Enable web_fetch in Grok Build

The web_fetch tool is off by default for security. Official switches live in the settings reference.

Turn it on

Environment (process-scoped):

export GROK_WEB_FETCH=1

Or in user ~/.grok/config.toml / $GROK_HOME/config.toml:

[features]
web_fetch = true

Project .grok/config.toml only contributes MCP, plugins, and permission rules — put [features] in the user config.

Optional egress proxy:

export GROK_WEB_FETCH_PROXY=https://proxy.example:8080

Or under [toolset.web_fetch] with proxy_endpoint and an optional allowed_domains list.

Confirm

grok inspect

Check that feature flags and tool discovery match what you set. Permission rules still apply: a deny on fetch-style tools wins over the feature flag — see Configure Grok Build permissions.

Related tools

• Built-in web_search is a different tool (search, not arbitrary page fetch). Model routing for search uses GROK_WEB_SEARCH_MODEL / [models] web_search.
• Disable web search for one run with --disable-web-search on the CLI (CLI reference).

Pitfalls

• Leaving web_fetch on in shared or untrusted workspaces expands what the agent can pull over the network.
• Proxy and domain allowlists only apply when you set them — defaults do not invent a corporate allowlist for you.
• ZDR / hosted-output restrictions are a separate tools setting (disable_zdr_incompatible_tools); do not confuse that with web_fetch.