The everyday design of Claude Code’s tool surface: reads run freely; mutations ask. As of July 2026 there are 42 built-in tools; 13 ask for permission.
| Tool | What it does | Asks |
|---|---|---|
Read / Glob / Grep / LSP | Inspect the codebase | No |
Agent | Spawn a subagent in its own context | No (subagent’s tools still checked) |
Edit / Write / NotebookEdit | Change files | Yes |
Bash / PowerShell / Monitor | Run / watch commands | Yes |
WebFetch / WebSearch | Reach the network | Yes |
Skill / ExitPlanMode | Execute skill / leave plan mode | Yes |
Behaviors that bite
- Edit enforces read-before-edit - Claude must have read the file in this conversation;
old_stringmust match exactly once (orreplace_all). Viewing viacat/headcounts; piped output does not. - Bash is stateless between commands -
exportdoes not survive; 2-minute default timeout; 30k characters of output before spill to a file. - WebFetch is lossy - a small model answers Claude’s extraction prompt; “doesn’t mention X” may mean the prompt did not ask.
- Grep respects
.gitignore; Glob does not by default.
Restrict further with permission rules and the sandbox ladder. Full map: Claude Code tools.