Permission Analyzer
Generate permissions configuration based on actual tool usage from past sessions.
Workflow
Run the analysis script for the current project:
~/.claude/skills/permission-analyzer/scripts/analyze_permissions.py
Review the generated permissions output
Offer to merge into existing settings:
- If
.claude/settings.json exists, merge the permissions section
- If not, create new file with generated config
- Preserve existing settings (model, env, etc.)
Script Output
The script outputs to stderr (summary) and stdout (JSON):
Analyzing: /path/to/project
Sessions analyzed: 42
Bash commands found:
git: 150
make: 80
go: 45
MCP tools found:
mcp__devtools__think
{
"permissions": {
"allow": ["Bash(git:*)", "Bash(go:*)", ...],
"deny": [...],
"defaultMode": "acceptEdits"
}
}
Generated Rules
Allow list includes:
- Development commands used (git, make, go, npm, cargo, etc.)
- Filesystem commands used (ls, mkdir, find, etc.)
- MCP server wildcards for servers that were used
Deny list includes:
- Dangerous gh operations (merge, delete, secrets, auth)
- Sensitive file patterns (.env, secrets/, *.pem, *.key)
- Destructive commands (rm -rf, sudo, chmod 777)
Merging Settings
When .claude/settings.json exists, merge only the permissions key while preserving other settings. If user has custom allow/deny rules, ask whether to merge or replace.
1---2name: permission-analyzer3description: Generate Claude Code permissions config from session history. Use when setting up autonomous mode, configuring .claude/settings.json, avoiding --dangerously-skip-permissions, or analyzing what permissions a project needs. Reads session logs to extract Bash commands and MCP tools actually used, then generates appropriate allow/deny rules.4---5
6# Permission Analyzer
7
8Generate permissions configuration based on actual tool usage from past sessions.
9
10## Workflow
11
121. Run the analysis script for the current project:
13 ```bash
14 ~/.claude/skills/permission-analyzer/scripts/analyze_permissions.py
15 ```
16
172. Review the generated permissions output
18
193. Offer to merge into existing settings:
20 - If `.claude/settings.json` exists, merge the `permissions` section
21 - If not, create new file with generated config
22 - Preserve existing settings (model, env, etc.)
23
24## Script Output
25
26The script outputs to stderr (summary) and stdout (JSON):
27
28```
29Analyzing: /path/to/project
30Sessions analyzed: 42
31
32Bash commands found:
33 git: 150
34 make: 80
35 go: 45
36
37MCP tools found:
38 mcp__devtools__think
39
40{
41 "permissions": {
42 "allow": ["Bash(git:*)", "Bash(go:*)", ...],
43 "deny": [...],
44 "defaultMode": "acceptEdits"
45 }
46}
47```
48
49## Generated Rules
50
51**Allow list** includes:
52- Development commands used (git, make, go, npm, cargo, etc.)
53- Filesystem commands used (ls, mkdir, find, etc.)
54- MCP server wildcards for servers that were used
55
56**Deny list** includes:
57- Dangerous gh operations (merge, delete, secrets, auth)
58- Sensitive file patterns (.env, secrets/, *.pem, *.key)
59- Destructive commands (rm -rf, sudo, chmod 777)
60
61## Merging Settings
62
63When `.claude/settings.json` exists, merge only the `permissions` key while preserving other settings. If user has custom allow/deny rules, ask whether to merge or replace.
arjenschwarz