What
When Claude Code creates a remote session, the request now includes disallowed_tools. These are tools the session is not allowed to use. The list combines the caller's own disallowedTools with the built-in list used for device-bound sessions. The request carries disallowedTools alongside allowedTools.
Before, the request sent only the fixed built-in list, and only for device-bound sessions.
Why
Tools you block when starting a remote session are now actually passed on to that session, instead of being dropped.
Names in the bundledisallowedTools
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Added since
A small documentation edit on Create custom subagents touched a line naming disallowedTools after this was published.
The full content of each listed skill is injected into the subagent's context at startup, up to the first 32 distinct names in the list. This field controls which skills are preloaded, not which skills the subagent can access: without it, …sub-agents see the edit
Confirmed since
Anthropic's documentation has since written up disallowedTools, on Create custom subagents.
* **[Frontmatter fields](#supported-frontmatter-fields)**: `description`, `tools`, `disallowedTools`, `model`, `permissionMode`, `mcpServers`, `hooks`, `maxTurns`, `skills`, `initialPrompt`, `memory`, `effort`, `background`, `omitClaudeMd`…sub-agents see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up disallowedTools, on Create custom subagents.