--dangerously-skip-permissions starts Claude Code in bypassPermissions mode, so tool calls run without asking you first. It is the fastest way to stop the prompts, and also the riskiest. Anthropic’s own docs say to use it only in isolated environments such as containers or VMs. Usually you don’t need it. A few allow rules, auto mode or a sandbox remove most prompts and keep the guardrails.
This post covers what the flag skips, what it doesn’t, where it goes wrong, and the safer options. At the end it shows how AgentVera handles the same problem when several agents run at once.
What the flag actually does
Claude Code has permission modes. The flag is a shortcut for one of them:
claude --dangerously-skip-permissions
# same as
claude --permission-mode bypassPermissionsIn this mode Claude edits files, runs shell commands and calls tools without stopping. According to the permission modes docs, a few things still stop it:
- Deny rules. A deny rule in your settings blocks a tool in every mode, bypass included.
- Explicit ask rules. If you wrote an
askrule, it still asks. - Questions Claude asks you. Claude can still pause to ask a question.
- Removing critical paths.
rmorrmdiron the filesystem root, top-level folders, your home folder or the working directory and its parents still prompts.
Allow rules have no effect in bypass mode, because everything is already allowed. Writes to protected paths like .git and .claude are also allowed.
A few more details matter in practice:
- The first time you use it interactively, Claude Code shows a warning dialog. Accepting it writes
skipDangerousModePermissionPrompt: trueto~/.claude/settings.json. - In a non-interactive run (
claude -p) there is no dialog. - On Linux and macOS the flag refuses to run as root or with sudo. The check is skipped inside a recognized sandbox.
- You can’t switch into bypass from a session that didn’t start with it.
--allow-dangerously-skip-permissionsadds the mode to the Shift+Tab cycle without turning it on. - Admins can turn the mode off for everyone with
permissions.disableBypassPermissionsMode: "disable"in managed settings.
The risks
The docs put it plainly: bypass mode “offers no protection against prompt injection or unintended actions.” Here is what that means day to day.
Prompt injection
Claude reads files, web pages, issue text and tool output. If any of that contains instructions, the model might follow them. With prompts on, you see the odd curl to an unknown host before it runs. In bypass mode you find out afterwards.
Destructive commands that aren’t on the critical list
The critical-path check covers rm of your home folder or project root. It does not cover git reset --hard, git clean -fd, a dropped database table, a force push or a migration run against the wrong environment. All of those run without a prompt.
Secrets and the rest of your machine
On your laptop, Claude runs as you. It can read your SSH keys, cloud credentials and .env files, and it can reach the network. A mistake or an injected instruction has your whole account to work with.
Checkpoints don’t cover everything
Claude Code takes a checkpoint before each prompt, and /rewind (or Esc twice) restores code, the conversation, or both. But the checkpointing docs say changes made by Bash commands such as rm, mv and cp are not tracked, and neither are changes outside the session. Rewind is not a replacement for git.
Safer ways to cut permission prompts
Most people reach for the flag because the prompts are slowing them down. These options deal with the prompts and keep the guardrails.
1. Pick the right permission mode
| Mode | Runs without asking | Good for |
|---|---|---|
default (Manual) | Reads only | Unfamiliar code, sensitive repos |
acceptEdits | Reads, file edits, common file commands like mkdir, mv, cp | Day-to-day coding where you review the diff |
plan | Reads only, no source edits | Exploring and planning before a change |
auto | Everything, with a classifier checking each action first | Long tasks where you trust the direction |
dontAsk | Only pre-approved tools; everything else is denied | CI and scripts |
bypassPermissions | Everything except the cases above | Isolated containers and VMs only |
Shift+Tab cycles through modes in a session. --permission-mode picks one at start, and permissions.defaultMode in settings sets your default.
Auto mode is the middle ground most people want. A classifier model reviews each action before it runs. It blocks actions that go beyond your request, target infrastructure it doesn’t recognize, or look driven by hostile content. If it blocks three times in a row or 20 times in total, auto mode pauses and normal prompts come back. Two limits apply: it needs a supported model, and the docs say it “reduces permission prompts but does not guarantee safety.” Recent Claude Code versions start interactive sessions in auto mode by default. Check /permissions to see which mode you’re in.
2. Write allow and deny rules
Permission rules live in settings.json and are enforced by Claude Code, not by the model. They are checked in order: deny, then ask, then allow. The first match wins, so an allow rule can never override a deny.
{
"permissions": {
"allow": ["Bash(npm run test *)", "Bash(npm run lint)", "Bash(git diff *)"],
"ask": ["Bash(git commit *)"],
"deny": ["Bash(git push *)", "Read(./.env)"]
}
}Use /permissions to see and edit rules in a session. Allow the commands you run fifty times a day, like tests, lint and read-only git. Deny the ones you never want an agent to run. CLAUDE.md is guidance for the model. It doesn’t change permissions.
For scripts, dontAsk plus a short allow list is stricter than bypass:
claude -p "run the test suite and fix failures" \
--permission-mode dontAsk --allowedTools "Bash(npm test)" "Read" "Edit"3. Turn on the Bash sandbox
The sandboxing docs describe an OS-level sandbox that limits which files and network domains shell commands can reach. Turn it on with /sandbox or sandbox.enabled: true. It works on macOS, Linux and WSL2. It applies to shell commands only. File tools, MCP servers and hooks run outside it.
4. If you skip permissions, isolate first
Sometimes bypass is the right call, like a long unattended run on throwaway code. Then follow the docs’ setup: a container, VM or dev container, a non-root user, no secrets mounted and ideally no internet access. The common unattended form is:
claude -p "<task>" --dangerously-skip-permissionsRun it inside the container, not on your laptop.
5. Work in a worktree and commit often
A git worktree gives the agent its own folder and branch. If it wrecks the branch, you delete the worktree and main never knew. Frequent commits give you restore points that also cover what Bash changed, which checkpoints can’t.
A quick decision table
| Situation | What to use |
|---|---|
| You keep approving the same test and lint commands | Allow rules |
| You want fewer prompts but still want a safety check | Auto mode |
| CI job or script with a known set of tools | dontAsk plus --allowedTools |
| Shell commands should not touch the network or your home folder | Bash sandbox |
| Long unattended run on disposable code | Bypass inside a container, as non-root |
| Production credentials on the machine | Never bypass |
How AgentVera handles this
When you run several agents, the prompts multiply. Five agents means five places that can be waiting for a yes. AgentVera gives you the same options per agent, plus ways to answer prompts from anywhere.
A permission level for each agent
In the agent dialog and the model picker there is a Permissions field with three options:
- Ask: the CLI asks as usual.
- Auto: the CLI’s own auto mode. Edits and safe commands go ahead, risky ones still stop. For Claude Code this starts the agent with
--permission-mode auto. - Full access: never asks. For Claude Code this is
--dangerously-skip-permissions. The app’s hint says it plainly: “Best in a worktree or container”.
The agent header shows a badge such as “Permissions: Auto”. Codex and other CLIs get their own equivalents. Changing the level relaunches the agent, and the conversation carries on. If a team policy caps approvals, agents keep asking.
Auto-approve safe requests (Pro and Team)
Auto approval is a middle path for Claude Code agents. With Auto-approve safe requests on, AgentVera answers only the requests Claude would have asked about anyway, and only safe ones:
- read tools such as Read, Glob, Grep and LS,
- read-only shell and git commands,
- test, lint, typecheck and build commands for npm, pnpm, yarn, bun, pytest, cargo, go and more.
Commands with >, $() or backticks are never auto-approved. Your own Claude allow and deny rules still apply. Also approve file edits inside the project is off by default. When on, it covers edits inside the project or worktree and never touches .git or .env. The Never auto-approve list starts with git push, npm publish, rm, git reset --hard and git clean, and you can add your own. Recent auto-approvals shows what went through in the current session.
The switch is on by default but only takes effect on Pro and Team. On the free plan, requests still come to you.
Answer prompts from your desk, phone or Telegram
The prompts that remain come to you wherever you are. On the desktop there is an approval queue in the status bar, ⇧⌘A jumps to the agent that has waited longest, and the Dock shows a badge. If you leave an approval waiting, a reminder comes after five minutes. See notifications and approvals.
Away from the desk:
- Telegram sends approval requests with Approve and Deny buttons.
- The phone view at app.agentvera.dev shows approvals with Approve and Reject.
- The mobile app sends push notifications for them.
Since answering a prompt takes seconds, you have less reason to reach for Full access.
Docker agents for real isolation
For runs where you do want Full access, start the agent with Run in a Docker container. It works for local Claude Code and Codex agents, and it’s on every plan. See agents in Docker.
- The container sees only the project folder, not your SSH keys or the rest of your computer.
- When the agent stops, the container is removed. Only changes in the project folder remain.
- You can set CPU and memory limits.
- Hooks and MCP keep working.
It needs Docker Desktop, Colima or OrbStack. This is the isolated environment the Claude Code docs ask for, without writing a Dockerfile yourself.
Checkpoints for every turn
AgentVera’s checkpoints snapshot the working folder to a hidden git ref at the start of each turn, keeping the last 60 turns per agent. Because they snapshot the folder itself, they also catch files a shell command changed. You can see which files a turn touched, undo the turn, and undo the undo. Your branches, index and stash are left alone.
Checklist before you skip permissions
- Could allow rules or auto mode remove the prompts instead?
- Is the agent in a container or VM, not on your main machine?
- Is it running as a non-root user?
- Are secrets, SSH keys and production credentials out of reach?
- Is network access limited or off?
- Is the work on its own branch or worktree, with a recent commit to go back to?
- Do deny rules cover
git pushand anything else you never want?
Wrapping up
--dangerously-skip-permissions is a real tool with a narrow use: disposable, isolated environments. For everyday work, allow and deny rules, auto mode and the sandbox remove most prompts and keep control in your hands. If you run many agents, give each one the level it needs. Let safe requests pass on their own, answer the rest from your phone, and put the agents that need Full access in a container.
Read more:
- Auto approval
- Agents in Docker
- Checkpoints and replay
- Run multiple Claude Code agents
- Claude Code agent
To try AgentVera, start at the home page.