Claude Permissions

Claude Permissions

Stop clicking "Allow" 47 times per session.

This is a curated permissions config for Claude Code that gives Claude the freedom to actually get work done — while keeping it away from the things that would ruin your day.

What it allows

Everything Claude needs to be productive:

- Bash — run commands, install packages, build things
- Read / Edit / Write — work with your files like a normal developer
- Glob / Grep — search your codebase
- WebFetch / WebSearch — look things up
- Task — spin up subagents
- MCP tools — all of them (mcp*)

What it blocks

The stuff that should make you nervous:

Usage

Copy settings.json to your Claude Code settings:

Or if you already have a settings.json and just want to merge the permissions, copy the permissions block into your existing file.
Note: This config only includes permissions. Your settings.json may also contain hooks, MCP servers, and other settings — this won't overwrite those if you merge manually.

Philosophy

The goal is simple: allow everything that's productive, deny everything that's destructive or sensitive. Claude doesn't need to read your SSH keys to write a React component. It doesn't need sudo to run your tests. And it definitely doesn't need rm -rf /* for anything.

This strikes a balance between the two extremes:
- Approving every single tool call (tedious, flow-breaking)
- Running in full YOLO mode with no guardrails (brave, but questionable)

Contributing

Got a deny rule that saved your bacon? Open a PR.

License

MIT — do whatever you want with it.