Blog · 2026-11-06

Before you trust a cloned repo, read its .claude/settings.json: what 5,864 public repos turn on

We read the project settings of 5,864 active public repos. 54% define hooks and 20% run one when a session starts. Hooks and env apply even under claude -p, before any trust prompt.

Summary

Before you open Claude Code in a repo you cloned, open its .claude/settings.json and read four keys: hooks, env, permissions and enableAllProjectMcpServers. If you run Claude Code headless in that repo, add one of the two flags the docs recommend.

The reason is simple. A repo’s settings file is not all held back until you trust the folder. The docs split it in two:

Used before you trust the folder: the file’s hooks, its env block, and helper commands such as apiKeyHelper. This applies when you trusted only a parent folder, and in every claude -p or SDK run, which never shows a trust prompt.
Held for the trust dialog: permissions.allow rules and additionalDirectories. The dialog “lists the rules and directories the folder would grant” so you can review them first.

So a settings file can run commands on your machine before you have seen a dialog. Its env can also change where Claude Code sends your requests.

How common are these in practice? We read the project settings of 5,864 active public repos.

Our picks

What we now check in .claude/settings.json before running Claude Code in a repo we didn’t write:

hooks, starting with SessionStart. Each hook is a shell command, and a SessionStart hook runs as the session starts. Read the scripts the commands call, not just the command lines.
env. Look for ANTHROPIC_BASE_URL, which sets where Claude Code sends requests, and OTEL_EXPORTER_OTLP_*_ENDPOINT, which sets where telemetry goes. Also check proxy and certificate variables.
permissions, when the trust dialog lists it. Before you accept, read every allow rule. Bash(python:*), Bash(node:*) or Bash(npx:*) lets any code run through that interpreter. Bash(rm:*), Bash(curl:*) and Bash(git push:*) say what they allow. Also look at defaultMode and additionalDirectories.
enableAllProjectMcpServers and enabledMcpjsonServers. These approve the repo’s .mcp.json servers ahead of time.

For headless runs in a repo you haven’t reviewed, the docs give two flags:

claude -p --setting-sources user "…" reads neither the project’s settings files nor its .mcp.json.
claude -p --settings '{"disableAllHooks": true}' "…" turns hooks off for that run. Setting disableAllHooks in your own user settings is not enough, because the repo’s project settings take precedence and can set it back to false.

One more file: a .claude/settings.local.json tracked in git is treated as repo-supplied, so it gets the same review.

How we tested

Find settings files. GitHub code search reports about 91,976 files matching filename:settings.json path:.claude. Search returns at most 1,000 results per query, so we split it into 95 file-size slices.
- A 30-minute pass finished only 7 slices, all under 300 bytes. Two short passes then took one page from every other slice, so every size range is sampled. Search took about 53 minutes in total.
- The sample we report keeps at most 100 files per slice, 9,174 files, so no size range outweighs the others. Using all 14,178 sampled files changes no share by more than half a point.
Filter repos. At least 5 stars, pushed to since October 7, not a fork, not archived: 5,864 repos.
Read every project settings file in those repos. 6,099 files, plus the scripts their hooks name. We parsed them as JSON and recorded key names and categories only, never values. Nothing was run.
Count by repo. The share of repos with at least one settings file that does each thing. Most repos have one settings file, so counting by file gives the same numbers.

Results

Used before you trust the folder

What the repo’s settings do	Repos (of 5,864)
Define shell hooks	53.7%
Run a hook when a session starts (SessionStart or Setup)	20.3%
Run a hook before each tool call (PreToolUse)	28.5%
Run a hook after each tool call (PostToolUse)	27.3%
Run a hook on each prompt you send (UserPromptSubmit)	7.0%
Call a hook script that writes files	20.6%
Call a hook script that goes online	4.7%
Set environment variables (`env`)	8.5%
Set a status line command	3.1%

Held for the trust dialog

What the repo’s settings allow	Repos
Any allow rule	47.2%
Bash for an interpreter or runner (python, node, bash, npx…)	19.8%
Bash for rm, curl, sudo, ssh, git push and similar	11.4%
MCP tools	9.6%
Write or Edit with no path limit	4.9%
WebFetch for any site	3.2%
Extra working directories	3.0%
Any Bash command	2.4%
A default mode of `auto`, `dontAsk`, `acceptEdits` or `bypassPermissions`	3.2% (bypassPermissions alone: 0.9%)

MCP servers and plugins: 19.0% enable plugins or add a marketplace, 2.6% approve named .mcp.json servers, and 2.4% approve all of them.

Restrictions, the good kind: 20.3% add deny rules, 5.7% add ask rules and 1.0% turn on the sandbox.

Quick guess: in how many repos does the settings file change where Claude Code sends your requests? Few: 8 of 5,864 set ANTHROPIC_BASE_URL. Three point to localhost. Five point to a remote model gateway or another provider’s API, which looks like authors using their own gateway. If you run claude -p in one of those repos, your requests go there too. Four more send OpenTelemetry data to a remote collector the author set up.

Where a keyword told us what a hook does, PreToolUse hooks are mostly guards that block or check a command, and PostToolUse hooks are often formatters and linters. Many hooks matched no keyword, so treat this as a direction, not a count.

What to ignore

The size of the file. A long settings file full of deny rules is protective, and a three-line file with one SessionStart hook and an ANTHROPIC_BASE_URL deserves the closer read. Look at what runs before the trust dialog and where the requests go.

Limitations

A sample. About 10% of matching files, from active repos with 5 or more stars, as of November 6, 2026. Code search ranks results by relevance within each slice, so this is not a random sample.
Static only. We did not run any hook, so we don’t know what each one does at runtime or what telemetry sends.
Capabilities, not intent. Almost everything here is authors setting up their own workflow. Nothing we read by hand looked malicious, and we did not read every hook.
Key names only. We did not read environment values, apart from the host name of the endpoint variables.

Reproduce it

The counts above are in project-settings-2026-11.json, with repo names and all values left out. To check a repo yourself, open .claude/settings.json and read the four keys in the first section.

For the other half of a cloned repo, its .claude/skills/ folder, see our review of 41,142 project skills.

All of our checks are on one page: the Claude Code safety checklist.