--disallowed-tools
A Claude Code CLI flag, read out of the shipped bundle. It has been in the build since v2.1.138, including the newest one read.
Also written --disallowedTools. Every list on this page counts all of these spellings together.
Deny rules. A bare tool name removes the matching tools from Claude's context: "Edit" removes Edit, "" removes every tool, and "mcp__" removes every MCP tool. A scoped rule such as Bash(rm *) leaves the tool available and denies only calls that match as written. A rule naming EndConversation can't remove it while any other tool remains
Anthropic's own wording. Read off CLI reference, captured 2026-09-26.
In the changelogs
13Releases whose published page names --disallowed-tools.
-
v2.1.299
--toolsexplains that it cannot remove MCP toolsPassing an MCP tool to
--toolsnow fails with a message saying to use--disallowed-toolsinsteadfound in this entry's text, named in this entry
-
v2.1.299
Cloud sessions now warn that wildcard connector deny rules block nothing
In a cloud session, a
--disallowed-toolsrule with*in a claude.ai connector's name is now reported as blocking no connectorfound in this entry's text, named in this entry
-
v2.1.296
Cloud sessions now refuse tool restrictions instead of quietly ignoring them
Starting a cloud session with
--toolsor--disallowed-toolsrestrictions it cannot apply now fails with an errorfound in this entry's text, named in this entry
-
v2.1.285
Cloud sessions gain messages for limiting tools with --tools
Cloud sessions now have messages for limiting a session to the tools you list with
--tools, covering empty lists, unsupported cases and org limitsfound in this entry's text
-
v2.1.281
--disallowed-tools is now accepted when starting a cloud session
--disallowed-tools is now passed through to new cloud sessions, but still refused when attaching to an existing one
found in this entry's text, named in this entry
-
v2.1.281
--disallowedTools now forwarded to cloud sessions
Tools you block with --disallowedTools now stay blocked in cloud sessions you start
found in this entry's text
-
v2.1.281
Cloud sessions: clear errors for a deny list on attach and for an unclosed --disallowed-tools rule
Cloud sessions now give clear errors when attach flags would change the deny list, or a --disallowed-tools rule has an unclosed parenthesis
found in this entry's text, named in this entry
-
v2.1.281
Cloud sessions: clearer --tools rejection; --disallowed-tools no longer listed as rejected
Cloud sessions reject
--toolswith a clearer message, and--disallowed-toolsis no longer on the rejected listfound in this entry's text, named in this entry
-
v2.1.257
allowManagedPermissionRulesOnly semantics clarified/expanded
The allowManagedPermissionRulesOnly description now spells out exactly which rule sources it ignores and which still apply.
found in this entry's text
-
v2.1.242
Cloud-hosted sessions now refuse local CLI options instead of quietly dropping them
Running with --cloud now tells you which local CLI options were ignored or refused, and why.
found in this entry's text
-
v2.1.234
Early flag scan no longer mistakes tool lists and directories for flags
Tool lists and directories passed to flags are no longer misread as flags themselves at startup.
named in this entry, found in this entry's text
-
v2.1.232
Cloud gateway sign-in explains its restart, and refuses when it cannot
Cloud gateway sign-in explains its restart, and ends the session when a restart can't carry state.
found in this entry's text
-
v0.2.120
Tool Permission Handling Improvements
found in this entry's text
First cited
2The earliest release whose published evidence quoted --disallowed-tools was v2.1.281, 23 Sep 2026. That is the oldest release this project wrote about it, so it is a floor on the name's age and not the release that introduced it. It is not a presence reading: which builds carried the name is the table below.
Presence across releases
1Build by build
149One row per release since the first build this name was read out of. Absent means the build was read and the name was not in it, never mined means no bundle for that release was ever archived, and a declared type or a default is only ever what that release's own bundle stated.
Read out of the published npm bundle release by release, and out of Anthropic's own documentation as this site captured it. Nothing on this page is a description anybody here wrote about what the CLI flag does. All CLI flags.