What
A disallowedTools entry naming a tool now also blocks the batched wrapper around that tool. Previously a rule written against the original name did not stop the wrapped form.
Details
- Wrapper tools carry the name of the tool they wrap, and the permission check treats a match on that name as a match on the wrapper.
- The same lookup is applied to the plan-mode and read-only tool sets, so a wrapper cannot be used to run something those modes exclude.
- Applies whenever a batching tool is present; there is no flag.
Evidence
if (a.underlyingV1ToolName !== void 0 && t.has(a.underlyingV1ToolName)), if (n.underlyingV1ToolName && w0(t, { name: n.underlyingV1ToolName }, r))
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
Names in the bundledisallowedTools
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Added since
A small documentation edit on CLI reference touched a line naming disallowedTools after this was published.
| `--tools` | Restrict which built-in tools Claude can use. Use `""` to disable all, `"default"` for the default set, or tool names like `"Bash,Edit,Read"`. On macOS, Linux, and WSL, the default set leaves out `Glob` and `Grep`, as describ…cli-reference see the edit
Confirmed since
Anthropic's documentation has since written up disallowedTools, on Create custom subagents.
| `disallowedTools` | No | Tools to deny, removed from inherited or specified list. An entry with a specifier, such as `Bash(git push *)`, still [removes the whole tool](#available-tools) |sub-agents see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up disallowedTools, on Create custom subagents.