Claude Code YOLO: Permission Modes and Working Without Prompts

When people search for "claude code yolo" they usually mean one thing: they are tired of confirming every command and want the agent to just work. Claude Code has no mode literally called YOLO, but it has permission modes, rules and one flag that disables checks entirely. Let's go through which one to pick so you get rid of pointless prompts without handing the agent more power than it needs.

Claude Code YOLO: what it really is

The folk name "YOLO" corresponds to the bypassPermissions mode, enabled with the --dangerously-skip-permissions flag. The flag name is no accident: it removes almost all confirmation prompts. But between "ask about everything" and "ask about nothing" there are intermediate modes. According to Anthropic's documentation there are six:

You can switch modes during a session with Shift+Tab, and the starting mode is set with the --permission-mode flag or the permissions.defaultMode setting. Exact versions and the cycle order depend on the Claude Code release, so check claude --help and the documentation.

Rules first, modes second

Most of the time you do not need full autopilot. What annoys you is three or four repeated commands: npm test, git status, git diff. It is easier to allow those with rules. Open /permissions or add a block to settings.json:

{
  "permissions": {
    "allow": [
      "Bash(npm run *)",
      "Bash(git status)",
      "Bash(git diff *)",
      "Bash(git commit *)"
    ],
    "deny": [
      "Bash(git push *)",
      "Read(./.env)"
    ]
  }
}

Rules are evaluated in the order deny, ask, allow, and the first match decides. A narrow allow cannot carve an exception out of a broader deny. The asterisk in a Bash rule stands for any text, so Bash(npm run *) covers npm run build and npm run test --watch, but not npm install. The space before a trailing asterisk matters: Bash(ls *) does not match lsof, while Bash(ls*) does.

Claude Code splits compound commands into parts: safe-cmd && other-cmd will not pass on a rule for the first half only. That protects against smuggling, but it means chains must be allowed link by link. Another quick path: choose "Yes, and don't ask again" on a prompt, and the rule is saved to .claude/settings.local.json.

An important caveat from the documentation: rules are enforced by Claude Code itself, not by the model. Asking in a prompt or in CLAUDE.md not to run git push guarantees nothing, while a deny rule always works, including in bypassPermissions.

acceptEdits: the middle ground for your own project

If the project is under git, acceptEdits often solves the problem: edits to files in the working directory and simple filesystem commands run without questions, while everything else still asks. You review the result with git diff. It suits tasks like "rename this function across all modules and fix the tests". The mode does not cover protected paths or arbitrary Bash commands.

Auto mode and the classifier

In auto mode a second model, the classifier, evaluates actions instead of you: it blocks what goes beyond your request or looks like following instructions found in text the agent read. The documentation states that the mode does not guarantee safety. Availability depends on the model and provider: the documentation lists the Anthropic API and cloud platforms as providers where the mode is on by default, and separately warns that LLM gateways and proxies can interfere with action review. So on a gateway, check on the spot: if auto is not in the Shift+Tab cycle, it is unavailable, and you should rely on rules and acceptEdits.

bypassPermissions: when it is justified

Turning checks off entirely makes sense in one scenario: the agent runs inside a container or a virtual machine where it cannot harm the host, and you collect the result as an artifact or a commit. The documentation says plainly that this mode offers no protection against prompt injection or unintended actions.

claude -p "run the tests and fix the failing ones" --dangerously-skip-permissions

Good to know in advance:

• on first launch a warning dialog appears, and your consent is stored in ~/.claude/settings.json;
• on Linux and macOS Claude Code refuses to start in this mode as root or via sudo unless a recognized sandbox is detected;
• deny rules still apply, while allow rules have no effect in this mode;
• for non-interactive CI runs, dontAsk with an exact allowlist is safer: claude -p "..." --permission-mode dontAsk --allowedTools "Bash(npm test)" "Read".

Money: autonomy and token spend

An agent without prompts works faster, which means it also spends faster. A looping task with a growing context can drain a balance in an evening. A safety net on the gateway side: a separate key for autonomous runs with daily and monthly dollar limits and a short list of allowed models. When a limit is reached you get a 429 with key_daily_limit_reached or key_monthly_limit_reached. Setup is covered in the articles on per-key limits↗ and the looping agent↗.

Let's estimate a ceiling. Prices as of October 18, 2026, claude-sonnet-5-5: $0.4 per 1M input and $2 per 1M output. Assume (illustrative volumes) an autonomous session fed the model 8M input tokens without caching and received 300 thousand output tokens: 8 × 0.4 + 0.3 × 2 = 3.2 + 0.6 = $3.80. In the Anthropic format that Claude Code uses, repeated context is read from cache at a lower price, but the key limit sets the ceiling regardless. Current prices: GET https://api.zukko.pro/v1/models or the Models page in the dashboard.

What about Qwen Code

Qwen Code has a mode with exactly this name. According to the project's documentation, /approval-mode yolo enables it for the current session, and with the --project or --user flags it is saved as the default. In .qwen/settings.json it looks like this:

{
  "tools": {
    "approvalMode": "yolo"
  }
}

Modes cycle with Shift+Tab (Tab on Windows): plan, default, auto-edit, auto, yolo. The warnings are the same: trusted code only, committed files, a controlled environment. Connecting Qwen Code to the gateway is described in the article on Qwen Code CLI↗.

You can connect Claude Code to the gateway following the documentation↗: create a key in the dashboard, set ANTHROPIC_BASE_URL=https://api.zukko.pro and ANTHROPIC_AUTH_TOKEN, then tune the rules to your project.

FAQ

Does Claude Code have a yolo flag?

No. The closest equivalent is --dangerously-skip-permissions, which is the same as starting with --permission-mode bypassPermissions.

How do I allow a command permanently without disabling all checks?

Choose "Yes, and don't ask again" on the prompt, or add a Bash(command *) rule to allow through /permissions. The rule is saved for the repository.

Can I run bypassPermissions on my work laptop?

The documentation recommends it only for isolated environments: containers, virtual machines, dev containers. If you need autonomy on your own machine, start with acceptEdits and rules.

How do I cap the spending of an autonomous agent?

Create a separate key with a daily limit and a list of allowed models, and top up the balance in small amounts. Top-ups from $1 are available via SBP (the payment page adds an 8.5% fee), with a MasterCard card or with cryptocurrency.