WebSearch Tool Blocked Despite Permissionless Mode and Claude Max Subscription

WebSearch Tool Blocked Despite Permissionless Mode and Claude Max Subscription

Summary

The WebSearch tool is denied with permission errors even when running Claude Code in permissionless mode with a Claude Max subscription. This occurs consistently across sessions and persists after migrating from npm to native installer.

Environment

• Claude Code Version: 2.1.19 (native build)
• Installation Path: C:\Users\AdamMorse\.local\bin\claude.exe
• Operating System: Windows
• Subscription: Claude Max ("subscriptionType":"max")
• Rate Limit Tier: default_claude_max_5x
• Location: United States (WebSearch geographic requirement met)
• Permission Mode: PERMISSIONLESS MODE (no permission prompts enabled)

OAuth Scopes

Current OAuth scopes in ~/.claude/.credentials.json:

"scopes": [
  "user:inference",
  "user:mcp_servers",
  "user:profile",
  "user:sessions:claude_code"
]

Expected Behavior

With a Claude Max subscription in the US and running in permissionless mode, the WebSearch tool should execute successfully without permission denials.

Actual Behavior

Every attempt to use WebSearch returns:

Error: Permission to use WebSearch has been denied.

This occurs:

• ✅ In permissionless mode (PERMISSIONLESS MODE banner shown at startup)
• ✅ After migrating from npm to native installer
• ✅ After removing the permissions section from ~/.claude/settings.json
• ✅ Across multiple session restarts
• ✅ With Claude Max subscription active

Steps to Reproduce

1. Start Claude Code in permissionless mode (via custom startup script)
2. Verify startup banner shows: PERMISSIONLESS MODE - Claude will not ask for permission to execute commands or edit files
3. Attempt to use WebSearch tool with any query
4. Observe permission denial error

Configuration Files

~/.claude/settings.json

{
  "model": "sonnet"
}

(Note: permissions section was previously present with an allow-list that excluded WebSearch, but has been completely removed)

Historical Context

Debug logs from ~/.claude/debug/16f41745-2753-45e4-b066-c28923f2a9b5.txt show that WebSearch was working in early January 2026:

2026-01-03T21:53:09.757Z [DEBUG] Applying permission update: Adding 38 allow rule(s) to destination 'localSettings': [...,"WebSearch",...]

Multiple successful WebSearch executions are logged:

2026-01-03T23:38:03.650Z [DEBUG] executePreToolHooks called for tool: WebSearch
2026-01-03T23:42:16.379Z [DEBUG] executePreToolHooks called for tool: WebSearch
2026-01-03T23:47:35.564Z [DEBUG] executePreToolHooks called for tool: WebSearch

This suggests something changed between early January and now (January 26, 2026).

Troubleshooting Attempted

1. ✅ Removed permissions section from global ~/.claude/settings.json
2. ✅ Restarted Claude Code session multiple times
3. ✅ Migrated from npm to native installer (claude install)
4. ✅ Confirmed running in permissionless mode
5. ✅ Verified Claude Max subscription active
6. ✅ Confirmed located in United States
7. ✅ Checked for deny/block rules in config files (none found)

Hypothesis

The issue may be related to:

1. Missing OAuth scope: WebSearch might require a scope not included in the current OAuth token
2. Hardcoded permission check: WebSearch permission check might bypass permissionless mode
3. Breaking change: Something changed in Claude Code between early January and late January that broke WebSearch permissions

Requested Fix

Either:

1. Add necessary OAuth scope for WebSearch to the authentication flow
2. Ensure WebSearch respects permissionless mode settings
3. Provide a way to explicitly grant WebSearch permission (e.g., --tools "WebSearch" flag)
4. Document if WebSearch requires special setup beyond standard Claude Max subscription

Additional Information

Other tools work correctly in permissionless mode:

• ✅ Bash
• ✅ Read
• ✅ Write
• ✅ Edit
• ✅ Glob
• ✅ Grep
• ✅ WebFetch (with specific URLs)

Only WebSearch is consistently denied.