[BUG] Artifact tool loads ~12k tokens of schema into every claude.ai-backed session, eagerly, with no way to opt out except a deny rule

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet (closest is #83363, which measures deferred-tool overhead in aggregate but does not attribute it to a specific tool or offer a fix)
• [x] This is a single bug report
• [x] I am using the latest version of Claude Code

Environment

• Claude Code 2.1.258
• Model: claude-fable-5-1 (1M context)
• Linux and MacOS
• Three configurations compared, all with identical ~/.claude, project settings, skills, agents, and memory:

1. Enterprise claude.ai login, stock system prompt
2. Enterprise claude.ai login, custom --system-prompt-file
3. Same custom system prompt, authenticated to Bedrock (no claude.ai backend)

What's wrong

Sessions signed in to claude.ai carry ~14k more tokens in /context's "System tools" row than an otherwise identical Bedrock session. ~12k of that is the Artifact tool alone. It is loaded eagerly on every request, whether or not the user has ever published an artifact, and none of the normal controls remove it except a permissions.deny rule.

/context at session start, before any user message:

| Setup | Total | System prompt | System tools |
|---|---|---|---|
| 1. Enterprise login, stock prompt | 38.5k | 6.3k | 22.2k |
| 2. Enterprise login, custom prompt | 36.7k | 4.6k | 22.2k |
| 3. Bedrock, custom prompt | 21.6k | 4.6k | 7.9k |

Everything other than system prompt and system tools was identical across all three.

Asking each session to list its tool names confirms the difference is the set of builtins that depend on the claude.ai backend: Artifact, Workflow, WebSearch, WebFetch, etc. are present in setups 1 and 2 and absent in 3.

Adding "permissions": { "deny": ["Artifact"] } to settings and starting a fresh session drops "System tools" by ~12k. That single tool accounts for most of the gap.

The size is consistent with the extracted tool description fragments: the Artifact description is assembled from ~23 pieces (action reference, type discovery, publishing guidance, live rooms, database, comments, supporting files, theme, assets, etc.) totaling roughly 9.5k tokens before the JSON schema.

Why this matters

Cost. On API-billed Enterprise, a single trivial first turn ("list your tool names") cost $1.56 in setup 2 versus $0.85 in setup 3. Prompt caching reduces this on subsequent turns but it is paid again on every new session, every compaction, every model switch, and every idle gap past the cache TTL. Across an org this is a meaningful line item for a tool most terminal sessions never call.

Rate limits. On Pro/Max/Team the same ~12k counts against the 5-hour and weekly usage windows on every request, so subscribers exhaust their limits faster carrying a schema for a feature they may not use.

Context quality. 12k of publishing instructions in every coding session's context is noise that competes with actual work for attention and pulls compaction earlier.

Inconsistency with existing policy. The core builtins were deferred behind ToolSearch in 2.1.69 (#31002) specifically because ~15k of upfront schema was considered wasteful. Artifact is a comparable size and ships eagerly.

Expected behavior

One of:

• Artifact (and the other claude.ai-backend tools: Workflow, RemoteTrigger, ScheduleWakeup) is deferred behind ToolSearch like the core builtins, so its schema is only loaded when the model actually needs to publish.
• Or Artifact is opt-in per session/project, off by default for terminal coding sessions.
• At minimum, the Artifact tool description is split so the eagerly loaded part is a short summary and the ~9k of publishing, live-room, database, and comment guidance is loaded on first use.

Actual behavior

Artifact's full schema and description are included in every request for any claude.ai-backed session. ENABLE_TOOL_SEARCH=true does not defer it. Disabling MCP connectors via /mcp does not affect it. Only permissions.deny: ["Artifact"] removes it, which is a workable but undiscoverable workaround and requires managed settings to apply org-wide.

Reproduction

1. Sign in with /login to a claude.ai account that has artifacts enabled (Team by default, Enterprise with admin toggle, Pro/Max).
2. Start a session in any directory and run /context. Note the "System tools" value.
3. Ask: "List the exact names of every tool you have available, one per line." Confirm Artifact is present.
4. Add {"permissions": {"deny": ["Artifact"]}} to user settings, start a fresh session, run /context again. Observe "System tools" drops by ~12k.
5. For the control, repeat steps 2 and 3 with CLAUDE_CODE_USE_BEDROCK=1 (or an API-key login). Artifact is absent and "System tools" is ~8k.

Secondary observation

In setup 2, the tool-name list also included tools from managed MCP connectors that had been disabled via /mcp. Their token footprint is small, so they don't explain the gap above, but disabled connectors should not appear in the tool list at all. Happy to split this into a separate issue if preferred.

Workaround

{
  "permissions": {
    "deny": ["Artifact"]
  }
}

Recovers ~12k tokens per request. Adding Workflow, RemoteTrigger, and ScheduleWakeup recovers a further ~2 to 3k for sessions that don't use them.