Security & Permissions Simple

Network-Isolated Mode

Block all web access while keeping file tools available for air-gapped analysis

Command

$ "color:#7C5CFC">claude -p "Analyze this code offline" \
    "color:#d97757">--disallowedTools "WebFetch,WebSearch" \
    "color:#d97757">--permission-mode bypassPermissions \
    "color:#d97757">--output-format json

Response

{
  "result": "Based on the code structure...",
  "permission_denials": []
}

Parsing Code

059669">">// Claude falls back to training knowledge 059669">">for anything
// that would normally require a web search

Gotchas

! Claude uses training knowledge instead of web search — answers may be stale

! MCP servers with network access are NOT blocked by --disallowedTools — block them separately

Related Recipes

Read-Only Agent Strict MCP Config