AgentCore Web Answer: Setup, Filters, Pricing and Limits

AgentCore Web Answer is a managed tool on Amazon Bedrock AgentCore, generally available since November 5, 2026. Your agent sends one question through an AgentCore Gateway and gets back a synthesized answer with citations to current web sources. It costs $10 per 1,000 tool calls and runs in us-east-1.

Last updated: November 7, 2026

What AWS released on November 5, 2026
Web Answer compared with Web Search
How to set up Web Answer
Domain, date and country filters
What the response looks like
Pricing, regions, limits and rules
Frequently asked questions
Sources

What AWS released on November 5, 2026

The AWS What’s New post announced general availability of Web Answer on Amazon Bedrock AgentCore. It builds on Web Search on AgentCore, which launched in June, and moves the tool from finding web content to returning the finished answer.

According to the AWS launch walkthrough, Web Answer plans its own searches, runs several in parallel and reads key pages to check facts. If the evidence is not enough, it searches again. It then writes an answer that ties each claim to a source URL. Its model is given the current date, so it can look for up-to-date information.

The developer guide adds a privacy point. Web Answer searches a web index that Amazon builds and operates and writes the answer with a model on Amazon Bedrock. It does not send your questions to a third-party search engine.

Several other vendors added similar grounded search tools in recent weeks. For comparison, see our DeepSeek Search API guide and the web grounding section of our Perplexity Agent Ultra guide.

Web Answer compared with Web Search

AWS describes the dividing line as who runs the model. The table summarizes the official comparison from the blog post and docs.

	Web Search on AgentCore	Web Answer on AgentCore
What it returns	Ranked URLs, titles, snippets and publication dates	A synthesized markdown answer with inline citations and a list of cited URLs
Who synthesizes	Your agent’s own model	Web Answer runs the model, retrieval loop and attribution
Best for	Broad research where your model needs raw results	Specific factual sub-questions inside a larger task
Launch	June 2026	GA November 5, 2026
Access	AgentCore Gateway over MCP	AgentCore Gateway over MCP, connectorId `web-answer`

The practical benefit is less code to maintain. Your agent’s model does not have to process raw search results, and you do not maintain a search, page-fetch and synthesis pipeline.

How to set up Web Answer

The prerequisites are an AWS account with AgentCore Gateway access, a Gateway in us-east-1 that uses IAM (AWS_IAM) inbound authentication, an identity with bedrock-agentcore:InvokeGateway, and Python 3.10 or later. AWS warns that the walkthrough creates billable resources. The steps below follow the official walkthrough:

Install the packages: pip install boto3 strands-agents mcp mcp-proxy-for-aws.
Grant the Gateway service role the bedrock-agentcore:InvokeWebAnswer action on the AWS-owned resource arn:aws:bedrock-agentcore:us-east-1:aws:tool/web-answer.v1. The role does not need bedrock:InvokeModel.
Create a Gateway target with create_gateway_target on the bedrock-agentcore-control client. Set the connector source to {"connectorId": "web-answer"} and the credential provider type to GATEWAY_IAM_ROLE. No tool credentials are stored.
Wait until get_gateway_target reports the status READY.
Connect your agent to the Gateway’s MCP endpoint, call tools/list, and select the tool whose name ends with ___WebAnswer. If the Gateway uses semantic search, the x_amz_bedrock_agentcore_search tool may appear first, so do not rely on list position.
Call tools/call with a natural-language query and read the answer and citations.

The connector works with Strands Agents, LangChain, LangGraph, CrewAI or any MCP-compatible client. To use it from an AgentCore harness, attach the Gateway as an agentcore_gateway tool and grant the harness execution role bedrock-agentcore:InvokeGateway on the Gateway ARN. When you finish testing, delete the target, then the Gateway, then the role, to stop charges.

If you already use AWS agent tools such as Kiro, our Kiro auto approve guide covers related permission settings on the developer side.

Domain, date and country filters

Connector version 1.1.0 and later adds two layers of filtering, as described in the docs. On version 1.0.0 the schema accepts only query.

Target-level lists: the administrator sets parameterValues.domainFilter.include and exclude, up to 50 domains each. Agents cannot see these lists, and they apply to every request.
Request-level filters: the agent can pass filters.domainFilter and filters.publishedDateFilter with inclusive from and to bounds in ISO-8601, interpreted in UTC.
Country: userLocation.country takes a two-letter ISO 3166-1 code, such as DE, to refine results.

The merge rules matter. A domain is excluded if either list excludes it, and a root domain also matches its subdomains. If both include lists are set, only domains in both are used; if they share none, the request fails with a validation error. A from date later than to also fails. Queries can be 1 to 30,000 characters.

What the response looks like

Web Answer returns a standard MCP tool result with content, structuredContent, isError and _meta:

content[0].text is markdown, not JSON, with inline markers in the form [[N](url)].
structuredContent.answer is a list of blocks, each with text and a citations list of url and, when available, domain. It normally holds one block, but the docs say to read every block.
_meta.latencyMs reports server-side latency; the official example shows 5,210 ms.
When the tool cannot answer, isError is true and the text describes the problem.

Pricing, regions, limits and rules

Pricing: $10 per 1,000 tool calls. Gateway invocations are also billable.
Region: US East (N. Virginia) at launch, with more regions coming soon. Processing uses geographic cross-Region inference within a geography such as the US, EU or APAC.
Rate limit: 10 transactions per second per account in us-east-1; request increases through AWS Support.
Network and security: callers can reach the Gateway through the PrivateLink endpoint com.amazonaws.us-east-1.bedrock-agentcore.gateway, and CloudWatch metrics publish from the first call.
Acceptable use: you must keep and display the citations and links in any output shown to end users, and you may not extract results in bulk or build a competing index.

AWS also notes that Web Answer is not a substitute for professional advice, so review outputs before relying on them in regulated work. For another managed agent platform released this week, see our Mistral Managed Agents guide.

Frequently asked questions

What is AgentCore Web Answer?

Web Answer is a managed connector on Amazon Bedrock AgentCore Gateway. It takes a natural-language question, runs several web searches in parallel, reads relevant pages and returns a markdown answer with inline citations plus a structured list of cited URLs, all from one MCP tool call.

How much does AgentCore Web Answer cost?

AWS prices Web Answer at $10 per 1,000 tool calls. AgentCore Gateway invocations are billed as well, and your agent’s own model usage is separate, so the tool fee is only part of the total cost.

What is the difference between Web Answer and Web Search on AgentCore?

Web Search returns ranked URLs, titles, snippets and dates for your own model to reason over. Web Answer runs the retrieval loop, synthesis and citation work for you and returns a finished, cited answer. AWS expects many customers to use both.

Which regions support Web Answer?

At launch the connector is available in US East (N. Virginia), us-east-1, with more regions coming soon. It uses geographic cross-Region inference, so processing stays in supported commercial AWS Regions within a geography such as the US, EU or APAC.

Can I restrict which websites Web Answer uses?

Yes, in connector version 1.1.0 and later. Administrators set target-level include and exclude lists of up to 50 domains each. Agents can add per-request domain filters, a published-date range and a country, but cannot widen the administrator’s limits.

Do I need an API key for Web Answer?

No. Callers authenticate to the Gateway with IAM (SigV4) or a JSON Web Token. The Gateway calls Web Answer with its own service role, which needs the bedrock-agentcore:InvokeWebAnswer permission.

AgentCore Web Answer: Power-User Guide to Cited Web Answers

Table of contents