Claude Code Settings Audit Skill

by Sentry getsentry/sentry-skills skills/claude-settings-audit

Analyse a repository's tech stack and generate a recommended Claude Code settings.json permission allowlist for its read-only commands.

GitHub Docs

Development

Added to Onei Aug 6, 2026

MIT

Install

Install with the skills CLI

One command for Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf and dozens of other agents. Needs Node.js; the skill is fetched straight from getsentry/sentry-skills.

$ npx skills add getsentry/sentry-skills --skill claude-settings-audit

Run it in a terminal. The CLI finds the agents installed on your machine, asks which ones to add the skill to, and whether to install it into the folder you ran it from or for all your projects.

Other ways to install

Copy the whole skill folder — SKILL.md and any scripts or references beside it — into ~/.claude/skills/claude-settings-audit/, where Claude Code picks it up in every project. Only git is needed.

tmp=$(mktemp -d) && \
  git clone --depth 1 --branch main https://github.com/getsentry/sentry-skills.git "$tmp" && \
  mkdir -p ~/.claude/skills && \
  cp -R "$tmp"/skills/claude-settings-audit ~/.claude/skills/claude-settings-audit

No scripts or references next to it? Saving the SKILL.md alone as ~/.claude/skills/claude-settings-audit/SKILL.md works too.

Using another agent? Its personal skills folder

Codex: ~/.agents/skills/
Cursor: ~/.cursor/skills/
GitHub Copilot: ~/.copilot/skills/
Gemini CLI: ~/.gemini/skills/
Windsurf: ~/.codeium/windsurf/skills/
OpenCode: ~/.config/opencode/skills/

Open folder on GitHub

Download the skill folderfrom GitHub and zip it, so the archive has SKILL.md inside its top folder.
In Claude, open Settings → Capabilities and turn on Skills.
Choose Upload skill and pick the zip.

Paste this into an agent that can run commands — Claude Code, Codex, Cursor — and it installs the skill itself.

Install the agent skill "claude-settings-audit" from https://github.com/getsentry/sentry-skills/tree/main/skills/claude-settings-audit. If Node.js is available, run `npx skills add getsentry/sentry-skills --skill claude-settings-audit -g -y -a <your agent id>`, where the id is claude-code, codex, cursor, github-copilot, gemini-cli, windsurf or opencode. Otherwise copy that folder — SKILL.md and every file beside it — into your personal skills directory (for Claude Code: ~/.claude/skills/claude-settings-audit/). Then tell me the skill is installed and what it does.

Instructions from Sentry, as published with the skill.

Any agent

npx skills add getsentry/skills

Run it from the repository root and ask for a settings audit. Review the generated allowlist before pasting it into .claude/settings.json — it is a recommendation, not a drop-in file.

Claude

claude plugin marketplace add getsentry/skills
claude plugin install sentry-skills@sentry-skills

Restart Claude Code, then run Audit this repo and recommend settings.json permissions.

About

Detects the stack from lockfiles and build manifests, not guesswork
Covers Python, Node, Go, Rust, Ruby, Java, Docker and Terraform
Recognises monorepo layouts and adjusts recommendations
Restricts the generated allowlist to read-only commands
Works as a first-time setup step or an audit of existing settings

Every new project starts with the same friction: the agent asks permission for pnpm check, then cargo test, then terraform validate, and you approve each one by hand. This skill from Sentry's collection does the survey for you and produces a settings.json permissions block tailored to what the repository actually contains.

It begins by detecting the stack from indicator files rather than guessing — pyproject.toml, uv.lock and requirements.txt for Python; package.json and the various lockfiles for Node; go.mod, Cargo.toml, Gemfile, pom.xml and Gradle build files; Makefile, Dockerfile and docker-compose.yml for build tooling; *.tf, kubernetes/ and helm/ for infrastructure. It also recognises monorepo markers (turbo.json, nx.json, lerna.json, pnpm-workspace.yaml), which matter because they change what the safe command surface looks like.

The output is scoped to read-only commands. That is the point: allowlisting git status, pnpm test or terraform plan removes almost all of the prompt noise without handing an agent the ability to mutate anything, so the permission dialogs that remain are the ones actually worth reading.

Useful when onboarding a repository to Claude Code, and equally useful as an audit of settings that accumulated by hand over time and now allow more than anyone intended. Published by Sentry in getsentry/sentry-skills under the open Agent Skills format.

Try it

Once installed, ask your agent something like:

Audit this repository and recommend Claude Code settings.json permissions.

SKILL.md

The instructions your agent loads, as published by Sentry.

SKILL.md getsentry/sentry-skills/skills/claude-settings-audit

name: claude-settings-audit
description: Analyze a repository to generate recommended Claude Code settings.json permissions. Use when setting up a new project, auditing existing settings, or determining which read-only bash commands to allow. Detects tech stack, build tools, and monorepo structure.

Claude Settings Audit

Analyze this repository and generate recommended Claude Code settings.json permissions for read-only commands.

Phase 1: Detect Tech Stack

Run these commands to detect the repository structure:

ls -la
find . -maxdepth 2 \( -name "*.toml" -o -name "*.json" -o -name "*.lock" -o -name "*.yaml" -o -name "*.yml" -o -name "Makefile" -o -name "Dockerfile" -o -name "*.tf" \) 2>/dev/null | head -50

Check for these indicator files:

Category	Files to Check
Python	`pyproject.toml`, `setup.py`, `requirements.txt`, `Pipfile`, `poetry.lock`, `uv.lock`
Node.js	`package.json`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`
Go	`go.mod`, `go.sum`
Rust	`Cargo.toml`, `Cargo.lock`
Ruby	`Gemfile`, `Gemfile.lock`
Java	`pom.xml`, `build.gradle`, `build.gradle.kts`
Build	`Makefile`, `Dockerfile`, `docker-compose.yml`
Infra	`*.tf` files, `kubernetes/`, `helm/`
Monorepo	`lerna.json`, `nx.json`, `turbo.json`, `pnpm-workspace.yaml`

Phase 2: Detect Services

Check for service integrations:

Service	Detection
Sentry	`sentry-sdk` in deps, `@sentry/*` packages, `.sentryclirc`, `sentry.properties`
Linear	Linear config files, `.linear/` directory

Read dependency files to identify frameworks:

package.json → check dependencies and devDependencies
pyproject.toml → check [project.dependencies] or [tool.poetry.dependencies]
Gemfile → check gem names
Cargo.toml → check [dependencies]

Phase 3: Check Existing Settings

cat .claude/settings.json 2>/dev/null || echo "No existing settings"

Phase 4: Generate Recommendations

Build the allow list by combining:

Baseline Commands (Always Include)

[
  "Bash(ls:*)",
  "Bash(pwd:*)",
  "Bash(find:*)",
  "Bash(file:*)",
  "Bash(stat:*)",
  "Bash(wc:*)",
  "Bash(head:*)",
  "Bash(tail:*)",
  "Bash(cat:*)",
  "Bash(tree:*)",
  "Bash(git status:*)",
  "Bash(git log:*)",
  "Bash(git diff:*)",
  "Bash(git show:*)",
  "Bash(git branch:*)",
  "Bash(git remote:*)",
  "Bash(git tag:*)",
  "Bash(git stash list:*)",
  "Bash(git rev-parse:*)",
  "Bash(gh pr view:*)",
  "Bash(gh pr list:*)",
  "Bash(gh pr checks:*)",
  "Bash(gh pr diff:*)",
  "Bash(gh issue view:*)",
  "Bash(gh issue list:*)",
  "Bash(gh run view:*)",
  "Bash(gh run list:*)",
  "Bash(gh run logs:*)",
  "Bash(gh repo view:*)",
  "Bash(gh api:*)"
]

Stack-Specific Commands

Only include commands for tools actually detected in the project.

#### Python (if any Python files or config detected)

If Detected	Add These Commands
Any Python	`python --version`, `python3 --version`
`poetry.lock`	`poetry show`, `poetry env info`
`uv.lock`	`uv pip list`, `uv tree`
`Pipfile.lock`	`pipenv graph`
`requirements.txt` (no other lock)	`pip list`, `pip show`, `pip freeze`

#### Node.js (if package.json detected)

If Detected	Add These Commands
Any Node.js	`node --version`
`pnpm-lock.yaml`	`pnpm list`, `pnpm why`
`yarn.lock`	`yarn list`, `yarn info`, `yarn why`
`package-lock.json`	`npm list`, `npm view`, `npm outdated`
TypeScript (`tsconfig.json`)	`tsc --version`

#### Other Languages

If Detected	Add These Commands
`go.mod`	`go version`, `go list`, `go mod graph`, `go env`
`Cargo.toml`	`rustc --version`, `cargo --version`, `cargo tree`, `cargo metadata`
`Gemfile`	`ruby --version`, `bundle list`, `bundle show`
`pom.xml`	`java --version`, `mvn --version`, `mvn dependency:tree`
`build.gradle`	`java --version`, `gradle --version`, `gradle dependencies`

#### Build Tools

If Detected	Add These Commands
`Dockerfile`	`docker --version`, `docker ps`, `docker images`
`docker-compose.yml`	`docker-compose ps`, `docker-compose config`
`*.tf` files	`terraform --version`, `terraform providers`, `terraform state list`
`Makefile`	`make --version`, `make -n`

Skills (for Sentry Projects)

If this is a Sentry project (or sentry-skills plugin is installed), include:

[
  "Skill(sentry-skills:agents-md)",
  "Skill(sentry-skills:blog-writing-guide)",
  "Skill(sentry-skills:brand-guidelines)",
  "Skill(sentry-skills:claude-settings-audit)",
  "Skill(sentry-skills:code-review)",
  "Skill(sentry-skills:code-simplifier)",
  "Skill(sentry-skills:commit)",
  "Skill(sentry-skills:create-branch)",
  "Skill(sentry-skills:django-access-review)",
  "Skill(sentry-skills:django-perf-review)",
  "Skill(sentry-skills:doc-coauthoring)",
  "Skill(sentry-skills:document-api-endpoint)",
  "Skill(sentry-skills:find-bugs)",
  "Skill(sentry-skills:gh-review-requests)",
  "Skill(sentry-skills:gha-security-review)",
  "Skill(sentry-skills:iterate-pr)",
  "Skill(sentry-skills:pr-link-issue)",
  "Skill(sentry-skills:pr-writer)",
  "Skill(sentry-skills:presentation-creator)",
  "Skill(sentry-skills:prompt-optimizer)",
  "Skill(sentry-skills:replay-ux-research)",
  "Skill(sentry-skills:security-review)",
  "Skill(sentry-skills:skill-scanner)",
  "Skill(sentry-skills:skill-writer)",
  "Skill(sentry-skills:sred-project-organizer)",
  "Skill(sentry-skills:sred-work-summary)",
  "Skill(sentry-skills:triage-frontend-issues)",
  "Skill(sentry-skills:typing-exclusion-worker)"
]

WebFetch Domains

#### Always Include (Sentry Projects)

[
  "WebFetch(domain:docs.sentry.io)",
  "WebFetch(domain:develop.sentry.dev)",
  "WebFetch(domain:docs.github.com)",
  "WebFetch(domain:cli.github.com)"
]

#### Framework-Specific

If Detected	Add Domains
Django	`docs.djangoproject.com`
Flask	`flask.palletsprojects.com`
FastAPI	`fastapi.tiangolo.com`
React	`react.dev`
Next.js	`nextjs.org`
Vue	`vuejs.org`
Express	`expressjs.com`
Rails	`guides.rubyonrails.org`, `api.rubyonrails.org`
Go	`pkg.go.dev`
Rust	`docs.rs`, `doc.rust-lang.org`
Docker	`docs.docker.com`
Kubernetes	`kubernetes.io`
Terraform	`registry.terraform.io`

MCP Server Suggestions

MCP servers are configured in .mcp.json (not settings.json). Check for existing config:

cat .mcp.json 2>/dev/null || echo "No existing .mcp.json"

#### Sentry MCP (if Sentry SDK detected)

Add to .mcp.json (replace {org-slug} and {project-slug} with your Sentry organization and project slugs):

{
  "mcpServers": {
    "sentry": {
      "type": "http",
      "url": "https://mcp.sentry.dev/mcp/{org-slug}/{project-slug}"
    }
  }
}

#### Linear MCP (if Linear usage detected)

Add to .mcp.json:

{
  "mcpServers": {
    "linear": {
      "command": "npx",
      "args": ["-y", "@linear/mcp-server"],
      "env": {
        "LINEAR_API_KEY": "${LINEAR_API_KEY}"
      }
    }
  }
}

Note: Never suggest GitHub MCP. Always use gh CLI commands for GitHub.

Output Format

Present your findings as:

Summary Table - What was detected
Recommended settings.json - Complete JSON ready to copy
MCP Suggestions - If applicable
Merge Instructions - If existing settings found

Example output structure:

## Detected Tech Stack

| Category        | Found          |
| --------------- | -------------- |
| Languages       | Python 3.x     |
| Package Manager | poetry         |
| Frameworks      | Django, Celery |
| Services        | Sentry         |
| Build Tools     | Docker, Make   |

## Recommended .claude/settings.json

\`\`\`json
{
"permissions": {
"allow": [
// ... grouped by category with comments
],
"deny": []
}
}
\`\`\`

## Recommended .mcp.json (if applicable)

If you use Sentry or Linear, add the MCP config to `.mcp.json`...

Important Rules

What to Include

Only READ-ONLY commands that cannot modify state
Only tools that are actually used by the project (detected via lock files)
Standard system commands (ls, cat, find, etc.)
The :* suffix allows any arguments to the base command

What to NEVER Include

Absolute paths - Never include user-specific paths like /home/user/scripts/foo or /Users/name/bin/bar
Custom scripts - Never include project scripts that may have side effects (e.g., ./scripts/deploy.sh)
Alternative package managers - If the project uses pnpm, do NOT include npm/yarn commands
Commands that modify state - No install, build, run, write, or delete commands

Package Manager Rules

Only include the package manager actually used by the project:

If Detected	Include	Do NOT Include
`pnpm-lock.yaml`	pnpm commands	npm, yarn
`yarn.lock`	yarn commands	npm, pnpm
`package-lock.json`	npm commands	yarn, pnpm
`poetry.lock`	poetry commands	pip (unless also has requirements.txt)
`uv.lock`	uv commands	pip, poetry
`Pipfile.lock`	pipenv commands	pip, poetry

If multiple lock files exist, include only the commands for each detected manager.

Install

Skill: SerpApi Agent Usability Test

by SerpApi

A protocol for measuring whether agents can discover and use your tool without being told about it — WITH/WITHOUT trials, binary scoring, and lift as the only metric. The subject under test is your docs, not the model.

Testing & QA

Skill: Sentry AI Agent Monitoring Setup

by Sentry

Sentry's official skill for instrumenting LLM and agent code — detects your installed AI SDK and wires up traces for model calls, tool use and token spend.

Development DevOps & Infrastructure

Skill: Sentry SDK Setup

by Sentry

Sentry's official router skill: detects your language or framework, then loads the matching Sentry SDK setup guide for error monitoring, tracing and session replay.

Development DevOps & Infrastructure

Skill: Django Performance Review

by Sentry

Sentry's Django performance review skill — hunts N+1 queries, unbounded querysets, missing indexes and write loops, and reports only findings it can prove.

Development Testing & QA

Browse all skills →

Install

Other ways to install

About

Try it

SKILL.md

Claude Settings Audit

Phase 1: Detect Tech Stack

Phase 2: Detect Services

Phase 3: Check Existing Settings

Phase 4: Generate Recommendations

Baseline Commands (Always Include)

Stack-Specific Commands

Skills (for Sentry Projects)

WebFetch Domains

MCP Server Suggestions

Output Format

Important Rules

What to Include

What to NEVER Include

Package Manager Rules

Related Skills

Skill: SerpApi Agent Usability Test

Skill: Sentry AI Agent Monitoring Setup

Skill: Sentry SDK Setup

Skill: Django Performance Review