The Default Tool Set: What You Get for Free

The Agent SDK ships its own tools

Out of the box, the Agent SDK provides filesystem and shell tools that mirror what Claude Code gives a human user — Read, Write, Edit, Bash, Glob, Grep, WebFetch, Task, NotebookEdit, and others. The model selects them like any other tool; permission prompts gate them by default.

Tools have their own discipline

Read reads files (with size and offset controls). Write creates new files. Edit performs string replacements; you must read a file first before editing it. Bash runs shell commands inside the cwd. Glob matches paths; Grep searches contents. Each has options that affect cost and safety.

Whitelist, do not blacklist

If your agent only needs to read and search, declare exactly that. The default set is broad on purpose; in production agents you should narrow aggressively and document the reason. Declare it with tools=, which decides what exists; allowed_tools= only decides what runs without asking. cwkPippa gives its Claude brain the file and shell tools because Pippa is a pair-programming companion, and reaches the web only through its own checkpointed MCP server instead of the built-in WebSearch and WebFetch; a customer-service agent should not have Bash.

Principle: Tool capability is permission. Audit it like permission, not like a feature flag.

Code

Common tools= combinations·python

# Pass one of these as tools= : it decides which built-in tools exist in the run.
# (As allowed_tools= it would only pre-approve them; every other tool would stay.)

# Read-only auditor
READ_ONLY = ["Read", "Grep", "Glob", "WebFetch"]

# Documentation editor (read + edit, no shell, no new file creation)
DOC_EDITOR = ["Read", "Grep", "Glob", "Edit"]

# Pair programmer (full set, but no Task delegation)
PAIR_PROGRAMMER = [
    "Read", "Write", "Edit",
    "Glob", "Grep", "WebFetch",
    "Bash", "NotebookEdit",
]

# Just bash, for a sysadmin assistant
SYSADMIN = ["Bash", "Read"]

options = ClaudeAgentOptions(tools=READ_ONLY, allowed_tools=READ_ONLY)

Edit requires a prior Read in the same session·python

# The Agent SDK's Edit tool will refuse if the file has not been Read this session.
# This is by design — it forces the model to look at current contents before changing.
# Your code does not need to enforce this; the SDK does.
#
# Implication: if you reset the session (new ClaudeSDKClient), the model needs to re-read.
# This is exactly the safety guarantee of session-scoped state.

The Agent SDK ships its own tools

Tools have their own discipline

Whitelist, do not blacklist

Code

External links

Exercise

Progress

Comments 0