Back to rankings

Claude Code Adds a Restricted Mode Flag

Claude CodeView original changelog

Claude Code 2.1.248 introduced a new --restricted flag (also settable via CLAUDE_CODE_RESTRICTED=1) that strips out the built-in tools capable of running arbitrary commands or code, along with WebFetch unless it is explicitly named in --tools. In this mode Claude Code refuses bypassPermissions outright, confines file tools to the working directory, and ignores user, project, and local settings files so an untrusted or scripted context cannot quietly loosen its own rules. The feature gives teams a hardened, opt-in profile for running Claude Code in CI pipelines, review bots, or other automated contexts where a full-permission agent would be unacceptable.

Key Takeaways

  • A new opt-in lockdown mode strips code-execution and network tools from Claude Code, aimed at CI pipelines and unattended automation rather than everyday interactive use.
  • bypassPermissions is refused outright under restricted mode, closing a path that other hardening fixes this month were built around plugging.
  • Local settings files are ignored entirely, preventing a repository's own configuration from quietly re-expanding permissions the operator intended to restrict.
  • File tools stay confined to the working directory, limiting the blast radius even for the tools that remain available.
  • WebFetch is off by default in this mode and must be explicitly re-added via --tools, treating outbound network access as a privilege rather than a default.
  • It goes further than dontAsk mode, which auto-denies prompting tool calls — restricted mode removes those tools from the session entirely.

A Locked-Down Profile for Automated Contexts

Claude Code 2.1.248 shipped a new restricted mode, activated with the --restricted command-line flag or the CLAUDE_CODE_RESTRICTED=1 environment variable. Rather than adding another permission prompt, it removes an entire category of capability up front: Claude Code drops the built-in tools that execute shell commands or run code, and also drops WebFetch unless the operator explicitly re-adds it through --tools.

What Changes Under Restricted Mode

File-editing tools are not removed, but they are boxed in: reads and writes stay confined to the working directory, so Claude Code cannot reach outside the folder it was launched from. The mode also closes a well-known escape hatch by refusing bypassPermissions even if it is requested, and it ignores user, project, and local settings files entirely, so a repository's own configuration cannot re-enable something the operator meant to lock down.

Why It Matters

Most Claude Code hardening to date has come in the form of bug fixes closing accidental permission leaks. Restricted mode is different: it is a deliberate, opt-in posture aimed at anyone embedding Claude Code inside CI pipelines, review bots, or other unattended automation where a mistakenly permissive agent could do real damage. It sits alongside the existing dontAsk mode, which Anthropic already documents for CI pipelines and restricted environments — but where dontAsk auto-denies tool calls that would otherwise prompt, restricted mode goes further and removes the risky tools from the session altogether.