What
web_fetch now enforces a provenance check — it can only retrieve URLs that appeared in a user message or a prior web_fetch result. Attempts to fetch URLs outside this set present a permission prompt asking the user to approve.
Details
- If the user approves, the fetch proceeds; if denied or timed out, Claude receives an error
- Timeout message: "The permission request for this URL was not answered in time. Ask the user to approve the fetch or include the URL in a message, then try again."
- The error type is
PROVENANCE_REQUIRED - Suppressed in bypassPermissions and dontAsk modes
Evidence
Provenance enforcement and prompt (search for "URL not in provenance set. web_fetch can only retrieve URLs that appeared in a user message")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.