Tools & Permissions

All Claude Code tools are disabled by default. Learn how to selectively enable them and what each one does.

Default Behaviour

All Claude Code tools are disabled by default. This is intentional — it prevents potentially harmful operations (like file writes or shell commands) from running automatically the first time you open a session.

You need to explicitly enable the tools you want to use.

Enabling Tools

Click the gear icon in the sidebar to open Tools Settings
Toggle on the tools you need
Your preferences are saved locally and persist across sessions

Recommended approach: Start with read-only tools enabled and add write/execute permissions only when you need them.

Available Tool Categories

Tool	What it does	Risk level
`Read`	Read file contents	Low
`Glob` / `Grep` / `LS`	Search and list files	Low
`Edit` / `MultiEdit` / `Write`	Modify and create files	Medium
`Bash`	Run shell commands	High
`Bash(git log:*)`	Scoped bash — git log only	Low
`WebFetch` / `WebSearch`	Access the web	Medium
`Task`	Spawn sub-agents	Medium

Scoped Bash Permissions

Rather than enabling all Bash commands, you can scope permissions to specific commands:

json

{
  "permissions": {
    "allow": [
      "Bash(npm run lint)",
      "Bash(npm run test *)",
      "Bash(git log:*)"
    ],
    "deny": [
      "Bash(curl *)",
      "Read(./.env)"
    ]
  }
}

This is written to your ~/.claude/settings.json and takes effect immediately in both CloudCLI UI and the Claude Code CLI.

How Settings Sync

Permission changes you make in CloudCLI UI are written directly to your local ~/.claude config. This means:

Changes appear immediately in your Claude Code CLI sessions
MCP servers you add via the UI show up when you run claude in your terminal
There is no separate config to maintain

Project-Scoped vs Global Permissions

Settings can be scoped at two levels:

Global (~/.claude/settings.json) — applies to all projects
Project (.claude/settings.json in the project root) — overrides global for that project only

Project-scoped settings can be committed to your repo so teammates share the same tool configuration. If you're working with a team, shared cloud environments for teams let you distribute MCP servers, tool permissions, and context files to every developer automatically.