Toolofficial publisher

Bash (Claude Code)

Tool : A precise action the AI can call · requires claude-code

Executes shell commands in a persistent session.

Essential and dangerous: use pattern-based allowlists, never --dangerously-skip-permissions outside a container.

Docs

Overall score

7.1 /10

Security: serious reservations

Utility

9.0

Reliability

6.0

Security

Serious reservations

Ease

5 min · Comfortable

Security reflects where data goes, requested permissions and incidents on record at the verification date. It is not a guarantee of zero risk: check the deployment mode and the connections you enable.

What it does, concretely

Bash is the built-in Claude Code tool that executes shell commands directly in your environment within a persistent session. It addresses the need to run scripts, builds, tests, or any command-line operation without leaving the working context.

In practice, Claude Code submits a command to your machine's shell and retrieves the output to incorporate it into the conversation. The session is persistent: environment variables, the current directory, and launched processes remain active across commands. A set of read-only commands runs without asking for your approval; all others trigger a permission prompt in Manual mode.

This tool is aimed at developers who want to delegate automation, build, or command-line debugging tasks to Claude. It suits those who know their environment well enough to define precise permission rules.

It is not suitable for non-technical users or contexts where running arbitrary commands on the host machine poses an unacceptable risk without prior isolation.

What it offers

·Executes shell commands in a persistent session that retains environment variables and the current directory between calls.
·Applies permission rules by command pattern using allow, deny, and ask formats in permission settings.
·Runs a built-in set of read-only commands without prompting, even in Manual mode.
·Integrates with PreToolUse and PostToolUse hooks to intercept or log each call before or after execution.
·Accepts rules such as Bash(npm run *) to allow or block specific families of commands.
·Can be restricted or extended via --allowedTools and --disallowedTools options in the CLI or Agent SDK.

Our tips

Define precise Bash(pattern) rules in your permission settings rather than allowing all commands: for example Bash(npm run *) to limit access to npm scripts.
In auto mode (Pro, Max, and Team plans), a classifier handles most permission prompts for you; switch to Manual mode if you want to approve each command individually.
Use PreToolUse hooks with a Bash matcher to log or block specific commands before they run.
Never use the --dangerously-skip-permissions option outside an isolated container: Bash runs with your full system privileges.
For long-running tasks, combine Bash with the Monitor tool so Claude can react to output in real time without blocking the conversation.

Watch out

Bash runs with the current user's privileges: a poorly authorized command can modify or delete system files without further warning.
Permission rules match on command text patterns: an overly broad rule such as Bash(*) is equivalent to allowing everything, which removes all protection.

In practice

Price: Free
Commercial use: Commercial use: yes
Available on: claude-code
Host: claude-code
FR interface: No

Security and data

Rating: Security: serious reservations
Capabilities: readswritesexecutesnetwork
Your data: Data stays local
Maintenance: Active

Links and repository checked on 25 October 2026 · added on 1 February 2025

How to install Bash (Claude Code)

1. Install Claude Code using the standard procedure (npm or equivalent). 2. Bash is included by default: no separate installation is needed. 3. Open your Claude Code settings file and add your rules under permissions.allow and permissions.deny using the Bash(pattern) format. 4. For sensitive commands, use the ask format so that confirmation is requested each time. 5. If you are working inside an isolated container, you may relax restrictions; outside a container, keep a strict pattern-based allowlist.

permissions.allow: ["Bash(git *)","Bash(npm test)"]

Official documentation ↗

In the same category

Whole category Code →