contenox

--dangerously-skip-permissions: what it skips, what stays

Updated

SAFETY AND CONTROL --dangerously-skip-permissions

--dangerously-skip-permissions starts Claude Code in bypassPermissions mode: it edits files, runs commands and fetches URLs without asking you first. It’s the same as claude --permission-mode bypassPermissions. Your deny rules still apply; everything else that would have asked just runs.

The Codex equivalent is --dangerously-bypass-approvals-and-sandbox, alias --yolo, and it goes further: it also removes Codex’s sandbox.

claude --dangerously-skip-permissions

The first time you start it this way, Claude Code shows a warning you must accept. Accepting saves "skipDangerousModePermissionPrompt": true in ~/.claude/settings.json, so you won’t see it again. In a script with claude -p, there’s no dialog.

What it turns off, and what still applies

Turned off:

  • Every approval prompt for commands, edits and web fetches
  • Your allow rules, which no longer matter, since everything not denied runs
  • The protection of .git, .claude, .vscode, .bashrc, .mcp.json and similar paths, which become writable

Still applies:

  • Deny rules. A "deny": ["Bash(git push *)"] blocks in every mode, including this one.
  • Explicit ask rules. A rule in "ask" still prompts.
  • Deleting critical paths. rm on a drive root or a system folder still asks.
  • The sandbox, if enabled. Commands stay inside it, though hosts outside the network allowlist are allowed without a prompt.
  • Admin settings. Managed deny rules can’t be overridden.

So the flag is less absolute than its name suggests, if you’ve written deny rules first. With an empty settings file, nothing stands between the model and your machine.

Guards around the flag

  • No root. On Linux and macOS, Claude Code refuses to run with it as root or under sudo: --dangerously-skip-permissions cannot be used with root/sudo privileges for security reasons. The check is skipped inside a recognized sandbox. Windows has no such check.
  • Not from a project. Setting "defaultMode": "bypassPermissions" in a project’s .claude/settings.json is ignored. It only works in your own user settings or managed settings, so a repository you clone can’t switch it on for you.
  • Admins can block it, and so can you: "permissions": {"disableBypassPermissionsMode": "disable"}.
  • Opt in without starting in it. claude --allow-dangerously-skip-permissions adds bypass mode to the Shift+Tab cycle without turning it on. Without one of the two flags at startup, you can’t switch into bypass during a session.

The equivalents in other tools

ToolFlagAlso removes the sandbox?
Claude Code--dangerously-skip-permissionsNo: the sandbox stays if enabled
Codex--dangerously-bypass-approvals-and-sandbox, alias --yoloYes: sets approval_policy = never and sandbox_mode = danger-full-access
Copilot CLI--allow-all, alias --yoloCopilot’s sandbox is separate and off by default
Cursor CLI--force, alias --yoloSeparate: --sandbox enabled
OpenCode--autoOpenCode has no sandbox

If you searched for the Codex version of this flag because you want Codex to stop asking: you probably don’t want --yolo. codex --approve-for-me keeps the workspace-write sandbox and lets an automatic reviewer handle approvals. And codex -a never --sandbox workspace-write never asks, while the sandbox still keeps it inside the project and off the network.

When it’s the right flag

For unattended runs in a box where nothing can go wrong: a container or VM with only the project mounted, no credentials, ideally no network. That’s what Anthropic’s docs recommend. A typical use is a long refactoring or a batch job running overnight in a dev container, on a fresh clone you can throw away.

It’s the wrong flag on your laptop, with your SSH keys in ~/.ssh, your cloud logins in your home folder, and push access to your company’s repositories. The model doesn’t have to be malicious to do damage there. It only has to read a web page or an issue with instructions planted in it.

Safer ways to get the same speed

  1. Write deny rules first. If you use the flag, it’s only as safe as your deny list. A minimal one:

    {
  "permissions": {
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(~/.ssh/**)",
      "Read(~/.aws/**)",
      "Bash(git push *)",
      "Bash(sudo *)"
    ]
  }
}

  2. Turn on the sandbox instead. With {"sandbox": {"enabled": true}}, sandboxed commands run without prompts, writes stay in the project, and network goes through an allowlist. Available on macOS, Linux and WSL2; on native Windows, commands run unsandboxed.

  3. Use auto mode. It’s Claude Code’s default since v2.1.283: a classifier approves routine actions, and you only see the unusual ones.

  4. Use acceptEdits (claude --permission-mode acceptEdits) if the prompts you hate are mostly edits. Edits and simple file commands inside the project run; other commands still ask.

  5. Allow your routine commands by rule. npm test *, npm run build, git add *. See why your agent keeps asking.

Contenox

Contenox’s default rules are built so you don’t need a flag like this. Builds, tests, linters and read-only git commands run without asking; rm, sudo and history changes keep asking; keys and credentials are blocked. For your own machine, a looser set allows everything not named and still asks before the risky commands. The command line has --auto for CI runners you throw away, the one place where skipping prompts is the right call. See built-in tools and permissions.

Related

Esc to close