CLI · Coding agents · Anthropic
Claude Code
Ask an agent to inspect a project, plan a change and work across files with explicit tool permissions.
Repository content can steer the agent. Instructions in files, plugins or tool results can influence proposed actions. Review unfamiliar project configuration and keep secrets outside the task scope.
Understand the tool
What it does.
Claude Code is an AI coding agent available through the claude terminal command. It can inspect files, propose changes, edit code and run development tools. You describe the result you need; the agent chooses intermediate steps within the configured permissions.
Why use it?
It is useful when a coding task spans several files or starts with understanding unfamiliar code. Give it an observable outcome, such as explaining a request path or adding a regression test. Review the resulting evidence and diff before treating the task as finished.
A useful fit for
- Understanding unfamiliar repositories
- Preparing scoped implementation plans
- Supervised bug fixes and tests
From need to output
Ways to put it to work.
These are suggested workflows based on the documented capabilities. They are not recorded runtime results.
Use case 01
Map an unfamiliar feature
A developer needs to understand where a form submission becomes a database update.
- Open only the relevant project.
- Request an explanation with file references in plan mode.
- Check the cited code and note any unresolved behavior.
Intended outputA reviewable map of the feature and the next files to inspect.
Use case 02
Prepare a small bug fix
A reproducible validation error needs a test and a targeted change.
- Provide the failing input and expected behavior.
- Review the plan and permit only the required tools.
- Inspect the changed files and run the relevant test suite.
Intended outputA proposed patch with evidence that the reported case is covered.
A concrete starting point
Request a plan before editing
Replace FEATURE_NAME with a specific feature. The documented plan mode supports investigation before implementation.
claude --permission-mode plan "Explain how FEATURE_NAME works and propose a test plan."What this can change
Starts a model session, reads permitted project context and consumes account usage. It may save session state. Plan mode is not a promise that no data leaves the machine.
This example has not been executed for this review. Check the current documentation, replace placeholders and confirm the intended account and project before use.
Before you start
Setup and access.
What you’ll need
- Installed Claude Code on a supported system
- An eligible Claude account, Anthropic Console account or configured supported provider
- A project you are authorized to share with that provider
- Authentication
- Supported Claude subscription, Console credentials or a documented third-party provider; availability depends on the account.
- Can read
- Permitted project files and tool output
- Additional directories and connected systems if configured
- Can write or change
- Project edits and shell actions allowed by the active mode
- Session state and tool-specific outputs
- Network and data flow
- Configured model provider
- Any approved web, package or integration endpoint
- Approval and control
- Permission modes and rules govern tool execution. Broad allow rules and bypass modes materially change the review boundary.
Check your environment
Compatibility, costs and license.
Compatibility notes
- macOS, Linux and Windows; follow the current platform setup guide
- Terminal workflows can be extended with MCP servers and plugins
Costs and account requirements
Subscription limits or provider API charges apply. Long sessions and repeated tool output can increase usage; consult the account's current terms.
Current pricing or plan information ↗Proprietary terms
The public repository is not an open-source license grant for Claude Code; its license points to Anthropic commercial terms.
Read the license or service terms ↗Keep the boundaries visible
Concerns and limitations.
Repository content can steer the agent
Instructions in files, plugins or tool results can influence proposed actions. Review unfamiliar project configuration and keep secrets outside the task scope.
Permission settings change the exposure
An agent allowed to run shell commands can affect more than the file it is editing. Review actual commands and keep a recoverable branch.
Where it may fall short
- A plausible explanation or passing generated test does not establish correctness.
- Provider data handling and permissions need a separate organizational decision.
Observed behavior · 2026-10-18
Runtime and security findings.
Startup checks confirmed that bare mode stops without credentials and restricted mode rejects bypassPermissions. No model response, code change or tool execution was tested.
These checks cover the conditions below. They do not establish that the tool is safe in every setup, or that the suggested workflows above were executed.
What we found
Observed in this evaluation
Restricted mode rejects the explicit bypass combination
The exact invocation combining --restricted and --permission-mode bypassPermissions exited 1 with a configuration error. That is one preflight control; it does not prove tool isolation against malicious prompts.
In practice: Keep restricted mode for suitable tasks and test the actual file/network permissions in a disposable project before using sensitive material.
Observed in this evaluation
Bare mode makes missing credentials visible
The account-free print invocation exited 1 and requested login. --bare was selected because its local help states that it skips keychain reads, hooks and automatic context discovery.
In practice: Use explicit credentials and context for automated runs; do not assume a no-login test covers the normal interactive configuration.
Documented concern · medium severity under stated conditions
Noninteractive trust needs deliberate handling
The tested CLI help warns that print/non-TTY execution skips the workspace trust dialog and can silently ignore invalid settings. This documented behavior was not independently adversarially tested.
In practice: Only run print mode in reviewed directories, and validate settings before relying on them.
Version, environment and fixture
- Version or deployment
- 2.1.290
- Tested target
- Claude Code installed native Windows executable
- Artifact identity
- SHA-256 467d3dff9d6bbb26ab765284490a200dd713ee5778c55662007240e7e86386b2 of the installed executable; this identifies the tested file, not an independent provenance audit.
- Environment and fixture
- Windows 11 x64; Python 3.12.10 harness. Raw timestamps UTC.
- Fresh per-tool home/config/cache; child environment constructed from OS/runtime paths, explicit isolation variables and no inherited credentials. Synthetic fixtures only; no user account sign-in.
Checks and results
3 recorded checks. Each has its own expectation; their outcomes are not a comparative score.
Installed versionMet expectation
- Method
<user-home>\.local\bin\claude.exe --version- Expected
- Print the executable version.
- Observed
- Exit 0. 2.1.290 (Claude Code)
Bare mode without credentialsMet expectation
- Method
claude --bare --restricted --strict-mcp-config --no-session-persistence -p "Return the word fixture."- Expected
- Refuse to start an authenticated model request without credentials.
- Observed
- Exit 1. Not logged in · Please run /login
Conflicting permission modesMet expectation
- Method
claude --bare --restricted --permission-mode bypassPermissions -p "Return the word fixture."- Expected
- Reject bypassPermissions when restricted mode is enabled.
- Observed
- Exit 1. Error: bypassPermissions not supported in restricted mode
Practical caveats
- These are startup/permission-configuration checks, not an agent task benchmark.
- The full interactive profile can load additional context, hooks, plugins and MCP servers; the bare fixture excluded those.
What this evaluation does not establish
- Model quality, actual tool allow/deny enforcement, prompt injection resistance and sandbox escape.
- OAuth/keychain behavior, plugins, hooks, browser integration, network destinations and billing.
Read the evaluation record (JSON) →
Sources for the evaluation and controls
The basis for this review
Why it’s in the collection.
An editorial starting point for supervised coding: natural-language tasks and documented permission modes make the workflow explainable. No model-performance comparison was run.
The number is an editorial starting order within the cli tools collection. It does not measure popularity, speed, reliability or safety.
What we reviewed
- Official overview, CLI reference, permissions and cost documentation
The evaluation above lists the current runtime coverage and untested behavior.
Reviewed Oct 18, 2026. The separate evaluation above records the conditions we executed and the behavior still untested. Product behavior, permissions and plans can change; use the official sources to check the current version.
Follow the evidence
Official sources.
- Product overview ↗code.claude.com
- CLI command reference ↗code.claude.com
- Permission configuration ↗code.claude.com
- Usage and cost ↗code.claude.com
- Repository license ↗github.com