What --dangerously-skip-permissions does in Claude Code.
claude --dangerously-skip-permissions makes Claude Code run every tool call, bash, file writes, deletes, without asking for approval. People use it for unattended or overnight runs so the agent never blocks on a prompt.
The flag
claude --dangerously-skip-permissionsRuns every tool call without a prompt for the whole session.
The risk is that a wrong or injected command runs with no human gate. The safer pattern is to keep the agent moving but route approvals to your phone.
Uitgelicht op Hacker NewsThree ways to run an agent
Full skip keeps the agent moving but drops the gate. Babysitting keeps the gate but pins you to the keyboard. A phone gate keeps both.
| Approach | Agent keeps moving | Destructive actions gated | Away from the keyboard | Audit trail |
|---|---|---|---|---|
| Full skip (--dangerously-skip-permissions) | ||||
| Babysit the terminal | ||||
| Pushary phone-gate |
What the flag actually does
It is not a lighter prompt or a smart allowlist. It removes the approval step for every tool for the rest of the session, with the few exceptions covered below.
Skips the approval prompts
Bash commands, file writes, edits, and deletes all run without asking. Claude Code stops surfacing the approval prompt for the session, apart from the few prompts covered below.
No per-tool gate
There is no allowlist. Apart from deny rules, hooks and a few prompts, such as explicit ask rules and removals of critical paths like your home directory, a wrong command runs the same as a correct one, with no chance to stop it first.
Other agents use different flags
Codex takes --dangerously-bypass-approvals-and-sandbox or approval_policy = never, Cursor takes --force, and Gemini CLI takes --approval-mode=yolo. None of them accepts --dangerously-skip-permissions, and each has its own page here.
Auto mode is now the default
With Claude Code 2.1.283 or later, and on earlier versions for Pro, Max and Team plans, interactive terminal and VS Code sessions start in auto mode when auto mode is available for your model and organization and no flag or settings file picks another mode. In auto mode a second model, the classifier, reviews actions before they run and blocks anything that goes beyond your request, targets infrastructure it does not recognize, or looks driven by hostile content Claude read. Routine actions run without a prompt.
--dangerously-skip-permissions starts a different mode, bypassPermissions, which has no classifier at all. Deny rules still block, hooks such as Pushary's still run, and a few prompts survive, including explicit ask rules and rm or rmdir aimed at a critical path such as your home directory, your working directory or a drive root. Since 2.1.281 the critical-path prompt counts down for two minutes in the terminal and then denies the command, so an unattended run keeps going.
To go back to a session that asks before most edits, shell commands and network access, start Claude Code with claude --permission-mode default, or set permissions.defaultMode to "default" in ~/.claude/settings.json. Claude Code calls that mode Manual. Claude Code does not take auto or bypassPermissions as the starting mode from a project's .claude/settings.json or .claude/settings.local.json.
On a current Pushary install, when the classifier blocks a shell command or a file edit, the call reaches your phone. If you allow it, Claude is told it may retry, and that same call then runs once. Blocked web fetches, MCP tools and subagents do not reach your phone. If auto mode pauses after repeated blocks and goes back to asking, those prompts reach your phone too. Calls the classifier approves run without a push, which is the point of auto mode.
Why people use it, and the real risk
The flag solves a real problem. It also removes the one safeguard that stops a bad command before it runs.
The safer alternative
Pushary keeps a human gate on the risky tools through a PreToolUse hook. The agent runs on its own, but a destructive bash command, a delete, or an edit outside the allowlist is held. A push notification goes to your phone, you approve or deny in one tap from your lock screen, and every decision is logged. You keep the unattended flow of the skip flag without dropping the gate. That is how it works with the flag or in Manual mode. In auto mode, the Claude Code classifier decides first, and Pushary reaches your phone when it blocks a shell command or a file edit, or goes back to asking. Your deny rules and the kill switch apply in every mode.
Skip permissions questions
What does --dangerously-skip-permissions do?
It tells Claude Code to run every tool call without asking for approval. Bash commands, file writes, edits, and deletes all execute immediately. The flag turns off Claude Code's approval prompt for the whole session, which is why people use it for unattended or overnight runs. A few prompts survive, such as explicit ask rules and rm or rmdir aimed at a critical path like your home directory.
Is --dangerously-skip-permissions safe?
It is only as safe as the environment you run it in. Inside a throwaway container or VM with nothing valuable to reach, the blast radius is small. On your real machine or with repo write access, a single wrong or injected command can delete files, force push, or run a bad migration with no chance to stop it. The safer pattern is to keep a human gate on the risky tools instead of removing all of them.
Can I skip permissions for one command instead of the whole session?
Not with the flag. --dangerously-skip-permissions applies to the session, so there is no per-command form. Once it is set, only a few prompts remain, such as explicit ask rules and removals of critical paths like your home directory. That is the gap people are actually trying to close: they want the agent to stop asking about the safe majority, not to stop asking about anything at all. An allowlist for routine commands plus a gate on the risky ones gets you that, and Pushary puts the gate on your phone so the run does not stall while you are away.
Can I keep a gate on risky tools and still let Claude Code run on its own?
Add Pushary's PreToolUse hook. The agent keeps running on its own, but risky tool calls are held and a push notification goes to your phone. You approve or deny in one tap from your lock screen, and every decision is logged. You get the unattended flow of the skip flag without giving up the human gate. That is how it works with the flag or in Manual mode. In auto mode the classifier decides first, and Pushary reaches your phone when it blocks a shell command or a file edit.
What is the equivalent of --dangerously-skip-permissions in Codex, Cursor and Gemini CLI?
None of them accepts the flag itself. Codex splits the idea across two settings: codex --dangerously-bypass-approvals-and-sandbox, which also accepts --yolo, drops approvals and the sandbox together, while approval_policy = "never" removes only the prompts. Cursor uses agent --force, aliased --yolo. Gemini CLI uses --approval-mode=yolo. Antigravity CLI takes the same flag as Claude Code, and OpenCode accepts it as a hidden alias of --auto.
Is auto mode the default in Claude Code now?
Yes, for interactive terminal and VS Code sessions on Claude Code 2.1.283 or later, and on earlier versions for Pro, Max and Team plans, when auto mode is available for your model and organization and no flag or settings file picks another mode. In auto mode a classifier reviews actions beyond routine reads and edits before they run. It is not the same as --dangerously-skip-permissions, which starts bypassPermissions mode with no classifier.
How do I turn off auto mode in Claude Code?
Start Claude Code with claude --permission-mode default, or set permissions.defaultMode to "default" in ~/.claude/settings.json so every terminal session on the machine starts that way. Claude Code calls that mode Manual, and it asks before most edits, shell commands and network access. In the terminal, Shift+Tab cycles through the modes.
Run unattended without skipping every permission.
Keep the agent moving, gate the risky calls, approve from your phone. Set up in two minutes.
Start your trial$9.99/mo after a 3-day free trial. Cancel anytime.