--disallowedTools<rules...>
Lists deny rules, which either remove a tool outright or refuse only the calls that match.
FlagsPermissions and securitycurrent
What the documentation does not say
A bare name removes the tool from Claude context, so Edit takes editing away and mcp__* clears every MCP tool. A scoped rule such as Bash(rm *) leaves the tool in place and denies only those calls. A rule naming EndConversation cannot remove it while any other tool remains.
- Arguments
- <rules...>
- Also known as
- --disallowed-tools