Claude Code Permission Rule

Matches Bash tool commands. Supports wildcard patterns with * at any position in the specifier.

• Bash — matches all Bash commands (equivalent to Bash(*))
• Bash(npm run build) — matches the exact command npm run build
• Bash(npm run *) — prefix match with word boundary (matches npm run test but not npm runtime)
• Bash(npm*) — prefix match without word boundary (matches both npm run and npmrc)
• Bash(* --version) — suffix match
• Bash(git * main) — middle wildcard (matches git checkout main, git merge main)

The space before * matters: Bash(ls *) enforces a word boundary requiring a space, while Bash(ls*) does not. The legacy :* suffix syntax (e.g. Bash(npm:*)) is equivalent to * but is deprecated — use Bash(npm *) instead. Claude Code is shell-operator aware — a rule like Bash(safe-cmd *) won't match safe-cmd && dangerous-cmd. See Bash permission caveats.

Matches Read tool operations. Read rules also apply best-effort to other built-in tools that read files, including Grep and Glob.

Specifiers use gitignore pattern syntax with four path types:

* matches files in a single directory; ** matches recursively across directories. Note: /Users/alice/file is relative to the project root — use //Users/alice/file for absolute paths. See Read and Edit rules.

Matches Edit tool operations. Edit rules apply to all built-in tools that modify files, including Write. Uses the same gitignore pattern syntax as Read with four path types (./, /, ~/, //).

• Edit — all file edits
• Edit(/src/**/*.ts) — TypeScript files under project src/
• Edit(/docs/**) — files in <project>/docs/ (NOT the filesystem /docs/ and NOT <project>/.claude/docs/)
• Edit(~/.config/**) — files in home config directory
• Edit(//tmp/scratch.txt) — absolute path

* matches files in a single directory; ** matches recursively across directories. See Read and Edit rules.

Matches Write tool operations. Edit rules also apply to Write since Edit covers all built-in tools that modify files. Uses the same gitignore pattern syntax as Read and Edit with four path types (./, /, ~/, //).

* matches files in a single directory; ** matches recursively across directories. See Read and Edit rules.

Matches WebFetch tool requests. Supports domain-based filtering with the domain: specifier prefix.

• WebFetch — all web fetch requests
• WebFetch(domain:example.com) — only requests to example.com

Note: Using WebFetch alone does not prevent network access. If Bash is allowed, Claude can still use curl, wget, or other tools to reach any URL. For reliable URL filtering, consider combining Bash deny rules with WebFetch domain rules. See WebFetch rules.

Matches WebSearch tool operations. No specifier support — applies to all web searches. See permission system.

Matches Glob tool operations for file pattern matching. Glob is a read-only tool — Read permission rules also apply to Glob on a best-effort basis. See permission system.

Matches Grep tool operations for content searching. Grep is a read-only tool — Read permission rules also apply to Grep on a best-effort basis. See permission system.

Matches Task (subagent) operations. Controls which subagents Claude can spawn.

• Task — all subagents
• Task(Explore) — the Explore subagent (read-only codebase exploration)
• Task(Plan) — the Plan subagent (implementation planning)
• Task(general-purpose) — the general-purpose subagent
• Task(my-custom-agent) — a custom subagent defined in .claude/agents/

Add to deny rules or use the --disallowedTools CLI flag to disable specific agents. See Task permission rules.

Matches NotebookEdit tool operations for editing Jupyter notebook (.ipynb) cells. See permission system.

Matches Skill tool invocations. Controls which skills Claude can trigger via the Skill tool.

• Skill — all skills
• Skill(commit) — the specific commit skill
• Skill(my-plugin:my-skill) — a namespaced plugin skill

Skills are invoked as /slash-commands by users or programmatically by other skills. See skills.

Matches MCP (Model Context Protocol) tool operations. MCP tools follow the naming pattern mcp__<server>__<tool> where <server> is the server name configured in Claude Code.

• mcp__puppeteer — all tools from the puppeteer server
• mcp__puppeteer__* — wildcard matching all tools from the puppeteer server
• mcp__puppeteer__puppeteer_navigate — the specific puppeteer_navigate tool

Server names come from MCP server configuration in .mcp.json, settings files, or plugin manifests. See MCP permission rules.