Claude Code configuration which blocks most telemetry by default and some other preferences and guardrails.

settings.json

{
  "cleanupPeriodDays": 30,
  "env": {
    "BASH_DEFAULT_TIMEOUT_MS": "60000",
    "BASH_MAX_OUTPUT_LENGTH": "20000",
    "CLAUDE_BASH_MAINTAIN_PROJECT_WORKING_DIR": "1",
    "CLAUDE_CODE_MAX_OUTPUT_TOKENS": "20000",
    "DISABLE_NON_ESSENTIAL_MODEL_CALLS": "1",
    "DISABLE_COST_WARNINGS": "1",
    "CLAUDE_CODE_ENABLE_TELEMETRY": "0",
    "DISABLE_TELEMETRY": "1",
    "DISABLE_ERROR_REPORTING": "1",
    "DISABLE_FEEDBACK_COMMAND": "1",
    "CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY": "1",
    "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": "1"
  },
  "permissions": {
    "allow": [
      "Bash(ls:*)",
      "Bash(ls -la:*)",
      "Bash(ls -l:*)",
      "Bash(ls -a:*)",
      "Bash(ls -lh:*)",
      "Bash(cat:*)",
      "Bash(cat -n:*)",
      "Bash(grep:*)",
      "Bash(grep -r:*)",
      "Bash(grep -i:*)",
      "Bash(grep -n:*)",
      "Bash(grep -E:*)",
      "Bash(grep -v:*)",
      "Bash(grep -A:*)",
      "Bash(wc:*)",
      "Bash(wc -l:*)",
      "Bash(python:*)",
      "Bash(python3:*)",
      "Bash(pip:*)",
      "Bash(pip3:*)",
      "Bash(python -m:*)",
      "Bash(python3 -m:*)",
      "Bash(uv python:*)",
      "Bash(uv python -m:*)",
      "Bash(venv/.bin/activate)",
      "Read(**)",
      "Edit(**)",
      "MultiEdit(**)",
      "Write(**)",
      "Glob(**)",
      "Grep(**)",
      "LS(**)",
      "WebFetch(domain:docs.anthropic.com)",
      "WebFetch(domain:localhost)",
      "WebFetch(domain:127.0.0.1)",
      "WebFetch(domain:github.com)",
      "WebFetch(domain:n8n.io)",
      "WebFetch(domain:*.nextsteptek.com)",
      "WebFetch(domain:gmktec-k9)",
      "WebFetch(domain:api.openai.com)",
      "WebFetch(domain:api.anthropic.com)",
      "WebSearch(claude ai)",
      "WebSearch(typescript tutorial)",
      "WebSearch(python documentation)",
      "TodoRead",
      "TodoWrite(**)",
      "Task(**)"
    ],
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(./secrets/**)",
      "Read(./config/credentials.json)",
      "Bash(rm -rf /*)",
      "Bash(rm -rf /)",
      "Bash(sudo rm -rf /*)",
      "Bash(sudo rm -rf /)",
      "Bash(dd if=/dev/zero of=/dev/*)",
      "Bash(dd if=/dev/random of=/dev/*)",
      "Bash(mkfs:*)",
      "Bash(fdisk:*)",
      "Bash(parted:*)",
      "Bash(> /dev/sda:*)",
      "Bash(> /dev/nvme:*)",
      "Bash(> /dev/sd:*)",
      "Bash(cat /dev/urandom > :*)",
      "Bash(:* | nc -l:*)",
      "Bash(:* | netcat -l:*)",
      "Bash(:* | socat:*)",
      "Bash(:* | base64 -d | sh:*)",
      "Bash(:* | base64 -d | bash:*)",
      "Read(.env*)",
      "Read(secrets/**)",
      "Read(*.key)",
      "Read(*.pem)",
      "Read(id_rsa*)",
      "Bash(history | grep -i password:*)",
      "Bash(history | grep -i token:*)",
      "Bash(history | grep -i secret:*)",
      "Bash(history | grep -i key:*)",
      "Bash(grep -r password /etc/*)",
      "Bash(grep -r token /etc/*)",
      "Bash(find / -name id_rsa:*)",
      "Bash(find / -name *.key:*)",
      "Bash(find / -name *.pem:*)",
      "Bash(sudo passwd:*)",
      "Bash(passwd:*)",
      "Bash(sudo useradd:*)",
      "Bash(sudo userdel:*)",
      "Bash(sudo usermod:*)",
      "Bash(sudo groupadd:*)",
      "Bash(sudo groupdel:*)",
      "Bash(sudo adduser:*)",
      "Bash(sudo deluser:*)",
      "Bash(sudo chmod 777 /*)",
      "Bash(sudo rm /etc/*)",
      "Bash(sudo rm -rf /etc/*)",
      "Bash(sudo rm /bin/*)",
      "Bash(sudo rm /usr/*)",
      "Bash(sudo > /etc/*)",
      "Bash(nc -l:*)",
      "Bash(netcat -l:*)",
      "Bash(socat:*)",
      "Bash(nmap:*)",
      "Bash(masscan:*)",
      "Bash(git push --force origin master:*)",
      "Bash(git push --force origin main:*)",
      "Bash(git push -f origin master:*)",
      "Bash(git push -f origin main:*)",
      "Bash(git reset --hard origin/master:*)",
      "Bash(git reset --hard origin/main:*)",
      "Bash(cat ~/.aws/*)",
      "Bash(cat ~/.ssh/id_*)",
      "Bash(cat /root/.ssh/*)",
      "Read(*.ssh/**)",
      "Bash(env | base64:*)",
      "Bash(printenv | base64:*)",
      "Bash(set | base64:*)",
      "Bash(shutdown:*)",
      "Bash(reboot:*)",
      "Bash(halt:*)",
      "Bash(poweroff:*)",
      "Bash(init 0:*)",
      "Bash(init 6:*)",
      "Bash(sudo shutdown:*)",
      "Bash(sudo reboot:*)",
      "Bash(sudo ufw disable:*)",
      "Bash(sudo iptables -F:*)",
      "Bash(sudo iptables --flush:*)",
      "Bash(sudo systemctl stop firewalld:*)",
      "Bash(sudo service iptables stop:*)",
      "Bash(rm /var/log/*)",
      "Bash(rm -rf /var/log/*)",
      "Bash(> /var/log/*)",
      "Bash(echo > /var/log/*)",
      "Bash(truncate -s 0 /var/log/*)",
      "Bash(find / -type f -delete:*)",
      "Bash(find / -type d -delete:*)",
      "Bash(rm -rf /home/*)",
      "Bash(rm -rf /var/*)",
      "Bash(rm -rf /opt/*)",
      "Bash(sudo -l:*)",
      "Bash(sudo -V:*)",
      "Bash(sudo su:*)",
      "Bash(sudo su -:*)",
      "Bash(sudo -i:*)",
      "Bash(pkexec:*)",
      "Bash(exec < /dev/tcp/*)",
      "Bash(exec > /dev/tcp/*)",
      "Bash(exec 3<>/dev/tcp/*)",
      "Read(*.csv)",
      "Read(*.tsv)",
      "Read(tmp/**)",
      "Read(backup/**)",
      "Read(dumps/**)",
      "Read(*.bak)",
      "Read(*.backup)"
    ]
  },
  "enabledPlugins": {
    "gopls-lsp@claude-plugins-official": false
  },
  "effortLevel": "low"
}