Claude Code settings.json: the one config file most developers ignore

Claude Code settings.json: the one config file most developers ignore When people talk about customizing Claude Code, they jump straight to CLAUDE.md. But there's another config file that deserves equal attention: .claude/settings.json. This file controls what Claude Code is actually allowed to do on your machine. Get it right and your agent works safely and predictably. Ignore it and you're running with default permissions that might surprise you. Here's a complete breakdown of what it does and my recommended setup. Where it lives your-project/ ├── .claude/ │ └── settings.json ← project-level (commit this) ├── ~/.claude/ │ └── settings.json ← user-level (applies everywhere) Project-level overrides user-level. Both are JSON. The structure { "permissions": { "allow": [], "deny": [] }, "env": {}, "includeCoAuthoredBy": true } Simple — but the permissions section is where the real power is. Permissions: allow and deny Permissions use a tool-name format: Bash, Read, Write, Edit, WebFetch,