Guide
Claude Code permissions: modes, allow rules and --dangerously-skip-permissions
The four permission modes, how allow and deny rules work, how they apply to MCP tools, and what you give up when you skip permissions.
How Claude Code permissions work
Claude Code permissions decide which tool calls run without asking you. Every action the agent takes is a tool call: reading a file, editing one, running a shell command, fetching a page, or calling a tool on an MCP server. Reads are allowed by default. Everything else is checked against your permission mode and your allow and deny rules, and prompts you when nothing matches.
Rules live in settings files at three levels: user (your home directory), project (checked in, shared with the team) and local project (your overrides, not checked in). Administrators can add a fourth, managed settings, which win over all of them. Anthropic's documentation has the current file locations; this guide covers the model, which has been stable.
The four permission modes
| Mode | How you get it | What runs without a prompt | Use it for |
|---|---|---|---|
| Default | No flag | Reads run freely. Edits, shell commands and MCP tools prompt unless an allow rule matches. | Anything that touches real data or a shared repository. |
| Accept edits | Shift+Tab to cycle, or permissions.defaultMode | File edits in the project are accepted without a prompt. Shell commands and MCP tools still prompt. | Long refactors where you review the diff at the end. |
| Plan | Shift+Tab to cycle, or --permission-mode plan | Read-only. Claude Code explores and proposes; nothing is changed or run. | Understanding a codebase or agreeing an approach first. |
| Bypass | --dangerously-skip-permissions, or permissions.defaultMode set to bypass | No prompts at all. Every tool runs as soon as the model asks for it. | Disposable sandboxes with no credentials and no network. Nowhere else. |
Allow and deny rules
Rules are strings of the form Tool(specifier), listed under permissions.allow, permissions.deny or permissions.ask in a settings file. Deny wins over allow. A good set of allow rules removes the prompts for the commands you run twenty times a day without opening the door to everything.
| Rule | Meaning |
|---|---|
Bash(npm test) | Allow exactly this command. |
Bash(git diff *) | Allow any git diff command. |
Edit(src/**) | Allow edits under src. |
Read(.env) | In a deny list: never read this file, even in bypass mode. |
mcp__contextgate | Allow every tool from the MCP server named contextgate. |
mcp__contextgate__send_email | Allow one tool from that server. |
WebFetch(domain:docs.example.com) | Allow fetches from one domain. |
How permissions apply to MCP tools
MCP tools appear to Claude Code as mcp__<server>__<tool>, where the server name is the one in your MCP configuration. They prompt like any other tool, and you can allow or deny one tool or a whole server. Two things the prompt cannot do: it cannot show you what the tool returned, and it cannot stop a tool from existing. If a server exposes a destructive tool, the only ways to keep it out of reach are a deny rule on every machine or a server that does not offer it.
That second point is where a gateway earns its place. When Claude Code's MCP servers sit behind one connection, the connection can switch tools off so they are never offered, and it records every call that is made. The permission prompt stays as the human check; the record is what you look at afterwards.
Hooks: your own checks before and after a tool runs
Hooks are shell commands Claude Code runs at fixed points, including before and after each tool call. A pre-tool hook can inspect the call and block it, which is how teams enforce rules that are hard to express as a permission string: no commits to main, no edits under a generated directory, no shell commands containing a secret. Hooks run in every mode, including bypass.
What --dangerously-skip-permissions really skips
The flag turns off the prompt, nothing more and nothing less. Claude Code will still obey deny rules and run your hooks. What you lose is the one moment where a person sees the call before it happens. In a container with no credentials, no network and a throwaway checkout, that moment is worth little and the flag is reasonable. On a laptop with your SSH keys, your cloud credentials and your MCP servers signed in to production systems, it means any prompt injection in a file, a web page or a tool result can act with everything you have.
If you reach for the flag because the prompts are relentless, the fix is allow rules for the commands you actually trust, and a single MCP connection whose tools you have already pruned. Both remove most prompts and keep the check for the calls that matter.
Where ContextGate fits
ContextGate is an MCP server you add to Claude Code once. Behind it sit the apps and remote MCP servers you connect in your workspace. Whatever permission mode Claude Code is in, every tool call that goes through ContextGate is recorded with the AI app, the user, the tool, the arguments, the redacted result and the policy outcome. Policies block, warn or redact on each call. Tools you switch off are hidden from Claude Code and refused if called. In approval mode, new tools arrive switched off. API keys for the connected apps stay in the workspace instead of in a config file on each laptop.
It does not see Claude Code's built-in tools: shell commands, file edits and reads stay with Claude Code's own permissions and hooks. The two work together: Claude Code's rules for what runs on the machine, ContextGate's record and policies for what reaches your apps and data.
Setup takes one command: add ContextGate to Claude Code. The developer guide covers Cursor and VS Code too, and MCP security best practices covers the wider set of controls.
Questions people ask about Claude Code permissions
What does --dangerously-skip-permissions do in Claude Code?
It starts Claude Code in bypass mode: every tool call runs without a prompt, including shell commands, file edits and MCP tools. Anthropic documents it for isolated, disposable environments such as containers with no credentials and no network. Deny rules and hooks still apply where configured; the gateway record applies to any MCP tool call that goes through ContextGate.
How do I stop Claude Code asking permission for one tool but not others?
Add an allow rule for that tool in settings.json under permissions.allow, for example Bash(npm test) or an MCP rule such as mcp__contextgate. Everything not matched by an allow rule still prompts. Deny rules win over allow rules.
How do Claude Code permissions apply to MCP tools?
MCP tools are named mcp__<server>__<tool>. You can allow or deny a single tool, or a whole server with mcp__<server>. Prompts for MCP tools look like any other permission prompt. If the server is a gateway, the gateway can also switch tools off so Claude Code never sees them.
Can an organisation lock Claude Code permissions?
Yes. Managed settings, deployed by an administrator, take precedence over user and project settings and can set deny rules and the permission mode that users cannot override. Check Anthropic's current documentation for the exact file locations and keys on each platform.
Is Claude Code secure to use at work?
It is as secure as the permissions you give it and the environment it runs in. The risks are the ones any agent with a shell has: it can run commands, read files and call MCP tools. Keep the default mode for anything that touches production or customer data, use allow rules for the repetitive safe commands, and route MCP tools through one connection you can record and control.
Does a permission prompt tell me what a tool call actually did?
No. A prompt shows the call Claude Code is about to make. It does not record the result, and once a call is allowed there is no log of what came back. For MCP tools, a gateway in front of the servers gives you that record: the arguments, the result after redaction and the policy outcome.
Ready to see what your AI agents do?
Create a free workspace and add ContextGate to your AI apps in minutes. No card required.
Get started free
We'll email you a sign-in link to set up your workspace.
Rather talk it through first? Book a 30-minute call