Claude allow/deny settings with (mostly) read-only commands. Use at own risk!

settings.json

{
  "permissions": {
    "allow": [
      "Bash(aws * describe-*)",
      "Bash(aws * get-*)",
      "Bash(aws * list-*)",
      "Bash(aws pricing:*)",
      "Bash(az * list:*)",
      "Bash(az * show:*)",
      "Bash(az monitor diagnostic-settings list:*)",
      "Bash(az monitor diagnostic-settings show:*)",
      "Bash(az monitor log-analytics workspace list:*)",
      "Bash(az monitor log-analytics workspace show:*)",
      "Bash(az monitor log-analytics workspace table list:*)",
      "Bash(az monitor log-analytics workspace table show:*)",
      "Bash(az role assignment list:*)",
      "Bash(az role assignment show:*)",
      "Bash(cat:*)",
      "Bash(curl -sf http://localhost:*)",
      "Bash(diff:*)",
      "Bash(docker build:*)",
      "Bash(docker buildx:*)",
      "Bash(docker compose config:*)",
      "Bash(docker compose logs:*)",
      "Bash(docker pull:*)",
      "Bash(docker system:*)",
      "Bash(du:*)",
      "Bash(gcloud auth list:*)",
      "Bash(gcloud iam roles describe:*)",
      "Bash(gcloud iam roles list:*)",
      "Bash(gcloud identity groups memberships describe:*)",
      "Bash(gcloud identity groups memberships list:*)",
      "Bash(gcloud projects get*)",
      "Bash(gcloud services describe:*)",
      "Bash(gcloud services list:*)",
      "Bash(gh pr diff:*)",
      "Bash(gh pr list:*)",
      "Bash(gh pr view:*)",
      "Bash(gh release view:*)",
      "Bash(gh repo view:*)",
      "Bash(gh run:*)",
      "Bash(git add *)",
      "Bash(git diff:*)",
      "Bash(git fetch *)",
      "Bash(git log:*)",
      "Bash(git ls-remote:*)",
      "Bash(git merge *)",
      "Bash(git show:*)",
      "Bash(git stash *)",
      "Bash(git status:*)",
      "Bash(go build:*)",
      "Bash(go doc:*)",
      "Bash(go env *)",
      "Bash(go get:*)",
      "Bash(go list:*)",
      "Bash(go mod:*)",
      "Bash(go vet:*)",
      "Bash(golangci-lint:*)",
      "Bash(grep:*)",
      "Bash(hasura metadata:*)",
      "Bash(hasura migrate:*)",
      "Bash(head:*)",
      "Bash(ls:*)",
      "Bash(lsof:*)",
      "Bash(npm ci:*)",
      "Bash(npx eslint:*)",
      "Bash(npx tsc:*)",
      "Bash(ping:*)",
      "Bash(ps:*)",
      "Bash(pstree:*)",
      "Bash(pulumi package *)",
      "Bash(pulumi stack export:*)",
      "Bash(pulumi stack ls:*)",
      "Bash(pulumi stack output:*)",
      "Bash(rg:*)",
      "Bash(sort:*)",
      "Bash(tail:*)",
      "Bash(wc:*)",
      "Bash(which:*)",
      "Bash(xxd:*)",
      "mcp__defang__current_stack",
      "mcp__defang__list_stacks",
      "mcp__defang__logs",
      "mcp__defang__services",
      "WebSearch"
    ],
    "ask": [
      "Bash(find * -delete*)",
      "Bash(find * -exec *)",
      "Bash(find * -execdir *)"
    ]
  }
}