cc-permissions

Thoughtful permission configs for Claude Code without the container overhead.

Claude Code users face a frustrating choice: run in a Docker sandbox with --dangerously-skip-permissions for convenience, or run natively and deal with constant permission prompts.

This tool offers a middle ground. Generate permission configurations tailored to your workflow, reducing prompt fatigue while maintaining control over what Claude Code can do.

⚠️ Warning: This approach is inherently less safe than a fully isolated environment. You're trading sandbox protection for convenience. ⚠️

Getting started

The fastest way to get going:

npx cc-permissions apply

This analyzes your project, detects relevant templates, and applies permissions to .claude/settings.json.

Want to see what would be applied first?

npx cc-permissions

Or install globally to use without npx:

npm install -g cc-permissions

Then run: cc-permissions apply

Or use as slash command via a Claude Code plugin:

# Add the marketplace
claude plugin marketplace add DanielCarmingham/cc-permissions

# Install the plugin
claude plugin install cc-permissions@DanielCarmingham-cc-permissions

# Update to latest version
claude plugin update cc-permissions@DanielCarmingham-cc-permissions

# Uninstall
claude plugin uninstall cc-permissions@DanielCarmingham-cc-permissions

Then use /cc-permissions:analyze, /cc-permissions:apply, and other slash commands directly in Claude Code.

Note: Third-party plugins don't auto-update by default. Run claude plugin update from your terminal to get new versions, or enable auto-update via /plugin → Marketplaces → select marketplace → Enable auto-update.

How it works

Permissions are organized into templates and levels.

Templates group commands by technology. Use nodejs for npm/yarn/pnpm commands, python for pip and pytest, docker for container operations, and so on. Combine them freely:

cc-permissions apply nodejs,python,docker

Levels control how permissive each template is:

| Level | What it allows | |-------|----------------| | restrictive | Read-only operations (list, status, info) | | standard | Development workflow (run, build, test) | | permissive | Broader access (install, publish, remove) |

Levels are cumulative. standard includes everything from restrictive, and permissive includes everything from standard.

# Safe exploration mode
cc-permissions apply nodejs --level restrictive

# Normal development (default)
cc-permissions apply nodejs

# Trusted project, full access
cc-permissions apply nodejs --level permissive

Templates

General

| Template | Description | |----------|-------------| | shell | Basic shell and filesystem commands |

Version Control

| Template | Description | |----------|-------------| | git | Git version control | | gitea | Gitea CLI (tea) for repository and workflow management | | gitea-mcp | Gitea MCP Server tools for repository and workflow management | | github | GitHub CLI (gh) for repository and workflow management | | github-mcp | GitHub MCP Server tools for repository and workflow management | | gitlab | GitLab CLI (glab) for repository and workflow management | | gitlab-mcp | GitLab MCP Server tools for repository and workflow management |

Languages & Runtimes

| Template | Description | |----------|-------------| | bun | Bun runtime and package manager | | dotnet | dotnet CLI, NuGet, MSBuild | | go | Go development and golangci-lint | | java | Java and JVM runtime | | nodejs | Node.js, npm, and npx | | php | PHP, Composer, and Laravel Artisan | | pnpm | pnpm package manager | | python | pip, python, venv, pytest, and common data tools | | ruby | Ruby, Bundler, Rails, and Rake | | rust | Cargo, rustc, and rustup | | typescript | TypeScript compiler (tsc) | | yarn | Yarn package manager |

Build Tools

| Template | Description | |----------|-------------| | gradle | Gradle build tool and wrapper | | maven | Apache Maven build tool |

Cloud Providers

| Template | Description | |----------|-------------| | aws | AWS CLI, SAM, CDK, Amplify, and Elastic Beanstalk | | aws-mcp | AWS MCP Server tools for cloud infrastructure and serverless development | | azure | Azure CLI, Functions, Bicep, and Azure Developer CLI | | bicep | Azure Bicep infrastructure-as-code CLI | | gcp | Google Cloud CLI, gsutil, Firebase, and BigQuery |

Container & Infrastructure

| Template | Description | |----------|-------------| | docker | Docker, Docker Compose, and Buildx | | docker-mcp | Docker MCP Server tools for container management | | kubernetes | kubectl, Helm, k9s, and Minikube | | podman | Podman, Podman Compose, and Podman Machine | | podman-mcp | Podman MCP Server tools for container management | | terraform | Terraform, Terragrunt, and tflint |

Database

| Template | Description | |----------|-------------| | azure-sql | Azure SQL Database CLI tools (az sql) | | azure-storage | Azure Storage CLI tools (az storage) for blobs, tables, queues, and file shares | | excel-mcp | Excel MCP Server tools for spreadsheet operations | | mariadb | MariaDB CLI tools (mariadb, mariadb-dump, mariadb-admin) | | mariadb-mcp | MariaDB MCP Server tools for database queries | | mongodb | MongoDB CLI tools (mongosh, mongodump, mongorestore) | | mysql | MySQL CLI tools (mysql, mysqldump, mysqladmin) | | postgres | PostgreSQL CLI tools (psql, pg_dump, pg_restore) | | postgres-mcp | PostgreSQL MCP Server tools for database queries | | redis | Redis CLI tools (redis-cli) | | sqlite | SQLite CLI tools (sqlite3) | | sqlite-mcp | SQLite MCP Server tools for database operations |

Testing

| Template | Description | |----------|-------------| | chrome-devtools-mcp | Chrome DevTools MCP Server tools for browser inspection and debugging | | firefox-devtools-mcp | Firefox DevTools MCP Server tools for browser inspection and debugging | | playwright | Playwright testing framework | | playwright-mcp | Playwright MCP Server tools for browser automation | | selenium | Selenium testing framework CLI tools | | selenium-mcp | Selenium MCP Server tools for browser automation |

Mobile Development

| Template | Description | |----------|-------------| | android | Android SDK, ADB, and emulator | | flutter | Flutter SDK and Dart development | | ios | Xcode, Swift, CocoaPods, and iOS development |

MCP Servers

All MCP server templates in one place. These are also listed alongside their CLI counterparts above.

| Template | Description | |----------|-------------| | aws-mcp | AWS MCP Server tools for cloud infrastructure and serverless development | | azure-sql-mcp | Azure SQL Database MCP Server tools (azmcp) | | azure-storage-mcp | Azure Storage MCP Server tools (azmcp) | | chrome-devtools-mcp | Chrome DevTools MCP Server tools for browser inspection and debugging | | docker-mcp | Docker MCP Server tools for container management | | excel-mcp | Excel MCP Server tools for spreadsheet operations | | firefox-devtools-mcp | Firefox DevTools MCP Server tools for browser inspection and debugging | | gitea-mcp | Gitea MCP Server tools for repository and workflow management | | github-mcp | GitHub MCP Server tools for repository and workflow management | | gitlab-mcp | GitLab MCP Server tools for repository and workflow management | | mariadb-mcp | MariaDB MCP Server tools for database queries | | playwright-mcp | Playwright MCP Server tools for browser automation | | podman-mcp | Podman MCP Server tools for container management | | selenium-mcp | Selenium MCP Server tools for browser automation | | postgres-mcp | PostgreSQL MCP Server tools for database queries | | sqlite-mcp | SQLite MCP Server tools for database operations | | typescript-mcp | TypeScript MCP Server tools for type checking and compilation |

Click any template to see the full list of commands at each level.

Where permissions are saved

By default, permissions go to .claude/settings.json (project scope). You can change this:

# Personal defaults across all projects
cc-permissions apply --scope user

# Project-specific overrides (gitignored)
cc-permissions apply --scope local

# Custom file
cc-permissions apply --output ./my-permissions.json

| Scope | File | Use case | |-------|------|----------| | project | .claude/settings.json | Team settings, commit to repo | | user | ~/.claude/settings.json | Personal defaults | | local | .claude/settings.local.json | Personal overrides, gitignored |

Safety

All generated configs include a deny list blocking dangerous patterns like rm -rf /, sudo, and piped remote execution (curl | bash). You can still shoot yourself in the foot, but the obvious hazards are blocked.

Other commands

# See what would be applied (same as cc-permissions analyze)
cc-permissions

# List available templates
cc-permissions list

# View template permissions without applying
cc-permissions template nodejs

# Output as JSON (for piping/scripting)
cc-permissions template nodejs --format json

Contributing

See CONTRIBUTING.md for instructions on adding new templates and development setup.

License

0BSD - Use freely, no attribution required.