A Claude Code user alleged that the signed-in account email appeared in an HTTP User-Agent header during web searches. Anthropic’s documented privacy mod checks for a narrower pattern in certain tool calls and does not check WebSearch, WebFetch or MCP calls.
What the Claude Code report alleges
Taylor Edwards opened issue #107757 on November 5, 2026, alleging that Claude Code sent the signed-in user’s email in an outbound User-Agent header during web searches. A User-Agent is a header in an HTTP request that identifies the software making the request. Edwards listed Claude Code 2.1.318, macOS (darwin) and tmux as the setup.
What the privacy mod checks
A Claude Code repository contributor, Alice T’Poteat, said the built-in cc-plugin-privacy mod was introduced in version 2.1.317 and later, enabled by default, and could be turned off with /plugins. Anthropic’s mod documentation describes a specific check: it looks at Bash, PowerShell or Monitor tool calls when the input contains both the account email and a recognized User-Agent indicator.
The documentation lists runtime-computed values, variables, named files and some other header constructions among forms the check may miss. It is a narrow check over tool-call input, not a general safeguard for every way an email might be sent.
Web and MCP calls are outside the check
Anthropic’s documentation says the mod does not check WebFetch, WebSearch or MCP calls. That includes WebSearch, the type of activity named in Edwards’ allegation.
The issue lists 2.1.318 as the reporter’s version. Separately, T’Poteat said the built-in mod was introduced in 2.1.317 and later.
For this mod, the call type matters: its documented check covers a particular pattern in selected shell-like calls, not WebSearch, WebFetch or MCP.
