{"version":"2.1.172","anchor":"url-provenance-check-for-web-fetch","canonical_anchor":"url-provenance-check-for-web-fetch","heading":"URL Provenance Check for web_fetch","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.172\/e\/url-provenance-check-for-web-fetch","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.172","markdown":"### URL Provenance Check for web_fetch\n\n**What**\n\n`web_fetch` now enforces a provenance check \u2014 it can only retrieve URLs that appeared in a user message or a prior `web_fetch` result. Attempts to fetch URLs outside this set present a permission prompt asking the user to approve.\n\n**Details**\n\n- If the user approves, the fetch proceeds; if denied or timed out, Claude receives an error\n- Timeout message: \"The permission request for this URL was not answered in time. Ask the user to approve the fetch or include the URL in a message, then try again.\"\n- The error type is `PROVENANCE_REQUIRED`\n- Suppressed in bypassPermissions and dontAsk modes\n\n**Evidence**\n\nProvenance enforcement and prompt (search for `\"URL not in provenance set. web_fetch can only retrieve URLs that appeared in a user message\"`)"}