[BUG] WebFetchTool over MCP behaves inconsistently wrt. message state

Environment

• Platform (select one):
• [ ] Anthropic API
• [ ] AWS Bedrock
• [ ] Google Vertex AI
• [x] Other: MCP server
• Claude CLI version: 0.2.56
• Operating System: mac OS
• Terminal: Mac Terminal

Bug Description

When used as an MCP server, WebFetchTool sometimes complains that the URL can't be fetched for security reasons because it was not mentioned by the user. My guess is that the tool has some state that only gets set in the context of the actual Claude Code client.

<img width="1112" alt="Image" src="https://github.com/user-attachments/assets/98354bf6-ef54-4e10-9461-91bedabd5293" />

Input (via Claude Desktop):

{
  `url`: `https://docs.anthropic.com/en/docs/agents-and-tools/mcp`,
  `prompt`: `Please summarize the key information about Anthropic MCP (Multi-Channel Protocol) from this page, including what it is, its purpose, how it works, and its key features or capabilities.`
}

Output:

Error: Tool WebFetchTool input is invalid: Error: Cannot fetch URL "https://docs.anthropic.com/en/docs/agents-and-tools/mcp". For security, you can only fetch URLs from hosts that the user has mentioned in their messages or that are found in CLAUDE.md files or project files.

Steps to Reproduce

1. Configure claude desktop with the default MCP settings, as follows:

{
  "mcpServers": {
	"claude": {
"command": "claude",
"args": ["mcp", "serve"]
}
  }
}

1. Prompt it with fetch https://docs.anthropic.com/en/docs/agents-and-tools/mcp and tell me about it
2. Observe that it often fails with a message similar to the one above.

Expected Behavior

I expect the tool to return a success response such as:

{"result":{"content":[{"type":"text","text":"{\"result\":\"Title: Introduction to Model Context Protocol (MCP)\\n\\nDescription: MCP is an open protocol that standardizes how applications provide context to Large Language Models (LLMs), analogous to a \\\"USB-C port for AI applications.\\\"\\n\\nKey Highlights:\\n- Provides a standardized way to connect AI models to data sources and tools\\n- Helps build agents and complex workflows on top of LLMs\\n- Offers pre-built integrations and flexibility between LLM providers\\n- Follows a client-server architecture with multiple components:\\n  1. MCP Hosts (e.g., Claude Desktop, IDEs)\\n  2. MCP Clients\\n  3. MCP Servers\\n  4. Local and Remote Data Sources\\n\\nNotable Context:\\n- Recently released C# SDK\\n- Supports multiple programming language SDKs (Python, TypeScript, Java, Kotlin, C#)\\n- Provides documentation, tutorials, and development resources\\n- Open to community contributions and feedback\\n\\nCore Value Proposition: \\\"MCP provides a standardized way to connect AI models to different data sources and tools\\\" by creating a consistent protocol for integrating LLMs with various systems and resources.\",\"durationMs\":7348,\"url\":\"https://modelcontextprotocol.io/introduction\"}"}]},"jsonrpc":"2.0","id":"toolu_0115GhU2yDntaQ2FkEMwqNf4"}

Actual Behavior

The MCP server returns a security warning instead.

Additional Context

I don't always get this behavior; sometimes the security check does not fail. Here's an example from the terminal where issuing the same tool call consecutively across different MCP server invocations fails and then succeeds with no other changes.

<img width="1481" alt="Image" src="https://github.com/user-attachments/assets/0e856f31-8add-4581-80d1-1b636d15d69a" />