Permission Analyzer

Generate permissions configuration based on actual tool usage from past sessions.

Workflow

Run the analysis script for the current project:

~/.claude/skills/permission-analyzer/scripts/analyze_permissions.py

Review the generated permissions output

Offer to merge into existing settings:

• If .claude/settings.json exists, merge the permissions section

• If not, create new file with generated config

• Preserve existing settings (model, env, etc.)

Script Output

The script outputs to stderr (summary) and stdout (JSON):

Analyzing: /path/to/project Sessions analyzed: 42

Bash commands found: git: 150 make: 80 go: 45

MCP tools found: mcp__devtools__think

{ "permissions": { "allow": ["Bash(git:)", "Bash(go:)", ...], "deny": [...], "defaultMode": "acceptEdits" } }

Generated Rules

Allow list includes:

• Development commands used (git, make, go, npm, cargo, etc.)

• Filesystem commands used (ls, mkdir, find, etc.)

• MCP server wildcards for servers that were used

Deny list includes:

• Dangerous gh operations (merge, delete, secrets, auth)

• Sensitive file patterns (.env, secrets/, *.pem, *.key)

• Destructive commands (rm -rf, sudo, chmod 777)

Merging Settings

When .claude/settings.json exists, merge only the permissions key while preserving other settings. If user has custom allow/deny rules, ask whether to merge or replace.