PRODUCTION SCENARIO
A team wants a code-review helper that scans files and reports findings but must not modify the repository. Every engineer who clones the repo should get it.
How should the helper be defined?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: A subagent in .claude/agents/ with tools set to Read, Grep, and Glob
Project subagents live in .claude/agents/ and ship with the repository, and the tools field is an allowlist, so naming Read, Grep and Glob leaves nothing that can write. disallowedTools is a denylist over the inherited pool, so removing Edit and Write still leaves Bash, which can modify files. The same allowlist under the home directory is personal to one machine and never reaches a teammate who clones the repo. Adding Bash to the allowlist reopens the write path directly.
Official Source: https://code.claude.com/docs/en/sub-agents ↗