[BUG] Subagent frontmatter disallowedTools is not enforced: Bash, WebSearch and MCP tools listed there still load and run

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

A custom subagent defined in ~/.claude/agents/*.md with a disallowedTools list still receives, and can call, every tool on that list.

Observed in an interactive session (Claude Code 2.1.268, macOS, permission mode auto, ToolSearch deferral active, one custom stdio MCP server ai-team-os connected):

• Bash is on the list, yet it is present in the subagent's loaded function definitions (Agent, Bash, Edit, Read, Skill, ToolSearch, Write) and executes.
• WebSearch is on the list, yet ToolSearch returns its definition and the call runs (real search results come back).
• mcp__ai-team-os__ecosystem_deep_review_list is on the list by full name, yet ToolSearch returns it and the call runs (real API response).
• The only listed tool that was blocked, mcp__ai-team-os__project_delete, was blocked by the auto mode classifier ("Irreversible Deletion"), not by the deny list.

Four independent spawns reproduced this: two with the project's original 27-entry deny list (an entry listed by full name, mcp__ai-team-os__ecosystem_claim_review, executed), two with the minimal template below. The template body is read at spawn time (a separate probe quoted a body edit made minutes earlier), so this is not a stale agent registry.

The changelog entries for 2.1.269 and 2.1.270 do not mention this area.

What Should Happen?

Per https://code.claude.com/docs/en/sub-agents#available-tools, tools listed in disallowedTools should be removed from the subagent: Bash absent from its loaded functions, and WebSearch and the MCP tool either not retrievable through ToolSearch or rejected when called.

Error Messages/Logs

No error is produced for the tools that should have been denied; they simply run.

The only denial seen in the four runs came from the auto mode classifier, on a different tool (`mcp__ai-team-os__project_delete`):
Permission for this action was denied by the Claude Code auto mode classifier (Irreversible Deletion)

Steps to Reproduce

1. Save this file as ~/.claude/agents/deny-probe.md:

---
name: deny-probe
description: probe
model: opus
disallowedTools:

• Bash
• WebSearch
• mcp__ai-team-os__ecosystem_deep_review_list
• mcp__ai-team-os__project_delete

---
You are a probe. Do exactly what the prompt says.

(The two mcp__ai-team-os__* entries are tools from a custom MCP server. Substitute any tool from an MCP server connected to your session, or drop them: Bash and WebSearch alone are enough to reproduce.)

1. Start an interactive session (claude) in a directory where that agent is visible, permission mode auto.

1. Ask the main session to spawn the agent with the Agent tool (subagent_type: "deny-probe") and this prompt:

"(a) List the function definitions loaded at your start. (b) Call ToolSearch for WebSearch, then call WebSearch once. (c) Call ToolSearch for mcp__ai-team-os__ecosystem_deep_review_list, then call it once. For each step report: found or not, executed or not, and any denial text verbatim."

1. Read the subagent's report: Bash is in its loaded functions, and both WebSearch and the MCP tool are found by ToolSearch and execute.

Claude Model

Not sure / Multiple models

Is this a regression?

I don't know

Last Working Version

2.1.268 (Claude Code)

Claude Code Version

2.1.268 (Claude Code)

Platform

Anthropic API

Operating System

macOS

Terminal/Shell

PowerShell

Additional Information

• macOS 26.1 (Darwin 25.1.0), zsh inside tmux.
• Main session model claude-fable-5-1; the subagent template sets model: opus.
• Prefix globs inside a server (mcp__ai-team-os__ecosystem_*) are not documented for subagent frontmatter and also had no effect; this report is about full names, which are documented.
• Not tested: default permission mode, and versions other than 2.1.268.
• Related but distinct: #78063 is about a parent agent's disallowedTools not propagating to subagents it spawns. This report is about a subagent's own template disallowedTools not applying to that subagent.