On October 2, 2026, AWS published a walkthrough of connecting Claude Desktop to Web Search through Amazon Bedrock AgentCore Gateway. The post describes Web Search as a managed, MCP-compatible capability backed by an Amazon web index. The description of the integration, including its authentication and connector settings, comes from that AWS walkthrough.

The connection described by AWS

AgentCore Gateway is the route to Web Search in the post’s Claude Desktop setup. The walkthrough gives separate roles to user authentication, token issuance and token validation. IAM Identity Center authenticates users, Cognito issues JWTs, and AgentCore Gateway validates those tokens on each request. Reading the steps in that order helps explain why the setup covers identity services as well as the gateway and the desktop connector.

The identity flow uses a Cognito federation layer. AWS describes an OAuth 2.0 authorization code grant flow with SAML authentication through IAM Identity Center. In the walkthrough, these are parts of the same route from user sign-in to a token presented to the gateway. The post therefore treats the identity configuration as part of making Web Search available through Claude Desktop, rather than as a separate example.

What the setup asks readers to configure

The instructions begin with a Cognito user pool that acts as the OIDC token issuer for AgentCore Gateway. They then call for an IAM Identity Center SAML application federated with Cognito. Users or groups are assigned access to Web Search through that application. These steps identify both where the gateway’s tokens originate and which users or groups receive access in the described arrangement.

The walkthrough next creates an AgentCore Gateway with Web Search and JWT-based inbound authorization. That gateway is the point at which the JWTs are validated, according to the post. The distinction between issuing a token and validating it matters when following the instructions: Cognito and the gateway have different jobs even though both appear in the access path.

Claude Desktop configuration and tool use

For the Claude Desktop connector, the post specifies Streamable HTTP, the gateway resource URL, and the ID and secret of a Cognito app client. Those settings connect the desktop application to the gateway and the identity flow described earlier in the walkthrough. They are concrete configuration items in the AWS example; the post’s described path depends on the gateway and Cognito settings being considered together.

AWS says Claude Desktop discovers WebSearchTool through an MCP tools/list call. Discovery tells the reader which tool appears to the client in this setup. The post also describes a separate approval dialog when the tool is executed. Its choices are Deny, Allow for this task, and Allow once. The distinction is useful when reading the walkthrough: seeing WebSearchTool in the tool list and choosing whether to execute it are separate stages in the described desktop experience.

Availability stated in the post

AWS lists US East (N. Virginia), Europe (Ireland), and Asia Pacific (Tokyo) as the Regions where AgentCore Web Search was available in the post. That list sets the geographic scope stated by this source at publication. It does not establish availability in other Regions.

Taken together, the AWS steps describe a sequence: assign user or group access, authenticate through the federated identity flow, issue a token with Cognito, validate it at AgentCore Gateway, and expose WebSearchTool to Claude Desktop through the configured connector. The sequence provides a way to read the components as one walkthrough while keeping their roles distinct. The configuration details and regional list appear in the AWS post.