What --dangerously-skip-permissions does, and a safer way to run unattended
See what Claude Code's bypass mode skips, which checks remain, and how to ask for approval on specific commands without stopping routine work.
--dangerously-skip-permissions starts Claude Code in bypassPermissions mode. It bypasses normal permission checks, so commands and edits that would otherwise need approval can run without asking. It does not remove every safeguard or limit what the process can access. See Claude Code's permission modes for the current exceptions.
For the flag on its own, see Claude Code dangerously skip permissions. Other agents' equivalents have their own pages: Codex, Cursor and Antigravity CLI and Gemini CLI.
If repeated prompts are the problem, start by choosing which actions need your answer. A test run and a production release do not need the same approval rule.
Key takeaways
- Bypass mode skips normal permission checks. It is not a sandbox.
- Pushary's hooks can ask about recognized risky steps while Claude Code's permissions are off. Explicit rules and the Never stop me setting still affect the result. On Team and Enterprise, each person sets Never stop me for their own agents.
- A plain
git pushcan run without asking. Add an ask rule forBash(git push:*)if you want to review pushes too.
What the flag actually turns off
The flag selects the same mode as --permission-mode bypassPermissions. Normal approval checks are bypassed, but deny rules and explicit ask rules still apply, with documented exceptions. Some actions requiring user interaction and critical-path removals have separate handling.
Those protections depend on the Claude Code version and configuration. Use the current permission-mode reference instead of assuming a short list of exceptions covers every command.
Why people use it anyway
Approving each test run interrupts the work you asked the agent to do. Removing those interruptions is useful. Giving every command the same treatment can also let a mistake reach your files, credentials or production systems.
Anthropic recommends bypass mode for isolated containers or VMs. Isolation limits access; it does not prove an action is safe. Restrict mounted files, credentials and network access to what the task needs. If you want background review instead of bypassing checks, compare Claude Code's auto mode.
A safer pattern: one gate, answers on your phone
Choose which actions need your answer. Routine work should keep moving. A release, a force push or a production change may need your decision. A permission policy holds those choices as per-tool rules that approve, deny or ask.
With Claude Code's permissions off, Pushary can let routine commands run and ask about recognized risky steps. This behavior is specific to Claude Code. The examples below describe Pushary CLI 1.9.99, released November 1, 2026. Check the CLI changelog for later changes.
With the default permissions-off setting, npm test runs without a question and gh pr merge asks for approval. A plain git push can run without asking. To review pushes too, add an ask rule for Bash(git push:*) in Permission policies.
Your rules still matter. An explicit rule, preset, approval route, mode override, kill switch or approved scope can change the result. The Never stop me setting disables the extra permissions-off checks. On Team and Enterprise, each person sets it for their own agents; until they do, the team default applies. Your explicit rules and the other controls that still apply remain in effect.
These checks inspect the command or file edit presented to the hook. They do not inspect every operation hidden inside a script and do not create a sandbox.
When a call needs your answer, the configured approval mode decides where it goes. Follow the Claude Code setup guide for terminal, phone and Mac behavior. Question types and devices support different ways to answer; see supported agents before choosing an integration.
If you need to stop further work, use the kill switch. It blocks subsequent gated tool calls. It cannot undo work that has already run. Decision history follows your workspace's audit settings and retention.
An MCP-only connection can send notifications and ask questions, but it cannot enforce a gate on every tool call. An approval hook also cannot guarantee that a script is safe. Keep the agent's access limited and check the coverage of the integration you use.
Common questions
Is --dangerously-skip-permissions safe to use?
Isolation limits what an agent can reach. It does not guarantee that a task is safe. Restrict network access, mounted files and credentials, and review the current Claude Code permission-mode documentation before choosing bypass mode.
What still prompts even with the flag on?
Claude Code still applies deny rules and explicit ask rules, with documented exceptions. Some actions requiring user interaction and critical-path removals also have separate handling. The remaining checks depend on the Claude Code version and configuration; bypass mode is not a sandbox. See the current reference.
How do I run unattended without skipping everything?
Choose the calls that need review in Permission policies. Add an ask rule for Bash(git push:*) if pushes should wait. Routing and timeout behavior depend on the rule and the agent's supported integration.
Set your permission rules, then follow the Claude Code setup guide to route the decisions you want to review. Compare plans on pricing.
Frequently asked questions
What does --dangerously-skip-permissions not turn off?
Claude Code still applies deny rules and explicit ask rules, with documented exceptions. Some actions requiring user interaction and critical-path removals also have separate handling. The remaining checks depend on the Claude Code version and configuration; bypass mode is not a sandbox.
Is it safe to run --dangerously-skip-permissions inside a container?
Isolation limits what an agent can reach. It does not guarantee that a task is safe. Restrict network access, mounted files and credentials, and review the current Claude Code permission-mode documentation before choosing bypass mode.
How do I run an agent unattended without skipping every permission?
Choose the calls that need review in Permission policies. Add an ask rule for Bash(git push:*) if pushes should wait. Routing and timeout behavior depend on the rule and the agent's supported integration.