Claude Code settings preset: acceptEdits mode, explicit dev-command allowlist, MCP whitelist, and guardrails for secrets and destructive Bash commands

settings.local.json

{
  "permissions": {
    "defaultMode": "acceptEdits",
    "allow": [
      "Read",
      "Edit",
      "Write",

      "Bash(git status)",
      "Bash(git status *)",
      "Bash(git diff *)",
      "Bash(git log *)",
      "Bash(git branch *)",
      "Bash(git show *)",
      "Bash(git add *)",
      "Bash(git commit *)",

      "Bash(npm run *)",
      "Bash(npm test)",
      "Bash(npm test *)",
      "Bash(npm install)",
      "Bash(npm ci)",

      "Bash(pnpm *)",
      "Bash(yarn *)",
      "Bash(npx tsc *)",
      "Bash(npx eslint *)",
      "Bash(npx prettier *)",

      "Bash(node *)",

      "mcp__code-review-graph__detect_changes_tool",
      "mcp__code-review-graph__list_repos_tool",
      "mcp__code-review-graph__list_graph_stats_tool",
      "mcp__code-review-graph__get_architecture_overview_tool",
      "mcp__playwright__*"
    ],
    "ask": [
      "Bash(git push *)",
      "Bash(git pull *)",
      "Bash(git merge *)",
      "Bash(git rebase *)",
      "Bash(git checkout *)",
      "Bash(git switch *)",
      "Bash(git reset *)",
      "Bash(git clean *)",
      "Bash(docker *)",
      "Bash(docker-compose *)",
      "Bash(curl *)",
      "Bash(wget *)",
      "Bash(ssh *)",
      "Bash(scp *)"
    ],
    "deny": [
      "Read(.env)",
      "Read(**/.env)",
      "Read(**/.env.*)",
      "Read(**/*secret*)",
      "Read(**/*secrets*)",
      "Read(**/*credential*)",
      "Read(**/*credentials*)",
      "Read(**/id_rsa)",
      "Read(**/id_ed25519)",

      "Edit(.env)",
      "Edit(**/.env)",
      "Edit(**/.env.*)",
      "Edit(**/*secret*)",
      "Edit(**/*secrets*)",
      "Edit(**/*credential*)",
      "Edit(**/*credentials*)",

      "Bash(rm -rf *)",
      "Bash(sudo *)",
      "Bash(chmod *)",
      "Bash(chown *)",
      "Bash(kill *)",
      "Bash(pkill *)",
      "Bash(npm publish *)",
      "Bash(pnpm publish *)",
      "Bash(yarn publish *)"
    ]
  },
  "enableAllProjectMcpServers": false,
  "enabledMcpjsonServers": ["code-review-graph", "playwright"],
  "prefersReducedMotion": true
}