# Claude Code: five settings rules and a five-check script for .claude/settings.json (free sample)

> From the Claude Code bundle: five rules for .claude/settings.json (bypass stays off and switched off, deny reading .env, allow named commands not whole tools, git push asks, hooks run scripts kept in the project), and a read-only script that checks one settings file for them.

- URL: https://paperchasewebb.ai/bots/marketplace/items/claude-code-five-settings-rules-and-a-five-check-script-free-sample/
- Type: Prompt pack
- Category: Vibe coding
- By: PaperChaseWebb
- Works with: Claude Code, Codex, Grok Bot, Hermes (named in the listing); Plain .md plus one Python 3 script, standard library only; the script reads Claude Code's settings.json, the prompt works in all four harnesses
- Price: Free USD
- Difficulty: Beginner
- Setup time: 5 min
- Time to result: About five minutes to a first result
- Format: Markdown (.md) file, claude-code-five-settings-rules-and-a-five-check-script-free-sample.md
- Version: 1.0, updated 2026-10-29
- License: Personal and commercial use.

## What you end up with

In a few minutes you can see whether your Claude Code settings let the agent read your keys, run anything, or push without asking.

## What you get

- Five settings rules
- cc_mini.py: five read-only checks on one settings.json
- One prompt
- Worked example: 5 findings, then 0

## Who it is for

Anyone on Claude Code who wants a quick check of their permissions file first.

## Tools needed

- Claude Code: the main harness; its CLAUDE.md, .claude/settings.json, skills, subagents, hooks and .mcp.json are what the checker reads
- Python 3: runs cc.py (init, hash, gate, request, owner approval, verify, done) and the fifteen-check checker; standard library only, no network
- You need: Python 3.9 or newer
- You need: Claude Code

Cost to run: Free.

## Sample prompt: Narrow the allow list (Claude Code, Grok Bot, Codex, Hermes)

```
Read .claude/settings.json and list every allow rule with what it lets you do. Mark any that are wider than the commands this project runs.
Propose a narrower list and wait for my yes before changing the file.
```

The rules and the script are in the file.

## Free preview of claude-code-five-settings-rules-and-a-five-check-script-free-sample.md

````markdown
# Claude Code: five settings rules and a five-check script for .claude/settings.json (free sample)

Version 1.0, 2026-10-29. By PaperChaseWebb. For developers who use Claude Code every day, alone or next to Codex, Hermes or Grok Bot. One Markdown file and one Python 3 script, standard library only. The script was tested on its worked example (5 findings, then 0) and on a missing file (exit 2). It reads one settings file; it was not run inside Claude Code or any other harness.

Most Claude Code setups that go wrong go wrong in the same file. Bypass mode is on because the prompts were annoying. .env is readable because nobody wrote a deny rule. Plain Bash is allowed because it was faster. git push happens without a question. A hook runs a script from someone's Downloads folder. This sample gives you the five rules that cover those, and a script that checks them in one settings.json.

## Install in one line

Save this page as FREE-SAMPLE.md, then:

```
python3 -c "import re;t=open('FREE-SAMPLE.md').read();open('cc_mini.py','w').write(re.search(r'~~~python\n(.*?)~~~',t,re.S).group(1))"
python3 cc_mini.py .claude/settings.json
```

## Five settings rules

1. **Bypass stays off, and stays switched off.** Never make bypassPermissions the default mode, and set disableBypassPermissionsMode to "disable" so nobody turns it on in a hurry.
2. **Deny reading your keys.** Read(./.env) and Read(./.env.*) go in deny, plus any folder where you keep secrets.
3. **Allow named commands, never who
````

## Test record

- Date: Oct 29, 2026
- What was run: cc_mini.py on the worked example, a fixed file, a missing file, and the copy taken from the sample file.
- Result: 5 findings, then 0; exit 2 on a missing file; the copy behaved the same.
- Not run: Claude Code or any other harness.

Copied from this item's dated test notes. What was not run stays in.

## Worth knowing

- The sample checks one settings file against five rules. The full Claude Code Setup Runbook, gate, request approvals by hash, source and vetting records and the fifteen checks are in the full bundle.
- On 2026-10-29 cc_mini.py gave 5 findings on the worked example, then 0 on the fixed file, and exited 2 on a missing file; the copy extracted from the sample file behaved the same. It was not run inside Claude Code or any other harness.

## Questions

**Does it send anything anywhere?** No. It reads one file and opens no network connection.

**What is in the full bundle?** The Claude Code Setup Runbook with fifteen checks and owner approval tied to each request's hash, plus Agent Rules starter files, Agent Skills Workshop, MCP Setup Playbook and Vet Before You Install in full. $69, against $101 for the four bought separately.

## How to get it

Free sample. Download it directly at https://paperchasewebb.ai/bots/marketplace/items/claude-code-five-settings-rules-and-a-five-check-script-free-sample/, no signup.

Seller: PaperChaseWebb Inc., mgmt@paperchasewebb.com