Claude Code settings.json 完全指南：从权限控制到团队协作的配置艺术

// User Global: ~/.claude/settings.json
{
  "permissions": {
    "allow": ["Read"]
  }
}
 
// Project Shared: .claude/settings.json
{
  "permissions": {
    "allow": ["Bash(npm test)"]
  }
}
 
// 合并结果：两个 allow 数组拼接
// allow: ["Read", "Bash(npm test)"]

// User Global
{
  "env": {
    "EDITOR": "vim"
  }
}
 
// Project Shared
{
  "env": {
    "NODE_ENV": "development"
  }
}
 
// 合并结果：两个对象合并
// env: { "EDITOR": "vim", "NODE_ENV": "development" }

// User Global
{ "model": "claude-sonnet-4-6" }
 
// Project Shared
{ "model": "claude-opus-4-6" }
 
// 合并结果：高优先级的 Project Shared 生效
// model: "claude-opus-4-6"

{
  "permissions": {
    "allow": [],  // 自动允许，不弹确认
    "deny": [],   // 直接拒绝，Claude 看不到这个工具
    "ask": []     // 每次调用都弹确认（默认行为）
  }
}

{
  "permissions": {
    "allow": [
      "Read",                    // 允许所有文件读取
      "Bash(npm test)",          // 只允许 npm test
      "Bash(npm run *)",         // 允许所有 npm run 子命令
      "Bash(git log *)",         // 允许 git log
      "Bash(git diff *)",        // 允许 git diff
      "Bash(cd * && cat *)"      // 允许 cd + cat 组合
    ],
    "deny": [
      "Bash(rm -rf *)",          // 禁止递归删除
      "Bash(git push --force *)" // 禁止 force push
    ]
  }
}

{
  "permissions": {
    "allow": [
      "mcp__github__create_issue",     // 允许创建 issue
      "mcp__filesystem__read_file"     // 允许读文件
    ],
    "deny": [
      "mcp__github__delete_repository" // 禁止删仓库
    ]
  }
}

{
  "permissions": {
    "allow": ["Bash(git *)"],           // 允许所有 git 命令
    "deny": ["Bash(git push --force *)"] // 但禁止 force push
  }
}
// 结果：git push --force 被拒绝，其他 git 命令被允许

// Project Shared: .claude/settings.json
{
  "permissions": {
    "deny": ["Bash(rm -rf *)"]
  }
}
 
// User Global: ~/.claude/settings.json
{
  "permissions": {
    "allow": ["Bash(rm -rf *)"]  // 试图覆盖项目的 deny
  }
}
 
// 结果：rm -rf 仍然被拒绝。deny 不可覆盖。

{
  "permissions": {
    "allow": [
      "Read",
      "Edit",
      "Write",
      "Bash(npm *)",
      "Bash(npx *)",
      "Bash(git status)",
      "Bash(git diff *)",
      "Bash(git log *)",
      "Bash(git add *)",
      "Bash(git commit *)"
    ],
    "deny": [
      "Bash(git push --force *)",
      "Bash(rm -rf *)"
    ]
  }
}

{
  "permissions": {
    "allow": [
      "Read",
      "Bash(npm test *)",
      "Bash(npm run lint *)",
      "Bash(git status)",
      "Bash(git diff *)",
      "Bash(git log *)"
    ],
    "deny": [
      "Bash(git push *)",
      "Bash(rm *)",
      "Bash(npm publish *)",
      "Bash(curl *)",
      "Bash(wget *)"
    ]
  }
}

{
  "permissions": {
    "allow": [
      "Read",
      "Edit",
      "Write",
      "Bash(npm *)",
      "Bash(git *)"
    ],
    "deny": [
      "Bash(git push --force *)",
      "Bash(rm -rf /)",
      "WebFetch",
      "WebSearch"
    ]
  }
}

{
  "env": {
    "NODE_ENV": "development",
    "DEBUG": "true",
    "API_BASE_URL": "https://api.example.com"
  }
}

{
  // 顶层 env：对所有 Bash 命令生效
  "env": {
    "GLOBAL_VAR": "value"
  },
 
  // MCP Server 内的 env：只对该 MCP Server 进程生效
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": {
        "GITHUB_TOKEN": "ghp_xxx"  // 只有 github server 能看到
      }
    }
  }
}

// User Global
{ "env": { "EDITOR": "vim", "LANG": "en_US" } }
 
// Project Shared
{ "env": { "NODE_ENV": "development", "LANG": "zh_CN" } }
 
// 合并结果
// { "EDITOR": "vim", "NODE_ENV": "development", "LANG": "zh_CN" }
// LANG 被 Project Shared 覆盖

{
  "model": "claude-sonnet-4-6"
}

{
  "maxTokens": 16384
}

{
  "apiProvider": "anthropic"
  // 使用 ANTHROPIC_API_KEY 环境变量
}

{
  "apiProvider": "bedrock",
  "env": {
    "AWS_REGION": "us-east-1",
    "AWS_PROFILE": "my-profile"
  }
}

{
  "apiProvider": "vertex",
  "env": {
    "CLOUD_ML_REGION": "us-east5",
    "ANTHROPIC_VERTEX_PROJECT_ID": "my-project-id"
  }
}

{
  "customApiHeaders": {
    "X-Custom-Header": "value",
    "Authorization": "Bearer custom-token"
  }
}

// /etc/claude-code/managed-settings.json
{
  "permissions": {
    "deny": [
      "Bash(curl *)",
      "Bash(wget *)",
      "Bash(npm publish *)",
      "Bash(git push --force *)",
      "WebFetch",
      "WebSearch"
    ]
  },
  "model": "claude-sonnet-4-6"
}

{
  "permissions": {
    "deny": [
      "Bash(curl *)",
      "Bash(wget *)",
      "Bash(ssh *)",
      "WebFetch",
      "WebSearch"
    ]
  }
}

{
  "model": "claude-sonnet-4-6"
}

{
  "mcpServers": {},
  "permissions": {
    "deny": [
      "mcp__*"
    ]
  }
}

{
  "permissions": {
    "allow": [
      "Read",
      "Bash(flutter test *)",
      "Bash(flutter analyze *)",
      "Bash(dart format *)",
      "Bash(dart fix *)",
      "Bash(flutter pub get)",
      "Bash(git status)",
      "Bash(git diff *)",
      "Bash(git log *)",
      "mcp__github__list_issues",
      "mcp__github__get_issue",
      "mcp__github__create_issue"
    ],
    "deny": [
      "Bash(git push --force *)",
      "Bash(rm -rf *)",
      "Bash(flutter pub publish *)",
      "mcp__github__delete_repository"
    ]
  },
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Write|Edit",
        "hooks": [
          {
            "type": "command",
            "command": "dart format --line-length 80 $CLAUDE_FILE_PATH"
          }
        ]
      }
    ]
  },
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": {
        "GITHUB_TOKEN": ""
      }
    }
  },
  "env": {
    "FLUTTER_TEST_CONCURRENCY": "4"
  }
}

{
  "permissions": {
    "allow": [
      "Edit",
      "Write",
      "Bash(git add *)",
      "Bash(git commit *)"
    ]
  },
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": {
        "GITHUB_TOKEN": "ghp_xxxxxxxxxxxx"
      }
    }
  },
  "model": "claude-opus-4-6"
}

{
  "permissions": {
    "allow": [
      "Read",
      "Bash(cat *)",
      "Bash(ls *)",
      "Bash(which *)",
      "Bash(echo *)"
    ]
  },
  "env": {
    "EDITOR": "code",
    "LANG": "zh_CN.UTF-8"
  }
}

{
  "permissions": {
    "deny": ["WebFetch", "WebSearch"]
  }
}

claude --settings /path/to/session-settings.json