AgentCore web search adds domain filters: allowlist your agent

AWS added domain filtering and published-date filtering to web search in Bedrock AgentCore on August 19, and expanded the tool to Ireland and Tokyo. The feature reads like a small parameter update. It's actually the difference between an agent that researches and an agent that repeats whatever it found.

What actually happened

Per the AWS announcement, agents can now pass include and exclude domain lists on a per-call basis, up to 100 domains per list. Published-date filtering constrains results to a time window using inclusive from and to bounds. Separately, administrators get gateway-level allowlists, so the constraint doesn't have to live in the prompt or the agent code.

Regions went from one to three: US East (N. Virginia), Europe (Ireland), and Asia Pacific (Tokyo). AWS positions the filtering at regulated industries and research workflows, which is accurate and undersells it.

Web search on AgentCore reached general availability in June and is exposed as a built-in connector target on the AgentCore gateway over MCP. Your agent sends a natural-language query; it gets back ranked results with snippets, source URLs, titles, and publication dates.

Why constraining agent retrieval matters for your business

Retrieval is an injection surface. An agent that can search the open web can be steered by anything it retrieves. Content farms, SEO spam, and pages written specifically to be read by agents all land in the same result list as the vendor documentation you actually wanted. A domain allowlist doesn't make prompt injection impossible, but it shrinks the set of authors who get to talk to your model from "the internet" to a list you approved.

Date bounds are a correctness control, not a nicety. Ask an agent about pricing, API syntax, or a regulation and it will happily cite a 2023 blog post that ranked well. Bounding results to the last ninety days is often the single cheapest accuracy improvement available, and it costs one parameter.

Put the constraint at the gateway, not in the prompt. This is the part worth acting on. A domain list inside a prompt is a suggestion — it survives until someone edits the prompt, forks the agent, or lets the model decide it needs broader sources. A gateway allowlist is configuration: it applies to every agent behind it, it's reviewable, and it doesn't drift. Same reason you don't enforce database access with a code comment.

And know what you're standardizing on. This lands through the AgentCore gateway over MCP, which is the good news — the filtering semantics live in the tool contract rather than in AWS-only glue. The retrieval index itself is Amazon's, and it isn't portable. Build your agent so the search tool is swappable and the policy about what it may read lives in your config, not the vendor's.

Sources: AWS: Web Search in Amazon Bedrock AgentCore, AWS News Blog: Announcing Web Search on Amazon Bedrock AgentCore.