[FEATURE] Desktop Code tab: image search results, and an image allowlist with attribution for widgets and artifacts

Problem

Claude Code in the desktop app has no way to put web images in front of the user, and design and research work needs this all the time. We are an architecture practice, and the typical case is "show me built examples of prefinished fibre cement cladding on townhouses". claude.ai web search already returns images "powered by Bing", each with a source link (support article 10684626). Claude Code's WebSearch returns text only, and the API web_search tool returns no images.

Today each surface blocks the obvious route:

• Inline widget (show_widget): the CSP admits only cdnjs, esm.sh, jsDelivr, unpkg and Google Fonts. An <img> from Wikimedia, Unsplash or i.pinimg.com is blocked, while data: URIs load. We tested this on 10 Oct 2026 with URLs confirmed live by curl first. Embedding base64 means the model has to type about 22,000 characters per 236px thumbnail.
• Artifacts: the docs say "The CSP blocks every external image", so every image has to be downloaded and inlined.
• MCP ImageContent: the model sees it, but Desktop collapses it (#53256, closed by the bot as not about Claude Code).

What does work: an HTML file whose <img> tags hotlink the same thumbnails, sent with SendUserFile and display: "render", shows every image inline in the Code tab. So the renderer can already show remote images. It is only the widget and artifact sandboxes that cannot.

Requests, smallest first

1. Image results in WebSearch, or a separate ImageSearch tool, for Claude Code. It would return the image URL, a thumbnail URL, the source page URL and the title, using the same Bing-backed path as claude.ai, and render them as a source-linked thumbnail strip like claude.ai does.
2. An img-src allowlist for widgets, limited to thumbnail proxies Anthropic controls or vets (for example the proxy that serves claude.ai image results), so a widget can show search results without base64. Attribution would be enforced by the host, for example a required source link per image.
3. Owner-approved image domains for artifacts, as #99606 proposes for network domains generally. Its capabilities.network.img shape covers this.

Why attribution belongs in the platform

Every consumer chat that shows web images (claude.ai, ChatGPT, Gemini, Google AI Mode) links each image to its source. If the host renders the link, every agent-built gallery gets attribution by default. Leaving it to each skill or MCP server means it will be done unevenly.

Related

• #99606: artifacts, owner-approved network domains (images included)
• anthropics/claude-ai-mcp#40: claude.ai ignores declared MCP Apps CSP domains, including img-src (51 upvotes)
• #69715: show_widget fetch allowlist (connect-src, not images)
• #53256: MCP ImageContent collapsed in Desktop
• #79706, #95797: displaying images Claude already has, in the terminal and VS Code

Environment

• Claude desktop app (macOS), Code tab, Claude Code 2.1.293, 10 Oct 2026.