Claude Settings Audit
Analyze this repository and generate recommended Claude Code settings.json permissions for read-only commands.
When to Use
- You are setting up or auditing Claude Code
settings.json permissions for a repository.
- You need to infer a safe read-only allow list from the repo's tech stack, tooling, and monorepo structure.
- You want to review or replace an existing Claude permissions baseline with something evidence-based.
Phase 1: Detect Tech Stack
Run these commands to detect the repository structure:
ls -la
find . -maxdepth 2 \( -name "*.toml" -o -name "*.json" -o -name "*.lock" -o -name "*.yaml" -o -name "*.yml" -o -name "Makefile" -o -name "Dockerfile" -o -name "*.tf" \) 2>/dev/null | head -50
Check for these indicator files:
| Category |
Files to Check |
| Python |
pyproject.toml, setup.py, requirements.txt, Pipfile, poetry.lock, uv.lock |
| Node.js |
package.json, package-lock.json, yarn.lock, pnpm-lock.yaml |
| Go |
go.mod, go.sum |
| Rust |
Cargo.toml, Cargo.lock |
| Ruby |
Gemfile, Gemfile.lock |
| Java |
pom.xml, build.gradle, build.gradle.kts |
| Build |
Makefile, Dockerfile, docker-compose.yml |
| Infra |
*.tf files, kubernetes/, helm/ |
| Monorepo |
lerna.json, nx.json, turbo.json, pnpm-workspace.yaml |
Phase 2: Detect Services
Check for service integrations:
| Service |
Detection |
| Sentry |
sentry-sdk in deps, @sentry/* packages, .sentryclirc, sentry.properties |
| Linear |
Linear config files, .linear/ directory |
Read dependency files to identify frameworks:
package.json → check dependencies and devDependenciespyproject.toml → check [project.dependencies] or [tool.poetry.dependencies]Gemfile → check gem namesCargo.toml → check [dependencies]
Phase 3: Check Existing Settings
cat .claude/settings.json 2>/dev/null || echo "No existing settings"
Phase 4: Generate Recommendations
Build the allow list by combining:
Baseline Commands (Always Include)
[
"Bash(ls:*)",
"Bash(pwd:*)",
"Bash(find:*)",
"Bash(file:*)",
"Bash(stat:*)",
"Bash(wc:*)",
"Bash(head:*)",
"Bash(tail:*)",
"Bash(cat:*)",
"Bash(tree:*)",
"Bash(git status:*)",
"Bash(git log:*)",
"Bash(git diff:*)",
"Bash(git show:*)",
"Bash(git branch:*)",
"Bash(git remote:*)",
"Bash(git tag:*)",
"Bash(git stash list:*)",
"Bash(git rev-parse:*)",
"Bash(gh pr view:*)",
"Bash(gh pr list:*)",
"Bash(gh pr checks:*)",
"Bash(gh pr diff:*)",
"Bash(gh issue view:*)",
"Bash(gh issue list:*)",
"Bash(gh run view:*)",
"Bash(gh run list:*)",
"Bash(gh run logs:*)",
"Bash(gh repo view:*)",
"Bash(gh api:*)"
]
Stack-Specific Commands
Only include commands for tools actually detected in the project.
Python (if any Python files or config detected)
| If Detected |
Add These Commands |
| Any Python |
python --version, python3 --version |
poetry.lock |
poetry show, poetry env info |
uv.lock |
uv pip list, uv tree |
Pipfile.lock |
pipenv graph |
requirements.txt (no other lock) |
pip list, pip show, pip freeze |
Node.js (if package.json detected)
| If Detected |
Add These Commands |
| Any Node.js |
node --version |
pnpm-lock.yaml |
pnpm list, pnpm why |
yarn.lock |
yarn list, yarn info, yarn why |
package-lock.json |
npm list, npm view, npm outdated |
TypeScript (tsconfig.json) |
tsc --version |
Other Languages
| If Detected |
Add These Commands |
1---2name: claude-settings-audit3description: Analyze a repository to generate recommended Claude Code settings.json permissions. Use when setting up a new project, auditing existing settings, or determining which read-only bash commands to allow4---567# Claude Settings Audit89Analyze this repository and generate recommended Claude Code `settings.json` permissions for read-only commands.1011## When to Use12- You are setting up or auditing Claude Code `settings.json` permissions for a repository.13- You need to infer a safe read-only allow list from the repo's tech stack, tooling, and monorepo structure.14- You want to review or replace an existing Claude permissions baseline with something evidence-based.1516## Phase 1: Detect Tech Stack1718Run these commands to detect the repository structure:1920```bash21ls -la22find . -maxdepth 2 \( -name "*.toml" -o -name "*.json" -o -name "*.lock" -o -name "*.yaml" -o -name "*.yml" -o -name "Makefile" -o -name "Dockerfile" -o -name "*.tf" \) 2>/dev/null | head -5023```2425Check for these indicator files:2627| Category | Files to Check |28| ------------ | ------------------------------------------------------------------------------------- |29| **Python** | `pyproject.toml`, `setup.py`, `requirements.txt`, `Pipfile`, `poetry.lock`, `uv.lock` |30| **Node.js** | `package.json`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml` |31| **Go** | `go.mod`, `go.sum` |32| **Rust** | `Cargo.toml`, `Cargo.lock` |33| **Ruby** | `Gemfile`, `Gemfile.lock` |34| **Java** | `pom.xml`, `build.gradle`, `build.gradle.kts` |35| **Build** | `Makefile`, `Dockerfile`, `docker-compose.yml` |36| **Infra** | `*.tf` files, `kubernetes/`, `helm/` |37| **Monorepo** | `lerna.json`, `nx.json`, `turbo.json`, `pnpm-workspace.yaml` |3839## Phase 2: Detect Services4041Check for service integrations:4243| Service | Detection |44| ---------- | ------------------------------------------------------------------------------- |45| **Sentry** | `sentry-sdk` in deps, `@sentry/*` packages, `.sentryclirc`, `sentry.properties` |46| **Linear** | Linear config files, `.linear/` directory |4748Read dependency files to identify frameworks:4950- `package.json` → check `dependencies` and `devDependencies`51- `pyproject.toml` → check `[project.dependencies]` or `[tool.poetry.dependencies]`52- `Gemfile` → check gem names53- `Cargo.toml` → check `[dependencies]`5455## Phase 3: Check Existing Settings5657```bash58cat .claude/settings.json 2>/dev/null || echo "No existing settings"59```6061## Phase 4: Generate Recommendations6263Build the allow list by combining:6465### Baseline Commands (Always Include)6667```json68[69 "Bash(ls:*)",70 "Bash(pwd:*)",71 "Bash(find:*)",72 "Bash(file:*)",73 "Bash(stat:*)",74 "Bash(wc:*)",75 "Bash(head:*)",76 "Bash(tail:*)",77 "Bash(cat:*)",78 "Bash(tree:*)",79 "Bash(git status:*)",80 "Bash(git log:*)",81 "Bash(git diff:*)",82 "Bash(git show:*)",83 "Bash(git branch:*)",84 "Bash(git remote:*)",85 "Bash(git tag:*)",86 "Bash(git stash list:*)",87 "Bash(git rev-parse:*)",88 "Bash(gh pr view:*)",89 "Bash(gh pr list:*)",90 "Bash(gh pr checks:*)",91 "Bash(gh pr diff:*)",92 "Bash(gh issue view:*)",93 "Bash(gh issue list:*)",94 "Bash(gh run view:*)",95 "Bash(gh run list:*)",96 "Bash(gh run logs:*)",97 "Bash(gh repo view:*)",98 "Bash(gh api:*)"99]100```101102### Stack-Specific Commands103104Only include commands for tools actually detected in the project.105106#### Python (if any Python files or config detected)107108| If Detected | Add These Commands |109| ---------------------------------- | --------------------------------------- |110| Any Python | `python --version`, `python3 --version` |111| `poetry.lock` | `poetry show`, `poetry env info` |112| `uv.lock` | `uv pip list`, `uv tree` |113| `Pipfile.lock` | `pipenv graph` |114| `requirements.txt` (no other lock) | `pip list`, `pip show`, `pip freeze` |115116#### Node.js (if package.json detected)117118| If Detected | Add These Commands |119| ---------------------------- | -------------------------------------- |120| Any Node.js | `node --version` |121| `pnpm-lock.yaml` | `pnpm list`, `pnpm why` |122| `yarn.lock` | `yarn list`, `yarn info`, `yarn why` |123| `package-lock.json` | `npm list`, `npm view`, `npm outdated` |124| TypeScript (`tsconfig.json`) | `tsc --version` |125126#### Other Languages127128| If Detected | Add These Commands |129| -------------- | -------------------
sickn33