[BUG] allowedTools restrictions not enforced — Claude reads files without approval prompt

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Bug: Claude Code ignores allowedTools restrictions in settings.json and
reads files (Read tool) without triggering an approval prompt.

Actual: Claude calls Read/Grep/Bash and they execute immediately without
any approval prompt, bypassing the configured restrictions entirely.

Settings: allowedTools configured in .claude/settings.json to only include
specific mcp__snap__* tools. All other tools (Read, Grep, Bash, Glob) are not
listed and should require approval.

What Should Happen?

Expected: When a tool is not in allowedTools, the user should be prompted
to approve or deny before the tool executes.

Error Messages/Logs

Steps to Reproduce

1. Add allowedTools to .claude/settings.json with only specific tools listed

(e.g., only mcp__snap__* tools)

1. Start a Claude Code session
2. Ask Claude to perform a task that involves reading a file
3. Observe: Claude calls the Read tool and it executes immediately with no

approval prompt — despite Read not being in allowedTools

1. Expected: Approval prompt appears before Read executes
2. Actual: Read executes silently, bypassing the restriction

Claude Model

Not sure / Multiple models

Is this a regression?

No, this never worked

Last Working Version

_No response_

Claude Code Version

2.1.76

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

VS Code integrated terminal

Additional Information

_No response_