{"version":"2.1.321","anchor":"tools-withholding-applies-a-per-tool-filter","canonical_anchor":"tools-withholding-applies-a-per-tool-filter","heading":"Tools left out under --tools can now also be excluded by an extra per-tool check","tier":"internal","area":"Tools","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.321\/e\/tools-withholding-applies-a-per-tool-filter","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.321","markdown":"### Tools left out under --tools can now also be excluded by an extra per-tool check\n\nThe step that withholds tools not named in `--tools` can now apply an extra check that excludes individual tools\n\n**Unclear.** Which tools the extra per-tool check excludes is not stated.\n\n**What**\n\n`--tools` is a command-line option that limits which built-in tools Claude may use in a session. A tool is an action Claude can take, such as reading a file or running a command. When Claude Code works out which tools to withhold under `--tools`, that step can now also run an extra check on each tool, and that check can exclude a tool.\n\nA tool withheld because `--tools` does not name it still produces the warning that it \"is not on this session's --tools list and no deny rule names it; withheld\".\n\n**Why**\n\nThis is a small change. The warning you see for tools left off your `--tools` list stays the same.\n\n- Area: Tools\n- Names: `--tools`\n- Tier: Under the hood\n- Useful: 2\/5\n- Signal: 2\/5\n- Scope: individual\n- Heads-up: no"}