Web Search and External Context

You are debugging an OAuth integration. The library released a breaking change last week. Claude Code's training data does not include it. You could go read the changelog yourself, paste it in, explain what changed. Or you type "search for the latest NextAuth v5 migration guide" and ten seconds later Claude Code has the answer and is already updating your code.

The second approach is better. Obviously.

How Web Search Works in Claude Code

Two built-in tools: WebSearch and WebFetch.

WebSearch queries the web and returns results. Blog posts, docs updates, Stack Overflow answers, GitHub issues. Anything publicly available. WebFetch grabs a specific URL and reads the page content. You already know where the info lives? Give it the link.

What catches people off guard: Claude Code often uses these tools on its own. You ask it to implement something, it realizes its training data might be stale, and it just... searches. You will see it in the tool output. No prompting required.

Add rate limiting to this Express app using express-rate-limit

If Claude Code is unsure about the latest API, it pulls up the docs before writing code. Zero effort from you.

When to Search Explicitly

Automatic search handles most cases. But there are times you want to be deliberate.

If you already know the source, skip the search and give it the URL directly:

Fetch the docs at https://tanstack.com/query/latest/docs/react/overview and summarize the key changes in v5

For anything released after Claude Code's training cutoff, be explicit. Don't let it guess from stale knowledge:

Search for the Prisma 6.0 migration guide

The sneaky failure mode is when Claude Code thinks it knows the answer but its info is outdated. I have been burned by this more than once. If something feels off, force verification:

Search for the current recommended way to handle middleware in Next.js 16. Don't rely on your training data.

And sometimes you want breadth, not just the first result it finds:

Search for common solutions to CORS issues with AWS API Gateway. Check at least 3 sources.

You can also pipe content in from outside. Download a page with curl, copy docs into a file, whatever. The point is getting the right information into the context window by any means necessary.

Don't Trust It Blindly

People get burned here. Claude Code finds an answer, you assume it's correct, ship it. Bad move. Web content is outdated, wrong, or just irrelevant to your specific situation all the time. That Stack Overflow answer from 2022? The method it suggests was deprecated six months ago.

For anything critical (security configs, auth flows, database migrations), make Claude Code verify against official docs. Not some random blog post.

You found that solution on a blog post. Now fetch the official AWS docs and confirm this is still the recommended approach.

Check dates. Always. A tutorial from three years ago might be technically correct but recommend patterns nobody uses anymore.

And obviously, test the code. External solutions work in isolation and then explode in your specific setup. Build your project. Run your tests. "The source looked credible" is not a testing strategy.

If Claude Code doesn't mention where it found something, ask. "Where did you find that?" is a perfectly valid follow-up. Drop source URLs in docs and commit messages so future-you isn't left guessing.

One quality-of-life thing: domain allowlisting. If you keep referencing the same docs sites, add a /permissions rule to pre-approve them. Saves you from clicking "approve" on react.dev for the hundredth time.

Allow web fetches to: docs.example.com, developer.mozilla.org, react.dev

Try It

Run through these three prompts, in order:

Search for what's new in TypeScript 5.7

Fetch https://react.dev/blog and tell me what the latest post is about

How do I set up ESLint with TypeScript in 2026? Search for the current flat config approach, don't use your training data.

Notice the difference. Open search returns multiple results. URL fetch gives targeted content. The verification prompt forces fresh sources over stale data.

Recap

• WebSearch and WebFetch are built-in. No setup, no plugins.
• Claude Code searches on its own when it lacks info, but force explicit searches for anything recent or when you smell stale knowledge.
• Verify before trusting. Official docs over blog posts. Check dates. Test the code.
• Domain allowlisting via /permissions kills the friction of repeatedly approving the same docs sites.