AWS Security ChangesHomeSearch

AWS bedrock-agentcore documentation change

Service: bedrock-agentcore · 2026-06-19 · Documentation low

File: bedrock-agentcore/latest/devguide/harness-tools.md

Summary

Added documentation for new AgentCore Web Search tool, restructured CLI examples, updated inline function examples, and modified navigation links.

Security assessment

The change introduces AgentCore Web Search as a new tool with explicit security benefits: 'Queries stay within AWS and are not sent to third-party search engines'. This documents a security feature but doesn't address a vulnerability. The credential handling example using Token Vault reinforces security best practices but isn't new.

Diff

diff --git a/bedrock-agentcore/latest/devguide/harness-tools.md b/bedrock-agentcore/latest/devguide/harness-tools.md
index 0798f09b3..8ac040549 100644
--- a//bedrock-agentcore/latest/devguide/harness-tools.md
+++ b//bedrock-agentcore/latest/devguide/harness-tools.md
@@ -9 +9 @@ Add toolsInline function calls
-# Connect to tools
+# Tools
@@ -11 +11 @@ Add toolsInline function calls
-Tools are declarative. You list what the agent can call; AgentCore handles invocation, credentials, and results. The harness supports five tool types, plus the built-in filesystem and shell tools.
+Tools are declarative. You list what the agent can call; AgentCore handles invocation, credentials, and results. The harness supports six tool types, plus the built-in filesystem and shell tools.
@@ -16,0 +17,2 @@ Tools are declarative. You list what the agent can call; AgentCore handles invoc
+  * **[AgentCore Web Search](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/web-search-tool.html):** Managed web search backed by an AWS-owned web index. Add `agentcore_web_search` as a tool and the agent can search the web with no API key or Gateway setup required. Queries stay within AWS and are not sent to third-party search engines.
+
@@ -52,47 +53,0 @@ Builtin glob |  `"file_*"` |  `file_operations`, `file_read`
-AgentCore CLI
-    
-
-When creating a new harness interactively, the `agentcore add harness` wizard lets you select tools. To add tools via the CLI, use `agentcore add tool` after creating the harness:
-
-###### Note
-
-The `--type` flag uses underscore-separated names (e.g., `agentcore_browser`), which match the tool type identifiers in `harness.json`.
-    
-    
-    # Add a remote MCP server
-    agentcore add tool --harness my-agent --type remote_mcp \
-      --name exa --url https://mcp.exa.ai/mcp
-    
-    # Add a remote MCP server with an API key from AgentCore Identity Token Vault.
-    # Use ${arn:...} syntax in header values to reference a credential provider.
-    agentcore add tool --harness my-agent --type remote_mcp \
-      --name exa-secure --url https://mcp.exa.ai/mcp \
-      --header 'x-api-key=${arn:aws:bedrock-agentcore:us-west-2:123456789012:token-vault/default/apikeycredentialprovider/my-exa-key}'
-    
-    # Add Browser
-    agentcore add tool --harness my-agent --type agentcore_browser --name browser
-    
-    # Add Code Interpreter
-    agentcore add tool --harness my-agent --type agentcore_code_interpreter --name code-interpreter
-    
-    # Add Gateway by ARN
-    agentcore add tool --harness my-agent --type agentcore_gateway \
-      --name my-gateway --gateway-arn arn:aws:bedrock-agentcore:us-west-2:123456789012:gateway/my-gateway
-    
-    # Add Gateway by project-local name
-    agentcore add tool --harness my-agent --type agentcore_gateway \
-      --name my-gateway --gateway my-gateway
-    
-    # Add an inline function tool (executes client-side, not on the harness VM)
-    agentcore add tool --harness my-agent --type inline_function \
-      --name approve_purchase \
-      --description "Request human approval for a purchase" \
-      --input-schema '{"type": "object", "properties": {"item": {"type": "string"}, "amount": {"type": "number"}}, "required": ["item", "amount"]}'
-
-Deploy to apply.
-
-Override tools on a single invocation:
-    
-    
-    agentcore invoke --harness research-agent --tools agentcore-browser "Find the latest news on AI agents"
-
@@ -156,0 +112,2 @@ Pass `tools` at create, update, or invoke time:
+        # AgentCore Web Search (managed web search via Gateway, no setup required)
+        {"type": "agentcore_web_search", "name": "web_search"},
@@ -186 +143 @@ Pass `tools` at create, update, or invoke time:
-## Inline function calls
+AgentCore CLI
@@ -188 +144,0 @@ Pass `tools` at create, update, or invoke time:
-Inline functions let you define a tool that executes in your code, not on the harness. This is useful for human-in-the-loop approvals, calling internal APIs, or any logic you want to control client-side.
@@ -190 +146 @@ Inline functions let you define a tool that executes in your code, not on the ha
-###### Example
+When creating a new harness interactively, the `agentcore add harness` wizard lets you select tools. To add tools via the CLI, use `agentcore add tool` after creating the harness:
@@ -192 +148 @@ Inline functions let you define a tool that executes in your code, not on the ha
-AgentCore CLI
+###### Note
@@ -193,0 +150 @@ AgentCore CLI
+The `--type` flag uses underscore-separated names (e.g., `agentcore_browser`), which match the tool type identifiers in `harness.json`.
@@ -195 +151,0 @@ AgentCore CLI
-Add an inline function tool to a harness:
@@ -196,0 +153,26 @@ Add an inline function tool to a harness:
+    # Add a remote MCP server
+    agentcore add tool --harness my-agent --type remote_mcp \
+      --name exa --url https://mcp.exa.ai/mcp
+    
+    # Add a remote MCP server with an API key from AgentCore Identity Token Vault.
+    # Use ${arn:...} syntax in header values to reference a credential provider.
+    agentcore add tool --harness my-agent --type remote_mcp \
+      --name exa-secure --url https://mcp.exa.ai/mcp \
+      --header 'x-api-key=${arn:aws:bedrock-agentcore:us-west-2:123456789012:token-vault/default/apikeycredentialprovider/my-exa-key}'
+    
+    # Add Browser
+    agentcore add tool --harness my-agent --type agentcore_browser --name browser
+    
+    # Add Code Interpreter
+    agentcore add tool --harness my-agent --type agentcore_code_interpreter --name code-interpreter
+    
+    # Add Web Search (managed web search via Gateway, no setup required)
+    agentcore add tool --harness my-agent --type agentcore_web_search --name web-search
+    
+    # Add Gateway by ARN
+    agentcore add tool --harness my-agent --type agentcore_gateway \
+      --name my-gateway --gateway-arn arn:aws:bedrock-agentcore:us-west-2:123456789012:gateway/my-gateway
+    
+    # Add Gateway by project-local name
+    agentcore add tool --harness my-agent --type agentcore_gateway \
+      --name my-gateway --gateway my-gateway
@@ -197,0 +180 @@ Add an inline function tool to a harness:
+    # Add an inline function tool (executes client-side, not on the harness VM)
@@ -199 +182,3 @@ Add an inline function tool to a harness:
-      --name get_weather
+      --name approve_purchase \
+      --description "Request human approval for a purchase" \
+      --input-schema '{"type": "object", "properties": {"item": {"type": "string"}, "amount": {"type": "number"}}, "required": ["item", "amount"]}'
@@ -201 +186 @@ Add an inline function tool to a harness:
-Then define the description and input schema in `app/my-agent/harness.json`:
+Deploy to apply.
@@ -202,0 +188 @@ Then define the description and input schema in `app/my-agent/harness.json`:
+Override tools on a single invocation:
@@ -204,14 +189,0 @@ Then define the description and input schema in `app/my-agent/harness.json`:
-    {
-      "type": "inline_function",
-      "name": "get_weather",
-      "config": {
-        "inlineFunction": {
-          "description": "Get the current weather for a city.",
-          "inputSchema": {
-            "type": "object",
-            "properties": { "city": { "type": "string" } },
-            "required": ["city"]
-          }
-        }
-      }
-    }
@@ -219 +191,7 @@ Then define the description and input schema in `app/my-agent/harness.json`:
-Run `agentcore deploy` to apply. When the agent calls the inline function during an invocation, the TUI pauses and prompts you to provide the tool result inline. In non-interactive (CLI) mode, the stream returns with `stopReason: "tool_use"` and you send the result back with a follow-up invoke call.
+    agentcore invoke --harness research-agent --tools agentcore-browser "Find the latest news on AI agents"
+
+## Inline function calls
+
+Inline functions let you define a tool that executes in your code, not on the harness. This is useful for human-in-the-loop approvals, calling internal APIs, or any logic you want to control client-side.
+
+###### Example
@@ -289,0 +268,29 @@ The agent resumes reasoning with the tool result and streams the final response.
+AgentCore CLI
+    
+
+Add an inline function tool to a harness:
+    
+    
+    agentcore add tool --harness my-agent --type inline_function \
+      --name get_weather
+
+Then define the description and input schema in `app/my-agent/harness.json`:
+    
+    
+    {
+      "type": "inline_function",
+      "name": "get_weather",
+      "config": {
+        "inlineFunction": {
+          "description": "Get the current weather for a city.",
+          "inputSchema": {
+            "type": "object",
+            "properties": { "city": { "type": "string" } },
+            "required": ["city"]
+          }
+        }
+      }
+    }
+
+Run `agentcore deploy` to apply. When the agent calls the inline function during an invocation, the TUI pauses and prompts you to provide the tool result inline. In non-interactive (CLI) mode, the stream returns with `stopReason: "tool_use"` and you send the result back with a follow-up invoke call.
+
@@ -303 +310 @@ Learn more about each tool:
-  * [Configure agents and models](./harness-config-and-models.html) \- configure models and override per invocation
+  * [Models and instructions](./harness-models.html) \- configure models and override per invocation
@@ -305 +312 @@ Learn more about each tool:
-  * [Environment and Skills](./harness-environment.html) \- bring your own container and run shell commands
+  * [Environment and filesystem](./harness-environment.html) \- bring your own container and run shell commands
@@ -320 +327 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please
-Configure agents and models
+Models and instructions
@@ -322 +329 @@ Configure agents and models
-Memory and filesystem
+Skills