Wondering what Claude Code restricted mode actually does? The quick version is just below — and if you run AI agents on client work, codebases you don’t fully trust, or shared machines, this is the most important switch Anthropic has shipped in months.
Short answer:
Claude Code restricted mode is a new hard-lockdown switch: run claude --restricted or set CLAUDE_CODE_RESTRICTED=1.
It removes the built-in tools that run commands or code, and removes WebFetch, unless you explicitly name them in --tools.
File tools keep working but are confined to the working directory.
It refuses bypassPermissions and ignores user, project and local settings files completely.
It shipped in Claude Code v2.1.248 on 28 August 2026, per the official Claude Code changelog.
What Claude Code restricted mode actually does
In this guide I’m working directly from the official Claude Code changelog for v2.1.248 (published on Anthropic’s claude-code GitHub repository; the release landed 28 August 2026 per Releasebot’s tracking). Here’s the exact behaviour, in plain English.
When you start a session with claude --restricted — or set the environment variable CLAUDE_CODE_RESTRICTED=1 — four things change at once:
Command and code execution disappears. The built-in tools that run shell commands or execute code are removed from the session, along with WebFetch. The only exception is if you deliberately name a tool in --tools — so nothing risky comes back by accident.
File tools get fenced in. Reading and writing files still works, but only inside the working directory you launched from. The agent can’t wander off into your home folder, your SSH keys or another project.
No permission escalation. The session refuses bypassPermissions outright. There is no flag combination that turns a restricted session back into a fully autonomous one mid-run.
Settings files are ignored. User, project and local settings files don’t load at all. That closes a subtle hole: a repository you cloned five minutes ago can’t ship a .claude folder that quietly grants itself extra permissions or hooks.
Put together, that’s a genuinely different trust posture. Normal Claude Code is “powerful assistant, ask before dangerous things”. Restricted mode is “text-and-files worker that physically cannot run code” — which is what a lot of teams have been asking for since agents started touching production repositories.
Why this update matters more than it looks
Most Claude Code updates add capability. This one deliberately subtracts it, and that’s the story. If you’ve followed my Claude Code training content, you’ll know the biggest objection I hear from agencies and in-house teams isn’t “can the agent do the work?” — it’s “what happens if it does something we didn’t ask for?”
Restricted mode gives you a one-word answer for the security review. Prompt injection through a poisoned README? It can’t reach a shell. A malicious settings file in a cloned repo? Never loaded. An over-eager automation that tries to fetch a URL? WebFetch isn’t there. You’re left with a model that reads and writes files in one directory, and nothing else.
The same v2.1.248 release also shipped cross-session messaging on Bedrock, Vertex and Foundry deployments, a per-agent prompt-cache TTL setting, and a /usage-credits command for Enterprise organisations — but restricted mode is the headline for anyone running agents on real client work.
🔥 Want this set up without the guesswork? Getting Claude Code producing safe, hands-off SEO content pipelines — restricted mode included — is a solved problem. That is exactly what we do inside the AI Profit Boardroom — 3,700+ members, four live calls per week, daily tutorials, done-for-you templates and a 30-day roadmap. Prefer to talk it through first? Book a free SEO strategy session and I’ll map it out with you one-to-one.
How to turn on Claude Code restricted mode
Two ways, both from the changelog:
Per session:claude --restricted — ideal when you’re about to point Claude Code at an untrusted repository or let a junior team member experiment.
Per environment:export CLAUDE_CODE_RESTRICTED=1 — set it on a CI runner, a shared VPS or a client machine and every session on that box starts locked down, no matter how it’s invoked.
If you genuinely need one risky tool back — say you want WebFetch for a crawl — you can name it explicitly with --tools. The design is allow-list, not block-list: everything dangerous is off unless you asked for it by name.
Restricted mode vs normal mode at a glance
Behaviour
Normal Claude Code
Restricted mode
Run shell commands / code
Yes, with permission prompts
Removed (unless named in --tools)
WebFetch
Yes
Removed (unless named in --tools)
File reads/writes
Broad, permission-gated
Working directory only
bypassPermissions
Available
Refused
User/project/local settings
Loaded
Ignored
Where I’d use it in an SEO workflow
Here’s where this lands for the AI SEO crowd. A huge share of content operations is pure file work: audits over exported crawls, brief generation, rewriting drafts, building internal-link maps from a folder of markdown. None of that needs a shell. Running those jobs in restricted mode means you can hand the workflow to a VA, a client or a scheduled runner and sleep fine.
It also pairs nicely with cost control. If you’re already trimming spend with the tricks in my guide on reducing Claude Code token usage by 80%, restricted mode is the safety half of the same conversation — cheaper and safer sessions. And if you’re experimenting with alternative backends like the setup in my Claude Code Desktop + DeepSeek walkthrough, a restricted first run is a sensible way to evaluate any new model before you hand it the keys. Inside the AI Profit Boardroom we’re already folding this into the standard client-safe pipeline templates.
The bottom line on claude code restricted mode
Claude Code restricted mode is the clearest signal yet that Anthropic expects agents to run unattended on other people’s machines — and wants a hard, simple guarantee to offer when they do. One flag, four subtractions: no command execution, no web fetching, files fenced to one directory, no settings-file surprises and no permission bypass. If agents touch client work anywhere in your business, update to v2.1.248 and make --restricted your default for anything you wouldn’t run with your eyes closed. If you want help wiring that into a real content pipeline, book a free SEO strategy session and I’ll walk you through exactly how we do it.
FAQ: claude code restricted mode
Is Claude Code restricted mode available now?
Yes. It shipped in Claude Code v2.1.248, released on 28 August 2026 per the official changelog. Update Claude Code to the latest version and the –restricted flag is available immediately on every platform the CLI runs on.
Does restricted mode stop Claude Code writing files?
No — file tools keep working, but only inside the working directory you launched Claude Code from. What restricted mode removes is the ability to run shell commands or code, and WebFetch, unless you explicitly name those tools with –tools.
What is the environment variable for restricted mode?
Set CLAUDE_CODE_RESTRICTED=1 and Claude Code behaves exactly as if you had passed –restricted on the command line. That makes it easy to enforce in CI pipelines, shared runners and wrapper scripts without changing how anyone types the command.
Why does restricted mode ignore my settings files?
Because settings files can re-enable risky behaviour. Per the changelog, restricted mode ignores user, project and local settings files entirely, so a cloned repository cannot smuggle in permission rules, hooks or tool grants that widen what the session can do.
Can I still use bypassPermissions with the restricted flag?
No. The changelog is explicit that restricted mode refuses bypassPermissions. That is the point: it is a hard floor for locked-down sessions, so a prompt injection or a misconfigured script cannot escalate the session back to full autonomy.
Is Claude Code restricted mode useful for SEO work?
Very. A lot of AI SEO automation is read-and-write on content files — audits, briefs, internal linking maps. Restricted mode lets you run those safely over a client repository or content folder without giving the agent shell access, which is an easy sell to cautious clients.
Where to go from here: Lock down your agents, then put them to work. Join the AI Profit Boardroom for the live calls, templates and the 30-day roadmap, or if you’d rather have this configured for your exact stack, book a free SEO strategy session and we’ll build the plan together.
About the author
Julian Goldie is an SEO agency owner with 394K+ YouTube subscribers, a 100% job-success score on Upwork, 75K+ community members across his groups, 10+ years in SEO and a best-selling SEO book to his name. He shares daily AI SEO tutorials on YouTube, runs the AI Profit Boardroom community, and offers a free SEO strategy session if you want a personal plan for ranking with AI. For agency work, book a call for a custom quote.
Last updated August 2026. This is the living guide to claude code restricted mode — it gets updated as the tools change.
NotebookLM SEO Automation: Scale Content and Traffic Effortlessly