Claude Code adds a --restricted flag for shared and unattended machines

Running claude on a shared box — an eval harness, a CI runner, a machine you don't fully trust — has always meant relying on whatever permission rules happen to be in place, and hoping no project or local settings file quietly loosens them. Claude Code 2.1.248 (August 27, 2026) adds a flag that removes the trust instead of asking you to configure it.

claude --restricted -p "query"

--restricted (or CLAUDE_CODE_RESTRICTED=1) does four things at once:

• Removes the built-in tools that run commands or code, and WebFetch, unless you name them individually with --tools — naming them through the default preset doesn't bring them back.
• Confines the built-in file tools to the session's working directories.
• Loads only managed settings and whatever you pass with --settings; user, project, and local settings files are ignored.
• Refuses bypassPermissions mode, and refuses to create cloud sessions.

The target case is an evaluation harness or a shared machine driving claude where you need a guarantee that the session can't read that machine's ambient settings or reach outside the directory it was given — not just a default that a stray .claude/settings.json could override.

claude --restricted --tools "Read,Grep" -p "query"

Naming a tool in --tools is the only way to get a command- or code-running tool back under --restricted; it still has to be an explicit, individual name.

What this means

--restricted is a stronger guarantee than tightening --allowedTools or --tools on their own, because it also closes the settings-file and bypass-permissions escape hatches those flags leave open. See the Claude Code sheet for the rest of the launch flags.