Configure permissions changedpermissions
Nearest release: v2.1.284, published 17 hours after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 28 Sep 2026 00:01 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 28 Sep 2026 23:37 UTC.
Upstream edited
Recorded here
Lines+90added
Lines−90removed
From line
8
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits72to this page, all time
The whole hunk
from line 8, old and new numbered
/
from line 8
88
99Claude Code uses a tiered permission system to balance power and safety. The table shows, for each tool type, whether Manual mode asks before the action runs. The other [permission modes](#permission-modes) change which of these ask you; in auto mode a classifier reviews actions instead of you, and [how the classifier evaluates actions](/docs/en/permission-modes#how-the-classifier-evaluates-actions) lists which ones it sees.
1010
11| Tool type | Example | Approval required | "Yes, and don't ask again" behavior |
12| :---------------- | :--------------- | :------------------------------------------------------------------------------------------------------------ | :------------------------------------- |
13| Read-only | File reads, Grep | No, within the [working directory and additional directories](#working-directories) | N/A |
14| Bash commands | Shell execution | Yes, except a built-in set of [read-only commands](#read-only-commands) | Permanently per repository and command |
15| File modification | Edit/write files | Yes | Until session end |
16| Web fetch | WebFetch | Yes, except a built-in set of [preapproved documentation domains](/docs/en/tools-reference#webfetch-tool-behavior) | Permanently per repository and domain |
17| Web search | WebSearch | Yes | Permanently per repository |
11| Tool type | Example | Approval required | "Yes, and don't ask again" behavior |
12| :- | :- | :- | :- |
13| Read-only | File reads, Grep | No, within the [working directory and additional directories](#working-directories) | N/A |
14| Bash commands | Shell execution | Yes, except a built-in set of [read-only commands](#read-only-commands) | Permanently per repository and command |
15| File modification | Edit/write files | Yes | Until session end |
16| Web fetch | WebFetch | Yes, except a built-in set of [preapproved documentation domains](/docs/en/tools-reference#webfetch-tool-behavior) | Permanently per repository and domain |
17| Web search | WebSearch | Yes | Permanently per repository |
1818
1919When you choose "Yes, and don't ask again" and the approval saves permanently, such as for a Bash command or a WebFetch domain, Claude Code saves the rule to `.claude/settings.local.json` at the root of the git repository, resolved through [worktrees](/docs/en/worktrees) to the main checkout. The rule applies to future sessions anywhere in that repository, including sessions started in subdirectories and in worktrees. A file-modification approval isn't saved to the file: as the table shows, it lasts until the session ends. In some cases, such as outside a git repository or on Windows, Claude Code doesn't use the repository root; [Where Claude Code looks for each file](/docs/en/settings#where-claude-code-looks-for-each-file) lists those cases and where it saves the rule instead.
2020
from line 63
6363
6464Claude Code supports several permission modes that control how it approves tool calls. See [Permission modes](/docs/en/permission-modes) for when to use each one. To change the mode sessions start in, set `defaultMode` in your [settings files](/docs/en/settings#where-settings-live). [Which mode a session starts in](/docs/en/permission-modes#which-mode-a-session-starts-in) covers the built-in default for each plan and what the VS Code extension reads.
6565
66| Mode | Description |
67| :------------------ | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
68| `default` | Prompts for permission on first use of each tool. Labeled Manual in the CLI, the VS Code and JetBrains extensions, and the desktop app, and Claude Code accepts `manual` as an alias. The label and alias require Claude Code v2.1.200 or later. The desktop app's label doesn't depend on your CLI version |
69| `acceptEdits` | Automatically accepts file edits and common filesystem commands such as `mkdir`, `touch`, `mv`, and `cp` for paths in the working directory or `additionalDirectories` |
70| `plan` | Claude reads files and runs read-only shell commands to explore but doesn't edit your source files; with [auto mode](/docs/en/permission-modes#eliminate-prompts-with-auto-mode) available, classifier-approved commands also run. Labeled Plan in the CLI and the VS Code extension |
71| `auto` | Auto-approves tool calls with background safety checks that verify actions align with your request |
72| `dontAsk` | Auto-denies every call that would otherwise prompt; file reads in your working directories and other actions that need no approval still run, as do tools pre-approved via `/permissions` or `permissions.allow` rules. `AskUserQuestion`, MCP tools marked [`requiresUserInteraction`](/docs/en/mcp#require-approval-for-a-specific-tool), and connector tools [your organization set to `ask`](/docs/en/mcp#organization-controls-on-connector-tools) in sessions where that setting reaches Claude Code are denied even if you've allowed them |
73| `bypassPermissions` | Skips permission prompts, except for the [actions no mode auto-approves](/docs/en/permission-modes#actions-no-mode-auto-approves) |
66| Mode | Description |
67| :- | :- |
68| `default` | Prompts for permission on first use of each tool. Labeled Manual in the CLI, the VS Code and JetBrains extensions, and the desktop app, and Claude Code accepts `manual` as an alias. The label and alias require Claude Code v2.1.200 or later. The desktop app's label doesn't depend on your CLI version |
69| `acceptEdits` | Automatically accepts file edits and common filesystem commands such as `mkdir`, `touch`, `mv`, and `cp` for paths in the working directory or `additionalDirectories` |
70| `plan` | Claude reads files and runs read-only shell commands to explore but doesn't edit your source files; with [auto mode](/docs/en/permission-modes#eliminate-prompts-with-auto-mode) available, classifier-approved commands also run. Labeled Plan in the CLI and the VS Code extension |
71| `auto` | Auto-approves tool calls with background safety checks that verify actions align with your request |
72| `dontAsk` | Auto-denies every call that would otherwise prompt; file reads in your working directories and other actions that need no approval still run, as do tools pre-approved via `/permissions` or `permissions.allow` rules. `AskUserQuestion`, MCP tools marked [`requiresUserInteraction`](/docs/en/mcp#require-approval-for-a-specific-tool), and connector tools [your organization set to `ask`](/docs/en/mcp#organization-controls-on-connector-tools) in sessions where that setting reaches Claude Code are denied even if you've allowed them |
73| `bypassPermissions` | Skips permission prompts, except for the [actions no mode auto-approves](/docs/en/permission-modes#actions-no-mode-auto-approves) |
7474
7575<Warning>
7676 In `bypassPermissions` mode, Claude Code skips permission prompts, including for writes to [protected paths](/docs/en/permission-modes#protected-paths) such as `.git` and `.claude`. The [cross-session messaging safeguards](/docs/en/permission-modes#skip-all-checks-with-bypasspermissions-mode) still apply. Only use this mode in isolated environments like containers or VMs where Claude Code can't cause damage.
from line 86
8686
8787To match all uses of a tool, use only the tool name without parentheses:
8888
89| Rule | Effect |
90| :--------- | :----------------------------- |
91| `Bash` | Matches all Bash commands |
89| Rule | Effect |
90| :- | :- |
91| `Bash` | Matches all Bash commands |
9292| `WebFetch` | Matches all web fetch requests |
93| `Read` | Matches all file reads |
93| `Read` | Matches all file reads |
9494
9595`Bash(*)` is equivalent to `Bash` and matches all Bash commands. As a deny rule, both forms remove the tool from Claude's context.
9696
from line 98
9898
9999Add a specifier in parentheses to match specific tool uses:
100100
101| Rule | Effect |
102| :----------------------------- | :------------------------------------------------------- |
103| `Bash(npm run build)` | Matches the exact command `npm run build` |
104| `Read(./.env)` | Matches reading the `.env` file in the current directory |
105| `WebFetch(domain:example.com)` | Matches fetch requests to example.com |
101| Rule | Effect |
102| :- | :- |
103| `Bash(npm run build)` | Matches the exact command `npm run build` |
104| `Read(./.env)` | Matches reading the `.env` file in the current directory |
105| `WebFetch(domain:example.com)` | Matches fetch requests to example.com |
106106
107107### Match by input parameter
108108
from line 112
112112
113113A parameter rule matches when Claude calls the tool with that parameter set to that exact value. An allow rule for one parameter value wouldn't establish that the call is safe overall, so allow rules continue to use each tool's own specifier syntax. This works for any scalar parameter the tool accepts:
114114
115| Rule | Matches |
116| :----------------------------- | :------------------------------------------- |
117| `Agent(model:opus)` | Agent calls that request the Opus model tier |
118| `Agent(isolation:worktree)` | Agent calls that request a git worktree |
119| `Bash(run_in_background:true)` | Bash calls that run in the background |
115| Rule | Matches |
116| :- | :- |
117| `Agent(model:opus)` | Agent calls that request the Opus model tier |
118| `Agent(isolation:worktree)` | Agent calls that request a git worktree |
119| `Bash(run_in_background:true)` | Bash calls that run in the background |
120120
121121Parameter matching follows these rules:
122122
from line 155
155155
156156A `*` can go anywhere in the rule: at the start, in the middle, or at the end. Each row shows a rule, commands it matches, and nearby commands it doesn't match:
157157
158| You write | Matches | Doesn't match |
159| :--------------------- | :----------------------------------------------------------------------------------- | :------------------------------------- |
160| `Bash(npm run build)` | `npm run build` | `npm run build --watch` |
161| `Bash(npm run *)` | `npm run build`, `npm run test --watch`, `npm run` | `npm install` |
162| `Bash(git log * main)` | `git log --oneline main`, `git log -5 main`, `git log --output=<file> main` | `git log main`, `git push origin main` |
163| `Bash(git * main)` | `git merge main`, `git push origin main`, `git -c core.fsmonitor=<script> diff main` | `git log` |
164| `Bash(* --version)` | `node --version`, `bash -c 'echo hi' --version` | `node -v` |
165| `Bash(ls *)` | `ls -la`, `ls` | `lsof` |
166| `Bash(ls*)` | `ls -la`, `lsof` | |
167| `Bash(* --help *)` | `npm --help x` | `npm --help` |
158| You write | Matches | Doesn't match |
159| :- | :- | :- |
160| `Bash(npm run build)` | `npm run build` | `npm run build --watch` |
161| `Bash(npm run *)` | `npm run build`, `npm run test --watch`, `npm run` | `npm install` |
162| `Bash(git log * main)` | `git log --oneline main`, `git log -5 main`, `git log --output=<file> main` | `git log main`, `git push origin main` |
163| `Bash(git * main)` | `git merge main`, `git push origin main`, `git -c core.fsmonitor=<script> diff main` | `git log` |
164| `Bash(* --version)` | `node --version`, `bash -c 'echo hi' --version` | `node -v` |
165| `Bash(ls *)` | `ls -la`, `ls` | `lsof` |
166| `Bash(ls*)` | `ls -la`, `lsof` | |
167| `Bash(* --help *)` | `npm --help x` | `npm --help` |
168168
169169Three matching rules produce those rows:
170170
from line 234
234234
235235A Bash rule matches the command text Claude writes, after Claude Code splits [compound commands](#compound-commands) and strips [wrappers](#process-wrappers). It doesn't match the same program invoked in a different form, so a deny or ask rule covers the invocation Claude usually produces and isn't a security boundary around the program. These rules in `deny` or `ask` stop the first form and not the others:
236236
237| Rule | Stops | Doesn't stop |
238| :----------------- | :------------------------- | :---------------------------------------------------------------------------------------------------- |
239| `Bash(curl *)` | `curl https://example.com` | `/usr/bin/curl https://example.com`, `sh -c 'curl https://example.com'` |
240| `Bash(rm *)` | `rm -rf build/` | `/bin/rm -rf build/`, `bash -c 'rm -rf build/'` |
241| `Bash(git push *)` | `git push origin main` | `git -C . push origin main`, `git -c push.default=current push origin main`, `git 'push' origin main` |
237| Rule | Stops | Doesn't stop |
238| :- | :- | :- |
239| `Bash(curl *)` | `curl https://example.com` | `/usr/bin/curl https://example.com`, `sh -c 'curl https://example.com'` |
240| `Bash(rm *)` | `rm -rf build/` | `/bin/rm -rf build/`, `bash -c 'rm -rf build/'` |
241| `Bash(git push *)` | `git push origin main` | `git -C . push origin main`, `git -c push.default=current push origin main`, `git 'push' origin main` |
242242
243243Your other rules and the permission mode decide the commands in the last column.
244244
from line 331
331331
332332Read and Edit rules both use [gitignore](https://git-scm.com/docs/gitignore) pattern syntax with four distinct pattern types; for single-segment directory patterns, the matching depth also depends on the rule type, described later in this section:
333333
334| Pattern | Meaning | Example | Matches |
335| ------------------ | ------------------------------------ | -------------------------------- | ------------------------------------------------------------- |
336| `//path` | Absolute path from filesystem root | `Read(//Users/alice/secrets/**)` | `/Users/alice/secrets/**` |
337| `~/path` | Path from home directory | `Read(~/Documents/*.pdf)` | `/Users/alice/Documents/*.pdf` |
338| `/path` | Path relative to the settings source | `Edit(/src/**/*.ts)` | `<primary working directory>/src/**/*.ts` in project settings |
339| `path` or `./path` | Path relative to current directory | `Read(*.env)` | `<cwd>/*.env` |
334| Pattern | Meaning | Example | Matches |
335| - | - | - | - |
336| `//path` | Absolute path from filesystem root | `Read(//Users/alice/secrets/**)` | `/Users/alice/secrets/**` |
337| `~/path` | Path from home directory | `Read(~/Documents/*.pdf)` | `/Users/alice/Documents/*.pdf` |
338| `/path` | Path relative to the settings source | `Edit(/src/**/*.ts)` | `<primary working directory>/src/**/*.ts` in project settings |
339| `path` or `./path` | Path relative to current directory | `Read(*.env)` | `<cwd>/*.env` |
340340
341341<Warning>
342342 A pattern like `/Users/alice/file` isn't an absolute path. The single leading slash anchors at the settings source, not the filesystem root. Use `//Users/alice/file` for absolute paths.
from line 344
344344
345345A `/path` pattern anchors at a directory associated with the settings source that defines it, so the same rule matches different locations depending on where you put it:
346346
347| Rule defined in | `/path` resolves to |
348| :---------------------------------------------- | :--------------------------------- |
349| Project settings at `.claude/settings.json` | `<primary working directory>/path` |
347| Rule defined in | `/path` resolves to |
348| :- | :- |
349| Project settings at `.claude/settings.json` | `<primary working directory>/path` |
350350| Local settings at `.claude/settings.local.json` | `<primary working directory>/path` |
351| User settings at `~/.claude/settings.json` | `~/.claude/path` |
352| A file passed with `--settings <file>` | `<directory of file>/path` |
353| CLI flags or session rules | `<primary working directory>/path` |
351| User settings at `~/.claude/settings.json` | `~/.claude/path` |
352| A file passed with `--settings <file>` | `<directory of file>/path` |
353| CLI flags or session rules | `<primary working directory>/path` |
354354
355355A rule you add through `/permissions` follows the row for the settings file you save it to.
356356
from line 369
369369
370370A rule only matches files under its anchor; within that bound, matching depth depends on the pattern shape and, for single-segment directory patterns, the rule type, described below. Bare filenames follow gitignore semantics and match at any depth, so `Read(.env)` and `Read(**/.env)` are equivalent:
371371
372| Deny rule | Blocks | Does not block |
373| ------------------------------- | -------------------------------------------- | ---------------------------------------------------- |
374| `Read(.env)` or `Read(**/.env)` | any `.env` at or under the current directory | `.env` in a parent directory or another project |
375| `Read(//**/.env)` | any `.env` anywhere on the filesystem | nothing; the rule is anchored at the filesystem root |
372| Deny rule | Blocks | Does not block |
373| - | - | - |
374| `Read(.env)` or `Read(**/.env)` | any `.env` at or under the current directory | `.env` in a parent directory or another project |
375| `Read(//**/.env)` | any `.env` anywhere on the filesystem | nothing; the rule is anchored at the filesystem root |
376376
377377A relative pattern with a single directory segment, such as `src/**`, matches at different depths depending on the rule type:
378378
from line 393
393393 └── lib.js
394394```
395395
396| Rule | Matches `src/app.ts` | Matches `vendor/pkg/src/lib.js` |
397| :----------------------------------- | :------------------- | :------------------------------ |
398| `Edit(src/**)` as an allow rule | Yes | No |
399| `Edit(src/**)` as a deny or ask rule | Yes | Yes |
400| `Edit(/src/**)` in any rule type | Yes | No |
401| `Edit(**/src/**)` in any rule type | Yes | Yes |
396| Rule | Matches `src/app.ts` | Matches `vendor/pkg/src/lib.js` |
397| :- | :- | :- |
398| `Edit(src/**)` as an allow rule | Yes | No |
399| `Edit(src/**)` as a deny or ask rule | Yes | Yes |
400| `Edit(/src/**)` in any rule type | Yes | No |
401| `Edit(**/src/**)` in any rule type | Yes | Yes |
402402
403403<Note>
404404 In gitignore patterns, `*` matches within a single path segment and can appear at any position in the pattern, while `**` matches across directories.
from line 467
467467
468468Each row shows what a rule does in the `allow` list and in the `deny` list:
469469
470| Rule | In `allow` | In `deny` |
471| :------------------- | :--------------------------------------------------------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------ |
472| `WebFetch` | Claude fetches without prompting you. Doesn't change which hosts sandboxed commands can reach. | Claude Code removes the `WebFetch` tool, so Claude can't fetch at all. Doesn't change which hosts sandboxed commands can reach. |
473| `WebFetch(domain:*)` | Claude fetches without prompting you, and sandboxed commands can reach any host. | Claude Code keeps the tool and refuses each fetch, and sandboxed commands can't reach any host. |
470| Rule | In `allow` | In `deny` |
471| :- | :- | :- |
472| `WebFetch` | Claude fetches without prompting you. Doesn't change which hosts sandboxed commands can reach. | Claude Code removes the `WebFetch` tool, so Claude can't fetch at all. Doesn't change which hosts sandboxed commands can reach. |
473| `WebFetch(domain:*)` | Claude fetches without prompting you, and sandboxed commands can reach any host. | Claude Code keeps the tool and refuses each fetch, and sandboxed commands can't reach any host. |
474474
475475The two forms also differ on reads of [artifacts](/docs/en/artifacts), the pages the Artifact tool publishes on claude.ai. A bare `WebFetch` deny or ask rule doesn't apply to those reads. A `domain:` rule covering `claude.ai` or the `*.claudeusercontent.com` content host, such as `WebFetch(domain:claude.ai)` or `WebFetch(domain:*)`, denies each read or prompts before it. An [`Artifact` rule](/docs/en/artifacts#disable-artifacts) does the same.
476476
from line 530
530530
531531Path patterns share the `//`, `~/`, and `/` anchors from [Read and Edit rules](#read-and-edit), but matching is anchored to the whole directory path rather than gitignore-style. `*` matches exactly one path segment and `**` matches across segments. A trailing `/**` also matches its named root.
532532
533| Rule | Matches | Does not match |
534| --------------------- | --------------------------------------------------------------------- | ---------------------------- |
535| `Cd(~/code/*)` | `~/code/app` | `~/code/app/src`, `~/code` |
536| `Cd(~/code/**)` | `~/code` and any directory under it | directories outside `~/code` |
537| `Cd(**/node_modules)` | any `node_modules` directory at any depth under the current directory | `node_modules/pkg` |
533| Rule | Matches | Does not match |
534| - | - | - |
535| `Cd(~/code/*)` | `~/code/app` | `~/code/app/src`, `~/code` |
536| `Cd(~/code/**)` | `~/code` and any directory under it | directories outside `~/code` |
537| `Cd(**/node_modules)` | any `node_modules` directory at any depth under the current directory | `node_modules/pkg` |
538538
539539## Extend permissions with hooks
540540
from line 589
589589
590590The following configuration types are loaded from `--add-dir` directories:
591591
592| Configuration | Loaded from `--add-dir` |
593| :------------------------------------------------------------------------------------ | :----------------------------------------------------------------------------------------------------------------------------------------------------------------- |
594| [Skills](/docs/en/skills) in `.claude/skills/` | Yes, with live reload |
595| [Command files](/docs/en/skills#where-skills-live) in `.claude/commands/` | Yes, without live reload. When the added directory and your project both define a command with the same name, Claude Code runs your project's command |
596| [Subagents](/docs/en/sub-agents) in `.claude/agents/` | Yes, without live reload |
597| [Settings](/docs/en/settings) in `.claude/settings.json` and `.claude/settings.local.json` | `enabledPlugins` and [`extraKnownMarketplaces`](/docs/en/settings-reference#extraknownmarketplaces) keys only |
598| [CLAUDE.md](/docs/en/memory) files, `.claude/rules/`, and `CLAUDE.local.md` | Only when `CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD=1` is set. `CLAUDE.local.md` additionally requires the `local` setting source, which is enabled by default |
592| Configuration | Loaded from `--add-dir` |
593| :- | :- |
594| [Skills](/docs/en/skills) in `.claude/skills/` | Yes, with live reload |
595| [Command files](/docs/en/skills#where-skills-live) in `.claude/commands/` | Yes, without live reload. When the added directory and your project both define a command with the same name, Claude Code runs your project's command |
596| [Subagents](/docs/en/sub-agents) in `.claude/agents/` | Yes, without live reload |
597| [Settings](/docs/en/settings) in `.claude/settings.json` and `.claude/settings.local.json` | `enabledPlugins` and [`extraKnownMarketplaces`](/docs/en/settings-reference#extraknownmarketplaces) keys only |
598| [CLAUDE.md](/docs/en/memory) files, `.claude/rules/`, and `CLAUDE.local.md` | Only when `CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD=1` is set. `CLAUDE.local.md` additionally requires the `local` setting source, which is enabled by default |
599599
600600To load the skills, commands, and subagents from a subdirectory of your [primary working directory](#working-directories) mid-session, run `/add-dir` with that subdirectory's path. Claude Code loads them for the rest of the session without prompting you or adding a working directory, because the subdirectory is already readable. This requires Claude Code v2.1.257 or later.
601601
from line 681
681681
682682Each row is one kind of content a repository can supply. The columns are the two situations in which you haven't trusted the folder itself: you trusted only a parent folder, or you ran `claude -p` or the SDK there, which never shows the trust dialog. The parent-folder column doesn't apply inside a [nested repository](#project-allow-rules-and-workspace-trust): in an interactive session Claude Code shows the trust dialog for it, and a `claude -p` or SDK run there follows the `claude -p` column.
683683
684| What the repository supplies | You trusted only a parent folder | `claude -p` or the SDK, folder never trusted |
685| :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
686| [Hooks](/docs/en/hooks) in settings files, the [`env`](/docs/en/settings-reference#env) block and helper commands such as [`apiKeyHelper`](/docs/en/settings-reference#apikeyhelper), and a project skill's [hooks](/docs/en/hooks#hooks-in-skills-and-agents) and [`allowed-tools`](/docs/en/skills#pre-approve-tools-for-a-skill) | Used | Used. Workspace trust never gates a skill's `allowed-tools` in any session |
687| `permissions.allow` rules and `additionalDirectories` in `.claude/settings.json` | Not used until you accept the trust dialog, which appears again listing them | Not used. Claude Code prints a [`this workspace has not been trusted`](/docs/en/errors#workspace-has-not-been-trusted) warning to stderr |
688| Frontmatter hooks in a project [subagent](/docs/en/sub-agents#hooks-in-subagent-frontmatter), a project [`@skills-dir` plugin](/docs/en/plugins/loading#plugins-shared-through-a-repository), and [`extraKnownMarketplaces`](/docs/en/settings-reference#extraknownmarketplaces) entries from the repository or an `--add-dir` directory | Not used, and no dialog is offered | Not used |
689| Inline [`mcpServers`](/docs/en/sub-agents#scope-mcp-servers-to-a-subagent) in the frontmatter of a subagent from the repository or an `--add-dir` directory. Before v2.1.238, Claude Code loaded these servers in both situations | Not used, and no dialog is offered | Not used |
690| Servers in `.mcp.json`, including ones the repository [approves in its own settings](/docs/en/mcp#project-server-approvals-and-workspace-trust) | Claude Code asks you before connecting them. The repository's own approvals don't count | Connected without asking, approved or not. The SDK loads them only when `settingSources` includes project settings. `claude mcp list` in the same folder still reports such a server as pending |
691| A [`headersHelper`](/docs/en/mcp#trust-a-folder-before-its-headershelper-runs) on a server in `.mcp.json`. Before v2.1.238, Claude Code ran the helper in both situations | Not run until you accept the trust dialog, which appears again naming where the helper is declared. Claude Code connects the server with its static `headers` alone until then | Not run. Claude Code connects the server with its static `headers` alone and prints a [`headersHelper not run`](/docs/en/errors#headershelper-not-run) line per server to stderr |
684| What the repository supplies | You trusted only a parent folder | `claude -p` or the SDK, folder never trusted |
685| :- | :- | :- |
686| [Hooks](/docs/en/hooks) in settings files, the [`env`](/docs/en/settings-reference#env) block and helper commands such as [`apiKeyHelper`](/docs/en/settings-reference#apikeyhelper), and a project skill's [hooks](/docs/en/hooks#hooks-in-skills-and-agents) and [`allowed-tools`](/docs/en/skills#pre-approve-tools-for-a-skill) | Used | Used. Workspace trust never gates a skill's `allowed-tools` in any session |
687| `permissions.allow` rules and `additionalDirectories` in `.claude/settings.json` | Not used until you accept the trust dialog, which appears again listing them | Not used. Claude Code prints a [`this workspace has not been trusted`](/docs/en/errors#workspace-has-not-been-trusted) warning to stderr |
688| Frontmatter hooks in a project [subagent](/docs/en/sub-agents#hooks-in-subagent-frontmatter), a project [`@skills-dir` plugin](/docs/en/plugins/loading#plugins-shared-through-a-repository), and [`extraKnownMarketplaces`](/docs/en/settings-reference#extraknownmarketplaces) entries from the repository or an `--add-dir` directory | Not used, and no dialog is offered | Not used |
689| Inline [`mcpServers`](/docs/en/sub-agents#scope-mcp-servers-to-a-subagent) in the frontmatter of a subagent from the repository or an `--add-dir` directory. Before v2.1.238, Claude Code loaded these servers in both situations | Not used, and no dialog is offered | Not used |
690| Servers in `.mcp.json`, including ones the repository [approves in its own settings](/docs/en/mcp#project-server-approvals-and-workspace-trust) | Claude Code asks you before connecting them. The repository's own approvals don't count | Connected without asking, approved or not. The SDK loads them only when `settingSources` includes project settings. `claude mcp list` in the same folder still reports such a server as pending |
691| A [`headersHelper`](/docs/en/mcp#trust-a-folder-before-its-headershelper-runs) on a server in `.mcp.json`. Before v2.1.238, Claude Code ran the helper in both situations | Not run until you accept the trust dialog, which appears again naming where the helper is declared. Claude Code connects the server with its static `headers` alone until then | Not run. Claude Code connects the server with its static `headers` alone and prints a [`headersHelper not run`](/docs/en/errors#headershelper-not-run) line per server to stderr |
692692
693693For the rows that need this exact folder trusted, trust it by hand: set `projects["<path>"].hasTrustDialogAccepted` to `true` in `~/.claude.json`, where `<path>` is the repository root, or the folder itself outside a repository. Claude Code prints the exact key in the debug log line for a skipped subagent hook or inline MCP server, in the stderr warning for skipped allow rules, and in the `headersHelper not run` line for a skipped helper.
694694
No line in this hunk matches that.