How to stop Claude Code asking for permission: allow all commands safely

Updated 24 October 2026

Answering “Do you want to proceed?” for npm test for the fortieth time teaches you to hit Enter without reading, which is worse than no prompt at all. The fix isn’t to switch every check off. It’s to let the boring, safe commands through, block the dangerous ones outright, and keep prompts for the few things you actually want to see. Here’s how, in the order worth trying.

Options, safest first

1. Use “Yes, and don’t ask again”

The cheapest fix is on the prompt itself. For a Bash command, the second option reads something like Yes, and don’t ask again for: npm test *. Pick it and Claude Code writes an allow rule to .claude/settings.local.json at the root of the git repository. It applies to every later session in that repository, including subdirectories and worktrees, and stays out of git.

What it remembers depends on the tool:

• Bash commands, WebFetch domains and WebSearch: saved for good, per repository.
• File edits: only until the session ends. That’s why edit prompts come back tomorrow. Use acceptEdits or an Edit rule instead.
• Compound commands: approving git status && npm test saves a rule for each part that needed approval, here just npm test, up to five rules.

Some prompts only offer a one-time Yes. Claude Code only offers to save a rule when the prompt can show you everything that rule would allow. For those, write the rule yourself in /permissions or in a settings file.

2. Write an allow list

If you approve the same commands in every project, put them in your user settings once. You don’t need rules for ls, cat, grep, find, git status, git diff or git log: Claude Code already runs a built-in set of read-only commands without asking. Add the ones that change things but that you’re happy to run unseen.

This is a starting point for a JavaScript project. Paste it, then delete what you don’t use. If the file already exists, merge the permissions object into it rather than adding a second one.

~/.claude/settings.json{
  "permissions": {
    "allow": [
      "Bash(npm run *)",
      "Bash(npm test *)",
      "Bash(npx tsc *)",
      "Bash(npx eslint *)",
      "Bash(npx prettier *)",
      "Bash(git add *)",
      "Bash(git commit *)",
      "WebFetch(domain:developer.mozilla.org)",
      "WebFetch(domain:github.com)"
    ],
    "ask": [
      "Bash(git push *)",
      "Bash(rm *)"
    ],
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(./secrets/**)",
      "Read(~/.ssh/**)",
      "Read(~/.aws/**)",
      "Bash(git push --force *)",
      "Bash(git push -f *)",
      "Bash(sudo *)"
    ]
  }
}

For other stacks, swap the first lines for Bash(pytest *), Bash(uv run pytest *), Bash(go test *), Bash(go build *), Bash(cargo test *) or Bash(cargo build *). Restart Claude Code or open /permissions to check the rules loaded.

How to write rules that do what you expect:

• Put the * after the subcommand. Bash(git commit *) allows commits. Bash(git *) allows every git command, including git push --force and git -c, which can run any program.
• Keep the space before a trailing *. Bash(ls *) doesn’t match lsof; Bash(ls*) does.
• Watch :*. It’s an old spelling of a trailing *, so Bash(npm run test:*) means npm run test * and won’t match npm run test:unit. Write Bash(npm run test:unit) instead.
• Don’t allow a runner on its own. Bash(npx *), Bash(docker exec *) or Bash(uv run *) allow whatever comes after them. Name the tool too, as in Bash(npx tsc *), if you want a tighter rule.
• Be careful with npm run *. It runs whatever is in package.json, which is fine in your own code and worth thinking about in a repository you just cloned.

The permissions guide has the full rule syntax for Bash, Read, Edit, WebFetch and MCP tools.

3. Block the dangerous stuff with deny and ask

An allow list is safe because of the other two lists. Claude Code checks deny first, then ask, then allow, and the first match wins. A deny in any settings file beats an allow in any other, and a broad deny beats a narrow allow.

• deny blocks in every mode, bypass included. Use it for secrets and anything you never want run.
• ask forces a prompt even in acceptEdits, auto and bypass mode. Use it for things you want to see first, like pushes.

Know the limits. Bash rules match the command text, so Bash(sudo *) doesn’t stop bash -c 'sudo …', and Bash(git push *) doesn’t stop git -C . push. A Read deny on .env covers Claude’s Read tool and cat .env, but not a Python script that opens the file itself. For a boundary that holds regardless, use the sandbox.

4. Pick the right settings file

Rule lists from all three are merged. Two catches:

• Project allow rules need trust. Allow rules and extra directories in a project’s .claude/settings.json only apply after you accept the workspace trust dialog, which lists them. With claude -p they’re skipped with a warning.
• A leading / means different things. Edit(/src/**) in a project file means that project’s src. In ~/.claude/settings.json it means ~/.claude/src. In user settings, use ./, ~/ or // paths, as in the example above.

If your company deploys managed settings, those win over everything, and an administrator can block bypass and auto mode or ignore your own rules entirely.

5. Auto-accept edits with acceptEdits

Most prompts in a coding session are file edits. Press Shift+Tab until the status bar shows ⏵⏵ accept edits on, or start with:

claude --permission-mode acceptEdits

Claude can now create and edit files and run mkdir, touch, rm, rmdir, mv, cp and sed inside your working directories without asking. Paths outside them, protected files like .git and .zshrc, and other Bash commands still ask. Review the result with git diff. Commit before a big task so you can roll back.

The ask rule for Bash(rm *) in the example above keeps rm prompting even in acceptEdits. Drop it if you’d rather not see those.

To start in acceptEdits every time, add "defaultMode": "acceptEdits" inside permissions in ~/.claude/settings.json.

6. Turn on the sandbox

The sandbox lets the operating system limit what shell commands can reach: writes only inside your project and temp folder, network only to hosts you allow. In its auto-allow mode, commands that run inside it don’t prompt at all. Run /sandbox and choose auto-allow on the Mode tab.

• It works on macOS, Linux and WSL2. Native Windows runs commands unsandboxed.
• On Linux and WSL2, install bubblewrap and socat first.
• Deny rules and ask rules like Bash(git push *) still apply.
• The first time a command needs a new network host, Claude Code asks you to approve it.

7. Or use auto mode

Auto mode is Anthropic’s own answer to prompt fatigue: a separate classifier model reviews each shell command and network request and blocks anything that looks risky or beyond what you asked for, such as force pushes, curl | bash, production deploys or sending secrets out. From Claude Code v2.1.283 it’s the default mode for new terminal and VS Code sessions, when your account and model support it. If you see ⏸ manual mode on instead, something picked Manual: a defaultMode or disableAutoMode setting, an older version, or an unsupported model.

• Your ask rules still prompt, and your deny rules still block.
• Broad allow rules that would let Claude run arbitrary code are switched off while you’re in auto mode: Bash(*), wildcarded interpreters like Bash(python*), and package-manager run commands such as Bash(npm run *). Narrow rules like Bash(npm test) stay.
• If the classifier blocks three actions in a row or 20 in a session, it falls back to prompting you.
• "defaultMode": "auto" only works from ~/.claude/settings.json, not from a project file.

Anthropic’s docs are blunt that it reduces prompts but doesn’t guarantee safety, so keep your deny rules.

8. How to allow all commands (and why you usually shouldn’t)

If you really want Claude Code to approve all commands, there are two ways, and they differ a lot:

• Allow all Bash commands only. Add "Bash" (the same as "Bash(*)") to permissions.allow. Your deny and ask rules still apply, so keep the ones from section 3. Auto mode switches this rule off while it’s active.
• Allow all permissions. Start with claude --dangerously-skip-permissions, or set "defaultMode": "bypassPermissions" under permissions in ~/.claude/settings.json to make it the default. A project’s settings file can’t turn this on.

--dangerously-skip-permissions (the same as --permission-mode bypassPermissions) skips nearly every prompt, including writes to .git, .claude and your shell startup files. Nothing checks what Claude does, so a prompt injection in a README, an issue or a web page Claude reads can run commands with your full access. Allow rules do nothing in this mode; deny and ask rules still apply.

Use it inside a container or VM you can throw away, never on your main machine. Claude Code refuses to start in this mode as root on macOS and Linux. Claude Code YOLO mode (--dangerously-skip-permissions) covers how to run it safely.

9. Why it still asks

Type /permissions first: it lists every rule and the file it came from. claude doctor and the warning dialog at startup list rules Claude Code skipped as invalid. Then check this list:

10. Answering prompts when you’re not at the terminal

Some prompts should reach you. The problem is usually that you’re in another window when they do, and the session sits there. Options:

• Notifications. A PermissionRequest hook can alert you the moment Claude asks; How to get Claude Code notifications has the setup. You still go back to the terminal to answer.
• Remote Control. Run claude remote-control in the project, or /remote-control in a session, and answer from claude.ai/code or the Claude app on your phone. Turn on Push when actions required in /config to get a push for each prompt. It needs a Pro, Max, Team or Enterprise login, not an API key, and doesn’t work through Bedrock, Google Cloud or Microsoft Foundry.
• Agent Pets, below, for answering from whatever browser tab you’re in.

Answer from any tab with Agent Pets

Once the routine prompts are gone, the ones left matter, and you don’t want them waiting while you’re reading docs in Chrome. Agent Pets turns each Claude Code, Codex, OpenCode and omp session into a pet walking along the bottom of every page:

• When Claude asks to run a command or edit a file, its pet bounces and the capsule above it says what it wants, such as Allow Bash?. Click it and answer Allow, Always or Deny.
• The toolbar badge counts sessions waiting on you, and a desktop notification names the pet that needs you, with Allow and Deny on it.
• You can read Claude’s latest answer and send its next message from the same tab.

Set it up with npx getagentpets init. It runs entirely on your computer, and the terminal prompt keeps working as usual.

Get Agent Pets — was $25, now $6$25 $6Get Agent Pets — $25

Questions

How do I stop Claude Code asking for permission for every command?

Add the commands you trust to permissions.allow in ~/.claude/settings.json, such as "Bash(npm run *)", and press Shift+Tab to accept edits. For far fewer prompts with a safety check, use auto mode. Keep deny rules for secrets and destructive commands.

Why does Claude Code still ask after I chose “Yes, and don’t ask again”?

For file edits, that choice only lasts until the session ends. For commands, the saved rule covers only the command it named, so a compound command, a different prefix, a path outside your project or a protected file like .git or .zshrc still asks.

Is --dangerously-skip-permissions safe to use?

Only in a container or VM with nothing you’d mind losing. It skips almost every check and offers no protection against prompt injection. Anthropic recommends auto mode instead if you want fewer prompts on your own machine.

Should my allow rules go in the project or in my user settings?

Put commands you trust everywhere in ~/.claude/settings.json. Put project commands your whole team uses in .claude/settings.json and commit it. Keep personal, one-project rules in .claude/settings.local.json.

Can I approve Claude Code permission prompts without being at the terminal?

Yes. Remote Control lets you answer from claude.ai/code or the Claude app on your phone. Agent Pets puts Allow, Always and Deny on a pet on any Chrome page and on a desktop notification.

How do I make Claude Code allow all commands?

Add "Bash" to permissions.allow to approve every shell command while keeping your deny and ask rules, or start with --dangerously-skip-permissions to skip almost every prompt. Only do the second inside a container or VM; on your own machine, auto mode is the safer way to approve nearly everything.

How do I turn on auto-accept in Claude Code?

Press Shift+Tab until the status bar shows ⏵⏵ accept edits on, or start with claude --permission-mode acceptEdits. File edits and basic file commands in your project then go through without asking; other commands still prompt.

Why does Claude Code keep asking “Do you want to proceed?”

That’s the permission prompt for a tool call no rule allows yet. Pick “Yes, and don’t ask again” for commands you trust, add them to an allow list, or switch to auto mode so a classifier approves safe actions for you.

Sources: Claude Code’s documentation on configuring permissions, permission modes, settings, the settings reference, sandboxing, hooks and Remote Control.

More guides

• Claude Code permissions explained
• Claude Code YOLO mode (--dangerously-skip-permissions): what it does and safer options
• Claude Code settings.json: file locations and reference
• Claude Code notifications on your phone (ntfy, Pushover, Telegram)
• Claude Code notifications: when done or waiting for input