The gate between the model and the machine. Turret decides which tools exist, which are on a never-list, and what it puts in front of a person before a call runs.
One evaluator
Claude Code evaluates permission rules. Turret does not. There is one evaluator, and Turret's store is an input to it.
From that follows the rule that keeps the two from disagreeing: Turret may only ever add denials. It never adds an allow the CLI would not otherwise have asked about, and it never re-derives a decision the CLI has already made. Two components that both deny agree by construction. Two that allow do not, which is why exactly one path in the app produces an allow. A person clicks a button in a dialog that names the rule being written.
The layers
Five things decide whether a tool runs. They apply in order, and each owns a different question.
| Layer | Question it answers |
|---|---|
| The mode's tool list | Does this tool exist for this session at all? |
| The never-list | Is this something the app refuses to run under any answer? |
| Claude Code's own settings | What did the user configure outside this app? |
| The app's permission store | What has the user already granted, here, by clicking? |
| The session's attendance | Ask, refuse silently, or execute nothing? |
Anything the layers above leave open becomes a dialog.
Switching a built-in tool off
The Tools screen decides which of Claude Code's own tools every session is given. A tool switched off there never appears in the list the model is shown, so it is never reached for.
That is a different thing from a deny rule. A deny rule leaves the tool in the model's list and refuses the call when it arrives, which costs a turn and puts a refusal in the transcript. Switching a tool off takes its helpers with it, so turning off the shell also removes the tools that read its output and kill it.
MCP servers
Every session starts with the CLI's strict MCP setting on, so the CLI loads no server of its own. What a session gets is what Turret hands it. That is what makes a session's tool list independent of the directory it happens to be running in.
The servers a person configured in Claude Code are read out of the CLI's own file and passed in explicitly. A user-scope server is offered to every session. A project-scope server is offered to a session whose working directory is exactly the one it was configured against, and that match is exact — a session that opened its own git worktree runs on the worktree's path, so a server configured against the repository's path is not offered to it.