Web search and web fetch changedthird-party/claude-desktop/web-tools
Nearest release: v2.1.318, published 2 hours after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 3 Nov 2026 19:00 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 3 Nov 2026 19:07 UTC.
Upstream edited
Recorded here
Lines+23added
Lines−2removed
From line
160
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits15to this page, all time
#### Unset allowlist in Code sessions
The whole hunk
from line 160, old and new numbered
/
from line 160
160160
161161* **Web Fetch**: each host you list becomes a Claude Code `WebFetch` allow rule. The key doesn't block a fetch to another host. In Auto mode, which new Code sessions start in by default, and in bypass permissions mode, Claude Code doesn't ask the user before that fetch. For the other modes, see [WebFetch tool behavior](https://code.claude.com/docs/en/tools-reference#webfetch-tool-behavior).
162162* **Web Fetch controls**: to have the user approve every fetch, set `WebFetch` to `"ask"` in [`builtinToolPolicy`](https://claude.com/docs/third-party/claude-desktop/configuration#builtintoolpolicy), which also applies in Cowork and Chat. To remove the tool, see [Disabling web tools](#disabling-web-tools).
163* **Shell commands**: commands that run in [Claude Code's sandbox](https://claude.com/docs/third-party/claude-desktop/code.md#applied-as-managed-policy) reach only the hosts you list, and no host while the key is unset or empty. On Windows, and on Linux without Claude Code's sandbox dependencies, shell commands run unsandboxed and can reach any host your network allows. To keep Code off such devices, see [Disabling Code](https://claude.com/docs/third-party/claude-desktop/code.md#disabling-code). For SSH hosts, see [Sandbox status on the remote host](https://claude.com/docs/third-party/claude-desktop/ssh-remote-sessions.md#sandbox-status-on-the-remote-host).
163* **Shell commands**: commands that run in [Claude Code's sandbox](https://claude.com/docs/third-party/claude-desktop/code.md#applied-as-managed-policy) reach only the hosts you list, and no host while the list is empty. For a key that isn't set, see [Unset allowlist in Code sessions](#unset-allowlist-in-code-sessions). On Windows, and on Linux without Claude Code's sandbox dependencies, shell commands run unsandboxed and can reach any host your network allows. To keep Code off such devices, see [Disabling Code](https://claude.com/docs/third-party/claude-desktop/code.md#disabling-code). For SSH hosts, see [Sandbox status on the remote host](https://claude.com/docs/third-party/claude-desktop/ssh-remote-sessions.md#sandbox-status-on-the-remote-host).
164164
165While the key is unset, Claude Desktop turns on Claude Code's sandbox, including on a device that you set up yourself, for example with your own API key. On a device where the sandbox runs, the **Local sandbox** and **Strict sandbox mode** switches under **Settings > Claude Code** are on and locked, and the app says that your organization manages them. To let shell commands reach a host, add it to `coworkEgressAllowedHosts` in your configuration. On a device that you set up yourself, open the [in-app configuration window](https://claude.com/docs/third-party/claude-desktop/in-app-configuration.md), go to **Capabilities**, add the host under **Allowed egress hosts**, click **Apply Changes**, and then click **Save & Restart**.
165#### Unset allowlist in Code sessions
166
167The [in-app configuration window](https://claude.com/docs/third-party/claude-desktop/in-app-configuration.md) shows `coworkEgressAllowedHosts` as **Allowed egress hosts**, an unset key as **Not set**, and an empty list (`[]`) as **Allow none**. Where [Claude Code's sandbox](https://claude.com/docs/third-party/claude-desktop/code.md#applied-as-managed-policy) doesn't run, such as a Code session on Windows, shell commands run unsandboxed and can reach any host your network allows, whatever the key holds. To keep Code off those devices, see [Disabling Code](https://claude.com/docs/third-party/claude-desktop/code.md#disabling-code).
168
169When you deliver configuration through the Enterprise Admin Console, a bootstrap server, or a [managed source](https://claude.com/docs/third-party/claude-desktop/configuration-format.md#where-claude-desktop-reads-configuration-on-a-device) such as an MDM profile, an unset key turns on Claude Code's sandbox. Where the sandbox runs, shell commands in it reach no host, and the **Local sandbox** and **Strict sandbox mode** toggles under **Settings > Claude Code** are on and locked. To let shell commands reach a host, add it to `coworkEgressAllowedHosts` in your configuration.
170
171> [!WARNING]
172>
173> On a device whose only configuration is the local configuration file, including a file that you copy to the device with a script, an unset key doesn't turn on the sandbox by itself. Unless [`blockReadsOutsideWorkingDirectories`](https://claude.com/docs/third-party/claude-desktop/configuration#blockreadsoutsideworkingdirectories) is `true`, Claude Desktop doesn't limit the hosts that shell commands in Code sessions reach. Enrolling the device in MDM doesn't change that. What counts is a [managed source](https://claude.com/docs/third-party/claude-desktop/configuration-format.md#where-claude-desktop-reads-configuration-on-a-device) for Claude Desktop itself.
174>
175> To turn the sandbox on with no host allowed, set `coworkEgressAllowedHosts` to `[]` in the file. The device's user can edit the file, so to hold the setting, deliver the configuration from a managed source.
176
177If you set up the device yourself in the in-app configuration window ([single-machine setup](https://claude.com/docs/third-party/claude-desktop/installation.md#single-machine-setup)) and left **Allowed egress hosts** at **Not set**, go to **Settings > Claude Code** and check the **Local sandbox** toggle:
178
179* **The toggle is unlocked**: Code sessions follow your own Claude Code settings. While the toggle is off, shell commands run unsandboxed, and the session's permission mode and permission rules decide whether Claude Code asks you before it runs one. In Auto mode, the default for new Code sessions where the model supports it, a safety classifier decides instead of asking you. To run a local session's commands in the sandbox, turn on the toggle.
180* **The toggle is on and locked**: something else keeps the sandbox on, for example:
181 * **A [managed source](https://claude.com/docs/third-party/claude-desktop/configuration-format.md#where-claude-desktop-reads-configuration-on-a-device) on the device**: shell commands reach no host
182 * **Block reads outside working directories** turned on: shell commands reach no host
183 * **Allowed workspace folders** set, with neither of the other two: Claude Desktop doesn't limit the hosts, and [Claude Code's sandbox](https://code.claude.com/docs/en/sandboxing) decides which ones shell commands reach
184* **The toggle is missing, or is off and can't be changed**: the sandbox doesn't run on the device, so shell commands in local sessions run unsandboxed
185
186For what a list of hosts does, see [How the egress allowlist applies in Code sessions](#how-the-egress-allowlist-applies-in-code-sessions). To change the list, open the in-app configuration window, go to **Capabilities**, edit **Allowed egress hosts**, click **Apply Changes**, and then click **Save & Restart**. Removing the last host leaves **Allow none** selected, which allows no host. To unset the key again, select **Not set** once the list is empty.
166187
167188## Disabling web tools
168189
No line in this hunk matches that.