Use --tools to Restrict Which Built-In Tools Claude Can Use
The --tools flag controls which built-in tools are available to Claude in a session. This is different from --allowedTools (which controls auto-approval) and --disallowedTools (which hides specific tools). With --tools, you define the complete set of tools Claude can see.
# Only allow reading and searching, no editing or bash
claude --tools "Read,Grep,Glob"
This is useful when you want Claude to analyse code without any risk of modification. By limiting tools to read-only operations, you get a safe research assistant:
# Read-only analysis mode
claude --tools "Read,Grep,Glob" "Find all places where we handle authentication"
You can also disable all tools entirely with an empty string, which turns Claude into a pure chat assistant with no file or shell access:
claude --tools ""
Or use "default" to explicitly enable the full set:
claude --tools "default"
The available built-in tools include Bash, Read, Edit, Write, Glob, Grep, Agent, and others. This flag pairs well with --print mode for building constrained pipelines where Claude should only use specific capabilities.
Control the toolbox, not just the permissions.
Log in to leave a comment.
The autoUpdatesChannel setting pins Claude Code to a stable release track that skips versions with major regressions.
The language setting makes Claude respond in your preferred language by default, across every session and project.
The attribution setting lets you customize or completely remove Claude's Co-Authored-By trailer from git commits and pull requests.