Claude Code MCP Timeout and WebFetch Fix: What Operators Must Check

Two bugs shipped silently in Claude Code for weeks. The June 3 release fixed them both — and if you run Claude Code behind an AI gateway or enforce WebFetch domain policies, you need to know what changed.

The WebFetch Permission Precedence Bug

Claude Code has a built-in preapproved-host auto-allow list — a set of domains that are permitted by default without any explicit operator configuration. Before this fix, operator-defined WebFetch(domain:...) deny or ask rules had no effect on those preapproved hosts.

In practice: if your operator policy said deny: WebFetch(domain:api.example.com) and api.example.com appeared on Anthropic's preapproved list, Claude Code would silently allow the fetch anyway.

The fix changes rule precedence so that explicit operator WebFetch deny/ask/allow rules now take precedence over the preapproved-host auto-allow list. Your gateway's access control policy now applies consistently, regardless of whether the target domain is in Anthropic's default allowlist.

What to check now:

• Review your settings.json or .claude/settings.json for WebFetch permission rules.
• If you have deny rules that were intended to block specific domains, verify they now take effect after upgrading to the June 3 release.
• Teams using TheRouter to log and audit outbound AI fetch calls should confirm that WebFetch blocks are landing on your request ledger as expected — previously, auto-allow bypass meant those events were never generated.

The MCP Per-Server Timeout Watchdog Bug

Claude Code supports setting a timeout field (in milliseconds) per MCP server in .mcp.json. The intent is to let operators fine-tune how long Claude Code waits for a tool call to return before treating it as failed.

The bug: any timeout value below 1000 ms (one second) was being silently floored to a 1-second watchdog that aborted every tool call — because the watchdog fired before any legitimate tool response could arrive.

This was a silent failure mode. Teams setting tight sub-1000 ms timeouts (for example, to enforce SLA-like constraints on MCP tools that should respond in under a second) would see all tool calls fail without a meaningful error. The claude mcp get command now annotates sub-1000 ms timeout entries so operators can see the issue in inspection output.

The fix behavior: Sub-1000 ms timeout values are now ignored (falling back to MCP_TOOL_TIMEOUT env var or the default). If you need a sub-second enforcement boundary, you should implement it at the MCP server or gateway layer rather than in Claude Code's client-side timeout config.

Other Operator-Relevant Changes in This Release

--tools Grep/Glob explicit listing now works. Previously, explicitly naming Grep or Glob in a --tools allowlist was silently ignored on native builds with embedded search. Those tools now register correctly. If your operator profile restricts tool access via --tools, test that Grep/Glob now behaves as configured.

Windows path matching for permission rules fixed. Permission rules with backslash paths (~\folder, \\server\share) or case-variant paths were never matching on Windows. This affects operators running Claude Code in Windows-based CI or agent pipelines where path-based deny rules were silently bypassed.

Devin Desktop replaces Windsurf in IDE menu. The /ide menu, /terminal-setup, and /scroll-speed now reference Devin Desktop following the editor's rebrand from Windsurf. Update any operator documentation or onboarding scripts that referenced Windsurf.

claude agents --json now includes waitingFor. JSON output from the agents subcommand now surfaces what a waiting session is blocked on (e.g., a permission prompt). This is directly useful for headless monitoring systems that poll agent status — you can now distinguish "blocked on approval" from "running" without parsing human-readable status text.

Routing and Gateway Implications

The WebFetch permission fix is the most consequential change for AI gateway operators. The core problem was an inconsistency between Anthropic's default policy and operator-defined policy — with Anthropic's winning silently. That's now corrected.

For teams routing Claude Code traffic through TheRouter:

• Request logging: Outbound WebFetch calls that were previously auto-allowed now respect your deny rules, meaning you may see a drop in certain fetch events and a new class of blocked-fetch records in your request ledger.
• MCP timeout behavior: If you rely on per-server timeout fields to route around slow tool servers, verify your timeout values are ≥ 1000 ms. Sub-1000 ms values will now be silently dropped rather than causing watchdog-triggered failures — a net improvement, but your timeout budget will need to be revised at the gateway or MCP server level.
• Headless pipeline monitoring: The new waitingFor field in --json output means your Claude Code orchestration layer can surface permission-blocked agents more precisely, reducing the time it takes to identify stuck jobs in multi-agent pipelines.

What to Watch

The June 3 release continues Claude Code's pattern of addressing operator-facing edge cases in permission enforcement. This is the second permission-model fix in a week (after the forceLoginOrgUUID managed-settings regression was addressed in the Jun 2 release). If your organization runs Claude Code in a locked-down enterprise environment, a systematic audit of your settings.json permission rules after upgrading is now warranted — some rules that appeared to work may have been functioning on Anthropic's permissiveness, not your explicit policy.

Related

• Routing Claude Code requests through TheRouter
• AI gateway permission policies and request ledger