[BUG] Agent frontmatter tools: constraint not enforced — read-only agents can write files

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Custom agent definition files (\.claude\agents\*.md) declare required tools in frontmatter (e.g., tools: Read, Grep, Glob, Bash). Agents listed as read-only are still able to use Write and Edit tools at runtime, bypassing the declared constraints.

What Should Happen?

Agents should be blocked from using tools not listed in their tools: field.

Error Messages/Logs

Steps to Reproduce

1. Create or use an existing agent with tools: Read, Grep, Glob, Bash in frontmatter (no Write/Edit listed).
2. Launch the agent and ask it to write a file to disk.
3. The write succeeds, even though Write is not in the tools list.

Affected agents: opus-debugger, opus-security-reviewer, opus-system-architect, sonnet-explore, sonnet-reviewer, sonnet-test-runner, sonnet-dependency-auditor, sonnet-git-committer, sonnet-web-researcher, haiku-fast-researcher.

Claude Model

Sonnet (default)

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.241

Platform

Anthropic API

Operating System

Windows

Terminal/Shell

PowerShell

Additional Information

Actual: all declared tools execute regardless of frontmatter constraints.
Impact: safety issue — read-only reviewer/tester agents cannot be trusted to avoid modifying code.