Dippy CLI
A Bash command hook for Claude Code that auto-approves safe commands, stops dangerous ones and steers the agent to another route
- 244 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- Approves Bash commands automatically without asking you, so a wrong safety judgment skips a prompt you needed
- Writes a hook into `~/.claude/settings.json` and reads rules from `~/.dippy/config` and `.dippy`
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/dippyDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- Approves Bash commands automatically without asking you, so a wrong safety judgment skips a prompt you needed
- Writes a hook into `~/.claude/settings.json` and reads rules from `~/.dippy/config` and `.dippy`
This is third-party code. Review the repository files before installing.
What it does
Dippy plugs into Claude Code as a `PreToolUse` hook for the Bash tool and decides whether to ask you for permission. Commands such as `ls`, `git status` and `cat` need no confirmation. Long read chains like `git status && git log --oneline -5 && git diff --stat`, command substitutions, safe redirects and read-only cloud queries pass automatically. A stop and a prompt arrive where something is written or deleted: `git stash drop`, `kubectl delete pod`, `aws s3 rm`, or writing a downloaded file with `curl > script.sh`. The hook parses the whole command. It is built on Parable, the author's own Bash parser with no external dependencies, so it sees nested subshells such as `git $(echo rm) foo.txt` and blocks a chain if any part is dangerous, for example `rm -rf node_modules && npm install`. Rules live in `~/.dippy/config` and in a `.dippy` file at the project root. Besides allow and deny, a rule can carry a message the agent reads: `deny python "Use uv run python"` or `deny rm -rf "Use trash instead"`. Instead of a bare refusal the agent gets a hint and keeps working. The `deny-redirect` rule blocks writes to files by pattern, for example `.env`.
Who it is for. Developers tired of approving every `ls` and `git status` in Claude Code who do not want to switch permission checks off altogether.
Good fit when
- The agent asks permission for safe read commands and work keeps stalling
- The project has commands the agent should replace with your own: `uv run python` instead of `python`, `trash` instead of `rm -rf`
- You must keep secrets from being written: the `deny-redirect` rule blocks redirects into `.env` files
- You need to analyze complex chains with `&&`, pipelines and substitutions where a plain allowlist falls short
- A team needs shared rules: the `.dippy` file lives in the repository beside the code
Not a fit when
- You need protection against prompt injection and malicious packages: Dippy checks only Bash commands
- The agent runs without `PreToolUse` hooks: Dippy cannot be attached
- Every command in the project is better approved by hand: automatic allowances only add uncertainty
- You need checks on file reads and MCP calls: the hook looks at shell commands
Example request
Connect Dippy to Claude Code and add a rule: use uv run python instead of python, and forbid writes to .envLimitations
- The hook looks only at commands of the Bash tool. It does not check file reads, edits or MCP calls.
- Whatever Dippy considers safe is allowed automatically. That judgment rests on parsing the command, so an unusual utility deserves a check: close doubtful ones with your own `deny` rule.
- It installs through Homebrew or a repository clone. You add the hook to `~/.claude/settings.json` by hand, and for a manual install the full path to `dippy-hook` is needed.
- Detailed rule documentation lives in the project wiki, and the README holds only a short example.
How to disable. Remove the `PreToolUse` hook that runs dippy from `~/.claude/settings.json` or open `/hooks` in Claude Code and delete it there. The Homebrew package comes off with brew uninstall dippy.
FAQ
How do I connect Dippy to Claude Code?
Install the package with `brew tap ldayton/dippy` and `brew install dippy`, then add a `PreToolUse` hook with matcher Bash and command dippy to `~/.claude/settings.json`. You can also create the same hook interactively through `/hooks`.
Which commands does Dippy approve itself?
Reading and inspection: `ls`, `git status`, `cat`, chains of them, pipelines with `grep` and `awk`, queries like `aws ec2 describe-instances`, `docker logs`, safe redirects and command substitutions.
What does Dippy block?
Hidden subshells (`git $(echo rm) foo.txt`), writes through `curl > script.sh` or `tee`, hidden mutations such as `git stash drop` and `npm unpublish`, cloud deletions and chains with a destructive part.
How do I make the agent switch commands instead of just refusing?
Add a rule with a message, for example `deny python "Use uv run python"`. The agent sees the text and retries with the right command.
Where are Dippy's settings?
Global rules live in `~/.dippy/config` and project rules in a `.dippy` file at the repository root. The full description is in the project wiki on GitHub.
Discussion
No questions or reviews yet.
Related
CLI toolsA Claude Code hook that rates Bash command risk with rules and Haiku, asking for approval only on risky commands
Boucle Claude Code hooks
Boucle-framework
Seven Claude Code hooks block dangerous commands, force pushes and edits to protected files; enforce-hooks enforces CLAUDE.md.
Claude Hooks (Prompt Injection Defender)
Claude Hooks
A Claude Code hook that scans file, web page and command output for hidden instructions and warns the agent
A marketplace of 22 hook plugins for Claude Code: safety, cost control, observability and automation
A plugin and approval server for Claude Code and Codex: a risky tool call waits for your decision before it runs
Hook rules with no model in the loop stop dangerous commands and secrets in code, and every block goes to a local log.
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| Dippy (this card) | no | 244 | |
| CC Safety Net | no | 2,014 | blocks destructive Git and file system commands, while Dippy also auto-approves safe ones |
| Destructive Command Guard | no | 6,349 | explains the rule that fired and lets you inspect a command, while Dippy pairs command parsing with hints to the agent |
README in short
The page starts with permission fatigue and describes the hook with screenshot examples. It then lists approved and blocked commands, installation through Homebrew or manually, hook setup in `settings.json` and sample rules with messages for the agent. Details live in the wiki. The docs folder compares the hook systems of Claude Code, Codex CLI, Cursor and Gemini CLI.