diff --git a/src/hooks/grep-blocker.ts b/src/hooks/grep-blocker.ts
new file mode 100644
index 0000000..53db0da
--- /dev/null
+++ b/src/hooks/grep-blocker.ts
@@ -0,0 +1,18 @@
+import type { PluginInput } from "@opencode-ai/plugin"
+
+const BLOCKED_MESSAGE =
+  "Error: [BLOCKED] grep has no timeout and can freeze the system. " +
+  "It is permanently disabled. Use 'safe_grep' instead."
+
+export function createGrepBlocker(_ctx: PluginInput) {
+  return {
+    "tool.execute.before": async (
+      input: { tool: string; sessionID: string; callID: string },
+      _output: { args: unknown }
+    ) => {
+      if (input.tool === "grep") {
+        throw new Error(BLOCKED_MESSAGE)
+      }
+    },
+  }
+}
diff --git a/src/index.ts b/src/index.ts
index 73863a6..053a267 100644
--- a/src/index.ts
+++ b/src/index.ts
@@ -22,6 +22,10 @@ const OhMyOpenCodePlugin: Plugin = async (ctx) => {
         ...config.agent,
         ...builtinAgents,
       }
+      config.tools = {
+        ...config.tools,
+        grep: false,
+      }
     },
 
     event: async (input) => {
@@ -99,10 +103,6 @@ const OhMyOpenCodePlugin: Plugin = async (ctx) => {
     },
 
     "tool.execute.before": async (input, _output) => {
-      if (input.tool === "grep") {
-        throw new Error(`[BLOCKED] grep has no timeout and can freeze the system. It is permanently disabled. Use 'safe-grep' instead.`)
-      }
-
       if (input.sessionID === mainSessionID) {
         updateTerminalTitle({
           sessionId: input.sessionID,