ty re --disallowed-tools

for coding agents 'shell' is often all you need (just make sure the environment has the necessary tools)