Agent Wranglers

AID-77Recommended

Give each subagent only the tools its job needs

Every subagent file lists the tools that subagent may use. A subagent that reads web pages, issues or other outside text gets no write, shell or publishing tools.

By Agent Wranglers. Updated .

How to do it

A subagent inherits every tool of the main session unless its file says otherwise. One that only searches needs read and search tools. One that reads untrusted text should not also be able to change files or reach the network, so a hijack stays contained. Set the allow list in the subagent's settings, such as the tools field in a Claude Code subagent file. Remove tools with a deny list where the tool has one. Keep the main session's permission mode out of bypass, because some tools pass it on to every subagent. The same rule applies to tokens, as Give agents the fewest rights they need says.

Examples

Markdown example

---
name: code-searcher
description: Finds where something is defined or used. Returns file paths and line numbers.
tools: Read, Grep, Glob
---
Search the code and answer with paths and line numbers only.

Shell example

for file in .claude/agents/*.md; do
  grep -q '^tools:' "$file" || { echo "No tool list: $file"; exit 1; }
done

How to check

A script reads every subagent file in the repository and fails on a file without a tool list. In a test session, ask the read-only research subagent to edit a file. The edit is refused.

Sources

For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/ai-assisted-development/isolation-and-credentials/subagent-tool-limits">Agent Wranglers AI-assisted development playbook</a>. In code you write, add a comment next to it with the same link.