diff --git a/cue/load/import.go b/cue/load/import.go
index b134898..47c5282 100644
--- a/cue/load/import.go
+++ b/cue/load/import.go
@@ -376,6 +376,9 @@
 			if !isTest || fp.c.Tests {
 				fp.imported[path] = append(fp.imported[path], spec.Pos())
 			}
+			if !isTool && strings.HasPrefix(path, "tool/") {
+				badFile(errors.Newf(spec.Pos(), "%s may only be imported in *_tool.cue files", quoted))
+			}
 		}
 	}
 	switch {
diff --git a/cue/load/loader_test.go b/cue/load/loader_test.go
index 7251920..6771222 100644
--- a/cue/load/loader_test.go
+++ b/cue/load/loader_test.go
@@ -239,6 +239,18 @@
 root:   $CWD/testdata
 dir:    $CWD/testdata/toolonly
 display:./toolonly`,
+	}, {
+		cfg: &Config{
+			Dir: testdataDir,
+		},
+		args: args("./badtool"),
+		want: `
+err:    "tool/cli" may only be imported in *_tool.cue files
+path:   example.org/test/badtool:bad
+module: example.org/test
+root:   $CWD/testdata
+dir:    $CWD/testdata/badtool
+display:./badtool`,
 	}}
 	for i, tc := range testCases {
 		// if i != 5 {
diff --git a/cue/load/testdata/badtool/bad.cue b/cue/load/testdata/badtool/bad.cue
new file mode 100644
index 0000000..76c5a69
--- /dev/null
+++ b/cue/load/testdata/badtool/bad.cue
@@ -0,0 +1,9 @@
+package bad
+
+import "tool/cli"
+
+command foo task: {
+	foo: cli.Print & {
+		text: "foo"
+	}
+}