Claude Code publishes email guard code, with web tools outside its scope

Anthropic published source code for a built-in Claude Code privacy guard on November 6, after a user reported that the coding agent had sent an account email to websites during research. The commit exposes the implementation and its documented limits.

The guard targets shell input containing the account email and a User-Agent marker, a header identifying the requesting client. It can refuse a previously allowed call, separating permission to contact a site from the check for an address.

The November 5 issue identifies Claude Code 2.1.318 on macOS. In a reply, repository contributor poteat said the built-in privacy mod had been introduced in 2.1.317 and later, was enabled by default, and asked users to report gaps. The issue remained open when checked on November 6. The original transmission remains a user report.

The registration code preserves an existing denial. It looks for an at-sign or its encoded form before retrieving the account email and testing the targeted combination. Input containing neither @ nor %40 returns the preceding verdict before the identity lookup. A match produces a denial; otherwise, it returns the preceding verdict.

Before matching, a helper produces another reading with quotes, escapes and line-continuation characters removed. It keeps both the original and normalized text so split spellings of a client name or address can still be recognized. For objects and arrays, it recursively gathers their strings. The guard consequently examines more than an unchanged, single-line command.

A missing or empty account email produces no match. The matching implementation compares addresses without regard to case and decodes percent-encoded bytes once. It recognizes the header’s name and selected shorthand client options. Before looking for those header markers, it removes the address itself from the unencoded input, avoiding a match caused solely by characters inside the address. The implementation uses text matching rather than a command parser.

The two matches are independent. The code does not parse whether the address becomes the header’s value. It can refuse a call even when those strings serve different purposes.

What the published guard leaves outside

The privacy README describes this as a courtesy covering one shape of request. An address in a URL or request body, a value computed at runtime, or an address inside a separately invoked script can fall outside it. It also explicitly excludes WebFetch, WebSearch and MCP tools, the latter used to connect Claude Code to other services. The registered tools are Bash, PowerShell and Monitor. A host can add its own shell-tool name before registration, but that additional-name set is empty in the published source.

The refusal message is also public. It tells the model and the person reading the tool result that the call contains the account email and what looks like a User-Agent setting. If nobody requested the address be sent, the message says to retry without it, using a generic client name. Otherwise, it suggests removing that setting or separating the calls.

This review concerns the published commit and documentation; it did not reproduce the reported transmission or verify an installed binary against that source. The README also lists operational limits: a session in which the guard’s hooks module never loads will not run the check.