Security Enhancements

URL Validation for WebFetch

• WebFetch tool now requires URLs to be "provided directly by the user in the current or a previous message"
• Added URL extraction from user messages to maintain a whitelist of allowed URLs
• Prevents potential security issues from arbitrary URL fetching

Custom HTTP Headers Support

• New environment variable ANTHROPIC_CUSTOM_HEADERS for adding custom headers to API requests
• Supports multi-line header definitions with name: value format
• Useful for proxy authentication or custom API configurations