1. .claude/settings.local.json

{
  "permissions": {
    "defaultMode": "acceptEdits",
    "allow": [
      "Bash(npm install:*)",
      "WebSearch",
      "Bash(npx playwright:*)",
      "Bash(npm list:*)",
      "Bash(npx @playwright/mcp --help)",
      "Read(./**)",
      "Edit(./src/**)",
      "Edit(./app/**)",
      "Edit(./lib/**)",
      "Edit(./scripts/**)",
      "Edit(./*.json)",
      "Edit(./*.ts)",
      "Edit(./*.js)",
      "Edit(./*.vue)",
      "Edit(./*.md)",
      "Bash(npm *)",
      "Bash(pnpm *)",
      "Bash(yarn *)",
      "Bash(git *)",
      "Bash(dev)",
      "Bash(start)",
      "Bash(build)"
    ],
    "ask": [
      "Read(./.env*)",
      "Read(./.env.local*)",
      "Edit(./.env*)",
      "Bash(test)",
      "Bash(lint)",
      "Bash(serve)"
    ],
    "deny": [
      "Bash(rm -rf *)",
      "Bash(rm /*)",
      "Bash(sudo *)",
      "Bash(su *)",
      "Read(~/.ssh/**)",
      "Read(~/.aws/**)",
      "Read(/etc/**)",
      "Read(C:\\Users\\*\\.ssh\\**)",
      "Read(./*.pem)",
      "Read(./*.key)",
      "Bash(mkfs *)",
      "Bash(del /f *)"
    ],
    "commands": {
      "defaultMode": "ask"
    },
    "mcp": {
      "defaultMode": "ask",
      "allow": ["mcp__filesystem"],
      "deny": ["mcp__ssh", "mcp__postgres", "mcp__mysql"]
    }
  },
  "webFetch": {
    "allowDomains": [
      "github.com",
      "npmjs.com",
      "npmjs.org",
      "typescriptlang.org",
      "mdn.io",
      "vuejs.org",
      "react.dev"
    ],
    "denyDomains": ["未知恶意域名"]
  },
  "enabledMcpjsonServers": ["playwright"]
}

VSCode 全局配套设置（用户 settings.json）

{
  "claudeCode.initialPermissionMode": "acceptEdits", //打开VSCode时默认进入绕过权限模式
  "claudeCode.allowDangerouslySkipPermissions": false //是否解锁bypass模式选项
}