Tools: How Claude Acts
When Claude "reads a file" or "runs the tests", it is not imagining it. It calls a tool, Claude Code carries out the call on your machine, and the result goes back to the model. The permission prompts you see are tool calls waiting for your answer.
The rule
Every action is a tool call: looking is free, changing asks.
Built-in tools fall into a few families. Their exact names can change between versions (you will see names such as Read, Edit and Bash in the transcript), but the families are stable:
| Family | What it does | Asks first in the default mode? |
|---|---|---|
| Look | Read files, find files by name, search text | No |
| Change | Edit or create files | Yes, and shows the diff |
| Run | Shell commands: tests, git, installs | Yes, unless you have allowed that command |
| Reach out | Fetch a web page or search the web | Usually |
| Delegate | Hand a side task to a subagent | The subagent's tools follow the same rules |
More tools can come from MCP servers you connect, such as a database or an issue tracker. They ask for permission in the same way until you allow them.
Knowing this changes how you work. The transcript becomes a record you can audit: "it searched, read two files, edited one". And a permission prompt becomes a decision, not noise, so read the command before you say yes. For safe commands you run constantly, such as the tests, you can allow them for the rest of the session or permanently, so they stop interrupting you.
The shortcut
When a prompt appears, ask two things: Can this be undone? Does it leave my machine? Undoable and local, such as editing a tracked file or running the tests: approve, perhaps always. Hard to undo or external, such as deleting untracked data, pushing, deploying or sending data somewhere: read closely, and usually do it yourself.
Search for "weekly"
A look. It runs without a prompt.
Drills
Answer fast — trust the rule.
In the default mode, which tool call normally runs WITHOUT a permission prompt?
Claude asks to run rm -rf build/ data/. What does the shortcut tell you?
Why might you always allow pytest but not git push?
Where do extra tools, such as access to the kitchen's order database, come from?
Remember
- Every action is a tool call; looking is free, changing asks.
- Shortcut: can it be undone, and does it leave my machine?
- Trap: approving prompts on reflex without reading the command.