--tools
A Claude Code CLI flag, read out of the shipped bundle. It has been in the build since v2.1.138, including the newest one read.
Restrict which built-in tools Claude can use. Use "" to disable all, "default" for the default set, or tool names like "Bash,Edit,Read". On macOS, Linux, and WSL, the default set leaves out Glob and Grep, as described under Glob tool behavior. If you name one of the task-tracking tools here, Claude Code also opts the session in. The flag doesn't affect MCP tools; to deny those too, use --disallowedTools "mcp__*". A list that omits EndConversation doesn't remove it; "" removes it only when no MCP tools remain
Anthropic's own wording. Read off CLI reference, captured 2026-09-26.
In the changelogs
22Releases whose published page names --tools.
-
v2.1.305
Mistyped
--toolsexclusions now also produce short security warningsA
--toolsexclusion that matches no built-in tool, or a bare prefix with no tool name, now also produces a short security warningfound in this entry's text, named in this entry
-
v2.1.304
--toolshelp now says "default" picks the default set of toolsThe help text for --tools now describes "default" as using the default set of tools rather than all tools
found in this entry's text, named in this entry
-
v2.1.299
--toolsexplains that it cannot remove MCP toolsPassing an MCP tool to
--toolsnow fails with a message saying to use--disallowed-toolsinsteadfound in this entry's text, named in this entry
-
v2.1.299
Cloud sessions now warn that wildcard connector deny rules block nothing
In a cloud session, a
--disallowed-toolsrule with*in a claude.ai connector's name is now reported as blocking no connectorfound in this entry's text
-
v2.1.299
Clearer errors and advice when starting cloud sessions
Cloud session launches now give plainer errors for
--toolson self-hosted environments, missing sign-in and some git failuresfound in this entry's text
-
v2.1.296
--toolshandling for cloud sessions reworkedFor cloud sessions,
--toolsis now sorted into the default set, a refused list or another list, and errors now name the refused toolsfound in this entry's text, named in this entry
-
v2.1.296
Cloud sessions started with
--toolsnow stop with an error on some environmentsStarting a cloud session with
--toolson a Remote Control, self-hosted or unknown environment now fails with a clear errorfound in this entry's text, named in this entry
-
v2.1.296
Cloud sessions now refuse tool restrictions instead of quietly ignoring them
Starting a cloud session with
--toolsor--disallowed-toolsrestrictions it cannot apply now fails with an errorfound in this entry's text, named in this entry
-
v2.1.295
Agent SDK passes options so values starting with a dash are not misread
The Agent SDK now passes many options as
--flag=value, so a value starting with a dash is no longer mistaken for another flagfound in this entry's text
-
v2.1.295
Tools left out of
--toolsare now withheld unless a deny rule names themA tool missing from the session's
--toolslist and named by no deny rule is now withheld, with a warningfound in this entry's text, named in this entry
-
v2.1.285
Handling of the --tools flag reorganized, with the same warnings
The code that reads
--toolsand warns about unknown tool names was moved into one place; the warning text is unchangedfound in this entry's text, named in this entry
-
v2.1.285
Cloud sessions gain messages for limiting tools with --tools
Cloud sessions now have messages for limiting a session to the tools you list with
--tools, covering empty lists, unsupported cases and org limitsfound in this entry's text, named in this entry
-
v2.1.281
Cloud sessions: clearer --tools rejection; --disallowed-tools no longer listed as rejected
Cloud sessions reject
--toolswith a clearer message, and--disallowed-toolsis no longer on the rejected listfound in this entry's text, named in this entry
-
v2.1.277
--tools flag now warns about removed built-in tools
--tools now shows a specific warning when you exclude a built-in tool that's been removed
found in this entry's text, named in this entry
-
v2.1.274
Permission/tool-scoping setup takes an explicit getAllBaseTools callback
Tool permission setup now takes the base tool list as an explicit parameter
found in this entry's text
-
v2.1.273
New CLI diagnostics for malformed --tools entries
The --tools flag now gives specific warnings for common typos and formatting mistakes
found in this entry's text, named in this entry
-
v2.1.273
Named constant for the
!negation prefix in--toolsflag parsingThe
!negation prefix used in--toolsrules is now a named constantfound in this entry's text
-
v2.1.267
Session can now run with built-in tools entirely disabled, and plugins are blocked from adding tools in that mode
Sessions can now run with all built-in tools disabled, and plugins are blocked from adding tools back in that mode
found in this entry's text
-
v2.1.248
New
--restrictedsession modeNew --restricted flag starts a locked-down session with no shell tools and no settings files.
named in this entry, found in this entry's text
-
v2.1.242
Cloud-hosted sessions now refuse local CLI options instead of quietly dropping them
Running with --cloud now tells you which local CLI options were ignored or refused, and why.
found in this entry's text
-
v2.1.239
Command-line flag parsing rewritten around an explicit table of value-taking flags
Flags that take values no longer swallow or drop their arguments, and
--is handled.named in this entry, found in this entry's text
-
v2.1.224
Self-hosted runner operator tools
Nine operator tools can inspect runners, sessions, secrets, health, metrics and logs, loaded only via --base-tools.
found in this entry's text
First cited
10The earliest release whose published evidence quoted --tools was v2.1.267, 9 Sep 2026. That is the oldest release this project wrote about it, so it is a floor on the name's age and not the release that introduced it. It is not a presence reading: which builds carried the name is the table below.
4 further spans in the ledger name it. The list above is the earliest first and stops at 6.
Presence across releases
1Build by build
149One row per release since the first build this name was read out of. Absent means the build was read and the name was not in it, never mined means no bundle for that release was ever archived, and a declared type or a default is only ever what that release's own bundle stated.
Read out of the published npm bundle release by release, and out of Anthropic's own documentation as this site captured it. Nothing on this page is a description anybody here wrote about what the CLI flag does. All CLI flags.