Use --tools to Restrict Which Built-In Tools Claude Can Use
The --tools flag controls which built-in tools are available to Claude in a session. This is different from --allowedTools (which controls auto-approval) and --disallowedTools (which hides specific tools). With --tools, you define the complete set of tools Claude can see.
# Only allow reading and searching, no editing or bash
claude --tools "Read,Grep,Glob"
This is useful when you want Claude to analyse code without any risk of modification. By limiting tools to read-only operations, you get a safe research assistant:
# Read-only analysis mode
claude --tools "Read,Grep,Glob" "Find all places where we handle authentication"
You can also disable all tools entirely with an empty string, which turns Claude into a pure chat assistant with no file or shell access:
claude --tools ""
Or use "default" to explicitly enable the full set:
claude --tools "default"
The available built-in tools include Bash, Read, Edit, Write, Glob, Grep, Agent, and others. This flag pairs well with --print mode for building constrained pipelines where Claude should only use specific capabilities.
Control the toolbox, not just the permissions.
Log in to leave a comment.
When Claude writes error messages, button labels, validation text, or onboarding flows, it defaults to generic developer-speak. Add a "Users" section to your CLAUDE.md describing who your actual users are — their technical level, industry jargon, and what they care about — so Claude writes copy that makes sense to THEM, not to developers.
Use the --agent flag with custom markdown files in .claude/agents/ to launch purpose-built Claude sessions with restricted tools and scoped system prompts.
Every project has traps — the billing module that silently fails if you forget to queue the job, the legacy table with column names that don't match the model, the config value that must be set before tests run. Document these gotchas in your CLAUDE.md so Claude avoids the same mistakes your team spent days debugging.