web-fetch-tool changedagents-and-tools/tool-use/web-fetch-tool
Nearest release: v2.1.304, published 6 hours before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+55added
Lines−3removed
From line
27
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits16to this page, all time
### URL sources
The whole hunk
from line 27, old and new numbered
/
from line 27
2727<Warning>
2828 Enabling the web fetch tool in environments where Claude processes untrusted input alongside sensitive data poses data exfiltration risks. Only use this tool in trusted environments or when handling non-sensitive data.
2929
30 To minimize exfiltration risks, Claude cannot fetch URLs that appear only in its own output. Claude can only fetch URLs that have previously appeared in the conversation: URLs in user messages, URLs in client-side tool results (even when a result echoes text that Claude generated), and URLs from previous web search or web fetch results (see [URL validation](https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-fetch-tool#url-validation)). Claude also cannot fetch a URL that appears to contain a credential, such as an API key or a password, unless that credential appears in the system prompt or in the text of a user message.
30 To minimize exfiltration risks, Claude cannot fetch URLs that appear only in its own output. Claude can only fetch URLs that have previously appeared in the conversation: URLs in user messages, URLs in client-side tool results, and URLs from previous web search or web fetch results (see [URL validation](https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-fetch-tool#url-validation)). Claude also cannot fetch a URL that appears to contain a credential, such as an API key or a password, unless that credential appears in the system prompt or in the text of a user message.
3131
3232 However, there is still residual risk that you should carefully consider when using this tool.
3333
from line 36
3636 * Disabling the web fetch tool entirely
3737 * Using the `max_uses` parameter to limit the number of requests
3838 * Using the `allowed_domains` parameter to restrict to known safe domains
39 * Using the `url_sources` parameter to stop client-side tool results from counting as a source (see [URL sources](https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-fetch-tool#url-sources))
3940</Warning>
4041
4142For model support, see the [Tool reference](https://platform.claude.com/docs/en/agents-and-tools/tool-use/tool-reference).
from line 429
428429 // Optional: Never fetch from these domains (cannot be combined with allowed_domains)
429430 "blocked_domains": ["private.example.com"],
430431
432 // Optional: Don't fetch URLs that appear only in client-side tool results
433 "url_sources": {
434 "client_tool_results": { "type": "none" }
435 },
436
431437 // Optional: Enable citations for fetched content
432438 "citations": {
433439 "enabled": true
from line 643
637643* `invalid_tool_input`: Invalid tool input, such as a malformed URL or a non-HTTP(S) scheme
638644* `url_too_long`: URL exceeds maximum length (250 characters)
639645* `url_not_allowed`: URL blocked by domain filtering rules (including your organization's settings) or by Anthropic-side restrictions, such as private addresses, `robots.txt`, and URLs that appear to contain a credential you did not provide
640* `url_not_in_prior_context`: URL did not appear earlier in the conversation (see [URL validation](https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-fetch-tool#url-validation))
646* `url_not_in_prior_context`: URL did not appear earlier in the conversation, or appeared only in sources that `url_sources` excludes (see [URL validation](https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-fetch-tool#url-validation))
641647* `url_not_accessible`: Failed to fetch content (HTTP error)
642648* `too_many_requests`: Rate limit exceeded
643649* `unsupported_content_type`: Content type not supported (only text, HTML, and PDF)
from line 658
652658* URLs in client-side tool results
653659* URLs from previous web search or web fetch results
654660
655The tool cannot fetch URLs that appear only in Claude's own output or only in the system prompt. To make a URL from the system prompt fetchable, also include it in a user message. Results of other server-side tools, such as [code execution](https://platform.claude.com/docs/en/agents-and-tools/tool-use/code-execution-tool), the [MCP connector](https://platform.claude.com/docs/en/agents-and-tools/mcp-connector), or [tool search](https://platform.claude.com/docs/en/agents-and-tools/tool-use/tool-search-tool), are not an allowed source either. Client-side tool results are an allowed source even when they echo text that Claude produced (for example, a command that prints its input, or an error message that quotes it).
661The tool cannot fetch URLs that appear only in Claude's own output or only in the system prompt. To make a URL from the system prompt fetchable, also include it in a user message. Results of other server-side tools, such as [code execution](https://platform.claude.com/docs/en/agents-and-tools/tool-use/code-execution-tool), the [MCP connector](https://platform.claude.com/docs/en/agents-and-tools/mcp-connector), or [tool search](https://platform.claude.com/docs/en/agents-and-tools/tool-use/tool-search-tool), are not an allowed source either. By default, client-side tool results are an allowed source even when they echo text that Claude produced (for example, a command that prints its input, or an error message that quotes it).
656662
657663The tool also refuses a URL that appears to contain a credential, such as an API key or a password, unless that credential appears in the system prompt or in the text of a user message. A credential that appears only in a tool result does not count. The result is a `url_not_allowed` error. To fetch such a URL, include it in a user message.
664
665### URL sources
666
667<Note>
668 Works with `web_fetch_20250910`, `web_fetch_20260209`, `web_fetch_20260309`, and `web_fetch_20260318`.
669</Note>
670
671The optional `url_sources` parameter lets you turn off any of the three allowed sources, or limit tool results to certain tools. It has one key per source, and each key defaults to `{"type": "all"}`:
672
673* `user_input`: URLs in user messages. Its `type` is `"all"` or `"none"`.
674* `client_tool_results`: URLs in client-side tool results. Its `type` is `"all"`, `"none"`, or an `"only"` or `"except"` filter that names tools, as in the following example.
675* `server_tool_results`: URLs from previous web search or web fetch results. It takes the same values, and its filters name `web_search` or `web_fetch`.
676
677For example, a tool that runs code Claude wrote returns whatever that code prints, including any URL Claude put in it. To stop that tool's results from counting as a source, name it in an `"except"` filter:
678
679```json
680{
681 "tools": [
682 {
683 "type": "web_fetch_20260318",
684 "name": "web_fetch",
685 "url_sources": {
686 "client_tool_results": {
687 "type": "except",
688 "tools": [{ "type": "tool_reference", "name": "run_code" }]
689 }
690 }
691 },
692 {
693 "name": "run_code",
694 "description": "Run Python code and return its output",
695 "input_schema": {
696 "type": "object",
697 "properties": { "code": { "type": "string" } },
698 "required": ["code"]
699 }
700 }
701 ]
702}
703```
704
705A filter lists tools as `tool_reference` objects. Each name must match a tool in the request's `tools` array: a client tool for `client_tool_results`, or a server tool for `server_tool_results`. Otherwise, the request fails with an error. Under `"except"`, a tool you add to `tools` later counts as a source. Under `"only"`, it doesn't.
706
707Client-side tools other than `run_code` can also return text Claude wrote, for example in an error message that quotes it. To exclude all client-side tool results, set `client_tool_results` to `{"type": "none"}`.
708
709If a URL appeared only in sources that `url_sources` excludes, fetching it returns the `url_not_in_prior_context` error.
658710
659711## Combined search and fetch
660712
No line in this hunk matches that.