[Bug] WebSearch tool bypasses deny list in settings.local.json

Bug

The WebSearch tool executes successfully despite being explicitly denied in .claude/settings.local.json.

Steps to reproduce

1. Add WebSearch to the deny list in .claude/settings.local.json:

``json
"deny": [
"WebSearch",
"WebFetch",
"Web Search"
]
``

1. In a conversation, the model invokes ToolSearch with query: "select:WebSearch" — this loads the full tool schema
2. Model calls WebSearch with a query — it executes and returns results

Expected behavior

The WebSearch invocation in step 3 should be blocked by the deny list, regardless of whether the schema was loaded via ToolSearch.

Actual behavior

WebSearch executes normally and returns web search results. The deny list is not enforced.

Possible cause

ToolSearch loads deferred tool schemas into the callable tool set. The deny list may not be checked at invocation time for tools that were loaded via ToolSearch (as opposed to tools that were available from the start).

Related

#11812 — denying WebFetch/WebSearch broke plugin loading (different bug, closed due to inactivity)

Environment

• Claude Code v2.1.104
• macOS 26.3.1 (arm64 / Apple Silicon)
• Model: Claude Opus 4.6 (1M context)
• Settings file: .claude/settings.local.json (project-level, not checked into git)