Separate Artifact from WebFetch rules

WebFetch

WebFetch rules use a domain: prefix and match against the hostname of the requested URL. Matching is case-insensitive, supports * wildcards, and strips a trailing . from both the rule and the hostname so example.com. and example.com are treated the same.

• WebFetch(domain:example.com) matches requests to example.com
• WebFetch(domain:*.example.com) matches any subdomain at any depth, such as api.example.com or a.b.example.com, but not example.com itself
• WebFetch(domain:*) matches every domain. It isn't the same as a bare WebFetch rule; see Allow or deny every fetch

In any position other than a leading *. or a bare *, the wildcard matches only the text between two dots. WebFetch(domain:example.*) matches example.org, where * becomes org, but not example.evil.com, where * would have to become evil.com and cross a dot. This keeps a trailing wildcard from matching domains an attacker could register.

Wildcards in WebFetch rules require Claude Code v2.1.172 or later to match fetches.

Allow or deny every fetch

A bare WebFetch rule is the tool name with no domain: part, such as "deny": ["WebFetch"]. Both it and WebFetch(domain:*) cover every URL, but Claude Code applies them differently, and only the domain: form also adds its domain to the sandbox's allowed or denied domain list. That section lists the wildcard forms the sandbox honors and the version that added bare *.

Each row shows what a rule does in the allow list and in the deny list:

Rule	In allow	In deny
WebFetch	Claude fetches without prompting you. Doesn't change which hosts sandboxed commands can reach.	Claude Code removes the WebFetch tool, so Claude can't fetch at all. Doesn't change which hosts sandboxed commands can reach.
WebFetch(domain:*)	Claude fetches without prompting you, and sandboxed commands can reach any host.	Claude Code keeps the tool and refuses each fetch, and sandboxed commands can't reach any host.

The two forms also differ on reads of artifacts, the pages the Artifact tool publishes on claude.ai. A bare WebFetch deny or ask rule doesn't apply to those reads. A domain: rule covering claude.ai or the *.claudeusercontent.com content host, such as WebFetch(domain:claude.ai) or WebFetch(domain:*), denies each read or prompts before it. An Artifact rule does the same.

When a rule blocks a read, the denial names the rule. Before v2.1.268, a bare WebFetch deny rule blocked every artifact read, and a bare ask rule prompted before each one.

To let Claude fetch freely while keeping the sandbox allowlist as it is, use the bare form. This settings.json does that:

{
  "permissions": {
    "allow": ["WebFetch"]
  }
}

When you ask Claude to fetch a page, it fetches without a prompt. When you ask it to run a sandboxed curl against a host outside the sandbox allowlist, Claude Code still prompts you for that host, because the bare rule didn't add the host to the allowlist.

In auto mode, Claude instead names the host in the command's per-command allowed domains for the classifier to review.