What probably matters to youSection of the release
What
A new command-line flag, also settable as the environment variable CLAUDE_CODE_RESTRICTED=1, starts a locked-down session that drops the built-in tools which run commands or code (Bash, PowerShell, REPL) plus WebFetch unless --tools names them, confines the file tools to the working directories, refuses bypassPermissions, and loads no user, project or local settings files. Neither the flag nor the variable existed in 2.1.247, and nothing gates it: pass it and it applies, leave it off and the session behaves as before.
Details
Registered as a normal CLI option and also read straight off the process arguments by the early argv scan during settings load, so it takes effect from the very start of launch on any invocation, not just commands that register it.
Managed settings and an explicit --settings file still apply; the rest of the setting-sources list is emptied.
Writes to settings, git and tool-configuration files require explicit approval.
Attachments outside the working directory are rejected, and cloud sessions are blocked outright.
The restriction latches onto the launch options and is re-emitted when Claude Code rebuilds its own argv, respawns itself or launches helper sessions, so relaunches and child sessions stay restricted.
Denials name the mode: --restricted: path outside the working directory from the file tools, and bypassPermissions not supported in restricted mode.
The dispatch command carries the one registered option description, "Start dispatched sessions in restricted mode".
Startup telemetry records a restricted field, the cloud-session capability table lists restricted as a tool restriction, and the SDK counts restricted among the options that mark a launch as non-default.
Usage
claude --restricted
CLAUDE_CODE_RESTRICTED=1 claude
Evidence
restricted: le,, --restricted: path outside the working directory, bypassPermissions not supported in restricted mode, CLAUDE_CODE_RESTRICTED, ...(n.restricted ? ["--restricted"] : []),, Start dispatched sessions in restricted mode, strictMcpConfig: !1,, Restricted mode: removes the built-in tools that run commands or code
Strings lifted out of the shipped bundle, so the claim above can be checked against them.
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed sinceAnthropic's documentation has since written up --restricted, on Tools reference.* A permissions [deny rule](/docs/en/permissions#match-all-uses-of-a-tool), the `--disallowedTools` flag, or [`--restricted`](/docs/en/cli-reference#cli-flags) removes `Bash` from the session.tools-referencesee the edit
Confirmed sinceAnthropic's documentation has since written up --tools, on Tools reference.* You name `Glob` or `Grep` in [`--tools` or `--allowedTools`](/docs/en/cli-reference#cli-flags) when you start the session, or in the equivalent [Agent SDK](/docs/en/agent-sdk/overview) options. With `--tools` you get the ones you list, a…tools-referencesee the edit
Added sinceA small documentation edit on CLI reference touched a line naming --tools after this was published.| `--tools` | Restrict which built-in tools Claude can use. Use `""` to disable all, `"default"` for the default set, or tool names like `"Bash,Edit,Read"`. On macOS, Linux, and WSL, the default set leaves out `Glob` and `Grep`, as describ…cli-referencesee the edit
How sure we are
Two sources agreeTwo things we can check say the same as this entry.
Anthropic's documentation agreesA small documentation edit on CLI reference touched a line naming --tools after this was published.
Anthropic's release notes agreeAdded --restricted (or CLAUDE_CODE_RESTRICTED=1): removes the built-in tools that run commands or code and WebFetch (unless named in…
The name it cites is new in this buildNew in this build: --restricted
