Web Search Tool on Amazon Bedrock AgentCore vs SpecStream

Web Search Tool on Amazon Bedrock AgentCore 90

Graded on the hosted lines, for the Gateway endpoint and the connector agents call. AWS Health Dashboard with per-service, per-Region history (20). The dashboard's history file, re-read on 1 November 2026, names AgentCore in one event in the 90 days from 3 August, 2 hours 40 minutes of packet loss in one zone of eu-south-2 on 4 October 2026, marked informational and in a Region where Web Search is not sold. The us-west-2 events of 3 September and 30 October (API Gateway HTTP API) don't name AgentCore. Read as clean, as on the Memory listing (30). Quotas published and re-read on 1 November, 10 Web Search requests a second and 200 tool calls a second per gateway and per account (15). Owner-set gateway rate limits return an error body with retryAfter in seconds and searches have no side effects, but the response to the service's own Web Search quota is not documented (10 of 15). The AgentCore FAQ says the Amazon Bedrock SLA applies, but that SLA, last updated 4 October 2023, does not name AgentCore (5 of 10, as on the Code Interpreter listing). Generally available since 16 June 2026 (10).

SpecStream 23

Hosted reading, for the MCP server and REST API on api.specstream.ai. No public status page was found. None is linked from the site, llms.txt or the docs, llms-full.txt mentions none, and https://specstream.ai/status returned an error (0). No readable incident history, so the floor (5). No rate limit with numbers is published in the docs, llms.txt, llms-full.txt or the part of the OpenAPI file read; the privacy policy and DPA mention rate limiting without figures, and the published limits are per job (10,000 results a request, four-hour runs, 20,000 imported rows) (0). Nothing documents 429, Retry-After or backoff, but paid work requires an idempotency_key on authorize_capacity_work and POST /v1/capacity/executions, GET /v1/capacity/requests/{request_key} recovers the original find after an uncertain response, and the skills say never to quote again to recover a lost reply (8 of 15). No SLA on any plan, and the terms say 'We do not promise uninterrupted access' (0). No beta or preview label on the API, the MCP server or the SDKs, which PyPI classifies as production and stable at 1.2 (10). 0+5+0+8+0+10 = 23.

Web Search Tool on Amazon Bedrock AgentCore 30

No x402, MPP or L402 on the Gateway or the tool. AgentCore payments is a separate component for an agent paying third parties (0). Per-query price published without a login, $7.00 per 1,000, with a worked example that adds Gateway invocations at $0.005 per 1,000 (20). No Web Search allowance, but new AWS accounts get up to $200 in Free Tier credits and the Free Tier FAQ says most new customers need no payment method, so half, as on the other AWS listings (10). A person signs up in a browser and sets up a gateway, a target and IAM (0).

SpecStream 85

x402 v2 (USDC on Base, Arbitrum or Polygon, Permit2 upto for the quoted maximum, settled for the results cost) and MPP by card on SpecStream's own POST /v1/agent/lists, the route for buying a list of 1 to 500 results without an account; enrichment of imported lists, refreshes, monitors and investigations need an account, and the route was read in the docs and not exercised because api.specstream.ai's robots.txt could not be read, so partial (25). Per-result prices published without a login, 5, 15 or 100 cents a result, 5 cents an email, 15 cents a phone, rechecks at half rate or 1 cent (20). $10 of work for 30 days with no card (20). An agent can buy a list over x402 or MPP with no account, and the A2A endpoint prices a request without a key (20). 25+20+20+20 = 85.

Web Search Tool on Amazon Bedrock AgentCore 85

Gateway inbound auth is OAuth JWT from the owner's identity provider with allowed scopes advertised in the 401 challenge, or IAM SigV4 scoped to one gateway ARN, and the agent never holds a search credential (30). The tool only reads. The owner's target-level include and exclude lists cannot be relaxed by the agent, the service role's InvokeWebSearch names one service-owned ARN, and Cedar policies on the gateway can forbid the tool per caller. A no-authorisation gateway mode exists, with AWS's warning against production use (17 of 20). Results are third-party page text and the Web Search pages give no guidance on treating them as untrusted. Gateway guardrail policies can screen inputs for prompt attacks and suppress outputs, documented in general and not for this tool (7 of 15). CloudWatch metrics by method and tool name, and CloudTrail data events for InvokeGateway when the owner turns them on, at extra cost (13 of 15). A vulnerability disclosure programme on HackerOne, a security.txt that expires on 16 October 2027 (re-read on 1 November), and SOC and ISO 27001 among the programmes the AgentCore FAQ lists. No paid bounty found, so 2 held back as on every AWS listing (18 of 20).

SpecStream 73

API keys ss_live_... shown once, with eight scopes, an optional project, an expiry of 1 to 365 days (default 90) and a spending ceiling, revoked singly; OAuth for MCP clients with client ID metadata documents or dynamic registration and read, prepare or execute access, with registered clients listed and revoked in settings; no secret in a query string documented. The authorisation server metadata on api.specstream.ai was not read and rotation is not described beyond expiry (28 of 30). Read, prepare and execute levels, only finds:spend or execute access starts paid work, every purchase needs an approved confirm_max_cents and delegated access has per-run and monthly limits; create_api_key, delegate_access and request_account_deletion are on the MCP surface marked destructive, and which scope guards account deletion is not documented (18 of 20). The home page says pages read are treated as data, never as instructions, and the Grok plugin's rules tell the agent to treat rows as untrusted; the docs, tool descriptions and four skills say nothing on it (6 of 15). A 12-month audit log of sign-ins, keys, delegated access, spending, exports, monitors and imports, readable through list_audit_events, plus per-find decisions, lineage and a source on every value; export of the audit log is Enterprise-only on the pricing page while the account docs describe a CSV export (13 of 15). security.txt is valid until October 2027 with support@specstream.ai, and SECURITY.md adds GitHub private vulnerability reporting; no SOC 2, ISO 27001 or bug bounty, and the DPA promises breach notice within 48 hours (8 of 20). 28+18+6+13+8 = 73.

Web Search Tool on Amazon Bedrock AgentCore 77

Closed service under the AWS Customer Agreement and Service Terms, updated 30 October 2026, with an acceptable-use section on the docs page (15 of 30). The docs say queries are served inside AWS and not sent to a third-party engine, the Gateway data protection notes say data is encrypted with a service key or a customer managed key, and section 50.3 of the Service Terms does not list AgentCore for content use. No retention period for queries was found (15 of 30). The connector versions page sets out stages from available to deprecated and retired and promises a migration guide for a major version, without a notice period (12 of 20). A sub-processor list updated 30 October 2026 and a per-Region availability list, and the August release note says queries stay in their Region (18 of 20).

SpecStream 66

Closed hosted service under terms of 3 November 2026 naming SpecStream SAS, French law and a liability cap of the greater of 12 months' fees or 100 euros; the client code is MIT (20 of 30). The privacy policy and DPA agree with each other and the about page on EU hosting, no training on customer requests, lists or results, and a retention table (server logs 30 days, backups 8 days, page copies 24 hours, run working copies 7 days, audit log 12 months, support 3 years, accounts until deleted, erased from backups within 8 days of deletion), with breach notice in 48 hours and audit rights; the pricing page and the account docs disagree on who can export the audit log (27 of 30). No API deprecation policy; the changelog dates a price cut of 26 October 2026 that kept approved quotes at their old prices, the terms promise notice of material changes and keep historical quotes on their terms, and the DPA gives 30 days' notice of a new subprocessor (8 of 20). Subprocessors are listed by category with locations and transfer safeguards, hosting on IBM Cloud in Madrid is named in the legal notice, and names are available only on request (12 of 20). 20+27+8+12 = 67.

Web Search Tool on Amazon Bedrock AgentCore 75

One tool with a compact schema, and results are snippets AWS says are extracted for model context. Each result comes as a JSON string in a text block and again as structuredContent (22 of 25). maxResults 1 to 25, per-request domain include and exclude lists and published-date bounds from 1.2.0. No pagination, offset, country or language controls (15 of 20). JWT failures return 401 or 403 with a WWW-Authenticate header naming the scopes, and throttling returns retryAfter, but no error codes for the tool itself are documented (10 of 20). Searches only read, so retries are safe apart from the per-query charge. Connector 1.3.0 (19 October 2026, now the default) adds a title and readOnlyHint: true and openWorldHint: true to tools/list, per the connector versions page read on 1 November. No idempotentHint, and older pinned targets don't carry the annotations until updated (16 of 20, up from 12 when annotations were unconfirmed). Only query is required, and since the default moved from 1.1.0 to 1.3.0 a target created without a version gets the filters. A first call still needs a gateway, a target, a service role and inbound auth. Any MCP client calls it, and set-up runs through AWS SDKs in many languages (12 of 15, up from 10).

SpecStream 65

MCP reading. 128 tools at about 143,700 characters of names, descriptions and schemas (more than 30, 5), with no server-side toolsets or dynamic loading; the framework packages for LangChain, LlamaIndex, CrewAI and the Vercel AI SDK and the Open WebUI tool expose two to four tools with the price cap held in code, and results default to short evidence (5 back, 10 of 25). Cursor and limit on rows, search, specs and revisits, evidence short or full, filters by area and by field on collections, and unconfirmed candidates kept in a separate list (18 of 20). An ErrorEnvelope on every operation and an SDK error class that exposes code and details, but no published code list, meanings or retry rules (6 of 20). Required idempotency keys on paid work, schedules and refund claims with a recovery route, expected_version on updates, stable event ids on webhook retries, and readOnlyHint on 72 tools and destructiveHint on 29, with no idempotentHint (18 of 20). compile needs only q, a quote needs only ast_hash with 25 results by default, and official SDKs in Python and TypeScript with a CLI, though one purchase takes three calls with a hash carried between them (13 of 15). 10+18+6+18+13 = 65.