To connect Web Answer to an agent, add it as a target to an existing Amazon Bedrock AgentCore Gateway, grant the required permissions, wait for the target to reach READY, then call it through an MCP-compatible client. The steps below follow AWS’s setup guide and suit developers who already have an AgentCore Gateway.

What Web Answer returns

Web Answer retrieves and synthesizes information into an answer with citations. Web Search returns ranked results for your own model to process, so the choice depends on whether you want a finished cited answer or raw results to handle yourself.

AgentCore toolOutputWho synthesizes the informationSuitable task
Web SearchRanked URLs, titles, snippets, and metadataYour modelProcessing raw search results in your own workflow
Web AnswerA synthesized answer with citationsWeb AnswerGiving an agent a cited factual answer as a subtask

Check the prerequisites

AWS’s walkthrough uses an existing AgentCore Gateway in us-east-1 with IAM (AWS_IAM) inbound authentication. Before configuring the target, make sure you have:

  • An identity allowed to call the Gateway with bedrock-agentcore:InvokeGateway on that Gateway.
  • Access for the agent to the Bedrock model it will use.
  • Python 3.10 or later, plus boto3, strands-agents, mcp, and mcp-proxy-for-aws for AWS’s example setup.

IAM, or AWS Identity and Access Management, controls who can access a resource. Here, a Gateway caller’s permission and the Gateway service role’s permission govern different parts of the connection.

Add Web Answer to the Gateway

AWS’s Web Answer demonstration shows the target being added, a question entered in the AgentCore playground, and a response with citations.
  1. Allow the Gateway service role to invoke Web Answer. Attach an inline policy granting bedrock-agentcore:InvokeWebAnswer on arn:aws:bedrock-agentcore:us-east-1:aws:tool/web-answer.v1. This is the Gateway’s permission to call the tool, separate from the caller’s bedrock-agentcore:InvokeGateway permission. AWS says the Gateway service role does not need bedrock:InvokeModel for the agent’s model.
  2. Create the connector target. In AWS’s example, the bedrock-agentcore-control client runs in us-east-1; the target uses connectorId set to web-answer and GATEWAY_IAM_ROLE for outbound authentication. That lets the Gateway use its service role for the connector rather than separate credentials.
  3. Set domain bounds if needed, then wait for readiness. A Gateway administrator can define included or excluded domains at the target level. A call can narrow those bounds, but an agent cannot use its call-level filter to widen them. Before invoking the target, check get_gateway_target and wait until its status is READY.
Keep the two IAM checks separate: one lets a caller reach the Gateway; the other lets the Gateway invoke Web Answer.

Call Web Answer over MCP and inspect the citations

MCP, the Model Context Protocol, lets a compatible client discover and call tools exposed through the Gateway. Use tools/list to find the target, then tools/call to invoke it. AWS’s Strands Agents example names the tool web-answer-tool___WebAnswer.

The response includes Markdown text with inline citations and structured answer data under structuredContent.answer, including a citations list. Check both the answer and its citation data in the client that consumes the response.

AWS’s stated price and request limit

AWS lists Web Answer at $10 per 1,000 tool calls. Gateway usage is also billable, so that figure does not represent the total cost of a deployment. AWS states a limit of 10 transactions per second per account in us-east-1 and says customers can request an increase through AWS Support.

When the connector is no longer needed, delete its target. If the Gateway was created only for the walkthrough, AWS’s cleanup sequence is to delete its targets before removing the Gateway, service role, and policy.