Tools and Bash

These variables change how tools run. They set Bash time limits and output size, shell choice, search behavior, permission helpers, and the sandbox. Use them when long commands reach their time limit or when you need to limit what a tool can see.

This page lists 102 variables. BASH_DEFAULT_TIMEOUT_MS and BASH_MAX_OUTPUT_LENGTH are common. Switch rows take 1 or 0.

Example

~/.claude/settings.json
{
  "$schema": "https://clawdipedia.cc/schemas/claude-code-settings.json",
  "env": {
    "BASH_DEFAULT_TIMEOUT_MS": "300000",
    "BASH_MAX_OUTPUT_LENGTH": "60000"
  }
}

A Bash call now waits up to five minutes before it reaches its timeout.

Variables

The rows are in name order. See Environment Variables for what each column and badge means.

Variable	Status	What it does	Values and default	Notes
`AUTOMODE_DECISION_LOG`	Undocumented: Only the program shows this item. It can change without notice.	When the value is `1`, Claude Code appends each auto mode decision to `.automode_decisions.jsonl`.	Only the exact value `1` works. One runtime mode skips the log	Auto mode, all. Not set from project `env` before trust
`BASH_DEFAULT_TIMEOUT_MS`	Documented: An official docs page names this item.	Sets the default timeout of a foreground `Bash` or `PowerShell` command.	A number of milliseconds, `120000` by default. Positive number, default `120000`. Invalid values fall back to the default	All sessions. Project `env` can set it before trust
`BASH_MAX_OUTPUT_LENGTH`	Documented: An official docs page names this item.	Caps the characters of `Bash` output that Claude reads back into the result.	A number, `30000` by default. Integer, default `30000`, max `150000`. The `bashOutputMaxChars` setting wins when set	All sessions. Project `env` can set it before trust
`BASH_MAX_TIMEOUT_MS`	Documented: An official docs page names this item.	Sets the highest timeout the model may ask for on a foreground `Bash` or `PowerShell` command.	A number of milliseconds, `600000` by default. Positive number, default `600000`. The ceiling is the larger of this and `BASH_DEFAULT_TIMEOUT_MS`	All sessions. Project `env` can set it before trust
`CLAUDE_BASH_MAINTAIN_PROJECT_WORKING_DIR`	Documented: An official docs page names this item.	Returns to the project working directory after each Bash or PowerShell command in the main session.	On or off	Main session. Project `env` can set it before trust
`CLAUDE_BG_SESSION_PERMISSION_RULES`	Undocumented: Only the program shows this item. It can change without notice.	Gives allow and deny permission rules and extra dirs to a background session as JSON.	JSON text. Used only when `CLAUDE_CODE_SESSION_KIND` is `bg`. The scrub removes it from the child env	Background sessions. Not set from project `env` before trust
`CLAUDE_CHROME_CLASSIFIER_FLOOR`	Undocumented: Only the program shows this item. It can change without notice.	Forces the Chrome auto mode classifier floor on or off. It overrides a feature flag. No visible effect in a print-mode probe (Probes).	On, off, or unset, `false` by default. Without it the flag decides, default `false`. Remote sessions read the flag in safe mode	Claude in Chrome with auto mode. Not set from project `env` before trust
`CLAUDE_CHROME_PERMISSION_MODE`	Undocumented: Only the program shows this item. It can change without notice.	Sets the permission mode of Claude in Chrome. No visible effect in a print-mode probe (Probes).	Text. An unknown value logs a warning. Claude Code sets `skip_all_permission_checks` for the native host when permission checks are skipped	Claude in Chrome. Not set from project `env` before trust
`CLAUDE_CODE_AUTO_BACKGROUND_TIMEOUT_MS`	Undocumented: Only the program shows this item. It can change without notice.	Caps the timeout of a Bash call that can auto-background in the main agent.	A number of milliseconds. The cap is at least `2000`. Claude Code ignores a missing or non-positive value	Main agent, Bash
`CLAUDE_CODE_AUTO_MODE_ARTIFACT_CONSENT_RULE`	Undocumented: Only the program shows this item. It can change without notice. Gated: Works only behind a flag or a server gate. Works only behind a feature flag or server gate	Turns the artifact consent rule of the auto mode classifier on or off.	On by default. Env value wins. Else a feature flag set to true turns it off	Auto mode, gated by a feature flag
`CLAUDE_CODE_AUTO_MODE_CLASSIFY_ASK_USER_QUESTION`	Undocumented: Only the program shows this item. It can change without notice.	Overrides whether the auto mode classifier looks at `AskUserQuestion` calls.	On by default. Env value, else the `classifyAskUserQuestion` server setting	Auto mode
`CLAUDE_CODE_AUTO_MODE_CLASSIFY_EDITS`	Undocumented: Only the program shows this item. It can change without notice.	Overrides whether the auto mode classifier checks file edits.	Env value, else a per-model server setting `classifyEditsModels`	Auto mode
`CLAUDE_CODE_AUTO_MODE_COMPACT_THREAD_RULE`	Undocumented: Only the program shows this item. It can change without notice. Gated: Works only behind a flag or a server gate. Works only behind a feature flag or server gate	Picks the compact or the original thread rule for the auto mode classifier in a bound Slack thread.	Off by default. Env value, else a feature flag, default off	Auto mode, gated by a feature flag
`CLAUDE_CODE_AUTO_MODE_EDIT_REMOVAL`	Undocumented: Only the program shows this item. It can change without notice.	Turns on edit removal visibility in the auto mode classifier input.	Off by default. Env value, else the server setting `editRemovalVisibility`, default off	Auto mode
`CLAUDE_CODE_AUTO_MODE_EDIT_REMOVAL_CAP`	Undocumented: Only the program shows this item. It can change without notice.	Sets the size cap for removed edit text in the auto mode classifier input.	A number. Env value, else the server setting `editRemovalCap`, else `3000`	Auto mode
`CLAUDE_CODE_AUTO_MODE_GIT_STATUS_LIMIT`	Undocumented: Only the program shows this item. It can change without notice.	Sets a truncation limit for git status data in the auto mode classifier.	A number. Env value, else the server setting `gitStatusTruncationLimit`, else `2000`	Auto mode
`CLAUDE_CODE_AUTO_MODE_HEARTH_MEMBER_RELAY_ROWS`	Undocumented: Only the program shows this item. It can change without notice. Gated: Works only behind a flag or a server gate. Works only behind a feature flag or server gate	Turns on rows for posts that a project member relayed in a bound thread, in the auto mode classifier input.	Off by default. Env value, else a feature flag, default off	Auto mode, gated by a feature flag
`CLAUDE_CODE_AUTO_MODE_OUTCOME_CODES`	Undocumented: Only the program shows this item. It can change without notice.	Turns on outcome code visibility in the auto mode classifier.	Off by default. Env value, else the server setting `outcomeVisibility`, default off	Auto mode
`CLAUDE_CODE_AUTO_MODE_PRIOR_ASSISTANT_CONTEXT`	Undocumented: Only the program shows this item. It can change without notice.	Turns on prior assistant context in the auto mode classifier input.	Off by default. Env value, else the server setting `priorAssistantContext`, default off	Auto mode
`CLAUDE_CODE_AUTO_MODE_REPO_VISIBILITY`	Undocumented: Only the program shows this item. It can change without notice.	Turns on a repository visibility lookup for the auto mode classifier.	Off by default. Env value, else the server setting `repoVisibility`, default off	Auto mode
`CLAUDE_CODE_AUTO_MODE_SEGMENTED_TRANSCRIPT`	Undocumented: Only the program shows this item. It can change without notice.	Turns on a segmented transcript for the auto mode classifier.	Off by default. Env value, else the server setting `segmentedTranscript`, default off. Cached per session	Auto mode
`CLAUDE_CODE_AUTO_MODE_SERVER`	Documented: An official docs page names this item.	Controls whether the server reviews auto mode actions. Set to `0` to use the local classifier.	On or off. Unset gives no user choice. Claude Code forwards it to child processes	Auto mode
`CLAUDE_CODE_AUTO_MODE_TIER`	Undocumented: Only the program shows this item. It can change without notice.	Any value, even an empty one, switches the auto mode classifier to the `strict` tier. Claude Code forwards it to child processes.	`rawStr`. Only presence counts	Auto mode
`CLAUDE_CODE_BASH_EDIT_DIFF`	Documented: An official docs page names this item.	Turns the diff of files changed during a Bash command on or off.	On, off, or unset. Wins over `bashEditDiffEnabled`. Without either, it is on in `auto` and `bypassPermissions` mode only if a further check passes	Bash tool
`CLAUDE_CODE_BASH_OUTPUT_AUDIENCE_NOTE`	Undocumented: Only the program shows this item. It can change without notice.	Forces the `bash_output_audience_note` feature on or off for Bash results with text stdout.	On, off, or unset. Unset leaves the choice to the rollout check	Bash tool
`CLAUDE_CODE_BASH_SANDBOX_SHOW_INDICATOR`	Undocumented: Only the program shows this item. It can change without notice.	Shows the name `SandboxedBash` instead of `Bash` for commands that run in the sandbox.	On or off, off by default	Bash tool, sandbox
`CLAUDE_CODE_BUBBLEWRAP`	Undocumented: Only the program shows this item. It can change without notice.	Tells Claude Code that it runs inside a Bubblewrap sandbox. It also lets `--dangerously-skip-permissions` run as root.	On or off. Part of the sandbox environment check. `IS_SANDBOX=1` has the same effect on the root check	Linux sandbox
`CLAUDE_CODE_DISABLE_ADVISOR_TOOL`	Documented: An official docs page names this item.	Turns off the advisor tool and the `/advisor` command.	On or off. Checked first in the advisor enable check	First-party and AWS platform. Project `env` can set it before trust
`CLAUDE_CODE_DISABLE_BG_SHELL_PRESSURE_REAP`	Documented: An official docs page names this item.	Stops Claude Code from ending background shells under critical memory pressure.	On or off. The prompt says it works only from the environment at start	MacOS and Linux
`CLAUDE_CODE_DISABLE_DANGEROUS_RM_TIMEOUT`	Documented: An official docs page names this item.	Turns off the time limit on critical-path removal prompts.	On or off. Forces a feature flag timeout config to disabled	All sessions
`CLAUDE_CODE_DISABLE_INLINE_SHELL_RM_PROMPT`	Documented: An official docs page names this item.	Stops Claude Code from reading `bash -c` scripts for critical-path removal prompts.	On or off. The check returns null at once when the variable has a value	All sessions
`CLAUDE_CODE_DISABLE_MOUNTED_DRIVE_RM_PROMPT`	Undocumented: Only the program shows this item. It can change without notice.	Turns off the prompt for `rm -r` on a mounted drive, the folder that holds mounted drives, or a top-level file or folder of a drive. Since 2.1.304 these paths (such as `/Volumes`, `/media`, and WSL `/mnt/c`) get a prompt that permission rules cannot auto-allow.	On or off. The program skips the check when it is set	Bash tool
`CLAUDE_CODE_DISABLE_POWERSHELL_CMD_RM_DENY`	Documented: An official docs page names this item.	Turns off the PowerShell check that denies `rd`, `rmdir`, `del` and `erase` on system paths.	On or off. Without it a feature flag decides	PowerShell tool
`CLAUDE_CODE_DISABLE_SUBSTITUTION_RM_PROMPT`	Documented: An official docs page names this item.	Turns off the critical-path check for a recursive `rm` whose target is only command substitution output.	On or off. Checked together with a feature flag	Bash tool
`CLAUDE_CODE_DISABLE_WEB_FETCH`	Documented: An official docs page names this item.	Turns off the `WebFetch` tool. `WebSearch` stays on.	On or off. Docs: needs v2.1.285 or later. Also disables the web fetch agent	All sessions
`CLAUDE_CODE_DISABLE_WINDOWS_SHELL_LAUNCHER`	Documented: An official docs page names this item.	Starts PowerShell commands on Windows directly, not through the `cmd.exe` launcher.	On or off. The launcher also depends on a flag and logs `env_opt_out` when it has a value	Windows PowerShell tool
`CLAUDE_CODE_DONT_INHERIT_ENV`	Undocumented: Only the program shows this item. It can change without notice.	Starts the shell snapshot and the spawn-env probe with an empty environment instead of the inherited one.	On or off, off by default	Bash tool shell snapshot setup
`CLAUDE_CODE_EMIT_TOOL_USE_SUMMARIES`	Undocumented: Only the program shows this item. It can change without notice.	Sets the `emitToolUseSummaries` gate that the query loop reads.	On or off, off by default. Claude Code passes it in the loop gates object next to `fastModeEnabled`	Query loop, all modes
`CLAUDE_CODE_EVEN_MORE_DANGEROUSLY_SKIP_PERMISSIONS`	Undocumented: Only the program shows this item. It can change without notice. Caution: It deletes data, skips a safety check, or sends data off your machine. Lets dangerous rm commands run without a prompt in bypass permissions mode.	Lets dangerous `rm` commands run without a prompt in bypass permissions mode, once managed settings and plugin hooks have loaded. Claude Code warns about it when it is set. Added in `2.1.311`.	On or off, off by default. It has no effect in a child session (`CLAUDE_CODE_CHILD_SESSION`), when `blockReadsOutsideWorkingDirectories` is on, when some permission rules exist, or on Windows when the registry cannot be read for managed settings. The warning then says the usual checks stay	Bypass permissions mode
`CLAUDE_CODE_EXECPATH`	Undocumented: Only the program shows this item. It can change without notice.	Gives the shell snapshot function for `claude` the path of the running binary.	Falls back to the computed install path	Bash tool shell snapshot
`CLAUDE_CODE_FILE_READ_MAX_OUTPUT_TOKENS`	Documented: An official docs page names this item.	Sets the token limit of a file read.	A number. Whole number above `0`. Else a built-in default	Read tool
`CLAUDE_CODE_FILE_READ_MAX_PDF_PAGES_PER_MESSAGE`	Undocumented: Only the program shows this item. It can change without notice. Gated: Works only behind a flag or a server gate. A feature flag or server gate decides by default. This variable overrides it	Caps the PDF pages that Read tool calls may use in one message.	A number. Whole number of at least `1`, plain digits. Active only when a flag enforces the limit	Read tool with PDF files
`CLAUDE_CODE_FILE_READ_MAX_PDF_PAGES_PER_TURN`	Undocumented: Only the program shows this item. It can change without notice. Gated: Works only behind a flag or a server gate. Works only behind a feature flag or server gate	Caps the PDF pages that Read tool calls may use in one turn.	A number. Whole number of at least `1`, plain digits. Used only with the per-message cap and an enforcing flag	Read tool with PDF files
`CLAUDE_CODE_GIT_BASH_PATH`	Documented: An official docs page names this item.	Sets the path of the Git Bash executable on Windows.	Text. Must exist and be named `bash.exe`, `sh.exe`, `bash`, or `sh`. Else Claude Code warns and detects the path	Windows
`CLAUDE_CODE_GLOB_HIDDEN`	Documented: An official docs page names this item.	Includes dotfiles in Glob results.	`true` by default. Set `false` to exclude them	Glob tool
`CLAUDE_CODE_GLOB_NO_IGNORE`	Documented: An official docs page names this item.	Makes Glob ignore `.gitignore` rules.	`true` by default. Set `false` to respect `.gitignore`	Glob tool
`CLAUDE_CODE_GLOB_TIMEOUT_SECONDS`	Documented: An official docs page names this item.	Sets the timeout of Glob file discovery in seconds.	A number of seconds, `20` by default and `60` on WSL. Whole number of at least `1`	Glob tool
`CLAUDE_CODE_INLINE_TOOLS`	Undocumented: Only the program shows this item. It can change without notice. Gated: Works only behind a flag or a server gate. Works only behind a feature flag or server gate	Turns an inline tools mode on or off. In a probe, it adds the beta `inline-tools-2026-09-15` to `anthropic-beta`. See Probes.	On, off, or unset. A false value always turns it off. Off in a `CCR_SESSION_PROFILE` session	All sessions
`CLAUDE_CODE_MAX_TOOL_USE_CONCURRENCY`	Documented: An official docs page names this item.	Caps how many read-only tools and subagents run in parallel.	A number, `10` by default. A whole number, minimum `1`	All sessions
`CLAUDE_CODE_MAX_TURNS`	Documented: An official docs page names this item.	Caps the agentic turns when you give no `--max-turns` value.	A number. An explicit option wins	Print and SDK modes
`CLAUDE_CODE_MAX_WEB_SEARCHES_PER_SESSION`	Documented: An official docs page names this item.	Caps `WebSearch` calls per session.	A number, `200` by default. A whole number, minimum `1`, digits only	All sessions, `WebSearch`
`CLAUDE_CODE_NANKEEN_KESTREL`	Undocumented: Only the program shows this item. It can change without notice. Gated: Works only behind a flag or a server gate. Works only behind a feature flag or server gate	Turns on a Windows-only path by env. Nearby text is about the Windows sandbox group. No visible effect in a print-mode probe (Probes).	On or off. Unset follows a feature flag. Always false outside Windows	Windows
`CLAUDE_CODE_PERFORCE_MODE`	Documented: An official docs page names this item.	Turns on Perforce write protection. `Edit` and `Write` fail with a `p4 edit <file>` hint when the file lacks the owner-write bit.	On or off. Claude Code parses it as a boolean. It also adds a Perforce note to the system context	All file tools
`CLAUDE_CODE_POLICY_HELPER_PS1_PATH`	Undocumented: Only the program shows this item. It can change without notice. Gated: Works only behind a flag or a server gate. Works only behind a feature flag or server gate	Names the PowerShell script that a Windows policy helper runs. The helper script reads it with `$env:`.	Text. A PowerShell command string contains the env var name. We assume Claude Code sets it for the child	Windows with PowerShell
`CLAUDE_CODE_POLICY_HELPER_PSMODULEPATH`	Undocumented: Only the program shows this item. It can change without notice. Gated: Works only behind a flag or a server gate. Works only behind a feature flag or server gate	Carries the `PSModulePath` value for the Windows policy helper. The helper script copies it into `$env:PSModulePath`.	Text. A PowerShell command string contains the env var name. We assume Claude Code sets it for the child	Windows with PowerShell
`CLAUDE_CODE_POWERSHELL_RESPECT_EXECUTION_POLICY`	Documented: An official docs page names this item.	Stops Claude Code from passing `-ExecutionPolicy Bypass` to PowerShell.	On or off. The branch code was not shown	Windows with PowerShell
`CLAUDE_CODE_PWSH_PARSE_TIMEOUT_MS`	Undocumented: Only the program shows this item. It can change without notice.	Sets the timeout of the PowerShell command parse step.	A number of milliseconds, `5000` by default. Whole number in ms above 0. The full wait adds up to 10000 ms more	PowerShell tool
`CLAUDE_CODE_QUESTION_EXTENDED`	Undocumented: Only the program shows this item. It can change without notice.	Turns on extended questions in `AskUserQuestion`. A host sets it from the `askUserQuestion.extendedQuestions` option.	On or off. Read only for some entrypoints and remote sessions	SDK, remote, and selected entrypoints
`CLAUDE_CODE_QUESTION_OPTIONAL_DESCRIPTIONS`	Undocumented: Only the program shows this item. It can change without notice.	Makes option descriptions optional in `AskUserQuestion`. A host sets it from the `askUserQuestion.optionalDescriptions` option.	On or off. Read only for some entrypoints and remote sessions	SDK, remote, and selected entrypoints
`CLAUDE_CODE_QUESTION_PREVIEW_FORMAT`	Undocumented: Only the program shows this item. It can change without notice.	Sets the preview format of `AskUserQuestion`. A host sets it from the `askUserQuestion.previewFormat` option.	Text. Without it `markdown` is the default for most entrypoints. It is not the default for sdk, desktop, local-agent, or remote	All sessions
`CLAUDE_CODE_REPORT_FINDINGS`	Undocumented: Only the program shows this item. It can change without notice.	Gates a findings report mode for review runs. It needs a matching tool in the options and no text or json output. No visible effect in a print-mode probe (Probes).	On or off	Review runs
`CLAUDE_CODE_RESTRICTED`	Documented: An official docs page names this item.	Starts the session in restricted mode like `--restricted`.	On or off. Other paths such as `--desktop` refuse to run under it	All sessions
`CLAUDE_CODE_SANDBOX_LEAVE_DENIES_TO_SRT_WIN`	Undocumented: Only the program shows this item. It can change without notice.	On Windows, stops Claude Code from adding its own deny rules and leaves them to `srt-win`. The error text warns the sandbox may then fail on a large profile.	On or off. Set it in the environment at start. A settings file cannot set it	Windows sandbox
`CLAUDE_CODE_SANDBOX_LEAVE_PARENT_FOLDERS_ALONE`	Undocumented: Only the program shows this item. It can change without notice.	On Windows, stops Claude Code from giving parent folders an entry for the sandbox group. Related log text lists the folders it then skips.	On or off. Only the string use was seen. The exact branch was not read	Windows sandbox
`CLAUDE_CODE_SANDBOXED`	Undocumented: Only the program shows this item. It can change without notice. Caution: It deletes data, skips a safety check, or sends data off your machine.	Marks the process as already inside a sandbox. Claude Code then counts the folder as trusted and skips the trust gates.	On or off. Makes the trust check pass and the permission-gate check pass. Also picks the sandbox-time settings path	All sessions. A host or container sets it
`CLAUDE_CODE_SCRIPT_CAPS`	Documented: An official docs page names this item.	Limits how many times named scripts may run per session. It reads a JSON object of substring keys and number limits.	JSON text. JSON object. Bad JSON, an array, or no valid entries turn the caps off	Bash tool. The docs tie it to `CLAUDE_CODE_SUBPROCESS_ENV_SCRUB`
`CLAUDE_CODE_SHELL`	Documented: An official docs page names this item.	Sets the shell for Bash tool commands. It accepts a path to `bash` or `zsh`. An invalid path falls back to detection.	Text. The path must contain `bash` or `zsh` and run. Else Claude Code logs a message and detects a shell from `SHELL` and `PATH`	Bash tool
`CLAUDE_CODE_SHELL_LAUNCHER_SCRIPT`	Undocumented: Only the program shows this item. It can change without notice.	Passes a launcher script to a PowerShell shell. The wrapper reads it, clears the variable, and runs it with `Invoke-Expression`.	Text. Claude Code sets it for the PowerShell child. The wrapper sets it to `$null` before running	PowerShell tool. Claude Code sets it
`CLAUDE_CODE_SHELL_PREFIX`	Documented: An official docs page names this item.	Wraps shell commands that Claude Code starts with a prefix program. Hooks, Bash, status line, and stdio MCP starts use it.	Text. Claude Code passes the command to the wrapper as one quoted argument. PowerShell and exec-form hooks skip it	Bash tool, hooks, status line, MCP stdio
`CLAUDE_CODE_STRICT_INLINE_SHELL_RM_PROMPT`	Undocumented: Only the program shows this item. It can change without notice. Gated: Works only behind a flag or a server gate. Works only behind a feature flag or server gate	Restores the strict `rm` permission prompt for inline shell `-c` scripts that build `rm` at run time.	On or off, on by default. Without it a feature flag (default true) picks the relaxed rule. The changelog names this variable	Bash tool permissions
`CLAUDE_CODE_SUBPROCESS_ENV_SCRUB`	Documented: An official docs page names this item. Differs: The official docs and the program disagree. The row says how. The official docs and the program disagree. The row says how.	Strips credentials from the env of subprocesses such as Bash, hooks, and stdio MCP servers.	On, off, or unset. The default depends on the host (see Notes). `1` turns it on and `0` turns it off	Bash, hooks, MCP stdio. The docs omit the GitHub Actions and `local-agent` defaults. While the scrub is on, Claude Code forces the permission mode to `default` (see What the Scrub Removes)
`CLAUDE_CODE_TOOL_MEMORY_CGROUP_EXCLUDE`	Documented: An official docs page names this item.	Lists process kinds that the tool memory cap leaves out. Claude Code adds `mcp` unless another rule applies.	A comma-separated list. Without it, a feature flag or a built-in set applies	Linux and WSL
`CLAUDE_CODE_TOOL_MEMORY_LIMIT`	Documented: An official docs page names this item. Differs: The official docs and the program disagree. The row says how. The official docs and the program disagree. The row says how.	Caps memory for tool commands with a cgroup. The docs list `0` and `off` to turn it off. The code also accepts `none`.	Text. When unset, a feature flag decides, which the docs do not say	Linux and WSL
`CLAUDE_CODE_USE_NATIVE_FILE_SEARCH`	Documented: An official docs page names this item.	Finds commands, subagents, and output styles with Node file APIs and not ripgrep. Only the docs state this. The program lists the name in its environment table as a boolean, and no code reads it.	On or off. Set `1` to enable	All sessions
`CLAUDE_CODE_USE_POWERSHELL_TOOL`	Documented: An official docs page names this item.	Turns the PowerShell tool on or off. On Windows without Git Bash it is on. With Git Bash the feature flag decides when unset.	On, off, or unset. Non-Windows needs `1`. Windows takes `0` or `1`	Windows, Linux, macOS, WSL
`CLAUDE_CODE_WEB_SEARCH_FAST_ARG`	Undocumented: Only the program shows this item. It can change without notice. Gated: Works only behind a flag or a server gate. A feature flag or server gate decides by default. This variable overrides it	Turns on a fast `WebSearch` mode with its own description and hint. Env wins over a feature flag.	On, off, or unset. Needs an extra model check to pass	All sessions
`CLAUDE_CODE_WEB_SEARCH_REFILLS_PER_HOUR`	Documented: An official docs page names this item.	Sets how fast the session `WebSearch` limit refills, in calls per hour.	`100` by default. Plain digits. Unset gives 0 when non-interactive, else a feature flag with default `100`	All sessions
`CLAUDE_CODE_WEBFETCH_CACHE_TTL_MS`	Documented: An official docs page names this item.	Sets how long `WebFetch` keeps a fetched URL in cache.	A number of milliseconds, `900000` by default. Plain digits, at least 1. Claude Code reads it once for each start	All sessions
`CLAUDE_CODE_WEBFETCH_DEADLINE_MS`	Documented: An official docs page names this item.	Sets the upper bound on how long `WebFetch` waits for a download.	A number of milliseconds, `300000` by default. Plain digits, 0 or more. Env value has an upper cap	All sessions
`CLAUDE_CODE_WEBSEARCH_CITATIONS`	Undocumented: Only the program shows this item. It can change without notice.	Changes the `WebSearch` tool prompt so it does not ask for a `Sources:` list. It also gates a citations code path.	On or off. The second path needs two more checks	All sessions
`CLAUDE_ENV_FILE`	Documented: An official docs page names this item.	Names a shell script that runs before each Bash command in the same shell.	Text. Claude Code reads it and trims it. Claude Code gives hooks for `SessionStart`, `Setup`, `CwdChanged`, and `FileChanged` a path	Bash tool and hooks
`CLAUDE_PID`	Documented: An official docs page names this item.	Holds the process ID of Claude Code. Child commands use it to find the parent process.	-	-
`CLAUDECODE`	Documented: An official docs page names this item.	Marks a process as running inside Claude Code. Claude Code also reads it to detect a child session and to skip prompt history.	On or off. Claude Code sets it to `1` for shell snapshots, hook and tool subprocesses, and stdio MCP servers	All sessions
`ENABLE_TOOL_SEARCH`	Documented: An official docs page names this item.	Sets MCP tool search mode. Unset defers tools, including behind a custom `ANTHROPIC_BASE_URL` since 2.1.304. If the gateway answers 400 or 422, Claude Code retries without tool search.	Text. `true` defer, `false` upfront, `auto` or `auto:N` use a percent threshold. `0` and `100` map to defer and upfront	All sessions. Project `env` can set it before trust
`GCM_INTERACTIVE`	Documented: An official docs page names this item.	Claude Code sets a default for git child processes so Git Credential Manager does not prompt.	Claude Code sets it when the child env has no value for it. The default value comes from a table that was not read	Git child processes
`GIT_ASKPASS`	Documented: An official docs page names this item.	Claude Code passes the user value to git child processes. It falls back to a default and then to an empty string.	Text. If unset, Claude Code passes `SSH_ASKPASS` in its place in one path. Claude Code also sets it	Git child processes. Not set from project `env` before trust
`GIT_CONFIG_COUNT`	Documented: An official docs page names this item.	Claude Code reads the count and appends its own `GIT_CONFIG_KEY_n` and `GIT_CONFIG_VALUE_n` pairs for git child processes.	A number. Claude Code parses it as a plain integer string. It also sets it in a child env	Git child processes. Not set from project `env` before trust
`GIT_CONFIG_GLOBAL`	Undocumented: Only the program shows this item. It can change without notice.	Gives the path of the global git config. Claude Code reads it to find governed git config and sets it in scrubbed child envs.	Claude Code sets it to `/dev/null` or a sandbox path in some child envs	Git child processes. Not set from project `env` before trust
`GIT_CONFIG_NOSYSTEM`	Undocumented: Only the program shows this item. It can change without notice.	Claude Code sets it to `1` in scrubbed and sandbox child envs so git skips the system config.	Claude Code sets it. No direct read of the user value was seen	Git child processes. Not set from project `env` before trust
`GIT_SSH_COMMAND`	Documented: An official docs page names this item.	Claude Code uses it, or `ssh`, as the base of the SSH command for its git calls, and adds `-o BatchMode=yes` and a connect timeout.	Text. Claude Code sets the output in the child env. Timeout is `30` in one path and shorter in another	Git clone and fetch. Not set from project `env` before trust
`GIT_TERMINAL_PROMPT`	Documented: An official docs page names this item.	Claude Code sets it to `0` for git child processes so git never prompts on the terminal.	Claude Code sets it when the child env has no value for it. In one path, Claude Code keeps the user value	Git child processes. Not set from project `env` before trust
`IS_SANDBOX`	Undocumented: Only the program shows this item. It can change without notice.	Tells Claude Code that it runs in a deliberate sandbox, so Claude Code allows root with `--dangerously-skip-permissions`.	-	-
`JAVA_TOOL_OPTIONS`	Undocumented: Only the program shows this item. It can change without notice.	In the sandbox, Claude Code appends `-Dhttps.proxyHost` settings to it so Java tools use the sandbox proxy.	-	-
`LINES`	Documented: An official docs page names this item.	Claude Code sets it to the terminal row count for hook commands.	-	-
`LOCALAPPDATA`	Documented: An official docs page names this item. Gated: Works only behind a flag or a server gate. Works only behind a feature flag or server gate	Claude Code uses it on Windows to find the `WindowsApps` alias folder and for path checks.	-	-
`NoDefaultCurrentDirectoryInExePath`	Undocumented: Only the program shows this item. It can change without notice.	Claude Code sets it to `1` at startup so executable search skips the current directory.	-	-
`SHELL`	Documented: An official docs page names this item.	Names the user shell. Claude Code uses it to find tools, to describe the shell in the prompt, and to run login-shell probes.	Text. Non-empty string. Falls back to `/bin/zsh` for one probe and to `unknown` in the prompt text	All sessions, Windows sets it itself
`SSH_ASKPASS`	Undocumented: Only the program shows this item. It can change without notice.	Claude Code passes the user value to git child processes. It falls back to a default and then to an empty string.	Text. `GIT_ASKPASS` falls back to it in one path	Git child processes
`SUDO_GID`	Undocumented: Only the program shows this item. It can change without notice. Gated: Works only behind a flag or a server gate. Works only behind a feature flag or server gate	Holds the group id of the user who ran `sudo`. Claude Code uses it with `SUDO_UID` and `SUDO_USER` to find the real user when it runs as root.	A number. Integer, digits only, min `0`. Used only when the process uid is `0`	Linux and macOS as root
`SUDO_UID`	Undocumented: Only the program shows this item. It can change without notice. Gated: Works only behind a flag or a server gate. Works only behind a feature flag or server gate	Holds the user id of the user who ran `sudo`. Claude Code uses it to decide who owns files and git repos when it runs as root.	A number. Integer, digits only, min `0`. Used only when the process runs as root	Linux and macOS as root
`SUDO_USER`	Undocumented: Only the program shows this item. It can change without notice. Gated: Works only behind a flag or a server gate. Works only behind a feature flag or server gate	Holds the name of the user who ran `sudo`. Claude Code checks it against the system and uses it as the real owner when it runs as root.	Text. Non-empty string that must match a safe name pattern. Used only as root	Linux and macOS as root
`USE_BUILTIN_RIPGREP`	Documented: An official docs page names this item.	Set it to `0` to use the system `rg` instead of the bundled one.	On or off. Project settings may set it before trust (allowlist true)	All sessions. Project `env` can set it before trust

How It Works

The Bash tool starts a shell for each command. Claude Code reads many variables here when the command starts. Some variables also pass into the child shell, so a tool you run sees them too. CLAUDE_CODE_SUBPROCESS_ENV_SCRUB strips credentials from the environment of subprocesses such as Bash, hooks, and stdio MCP servers.

What the Scrub Removes

We read the lists in the program and ran a Bash call with the scrub on (see Probes). The scrub removes these from the subprocess environment:

About 95 fixed credential names, such as ANTHROPIC_API_KEY, CLAUDE_CODE_OAUTH_TOKEN, ANTHROPIC_AUTH_TOKEN, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, GOOGLE_APPLICATION_CREDENTIALS, AZURE_CLIENT_SECRET, HF_TOKEN, NODE_AUTH_TOKEN, CARGO_REGISTRY_TOKEN, VAULT_TOKEN, SLACK_WEBHOOK_URL, and ACTIONS_RUNTIME_TOKEN. The scrub also removes the same names with an INPUT_ prefix.
About 90 path and config names, such as AWS_SHARED_CREDENTIALS_FILE, KUBECONFIG, NETRC, DOCKER_CONFIG, GH_CONFIG_DIR, GNUPGHOME, SSH_AUTH_SOCK, GIT_ASKPASS, XDG_CONFIG_HOME, GIT_CONFIG_GLOBAL, and CLAUDE_CONFIG_DIR.
Any name that has a word such as TOKEN, SECRET, PASSWORD, KEY, AUTH, COOKIE, PAT, DSN, WEBHOOK, or CREDENTIAL, and any variable whose value has credentials in a URL, such as DATABASE_URL.

The four GitHub token variables (GH_TOKEN, GITHUB_TOKEN, GH_ENTERPRISE_TOKEN, GITHUB_ENTERPRISE_TOKEN) are the exception. In our run, a Bash child still saw them. It also saw GH_HOST and HTTPS_PROXY.

While the scrub is on (CLAUDE_CODE_SUBPROCESS_ENV_SCRUB true, or GITHUB_ACTIONS true and the scrub not set to 0), Claude Code forces the permission mode to default. The message says: "Permission mode forced to default - CLAUDE_CODE_SUBPROCESS_ENV_SCRUB is set (allowed_non_write_users hardening). Declare allowedTools explicitly, or set CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=0 to opt out." In -p, --permission-mode bypassPermissions still asked for approval for Bash until we passed --allowedTools.

Environment Variables: how Claude Code reads variables and which value wins.
Tools Reference
Permissions
Undocumented Items: every item that only the program shows.

Source: the program (variable names found in the 2.1.312 binary) and the Environment Variables page of the official docs.

Example​

Variables​

How It Works​

What the Scrub Removes​

Related Pages​

Example

Variables

How It Works

What the Scrub Removes

Related Pages