AI coding agents · Claude Code

What Claude Code can do without asking, and how to lock it down

Claude Code asks before it runs a command or edits a file, unless a setting tells it not to. Those settings live in several files, and the strictest one doesn't always win. Here's where to look.

~/.claude/settings.json −risky+fixed

 {   "permissions": {−    "defaultMode": "bypassPermissions",−    "allow": ["Bash(*)"]+    "defaultMode": "default",+    "disableBypassPermissionsMode": "disable",+    "allow": ["Bash(npm test)", "Bash(git status)"]   } }

Where Claude Code keeps its settings

From the strongest to the weakest. A managed policy overrides everything below it.

Scope	File	What's in it
Managed policy	`/Library/Application Support/ClaudeCode/managed-settings.json (macOS)/etc/claude-code/managed-settings.json (Linux)C:\Program Files\ClaudeCode\managed-settings.json (Windows)`	What your organisation enforces. Its absence means nothing constrains the agent.
This project, just you	`.claude/settings.local.json`	Your own rules for one project, not in git.
This project, shared	`.claude/settings.json`	Rules the whole team gets from git.
You, everywhere	`~/.claude/settings.json`	Your default mode, allow / ask / deny rules and hooks.
MCP servers	`~/.claude.json.mcp.json`	Servers it starts, the commands they run and the keys you gave them.
Instructions	`~/.claude/CLAUDE.mdCLAUDE.mdCLAUDE.local.md`	What it reads before every session. Shapes behaviour, grants nothing.
Skills, subagents, commands, plugins	`~/.claude/skills~/.claude/agents~/.claude/commands~/.claude/plugins`	Add-ons with their own scripts, hooks and MCP servers.

What each permission mode lets it do

permissions.defaultMode decides the mode every session starts in.

Mode	What it does without asking
`default (Manual)`	Reads files in your project. Asks before the first use of every other tool.
`acceptEdits`	Also edits files and runs mkdir, touch, mv and cp inside the project.
`plan`	Reads and explores; doesn't edit your source files.
`auto`	Runs without routine prompts; a background classifier checks commands and network requests instead of you.
`dontAsk`	Denies everything that would prompt, except what you pre-approved.
`bypassPermissions`	Skips the prompts, including writes to .git and .claude. The same as starting it with --dangerously-skip-permissions.

Five things to check

Approvals switched off

"defaultMode": "bypassPermissions" in any settings file, or claude --dangerously-skip-permissions in an alias or script in your shell profile, which turns it on for every launch.

A rule that pre-approves every command

A bare Bash or Bash(*) in an allow list: every shell command runs without a prompt. List the exact commands you use instead.

Keys within its reach

.env files and folders like ~/.ssh or ~/.aws it may read, and keys pasted into an MCP server's env, URL or headers.

Servers and hooks that start on their own

"enableAllProjectMcpServers": true starts every server a project's .mcp.json lists, without asking. A hook that runs curl … | sh runs whatever that address serves.

Instructions you can't see

Invisible characters in CLAUDE.md, a skill or a rules file can carry instructions you never read.

Lock it down

In ~/.claude/settings.json. Deny beats ask, and ask beats allow, whatever the order of the rules.

{
  "permissions": {
    "defaultMode": "default",
    "disableBypassPermissionsMode": "disable",
    "allow": ["Bash(npm test)", "Bash(git status)"],
    "deny": ["Read(./.env)", "Read(./.env.*)", "Read(~/.ssh/**)"]
  }
}

disableBypassPermissionsMode keeps bypass mode from being switched on, even by a flag. A team can put the same keys in the managed policy, where no user or project setting can override them.

Or check all of it at once

NeuroShield, part of DriveScape One's Shields, reads every agent on your computer and each project they work in.

Read only

It reads settings files and never runs your agents, their MCP servers or their scripts.

Nothing leaves this computer

The check runs locally. No account, no upload, no AI inside: fixed, published rules.

Nothing changes without your OK

Where a safe fix exists, Fix It for Me makes it after you confirm, with a backup and Undo.

Questions

Doesn't CLAUDE.md already tell it what not to do?

It shapes what Claude tries, not what Claude Code allows. Permission rules are enforced by Claude Code itself, not by the model.

Is --dangerously-skip-permissions saved anywhere?

Only for that launch. An alias in your shell profile makes it every launch, which is why NeuroShield reads shell profiles too.

Can a project's settings loosen mine?

Yes: project settings sit above your own. Only a managed policy can't be overridden.

See your own agents

The check is free: how many agents you have and what they can do. Details and fixes come with Shields.

Download DriveScape One Shields pricing