Claude Code Permissions Generator

This generator builds the one part of settings.json most people get wrong by hand: the permissions block that decides what Claude Code can run without asking, and what it can never touch. Five questions, all click-only except one optional path field, and the last screen pairs the JSON with a plain-English readout of what the rules actually do.

Deny always beats allow in Claude Code, even when the matching allow rule is more specific - a broad Bash(aws *) deny still blocks Bash(aws s3 ls). And read-only git commands like status, diff, and log already run without a prompt in every mode, since they're on Claude Code's own built-in read-only list, so an allow rule for them does nothing. Both facts are easy to miss reading the docs cold, and both changed what this generator ended up putting in the output.

Pick your OS and the last question - protecting an extra path like your AWS credentials or SSH keys - gets the syntax Claude Code actually matches against. Type a Windows path with backslashes and the generator converts it to the //c/... form Claude Code normalizes to before matching; the backslash version you'd paste in by hand matches nothing. It also only ever writes one Read() rule per path, because a Read deny rule already blocks Edit on that same path as of Claude Code 2.1.208 - a second rule would just be redundant.

The guardrails - blocking force-push, git reset --hard, rm -rf, and reads of .env and secrets/ - aren't a checkbox here. Every starting mode ships with them, so there's no screen where an unchecked box quietly removes your safety net. What changes between Balanced, Cautious, and Workflow-friendly is only how much gets pre-approved on top: Cautious skips the pre-approval screen entirely, Workflow-friendly starts it pre-checked for tests, lint, and GitHub reads.

This generator only covers permissions. For hooks, environment variables, and model selection in the same file, the settings.json generator builds the rest of it, and the complete permissions guide walks through every mode and rule type this tool encodes, if you want the reasoning behind a specific answer.

I run Claude Code daily and this generator writes the same permission rules my own settings.json uses. If you want the finished version of the whole idea - a tuned settings.json, a tuned CLAUDE.md, and the full vetted tool stack, installed in one paste - that is what ClockedCode is. The link is at the bottom of this page.

By Neo Zino - builder of ClockedCode