Web search and web fetch changedthird-party/claude-desktop/web-tools
Nearest release: v2.1.283, published an hour after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 25 Sep 2026 17:09 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 28 Sep 2026 22:07 UTC.
Upstream edited
Recorded here
Lines+22added
Lines−22removed
From line
13
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits10to this page, all time
The whole hunk
from line 13, old and new numbered
/
from line 13
1313
1414Web Search is a **server-side tool** executed by your inference provider, not by the desktop app. Availability depends on which provider you've configured:
1515
16| Provider | Web Search |
17| ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
18| Google Cloud's Agent Platform | Available |
19| Microsoft Foundry | Available on both [hosting options](https://platform.claude.com/docs/en/build-with-claude/claude-in-microsoft-foundry#hosting-options) |
20| Amazon Bedrock | Not available natively; use the [built-in web search](#built-in-web-search) below |
21| Anthropic API | Available |
22| Gateway | Available if your gateway implements Anthropic's `web_search` server tool, passes it through to a provider that does, or runs the search itself; see [Gateway-side search](#gateway-side-search) |
16| Provider | Web Search |
17| - | - |
18| Google Cloud's Agent Platform | Available |
19| Microsoft Foundry | Available on both [hosting options](https://platform.claude.com/docs/en/build-with-claude/claude-in-microsoft-foundry#hosting-options) |
20| Amazon Bedrock | Not available natively; use the [built-in web search](#built-in-web-search) below |
21| Anthropic API | Available |
22| Gateway | Available if your gateway implements Anthropic's `web_search` server tool, passes it through to a provider that does, or runs the search itself; see [Gateway-side search](#gateway-side-search) |
2323
2424On Microsoft Foundry, Web Search works on both [hosting options](https://platform.claude.com/docs/en/build-with-claude/claude-in-microsoft-foundry#hosting-options) with no additional configuration. Deployments hosted on Azure support only the basic web search tool version (`web_search_20250305`), which is the version Claude Desktop uses; see [features not supported when hosted on Azure](https://platform.claude.com/docs/en/build-with-claude/claude-in-microsoft-foundry#additional-features-not-supported-when-hosted-on-azure) in the Claude in Microsoft Foundry documentation for what else differs when hosted on Azure. On any provider you can configure the [built-in web search](#built-in-web-search) to choose the search backend yourself. Once it is configured, the app stops offering provider-side search and routes the model's search calls to the built-in server. If you want no web search at all, add `"WebSearch"` to [`disabledBuiltinTools`](/docs/third-party/claude-desktop/configuration#disabledbuiltintools) instead. That entry also blocks the built-in web search tool, so do not combine the two.
2525
from line 35
3535
3636If your inference provider supports native search (Google Cloud's Agent Platform or Microsoft Foundry), that's the simplest path and no additional configuration is required. Use the built-in `websearch` server when your provider has no native search (Amazon Bedrock or a custom gateway), or with any provider when you want to choose the search backend.
3737
38| Option | Best for | Where you configure it | Search backend |
39| ------------------------------------------ | ---------------------------------------------------------------------------------------------- | ----------------------------- | -------------------------------------- |
40| [Provider-native](#provider-native-search) | Google Cloud's Agent Platform, Microsoft Foundry | Your cloud provider's console | The provider's |
41| [Built-in](#built-in-web-search) | Amazon Bedrock or a custom gateway; or any provider when you want to choose the search backend | `managedMcpServers` | Brave, Tavily, Exa, or your own server |
42| [Gateway-side](#gateway-side-search) | A custom gateway you already run | Your gateway's configuration | Whatever your gateway is wired to |
43| [Remote search MCP](#remote-search-mcp) | A search MCP you already run, or Amazon Bedrock AgentCore | `managedMcpServers` | Whatever that MCP exposes |
38| Option | Best for | Where you configure it | Search backend |
39| - | - | - | - |
40| [Provider-native](#provider-native-search) | Google Cloud's Agent Platform, Microsoft Foundry | Your cloud provider's console | The provider's |
41| [Built-in](#built-in-web-search) | Amazon Bedrock or a custom gateway; or any provider when you want to choose the search backend | `managedMcpServers` | Brave, Tavily, Exa, or your own server |
42| [Gateway-side](#gateway-side-search) | A custom gateway you already run | Your gateway's configuration | Whatever your gateway is wired to |
43| [Remote search MCP](#remote-search-mcp) | A search MCP you already run, or Amazon Bedrock AgentCore | `managedMcpServers` | Whatever that MCP exposes |
4444
4545#### Provider-native search
4646
from line 97
9797
9898Set the per-entry `toolPolicy` to `"allow"` so users aren't prompted to approve each search. `headersHelper` is an executable that prints the auth header as a JSON object to stdout; it follows the same execution model as [`inferenceCredentialHelper`](/docs/third-party/claude-desktop/credential-helper) (exit 0, stdout read as JSON) but always runs with no arguments, and the output here is a flat header map, not the `{token, headers}` shape `inferenceCredentialHelper` uses.
9999
100| Provider | Header your script should output |
101| -------- | ----------------------------------- |
102| `brave` | `{"X-Subscription-Token": "<key>"}` |
100| Provider | Header your script should output |
101| - | - |
102| `brave` | `{"X-Subscription-Token": "<key>"}` |
103103| `tavily` | `{"Authorization": "Bearer <key>"}` |
104| `exa` | `{"x-api-key": "<key>"}` |
104| `exa` | `{"x-api-key": "<key>"}` |
105105| `custom` | Whatever your search server expects |
106106
107107You can use a static `headers` object instead if you don't need a secrets manager.
from line 136
136136
137137By default, the sandbox can reach only your inference provider's endpoint, so Web Fetch will fail for any other host unless you've allowed it. To permit fetches:
138138
139| Goal | Set `coworkEgressAllowedHosts` to |
140| -------------------------------------- | --------------------------------------------------- |
141| Allow specific domains | `["docs.example.com", "*.example.corp"]` |
142| Allow all hosts (no sandbox filtering) | `["*"]` |
143| Block all fetches | `[]` and add `"WebFetch"` to `disabledBuiltinTools` |
139| Goal | Set `coworkEgressAllowedHosts` to |
140| - | - |
141| Allow specific domains | `["docs.example.com", "*.example.corp"]` |
142| Allow all hosts (no sandbox filtering) | `["*"]` |
143| Block all fetches | `[]` and add `"WebFetch"` to `disabledBuiltinTools` |
144144
145145Wildcards match one or more leading subdomain labels (`*.example.com` matches `a.example.com` and `a.b.example.com`, but not `example.com`).
146146
No line in this hunk matches that.