Claude Code tools: the built-in tool list and how to control it

Claude Code tools are the built-in actions Claude uses to work on your code: Read, Edit and Write for files, Bash for shell commands, WebSearch and WebFetch for the web, Agent for subagents, and dozens more. You rarely call them yourself, but their exact names are what you type in permission rules, hook matchers and subagent tool lists.

This guide lists the tools you will meet most, shows which ones ask permission, and explains how to allow, restrict or remove them. It is based on the official tools reference, checked on 24 October 2026. The exact set in your session depends on your provider, platform and settings.

What are tools in Claude Code?

A tool is a named capability the model can call. When you ask Claude to fix a failing test, it might call Bash to run the suite, Read to open the test file, Edit to change one line, and Bash again to confirm the fix. Each call goes through Claude Code's permission system before it runs.

The docs put it this way: "The tool names are the exact strings you use in permission rules, subagent tool lists, and hook matchers." That is the main reason to learn them. If you want to block web access, let tests run without prompts, or give a reviewer subagent read-only access, you do it by tool name.

There are two ways to extend the list. To add new tools, connect an MCP server. To add reusable workflows, write a skill, which "runs through the existing Skill tool rather than adding a new tool entry."

Which built-in tools does Claude Code have?

These are the tools most people configure. The "Asks permission" column reflects Manual mode for paths inside the working directory, as the docs define it.

The full reference also covers scheduling tools (CronCreate, CronList, CronDelete, RemoteTrigger), messaging tools (SendMessage, ListAgents), MCP resource tools, PushNotification, SendUserFile, Artifact and others. TaskOutput was removed in v2.1.277.

Two notes from the docs on the permission column. File tools marked No still prompt for paths outside your working directory and added directories. In auto mode, a classifier decides most permission prompts instead of you.

How do you allow or block a Claude Code tool?

Every place that takes a tool name uses the same rule format, ToolName(specifier):

• permissions.allow and permissions.deny in settings, and the /permissions screen
• the --allowedTools and --disallowedTools CLI flags
• a skill's allowed-tools frontmatter
• a hook's if condition

The specifier depends on the tool:

A practical settings example that lets tests run without prompts, allows one docs domain and keeps secrets unreadable:

{
  "permissions": {
    "allow": ["Bash(npm test *)", "WebFetch(domain:docs.python.org)"],
    "deny": ["Read(./.env)", "Read(~/secrets/**)"]
  }
}

Two interactions are easy to miss. An Edit(...) allow rule also grants read access to that path. A Read(...) deny rule also blocks Edit and Write on the same path, including creating a new file there.

Hook matcher fields are different: they take bare tool names, not the parenthesized format. See the permissions guide and the hooks guide for the full rule syntax.

What is the difference between --tools, --allowedTools and --disallowedTools?

These three flags look similar but do different jobs, according to the CLI reference:

A read-only review run, for example, can strip everything except reading and searching:

claude -p --tools "Read,Grep,Glob" "review src/auth for injection risks"

How do the most-used tools behave?

Bash. Each command runs in a separate process. A cd carries over to later commands while it stays inside the project or an added directory, but environment variables do not: an export in one command is gone in the next. Activate your virtualenv before launching Claude Code, or set CLAUDE_ENV_FILE. The default timeout is two minutes and the ceiling is ten, set with BASH_DEFAULT_TIMEOUT_MS and BASH_MAX_TIMEOUT_MS. Output beyond roughly 30,000 characters is saved to a file that Claude reads as needed. Long-running processes like dev servers can run in the background; list and stop them with /tasks.

Read. Returns file contents with line numbers. Images come back as visual content Claude can see. PDFs longer than 10 pages are read in ranges of up to 20 pages, which needs pdftoppm from poppler-utils. One call returns at most 25,000 tokens by default, so large files are read in pages. Read refuses binary formats such as .xlsx or .zip.

Edit and Write. Edit does exact string replacement with no regex or fuzzy matching, and the text to replace must appear exactly once unless Claude sets replace_all. Write overwrites the whole file. Older models such as Claude Opus 4.6 and Haiku 4.5 must read a file before editing it; newer models can skip the read when it would not need a permission prompt.

Glob and Grep. On macOS, Linux and WSL these are absent by default, and Claude searches with find and grep through Bash. Grep uses ripgrep syntax and skips gitignored files. Glob does not respect .gitignore by default and caps results at 100 files.

WebFetch and WebSearch. WebFetch converts a page to Markdown and runs your prompt against it in a separate model call, so the docs call it "lossy by design." It refuses localhost, upgrades HTTP to HTTPS, and caches responses for 15 minutes. WebSearch returns titles and URLs only; an interactive session is limited to 200 searches, adjustable with CLAUDE_CODE_MAX_WEB_SEARCHES_PER_SESSION. Amazon Bedrock does not expose web search.

How do you give a subagent only some tools?

A subagent's tools frontmatter field lists the tools it may use, by the same names. A reviewer that should only read code might look like this, saved under .claude/agents/:

---
name: code-reviewer
description: Reviews changes for bugs and security issues. Use after edits.
tools: Read, Grep, Glob
---
Review the changed files and report problems with file and line references.

Listing Glob or Grep while leaving out Bash brings the listed tools back for that subagent on macOS, Linux and WSL. The subagents guide covers the other frontmatter fields.

How do you check which tools are loaded?

Ask in the session: "What tools do you have access to?" Claude answers in plain language. For exact MCP tool names, run /mcp. The task-tracking tools (TaskCreate, TaskList and friends) are only on by default for older models such as Opus 4.7 and Sonnet 4.6; set CLAUDE_CODE_ENABLE_TODO_TOOLS=1 to get them on newer ones.

Once you settle on a set of allow and deny rules or a tool-restricted subagent you like, it is worth keeping the snippet somewhere you can reuse it. Kipt stores prompts and Agent Skills as Markdown in a private GitHub repo you own, so a subagent brief or a skill with allowed-tools travels with you to the next project.