Claude Code permissions: invite-only in 4 settings

The catch is memory. Boundaries “are not stored as rules”, and “a boundary can be lost if context compaction removes the message that stated it. For a hard guarantee, add a deny rule instead.”

Add the rule in /permissions

1. Type /permissions in Claude Code. It lists every rule and the settings file it comes from.
2. Add Bash(git push *) as a deny rule to block pushes, or as an ask rule to get a prompt before each one.
3. Save it to .claude/settings.json to share it with your team through git, or to ~/.claude/settings.json for every project.

Or write it in the file yourself. This block is the docs’ own example: npm scripts and commits run without asking, and pushes are refused.

{
  "permissions": {
    "allow": [
      "Bash(npm run *)",
      "Bash(git commit *)"
    ],
    "deny": [
      "Bash(git push *)"
    ]
  }
}

Two lines from the docs explain why this beats a chat message. “Deny rules block in every mode, including bypassPermissions.” And: “Permission rules are enforced by Claude Code, not by the model.”

It’s off by default. To turn it on:

1. Type /sandbox in Claude Code.
2. On the Mode tab, pick auto-allow. Sandboxed commands then run without a prompt, because the wall holds them.
3. Ask Claude to run touch ~/sandbox-probe. Inside the sandbox it fails with Operation not permitted on macOS, or Read-only file system on Linux and WSL2.

The panel saves your choice to .claude/settings.local.json, for this project. To turn it on for every project, put this in ~/.claude/settings.json:

{
  "sandbox": {
    "enabled": true
  }
}

Auto-allow keeps your rules in force. Deny rules still block, and an ask rule like Bash(git push *) still forces a prompt, even for sandboxed commands.

And on its security page: Anthropic reviews connectors before adding them to its directory, “but does not security-audit or manage any MCP server.”

Look through the peephole

1. Type /mcp. It shows every connected server and its tools.
2. Toggle off any server you don’t use. The docs: that stops Claude Code connecting to it “without losing its configuration.”
3. For the ones you keep, ask what each can reach: your files, your database, the web.

Checking .mcp.json alone isn’t enough. Servers at other scopes and claude.ai connectors live outside the repository. The security page: “reviewing .mcp.json doesn’t show every server a session can load.” /mcp shows them all.

Invite new guests the careful way

claude mcp add --transport http <name> <url>

If you share a .mcp.json with your team, keep tokens out of it. Claude Code expands environment variables, so the file holds a name and your machine holds the value:

{
  "mcpServers": {
    "api-server": {
      "type": "http",
      "url": "${API_BASE_URL:-https://api.example.com}/mcp",
      "headers": {
        "Authorization": "Bearer ${API_KEY}"
      }
    }
  }
}