claude-settings-audit

You can generate read-only permissions for Claude Code by analyzing your repository's lockfiles and config files to produce a minimal settings.json allowlist of safe bash commands, skill access, and WebFetch domains.

A read-only allowlist for Claude Code is a scoped set of safe permissions in settings.json that prevents unsafe grants. You need it during new project setups, repository audits, and CI/PR reviews to ensure secure AI interactions.

To set up Claude Code permissions for a monorepo, the tool detects monorepo layouts, languages, and package managers from lockfiles to recommend a unified read-only bash command allowlist and appropriate skill access settings.

Yes, the audit detects services and frameworks like Sentry, Docker, and Terraform by checking configuration files, then includes the appropriate WebFetch domains and skill suggestions in the generated settings.json allowlist.

Yes, when an existing .claude/settings.json file is present, the audit provides specific merge instructions to safely integrate the newly detected read-only permissions without overwriting your current configuration.

The main limitation of automated settings.json generation is that it relies on detecting known lockfiles and config files, meaning custom or obscure infrastructure tools may be missed and require manual permission additions.