How to use Claude Code in a read-only reviewing mode for security-sensitive environments
Claude Code CLI installed, project directory with code to review
What this does
Security-sensitive environments such as production systems, regulated industries, or shared development servers require that CLI tools cannot modify files or execute arbitrary shell commands. Claude Code supports a read-only reviewing mode that enables code analysis, inspection, and review workflows while explicitly blocking all write operations, shell execution, and package management operations.
Steps
- Create or edit the Claude Code configuration file at
~/.config/claude-code/config.jsonor.claude-code.jsonin the project root. - Add a
readOnlyModekey set totruewithin the configuration object. - Also add
forbiddenToolswith at least["bash", "write", "install", "edit"]to ensure write operations are blocked even if the primary flag is not respected in some contexts. - Set
allowedPathsto an array containing only the directories that the tool should be able to read, for example["./src", "./tests"]. This prevents traversal into sensitive system directories. - Save the configuration file and exit the editor.
- Launch Claude Code in the target project directory using
claude. - Verify the restricted state by running
/tools. The output should show only read-only tools such asread,glob, andgrepas available. - Initiate a review by reading files with
/readand analyzing the code. Attempting to use a write tool produces a permission denied message. - Run code analysis on a specific file by prompting for patterns, for example "Identify all hardcoded credentials in this codebase" or "Find potential SQL injection points in the API handlers".
- Generate a review report in memory by asking for a summary, then copy the output to a secure location outside the restricted workspace.
Verification
claude /tools
Expected output:
Read-only mode: enabled
Available tools: read, glob, grep, web-search
All write operations blocked
Common failures
Read-only mode not recognized by older CLI version — Ensure the installed version of Claude Code is 1.0 or higher. Run
claude --versionand upgrade usingnpm install -g @anthropic-ai/claude-codeif needed.Path traversal attempted outside allowed directories — When
allowedPathsis set, any/readcommand targeting a path outside the allowed list returns a permission error. Verify the paths are correctly specified as absolute or properly relative paths in the configuration.Session not restarted after config change — Configuration changes require a new Claude Code session. If the read-only state is not active, exit the current session and restart.
Glob tool exposes restricted paths — The
globtool respectsallowedPathsand only returns files within permitted directories. If unexpected files appear, confirm the allowed paths list does not include parent directories that contain sensitive subdirectories.
Related guides
- Configure Claude Code's forbidden tool restrictions for safe usage
- Use Claude Code to review a pull request from the command line