AWS bedrock-agentcore documentation change
Summary
Added documentation for new AgentCore Web Search tool, restructured CLI examples, updated inline function examples, and modified navigation links.
Security assessment
The change introduces AgentCore Web Search as a new tool with explicit security benefits: 'Queries stay within AWS and are not sent to third-party search engines'. This documents a security feature but doesn't address a vulnerability. The credential handling example using Token Vault reinforces security best practices but isn't new.
Diff
diff --git a/bedrock-agentcore/latest/devguide/harness-tools.md b/bedrock-agentcore/latest/devguide/harness-tools.md index 0798f09b3..8ac040549 100644 --- a//bedrock-agentcore/latest/devguide/harness-tools.md +++ b//bedrock-agentcore/latest/devguide/harness-tools.md @@ -9 +9 @@ Add toolsInline function calls -# Connect to tools +# Tools @@ -11 +11 @@ Add toolsInline function calls -Tools are declarative. You list what the agent can call; AgentCore handles invocation, credentials, and results. The harness supports five tool types, plus the built-in filesystem and shell tools. +Tools are declarative. You list what the agent can call; AgentCore handles invocation, credentials, and results. The harness supports six tool types, plus the built-in filesystem and shell tools. @@ -16,0 +17,2 @@ Tools are declarative. You list what the agent can call; AgentCore handles invoc + * **[AgentCore Web Search](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/web-search-tool.html):** Managed web search backed by an AWS-owned web index. Add `agentcore_web_search` as a tool and the agent can search the web with no API key or Gateway setup required. Queries stay within AWS and are not sent to third-party search engines. + @@ -52,47 +53,0 @@ Builtin glob | `"file_*"` | `file_operations`, `file_read` -AgentCore CLI - - -When creating a new harness interactively, the `agentcore add harness` wizard lets you select tools. To add tools via the CLI, use `agentcore add tool` after creating the harness: - -###### Note - -The `--type` flag uses underscore-separated names (e.g., `agentcore_browser`), which match the tool type identifiers in `harness.json`. - - - # Add a remote MCP server - agentcore add tool --harness my-agent --type remote_mcp \ - --name exa --url https://mcp.exa.ai/mcp - - # Add a remote MCP server with an API key from AgentCore Identity Token Vault. - # Use ${arn:...} syntax in header values to reference a credential provider. - agentcore add tool --harness my-agent --type remote_mcp \ - --name exa-secure --url https://mcp.exa.ai/mcp \ - --header 'x-api-key=${arn:aws:bedrock-agentcore:us-west-2:123456789012:token-vault/default/apikeycredentialprovider/my-exa-key}' - - # Add Browser - agentcore add tool --harness my-agent --type agentcore_browser --name browser - - # Add Code Interpreter - agentcore add tool --harness my-agent --type agentcore_code_interpreter --name code-interpreter - - # Add Gateway by ARN - agentcore add tool --harness my-agent --type agentcore_gateway \ - --name my-gateway --gateway-arn arn:aws:bedrock-agentcore:us-west-2:123456789012:gateway/my-gateway - - # Add Gateway by project-local name - agentcore add tool --harness my-agent --type agentcore_gateway \ - --name my-gateway --gateway my-gateway - - # Add an inline function tool (executes client-side, not on the harness VM) - agentcore add tool --harness my-agent --type inline_function \ - --name approve_purchase \ - --description "Request human approval for a purchase" \ - --input-schema '{"type": "object", "properties": {"item": {"type": "string"}, "amount": {"type": "number"}}, "required": ["item", "amount"]}' - -Deploy to apply. - -Override tools on a single invocation: - - - agentcore invoke --harness research-agent --tools agentcore-browser "Find the latest news on AI agents" - @@ -156,0 +112,2 @@ Pass `tools` at create, update, or invoke time: + # AgentCore Web Search (managed web search via Gateway, no setup required) + {"type": "agentcore_web_search", "name": "web_search"}, @@ -186 +143 @@ Pass `tools` at create, update, or invoke time: -## Inline function calls +AgentCore CLI @@ -188 +144,0 @@ Pass `tools` at create, update, or invoke time: -Inline functions let you define a tool that executes in your code, not on the harness. This is useful for human-in-the-loop approvals, calling internal APIs, or any logic you want to control client-side. @@ -190 +146 @@ Inline functions let you define a tool that executes in your code, not on the ha -###### Example +When creating a new harness interactively, the `agentcore add harness` wizard lets you select tools. To add tools via the CLI, use `agentcore add tool` after creating the harness: @@ -192 +148 @@ Inline functions let you define a tool that executes in your code, not on the ha -AgentCore CLI +###### Note @@ -193,0 +150 @@ AgentCore CLI +The `--type` flag uses underscore-separated names (e.g., `agentcore_browser`), which match the tool type identifiers in `harness.json`. @@ -195 +151,0 @@ AgentCore CLI -Add an inline function tool to a harness: @@ -196,0 +153,26 @@ Add an inline function tool to a harness: + # Add a remote MCP server + agentcore add tool --harness my-agent --type remote_mcp \ + --name exa --url https://mcp.exa.ai/mcp + + # Add a remote MCP server with an API key from AgentCore Identity Token Vault. + # Use ${arn:...} syntax in header values to reference a credential provider. + agentcore add tool --harness my-agent --type remote_mcp \ + --name exa-secure --url https://mcp.exa.ai/mcp \ + --header 'x-api-key=${arn:aws:bedrock-agentcore:us-west-2:123456789012:token-vault/default/apikeycredentialprovider/my-exa-key}' + + # Add Browser + agentcore add tool --harness my-agent --type agentcore_browser --name browser + + # Add Code Interpreter + agentcore add tool --harness my-agent --type agentcore_code_interpreter --name code-interpreter + + # Add Web Search (managed web search via Gateway, no setup required) + agentcore add tool --harness my-agent --type agentcore_web_search --name web-search + + # Add Gateway by ARN + agentcore add tool --harness my-agent --type agentcore_gateway \ + --name my-gateway --gateway-arn arn:aws:bedrock-agentcore:us-west-2:123456789012:gateway/my-gateway + + # Add Gateway by project-local name + agentcore add tool --harness my-agent --type agentcore_gateway \ + --name my-gateway --gateway my-gateway @@ -197,0 +180 @@ Add an inline function tool to a harness: + # Add an inline function tool (executes client-side, not on the harness VM) @@ -199 +182,3 @@ Add an inline function tool to a harness: - --name get_weather + --name approve_purchase \ + --description "Request human approval for a purchase" \ + --input-schema '{"type": "object", "properties": {"item": {"type": "string"}, "amount": {"type": "number"}}, "required": ["item", "amount"]}' @@ -201 +186 @@ Add an inline function tool to a harness: -Then define the description and input schema in `app/my-agent/harness.json`: +Deploy to apply. @@ -202,0 +188 @@ Then define the description and input schema in `app/my-agent/harness.json`: +Override tools on a single invocation: @@ -204,14 +189,0 @@ Then define the description and input schema in `app/my-agent/harness.json`: - { - "type": "inline_function", - "name": "get_weather", - "config": { - "inlineFunction": { - "description": "Get the current weather for a city.", - "inputSchema": { - "type": "object", - "properties": { "city": { "type": "string" } }, - "required": ["city"] - } - } - } - } @@ -219 +191,7 @@ Then define the description and input schema in `app/my-agent/harness.json`: -Run `agentcore deploy` to apply. When the agent calls the inline function during an invocation, the TUI pauses and prompts you to provide the tool result inline. In non-interactive (CLI) mode, the stream returns with `stopReason: "tool_use"` and you send the result back with a follow-up invoke call. + agentcore invoke --harness research-agent --tools agentcore-browser "Find the latest news on AI agents" + +## Inline function calls + +Inline functions let you define a tool that executes in your code, not on the harness. This is useful for human-in-the-loop approvals, calling internal APIs, or any logic you want to control client-side. + +###### Example @@ -289,0 +268,29 @@ The agent resumes reasoning with the tool result and streams the final response. +AgentCore CLI + + +Add an inline function tool to a harness: + + + agentcore add tool --harness my-agent --type inline_function \ + --name get_weather + +Then define the description and input schema in `app/my-agent/harness.json`: + + + { + "type": "inline_function", + "name": "get_weather", + "config": { + "inlineFunction": { + "description": "Get the current weather for a city.", + "inputSchema": { + "type": "object", + "properties": { "city": { "type": "string" } }, + "required": ["city"] + } + } + } + } + +Run `agentcore deploy` to apply. When the agent calls the inline function during an invocation, the TUI pauses and prompts you to provide the tool result inline. In non-interactive (CLI) mode, the stream returns with `stopReason: "tool_use"` and you send the result back with a follow-up invoke call. + @@ -303 +310 @@ Learn more about each tool: - * [Configure agents and models](./harness-config-and-models.html) \- configure models and override per invocation + * [Models and instructions](./harness-models.html) \- configure models and override per invocation @@ -305 +312 @@ Learn more about each tool: - * [Environment and Skills](./harness-environment.html) \- bring your own container and run shell commands + * [Environment and filesystem](./harness-environment.html) \- bring your own container and run shell commands @@ -320 +327 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Configure agents and models +Models and instructions @@ -322 +329 @@ Configure agents and models -Memory and filesystem +Skills