Skip to content

expand allowed read operations #326

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
stackptr merged 5 commits into from
Mar 7, 2026
Merged

expand allowed read operations #326

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
92e57fe
allow gh read operations
stackptr Mar 7, 2026
e7dc934
allow more gh read operations
stackptr Mar 7, 2026
38708e0
expand pre-approved read permissions
stackptr Mar 7, 2026
25f07a9
narrow permissions to reduce security risks
stackptr Mar 7, 2026
9658108
remove curl from pre-approved permissions
stackptr Mar 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
85 changes: 73 additions & 12 deletions modules/home/development.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,31 +43,92 @@ in {
enabledMcpjsonServers = ["linear" "figma"];
permissions = {
allow = [
"Bash(find *)"
# File exploration
"Bash(cat *)"
"Bash(cut *)"
"Bash(diff *)"
"Bash(du *)"
"Bash(echo *)"
"Bash(file *)"
"Bash(find * -name *)"
"Bash(find * -type *)"
"Bash(find * -path *)"
"Bash(grep *)"
"Bash(rg *)"
"Bash(head *)"
"Bash(tail *)"
"Bash(cat *)"
"Bash(jq *)"
"Bash(ls *)"
"Bash(readlink *)"
"Bash(realpath *)"
"Bash(rg *)"
"Bash(sort *)"
"Bash(tail *)"
"Bash(tr *)"
"Bash(uniq *)"
"Bash(wc *)"
"Bash(which *)"
"Bash(nix *)"
# Environment
"Bash(env)"
"Bash(hostname)"
"Bash(printenv *)"
"Bash(pwd)"
"Bash(whoami)"
# Networking
"Bash(dig *)"
"Bash(nslookup *)"
"Bash(ping -c *)"
# Nix
"Bash(nix build *)"
"Bash(nix develop *)"
"Bash(nix eval *)"
"Bash(nix flake *)"
"Bash(nix fmt *)"
"Bash(nix log *)"
"Bash(nix path-info *)"
"Bash(nix profile list*)"
"Bash(nix registry list*)"
"Bash(nix search *)"
"Bash(nix show-derivation *)"
"Bash(nix store *)"
"Bash(nix why-depends *)"
"Bash(nix-eval-flake *)"
"Bash(git log *)"
"Bash(git diff *)"
"Bash(git status)"
"Bash(git show *)"
# Git
"Bash(git add *)"
"Bash(git blame *)"
"Bash(git branch *)"
"Bash(git diff *)"
"Bash(git log *)"
"Bash(git remote -v*)"
"Bash(git remote show *)"
"Bash(git show *)"
"Bash(git stash list*)"
"Bash(git status)"
"Bash(git tag -l *)"
"Bash(git tag --list *)"
# GitHub CLI
"Bash(gh api:*)"
"Bash(mkdir *)"
"Bash(gh issue list*)"
"Bash(gh issue status*)"
"Bash(gh issue view*)"
"Bash(gh pr checks*)"
"Bash(gh pr diff*)"
"Bash(gh pr list*)"
"Bash(gh pr status*)"
"Bash(gh pr view*)"
"Bash(gh release list*)"
"Bash(gh release view*)"
"Bash(gh repo view*)"
"Bash(gh run list*)"
"Bash(gh run view*)"
"Bash(gh search:*)"
# Graphite
"Bash(gt log*)"
"Bash(gt ls*)"
"Bash(gt status*)"
# System
"Bash(journalctl:*)"
"Bash(mkdir *)"
"Bash(systemctl list-jobs:*)"
"Bash(systemctl status:*)"
"Bash(* --version)"
"Bash(* --help *)"
"WebFetch(domain:raw.githubusercontent.com)"
"WebFetch(domain:github.com)"
"WebSearch"
Expand Down