Free tool

Agent permissions generator

Stop approving the same commands all day without giving your agent free rein. List what it may run, list what it must never run, and copy the exact rules for 12 coding agents. Syntax checked against each vendor's docs on 2026-10-19.

Your agent

Add to: .claude/settings.json (project) or ~/.claude/settings.json (user)

{
  "permissions": {
    "allow": [
      "Bash(npm test *)",
      "Bash(npm run lint *)",
      "Bash(git status *)",
      "Bash(git diff *)"
    ],
    "deny": [
      "Bash(rm -rf *)",
      "Bash(git push *)"
    ]
  }
}

Rules are checked deny, then ask, then allow. "Bash(cmd *)" also matches the bare command.

If the file already has settings, merge these keys into it. Syntax source: Claude Code docs.

Agents without a per-command allowlist

  • Cline: No per-command allowlist; use Auto Approve settings or a PreToolUse hook to block commands.
  • goose: Permissions are per tool (Always Allow, Ask Before, Never Allow), not per command.
  • Amp: Runs tools without asking by default since May 2026; command rules need the legacy permissions plugin.

Related

Permission rules change often

Get one email a week when a coding agent changes its permission, sandbox or approval settings.