What Claude Code already decides for you, what runs with your permissions anyway, and a checklist for everything you add to it.
The short answer. Claude Code asks before it runs a command or edits a file, and you can narrow that with deny rules and its sandbox. What it does not decide for you is whether to trust what you add: a plugin's hooks and MCP servers, a skill's scripts, a cloned repository's settings. Those run with your permissions, so check them before they arrive.
Last reviewed , against Anthropic's Claude Code documentation linked in each section.
It asks first. By default, a Bash command (outside a short list of read-only ones), a file edit and a web fetch each wait for your yes; reading files in the working directory does not. Other modes trade that prompt away — acceptEdits, auto, where a classifier reviews actions instead of you, and bypassPermissions, which Anthropic describes as for isolated containers and VMs only. Permission modes.
Deny rules hold in every mode. Rules in settings.json are read deny first, then ask, then allow, and a deny rule holds even in bypassPermissions. A rule such as Read(./.env) in the deny list keeps that file out of reach whatever else is allowed. Permissions.
It asks before trusting a folder. Opened interactively in a folder you have not trusted, Claude Code shows a workspace trust dialog, and until you accept it the hooks in settings files are held back. Servers in a repository's .mcp.json wait for your approval one by one. Security.
It can sandbox shell commands. The sandbox is off until you turn it on with /sandbox; it then confines what shell commands can write and which domains they can reach, on macOS, Linux and WSL2. Sandboxing.
Hooks. Anthropic's own words: "Command hooks execute shell commands with your full user permissions." The sandbox covers shell commands only; Claude's file tools, MCP servers and hooks run outside it. Hooks.
Plugins. A plugin can carry commands, agents, skills, hooks, MCP servers and background monitors. Once it is enabled, its hooks and its MCP servers run on your machine, and Claude Code says to make sure you trust a plugin before installing, updating or using it. Plugin security.
Skills. A skill is instructions your agent follows, and it can bundle scripts the agent runs. Its allowed-tools line lets the agent use those tools without asking while the skill runs — "a skill can grant itself broad tool access", in Anthropic's words, so read that line in any skill a repository brings with it. Skills.
Unattended runs. A claude -p or SDK run never shows the trust dialog: a repository's .mcp.json servers connect without asking and the hooks in its settings run. Before running one in a repository you did not write, start it with --bare, or with --setting-sources user, so the project's own files are not read. What runs before you trust a folder.
| What you add | Where it can run code | What to check first |
|---|---|---|
| A Claude Code plugin | Its hooks, MCP servers and monitors, once enabled | Who publishes it; hooks/hooks.json and .mcp.json; whether the marketplace entry is pinned to a commit — five checks for a plugin or skill |
| An agent skill | The scripts beside its SKILL.md, through your agent | The whole SKILL.md, including HTML comments; its allowed-tools; any fetch piped into a shell |
| An MCP server | Its launch command, every time a session starts | What the command downloads and runs, and who publishes it — six checks for an MCP server |
| A repository you cloned | Its .claude/settings.json hooks, its .mcp.json, its skills | Read them before you accept the trust dialog; the files an agent loads at start can carry text a reviewer misses — CLAUDE.md and README injection |
RepoGates answers the first column before the install. Its Claude Code plugin reads npx skills add and claude plugin install before they run and scores the skill or plugin on 16 published checks, with the source repository through the 22 repository checks; the MCP server's check_skill answers the same question for any agent that calls it. Set up the plugin.
The plugin's hook sees Bash tool calls in Claude Code and nothing else: it does not see a command you type in your own terminal or one another agent runs. Edit and Write are read for one thing only — an API key about to be saved — checked on the machine and never sent; that guard asks, it never denies. /plugin install typed inside Claude Code is a slash command, not a Bash call, so no hook sees it. The checks match named shapes in the text; they do not understand intent, and they are not a substitute for Claude Code's own permissions, deny rules and sandbox.
Is Claude Code safe to use? Nobody can promise that of any tool. Claude Code asks before commands and edits, keeps deny rules in every mode and can sandbox shell commands; what it cannot judge for you is the code you add to it, which runs with your permissions.
Does the sandbox cover hooks and MCP servers? No. The sandbox covers shell commands only; Claude's file tools, MCP servers and hooks run outside it.
Does RepoGates make Claude Code secure? No. It scores a skill, plugin or repository on published checks before your agent installs it, through the plugin and the MCP server; Claude Code's own permissions still decide what runs.
Set up the Claude Code plugin Add to Browser — it's free Plans
The browser extension is free to start: it puts a verdict on GitHub, Hugging Face and GitLab pages and checks what you download there. It does not check skills or plugins; those checks run through the plugin and the MCP server, on the paid plans.