Claude Settings Audit

Analyze this repository and generate recommended Claude Code settings.json permissions for read-only commands.

When to Use

• You are setting up or auditing Claude Code settings.json permissions for a repository.
• You need to infer a safe read-only allow list from the repo's tech stack, tooling, and monorepo structure.
• You want to review or replace an existing Claude permissions baseline with something evidence-based.

The broad prefixes in legacy examples are not a read-only sandbox: find can execute/delete, gh api can POST/PATCH/DELETE, and git branch/remote/tag have mutating forms. Recommend narrow reviewed commands or purpose-built read tools; never auto-allow arbitrary arguments merely because a command is usually observational. Build tools (make -n, Gradle, Maven, package managers) may evaluate project code or download/write caches. Redact settings/MCP secret values before displaying them, preserve existing deny/ask rules, and produce a proposal rather than silently installing permissions or servers. Skill invocation permissions can authorize mutating workflows and are not read-only by name.

Phase 1: Detect Tech Stack

Run these commands to detect the repository structure:

ls -la
find . -maxdepth 2 \( -name "*.toml" -o -name "*.json" -o -name "*.lock" -o -name "*.yaml" -o -name "*.yml" -o -name "Makefile" -o -name "Dockerfile" -o -name "*.tf" \) 2>/dev/null | head -50