Operations and Safety Commands
Commands for permission control, MCP, plugins, cleanup, sandboxing, and troubleshooting.
Key takeaways
- Groups the operational commands: permission and sandbox controls, MCP and plugin management, project cleanup, and a troubleshooting sequence.
- Scope
/permissionsrules by tool and path, and treat/sandboxas one layer rather than the sole security boundary. claude project purgedeletes transcripts, task lists, logs, and the project entry in~/.claude.json; always run--dry-runfirst.claude --safe-modedisables customizations (CLAUDE.md, hooks, plugins, MCP, skills) to isolate what triggers a Fable-to-Opus fallback, while keeping auth and permissions active. The automatic fallback follows the safety classifiers that shipped with the 2026-07-01 Fable 5 redeployment and carry over to Fable 5.1; biology flags rerun on Opus 5 and cybersecurity flags on Opus 4.8.CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1bundles the autoupdater, feedback, error-reporting, and telemetry disables for locked-down environments.- v2.1.248 adds
--restricted/CLAUDE_CODE_RESTRICTED=1; v2.1.248–251 also harden symlink and path traversal across file tools, plugin commands, workflowscriptPath, and Grep/Glob deny rules.
Permission and Sandbox
| Command | Use it for | Watch out for |
|---|---|---|
/permissions | Manage allow, ask, and deny rules for tool permissions. Opens an interactive dialog where you can view rules by scope, add or remove rules, manage working directories, and review recent auto mode denials. Alias: /allowed-tools. | Rules should be scoped by tool and path where possible. |
/fewer-permission-prompts | Bundled skill. Scans your transcripts for common read-only Bash and MCP tool calls, then adds a prioritized allowlist to project .claude/settings.json to reduce permission prompts. | Review proposed rules before committing them. |
/sandbox | Toggle sandbox mode. Available on supported platforms only. | Do not use it as the only security boundary. |
/security-review | Analyze pending changes on the current branch for security vulnerabilities. Reviews the git diff and flags risks like injection, auth issues, and data exposure. | It complements tests and human review; it does not replace them. |
The v2.1.200 change named the default mode Manual and added manual as an alias. Current eligible Pro, Max, and Team terminal/VS Code sessions start in auto mode (v2.1.228+, native Windows v2.1.233+); API, Enterprise, third-party, -p, and SDK sessions use Manual by default. Settings, feature flags, and availability can override these defaults. See starting permission modes.
For a locked-down session profile, start with claude --restricted (or
CLAUDE_CODE_RESTRICTED=1) and verify the effective managed settings in /doctor or /status.
This is a startup profile, not an alias for the interactive /sandbox panel.
MCP and Plugins
| Command | Use it for | Recent note |
|---|---|---|
/mcp | Manage MCP server connections and OAuth authentication. | v2.1.248–251 improve handshake timeout, reconnection, and error propagation; inspect current state and logs together. |
claude mcp | Configure MCP servers from the CLI (add, remove, list, login, logout, and authenticate). | Use the CLI for scriptable bootstrap and OAuth refresh; use /mcp for interactive diagnosis. |
/plugin | Manage Claude Code plugins (install, enable, and configure). | Marketplace and plugin behavior is configured under .claude/ settings and plugin manifests. |
/reload-plugins | Reload all active plugins to apply pending changes without restarting. | Reports counts for each reloaded component and flags any load errors, including --plugin-dir load failures. |
/reload-skills | Re-scan skill and command directories so skills added or changed during the session become available without restarting (v2.1.152+). | Useful after editing .claude/skills or .claude/commands. Reports how many skills are available and how many were added or removed. |
/hooks | View hook configurations for tool events. | Hooks can be powerful; keep failure behavior explicit. |
/mcp reconnect <server>, /mcp enable <server>, and /mcp disable all change connection state directly. In -p, /mcp prints server status instead of opening the dialog (v2.1.205+).
/reload-plugins [--force] skips changes that would replace MCP tools and invalidate the prompt cache unless you pass --force. In -p, Agent SDK, and Desktop (v2.1.260+), only directly typed commands are handled and plugin MCP-server changes are not applied.
Cleanup
Use claude project purge when you need to remove local Claude Code state for a project:
claude project purge ~/work/repo --dry-run
claude project purge ~/work/repo -yIt deletes transcripts, task lists, debug logs, file-edit history, prompt history lines, and the
project's entry in ~/.claude.json. Omit the path to pick from an interactive list. Useful flags:
--dry-run to preview, -y/--yes to skip confirmation, -i/--interactive to confirm each item,
and --all to purge every project. Always start with --dry-run unless you are in a disposable
environment.
Troubleshooting Sequence
/status
/doctor
/mcp
/plugin
/usage/status opens the Settings interface on the Status tab (version, model, account, connectivity) and
works while Claude is responding. As of v2.1.205, /doctor is a full setup checkup that can diagnose
and fix issues, and /checkup is its alias. /usage shows session cost, plan limits, and
activity stats; /cost and /stats are aliases of /usage.
For long MCP calls, set CLAUDE_CODE_MCP_TOOL_IDLE_TIMEOUT explicitly in CI or agent-runner
environments. v2.1.187 added claude mcp login/logout; prefer those commands when auth needs to be
refreshed outside an interactive /mcp session.
For model or usage drift after the Fable 5 and Opus 4.8 updates, add:
/model
/advisor
/usage-credits/usage-credits (previously /extra-usage) configures usage credits so you can keep working when
you hit a limit.
If Fable 5 unexpectedly falls back to Opus before an unusual prompt, isolate configuration and workspace context with:
claude --safe-modeSafe mode starts Claude Code with customizations disabled, which makes it useful for checking whether
CLAUDE.md, hooks, plugins, MCP servers, skills, custom commands, output styles, workflows, themes,
keybindings, status line, file suggestions, LSP servers, or auto-memory are triggering classifiers.
It differs from --bare: authentication, model selection, built-in tools, and permissions still work,
and managed settings policy still applies.
Use --disable-slash-commands when a session should expose no skills or slash commands. Use
disableBundledSkills: true or CLAUDE_CODE_DISABLE_BUNDLED_SKILLS=1 when you only want to remove
Claude Code's bundled skills and workflows while leaving project, user, and plugin skills available.
For locked-down environments, consider CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1 and document
why it is set. This is equivalent to setting DISABLE_AUTOUPDATER, DISABLE_FEEDBACK_COMMAND,
DISABLE_ERROR_REPORTING, and DISABLE_TELEMETRY together. Do not rely on Auto mode alone for
data-loss prevention; keep network and permission rules scoped.
In v2.1.181–v2.1.261 runbooks, also check sandbox.credentials,
sandbox.network.strictAllowlist, and sandbox.filesystem.disabled. The last option disables
filesystem isolation while preserving network isolation (v2.1.216). Also verify Windows PowerShell
sandbox behavior and destructive-command sandbox auto-approval. These controls are security boundaries; record the
expected behavior before enabling broad background or agent workflows.
Since v2.1.246, /permissions includes an Auto-mode rules tab. Treat it as an inspection surface,
not a replacement for managed permissions.deny. v2.1.247 can have Claude prepare a feedback draft
with SendFeedback; review and send it through /feedback. At user or managed scope,
feedbackDrafts accepts "notify", "quiet", or "off"; project and local values are ignored.
quiet retains drafts for /feedback without notifying, while off removes the tool. Set
CLAUDE_CODE_SEND_FEEDBACK=0 for a process-local disable.
v2.1.205 also makes Auto mode block session-transcript tampering and ask before rm -rf when the
target variable cannot be resolved from context. Keep filesystem permissions and transcript storage
protected independently; these checks are defense in depth.
If the issue is command behavior rather than environment state, add:
/debug describe the failure and include the last command that behaved unexpectedly/debug is a bundled skill that enables debug logging for the current session and analyzes the
session debug log. Because logging is off by default unless you started with claude --debug,
running /debug mid-session captures logs from that point forward. Optionally describe the issue to
focus the analysis.
For large, stale sessions, prefer summarize-and-resume behavior (/compact, /rewind, or
/clear) over repeatedly loading a corrupted or oversized transcript.