/hone

Claude Code Config Schema

Purpose: Comprehensive reference for all Claude Code configuration keys, default values, environment variables, and recommended settings. Read when: Auditing ~/.claude/ or proposing configuration changes. Last updated: 2026-03-12

Config File Locations

Note: Array settings (permissions.allow, sandbox.filesystem.allowWrite, etc.) are merged across scopes.

JSON Schema

{
  "$schema": "https://json.schemastore.org/claude-code-settings.json"
}

Enables autocompletion and validation in editors.

Core Settings

UI & Display Customization

StatusLine

StatusLine JSON input fields: workspace, model, cost, context_window, session_id, transcript_path

FileSuggestion

Attribution

Permissions

Permission Pattern Syntax

Recommended Deny Rules

"deny": [
  "Bash(curl *)",
  "Bash(wget *)",
  "Read(./.env)",
  "Read(./.env.*)",
  "Read(./secrets/**)",
  "Read(./**/*credentials*)",
  "Read(./**/*secret*)"
]

curl/wget are prompt injection vectors — officially recommended to block.

Permission Audit Criteria

• CCP1: Broad Bash allow in global settings is risky
• CCP2: Missing deny rules for destructive operations
• CCP3: Same pattern in both allow and deny (deny wins, but redundant)
• CCP4: References to tools/servers that no longer exist

Sandbox Settings

Sandbox Filesystem

Sandbox Network

Sandbox Path Prefixes

Environment Variables (env block)

Model & Performance Tuning

MCP & Tool Optimization

Bash Execution Control

Privacy & Telemetry

Feature Flags

Authentication & Provider

Telemetry & Monitoring

Miscellaneous

Hooks Configuration

Note: This section defines Hone's audit scope. Detailed hook design, configuration, and debugging use Hone's explicit hook* recipes and reference/hooks/.

Hook-Related Settings

Hook Audit Criteria (Structural Only)

• Validity: Hook commands are executable and paths exist
• Security: No plaintext secrets in hook commands or environment
• Matcher validity: Tool matchers reference existing tools
• Recipe switch: Complex hook logic should be reviewed through the matching Hone hook* recipe

MCP Server Configuration

{
  "mcpServers": {
    "server-name": {
      "command": "npx",
      "args": ["-y", "@scope/mcp-server"],
      "env": { "API_KEY": "${env:API_KEY}" }
    }
  }
}

MCP-Related Settings

MCP Audit Criteria

• CCS1: Server command exists and is executable
• CCS2: No unused/orphaned server configs
• CCS3: No plaintext secrets — use ${env:VAR} syntax
• CCS4: Server packages are current
• CCS5: Global vs project placement is appropriate

Plugin Settings

Agent Teams

Authentication Helpers

CLAUDE.md Instruction Files

CLAUDE.md Audit Criteria

• CCI1: At least one instruction file exists (global recommended)
• CCI2: Content reflects current project state and tool capabilities
• CCI3: No API keys, tokens, or credentials in instruction files
• CCI4: Project and global instructions are consistent

Custom Slash Commands vs Skills

Command Audit Criteria

• CCK1: Command files are valid Markdown
• CCK2: No hardcoded secrets in command templates

Model Configuration

Current Model Identifiers

ultracode in the Claude Code effort menu is not an API effort level — it pairs xhigh with standing permission to launch multi-agent workflows.

Authentication

Auth Audit Criteria

• CCA1: Authentication method is set up and working
• CCA2: ANTHROPIC_API_KEY not hardcoded in settings.json or CLAUDE.md
• Env var security: API keys use environment variables, not file literals

NEVER read: ~/.claude/credentials.json, ~/.claude/statsig/, or any auth/session files.

Power User Hacks & Tips

Context Optimization

Workflow Optimization

Parallel Execution Tips

• Multiple terminal tabs with numbered instances
• claude.ai/code for web sessions in parallel
• /teleport to bring cloud sessions local
• Ctrl+B to move subagents to background

Version History

This schema should be refreshed when major Claude Code versions are released. Check reference/web-sources.md for staleness thresholds.