# Claude Code --dangerously-skip-permissions, done safely

URL: https://agentvera.dev/en/blog/claude-code-skip-permissions/ · Published: 2026-10-22

What Claude Code’s --dangerously-skip-permissions flag skips, what still stops it, the real risks, and safer ways to cut prompts: modes, allow rules, sandboxes.

**In short:**

- --dangerously-skip-permissions starts Claude Code in bypassPermissions mode; deny rules, explicit ask rules, Claude’s own questions and removal of critical paths still stop it.
- Anthropic’s docs say to use it only in isolated containers or VMs, because it offers no protection against prompt injection or unintended actions.
- Allow and deny rules in settings.json, auto mode with its safety classifier and the Bash sandbox remove most prompts while keeping the guardrails.

`--dangerously-skip-permissions` starts Claude Code in `bypassPermissions` mode, so tool calls run without asking you first. It is the fastest way to stop the prompts, and also the riskiest. Anthropic’s own docs say to use it only in isolated environments such as containers or VMs. Usually you don’t need it. A few allow rules, auto mode or a sandbox remove most prompts and keep the guardrails.

This post covers what the flag skips, what it doesn’t, where it goes wrong, and the safer options. At the end it shows how AgentVera handles the same problem when several agents run at once.

## What the flag actually does

Claude Code has permission modes. The flag is a shortcut for one of them:

```bash
claude --dangerously-skip-permissions
# same as
claude --permission-mode bypassPermissions
```

In this mode Claude edits files, runs shell commands and calls tools without stopping. According to the [permission modes docs](https://code.claude.com/docs/en/permission-modes "Claude Code permission modes"), a few things still stop it:

- **Deny rules.** A deny rule in your settings blocks a tool in every mode, bypass included.
- **Explicit ask rules.** If you wrote an `ask` rule, it still asks.
- **Questions Claude asks you.** Claude can still pause to ask a question.
- **Removing critical paths.** `rm` or `rmdir` on the filesystem root, top-level folders, your home folder or the working directory and its parents still prompts.

Allow rules have no effect in bypass mode, because everything is already allowed. Writes to protected paths like `.git` and `.claude` are also allowed.

A few more details matter in practice:

- The first time you use it interactively, Claude Code shows a warning dialog. Accepting it writes `skipDangerousModePermissionPrompt: true` to `~/.claude/settings.json`.
- In a non-interactive run (`claude -p`) there is no dialog.
- On Linux and macOS the flag refuses to run as root or with sudo. The check is skipped inside a recognized sandbox.
- You can’t switch into bypass from a session that didn’t start with it. `--allow-dangerously-skip-permissions` adds the mode to the Shift+Tab cycle without turning it on.
- Admins can turn the mode off for everyone with `permissions.disableBypassPermissionsMode: "disable"` in managed settings.

## The risks

The docs put it plainly: bypass mode “offers no protection against prompt injection or unintended actions.” Here is what that means day to day.

### Prompt injection

Claude reads files, web pages, issue text and tool output. If any of that contains instructions, the model might follow them. With prompts on, you see the odd `curl` to an unknown host before it runs. In bypass mode you find out afterwards.

### Destructive commands that aren’t on the critical list

The critical-path check covers `rm` of your home folder or project root. It does not cover `git reset --hard`, `git clean -fd`, a dropped database table, a force push or a migration run against the wrong environment. All of those run without a prompt.

### Secrets and the rest of your machine

On your laptop, Claude runs as you. It can read your SSH keys, cloud credentials and `.env` files, and it can reach the network. A mistake or an injected instruction has your whole account to work with.

### Checkpoints don’t cover everything

Claude Code takes a checkpoint before each prompt, and `/rewind` (or Esc twice) restores code, the conversation, or both. But the [checkpointing docs](https://code.claude.com/docs/en/checkpointing "Claude Code checkpointing") say changes made by Bash commands such as `rm`, `mv` and `cp` are not tracked, and neither are changes outside the session. Rewind is not a replacement for git.

## Safer ways to cut permission prompts

Most people reach for the flag because the prompts are slowing them down. These options deal with the prompts and keep the guardrails.

### 1. Pick the right permission mode

| Mode | Runs without asking | Good for |
| --- | --- | --- |
| `default` (Manual) | Reads only | Unfamiliar code, sensitive repos |
| `acceptEdits` | Reads, file edits, common file commands like `mkdir`, `mv`, `cp` | Day-to-day coding where you review the diff |
| `plan` | Reads only, no source edits | Exploring and planning before a change |
| `auto` | Everything, with a classifier checking each action first | Long tasks where you trust the direction |
| `dontAsk` | Only pre-approved tools; everything else is denied | CI and scripts |
| `bypassPermissions` | Everything except the cases above | Isolated containers and VMs only |

Shift+Tab cycles through modes in a session. `--permission-mode` picks one at start, and `permissions.defaultMode` in settings sets your default.

**Auto mode** is the middle ground most people want. A classifier model reviews each action before it runs. It blocks actions that go beyond your request, target infrastructure it doesn’t recognize, or look driven by hostile content. If it blocks three times in a row or 20 times in total, auto mode pauses and normal prompts come back. Two limits apply: it needs a supported model, and the docs say it “reduces permission prompts but does not guarantee safety.” Recent Claude Code versions start interactive sessions in auto mode by default. Check `/permissions` to see which mode you’re in.

### 2. Write allow and deny rules

Permission rules live in `settings.json` and are enforced by Claude Code, not by the model. They are checked in order: deny, then ask, then allow. The first match wins, so an allow rule can never override a deny.

```json
{
  "permissions": {
    "allow": ["Bash(npm run test *)", "Bash(npm run lint)", "Bash(git diff *)"],
    "ask": ["Bash(git commit *)"],
    "deny": ["Bash(git push *)", "Read(./.env)"]
  }
}
```

Use `/permissions` to see and edit rules in a session. Allow the commands you run fifty times a day, like tests, lint and read-only git. Deny the ones you never want an agent to run. CLAUDE.md is guidance for the model. It doesn’t change permissions.

For scripts, `dontAsk` plus a short allow list is stricter than bypass:

```bash
claude -p "run the test suite and fix failures" \
  --permission-mode dontAsk --allowedTools "Bash(npm test)" "Read" "Edit"
```

### 3. Turn on the Bash sandbox

The [sandboxing docs](https://code.claude.com/docs/en/sandboxing "Claude Code sandboxing") describe an OS-level sandbox that limits which files and network domains shell commands can reach. Turn it on with `/sandbox` or `sandbox.enabled: true`. It works on macOS, Linux and WSL2. It applies to shell commands only. File tools, MCP servers and hooks run outside it.

### 4. If you skip permissions, isolate first

Sometimes bypass is the right call, like a long unattended run on throwaway code. Then follow the docs’ setup: a container, VM or dev container, a non-root user, no secrets mounted and ideally no internet access. The common unattended form is:

```bash
claude -p "<task>" --dangerously-skip-permissions
```

Run it inside the container, not on your laptop.

### 5. Work in a worktree and commit often

A [git worktree](/en/blog/git-worktree-parallel-agents/ "Git worktrees for parallel agents") gives the agent its own folder and branch. If it wrecks the branch, you delete the worktree and main never knew. Frequent commits give you restore points that also cover what Bash changed, which checkpoints can’t.

## A quick decision table

| Situation | What to use |
| --- | --- |
| You keep approving the same test and lint commands | Allow rules |
| You want fewer prompts but still want a safety check | Auto mode |
| CI job or script with a known set of tools | `dontAsk` plus `--allowedTools` |
| Shell commands should not touch the network or your home folder | Bash sandbox |
| Long unattended run on disposable code | Bypass inside a container, as non-root |
| Production credentials on the machine | Never bypass |

## How AgentVera handles this

When you run several agents, the prompts multiply. Five agents means five places that can be waiting for a yes. AgentVera gives you the same options per agent, plus ways to answer prompts from anywhere.

### A permission level for each agent

In the agent dialog and the model picker there is a **Permissions** field with three options:

- **Ask**: the CLI asks as usual.
- **Auto**: the CLI’s own auto mode. Edits and safe commands go ahead, risky ones still stop. For Claude Code this starts the agent with `--permission-mode auto`.
- **Full access**: never asks. For Claude Code this is `--dangerously-skip-permissions`. The app’s hint says it plainly: “Best in a worktree or container”.

The agent header shows a badge such as “Permissions: Auto”. Codex and other CLIs get their own equivalents. Changing the level relaunches the agent, and the conversation carries on. If a team policy caps approvals, agents keep asking.

### Auto-approve safe requests (Pro and Team)

[Auto approval](/en/features/auto-approval/ "Auto approval") is a middle path for Claude Code agents. With **Auto-approve safe requests** on, AgentVera answers only the requests Claude would have asked about anyway, and only safe ones:

- read tools such as Read, Glob, Grep and LS,
- read-only shell and git commands,
- test, lint, typecheck and build commands for npm, pnpm, yarn, bun, pytest, cargo, go and more.

Commands with `>`, `$()` or backticks are never auto-approved. Your own Claude allow and deny rules still apply. **Also approve file edits inside the project** is off by default. When on, it covers edits inside the project or worktree and never touches `.git` or `.env`. The **Never auto-approve** list starts with `git push`, `npm publish`, `rm`, `git reset --hard` and `git clean`, and you can add your own. **Recent auto-approvals** shows what went through in the current session.

The switch is on by default but only takes effect on Pro and Team. On the free plan, requests still come to you.

### Answer prompts from your desk, phone or Telegram

The prompts that remain come to you wherever you are. On the desktop there is an approval queue in the status bar, ⇧⌘A jumps to the agent that has waited longest, and the Dock shows a badge. If you leave an approval waiting, a reminder comes after five minutes. See [notifications and approvals](/en/features/notifications-and-approvals/ "Notifications and approvals").

Away from the desk:

- [Telegram](/en/features/telegram-control/ "Telegram control") sends approval requests with Approve and Deny buttons.
- The [phone view](/en/features/review-from-phone/ "Review from phone") at app.agentvera.dev shows approvals with Approve and Reject.
- The [mobile app](/en/blog/claude-code-mobile-app/ "Claude Code mobile app") sends push notifications for them.

Since answering a prompt takes seconds, you have less reason to reach for Full access.

### Docker agents for real isolation

For runs where you do want Full access, start the agent with **Run in a Docker container**. It works for local Claude Code and Codex agents, and it’s on every plan. See [agents in Docker](/en/features/agents-in-docker/ "Agents in Docker").

- The container sees only the project folder, not your SSH keys or the rest of your computer.
- When the agent stops, the container is removed. Only changes in the project folder remain.
- You can set CPU and memory limits.
- Hooks and MCP keep working.

It needs Docker Desktop, Colima or OrbStack. This is the isolated environment the Claude Code docs ask for, without writing a Dockerfile yourself.

### Checkpoints for every turn

AgentVera’s [checkpoints](/en/features/checkpoints-and-replay/ "Checkpoints and replay") snapshot the working folder to a hidden git ref at the start of each turn, keeping the last 60 turns per agent. Because they snapshot the folder itself, they also catch files a shell command changed. You can see which files a turn touched, undo the turn, and undo the undo. Your branches, index and stash are left alone.

## Checklist before you skip permissions

- [ ] Could allow rules or auto mode remove the prompts instead?
- [ ] Is the agent in a container or VM, not on your main machine?
- [ ] Is it running as a non-root user?
- [ ] Are secrets, SSH keys and production credentials out of reach?
- [ ] Is network access limited or off?
- [ ] Is the work on its own branch or worktree, with a recent commit to go back to?
- [ ] Do deny rules cover `git push` and anything else you never want?

## Wrapping up

`--dangerously-skip-permissions` is a real tool with a narrow use: disposable, isolated environments. For everyday work, allow and deny rules, auto mode and the sandbox remove most prompts and keep control in your hands. If you run many agents, give each one the level it needs. Let safe requests pass on their own, answer the rest from your phone, and put the agents that need Full access in a container.

Read more:

- [Auto approval](/en/features/auto-approval/ "Auto approval")
- [Agents in Docker](/en/features/agents-in-docker/ "Agents in Docker")
- [Checkpoints and replay](/en/features/checkpoints-and-replay/ "Checkpoints and replay")
- [Run multiple Claude Code agents](/en/blog/run-multiple-claude-code-agents/ "Run multiple Claude Code agents")
- [Claude Code agent](/en/agents/claude-code/ "Claude Code in AgentVera")

To try AgentVera, start at the [home page](/en/ "AgentVera").

## Frequently asked questions

**What does --dangerously-skip-permissions do in Claude Code?** It starts the session in bypassPermissions mode, the same as --permission-mode bypassPermissions. Tool calls run without a prompt, except explicit ask rules, deny rules, questions Claude asks you, and removals of critical paths such as your home folder.

**Is it safe to use --dangerously-skip-permissions?** Only in an isolated environment. Anthropic’s docs say to use it in containers, VMs or dev containers without internet access, and note that it offers no protection against prompt injection or unintended actions.

**Why does Claude Code refuse to skip permissions as root?** On Linux and macOS the flag refuses to run with root or sudo privileges, for security reasons. The check is skipped inside a recognized sandbox. Run Claude Code as a normal user, or as a non-root user inside a container.

**What is a safer alternative to skipping permissions?** Allow rules in settings.json for the commands you trust, deny rules for the ones you never want, auto mode with its safety classifier, and the Bash sandbox. Together they remove most prompts without giving up control.

**How does AgentVera handle permissions for Claude Code?** Each agent has a Permissions setting: Ask, Auto or Full access. On Pro and Team, Auto-approve safe requests answers read-only and test commands for you. Agents can also run in a Docker container, and every turn gets a checkpoint you can undo.

---

**About AgentVera.** AgentVera is a desktop app for macOS, Windows and Linux, built by Solviera Teknoloji. It runs 18 AI coding agents (Claude Code, Codex, Gemini CLI, Copilot, Cursor, Antigravity, opencode, Hermes, Qwen Code, Kimi Code, Kiro, Amp, Droid, Goose, Vibe, Crush, Aider, Cline) side by side, per project, in real terminals with the user's own CLI installs and logins. The free plan has unlimited agents. Download: https://agentvera.dev/en/download/ · Pricing: https://agentvera.dev/en/pricing/