Stop babysitting Claude Code permission prompts

Claude Code asks before it edits files or runs commands because its permission mode tells it to. To get fewer prompts, switch modes with Shift+Tab (auto mode or accept edits), pre-approve safe commands with permissions.allow rules in settings.json, or pick “Yes, and don’t ask again” on a prompt. Save --dangerously-skip-permissions for a container or VM.

There’s also a fourth option people forget: keep the prompts, but answer them in a second instead of finding them twenty minutes late.

Why Claude Code keeps asking

Every tool call goes through a permission check. In Manual mode (config value default), Claude asks before:

So if you approve npm test with “don’t ask again”, Claude Code saves a rule to .claude/settings.local.json in the repo and stops asking. File edits are different: that approval ends with the session, which is why edit prompts come back every morning.

Fix 1: pick the right permission mode

Press Shift+Tab to cycle modes. The status bar shows which one is on.

Auto mode is now the default. Since Claude Code v2.1.283, interactive terminal and VS Code sessions start in auto mode on every plan, if your model supports it. A second model reviews each action and blocks anything that goes beyond your request, targets infrastructure it doesn’t recognize, or looks driven by something Claude read. If you still get lots of prompts, check the status bar: you may be on an older version, an unsupported model, or a defaultMode set in your settings. Anthropic’s own warning: auto mode “reduces permission prompts but does not guarantee safety.”

Plan mode is the opposite direction: Claude reads and plans, and edits nothing until you approve the plan. Use it before big changes. Details in Anthropic’s permission modes docs.

To start every session in a mode, set it in ~/.claude/settings.json:

{
  "permissions": {
    "defaultMode": "acceptEdits"
  }
}

Note that auto and bypassPermissions only take effect from your user settings (~/.claude/settings.json), not from a project’s .claude/settings.json.

Fix 2: allow and deny rules

Rules pre-approve or block specific tools, in any mode. The format is Tool or Tool(specifier). Claude Code checks deny first, then ask, then allow, and the first match wins.

{
  "permissions": {
    "allow": [
      "Bash(npm run *)",
      "Bash(npm test *)",
      "Bash(git diff *)",
      "Bash(git log *)",
      "Bash(git commit *)",
      "WebFetch(domain:docs.python.org)"
    ],
    "ask": [
      "Bash(git push *)"
    ],
    "deny": [
      "Read(./.env)",
      "Read(./secrets/**)",
      "Bash(git push --force *)"
    ]
  }
}

How the patterns work:

• * matches any text. Bash(npm run *) covers npm run build and npm run test --watch, but not npm install.
• Put the * after the subcommand. Bash(git log *) allows only git log. Bash(git *) allows every git command, including git push.
• A space before a trailing * matters: Bash(ls *) matches ls -la but not lsof.
• Rules understand &&, | and ;. Bash(npm test *) won’t approve npm test && rm -rf build.
• Deny rules apply in every mode, even bypassPermissions. Ask rules force a prompt even in auto mode.
• Read deny rules also stop cat, head and redirects on that path, but not a script that opens the file itself. For a hard wall, turn on the sandbox.

Where to put them: ~/.claude/settings.json for you everywhere, .claude/settings.json to share with the team, .claude/settings.local.json for this repo only.

Fix 3: /permissions

Type /permissions in a session to see every rule and which file it came from, and to add or remove rules. Changes apply from Claude’s next tool call, even mid-turn. It’s the fastest way to clean up the pile of rules “don’t ask again” has saved over the months.

Fix 4: --dangerously-skip-permissions

claude --dangerously-skip-permissions
# same as
claude --permission-mode bypassPermissions

This turns off permission prompts and safety checks. Tool calls run immediately, including writes to protected paths. Why the name is honest:

• No protection against prompt injection. A README, issue or web page Claude reads can tell it to do things, and nothing stops it.
• Mistakes run at full speed. A wrong rm, a migration on the wrong database, a push to the wrong branch.
• Your credentials are in reach. SSH keys, cloud tokens, .env files.

A few things still prompt: explicit ask rules, removals of critical paths like rm -rf ~, and questions Claude asks you. Claude Code also refuses to start in this mode as root or under sudo.

When it’s reasonable: inside a container or VM with nothing valuable mounted, ideally without internet access. Anthropic’s dev container setup runs Claude Code as a non-root user for this. Even there, anything inside the container, including Claude’s own credentials, can leak if the repo is malicious. For most day-to-day work, auto mode plus a few deny rules gets you most of the speed with far less risk.

The middle path: keep the prompts, answer them fast

Prompts aren’t the real problem. The wait is. An agent asks at minute two, you’re in another window, and you come back at minute forty to find it stuck on “Do you want to proceed?”

Two ways to close that gap:

• Get notified. Hooks can ring a bell or show a banner when a prompt is waiting. See Get notified when Claude Code needs you.
• Answer from wherever you are. That’s what Coral is for.

Answering with Coral

Coral is a Mac app that puts every waiting agent in your Mac’s notch: Claude Code, Codex, Copilot CLI, OpenCode and Grok, the one that has waited longest first.

• One key. Press 1, 2 or 3. You see what the agent wrote before asking and every option in full. ⌘Z takes an answer back within two seconds.
• Plans too. When Claude Code finishes a plan, the card asks “Ready to code?”. Press 1 to approve and switch to auto mode, 2 to approve and review each edit, or type notes to send it back to planning.
• From your iPhone. Approving needs Face ID. You can deny a risky command from the phone, but allowing it needs your Mac, and “Always allow” isn’t offered from the phone. Plans too long to show in full, or that mention secrets or destructive commands, can only be approved on the Mac. On Free, a phone answer waits on your Mac until you press Return there; with Pro it reaches the agent right away.

Approval rules (Pro)

Coral’s approval rules answer the same kind of request automatically, so you set it once instead of answering it every time. They never apply to destructive commands like rm -rf or a force push, commands that run scripts (npm run, go run), paths outside the project, or edits to build files like package.json. Those always reach you. See Features and Pricing.

A sensible setup

1. Let auto mode handle routine work, or use acceptEdits if you prefer to review diffs.
2. Add deny rules for .env, secrets and force pushes, and an ask rule for git push.
3. Prune /permissions once a month.
4. Use --dangerously-skip-permissions only in a throwaway container.
5. For the prompts that remain, make sure you hear about them, and can answer, wherever you are.

Questions

How do I stop Claude Code asking for permission?

Switch to auto mode or acceptEdits with Shift+Tab, add permissions.allow rules for commands you trust, or choose “Yes, and don’t ask again” on a prompt. Bash approvals saved that way last for that repo.

Is --dangerously-skip-permissions safe?

Only in an isolated container or VM. It turns off permission checks and offers no protection against prompt injection, so anything Claude can reach is at risk.

What is plan mode in Claude Code?

A permission mode where Claude reads and plans but doesn’t edit files. You approve the plan before it changes anything. Press Shift+Tab until the status bar shows plan mode.

Where does “don’t ask again” save the rule?

In .claude/settings.local.json at the root of the git repo. You can see and remove it with /permissions.

Why does Claude Code ask again for file edits?

Edit approvals last only until the session ends. To skip them for good, use acceptEdits or auto mode, or set "defaultMode": "acceptEdits" in your settings.