The plugin fetch capability with strict address blocking ships with the disabled hook-module feature.
What
The plugin fetch capability refuses anything but https, refuses URLs with embedded credentials, and blocks private, loopback, link-local, carrier-NAT, multicast and reserved addresses in both IPv4 and IPv6, cloud metadata endpoints, localhost / .local / .internal names, and Anthropic-operated hosts. Calls time out at 30000ms. It ships as part of the plugin hook-module feature, which is off unless the server enables it.
Details
- Hostnames are resolved and the connection pinned to the resolved address; that pinning is skipped only when a proxy is configured and
CLAUDE_CODE_PROXY_RESOLVES_HOSTSis set. - Redirects are capped, and a cross-origin redirect strips every header except accept, accept-language, content-type and user-agent.
- Request and response bodies are size-capped.
- Two policies refuse the call before any of this: sessions with nonessential network traffic disabled, and the plugin network policy check being off.
Evidence
network access from plugins is disabled by policy
Strings lifted out of the shipped bundle, so the claim above can be checked against them.