A fetch_url tool that reads a web page or API response as text, built so a prompt-injected
model cannot use it to reach your internal network:
only http and https;
the address is checked when the connection is made, so DNS rebinding cannot swap in an internal
one, and loopback, private, link-local (cloud metadata) and multicast ranges are refused;
every redirect is followed by hand and re-checked, including against allowHosts;
bounded in size and time, uncompressed, text content types only.
Pages are returned as Markdown of their main content (format: 'text' for plain text of the whole
page, 'raw' for the source) and tagged untrusted.
Fetches need approval unless you pin allowHosts, because a URL can carry data out in its query
string.
A
fetch_urltool that reads a web page or API response as text, built so a prompt-injected model cannot use it to reach your internal network:httpandhttps;allowHosts;Pages are returned as Markdown of their main content (
format: 'text'for plain text of the whole page,'raw'for the source) and taggeduntrusted. Fetches need approval unless you pinallowHosts, because a URL can carry data out in its query string.