Tool
Claude Code settings builder
Tick what Claude may do without asking and what it may never do — a ready settings.json and an explanation of every line appear on the right. It all runs in your browser; nothing is sent anywhere.
Presets
Who the rules are for
.claude/settings.json
Sandbox for commands
{
"permissions": {
"allow": [
"Bash(npm test *)",
"Bash(git status *)",
"Bash(git diff *)",
"Bash(git log *)"
],
"deny": [
"Read(./.env)",
"Read(./.env.*)",
"Bash(git push *)"
]
}
}- .claude/settings.json applies to the whole team — the file is committed to the repository.
- allow — commands Claude runs without asking. Only reads and checks: they can’t break anything.
- deny — what is never allowed. Deny rules are checked first, and an allow rule from another file can’t override them.
- Read(./.env) closes off Claude’s read tools, but not a script that opens the file itself. The sandbox is what protects against that kind of workaround.
Ready-made settings.json examples
The presets above, written out. Copy one as it is, or open it in the builder to change it and get the hook scripts it points at.
Safe start
Secrets locked away, tests run without asking, push blocked.
{
"permissions": {
"allow": [
"Bash(npm test *)",
"Bash(git status *)",
"Bash(git diff *)",
"Bash(git log *)"
],
"deny": [
"Read(./.env)",
"Read(./.env.*)",
"Bash(git push *)"
]
}
}Unattended run
Strict sandbox, no commits or pushes, a guard for .env.
{
"permissions": {
"allow": [
"Bash(npm test *)",
"Bash(git status *)",
"Bash(git diff *)",
"Bash(git log *)"
],
"deny": [
"Read(./.env)",
"Read(./.env.*)",
"Bash(git commit *)",
"Bash(git push *)"
]
},
"sandbox": {
"enabled": true,
"failIfUnavailable": true,
"allowUnsandboxedCommands": false
},
"hooks": {
"PreToolUse": [
{
"matcher": "Edit|Write",
"hooks": [
{
"type": "command",
"command": "node",
"args": [
"${CLAUDE_PROJECT_DIR}/.claude/hooks/protect-files.mjs"
]
}
]
}
]
}
}Also needs: .claude/hooks/protect-files.mjs
Open “Unattended run” in the builder →My own habits
Your personal file: a status line, a desktop notification and git reads without asking.
{
"permissions": {
"allow": [
"Bash(git status *)",
"Bash(git diff *)",
"Bash(git log *)"
],
"deny": [
"Read(./.env)",
"Read(./.env.*)"
]
},
"hooks": {
"Notification": [
{
"matcher": "",
"hooks": [
{
"type": "command",
"command": "osascript -e 'display notification \"Claude Code needs your attention\" with title \"Claude Code\"' 2>/dev/null || notify-send 'Claude Code' 'Claude Code needs your attention'"
}
]
}
]
},
"statusLine": {
"type": "command",
"command": "~/.claude/statusline.sh"
}
}Also needs: ~/.claude/statusline.sh
Open “My own habits” in the builder →Tidy team repo
Prettier after every edit, lint before Claude finishes, push allowed but not force-push.
{
"permissions": {
"allow": [
"Bash(npm test *)",
"Bash(npm run lint *)",
"Bash(git status *)",
"Bash(git diff *)",
"Bash(git log *)"
],
"deny": [
"Read(./.env)",
"Read(./.env.*)",
"Bash(git push *--force*)",
"Bash(git push -f *)",
"Bash(git push * -f)",
"Bash(git push * -f *)"
]
},
"hooks": {
"PostToolUse": [
{
"matcher": "Edit|Write",
"hooks": [
{
"type": "command",
"command": "node",
"args": [
"${CLAUDE_PROJECT_DIR}/.claude/hooks/format.mjs"
]
}
]
}
],
"Stop": [
{
"hooks": [
{
"type": "command",
"command": "node",
"args": [
"${CLAUDE_PROJECT_DIR}/.claude/hooks/check-before-stop.mjs"
]
}
]
}
]
}
}Also needs: .claude/hooks/format.mjs, .claude/hooks/check-before-stop.mjs
Open “Tidy team repo” in the builder →Checked against the Claude Code v2.1.306 docs, October 2026.