Claude Code Permissions

[m-ronchi]

Hi,
in claude code, when it wants to run a shell command, we can use the permission system to allow/deny specific commands and arguments, e,g, allow: ["Bash(git status)", "Bash(npm run *)"].

but when lean-ctx is installed, Claude uses the ctx_shell tool instead of Bash, which doesn't appear to have such control (e.g. either I allow the tool as a whole or I deny it)

is or will there be a way to control it? I want to allow read-only or otherwise safe commands (e.g. jq) while keeping the confirmation in the general case (so no rogue rm,kubectl , python, etc...)

[yvgude]

Hi @m-ronchi, this is an excellent and important question about security.

How ctx_shell Security Works Today

lean-ctx has a built-in shell allowlist system that works similarly to Claude Code's permission model:

Option 1: Shell Allowlist (config.toml)

You can restrict which commands ctx_shell is allowed to execute:

# ~/.lean-ctx/config.toml
shell_allowlist = ["git", "ls", "cat", "head", "tail", "find", "grep", "rg", "wc", "jq", "npm", "node", "cargo"]

When the allowlist is non-empty, lean-ctx operates in deny-by-default mode:

• Only commands whose base executable is in the list can run
• Compound commands (&&, ||, |) require ALL segments to be allowed
• Dangerous patterns (eval, $(...), backticks at command position) are blocked regardless
• Blocked commands return a clear error: [BLOCKED — DO NOT RETRY] 'rm' is not in the shell allowlist

Option 2: Empty Allowlist (default)

When shell_allowlist = [] (the default), all commands pass — this is backwards-compatible but less secure.

How to Set It Up

# Set a restrictive allowlist:
lean-ctx config set shell_allowlist '["git","ls","cat","head","tail","find","grep","rg","wc","jq","npm","cargo"]'

# Verify:
lean-ctx config show | grep shell_allowlist

Hybrid Approach (CLI vs MCP)

For Claude Code specifically, you can also use lean-ctx in hybrid mode: use Claude Code's native Bash tool (with its own permission system) for shell commands, and lean-ctx only for reads/search:

# In your CLAUDE.md:
Use lean-ctx MCP tools for reads (ctx_read) and search (ctx_search).
Use native Bash for shell commands (keeps Claude Code permission control).

This way you get lean-ctx's compression benefits for file reads while keeping Claude Code's fine-grained shell permissions.

The allowlist system already covers your use case — you just need to configure it. Let me know if you need help with a specific setup!