Use dontAsk Mode to Run Claude with Only Pre-Approved Tools
In locked-down CI environments, you don't want Claude prompting for permissions or having access to arbitrary tools. dontAsk mode solves this by auto-denying every tool that isn't explicitly on your allow list.
claude --permission-mode dontAsk
Unlike bypassPermissions which removes all safety checks, dontAsk is additive in reverse: it auto-denies everything by default, and you explicitly allow only what you trust. If a tool has an ask rule, it's still denied rather than prompted, making the mode fully non-interactive.
Set up your allow list in settings.json first:
{
"permissions": {
"defaultMode": "dontAsk",
"allow": [
"Bash(npm test)",
"Bash(npm run build)",
"Bash(git status)",
"Bash(git diff)"
]
}
}
Then run Claude in a script or pipeline:
claude -p "run the test suite and summarise failures" --permission-mode dontAsk
This pairs well with CI pipelines where you want Claude to have access to specific build and test commands but nothing else. Claude will attempt its task and simply won't be able to call anything outside the pre-approved list.
Compare to the alternatives: auto mode uses a classifier to decide per-action, bypassPermissions skips all checks, and default prompts you for each new action. dontAsk is the choice when you want a fixed, auditable set of allowed operations.
dontAsk mode is the safest way to run Claude unattended in CI when you need predictable, scoped tool access.
Log in to leave a comment.
When Claude writes error messages, button labels, validation text, or onboarding flows, it defaults to generic developer-speak. Add a "Users" section to your CLAUDE.md describing who your actual users are — their technical level, industry jargon, and what they care about — so Claude writes copy that makes sense to THEM, not to developers.
Use the --agent flag with custom markdown files in .claude/agents/ to launch purpose-built Claude sessions with restricted tools and scoped system prompts.
Every project has traps — the billing module that silently fails if you forget to queue the job, the legacy table with column names that don't match the model, the config value that must be set before tests run. Document these gotchas in your CLAUDE.md so Claude avoids the same mistakes your team spent days debugging.