The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →To pause or block a Claude Code action before it runs, use a PreToolUse hook to inspect the proposed tool call and apply a clear policy. Keep a separate boundary for MCP server authorization, and treat GitHub Actions as a third security boundary: a local hook does not protect a privileged workflow from untrusted pull-request code. This guide shows how to plan the gate and where each control belongs; “5 minutes” is an aspiration, not a measured setup time, and repositories with more complex CI trust models need additional review.
How do I add approval before an AI agent runs a tool?
Claude Code hooks let you run logic at points in the agent lifecycle. Anthropic describes them as a way to “deterministically run logic at points in the agent lifecycle.” A PreToolUse hook is the relevant checkpoint: it runs before a tool action and can allow, ask for approval, or block it. The approval option is useful when a person can respond; a hard policy violation should be blocked rather than turned into a routine confirmation prompt. See Anthropic’s Claude Code power-user guidance and its AI-Native SDLC playbook.
As an Amazon Associate I earn from qualifying purchases.
Before configuring a hook, sort actions into three categories:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- Allow: ordinary, low-risk work the agent may perform without interrupting the user.
- Ask: actions that are legitimate but require a human decision, such as a consequential change when an interactive user is present.
- Block: actions that violate a firm rule and should not proceed through a casual approval prompt.
Prefer rules that target meaningful actions and inspect the actual tool input. A blanket prompt for every tool call creates friction without necessarily improving the decision; a broad allow rule can silently grant more authority than intended.
#1 Best Overall
How do I block Claude Code from running a command?
Configure a PreToolUse hook in Claude Code settings, match the relevant tool, and have the hook make a deterministic decision using the proposed input. The policy should distinguish an action that needs a person’s approval from one that is forbidden outright. For a hard denial, Anthropic’s playbook shows a shell hook that exits with code 2 and sends an explanation to Claude. That explanation should identify what was blocked and how a legitimate request can be approved or handled through the approved route.
Hook input and output behavior is part of the interface, not a detail to guess. Check the current Claude Code Hooks documentation for the exact event payload, decision format, and supported settings syntax before adapting a configuration. Keep the check understandable and narrowly scoped: a hook is executable code with authority over whether the agent proceeds.
Choose where the policy lives
- Repository project settings: appropriate for policy the team wants to share with contributors in that project.
- Administrator-managed settings: use controls managed by platform or IT administrators when an individual engineer must not be able to override or disable the rule.
A project-level setting is convenient, but it is not the right enforcement point for a control that must resist changes by the same users whose actions it governs. Anthropic documents settings and policy guidance in its Claude Code permissions documentation.
Does MCP authorization gate Claude Code tool calls?
Not by itself. MCP authorization and Claude Code’s PreToolUse decision operate at different boundaries. The MCP authorization specification addresses authorization at the protocol level; a Claude Code hook is a runtime decision about a proposed action before that client executes it. They can complement each other, but one should not be described as a substitute for the other. Consult the versioned MCP authorization specification for the protocol boundary and Claude Code’s hooks documentation for its runtime behavior.
In practice, consider separately what an MCP server will authorize and what Claude Code should be permitted to attempt. A client-side pre-tool gate does not establish the server’s authorization policy, and protocol authorization does not configure a Claude Code hook.
How do I run Claude Code safely in GitHub Actions?
CI is a separate security boundary, often without a person available to answer an approval prompt. Do not assume an interactive hook can provide meaningful approval in a headless job. Instead, decide which actors and events may run privileged jobs, give workflows only the permissions they require, and protect credentials and checkout behavior. Anthropic’s Claude Code Action security guidance advises preferring an explicit list of trusted apps over *; if wildcard access is necessary, it says to keep workflow permissions: minimal.
Keep untrusted pull-request code out of privileged execution
Anthropic specifically cautions against checking out an untrusted pull-request ref into the workspace root before the Claude Code Action runs. Its guidance notes that selected Claude configuration paths are restored from the pull request’s base branch, while other working-tree files—including manifests and build configuration—remain from the pull request’s head. That distinction matters: a base-branch hook can still invoke a package-manager script, make target, repository-relative script, or tool that reads configuration supplied by the PR.
Recommended Free Tools
- Keep hook commands self-contained and pinned rather than relying on mutable scripts or project configuration from the PR workspace.
- Review the action’s current security guidance and workflow example before adopting a checkout pattern.
- Limit workflow token permissions and restrict which actors can start jobs that have access to secrets or write permissions.
- Be cautious with privileged
pull_request_targetandworkflow_runworkflows. Anthropic warns that these can run with base-repository secrets; its guidance also notes that aworkflow_runcheck includes the repository access of the actor who started the upstream run.
The configuration-restoration behavior is not a guarantee that all PR-controlled code or configuration has been removed. Evaluate everything the action may execute or read in the checked-out workspace.
Best Value
Which gate belongs at each boundary?
| Control | Enforcement point | Best suited to | Key limitation |
|---|---|---|---|
Claude Code PreToolUse hook |
Agent runtime, before a tool action | Allowing, asking about, or blocking a proposed action in Claude Code | An interactive approval depends on a person being available; project settings may not provide administrator-level override resistance. |
| MCP authorization | Protocol/server authorization boundary | Controlling authorization in the MCP protocol context | It does not configure Claude Code’s local pre-tool hook policy. |
| CI workflow controls | GitHub Actions job and repository boundary | Restricting workflow permissions, trusted actors, credentials, and untrusted code exposure | A local hook alone does not secure a privileged job or neutralize PR-supplied files and configuration. |
How should I validate the gate?
After choosing the policy and adding the hook, exercise representative cases in a safe environment. Verify an allowed action proceeds, an approval-required action pauses in an interactive session, and a denied action is blocked with a useful explanation. Then inspect the CI workflow’s permissions, triggering actors, checkout behavior, and any commands that can read PR-controlled files. Do not rely on a successful hook test as evidence that the separate CI or MCP authorization boundary is secure.
How does this compare with GitHub Copilot hooks?
Hook names and behavior are product-specific. GitHub documents that Copilot’s cloud agent runs non-interactively with tool permissions pre-granted; its permissionRequest hook does not gate those calls, while preToolUse is the documented decision point in that environment. For Copilot CLI, GitHub documents permissionRequest, including CLI pipe mode and CI use. Those are Copilot-specific behaviors, not Claude Code configuration instructions; see GitHub’s Copilot hooks reference.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minute
