To run Claude Code in a script or CI job, pass the print flag with a prompt. For repeatable results, add bare mode so it skips hooks, plugins, MCP servers, auto memory and CLAUDE.md from the host. Then control what it may do with allowed tools or a locked-down permission mode.
The basics
Per Anthropic's programmatic usage documentation, adding -p runs a command non-interactively. It exits with code 0 on success and non-zero on failure, so scripts can branch on it.
claude -p "Find and fix the bug in auth.py" --allowedTools "Read,Edit,Bash"
cat build-error.txt | claude -p "Explain the root cause" > output.txt
Piped input is capped at 10MB. For larger inputs, write a file and reference its path.
Bare mode for CI
Without bare mode, a print session discovers and loads everything an interactive session would, including hooks in the project's settings and servers in .mcp.json, even in a folder you never trusted. The docs say a print session shows no trust dialog and no per-server approval prompt.
Bare mode skips auto-discovery of hooks, skills, commands, subagents, plugins, MCP servers, auto memory and CLAUDE.md. Anthropic recommends it for scripted calls and says it will become the default for print mode in a future release.
claude --bare -p "Summarize README.md" --allowedTools "Read"
Bare mode does not read OAuth credentials or the keychain, so set an API key in the environment, or supply a key helper. Context you want must be passed with flags, such as an MCP config or appended system prompt.
Permissions without a human
Pick the lowest access that works.
- Allowed tools pre-approve specific tools. Scoped patterns like
Bash(git diff *)are safer than the bare tool name. - The dontAsk mode denies anything that would prompt, which the docs call useful for locked-down CI. Reads in working directories and anything your allow rules cover still run.
- A flag to turn prompts off entirely, available on recent versions, denies requests that nothing else resolves and tells Claude not to retry them.
Note that in a run that starts in auto mode, a bare Bash entry in allowed tools is dropped as too broad.
Structured output
Use JSON output for parsing. With a schema flag the response includes a structured_output field. The JSON also reports total cost in dollars, which the docs describe as a client side estimate that can differ from your bill.
Keep CI safe
Treat a job that runs an agent like any job that runs code from a pull request. Do not give it deployment credentials, prefer short-lived tokens, and pin tool versions. If the prompt includes untrusted text, such as an issue body, assume it can contain instructions.
Quick check
Does print mode ask me to trust the folder?
No. It shows neither the trust dialog nor the MCP approval prompt, which is why bare mode is recommended for CI.
Which permission mode fits an unattended review job?
dontAsk, with a narrow allow list for the read-only commands the job needs.
Sources
Last reviewed: 19 October 2026.
