Toolofficial publisher

WebFetch, WebSearch (Claude Code)

Tool : A precise action the AI can call · requires claude-code

Web search and page retrieval from the code agent.

Allow by domain; web content is untrusted input.

Docs

Overall score

6.6 /10

Security: one caveat, see the card

Utility

7.0

Reliability

6.0

Security

One caveat

Ease

5 min · Comfortable

Security reflects where data goes, requested permissions and incidents on record at the verification date. It is not a guarantee of zero risk: check the deployment mode and the connections you enable.

What it does, concretely

When a code agent needs to consult online documentation, check an API, or look up recent information, it cannot do so without a dedicated tool. WebFetch and WebSearch fill this gap by giving Claude Code the ability to retrieve web pages and perform web searches directly from the working session.

WebFetch retrieves the content of a specific URL and makes it available to the agent. WebSearch performs web searches and returns results. Both tools require explicit permission before they can be used: they are marked as requiring a permission in the official reference table. WebFetch can be controlled on a per-domain basis using the permission rule WebFetch(domain:example.com), while WebSearch is allowed or denied as a whole.

These tools are aimed at developers who use Claude Code to automate tasks involving external sources: reading documentation, checking dependencies, retrieving public data. They are particularly useful in workflows where the agent needs to cross-reference local and remote information.

These tools are not suitable for contexts where all network communication must be avoided, for example in isolated environments or those subject to strict security constraints. Content retrieved from the web is not filtered and may contain unreliable information.

What it offers

·WebFetch retrieves the content of a specific URL and passes it to the agent for analysis or use in the current task.
·WebSearch performs web searches and returns results that the agent can use.
·WebFetch accepts per-domain permission rules, in the format WebFetch(domain:example.com), to restrict network access.
·WebSearch can be allowed or denied globally via permission rules, with no domain-level filtering available.
·Both tools are configurable in permission settings, the CLI flags --allowedTools and --disallowedTools, and in Agent SDK options.
·Permission rules also apply in hooks and subagent tool lists, offering granular control depending on the execution context.

Our tips

Use the WebFetch(domain:example.com) rule to restrict access to trusted domains only, such as the official documentation of a library.
Add WebSearch to --disallowedTools if your workflow does not require web search, to limit the network exposure surface.
In a subagent, explicitly specify allowed tools via allowedTools to prevent WebFetch or WebSearch from being available without control.
Configure permissions in hooks using the if condition to trigger an authorization request only for certain domains or contexts.
In Manual mode, both tools trigger a permission request before each use; in Auto mode (Pro, Max, Team plans), a classifier may decide on your behalf.

Watch out

Content retrieved from the web is not filtered: the agent may receive incorrect, outdated, or malicious information, which can influence its actions on the code.
WebSearch does not allow domain-level filtering, unlike WebFetch: it is not possible to restrict searches to certain sources without disabling the tool entirely.

In practice

Price: Free
Commercial use: Commercial use: yes
Available on: claude-code
Host: claude-code
FR interface: No

Security and data

Rating: Security: one caveat, see the card
Capabilities: readswritesexecutesnetwork
Your data: Data with the vendor
Maintenance: Active

Links and repository checked on 25 October 2026 · added on 1 February 2025

How to install WebFetch, WebSearch (Claude Code)

1. Install Claude Code and open a working session. 2. By default, WebFetch and WebSearch require explicit permission before use. 3. To allow WebFetch on a specific domain, add WebFetch(domain:example.com) to permissions.allow in your settings. 4. To allow WebSearch globally, add WebSearch to permissions.allow. 5. To block either tool, add it to permissions.deny or use the --disallowedTools flag at launch. 6. In sensitive environments, prefer a strict domain allowlist rather than a global authorization.

permissions.allow: ["WebFetch(domain:docs.python.org)"]

Official documentation ↗

In the same category

Whole category Feed (memory, context) →