Read Permissions for Claude Code

As a Senior Staff Developer with an AI focus at CreateiQ I’ve been glued to my news feeds for the last year. AI is moving at breakneck pace and I want to make sure that both our Product and Team stay at the forefront.

One of the things we’ve done recently to further that last goal is roll out Claude Code to every engineer on the team. I’ve been working with Claude in a Proof of Concept phase since it entered Research Preview and I have been seriously impressed. That’s only compounded by using it with the latest Claude 4 series models.

One of the first comments people make about Claude Code, after the impressiveness has settled in and they’re using it day-to-day, is “Why does it keep prompting me so much for simple reads?”. I like the safety first approach but I find that I want to give it wide license (within the project I’m running it in only of course) to read files and consult internet sources.

To that end, here’s my `~/.claude/settings.json` that captures as many tools as I can find to give the assistant broad read abilities, without asking for permission, by default. What do you think?

{
  // Claude Code: read-only blanket permissions
  "permissions": {
    "allow": [
      // External web access
      "WebFetch(**)",
      "WebSearch(**)",

      // Core built-in read tools
      "ReadFile(**)",
      "NotebookRead(**)",
      "LS(**)",
      "Glob(**)",
      "Find(**)",
      "Search(**)",
      "Grep(**)",
      "Agent",

      // Grep / ripgrep via Bash
      "Bash(grep:*)",
      "Bash(grep -R:*)",
      "Bash(rg:*)",
      "Bash(ripgrep:*)",

      // Text inspection utilities
      "Bash(cat:*)",
      "Bash(head:*)",
      "Bash(tail:*)",
      "Bash(less:*)",
      "Bash(awk:*)",
      "Bash(sed -n:*)",
      "Bash(wc:*)",
      "Bash(sort:*)",
      "Bash(uniq:*)",

      // File discovery & listing
      "Bash(find:*)",
      "Bash(ls:*)",
      "Bash(tree:*)",

      // Read-only Git queries
      "Bash(git diff:*)",
      "Bash(git show:*)",
      "Bash(git log:*)"
    ],
    "deny": []
  }
}

NB: Claude Code supports settings in JSON5 so these comments are valid!