Agent stack guide
Best CLI Tools for Claude Code
Give Claude Code a small local-first stack, then add authenticated tools only for the repository task at hand.
Claude Code command policy preview
Start with one recommended CLI and a read-only policy. Review command prefixes, the target environment, and approval boundaries before saving it.
{
"$schema": "https://json.schemastore.org/claude-code-settings.json",
"_clifinder": {
"tool": "github-cli",
"mode": "read-only",
"modeBoundary": "R0 exact commands may be used; R1, R2, and R3 commands are forbidden.",
"evidence": "verified",
"checkedAt": "2026-07-10",
"testedVersion": "2.86.0",
"warning": "Review generated command prefixes before installing this policy."
},
"permissions": {
"allow": [],
"ask": [
"Bash(gh pr list --state open --json number,title,reviewDecision,url:*)"
],
"deny": [
"Bash(gh pr merge:*)",
"Bash(gh repo delete:*)"
]
}
}
Evidence boundary
Compatibility is not a test result: current data does not attribute independent CLI execution to a particular agent.
Treat generated content as a reviewable starting point. Remote writes, deletion, production actions, and any confirmation-marked command must still stop for explicit approval.
Outcome, inputs, and outputs
Define the result and evidence before the agent selects a command.
Best CLI Tools for Claude Code: safe workflow
Run each step inside its stated boundary and verify the output before continuing.
Approval points and rollback
Pause at the listed decision points and keep recovery instructions beside the action.
CLI, MCP, or API?
Choose the interface by execution location, identity, output contract, and permission boundary.
Recommended approach
Default to local CLIs, then choose the narrowest remote interface that completes the task.
Official evidence and references
Use these primary or upstream sources to verify current command behavior before acting.