--restricted
A Claude Code CLI flag, read out of the shipped bundle. It has been in the build since v2.1.248, including the newest one read.
Start in restricted mode. Use it when an evaluation harness drives claude on a shared machine and Claude Code must not run commands or read that machine's user and project settings. Claude Code removes the built-in tools that run commands or code, and WebFetch, unless you name them individually in --tools, not through the default preset. It also confines the built-in file tools to the working directories, loads only managed settings and --settings, refuses bypassPermissions, and refuses to create cloud sessions. Requires Claude Code v2.1.248 or later
Anthropic's own wording. Read off CLI reference, captured 2026-09-26.
In the changelogs
18Releases whose published page names --restricted.
-
v2.1.300
Help for
--restrictedno longer lists REPL among the removed toolsThe help text for
--restricteddrops REPL from its list of code-running tools that restricted mode removesfound in this entry's text, named in this entry
-
v2.1.295
New
CLAUDE_CODE_RESTRICT_PERSONAL_CONFIGmode restricts your own Claude Code filesSetting
CLAUDE_CODE_RESTRICT_PERSONAL_CONFIGstarts a session that restricts your own Claude Code files, alongside the other restricted modesfound in this entry's text
-
v2.1.292
Attached files are checked again to be the exact path that was approved
Under
--restrictedor the read block, an attached file must open at the same path that was approved, closing a gap through links swapped mid-readfound in this entry's text, named in this entry
-
v2.1.290
Attachment error messages show the file path in a tidied form
Errors about attachment paths now show a tidied version of the path instead of exactly what was typed
found in this entry's text, named in this entry
-
v2.1.290
--safe-modeis now checked the same way as--restrictedThe
--safe-modeflag now goes through the same check as--restrictedand--strict-mcp-config, run when it is neededfound in this entry's text, named in this entry
-
v2.1.287
plugin install --replaceexplains that it needs a full plugin idRunning
plugin install --replacewithout a name@marketplace id now says that id is needed and that nothing was installedfound in this entry's text
-
v2.1.281
Background handoff carries added directories and extra dispatch args
Sending a session to the background with the left arrow now carries your added directories and more launch arguments
found in this entry's text
-
v2.1.257
New settings key to confine file reads to trusted working directories
Reads outside your working directories can be made to fail closed, with a prompt option that persists the setting.
found in this entry's text, named in this entry
-
v2.1.248
New
--restrictedsession modeNew --restricted flag starts a locked-down session with no shell tools and no settings files.
named in this entry, found in this entry's text
-
v2.1.248
Restricted sessions drop implicit file allowances and cannot be talked out of a denial
Restricted sessions drop implicit file allowances, and a denial can't be argued away.
named in this entry, found in this entry's text
-
v2.1.248
Prewarmed and dispatched background sessions inherit restriction
Background sessions spawned from a restricted session stay restricted.
named in this entry, found in this entry's text
-
v2.1.248
Restricted sessions handled the same way whether set by flag or environment
Setting CLAUDE_CODE_RESTRICTED now restricts a session exactly as --restricted does.
named in this entry, found in this entry's text
-
v2.1.248
New sessions started from fleet view inherit
--restrictedNew background sessions started from a restricted session inherit --restricted.
named in this entry, found in this entry's text
-
v2.1.248
--restrictedconfines file tools to the working directoryRestricted sessions block file paths outside the working directory with no approval offered.
named in this entry, found in this entry's text
-
v2.1.248
Claude in Chrome is now also skipped in restricted sessions
Restricted sessions skip Claude in Chrome browser wiring, same as safe mode.
named in this entry, found in this entry's text
-
v2.1.248
Auto-memory is off in restricted sessions
Restricted sessions never write auto-memory, regardless of your settings.
named in this entry, found in this entry's text
-
v2.1.248
--restrictedrefuses attachments from outside the working directoryIn restricted mode, attachments from outside your working directory are rejected up front.
named in this entry, found in this entry's text
-
v2.1.248
Restricted sessions deny out-of-directory file access outright
Restricted sessions now deny out-of-directory reads and writes outright, with no prompt.
named in this entry, found in this entry's text
First cited
9The earliest release whose published evidence quoted --restricted was v2.1.248, 27 Aug 2026. That is the oldest release this project wrote about it, so it is a floor on the name's age and not the release that introduced it. It is not a presence reading: which builds carried the name is the table below.
3 further spans in the ledger name it. The list above is the earliest first and stops at 6.
Presence across releases
1Build by build
51One row per release since the first build this name was read out of. Absent means the build was read and the name was not in it, never mined means no bundle for that release was ever archived, and a declared type or a default is only ever what that release's own bundle stated.
Read out of the published npm bundle release by release, and out of Anthropic's own documentation as this site captured it. Nothing on this page is a description anybody here wrote about what the CLI flag does. All CLI flags.