Summary
Claude Code v2.1.248 (late August 2026) introduced a --restricted flag (also CLAUDE_CODE_RESTRICTED=1) that removes built-in tools which run shell commands or code and disables WebFetch unless explicitly named in --tools, keeps file reads and writes inside the launch directory, refuses bypassPermissions, and ignores user, project, and local settings files.
What changed
A new restricted mode for Claude Code removes command/code-execution tools and WebFetch by default, scopes file tools to the working directory, refuses bypassPermissions, and ignores local/project/user settings so nothing risky is re-enabled implicitly.
Why it matters
It gives enterprises and CI or untrusted contexts a hardened default for running coding agents where arbitrary command execution and filesystem roaming are the main risks. Packaging least-privilege as a single flag lowers the bar for security-conscious adoption of agentic coding.
Evidence excerpt
The --restricted flag ... removes the built-in tools that run commands or code and WebFetch (unless named in --tools), keeps file tools inside the working directory, refuses bypassPermissions, and ignores user, project and local settings files.