CLAUDE_CODE_SCRIPT_CAPS Environment Variable

What

Enforces per-script call limits in subprocess-scrubbed environments to prevent data exfiltration via repeated write operations.

Usage

export CLAUDE_CODE_SCRIPT_CAPS='{"curl": 10, "wget": 5}'

Details

JSON object mapping script/command name substrings to maximum call counts
Tracks cumulative usage across the session
Throws an error when a cap is exceeded: "Script call limit exceeded: X has been called N times (cap: M)"
Only active when CLAUDE_CODE_SUBPROCESS_ENV_SCRUB is enabled
Designed for untrusted-input workflows where exfiltration prevention is critical

Evidence

Script caps (search for "CLAUDE_CODE_SCRIPT_CAPS" and "Script call limit exceeded")

Strings lifted out of the shipped bundle, so the claim above can be checked against them.

How sure we are

One source agreesOne thing we can check says the same as this entry.

Anthropic's release notes agreeAdded subprocess sandboxing with PID namespace isolation on Linux when CLAUDE_CODE_SUBPROCESS_ENV_SCRUB is set, and CLAUDE_CODE_SCRIPT_CAPS…

See this entry in the whole of v2.1.98 →

The build it came inv2.1.98

9 Apr 2026 · 23 entries, this one is #7.

Either side of it

v2.1.97Older
v2.1.100Newer

Open the release →

Names in this entry

envCLAUDE_CODE_SCRIPT_CAPS
JSON object mapping a string to a numeric cap on how many times it may appear across the shell commands a session runs. It is read once, and applied only when CLAUDE_CODE_SUBPROCESS_ENV_SCRUB is true: before each shell command Claude Code counts each key's occurrences in the command text and fails with Script call limit exceeded once the running total passes the cap. Invalid JSON, a non-object, or no entries with a finite number disables it.
envCLAUDE_CODE_SUBPROCESS_ENV_SCRUB
A hidden --inherit-permission-mode flag lets a spawned session take its permission mode from whatever launched it.

Anthropic's note

Upstream's own release notes for v2.1.98 name something this entry names, so the two are probably about the same change. Probably: the pairing is made on a shared name rather than on the words around it.

Added subprocess sandboxing with PID namespace isolation on Linux when CLAUDE_CODE_SUBPROCESS_ENV_SCRUB is set, and CLAUDE_CODE_SCRIPT_CAPS env var to limit per-session script invocations

Is this right?