Handsfree for Claude Code

Install: VS Code Marketplace · Open VSX (Cursor / VSCodium) · or run code --install-extension argalla.handsfree-claude-code.

Let Claude Code work without asking for permission — using only its own, native settings. One command turns on Claude Code's bypass permissions mode the way Anthropic designed it (no hooks, no auto-clicking, no usage quotas), one command reverts it byte-for-byte, and a Doctor tells you exactly why Claude is still asking when something else on your machine gets in the way.

Not affiliated with, endorsed by, or sponsored by Anthropic. "Claude" is a trademark of Anthropic, PBC. This extension only writes settings that Claude Code and its official VS Code extension document and expose.

Leer en español

Why this exists

Every "auto-accept" extension out there does the same thing with a different hack: a PreToolUse hook that says yes to everything, a script that types into your terminal, or DevTools clicking the button for you. All of them sit in front of Claude Code's permission system, and all of them fail the same way: when the hook breaks, its paid quota runs out, or Claude Code changes a detail, you're suddenly asked to confirm every single tool call — and nothing on screen tells you why.

Claude Code already ships an autonomous mode. It's just spread over four settings in two files, plus a one-time confirmation dialog that is easy to miss inside VS Code, plus a "last mode you picked" memory in the extension that silently outranks your settings. Handsfree sets those four settings, and then gets out of the way.

Do you actually need this? On Pro, Max and Team plans Claude Code now starts in auto mode, where a second model approves routine actions and blocks dangerous ones. If auto already works for you, keep it — it is the safer choice and needs no extension. Handsfree is for the cases where you want zero prompts and accept the trade-off below.

What it does

The four native settings

skipDangerousModePermissionPrompt is a top-level key (that is where the CLI itself stores the answer), even though the docs list it next to the permissions.* settings. CLAUDE_CONFIG_DIR is honoured as the VS Code process sees it — if you only export it in a shell profile, a VS Code launched from the Dock/Start menu will not see it; use handsfree.claudeSettingsPath (machine scope) in that case.

What it deliberately does not do

• No hooks. Nothing intercepts permission decisions at runtime, so nothing can start answering "ask" behind your back.
• No auto-clicking, no terminal typing. Nothing to break when the UI changes.
• No quota, no counter, no "upgrade to keep going".
• Nothing runs at startup. The extension activates only when you run one of its commands.
• No telemetry, no network in the free features. The only network call in the whole extension is Pro licence activation and its 24-hourly re-validation, and only on machines where you entered a licence key. See PRIVACY.md.

The Doctor

Each check comes with a one-click fix where one is safe:

Safety

• Consent first. Enable shows a modal that explains what bypass mode means and lists the files that will change. Nothing is written before you accept.
• Backups. A byte-exact copy of ~/.claude/settings.json is saved to ~/.claude/backups/handsfree/ before every write (Enable, Revert, Doctor fixes); the newest 10 are kept, the copy behind Revert is never pruned. Those copies contain whatever your settings contain — including env blocks with API keys — with the same file permissions as the original.
• Revert is real. It restores the original file and the two VS Code keys, and takes a copy of the current file first. Enable → Enable → Revert still returns to the original state.
• Never on a broken file. If settings.json is invalid, nothing is written; the Doctor opens it at the offending line.
• Bypass mode is Anthropic's, with Anthropic's rules — and Anthropic's warning. The official guidance is to use it only in isolated environments like containers, VMs or dev containers without internet access, where Claude Code cannot damage your host system. ask and deny rules still apply, rm -rf / and rm -rf ~ still prompt (circuit breaker), and Claude Code refuses to run in this mode as root. Read the official page before enabling.

Pro

The free version keeps Enable, Revert and the Doctor forever — that is the whole point of the extension and it will never be gated. Pro is a one-time licence (7 €) for the things that save time once you trust it:

Licences are sold through Polar (merchant of record: they invoice and handle VAT, so the checkout shows the final price for your country). Activation sends your key, this computer's name, your OS and the extension version to Polar — never anything from your settings; the licence keeps working offline for 14 days between checks, and a bad answer from the licence server is never final (it is retried after 24 h); if Polar reports the key as revoked (for example after a refund), Pro switches off at the next check — and back on if the key is re-enabled. Activations per key are a limit configured on the licence (three by default); deactivate on one computer to move it. Removing anything Pro added — a careful profile, a guardrail set — is always free, so a lapsed licence can never leave you stuck with prompts. See PRIVACY.md.

Requirements

• VS Code 1.95+. Cursor / VSCodium / Windsurf install it from Open VSX; the extension uses only standard APIs, but those hosts have not been tested yet.
• Claude Code CLI; the official Claude Code extension (anthropic.claude-code) for the VS Code side. Without it, only the CLI settings are written.
• Remote-SSH / WSL / Dev Containers: runs where Claude Code runs (extensionKind: workspace). Extensions installed on the other side are not visible to the Doctor.

FAQ

I enabled it and Claude still asked once. The first conversation right after installing or upgrading Claude Code ignores settings files; the second one honours them. Also reload the window after enabling.

It asks in one project only. That project has .claude/settings.json or settings.local.json pinning a mode or disabling bypass — the Doctor shows it. That's a per-project profile, possibly deliberate.

It asks for git push --force / a specific command. An ask rule (yours or your organisation's) still forces a prompt in bypass mode. That's by design.

Does this work with claude in the terminal? Yes: permissions.defaultMode covers terminal sessions; the two VS Code keys cover the extension.

Can my organisation block this? Yes. permissions.disableBypassPermissionsMode: "disable" in managed settings wins over everything; Handsfree reads the file-based managed settings and refuses to write when they forbid bypass.

Settings

Contributing

MIT-licensed, built by Argalla (Tecniart Galicia SL). Issues and PRs at github.com/TecniartGalicia/handsfree-claude-code. See CONTRIBUTING.md; security reports per SECURITY.md.

License

MIT © 2026 Tecniart Galicia SL (Argalla).