Back to Details

claude-settings-audit

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Claude Settings Audit

Claude配置审计

Analyze this repository and generate recommended Claude Code 
settings.json
permissions for read-only commands.
分析当前代码仓库，为Claude Code生成推荐的
settings.json
只读命令权限配置。

Phase 1: Detect Tech Stack

阶段1：检测技术栈

Run these commands to detect the repository structure:
bash
ls -la
find . -maxdepth 2 \( -name "*.toml" -o -name "*.json" -o -name "*.lock" -o -name "*.yaml" -o -name "*.yml" -o -name "Makefile" -o -name "Dockerfile" -o -name "*.tf" \) 2>/dev/null | head -50
Check for these indicator files:
CategoryFiles to Check
Python
pyproject.toml
, 
setup.py
, 
requirements.txt
, 
Pipfile
, 
poetry.lock
, 
uv.lock
Node.js
package.json
, 
package-lock.json
, 
yarn.lock
, 
pnpm-lock.yaml
Go
go.mod
, 
go.sum
Rust
Cargo.toml
, 
Cargo.lock
Ruby
Gemfile
, 
Gemfile.lock
Java
pom.xml
, 
build.gradle
, 
build.gradle.kts
Build
Makefile
, 
Dockerfile
, 
docker-compose.yml
Infra
*.tf
files, 
kubernetes/
, 
helm/
Monorepo
lerna.json
, 
nx.json
, 
turbo.json
, 
pnpm-workspace.yaml
运行以下命令检测仓库结构：
bash
ls -la
find . -maxdepth 2 \( -name "*.toml" -o -name "*.json" -o -name "*.lock" -o -name "*.yaml" -o -name "*.yml" -o -name "Makefile" -o -name "Dockerfile" -o -name "*.tf" \) 2>/dev/null | head -50
检查以下标识文件：
类别需检查的文件
Python
pyproject.toml
, 
setup.py
, 
requirements.txt
, 
Pipfile
, 
poetry.lock
, 
uv.lock
Node.js
package.json
, 
package-lock.json
, 
yarn.lock
, 
pnpm-lock.yaml
Go
go.mod
, 
go.sum
Rust
Cargo.toml
, 
Cargo.lock
Ruby
Gemfile
, 
Gemfile.lock
Java
pom.xml
, 
build.gradle
, 
build.gradle.kts
构建工具
Makefile
, 
Dockerfile
, 
docker-compose.yml
基础设施
*.tf
文件, 
kubernetes/
, 
helm/
单体仓库
lerna.json
, 
nx.json
, 
turbo.json
, 
pnpm-workspace.yaml

Phase 2: Detect Services

阶段2：检测服务集成

Check for service integrations:
ServiceDetection
Sentry
sentry-sdk
in deps, 
@sentry/*
packages, 
.sentryclirc
, 
sentry.properties
LinearLinear config files, 
.linear/
directory
Read dependency files to identify frameworks:
  • package.json
    → check 
    dependencies
    and 
    devDependencies
  • pyproject.toml
    → check 
    [project.dependencies]
    or 
    [tool.poetry.dependencies]
  • Gemfile
    → check gem names
  • Cargo.toml
    → check 
    [dependencies]
检查服务集成情况：
服务检测方式
Sentry依赖中包含
sentry-sdk
、
@sentry/*
包，或存在
.sentryclirc
、
sentry.properties
文件
Linear存在Linear配置文件或
.linear/
目录
读取依赖文件识别框架：
  • package.json
    → 检查
    dependencies
    和
    devDependencies
  • pyproject.toml
    → 检查
    [project.dependencies]
    或
    [tool.poetry.dependencies]
  • Gemfile
    → 检查gem名称
  • Cargo.toml
    → 检查
    [dependencies]

Phase 3: Check Existing Settings

阶段3：检查现有配置

bash
cat .claude/settings.json 2>/dev/null || echo "No existing settings"
bash
cat .claude/settings.json 2>/dev/null || echo "无现有配置"

Phase 4: Generate Recommendations

阶段4：生成推荐配置

Build the allow list by combining:
结合以下内容构建允许列表：

Baseline Commands (Always Include)

基础命令（始终包含）

json
[
  "Bash(ls:*)",
  "Bash(pwd:*)",
  "Bash(find:*)",
  "Bash(file:*)",
  "Bash(stat:*)",
  "Bash(wc:*)",
  "Bash(head:*)",
  "Bash(tail:*)",
  "Bash(cat:*)",
  "Bash(tree:*)",
  "Bash(git status:*)",
  "Bash(git log:*)",
  "Bash(git diff:*)",
  "Bash(git show:*)",
  "Bash(git branch:*)",
  "Bash(git remote:*)",
  "Bash(git tag:*)",
  "Bash(git stash list:*)",
  "Bash(git rev-parse:*)",
  "Bash(gh pr view:*)",
  "Bash(gh pr list:*)",
  "Bash(gh pr checks:*)",
  "Bash(gh pr diff:*)",
  "Bash(gh issue view:*)",
  "Bash(gh issue list:*)",
  "Bash(gh run view:*)",
  "Bash(gh run list:*)",
  "Bash(gh run logs:*)",
  "Bash(gh repo view:*)",
  "Bash(gh api:*)"
]
json
[
  "Bash(ls:*)",
  "Bash(pwd:*)",
  "Bash(find:*)",
  "Bash(file:*)",
  "Bash(stat:*)",
  "Bash(wc:*)",
  "Bash(head:*)",
  "Bash(tail:*)",
  "Bash(cat:*)",
  "Bash(tree:*)",
  "Bash(git status:*)",
  "Bash(git log:*)",
  "Bash(git diff:*)",
  "Bash(git show:*)",
  "Bash(git branch:*)",
  "Bash(git remote:*)",
  "Bash(git tag:*)",
  "Bash(git stash list:*)",
  "Bash(git rev-parse:*)",
  "Bash(gh pr view:*)",
  "Bash(gh pr list:*)",
  "Bash(gh pr checks:*)",
  "Bash(gh pr diff:*)",
  "Bash(gh issue view:*)",
  "Bash(gh issue list:*)",
  "Bash(gh run view:*)",
  "Bash(gh run list:*)",
  "Bash(gh run logs:*)",
  "Bash(gh repo view:*)",
  "Bash(gh api:*)"
]

Stack-Specific Commands

技术栈专属命令

Only include commands for tools actually detected in the project.
仅包含项目中实际检测到的工具对应的命令。

Python (if any Python files or config detected)

Python（若检测到Python文件或配置）

If DetectedAdd These Commands
Any Python
python --version
, 
python3 --version
poetry.lock
poetry show
, 
poetry env info
uv.lock
uv pip list
, 
uv tree
Pipfile.lock
pipenv graph
requirements.txt
(no other lock)
pip list
, 
pip show
, 
pip freeze
检测到的内容添加以下命令
任意Python相关文件或配置
python --version
, 
python3 --version
poetry.lock
poetry show
, 
poetry env info
uv.lock
uv pip list
, 
uv tree
Pipfile.lock
pipenv graph
requirements.txt
（无其他锁文件）
pip list
, 
pip show
, 
pip freeze

Node.js (if package.json detected)

Node.js（若检测到package.json）

If DetectedAdd These Commands
Any Node.js
node --version
pnpm-lock.yaml
pnpm list
, 
pnpm why
yarn.lock
yarn list
, 
yarn info
, 
yarn why
package-lock.json
npm list
, 
npm view
, 
npm outdated
TypeScript (
tsconfig.json
)
tsc --version
检测到的内容添加以下命令
任意Node.js相关配置
node --version
pnpm-lock.yaml
pnpm list
, 
pnpm why
yarn.lock
yarn list
, 
yarn info
, 
yarn why
package-lock.json
npm list
, 
npm view
, 
npm outdated
TypeScript（
tsconfig.json
）
tsc --version

Other Languages

其他语言

If DetectedAdd These Commands
go.mod
go version
, 
go list
, 
go mod graph
, 
go env
Cargo.toml
rustc --version
, 
cargo --version
, 
cargo tree
, 
cargo metadata
Gemfile
ruby --version
, 
bundle list
, 
bundle show
pom.xml
java --version
, 
mvn --version
, 
mvn dependency:tree
build.gradle
java --version
, 
gradle --version
, 
gradle dependencies
检测到的内容添加以下命令
go.mod
go version
, 
go list
, 
go mod graph
, 
go env
Cargo.toml
rustc --version
, 
cargo --version
, 
cargo tree
, 
cargo metadata
Gemfile
ruby --version
, 
bundle list
, 
bundle show
pom.xml
java --version
, 
mvn --version
, 
mvn dependency:tree
build.gradle
java --version
, 
gradle --version
, 
gradle dependencies

Build Tools

构建工具

If DetectedAdd These Commands
Dockerfile
docker --version
, 
docker ps
, 
docker images
docker-compose.yml
docker-compose ps
, 
docker-compose config
*.tf
files
terraform --version
, 
terraform providers
, 
terraform state list
Makefile
make --version
, 
make -n
检测到的内容添加以下命令
Dockerfile
docker --version
, 
docker ps
, 
docker images
docker-compose.yml
docker-compose ps
, 
docker-compose config
*.tf
文件
terraform --version
, 
terraform providers
, 
terraform state list
Makefile
make --version
, 
make -n

Skills (for Sentry Projects)

Skills（适用于Sentry项目）

If this is a Sentry project (or sentry-skills plugin is installed), include:
json
[
  "Skill(sentry-skills:commit)",
  "Skill(sentry-skills:create-pr)",
  "Skill(sentry-skills:code-review)",
  "Skill(sentry-skills:find-bugs)",
  "Skill(sentry-skills:iterate-pr)",
  "Skill(sentry-skills:claude-settings-audit)",
  "Skill(sentry-skills:agents-md)",
  "Skill(sentry-skills:brand-guidelines)",
  "Skill(sentry-skills:doc-coauthoring)",
  "Skill(sentry-skills:security-review)",
  "Skill(sentry-skills:django-perf-review)",
  "Skill(sentry-skills:code-simplifier)"
]
若为Sentry项目（或已安装sentry-skills插件），需包含：
json
[
  "Skill(sentry-skills:commit)",
  "Skill(sentry-skills:create-pr)",
  "Skill(sentry-skills:code-review)",
  "Skill(sentry-skills:find-bugs)",
  "Skill(sentry-skills:iterate-pr)",
  "Skill(sentry-skills:claude-settings-audit)",
  "Skill(sentry-skills:agents-md)",
  "Skill(sentry-skills:brand-guidelines)",
  "Skill(sentry-skills:doc-coauthoring)",
  "Skill(sentry-skills:security-review)",
  "Skill(sentry-skills:django-perf-review)",
  "Skill(sentry-skills:code-simplifier)"
]

WebFetch Domains

WebFetch 域名

Always Include (Sentry Projects)

始终包含（Sentry项目）

json
[
  "WebFetch(domain:docs.sentry.io)",
  "WebFetch(domain:develop.sentry.dev)",
  "WebFetch(domain:docs.github.com)",
  "WebFetch(domain:cli.github.com)"
]
json
[
  "WebFetch(domain:docs.sentry.io)",
  "WebFetch(domain:develop.sentry.dev)",
  "WebFetch(domain:docs.github.com)",
  "WebFetch(domain:cli.github.com)"
]

Framework-Specific

框架专属域名

If DetectedAdd Domains
Django
docs.djangoproject.com
Flask
flask.palletsprojects.com
FastAPI
fastapi.tiangolo.com
React
react.dev
Next.js
nextjs.org
Vue
vuejs.org
Express
expressjs.com
Rails
guides.rubyonrails.org
, 
api.rubyonrails.org
Go
pkg.go.dev
Rust
docs.rs
, 
doc.rust-lang.org
Docker
docs.docker.com
Kubernetes
kubernetes.io
Terraform
registry.terraform.io
检测到的框架添加以下域名
Django
docs.djangoproject.com
Flask
flask.palletsprojects.com
FastAPI
fastapi.tiangolo.com
React
react.dev
Next.js
nextjs.org
Vue
vuejs.org
Express
expressjs.com
Rails
guides.rubyonrails.org
, 
api.rubyonrails.org
Go
pkg.go.dev
Rust
docs.rs
, 
doc.rust-lang.org
Docker
docs.docker.com
Kubernetes
kubernetes.io
Terraform
registry.terraform.io

MCP Server Suggestions

MCP服务器建议

MCP servers are configured in 
.mcp.json
(not 
settings.json
). Check for existing config:
bash
cat .mcp.json 2>/dev/null || echo "No existing .mcp.json"
MCP服务器配置在
.mcp.json
中（而非
settings.json
）。检查现有配置：
bash
cat .mcp.json 2>/dev/null || echo "无现有.mcp.json配置"

Sentry MCP (if Sentry SDK detected)

Sentry MCP（若检测到Sentry SDK）

Add to 
.mcp.json
(replace 
{org-slug}
and 
{project-slug}
with your Sentry organization and project slugs):
json
{
  "mcpServers": {
    "sentry": {
      "type": "http",
      "url": "https://mcp.sentry.dev/mcp/{org-slug}/{project-slug}"
    }
  }
}
添加至
.mcp.json
（将
{org-slug}
和
{project-slug}
替换为你的Sentry组织和项目标识）：
json
{
  "mcpServers": {
    "sentry": {
      "type": "http",
      "url": "https://mcp.sentry.dev/mcp/{org-slug}/{project-slug}"
    }
  }
}

Linear MCP (if Linear usage detected)

Linear MCP（若检测到Linear使用痕迹）

Add to 
.mcp.json
:
json
{
  "mcpServers": {
    "linear": {
      "command": "npx",
      "args": ["-y", "@linear/mcp-server"],
      "env": {
        "LINEAR_API_KEY": "${LINEAR_API_KEY}"
      }
    }
  }
}
Note: Never suggest GitHub MCP. Always use 
gh
CLI commands for GitHub.
添加至
.mcp.json
：
json
{
  "mcpServers": {
    "linear": {
      "command": "npx",
      "args": ["-y", "@linear/mcp-server"],
      "env": {
        "LINEAR_API_KEY": "${LINEAR_API_KEY}"
      }
    }
  }
}
注意：请勿推荐GitHub MCP。始终使用
gh
CLI命令操作GitHub。

Output Format

输出格式

Present your findings as:
  1. Summary Table - What was detected
  2. Recommended settings.json - Complete JSON ready to copy
  3. MCP Suggestions - If applicable
  4. Merge Instructions - If existing settings found
Example output structure:
markdown
undefined
请按以下格式呈现检测结果：
  1. 汇总表格 - 检测到的内容
  2. 推荐的settings.json配置 - 可直接复制的完整JSON
  3. MCP配置建议 - 若适用
  4. 合并说明 - 若检测到现有配置
示例输出结构：
markdown
undefined

Detected Tech Stack

检测到的技术栈

CategoryFound
LanguagesPython 3.x
Package Managerpoetry
FrameworksDjango, Celery
ServicesSentry
Build ToolsDocker, Make
类别检测结果
编程语言Python 3.x
包管理器poetry
框架Django, Celery
服务集成Sentry
构建工具Docker, Make

Recommended .claude/settings.json

推荐的.claude/settings.json

```json { "permissions": { "allow": [ // ... grouped by category with comments ], "deny": [] } } ```
```json { "permissions": { "allow": [ // ... 按类别分组并添加注释 ], "deny": [] } } ```

Recommended .mcp.json (if applicable)

推荐的.mcp.json（若适用）

If you use Sentry or Linear, add the MCP config to 
.mcp.json
...
undefined
若你使用Sentry或Linear，请将以下MCP配置添加至
.mcp.json
...
undefined

Important Rules

重要规则

What to Include

需包含的内容

  • Only READ-ONLY commands that cannot modify state
  • Only tools that are actually used by the project (detected via lock files)
  • Standard system commands (ls, cat, find, etc.)
  • The 
    :*
    suffix allows any arguments to the base command
  • 仅包含只读命令，不能修改系统状态
  • 仅包含项目实际使用的工具（通过锁文件检测）
  • 标准系统命令（ls, cat, find等）
  • 使用
    :*
    后缀允许基础命令的任意参数

What to NEVER Include

绝对不能包含的内容

  • Absolute paths - Never include user-specific paths like 
    /home/user/scripts/foo
    or 
    /Users/name/bin/bar
  • Custom scripts - Never include project scripts that may have side effects (e.g., 
    ./scripts/deploy.sh
    )
  • Alternative package managers - If the project uses pnpm, do NOT include npm/yarn commands
  • Commands that modify state - No install, build, run, write, or delete commands
  • 绝对路径 - 请勿包含用户专属路径，如
    /home/user/scripts/foo
    或
    /Users/name/bin/bar
  • 自定义脚本 - 请勿包含可能产生副作用的项目脚本（如
    ./scripts/deploy.sh
    ）
  • 替代包管理器 - 若项目使用pnpm，请勿包含npm/yarn命令
  • 修改状态的命令 - 禁止包含安装、构建、运行、写入或删除类命令

Package Manager Rules

包管理器规则

Only include the package manager actually used by the project:
If DetectedIncludeDo NOT Include
pnpm-lock.yaml
pnpm commandsnpm, yarn
yarn.lock
yarn commandsnpm, pnpm
package-lock.json
npm commandsyarn, pnpm
poetry.lock
poetry commandspip (unless also has requirements.txt)
uv.lock
uv commandspip, poetry
Pipfile.lock
pipenv commandspip, poetry
If multiple lock files exist, include only the commands for each detected manager.
仅包含项目实际使用的包管理器对应的命令：
检测到的锁文件包含对应命令禁止包含的命令
pnpm-lock.yaml
pnpm命令npm, yarn
yarn.lock
yarn命令npm, pnpm
package-lock.json
npm命令yarn, pnpm
poetry.lock
poetry命令pip（除非同时存在requirements.txt）
uv.lock
uv命令pip, poetry
Pipfile.lock
pipenv命令pip, poetry
若存在多个锁文件，为每个检测到的包管理器添加对应命令。