Build a daily dependency watcher with LangGraph and Amazon Bedrock

Amazon Web Services launched the Web Search API in Amazon Bedrock AgentCore, providing AI agents and applications with current, cited web results through a single programmatic call signed with native AWS credentials. According to AWS Machine Learning Blog's report, queries run against a web index operated directly by Amazon rather than third-party search engines, ensuring sensitive search queries remain inside an organization's cloud environment. The managed interface eliminates separate search engine subscriptions and API keys while returning structured metadata including page titles, URLs, publication dates, and extracted query snippets.

This report examines how security engineering teams can implement an automated daily dependency watcher that monitors open-source ecosystems using LangGraph orchestration and Bedrock AgentCore. It provides software architects, security analysts, and platform engineers with concrete technical patterns for running parallel package investigations across ecosystems, enforcing hard guardrails in code, validating citations against raw search artifacts, and deploying runtime workflows through enterprise gateways.

01Web Search API in Amazon Bedrock AgentCore

The Web Search API in Amazon Bedrock AgentCore gives applications direct access to an Amazon-maintained web index using standard AWS Signature Version 4 authentication. Calls integrate with runtime environments including AWS Lambda, Amazon Elastic Container Service, and the Bedrock AgentCore runtime, inheriting existing IAM execution roles rather than requiring dedicated credential rotation.

Enterprise administrators can centralize governance through AgentCore Gateway, applying consistent source domain policies across multiple autonomous agents and Model Context Protocol clients. The API supports publication date filtering alongside explicit domain inclusion or exclusion rules to prevent untrusted sources from reaching reasoning engines.

LangChain developers access this capability through the AgentCore web search tool inside the langchain-aws integration. The tool returns results both as text context for model reasoning and as structured data artifacts that programmatic application code can inspect and validate.

02Parallel research branches across package ecosystems

The daily dependency watcher deploys an automated LangGraph graph that monitors vulnerabilities across three specific targets: npm packages, PyPI libraries, and container base images. A central fan_out step initiates independent research branches concurrently using LangGraph's Send API rather than evaluating package ecosystems in sequence.

Within each branch, an Anthropic Claude model hosted on Amazon Bedrock analyzes watchlist entries and determines specific search strategies. Each branch operates its own isolated toolkit instance, executing up to four targeted web searches before producing structured Pydantic findings instead of unformatted natural language text.

Parallel graph execution significantly reduces operational latency during automated morning scans. In benchmark testing, running the three research branches concurrently completed in 36 seconds of total wall time, compared to 99 seconds required when executing the ecosystem passes sequentially.

03Hardcoded runtime rules and search tool configuration

System integrity relies on keeping guardrail enforcement entirely in code rather than trusting model prompt compliance. The langchain-aws toolkit accepts deterministic configuration parameters that models cannot alter or override during execution, including domain blocklists, date windows, and a strict per-branch cap of four queries.

Setting the model_filters parameter to false strips out model control over search boundaries, restricting the Claude model's tool input exclusively to the search query string. Every HTTP request automatically appends the administrative domain blocklist and publication date floor before signing with SigV4 credentials.

A complete run across the three branches makes at most 12 total search calls, controlling per-use Bedrock AgentCore billing. The toolkit returns raw query responses as structured data artifacts, ensuring downstream evaluation steps have access to original search payloads for validation.

04Four programmatic evidence checks for security findings

Before any branch returns its findings, programmatic logic executes four automated verification checks against the raw search artifacts returned by Bedrock AgentCore. These checks confirm that the cited URL originated from that branch's search results and verify that the source document explicitly includes the target package name as a whole word.

The validation code checks whether any stated CVE or advisory identifier appears directly in the source text, while confirming the publication date falls within the designated watch window. Undated documents are treated as out-of-window and dropped automatically, ensuring stale or unverified alerts do not propagate.

These automated gates prevent hallucinated advisory IDs, unsupported URLs, and out-of-window disclosures from reaching security engineers. In benchmark evaluation, the evidence filter dropped two invalid findings—one missing the package name in source text and another containing an unverified CVE identifier—ensuring only evidenced claims advanced.

05LangGraph deduplication store and reporting table

Following branch completion, LangGraph aggregates all surviving findings and triggers a deduplication node named keep_new. This step evaluates findings against the persistent LangGraph store to verify whether an issue was previously recorded, preventing redundant alerts for known package advisories.

The final report step formats newly discovered vulnerabilities into a cited summary table for security teams. Structured fields detail package names, advisory identifiers, stated severity, reported exploitation status, recommended remediation steps, and corresponding source URLs.

Because index publication dates may reference older vulnerabilities and search text does not confirm affected version ranges or exploitation status, teams must verify findings against authoritative vulnerability databases. Operating the watcher requires boto3 1.43.127 or later, bedrock-agentcore 1.26.0 or later, and langchain-aws 1.9.3 or later on Python 3.10.