AI 程式開發工具
Claude Code 2.1.248 Adds Restricted Mode, Removing Command Execution and WebFetch by Default
A new flag confines file tools to the working directory and skips user and project settings, making it easier to run agents on evaluation platforms or shared hosts. Tools can still be re-enabled through launch arguments, and it is not an operating-system-level sandbox.
Anthropic has added `--restricted` in Claude Code 2.1.248, aiming to let evaluation harnesses, CI systems, and shared machines launch the coding agent with a smaller default permission set. When enabled, Claude Code removes built-in tools capable of executing commands or code, along with `WebFetch`; built-in file reading and writing tools can access only the working directory in effect at launch, and the mode cannot be combined with the `bypassPermissions` permission mode. The same behavior can also be enabled with `CLAUDE_CODE_RESTRICTED=1`.
Another important boundary concerns configuration sources. Restricted mode ignores user, project, and local settings files, loading only organization-managed settings and settings explicitly supplied through `--settings`. This prevents test results from being silently altered by hooks, tool permissions, or project-specific customizations on a developer's machine, while also reducing opportunities for a malicious repository to expand its capabilities through local configuration. For researchers comparing multiple agents, this provides a more reproducible minimal baseline than simply using `--tools`.
However, restricted mode does not provide enforced isolation. The documentation explicitly allows operators to add Bash, code execution, or `WebFetch` back individually using `--tools`. MCP tools are also not controlled by `--tools` and must be blocked separately with `--disallowedTools "mcp__*"`. The file boundary is enforced by Claude Code itself and cannot replace containers, virtual machines, read-only mounts, network policies, or low-privilege operating-system accounts. If a CI system processes untrusted pull requests, engineering teams must still establish genuine resource and network isolation at an outer layer.
The same release also adds per-subagent prompt-cache TTLs, cross-session messaging, and several cache fixes, but restricted mode is the change with the most direct impact on deployment models. Areas worth testing next include its interactions with symbolic links, MCP, hooks, and explicitly re-enabled tools, as well as whether Anthropic will provide an auditable threat model and sandbox-escape tests.