Computer use, code execution, memory, bash, text editor, web search, web fetch

These are the Anthropic-provided tools — the building blocks that let Claude do more than emit text. Some run server-side on Anthropic’s infrastructure (web_search, web_fetch, code_execution); some are Anthropic-schema tools that you implement client-side (bash, text_editor, computer, memory). This note is the canonical reference for each: tool type strings, supported model matrix, beta headers, action / command surface, response shapes, pricing, security floor.

1. The seven tools at a glance

Tool	Latest type	Where runs	Beta header	What it does
Web search	`web_search_20260209`	Anthropic	none (GA)	Internet search with citations; dynamic filtering via code execution
Web fetch	`web_fetch_20260309`	Anthropic	none (GA)	Fetch a specific URL and return parsed content
Code execution	`code_execution_20260120`	Anthropic	none (GA)	Sandboxed Python + bash + file ops
Bash	`bash_20250124`	Client (you)	`computer-use-2025-11-24` (with computer use) or none	Anthropic-schema bash interface; you execute
Text editor	`text_editor_20250728`	Client (you)	none	Anthropic-schema file editor (view / create / str_replace / insert)
Computer	`computer_20251124`	Client (you)	`computer-use-2025-11-24` (Claude 4.5+) or `computer-use-2025-01-24` (older)	Screenshot + mouse + keyboard
Memory	`memory_20250818`	Client (you)	none	File-system-style persistent memory

2. Web search — `web_search_20250305` / `web_search_20260209`

Per platform.claude.com/docs/en/agents-and-tools/tool-use/web-search-tool.

Definition

{
  "type": "web_search_20260209",
  "name": "web_search",
  "max_uses": 5,
  "allowed_domains": ["example.com", "trusteddomain.org"],
  "blocked_domains": ["untrustedsource.com"],
  "user_location": {
    "type": "approximate",
    "city": "San Francisco",
    "region": "California",
    "country": "US",
    "timezone": "America/Los_Angeles"
  }
}

Pricing

$10 per 1,000 searches + standard token costs for result content (charged as input tokens).
Errored searches not billed.
Each web_search_requests count is in response.usage.server_tool_use.web_search_requests.

Dynamic filtering (`web_search_20260209` only)

Requires the code_execution_* tool also enabled. Claude writes filter code that runs against raw search-result HTML before it enters context — saves tokens and improves precision. Supported on Opus 4.7, Opus 4.6, Sonnet 4.6, Mythos.

Citation behavior

Citations always enabled for web_search_* results. Each citation is a web_search_result_location block with url, title, encrypted_index, cited_text (up to 150 chars). The cited_text, title, and url do not count toward input or output token usage per docs.

Multi-turn requirement

encrypted_content (on results) and encrypted_index (on citations) must be passed back unmodified in subsequent turns. Don’t strip them.

Errors

Returned inline as {"type": "web_search_tool_result_error", "error_code": ...}:

too_many_requests — rate limit hit
invalid_input — bad query
max_uses_exceeded — hit max_uses
query_too_long
unavailable — internal error

The HTTP response is still 200; only the inline result block reports the error.

Platform availability

Claude API, Claude Platform on AWS, Microsoft Foundry. Basic version available on Vertex AI; dynamic filtering NOT on Vertex. Not available on Bedrock.

Org admin must enable web search in the Claude Console privacy settings.

3. Web fetch — `web_fetch_20250910` / `…20260209` / `…20260309`

Definition

{
  "type": "web_fetch_20260309",
  "name": "web_fetch",
  "allowed_domains": ["..."],
  "blocked_domains": ["..."],
  "max_uses": 5,
  "max_content_tokens": 10000,
  "citations": { "enabled": true },
  "use_cache": true
}

Behavior

Fetches a specific URL Claude chose.
Returns parsed content (HTML stripped, markdown-like).
max_content_tokens truncates each fetch (default ~10k tokens).
citations.enabled adds citation blocks for content used.
use_cache (20260309+): cache fetched content within session.

Pricing

Token costs only (parsed content as input tokens). No per-fetch surcharge.

4. Code execution — `code_execution_20250522` / `…20250825` / `…20260120`

Per platform.claude.com/docs/en/agents-and-tools/tool-use/code-execution-tool.

Tool versions

code_execution_20250522 — legacy, Python only
code_execution_20250825 — Python + bash + file operations. Available on all Claude 4 models (and Mythos).
code_execution_20260120 — adds REPL state persistence + programmatic tool calling from inside the sandbox. Available on Opus 4.5+ and Sonnet 4.5+ only.

Definition

{ "type": "code_execution_20250825", "name": "code_execution" }

Capabilities

Bash commands (system ops, package mgmt)
File ops (create / view / edit files in the sandbox)
Python REPL (with …20260120, persistent across calls within session)
Programmatic tool calling (…20260120): the sandbox can invoke your user-defined tools (requires allowed_callers on those tools)

Pricing

Free when combined with web_search_20260209 or web_fetch_20260209 / later. Just pay tokens.
Otherwise standard code-execution charges (per Anthropic pricing page; exact rate varies).

Containers

Each session gets a sandbox container. Reuse via the container parameter on subsequent requests:

response.container.id     # "container_abc..."
response.container.expires_at  # ISO timestamp

Pass the same container ID in the next request to retain file state. Without it, a fresh sandbox spawns.

Platform availability

Claude API, Claude Platform on AWS, Microsoft Foundry. Not on Bedrock or Vertex AI.

Multi-environment hazard

When you also provide a client-side bash tool, Claude is in a multi-computer environment. Add to your system prompt:

You have two execution environments:
- code_execution: runs in Anthropic's sandbox; ephemeral; isolated.
- bash (client): runs on the user's machine; persistent across calls in this session.
Don't assume file state is shared between them.

5. Bash — `bash_20250124`

Client-implemented. Same Anthropic-schema bash tool that the code-execution sandbox exposes server-side, but here you execute the commands. Often paired with computer use.

Definition

{ "type": "bash_20250124", "name": "bash" }

Tool input shape

{ "command": "ls -la /tmp" }

Tool result

Return stdout + stderr as text in tool_result.content. Include return_code in the text if non-zero.

Implementation tips

Run in a persistent shell (per-session) so cd and exports work
Cap output to a reasonable size (10-50 KB) before returning
Always set a timeout (subprocess.run(..., timeout=30))
Sanitize: refuse rm -rf /, :(){:|:&};:, etc. Use a denylist + permission prompt for destructive commands

6. Text editor — `text_editor_20250124` / `…20250429` / `…20250728`

Client-implemented. File editor exposed in the schema Claude knows. Latest tool name: str_replace_based_edit_tool. Older: str_replace_editor.

Definition

{
  "type": "text_editor_20250728",
  "name": "str_replace_based_edit_tool",
  "max_characters": 50000
}

max_characters (20250728+) bounds how many chars view returns at a time, forcing pagination.

Commands

view {path, view_range?} — show file contents or directory listing
create {path, file_text} — create new file
str_replace {path, old_str, new_str} — exact-string replacement (must be unique in file)
insert {path, insert_line, insert_text} — insert at line
undo_edit {path} — undo last edit (some versions)

Return format

Match the format Claude expects:

View (file):

Here's the content of {path} with line numbers:
     1 first line
     2 second line

View (directory):

Here're the files and directories up to 2 levels deep in {path}, excluding hidden items and node_modules:
4.0K /path
2.0K /path/file.txt

Errors must use specific strings to make Claude self-correct:

File not found: "The path {path} does not exist..."
str_replace miss: "No replacement was performed, old_str ... did not appear verbatim in {path}."
str_replace ambiguous: "No replacement was performed. Multiple occurrences of old_str ... in lines: ..."

This is the same protocol the claude-code-cli uses for its built-in Edit tool.

7. Computer — `computer_20250124` / `computer_20251124`

Per platform.claude.com/docs/en/agents-and-tools/tool-use/computer-use-tool.

Beta headers (required)

computer-use-2025-11-24 for Opus 4.7, Opus 4.6, Sonnet 4.6, Opus 4.5 (use computer_20251124)
computer-use-2025-01-24 for Sonnet 4.5, Haiku 4.5, Opus 4.1, deprecated Opus 4 / Sonnet 4 (use computer_20250124)

Definition

{
  "type": "computer_20251124",
  "name": "computer",
  "display_width_px": 1024,
  "display_height_px": 768,
  "display_number": 1
}

Recommended screen size: 1024×768 is the safe default — larger screens often confuse the model and burn screenshot tokens. Per the docs: “Higher resolution doesn’t necessarily help.”

Actions (input shapes)

{ "action": "screenshot" }
{ "action": "left_click", "coordinate": [x, y] }
{ "action": "right_click", "coordinate": [x, y] }
{ "action": "middle_click", "coordinate": [x, y] }
{ "action": "double_click", "coordinate": [x, y] }
{ "action": "triple_click", "coordinate": [x, y] }
{ "action": "key", "text": "ctrl+s" }              // xdotool-style key sequence
{ "action": "type", "text": "Hello world" }
{ "action": "mouse_move", "coordinate": [x, y] }
{ "action": "left_click_drag", "coordinate": [x2, y2] }   // drag from current pos to here
{ "action": "left_mouse_down" }
{ "action": "left_mouse_up" }
{ "action": "scroll", "coordinate": [x, y], "scroll_direction": "up" | "down" | "left" | "right", "scroll_amount": N }
{ "action": "wait", "duration": 2 }                // seconds
{ "action": "cursor_position" }
{ "action": "hold_key", "text": "shift", "duration": 1 }
{ "action": "key_combinations", "keys": ["ctrl", "shift", "t"] }   // newer

Tool result

Return a screenshot as a tool_result content block:

{
    "type": "tool_result",
    "tool_use_id": tu.id,
    "content": [
        {"type": "text", "text": f"Action complete. Mouse now at ({x}, {y})."},
        {"type": "image", "source": {"type": "base64", "media_type": "image/png", "data": png_b64}},
    ],
}

After every action, take a screenshot and return it. This is how Claude verifies state.

Reference implementation

Anthropic ships a Docker-based reference at anthropics/anthropic-quickstarts — includes a sample web UI, sample tool implementations, agent loop in Python.

Security floor (per docs)

Run in a sandboxed VM or container with minimal privileges.
Never give it sensitive data (logins, payment, PII).
Allowlist domains to limit reachable web targets.
Human-in-the-loop for destructive actions: deletes, payments, terms-of-service acceptance, cookie consent.
Anthropic auto-runs a prompt-injection classifier on screenshots — if it detects an injection attempt (e.g. malicious instructions in web content), it steers Claude to confirm with the user. To opt out, contact support.

8. Memory — `memory_20250818`

Per platform.claude.com/docs/en/agents-and-tools/tool-use/memory-tool.

Client-implemented. Anthropic-defined schema for “Claude has a persistent /memories directory.” You implement the storage backend (filesystem, S3, encrypted blob store, whatever).

Definition

{ "type": "memory_20250818", "name": "memory" }

Commands

Same family as the text editor, scoped to /memories:

view {path, view_range?}
create {path, file_text} — error if file exists
str_replace {path, old_str, new_str}
insert {path, insert_line, insert_text}
delete {path} — recursive for directories
rename {old_path, new_path} — error if destination exists

Auto-prefix system prompt

When the memory tool is enabled, Anthropic auto-injects this into the system prompt (per docs):

IMPORTANT: ALWAYS VIEW YOUR MEMORY DIRECTORY BEFORE DOING ANYTHING ELSE.
MEMORY PROTOCOL:
1. Use the `view` command of your `memory` tool to check for earlier progress.
2. ... (work on the task) ...
   - As you make progress, record status / progress / thoughts etc in your memory.
ASSUME INTERRUPTION: Your context window might be reset at any moment, so you risk losing any progress that is not recorded in your memory directory.

Security floor

Path traversal protection: validate every path starts with /memories; resolve to canonical form; reject ../, ..\\, URL-encoded %2e%2e%2f.
Per-user isolation: scope memory to the right user / session / org.
PII filtering: Claude usually refuses to write sensitive info; add extra validation.
Size caps: enforce max bytes per file + max files per user.
TTL: periodically purge unused memory files.

SDK helpers

Anthropic ships memory-tool helper classes:

Python: BetaAbstractMemoryTool (subclass to implement backend); example at examples/memory/basic.py
TypeScript: betaMemoryTool; example at examples/tools-helpers-memory.ts

Multi-session software-development pattern

Per docs, the recommended pattern for long-running agents:

Initializer session sets up: a progress log, feature checklist, reference to startup script.
Subsequent sessions open by reading those memory artifacts — recover full state in seconds.
End-of-session update writes what was done + what remains.
Mark a feature complete only after end-to-end verification.

See Effective harnesses for long-running agents.

Pairs with context editing + compaction

Memory + context editing (clears specific tool results client-side) + compaction (server-side conversation summarization) is the canonical long-running-agent stack.

9. Tool search — `tool_search_tool_bm25` / `tool_search_tool_regex`

Server tool used implicitly when you have many tools and want to defer their definitions out of context. Enabled by default in Claude Code for MCP tools. Cost: standard token usage.

For Claude API: add defer_loading: true to individual tools, include tool_search_tool_bm25 (or _regex) in tools[]. Claude calls the search tool to find relevant deferred tools, only those load into context.

10. Multi-tool composition

A “full stack” Claude Code-style agent often includes:

tools=[
    {"type": "computer_20251124", "name": "computer",
     "display_width_px": 1024, "display_height_px": 768, "display_number": 1},
    {"type": "text_editor_20250728", "name": "str_replace_based_edit_tool"},
    {"type": "bash_20250124", "name": "bash"},
    {"type": "memory_20250818", "name": "memory"},
    {"type": "web_search_20260209", "name": "web_search"},
    {"type": "web_fetch_20260309", "name": "web_fetch"},
    {"type": "code_execution_20260120", "name": "code_execution"},
    # plus your own custom tools
]

plus the appropriate beta header (computer-use-2025-11-24 covers computer + bash + text editor in many flows).

System-prompt tokens grow accordingly — cache aggressively.

11. Common gotchas across tools

Wrong tool version for the model: code_execution_20260120 on Haiku 4.5 → 400 error. Match the matrix.
Forgetting the beta header: silently strips the tool from the request.
Not passing encrypted_content / encrypted_index back: breaks web search citations in multi-turn.
Multi-environment confusion: code execution + client bash → Claude conflates state. Document the split in system prompt.
Computer use screenshot bloat: a 4K screenshot = 50k+ tokens. Resize.
Memory path traversal: validating prefixes alone is insufficient — resolve canonical path then check.
Container reuse: code execution sandboxes have ~24h max session lifetime; design for re-init.

12. Further reading

Tool reference — full directory of Anthropic-provided tools
Server tools — shared mechanics for Anthropic-executed tools
Computer use tool
Code execution tool
Memory tool
Web search tool
Web fetch tool
Bash tool
Text editor tool
Programmatic tool calling — invoking your tools from inside code_execution
Anthropic Quickstarts: computer use demo
Effective harnesses for long-running agents

Compendium

Explorer

Computer use, code execution, memory, bash, text editor, web search, web fetch

Computer use, code execution, memory, bash, text editor, web search, web fetch

See also

1. The seven tools at a glance

2. Web search — web_search_20250305 / web_search_20260209

Definition

Pricing

Dynamic filtering (web_search_20260209 only)

Citation behavior

Multi-turn requirement

Errors

Platform availability

3. Web fetch — web_fetch_20250910 / …20260209 / …20260309

Definition

Behavior

Pricing

4. Code execution — code_execution_20250522 / …20250825 / …20260120

Tool versions

Definition

Capabilities

Pricing

Containers

Platform availability

Multi-environment hazard

5. Bash — bash_20250124

Definition

Tool input shape

Tool result

Implementation tips

6. Text editor — text_editor_20250124 / …20250429 / …20250728

Definition

Commands

Return format

7. Computer — computer_20250124 / computer_20251124

Beta headers (required)

Definition

Actions (input shapes)

Tool result

Reference implementation

Security floor (per docs)

8. Memory — memory_20250818

Definition

Commands

Auto-prefix system prompt

Security floor

SDK helpers

Multi-session software-development pattern

Pairs with context editing + compaction

9. Tool search — tool_search_tool_bm25 / tool_search_tool_regex

10. Multi-tool composition

11. Common gotchas across tools

12. Further reading

Graph View

Table of Contents

Backlinks

2. Web search — `web_search_20250305` / `web_search_20260209`

Dynamic filtering (`web_search_20260209` only)

3. Web fetch — `web_fetch_20250910` / `…20260209` / `…20260309`

4. Code execution — `code_execution_20250522` / `…20250825` / `…20260120`

5. Bash — `bash_20250124`

6. Text editor — `text_editor_20250124` / `…20250429` / `…20250728`

7. Computer — `computer_20250124` / `computer_20251124`

8. Memory — `memory_20250818`

9. Tool search — `tool_search_tool_bm25` / `tool_search_tool_regex`