Claude Settings Audit

SentryOfficialPublished by Sentry

Skill
Workflow
Agent tooling
Apache-2.0
No issues found

From the author

Analyze a repository to generate recommended Claude Code settings.json permissions. Use when setting up a new project, auditing existing settings, or determining which read-only bash commands to allow. Detects tech stack, build tools, and monorepo structure.

— the description by Sentry

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill performs a systematic audit of a project's directory structure, dependency files, and configuration to generate a tailored settings.json file for Claude Code. It identifies the tech stack, build tools, and service integrations to recommend a minimal, secure set of read-only permissions. By detecting specific package managers and frameworks, it ensures that only relevant, non-destructive commands are enabled, adhering to the principle of least privilege.

What it does

Scans the repository for configuration files to detect languages, frameworks, and build tools.
Identifies active package managers to suggest only relevant read-only commands.
Generates a structured settings.json file with categorized permissions.
Provides recommendations for .mcp.json configurations for services like Sentry or Linear.
Ensures security by excluding state-modifying commands and absolute paths.
Provides clear instructions for merging recommendations with existing configurations.

When to use it

When initializing Claude Code in a new project repository.
When auditing or updating existing Claude Code permission settings.
When you need to determine which read-only bash commands are safe to allow for an AI agent.
When setting up MCP servers for integrated services like Sentry or Linear.

Advantages

Promotes security by enforcing a strict read-only policy for AI agents.
Reduces configuration clutter by only suggesting tools relevant to the detected stack.
Standardizes agent permissions across different projects.
Simplifies the setup of complex MCP server integrations.

Usage examples

“Run the claude-settings-audit to generate my settings.json.”: The agent scans the project, identifies the stack (e.g., Python/Poetry), and outputs a formatted JSON block with appropriate read-only bash and skill permissions.
“Audit my current settings and suggest updates based on my new Docker setup.”: The agent detects the Dockerfile, compares it against existing settings, and provides the necessary additions for Docker-related read-only commands.

Install

Download the skill as a ZIP:
https://autogineer.com/agent-skills/getsentry/claude-settings-audit/download

Unzip it into the cross-client skills folder of your project:

mkdir -p .agents/skills && unzip claude-settings-audit.zip -d .agents/skills

Documentation by Sentry

Claude Settings Audit

Analyze this repository and generate recommended Claude Code settings.json permissions for read-only commands.

Phase 1: Detect Tech Stack

Run these commands to detect the repository structure:

ls -la
find . -maxdepth 2 \( -name "*.toml" -o -name "*.json" -o -name "*.lock" -o -name "*.yaml" -o -name "*.yml" -o -name "Makefile" -o -name "Dockerfile" -o -name "*.tf" \) 2>/dev/null | head -50

Check for these indicator files:

Category	Files to Check
Python	`pyproject.toml`, `setup.py`, `requirements.txt`, `Pipfile`, `poetry.lock`, `uv.lock`
Node.js	`package.json`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`
Go	`go.mod`, `go.sum`
Rust	`Cargo.toml`, `Cargo.lock`
Ruby	`Gemfile`, `Gemfile.lock`
Java	`pom.xml`, `build.gradle`, `build.gradle.kts`
Build	`Makefile`, `Dockerfile`, `docker-compose.yml`
Infra	`*.tf` files, `kubernetes/`, `helm/`
Monorepo	`lerna.json`, `nx.json`, `turbo.json`, `pnpm-workspace.yaml`

Phase 2: Detect Services

Check for service integrations:

Service	Detection
Sentry	`sentry-sdk` in deps, `@sentry/*` packages, `.sentryclirc`, `sentry.properties`
Linear	Linear config files, `.linear/` directory

Read dependency files to identify frameworks:

package.json → check dependencies and devDependencies
pyproject.toml → check [project.dependencies] or [tool.poetry.dependencies]
Gemfile → check gem names
Cargo.toml → check [dependencies]

Phase 3: Check Existing Settings

cat .claude/settings.json 2>/dev/null || echo "No existing settings"

Phase 4: Generate Recommendations

Build the allow list by combining:

Baseline Commands (Always Include)

[
  "Bash(ls:*)",
  "Bash(pwd:*)",
  "Bash(find:*)",
  "Bash(file:*)",
  "Bash(stat:*)",
  "Bash(wc:*)",
  "Bash(head:*)",
  "Bash(tail:*)",
  "Bash(cat:*)",
  "Bash(tree:*)",
  "Bash(git status:*)",
  "Bash(git log:*)",
  "Bash(git diff:*)",
  "Bash(git show:*)",
  "Bash(git branch:*)",
  "Bash(git remote:*)",
  "Bash(git tag:*)",
  "Bash(git stash list:*)",
  "Bash(git rev-parse:*)",
  "Bash(gh pr view:*)",
  "Bash(gh pr list:*)",
  "Bash(gh pr checks:*)",
  "Bash(gh pr diff:*)",
  "Bash(gh issue view:*)",
  "Bash(gh issue list:*)",
  "Bash(gh run view:*)",
  "Bash(gh run list:*)",
  "Bash(gh run logs:*)",
  "Bash(gh repo view:*)",
  "Bash(gh api:*)"
]

Stack-Specific Commands

Only include commands for tools actually detected in the project.

Python (if any Python files or config detected)

If Detected	Add These Commands
Any Python	`python --version`, `python3 --version`
`poetry.lock`	`poetry show`, `poetry env info`
`uv.lock`	`uv pip list`, `uv tree`
`Pipfile.lock`	`pipenv graph`
`requirements.txt` (no other lock)	`pip list`, `pip show`, `pip freeze`

Node.js (if package.json detected)

If Detected	Add These Commands
Any Node.js	`node --version`
`pnpm-lock.yaml`	`pnpm list`, `pnpm why`
`yarn.lock`	`yarn list`, `yarn info`, `yarn why`
`package-lock.json`	`npm list`, `npm view`, `npm outdated`
TypeScript (`tsconfig.json`)	`tsc --version`

Other Languages

If Detected	Add These Commands
`go.mod`	`go version`, `go list`, `go mod graph`, `go env`
`Cargo.toml`	`rustc --version`, `cargo --version`, `cargo tree`, `cargo metadata`
`Gemfile`	`ruby --version`, `bundle list`, `bundle show`
`pom.xml`	`java --version`, `mvn --version`, `mvn dependency:tree`
`build.gradle`	`java --version`, `gradle --version`, `gradle dependencies`

Build Tools

If Detected	Add These Commands
`Dockerfile`	`docker --version`, `docker ps`, `docker images`
`docker-compose.yml`	`docker-compose ps`, `docker-compose config`
`*.tf` files	`terraform --version`, `terraform providers`, `terraform state list`
`Makefile`	`make --version`, `make -n`

Skills (for Sentry Projects)

If this is a Sentry project (or sentry-skills plugin is installed), include:

[
  "Skill(sentry-skills:agents-md)",
  "Skill(sentry-skills:blog-writing-guide)",
  "Skill(sentry-skills:brand-guidelines)",
  "Skill(sentry-skills:browse-local-sentry)",
  "Skill(sentry-skills:claude-settings-audit)",
  "Skill(sentry-skills:code-review)",
  "Skill(sentry-skills:code-simplifier)",
  "Skill(sentry-skills:commit)",
  "Skill(sentry-skills:create-branch)",
  "Skill(sentry-skills:django-access-review)",
  "Skill(sentry-skills:django-perf-review)",
  "Skill(sentry-skills:doc-coauthoring)",
  "Skill(sentry-skills:document-api-endpoint)",
  "Skill(sentry-skills:find-bugs)",
  "Skill(sentry-skills:gh-review-requests)",
  "Skill(sentry-skills:gha-security-review)",
  "Skill(sentry-skills:iterate-pr)",
  "Skill(sentry-skills:pr-link-issue)",
  "Skill(sentry-skills:pr-screenshots)",
  "Skill(sentry-skills:pr-writer)",
  "Skill(sentry-skills:presentation-creator)",
  "Skill(sentry-skills:prompt-optimizer)",
  "Skill(sentry-skills:secret-serialization)",
  "Skill(sentry-skills:security-model)",
  "Skill(sentry-skills:security-review)",
  "Skill(sentry-skills:skill-scanner)",
  "Skill(sentry-skills:skill-writer)",
  "Skill(sentry-skills:sred-project-organizer)",
  "Skill(sentry-skills:sred-work-summary)",
  "Skill(sentry-skills:triage-frontend-issues)",
  "Skill(sentry-skills:typing-exclusion-worker)"
]

WebFetch Domains

Always Include (Sentry Projects)

[
  "WebFetch(domain:docs.sentry.io)",
  "WebFetch(domain:develop.sentry.dev)",
  "WebFetch(domain:docs.github.com)",
  "WebFetch(domain:cli.github.com)"
]

Framework-Specific

If Detected	Add Domains
Django	`docs.djangoproject.com`
Flask	`flask.palletsprojects.com`
FastAPI	`fastapi.tiangolo.com`
React	`react.dev`
Next.js	`nextjs.org`
Vue	`vuejs.org`
Express	`expressjs.com`
Rails	`guides.rubyonrails.org`, `api.rubyonrails.org`
Go	`pkg.go.dev`
Rust	`docs.rs`, `doc.rust-lang.org`
Docker	`docs.docker.com`
Kubernetes	`kubernetes.io`
Terraform	`registry.terraform.io`

MCP Server Suggestions

MCP servers are configured in .mcp.json (not settings.json). Check for existing config:

cat .mcp.json 2>/dev/null || echo "No existing .mcp.json"

Sentry MCP (if Sentry SDK detected)

Add to .mcp.json (replace {org-slug} and {project-slug} with your Sentry organization and project slugs):

{
  "mcpServers": {
    "sentry": {
      "type": "http",
      "url": "https://mcp.sentry.dev/mcp/{org-slug}/{project-slug}"
    }
  }
}

Linear MCP (if Linear usage detected)

Add to .mcp.json:

{
  "mcpServers": {
    "linear": {
      "command": "npx",
      "args": ["-y", "@linear/mcp-server"],
      "env": {
        "LINEAR_API_KEY": "${LINEAR_API_KEY}"
      }
    }
  }
}

Note: Never suggest GitHub MCP. Always use gh CLI commands for GitHub.

Output Format

Present your findings as:

Summary Table - What was detected
Recommended settings.json - Complete JSON ready to copy
MCP Suggestions - If applicable
Merge Instructions - If existing settings found

Example output structure:

## Detected Tech Stack

| Category        | Found          |
| --------------- | -------------- |
| Languages       | Python 3.x     |
| Package Manager | poetry         |
| Frameworks      | Django, Celery |
| Services        | Sentry         |
| Build Tools     | Docker, Make   |

## Recommended .claude/settings.json

\`\`\`json
{
"permissions": {
"allow": [
// ... grouped by category with comments
],
"deny": []
}
}
\`\`\`

## Recommended .mcp.json (if applicable)

If you use Sentry or Linear, add the MCP config to `.mcp.json`...

Important Rules

What to Include

Only READ-ONLY commands that cannot modify state
Only tools that are actually used by the project (detected via lock files)
Standard system commands (ls, cat, find, etc.)
The :* suffix allows any arguments to the base command

What to NEVER Include

Absolute paths - Never include user-specific paths like /home/user/scripts/foo or /Users/name/bin/bar
Custom scripts - Never include project scripts that may have side effects (e.g., ./scripts/deploy.sh)
Alternative package managers - If the project uses pnpm, do NOT include npm/yarn commands
Commands that modify state - No install, build, run, write, or delete commands

Package Manager Rules

Only include the package manager actually used by the project:

If Detected	Include	Do NOT Include
`pnpm-lock.yaml`	pnpm commands	npm, yarn
`yarn.lock`	yarn commands	npm, pnpm
`package-lock.json`	npm commands	yarn, pnpm
`poetry.lock`	poetry commands	pip (unless also has requirements.txt)
`uv.lock`	uv commands	pip, poetry
`Pipfile.lock`	pipenv commands	pip, poetry

If multiple lock files exist, include only the commands for each detected manager.

Files

ATTRIBUTION.mdAdded by AutoGineer866 B
LICENSELicence file added by AutoGineer10.5 KiB
SKILL.md11.8 KiB

Requirements and compatibility

Written for: Claude Code

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Needs: Names Claude Code tools, Needs an MCP server, Needs an API key, Needs Python, Needs Node.js

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by

Sentry

Publisher

Sentry (Official)

Source

getsentry/skills · skills/claude-settings-audit · commit e94f222

Licence

Apache License 2.0 (redistribution allowed)

LICENSE (added by AutoGineer from LICENSE)
ATTRIBUTION.md (written by AutoGineer)

Synced

2026-11-09

AutoGineer is not affiliated with or endorsed by Sentry or Sentry.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download claude-settings-audit.zip

From the author

AutoGineer summary

What it does

When to use it

Advantages

Usage examples

Install

Documentation by Sentry

Claude Settings Audit

Phase 1: Detect Tech Stack

Phase 2: Detect Services

Phase 3: Check Existing Settings

Phase 4: Generate Recommendations

Baseline Commands (Always Include)

Stack-Specific Commands

Python (if any Python files or config detected)

Node.js (if package.json detected)

Other Languages

Build Tools

Skills (for Sentry Projects)

WebFetch Domains

Always Include (Sentry Projects)

Framework-Specific

MCP Server Suggestions

Sentry MCP (if Sentry SDK detected)

Linear MCP (if Linear usage detected)

Output Format

Important Rules

What to Include

What to NEVER Include

Package Manager Rules

Files

Requirements and compatibility

Security

Attribution and licence

Related skills

Setup Matt Pocock Skills

Writing For Agents

Loop Me

Writing Skills

Diagnosing Superpowers

Skill Creator

Download ZIP