208 pages for deny.

Common workflows Claude Code CLI · in the page common-workflows …nces from including files: * **Block specific paths**: add a [`Read` deny rule](/docs/en/permissions#read-and-edit) for them. Claude Code doesn't include a file that the rule matches. * **Stop `@` re… Let Claude use your computer from the CLI Claude Code CLI · in the page computer-use …be hidden while Claude works Choose **Allow for this session** or **Deny**. Approvals last for the current session. You can approve multiple apps at once when Claude requests them together. Apps wi… Message your other Claude Code sessions Claude Code CLI · in the page cross-session-messaging …nd a preview: * **Approve** delivers that one message to Claude. * **Deny**, or dismissing the dialog, drops it. * When the dialog stays unanswered past the [`dialogExpiry`](/docs/en/settings-referen… Debug your configuration Claude Code CLI · in the page debug-your-config …MCP servers and their status | | `/permissions` | Resolved allow and deny rules currently in effect | | `/doctor` | Setup checkup: installation health, invalid settings files, unused extensions, dupl… Desktop application Claude Code CLI · in the page desktop …Claude waits for your choice: **Allow once**, **Always allow**, or **Deny**. **Allow once** approves the action without saving anything. **Always allow** saves the approval for that site on your devi… Environment variables Claude Code CLI · in the page env-vars …| | `CLAUDE_CODE_DISABLE_POWERSHELL_CMD_RM_DENY` | Set to `1` to turn off the [PowerShell tool](/docs/en/tools-reference#powershell-tool) check that denies the `c… Error reference Claude Code CLI · in the page errors …r certificate` | [Network](#ssl-certificate-errors) | | `403` with `x-deny-reason: host_not_allowed` in a cloud session or cloud scheduled task | [Network](#host-not-allowed-in-a-cloud-session) | | `p… Fullscreen rendering Claude Code CLI · in the page fullscreen …lowlist, or [`--setting-sources`](/docs/en/cli-reference#cli-flags) * Deny or ask rules that a [hook or SDK permission update](/docs/en/hooks.md#permission-update-entries) added for this session only… Glossary Claude Code CLI · in the page glossary …tion based on the tool name and argument pattern. Rules are evaluated deny→ask→allow, first match wins. Permission rules are fine-grained controls layered on top of the broader [permission mode](#perm… Hooks reference Claude Code CLI · in the page hooks …stdin, extracts the command, and returns a `permissionDecision` of `"deny"` if it contains `rm -rf`. Save it to `.claude/hooks/block-rm.sh` in your project and make it executable with `chmod +x .clau… Automate actions with hooks Claude Code CLI · in the page hooks-guide …completion before Claude Code merges the results. One hook returning `deny` doesn't stop sibling hooks from executing. Don't rely on one hook's `deny` to suppress side effects in another hook. After… JetBrains IDEs Claude Code CLI · in the page jetbrains …n or tab in the IDE is automatically shared with Claude Code. [`Read` deny rules](/docs/en/permissions#read-and-edit) block this sharing for matching files * **File reference shortcuts**: use `Cmd+Opt… Set up Claude Code in a monorepo or large codebase Claude Code CLI · in the page large-codebases …ing build output, generated code, and vendored dependencies | [`Read` deny rules](#block-reads-of-generated-and-vendored-code) in `permissions.deny` | | Find a symbol's definition or callers through t… Control MCP server access for your organization Claude Code CLI · in the page managed-mcp …, with managed configuration files, managed settings, allowlists, and denylists. By default, anyone running Claude Code can connect any [MCP server](/docs/en/mcp.md) they choose. Anthropic reviews co… Deploy managed settings Claude Code CLI · in the page managed-settings …```json managed-settings.json theme={null} { "permissions": { "deny": [ "Read(./.env)", "Read(./secrets/**)" ], "disableBypassPermissionsMode": "disable" }, "allowManage… Connect Claude Code to tools via MCP Claude Code CLI · in the page mcp …em in | Your claude.ai organization settings, plus the [allowlist and denylist](/docs/en/managed-mcp.md#policy-based-control-with-allowlists-and-denylists) settings that reach the session and any `man… How Claude remembers your project Claude Code CLI · in the page memory …[managed settings](/docs/en/managed-settings.md) such as `permissions.deny`. **1. Create the file at the managed policy location** * macOS: `/Library/Application Support/ClaudeCode/CLAUDE.md` * Linu… Model configuration Claude Code CLI · in the page model-config …t [organization model restrictions](#organization-model-restrictions) deny for your account is replaced by the newest allowed model in its family, or a lower-cost family when every version of it is re… Monitoring Claude Code CLI · in the page monitoring-usage …ting, by one of these sources: * Project settings * Allow or deny rules in the user's personal settings * Enterprise managed policy * `--allowedTools` or `--disallowedTools` flags… Choose a permission mode Claude Code CLI · in the page permission-modes …md#manage-permissions) on top to pre-approve or block specific tools. Deny rules block in every mode, including `bypassPermissions`. Deny and ask rules don't apply to [`EndConversation`](/docs/en/tool… Configure permissions Claude Code CLI · in the page permissions …ermission prompt You can attach a note to Claude when you approve or deny a single action. On most permission prompts, including Bash, PowerShell, file, and MCP tool prompts, move to **Yes** or **No*… Manage mods for your organization Claude Code CLI · in the page plugins/mods/admin …nd make network requests. It can also rewrite tool calls and prompts, deny a tool call, and draw in the interface. * **Permission rules and `PreToolUse` hooks take precedence over a user's mod.** With… Use the mods API Claude Code CLI · in the page plugins/mods/api …xt` isn't a string, when another mod's hook on `ui.notify` returns `{ deny }`, or when writing to the terminal fails. Your mod can't choose the channel, and Claude Code doesn't limit how often a mod… React to events with a mod Claude Code CLI · in the page plugins/mods/events …nc () => { // No call to next, so the command never runs return { deny: 'Bash is turned off in this project. Use the file tools.' } }) ``` When Claude tries a Bash command, the command doesn't ru… Mods overview Claude Code CLI · in the page plugins/mods/overview …se` hook blocked. To check when a mod can also approve a call that a `deny` rule refuses, see [Extend permissions with hooks](/docs/en/permissions.md#precedence-among-rules-hooks-and-mods). A mod can… Mods reference Claude Code CLI · in the page plugins/mods/reference …, and a word such as `reason` stands for a string you write, as in `{ deny: 'Use the file tools.' }`. ### Tools Tool events fire around each tool call Claude makes, from the description Claude reads… Test a mod Claude Code CLI · in the page plugins/mods/test …`, and each error appears there: * `returned neither { value } nor { deny }`: a stub for a mods API call returned a bare value, which fails the test * `no implementation for` followed by a name: your… Troubleshoot a mod Claude Code CLI · in the page plugins/mods/troubleshoot …gin directory](#find-out-why-a-mod-does-nothing) | | `tried to lift a deny rule in your settings` | Your mod's [`tool.check`](/docs/en/plugins/mods/reference#tools) hook approved a call that a `deny`… How Claude Code uses prompt caching Claude Code CLI · in the page prompt-caching …[Enabling or disabling a plugin](#enabling-or-disabling-a-plugin) * [Denying an entire tool](#denying-an-entire-tool) * [Compacting the conversation](#compacting-the-conversation) * [Accumulating man… Automate work with scheduled tasks Claude Code CLI · in the page routines …ts on that path to hosts outside the allowlist fail with `403` and `x-deny-reason: host_not_allowed`. MCP connector traffic is routed through Anthropic's servers rather than that path, so the connecto… Choose a sandbox environment Claude Code CLI · in the page sandbox-environments …locks the highest-risk writes without any configuration from you: * `denyWrite` takes precedence over `allowWrite`. * At the project root, the runtime denies `.git/hooks`, denies `.git/config` unless… Configure the sandboxed Bash tool Claude Code CLI · in the page sandboxing …cs/en/settings-reference#sandbox-filesystem-allowwrite), [`filesystem.denyWrite`](/docs/en/settings-reference#sandbox-filesystem-denywrite) | | Reads | Most of the machine, including credential files… Run prompts on a schedule Claude Code CLI · in the page scheduled-tasks …skills#override-skill-visibility-from-settings) setting or a `Skill` [deny rule](/docs/en/skills.md#restrict-claude’s-skill-access) * [MCP prompts](/docs/en/mcp.md#use-mcp-prompts-as-commands) such as… Security Claude Code CLI · in the page security …er, and which Claude Code still asks you about. Your explicit ask and deny rules still apply, and your organization can [turn auto mode off](/docs/en/permission-modes.md#eliminate-prompts-with-auto-mo… Customize sessions in self-hosted environments Claude Code CLI · in the page self-hosted-environments-configuration …oose against these runner behaviors: * **Metadata endpoint**: if you deny sessions the [cloud metadata endpoint](/docs/en/self-hosted-environments-deploy.md#harden-your-deployment) outright, credenti… Deploy self-hosted environments to production Claude Code CLI · in the page self-hosted-environments-deploy …rotate the secret after any suspected session compromise. * **Default-deny network egress**: restrict runner and session container outbound traffic at your own network boundary on every environment; [… Self-hosted environments reference Claude Code CLI · in the page self-hosted-environments-reference …admin of your organization wrote. The lists are `environment`, `soft_deny`, and `allow`: * **`environment`**: an entry can make the classifier allow more as well as less. * **`soft_deny`**: an entry… Configure server-managed settings Claude Code CLI · in the page server-managed-settings …allowManagedPermissionRulesOnly`. This example enforces a permission deny list, prevents users from bypassing permissions, and restricts permission rules to those defined in managed settings. The `Ba… Manage sessions Claude Code CLI · in the page sessions …resume`, it continues in your current permission mode instead. If a [deny rule](/docs/en/permissions.md#manage-permissions) removes the [`ExitPlanMode`](/docs/en/tools-reference) tool, Claude can't p… Claude Code settings Claude Code CLI · in the page settings …t)", "Bash(npm run test *)", "Read(~/.zshrc)" ], "deny": [ "Bash(curl *)", "Read(./.env)", "Read(./.env.*)", "Read(./secrets/**)" ] }, "env": {… Example settings files Claude Code CLI · in the page settings-example …d#project-allow-rules-and-workspace-trust), not only a parent folder; deny and ask rules apply in every session, trusted or not. * **The hook is a script in the repo.** This file's hook runs `.claude/… All settings Claude Code CLI · in the page settings-reference …ntext | Any file | | [`autoMode`](#automode) | Add your own allow and deny rules to the [auto mode](/docs/en/permission-modes.md#eliminate-prompts-with-auto-mode) classifier | Permission settings | Us… Extend Claude with skills Claude Code CLI · in the page skills …rove](/docs/en/permissions.md) read-only commands that you frequently deny * **Usage**: on a Pro, Max, Team, or Enterprise plan, the [changes `/usage` recommends](/docs/en/costs#plan-usage-breakdown)… Create custom subagents Claude Code CLI · in the page sub-agents …ct them: * To block a specific built-in type, add it to `permissions.deny` as shown in [Disable specific subagents](#disable-specific-subagents). * To prevent Claude from delegating to any subagent,… Tools reference Claude Code CLI · in the page tools-reference …ow`](/docs/en/settings-reference#permissions-allow) and [`permissions.deny`](/docs/en/settings-reference#permissions-deny) in settings, and the `/permissions` interface * in the `--allowedTools` and `… Use Claude Code in VS Code Claude Code CLI · in the page vs-code …mission rules](/docs/en/permissions.md), grouped into Allow, Ask, and Deny. You can add rules to your user, project, or local settings and remove rules saved there. Rules from other sources, such as m… Week 16 · April 13–17, 2026 Claude Code CLI · in the page whats-new/2026-w16 …`, and `/proactive` is an alias for `/loop`Hardened Bash permissions: deny rules now match through `env`/`sudo`/`watch` wrappers, and `Bash(find:*)` allow rules no longer auto-approve `-exec` or `-del… Week 17 · April 20–24, 2026 Claude Code CLI · in the page whats-new/2026-w17 …ithub.comAuto mode: include `"$defaults"` in [`autoMode.allow`, `soft_deny`, or `environment`](/docs/en/auto-mode-config) to add custom rules alongside the built-in list instead of replacing itNew [`c… Week 19 · May 4–8, 2026 Claude Code CLI · in the page whats-new/2026-w19 …remote default, and block actions unconditionally with auto mode hard deny rules. Releases [v2.1.128 → v2.1.136](/docs/en/changelog.md#2-1-128) 2 features · May 4–8 Plugins from .zip archives and UR… Week 24 · June 8–12, 2026 Claude Code CLI · in the page whats-new/2026-w24 …` hide bundled skills, workflows, and built-in commands from the modelDeny rules accept a glob in the tool-name position, so `"*"` denies all tools, and unknown tool names in deny rules now warn at st…