Subagent files
# ~/.claude/agents/repo-scout.md --- name: repo-scout description: Mechanical search and inventory across a codebase...1 model: haiku2 tools: Read, Grep, Glob, mcp__brain3 disallowedTools: Agent, mcp__gingugu4 --- You are a search and inventory specialist. Answer with evidence, never with a summary...
Bash on the list, it can't run a shell command at all. Taking a tool away beats asking it not to use one.security-reviewer caught a data-loss bug in an install path after hand testing and seven unit tests had passed.