Claude’s –dangerously-skip-permissions flag turns off every permission prompt in Claude Code, so it runs commands and edits files without asking. Most people who search for it really want fewer interruptions, not zero safety. This free builder gives you that: tick what Claude Code may do on its own and what it must never touch, and get a ready settings.json, the matching command and a plain-English risk rating.
Free permissions builder
Fewer prompts, without skipping safety
Most people who reach for --dangerously-skip-permissions just want Claude Code to stop asking about the safe stuff. Tick what it may do on its own and what it must never touch, and get a ready settings.json, the matching command, and a plain-English risk rating. Nothing you type leaves your browser.
High risk on your own computer What --dangerously-skip-permissions actually does
- It is the same as starting with --permission-mode bypassPermissions.
- Tool calls run immediately with no permission prompts, including writes to protected paths such as .git and .claude.
- Your allow rules stop mattering, but deny rules still block, explicit ask rules still prompt, and rm or rmdir aimed at critical paths such as / or your home folder still stops for you.
- It offers no protection against prompt injection: instructions hidden in a file or web page Claude reads can steer what it runs.
- On macOS and Linux it refuses to start as root or under sudo, unless Claude Code detects a recognized sandbox.
- Anthropic says to use it only in isolated environments such as containers, VMs or dev containers without internet access.
Safer ways to get fewer prompts: allow the specific commands you trust (the builder below), use accept edits mode for file changes, turn on the command sandbox, or use auto mode, where a classifier checks actions before they run. Save skipping permissions for a container or VM you can throw away.
Get 6 ready-made safe permission presets
Unlock copy-paste settings files for a Node web app, Python and data science, docs-only writing, a read-only reviewer, a CI test runner and team guardrails.
Unlocked: the presets are just below. You are also on the weekly HOW TO // AI newsletter.
Free. You also get the HOW TO // AI newsletter once a week. Unsubscribe any time.
The six permission modes at a glance
| Mode | What runs without asking | Best for | Risk |
|---|---|---|---|
Manualdefault | Reads only | Reviewing every action yourself, sensitive work | Low risk |
Accept editsacceptEdits | Reads, file edits and common file commands (mkdir, touch, mv, cp and similar) inside your project | Iterating on code you review in git afterward | Low risk |
Planplan | Reads, plus classifier-approved commands when auto mode is available | Exploring a codebase before changing it | Low risk |
Autoauto | Everything, with a background classifier checking actions first | Long tasks with fewer prompts | Medium |
Don't askdontAsk | Reads in your working folders and pre-approved tools; anything else is denied | Locked-down CI and scripts | Low risk |
Bypass (skip permissions)bypassPermissions | Everything | Isolated containers and VMs only | High risk |
Switch modes in a session with Shift+Tab. Bypass only appears in that cycle if you started with it enabled. Risk labels are our plain-English summary of Anthropic's guidance, not an official rating. Not installed yet? Get your exact install commands.
Sources: Claude Code docs: Permission modes, Claude Code docs: Configure permissions, Claude Code docs: Settings reference, Claude Code docs: Sandboxing, Claude Code docs: Dev containers, Claude Code docs: CLI reference, checked October 18, 2026. This is general guidance, not a security review of your setup.
How to use the permissions builder
- Say where Claude Code will run: your own computer, a dev container or VM, or a CI pipeline. The builder picks a sensible starting mode for each.
- Pick your project type, then tick the commands it may run without asking, such as tests, lint and build.
- Choose what should always ask first (like git push) and what it must never do (like reading .env files or running sudo).
- Copy the settings.json into the file shown, or copy the command-line version for a single session. Check the risk rating and the reasons under it.
What –dangerously-skip-permissions actually does
According to Anthropic’s docs, the flag is the same as starting with –permission-mode bypassPermissions. Tool calls run immediately with no prompts, including writes to protected folders such as .git and .claude. Your allow rules stop mattering, though deny rules still block, explicit ask rules still prompt, and removing critical paths such as your home folder still stops for you.
The big risk is prompt injection: bypass mode offers no protection against instructions hidden in a file, issue or web page that Claude reads. On macOS and Linux, Claude Code refuses to start in this mode as root or under sudo. Anthropic’s advice is to use it only in isolated environments such as containers, VMs or dev containers without internet access.
Safer ways to get fewer prompts
| Option | What it does | Use it when |
|---|---|---|
| Allow rules in settings.json | Pre-approves exact commands, such as Bash(npm run test *) | You know which commands are routine |
| Accept edits mode | File edits and common file commands run without asking | You review changes in git afterward |
| Auto mode | A classifier checks each action before it runs | Long tasks where prompts slow you down |
| Command sandbox | The operating system limits what shell commands can write and reach | You want limits that don’t depend on rule wording |
| Don’t ask mode | Anything that would normally prompt is denied; pre-approved tools and actions that need no approval still run | CI jobs that must never wait for input |
Auto mode is now the built-in starting mode for terminal sessions on recent versions, but Anthropic notes that it reduces prompts without guaranteeing safety. The sandbox runs on macOS, Linux and WSL 2, not native Windows.
Mistakes to avoid
- Putting bypass in a settings file. It then applies to every session. Use the flag only when you start a session inside the container. (Bypass and auto don’t take effect from a project’s own .claude/settings.json anyway.)
- Trusting a Bash deny rule as a wall. Bash(rm *) blocks rm -rf build/ but not bash -c ‘rm -rf build/’. For hard limits, use the sandbox or a container.
- Writing the wildcard too early. Bash(git * main) matches far more than Bash(git log *). Put the * after the subcommand.
- Forgetting secrets. Deny Read(./.env) and Read(./.env.*) so Claude never reads your keys.
Need Claude Code first? Get your exact commands from the Claude Code install helper.
Related on HOW TO // AI
- How to use Claude Code: a beginner’s guide to your first sessions.
- APIs before agents: how to give AI access to your systems safely.
- Claude Developer study guide: permissions and agent safety are part of the exam.
Checked against Anthropic’s Claude Code docs on permission modes, permissions, settings, sandboxing and dev containers on October 18, 2026.
Frequently asked questions
Is --dangerously-skip-permissions safe?
Only in an isolated, disposable environment. Anthropic says to use it in containers, VMs or dev containers without internet access, because it offers no protection against prompt injection or unintended actions on your own computer.
What is the difference between bypassPermissions and auto mode?
Bypass runs everything without checks. Auto mode also runs without routine prompts, but a classifier reviews actions first and blocks ones that go beyond your request. Anthropic says auto mode reduces prompts but doesn't guarantee safety.
Why won't --dangerously-skip-permissions run as root?
On macOS and Linux, Claude Code refuses to start in bypass mode as root or under sudo, unless it detects a recognized sandbox. Run it as a non-root user, for example in Anthropic's dev container setup.
Where do I put the settings.json file?
Use ~/.claude/settings.json for every project on your computer, .claude/settings.json in a project to share with your team, or .claude/settings.local.json for personal settings in one project.
Can my company block --dangerously-skip-permissions?
Yes. Setting permissions.disableBypassPermissionsMode to disable blocks it. Admins usually put it in managed settings so users can't override it.