Source Intelligence
Follow Discord

DisclaimerUnofficial, and not affiliated with Anthropic. Nearly all of this is read straight out of what ships: npm bundles, captured prompts, published docs. Anthropic's own notes go in verbatim, marked as theirs. The rest is my reading, and every entry carries the strings behind it. If one looks wrong, vote it down and say why.

← All of v2.1.172 Home All releases ←olderv2.1.170 v2.1.173newer→
Claude Code v2.1.172

URL Provenance Check for web_fetch

What

web_fetch now enforces a provenance check — it can only retrieve URLs that appeared in a user message or a prior web_fetch result. Attempts to fetch URLs outside this set present a permission prompt asking the user to approve.

Details
  • If the user approves, the fetch proceeds; if denied or timed out, Claude receives an error
  • Timeout message: "The permission request for this URL was not answered in time. Ask the user to approve the fetch or include the URL in a message, then try again."
  • The error type is PROVENANCE_REQUIRED
  • Suppressed in bypassPermissions and dontAsk modes
Evidence

Provenance enforcement and prompt (search for "URL not in provenance set. web_fetch can only retrieve URLs that appeared in a user message")

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

See this entry in the whole of v2.1.172 →