Bash
A Claude Code tool, read out of the shipped bundle. It has been in the build since v2.1.138, including the newest one read.
Spawning an agent with a bad command clamp list now fails immediately instead of running unclamped.
Not Anthropic's. This is the line from the earliest changelog entry here that named it, v2.1.227.
In the changelogs
33Releases whose published page names Bash.
-
v2.1.299
Plugin evals can now take tools away from Claude with --disallow-tools
The plugin eval runner accepts
--disallow-toolsand a per-casedisallowed_toolslist, and scores runs that end on an API error as 0found in this entry's text
-
v2.1.293
Bash policy also covers PowerShell, and an empty allowed-folders list blocks every folder
A bare
Bashkey inbuiltinToolPolicyalso governs PowerShell, and an emptyallowedWorkspaceFolderslist now allows no folder at allfound in this entry's text
-
v2.1.289
Fewer
findcommands are allowed without askingClaude Code now asks before running some
find,test,jobsandsetcommands that it used to treat as safe to run automaticallyfound in this entry's text
-
v2.1.285
Handling of the --tools flag reorganized, with the same warnings
The code that reads
--toolsand warns about unknown tool names was moved into one place; the warning text is unchangedfound in this entry's text
-
v2.1.282
Bash permission rules with
:*in the middle no longer fail to loadBash permission rules like
Bash(foo:bar), with:not at the end, are no longer rejected as invalidfound in this entry's text
-
v2.1.280
Bash tool enforces a hard sandbox requirement for remote/SDK-issued calls
Bash/PowerShell now refuses remote-issued commands if a fully confining sandbox can't be confirmed
found in this entry's text
-
v2.1.280
Bash tool pre-spawn failures can now report a structured error code
Failed Bash commands that never even started now report a structured preSpawnErrorCode
found in this entry's text
-
v2.1.280
Bash tool validateInput gets an added asynchronous host-side check
Bash tool input validation adds a second, host-side asynchronous check after the existing one
found in this entry's text
-
v2.1.277
New tool
backgroundingfield controls detach/self/never execution modeTools gain a
backgroundingsetting controlling whether they can keep running in the backgroundfound in this entry's text
-
v2.1.277
Per-tool 'backgrounding' classification rolled out across nearly all built-in tools
Nearly every built-in tool now carries a 'backgrounding' classification of never, self, or detach
found in this entry's text
-
v2.1.275
Coordinator Bash safety restriction exists but is compiled off
A safety check that would block risky Bash calls from a coordinator agent exists in the code but is turned off
found in this entry's text
-
v2.1.273
Tool-preset exclusion syntax (
!ToolName) gated by a new killswitchTool presets can now exclude specific tools with a '!ToolName' syntax
found in this entry's text
-
v2.1.273
Named constant for the
!negation prefix in--toolsflag parsingThe
!negation prefix used in--toolsrules is now a named constantfound in this entry's text
-
v2.1.271
New system reminder against using
caton files near the Bash output limitNew guidance tells Claude to use the Read tool instead of cat for large files
found in this entry's text
-
v2.1.269
New 'bashEditDiff' snapshot/diff tracking system for the Bash tool, gated by config/env
New 'bashEditDiff' system snapshots the repo around Bash commands to track what they changed, controlled by an env var or config
found in this entry's text
-
v2.1.269
Bash tool's allowed_domains validation moved into validateInput
Bash tool now checks allowed_domains sandbox compatibility earlier, during input validation
found in this entry's text
-
v2.1.269
Tool architecture rework: many built-in tools moved to a create()/runEngine factory pattern
REPL, SendMessage, TaskCreate, TaskUpdate, feedback-draft, Workflow and Bash tools rebuilt on a shared factory pattern
found in this entry's text
-
v2.1.267
New auto-detected PostToolUse hook offers to connect GitHub after a push or PR create
Claude Code can now offer to connect GitHub to claude.ai right after you push or open a pull request
found in this entry's text
-
v2.1.260
Ambiguous backslash/parenthesis detection in permission rules
Permission rules with ambiguous backslashes, common in Windows paths, now error clearly instead of misparsing.
found in this entry's text
-
v2.1.257
Init frame schema gains 'host' and 'serving' fields for local tool serving to cloud sessions
The init frame can announce the local machine and whether it serves Bash, Read, Write and Edit calls to a cloud session.
found in this entry's text
-
v2.1.257
Tool dispatch can emit a 'tool.output' telemetry event with file contents/diffs/commands
A tool.output telemetry event can carry file contents, diffs and bash commands after a successful tool call, behind a gate.
found in this entry's text
-
v2.1.229
The built-in commit and PR command now blocks risky flags
The built-in commit-and-PR command can no longer use flags that rewrite history.
found in this entry's text
-
v2.1.227
Spawned agents can be clamped to a fixed set of shell commands
Spawning an agent with a bad command clamp list now fails immediately instead of running unclamped.
found in this entry's text
-
v2.1.207
Walnut Spire (
plugin evalGeneral Availability) [In Development]found in this entry's text
- v2.1.206
-
v2.1.205
/doctorredesigned as a comprehensive 8-check repair skillfound in this entry's text
- v2.1.108
-
v2.1.108
Permission Rule Wildcard Syntax Changed from
:tofound in this entry's text
-
v2.1.98
Monitor Tool
found in this entry's text
-
v2.1.94
/team-onboarding Command [Gradual Rollout]
found in this entry's text
- v2.1.72
-
v0.2.80
New Features
found in this entry's text
-
v0.2.65
New Features
found in this entry's text
First cited
0No release's published evidence quotes this name. The ledger indexes the Evidence lines of every changelog on this site, so this says nobody here has ever quoted it; it says nothing about how old the name is.
Presence across releases
2Build by build
265One row per release since the first build this name was read out of. Absent means the build was read and the name was not in it, never mined means no bundle for that release was ever archived, and a declared type or a default is only ever what that release's own bundle stated.
Read out of the published npm bundle release by release, and out of Anthropic's own documentation as this site captured it. Nothing on this page is a description anybody here wrote about what the tool does. All tools.