How do I stop Claude Code from using Bash for sed, grep, cat instead of the built-in Read/Grep tools?
Claude Code (v2.1.2 on AWS Bedrock, Sonnet model) often runs Bash commands such as sed -n, grep, and cat with heredocs instead of the built-in Read, Grep, Write, and Edit tools. Those Bash calls trigger extra permission prompts even with Accept Edits on. Is there a way to block them?
Originally asked on GitHub: https://github.com/anthropics/claude-code/issues/19649
6 answers
Status: open. The thread does not include a maintainer fix for the model behavior, so the issue is still open.
The workaround commenters used is a PreToolUse hook with matcher Bash that denies specific commands and tells the model which built-in tool to use. One commenter's settings uses this structure:
{"hooks":{"PreToolUse":[{"matcher":"Bash","hooks":[{"type":"command","command":"~/.claude/hooks/enforce-builtin-tools.sh"}]}]}}
An earlier inline jq hook (from a March 2 comment, extended on March 10) reads .tool_input.command, takes the first word, and returns hookSpecificOutput with permissionDecision set to deny for cat, head, tail, sed, awk, grep, rg, find, and ls. Its reason text points to Read, Grep, Glob, or Edit.
A first-word check misses commands after a pipe, such as echo foo | grep pattern. A later comment (March 26) provided a shell script that splits on pipes and chains and checks each segment. The thread does not report a test result for that script.
Note that blocking ls also blocks it when you explicitly ask for it, so leave out commands you sometimes need.
This is a workaround, not a fix. One commenter points out that the Claude Code system prompt already says not to use Bash when a dedicated tool exists, so the problem is model behavior.
Did this work for you?What @fgascon tried on GitHub (Worked)
Asked Claude to add a PreToolUse hook with matcher Bash that uses jq to deny cat and ls and suggests Read or Glob. The commenter noted that ls also gets blocked when explicitly requested.
Source: https://github.com/anthropics/claude-code/issues/19649#issuecomment-3985343985 (opens external site)
Did this work for you?What @dcerisier tried on GitHub (Worked)
Extended the inline jq hook to also deny head, tail, sed, awk, grep, rg, and find, each with a message pointing to Read, Grep, Edit, or Glob. The commenter said it seemed to work well at preventing find and grep.
Source: https://github.com/anthropics/claude-code/issues/19649#issuecomment-4027708205 (opens external site)
Did this work for you?What @yurukusa tried on GitHub (Outcome unclear)
Wrote a shell script hook that splits commands on pipes and chains and checks each segment, handling path-prefixed and env-var-prefixed commands, configured in settings.json with a PreToolUse Bash matcher. It covers cat, head, tail, sed, awk, grep, rg, and find, but the thread gives no test result.
Source: https://github.com/anthropics/claude-code/issues/19649#issuecomment-4138280713 (opens external site)
Did this work for you?What @nabilfreeman tried on GitHub (Partly worked)
Used a third-party wrapper (npx fullcontext grep) so piped head calls do not truncate output. This does not address using Bash over built-in tools.
Source: https://github.com/anthropics/claude-code/issues/19649#issuecomment-4032516422 (opens external site)
Did this work for you?What @ichoosetoaccept tried on GitHub (Partly worked)
Added a slash command that sends a prompt telling the model to prioritize its tools over terminal commands, used in other harnesses.
Source: https://github.com/anthropics/claude-code/issues/19649#issuecomment-4155653420 (opens external site)
Did this work for you?