Free tool · runs in your browser
Claude Code permissions checker
Paste your settings.json and, if you have one, your .mcp.json. The checker runs 43 rules taken from Anthropic's own Claude Code documentation and shows each finding with its exact JSON path, why it matters, the doc it comes from, and a safer snippet to paste instead.
Nothing you paste leaves this page
No upload, no server call, no storage. The input boxes switch off spell check and Grammarly and are masked from the site's session analytics. Credentials the checker spots are masked in the results too.
Official docs only
Every rule cites a section of code.claude.com, checked on October 10, 2026. Anything I could not confirm there is left out.
Which settings file is it?
Some settings behave differently by file, so the severity changes with it.
Paste the whole file. Strict JSON, no comments.
The project file with a top level mcpServers object.
Waiting for a config
Paste a file or load a sample.
A clean result is not a guarantee. The checker reads the files you paste; it cannot see other settings files that merge with them, managed policy, or what a server does once it runs.
How Claude Code decides
Deny, then ask, then allow, then the mode
The first match in that order wins, and a more specific rule never jumps the queue. That is why one broad allow rule undoes careful work elsewhere, and why an ask rule is the right home for anything destructive.
Deny rules
Checked first. A match blocks the call. A bare tool name removes the tool from Claude entirely.
Blocked
Ask rules
A match prompts you, even when a narrower allow rule also matches.
You are asked
Allow rules
A match runs the call with no prompt. Specificity never beats the order.
Runs
Permission mode
Nothing matched, so the mode decides: default asks, auto sends it to a classifier, dontAsk denies, bypassPermissions runs it.
Mode decides
Source: Claude Code docs, Configure permissions and Choose a permission mode, read October 10, 2026.
Where each limit holds
The sandbox covers shell commands. Hooks and MCP servers sit outside it.
Permission rules and the sandbox protect different things. This is the map the checker uses when it decides how serious a finding is.
Bash commands
Inside the sandbox when it is on
The operating system limits files and hosts, whatever the command text says.
Read, Edit and Write tools
Permission rules only
A sandbox denyRead entry does not stop the Read tool. Read and Edit deny rules do.
WebFetch
Permission rules only
The sandbox network allowlist does not limit WebFetch. WebFetch domain rules do.
Local MCP servers
Outside, with your full access
Only your trust in the server, its launch command and what you hand it as arguments.
Command hooks
Outside, with your full access
They run your shell commands with your user permissions on every matching event.
Source: Claude Code docs, What runs outside the sandbox, read October 10, 2026.
43 rules
Every rule, with the doc it comes from
Severity is my judgment of impact. The premise of each rule is Anthropic's, linked beside it and checked on October 10, 2026.
Allow rules and directories13 rules
Every shell command is pre approved Critical
A bare Bash allow rule, or Bash(*), approves any command.
Permissions: match all uses of a toolA wildcard stands in for the program name High
Rules like Bash(* --version) match any program.
Permissions: wildcard patternsA prefix rule on a command that runs other commands High
npx, docker exec, shells and interpreters run whatever follows them.
Permissions: Bash rules and wrappersEvery git subcommand and option is approved Medium
Bash(git *) also approves git -c, which runs a program you name.
Permissions: wildcard patternscurl or wget is pre approved Medium
Claude can send data to, or download from, any host without asking.
Permissions: how permissions interact with sandboxingDeleting files is pre approved High
Bash(rm *) matches rm -rf on any path.
Permissions: wildcard patternsFile edits are approved everywhere High
A bare Edit allow, or an Edit rule on / or ~, covers files outside the project.
Permissions: match all uses of a toolFile reads are approved everywhere Medium
A bare Read allow, or Read on / or ~, opens credential files to silent reads.
Permissions: match all uses of a toolEvery web fetch is pre approved Medium
A bare WebFetch allow lets Claude fetch any URL without a prompt.
Permissions: match all uses of a toolWebFetch(domain:*) also opens the sandbox to every host High
The domain form adds * to the sandbox allowlist, not just to fetches.
Permissions: allow or deny every fetchEvery tool on an MCP server is pre approved Low
mcp__server or mcp__server__* approves write tools along with reads.
Permissions: MCP rulesAn additional directory opens your home folder or the whole disk High
additionalDirectories on /, ~ or a credentials folder makes it all readable without prompts.
Settings reference: permissions.additionalDirectoriesAn extra directory is readable without prompts Note
Each additional directory widens silent read access.
Settings reference: permissions.additionalDirectories
Permission modes3 rules
Sessions start with every permission check skipped Critical
defaultMode bypassPermissions runs everything without asking.
Permission modes: bypassPermissionsThe bypass confirmation dialog is switched off Medium
skipDangerousModePermissionPrompt removes the last warning before bypass mode.
Settings reference: skipDangerousModePermissionPromptFile edits run without asking Note
acceptEdits approves edits and common filesystem commands.
Permission modes: acceptEdits
Secrets4 rules
No deny rule protects .env or secrets files Medium
Without Read denies, Claude can read API keys in the project.
Settings reference: permissions.denyA credential is stored in plain text in env High
env values are plain text and reach every subprocess.
Settings reference: envAn HTTP hook header holds a literal credential High
Use $VAR interpolation with allowedEnvVars instead.
Hooks reference: HTTP hook fieldsA credential is written into the MCP config High
Use ${VAR} expansion instead of literal tokens.
MCP: environment variable expansion in .mcp.json
Hooks4 rules
A hook downloads and runs code High
curl or wget piped into a shell, or eval, inside a hook command.
Hooks reference: security considerationsA command hook runs with your full permissions Low
Review every command hook; it runs outside the sandbox.
Hooks reference: security considerationsA hook script is referenced by a relative path Low
Hooks run in the current directory, which can change.
Hooks reference: security considerationsHTTP hooks can post to any URL Low
Without allowedHttpHookUrls, any URL is allowed.
Settings reference: allowedHttpHookUrls
MCP servers5 rules
Every project MCP server is approved automatically Medium
enableAllProjectMcpServers skips the approval prompt for any .mcp.json server.
Settings reference: enableAllProjectMcpServersAn MCP server runs whatever version the registry serves Medium
npx, uvx or docker without a pinned version.
MCP: find and build MCP servers (verify you trust each server)An MCP server is launched through a shell Medium
sh -c or bash -c, and worse, a download piped into a shell.
MCP: add a local stdio serverAn MCP server is given the whole disk or your home folder High
A root or home path argument bypasses your Read deny rules.
Sandboxing: what runs outside the sandboxA server uses the deprecated SSE transport Low
Use HTTP where the server supports it.
MCP: add a remote SSE server
Sandbox6 rules
Bash deny rules are not a security boundary on their own Note
Bash(curl *) does not stop /usr/bin/curl or sh -c curl.
Permissions: Bash rules and wrappersThe Bash sandbox is off Note
Without it, file and network limits depend on command text alone.
Settings reference: sandbox.enabledClaude can retry blocked commands outside the sandbox Low
allowUnsandboxedCommands defaults to true.
Settings reference: sandbox.allowUnsandboxedCommandsA broad command is excluded from the sandbox Medium
excludedCommands is a convenience, not a security boundary.
Settings reference: sandbox.excludedCommandsSandboxed commands can reach powerful Unix sockets Medium
The Docker socket, or all sockets, hands over control of the daemon.
Settings reference: sandbox.network.allowUnixSocketsA weaker sandbox option is on Low
The docs say both options reduce security.
Settings reference: sandbox.enableWeakerNestedSandbox
Rules that silently do nothing8 rules
This allow glob is skipped and approves nothing Low
Allow rules only accept globs after a literal mcp__server__ prefix.
Permissions: tool name wildcardsA path rule on a tool Claude Code never checks Low
Write, NotebookEdit, Glob and MultiEdit path rules are accepted but never consulted.
Permissions: Read and Edit rulesA parameter rule on a primary field is ignored Low
Rules like Bash(command:rm *) are ignored with a startup warning.
Permissions: match by input parameterAn MCP rule with parentheses is skipped Low
Settings files skip any mcp__ rule that has parentheses.
Permissions: match by input parameterA key that is not in the settings reference Note
Possibly a typo, a newer key, or a key that belongs in another file.
Settings reference: settings indexA remote server has a url but no type Low
Claude Code reads it as stdio and skips it.
MCP: add a remote HTTP serverA server uses a reserved name Low
Claude Code skips servers named like its built in ones.
MCP: configuration warningsNo mcpServers object found Note
.mcp.json keeps its servers under a top level mcpServers key.
MCP: project scope
Read this before trusting a score
What a clean result does not tell you
Settings merge across files. A rule in your user file can loosen what the project file looks like it enforces, and managed policy can override both. Check each file you have.
It reads configuration, not behavior. An MCP server pinned to a reviewed version can still do more than its name suggests.
Prompt injection arrives through content Claude reads, such as fetched pages, issues and files. No settings file removes that risk; narrow permissions only limit what an injected instruction can reach.
The rules match the docs as of the date above. Claude Code ships often, so a setting can change meaning after that.
Questions
About the checker
No. The check runs entirely in your browser: the page parses the JSON and runs pattern checks in JavaScript that loaded with the page. Pasting and checking makes no network request, nothing is stored, and the page keeps working if you go offline after it loads. Any credential it spots is masked in the results.
Related
AI agent production checklist
The wider list I run before an agent touches real systems, of which permissions are one part.
Production Tune-Up
A code level audit of an AI system someone else built, with a written list of fixes.
An MCP server with least privilege
How I put an MCP server in front of a production API so the agent never sees a token.
Claude SEO for Claude Code
Another free audit tool for Claude Code users, this one for websites.
Giving an agent access to production?
I build agents and MCP servers that can do real work while what they can reach still fits in a sentence. If you want a second pair of eyes on the permissions before launch, book a call.
Book Meeting