Governed web access
Web access is the one audited door through which agents and workflows read the public web and run web searches. There is no other path to the internet for an agent. Every read is gated by the acting agent's reach tier, checked against abuse protections, and returned as content that is marked as untrusted. Web access is part of the dependency-complete floor, so every edition carries it.
It exposes two capabilities:
| Capability | What it does |
|---|---|
web:page.fetch@1 | Reads one public web page. |
web:search.query@1 | Runs a web search through the configured search provider. |
Reading a page
web:page.fetch@1 takes an absolute http or https URL (up to 2048 characters). Optionally it collects the page's outbound links (includeLinks) or captures a viewport screenshot (includeScreenshot); a screenshot forces a headless-browser read.
The result has the requested and final URL (after redirects), the upstream HTTP status, the page title, a classification that is always untrusted-external, and the content.
Protections applied to every read:
- Private, loopback and link-local addresses are refused, so a page request cannot reach into your network.
- Each host has a rate limit and a circuit breaker, so a failing site is not hammered.
- A plain fetch falls over to a headless browser when a site needs one to render.
- The reach tier decides which hosts are allowed. With no tier stated, the tier is
as-owner, which allows only allow-listed hosts. It is never broad reach.
Reading search results
web:search.query@1 takes a query (up to 512 characters) and an optional limit (1 to 50). Search is broad reach by nature, so it needs the connected or full reach tier. The result names the provider that served the query and returns structured hits (title, URL, snippet) and the same results rendered inside the untrusted-content envelope, plus the retrieval time. The search provider is swappable (Brave, Tavily and SearXNG are supported), and its credential comes from the credential store, never from inline configuration. If no provider is configured, the call fails with an actionable message. It never returns an empty list to mean "not configured".
The untrusted-content envelope
Text from the web can contain instructions aimed at the agent reading it. Web access therefore never returns raw page text. Page content and search results come wrapped in an envelope: a handling notice, a provenance header, and delimiters the page cannot close. Titles and snippets have delimiter-like text neutralised. There is no unwrapped field in the response, so a prompt built from the result cannot splice raw web text in by accident.
Treat everything inside the envelope as data to read, never as instructions to follow.
Previous: ← Memory Next: MCP and Capabilities →