Where do I put the Claude Code settings.json file?

For one project and the people who work on it, save it as .claude/settings.json inside the project and commit it. For yourself in one project, save it as .claude/settings.local.json instead. For every project on your computer, save it as ~/.claude/settings.json. Then start Claude Code and run /status to see which files it loaded.

How do I stop Claude Code reading my .env file?

Add Read(./.env) and Read(./.env.*) to permissions.deny. A Read deny rule also blocks Claude's Edit and Write tools on those paths. It does not stop a script that opens the file itself, so for a hard limit turn on Claude Code's sandbox as well.

How do I let Claude Code run my tests without asking?

Add a Bash allow rule for the test command, such as Bash(npm test *). The space and * at the end match the command with or without more arguments. Keep the rule to the command itself: Bash(npm *) would also allow npm install and every script in the project.

Why does my project's allow rule not take effect?

Allow rules in a project's .claude/settings.json wait until you trust the folder, which Claude Code asks the first time you start it there. Ask and deny rules apply at once. Run /permissions to see every rule in force and the file it came from.

Which permission mode should Claude Code start in?

Leave it unset to start in auto mode, Claude Code's default since version 2.1.283, where a second model checks each action before it runs. Choose Manual to approve each edit and command yourself, Accept edits to let Claude change files freely while commands still ask, or Plan to have it read and plan before it changes anything. A project file cannot start sessions in auto or bypassPermissions mode.

How do I add an MCP server with an API key safely?

Write the name of a variable in place of the key, as the builder does with GITHUB_PAT, and set that variable in your shell. Claude Code fills it in each time it starts the server, from .mcp.json or from a server added with claude mcp add, so the key is never saved in a file you share.

Build your Claude Code settings.json

Choose what Claude may do without asking, what it must ask first and what it may never touch. Add a hook or 2 and the MCP servers you use, and copy the files: settings.json, .mcp.json or the commands to add the servers, and a CLAUDE.md to start from. Every key follows Anthropic's documentation.

Build your settings Questions

Where the settings go

Your project

No mode is set, so Claude Code starts in auto mode, its default since v2.1.283: a second model checks each action before it runs.

What Claude may do

Runs without asking

Claude runs these at once.

Asks you first

Claude stops and asks, in every mode.

Never

Claude Code refuses these, in every mode.

Hooks

MCP servers

Your files

Save as .claude/settings.json

{
  "$schema": "https://json.schemastore.org/claude-code-settings.json",
  "permissions": {
    "allow": [
      "Bash(npm test *)",
      "Bash(npm run lint *)",
      "Bash(npm run build *)",
      "Bash(git commit *)"
    ],
    "ask": [
      "Bash(npm install *)",
      "Bash(git push *)"
    ],
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)"
    ]
  },
  "hooks": {
    "Notification": [
      {
        "matcher": "",
        "hooks": [
          {
            "type": "command",
            "command": "osascript -e 'display notification \"Claude Code needs your attention\" with title \"Claude Code\"'"
          }
        ]
      }
    ]
  }
}

Commit .claude/settings.json so everyone who clones the project gets the same rules. Its allow rules wait until each person trusts the folder; its ask and deny rules apply at once.
A Read rule also stops Claude's Edit and Write tools on those paths, but not a script that opens the files itself. For a hard limit, turn on the sandbox.
In auto mode your deny and ask rules still apply, and narrow allow rules such as these still let a command run at once. Broad ones, such as all of Bash, are set aside while auto mode is on.
Start Claude Code in the project and run /status to see which settings files loaded, or /permissions to see every rule.

How the builder puts your files together

Claude Code reads its settings from JSON files at 3 levels: ~/.claude/settings.json for you in every project, .claude/settings.json for everyone in one project, and .claude/settings.local.json for you alone in one project. The more specific file wins, but lists such as permission rules are added together from every file. The builder writes the file you choose, with the $schema line that gives your editor completion and checks as you type.

Each action you place becomes a permission rule. A rule names a tool and, in brackets, what it may do: Bash(npm test *) is any command that starts with npm test. Deny rules win over ask rules, and ask rules over allow rules, in every mode. The builder writes a rule for each project's own test, lint and build commands, so it never allows a whole program such as npm or git.

Hooks are shell commands Claude Code runs at fixed points in a session. The notification hook runs when Claude is waiting for you. The format hook runs after Claude edits or writes a file, reads the file's path from the JSON it is given with jq, and formats only the file types your formatter takes. The compaction hook runs when a long session is summarized, and prints your recent commits so Claude keeps them in view.

MCP servers for the whole team go in .mcp.json at the project's root, which everyone commits and approves once. For you alone, the builder writes claude mcp add commands instead. Tokens are never written into either: each server reads them from a variable in your shell when Claude Code starts.

Every combination of choices the builder can make was checked against the published JSON schema for Claude Code settings. Nothing you choose is sent anywhere; the files are built in your browser.

Questions

Where do I put the Claude Code settings.json file?: For one project and the people who work on it, save it as .claude/settings.json inside the project and commit it. For yourself in one project, save it as .claude/settings.local.json instead. For every project on your computer, save it as ~/.claude/settings.json. Then start Claude Code and run /status to see which files it loaded.
How do I stop Claude Code reading my .env file?: Add Read(./.env) and Read(./.env.*) to permissions.deny. A Read deny rule also blocks Claude's Edit and Write tools on those paths. It does not stop a script that opens the file itself, so for a hard limit turn on Claude Code's sandbox as well.
How do I let Claude Code run my tests without asking?: Add a Bash allow rule for the test command, such as Bash(npm test *). The space and * at the end match the command with or without more arguments. Keep the rule to the command itself: Bash(npm *) would also allow npm install and every script in the project.
Why does my project's allow rule not take effect?: Allow rules in a project's .claude/settings.json wait until you trust the folder, which Claude Code asks the first time you start it there. Ask and deny rules apply at once. Run /permissions to see every rule in force and the file it came from.
Which permission mode should Claude Code start in?: Leave it unset to start in auto mode, Claude Code's default since version 2.1.283, where a second model checks each action before it runs. Choose Manual to approve each edit and command yourself, Accept edits to let Claude change files freely while commands still ask, or Plan to have it read and plan before it changes anything. A project file cannot start sessions in auto or bypassPermissions mode.
How do I add an MCP server with an API key safely?: Write the name of a variable in place of the key, as the builder does with GITHUB_PAT, and set that variable in your shell. Claude Code fills it in each time it starts the server, from .mcp.json or from a server added with claude mcp add, so the key is never saved in a file you share.

Put this calculator on your own site

Copy the code into any web page: a blog post, a course page or your team's wiki. The calculator runs in a frame and shows the same figures as this page, so when the prices change here they change on your page too. It is free and needs no account, and nothing a reader types is sent anywhere.

The code opens the calculator with the settings you have chosen above.

The short script at the end lets the frame grow and shrink with the calculator. Where a page cannot take scripts, choose a fixed height and the frame scrolls.

<iframe src="https://tecyfy.com/embed/settings-builder" title="Claude Code settings builder" width="100%" height="3000" style="border:0;display:block" loading="lazy" allow="clipboard-write"></iframe>
<p><a href="https://tecyfy.com/coding-agents/claude-code/settings-builder">Claude Code settings builder</a> by Tecyfy</p>
<script>addEventListener("message",function(e){if(e.origin!=="https://tecyfy.com"||!e.data||e.data.type!=="tecyfy:height")return;var h=Number(e.data.height);if(!(h>0))return;document.querySelectorAll("iframe").forEach(function(f){if(f.contentWindow===e.source)f.style.height=Math.min(h,20000)+"px"})})</script>

Sources

The Claude Code settings builder

How the builder puts your files together

Questions

Put this calculator on your own site

Where each fact comes from