Skip to content

Claude Code Cheatsheet

This is a reference document for looking up information, not a tutorial — to learn how to use Claude Code, see the main tutorial; to find the complete definition of a term, see the Glossary. This document answers "how to configure, which option to choose, what information sources are available for deep exploration." Four sections: decision tables (start here if unsure), glossary quick index (one-liner + link to Glossary), configuration quick reference (how to write settings.json), and high-quality information sources (where to go for continued learning).

Table of Contents


Decision Tables

Which Claude Product/Interface to Use

ScenarioRecommendationWhy
Writing code in terminal, need fine-grained control over file/command permissionsClaude Code CLIMost complete feature set, all permissions/Hooks/Skills/Sub-agents available
Quick Q&A without touching codebaseClaude.aiZero installation, use directly in browser
Want visual diff and parallel session managementClaude Code Desktop AppGUI wraps all CLI capabilities
Write and ask within VS Code/JetBrains without switching windowsEditor ExtensionsEmbedded integration
Want Claude to automate complete workflow from design to deployment, for non-engineersCoworkFor automation/non-engineer scenarios
Temporary tasks, don't want to open local terminalClaude Code Web VersionRuns in browser, no installation
On mobile, want to remotely check local session progressRemote ControlMobile/browser takes over local session, see Glossary Quick Index

Which Permission Mode to Use

ScenarioRecommended ModeWhy
New user, unfamiliar with Claude's judgmentNormalAsks each step, build trust first
Daily development, want fewer interruptions but keep safety boundariesAuto (recommended default)AI classifier blocks dangerous ops, others auto-approve
Only want plans/code analysis, don't want to modify filesPlanRead-only, no changes executed
Only want auto file edits, still confirm commands manuallyAccept EditsEdits auto-approve, Bash and other commands still ask
Complete trust, CI/unattended automationAuto-Accept (bypassPermissions)Fully automatic, watch security boundaries, avoid in production-sensitive directories

Which Multi-Agent Collaboration Approach

Claude Code has four mechanisms for "multiple AIs working together," easy to choose wrong, ordered by complexity from low to high:

ScenarioRecommendationWhy
Just want another open session to helpCross-Session MessagingLightest, pure text communication, no orchestration
Task can be split into independent sub-tasks, results aggregated to main sessionSub-agents (built-in or custom)Main session dispatches directly, simple configuration
Need scripted orchestration of large-scale parallel/pipeline tasksDynamic Workflows (agent()/pipeline())Better for scaling and reusability than manual sub-agent dispatch
Need multi-person collaboration-style task assignment and progress trackingAgent Teams (Experimental)Lead/Teammate roles + shared task list

Skill / Plugin / MCP / Hook: Which Extension Mechanism

ScenarioRecommendationWhy
Want Claude to connect to external tools/databases/APIsMCPOpen protocol for standardized connections
Want to package reusable multi-step workflows/specialized instructionsSkillDescribe trigger conditions, auto-recognize or manual /name invocation
Want to package Skills+Agents+Hooks+MCP for team distributionPluginInstallable unit, distributed via marketplace
Just want auto-run script on specific events (save file, pre-commit)HookNo need to package as skill, configure directly in settings.json

Glossary Quick Index

Complete definitions (what it is / why needed / role in ecosystem / how it works) are maintained in Glossary, avoiding divergence from definitions here. This section only contains "one-liner + link," for those already familiar with concepts who want quick confirmation or to jump for details.

ConceptOne-LinerDetails
MCPOpen protocol for AI to connect to external tools/data/APIs, basis of Connectors and pluginsGlossary → MCP
SkillsReusable multi-step workflow folders, Claude loads by scenarioGlossary → Skills
HooksScripts auto-triggered before/after tool callsGlossary → Hooks
PluginsSkills+Agents+Hooks+MCP packaged as installable unitGlossary → Plugins
Sub-agentsAI assistants with independent persona/permissions, process tasks in parallelGlossary → Sub-agents
MemoryCross-conversation preference and context retention (CLAUDE.md + auto-memory)Glossary → Memory
Dynamic WorkflowsScripted orchestration of large-scale sub-agent parallel/pipeline tasksGlossary → Dynamic Workflows
Cross-Session MessagingPure text messaging between different sessions for collaborationGlossary → Cross-Session Messaging
Agent TeamsMulti-session teaming, Lead assigns tasks, Teammates execute in parallel (Experimental)Glossary → Agent Teams
Remote ControlMobile/web/Slack remote takeover of local sessionGlossary → Remote Control
ChannelsExternal message sources (Telegram/Discord/iMessage) trigger sessions (Research Preview)Glossary → Channels
WorktreeMulti-session parallel branch isolation based on git worktreeGlossary → Worktree
Permission ModesControls whether Claude asks before executing operations, five modesGlossary → Permission Modes · Decision Tables · Configuration Quick Reference
Settings ScopeConfiguration hierarchy system: Managed > CLI args > Local > Project > UserConfiguration Quick Reference · Configuration Scopes

Configuration Quick Reference

This section is a curated reorganization of the official settings.json documentation, designed for actual configuration scenarios. For complete documentation, see Settings.

Configuration Scopes

Settings Scope is the most core yet most confusing concept in Claude Code. Before configuration takes effect, confirm which scope's file you're editing.

Five priority levels (from high to low, this is the single authoritative version, other pages reference here, don't copy separately):

PriorityScopeConfig FileShared ByOverride Rules
1 (Highest)ManagedIT deployment / managed-settings.jsonAll org membersCannot be overridden (except few security-sensitive keys)
2CLI Args--permission-mode etc. startup paramsCurrent session onlyTemporarily overrides all settings
3Local.claude/settings.local.jsonYou only (gitignored)Overrides Project and User
4Project.claude/settings.jsonWhole team (committed to Git)Overrides User
5 (Lowest)User~/.claude/settings.jsonYou onlyOverridden by all higher layers

Applicable scenarios for each scope:

ScopeWhat to PutExamples
UserPersonal global preferencesTheme, editor, API keys, global MCP
ProjectTeam-shared rulespermissions allow/deny, hooks, shared MCP
LocalPersonal project overridesDebugging permission relaxations, experimental configs
ManagedEnterprise security policiesMandatory deny rules, disable bypass, domain restrictions

Configuration locations for each feature:

FeatureUser LocationProject LocationLocal Location
Settings~/.claude/settings.json.claude/settings.json.claude/settings.local.json
Subagents~/.claude/agents/.claude/agents/None
MCP servers~/.claude.json.mcp.json~/.claude.json (per-project)
Plugins~/.claude/settings.json.claude/settings.json.claude/settings.local.json
CLAUDE.md~/.claude/CLAUDE.mdCLAUDE.md or .claude/CLAUDE.mdCLAUDE.local.md

Key rules:

  1. Managed cannot be overridden: Admin-set managed keys (like allowedPlugins, knownMarketplaces) are hidden from users and projects and cannot be modified
  2. Security exception: Security-related keys like apiKey, oauthToken, sandbox allow Local override of Managed, preventing credential leaks
  3. Permission rules merge across scopes (not override), higher priority entries match first
  4. Plugin configuration follows the same priority merge rules
  5. Invalid entries in Managed settings are auto-deleted with warnings logged (v2.1.169+), single typos won't disable remaining policies
  6. Setting auto mode in project settings is ignored (v2.1.142+), preventing repos from granting themselves auto permissions

Common pitfalls:

PitfallSymptomSolution
Project settings not taking effectNo change after modifying .claude/settings.jsonCheck if Local file overrides
Permission rule conflictsUncertain behavior when both allow and deny matchdeny matches first
Managed settings ignoredEnterprise policies not effectiveConfirm admin correctly set managed keys

Configuration file structure:

jsonc
// .claude/settings.json (project-level, committed to Git)
{
  "permissions": {
    "defaultMode": "auto",
    "allow": ["Bash(git:*)", "Read"],
    "deny": ["Bash(rm -rf:*)"]
  },
  "hooks": { "PostToolUse": [ /* ... */ ] },
  "mcpServers": { "github": { /* ... */ } }
}

Core Settings Reference

json
{
  "$schema": "https://json.schemastore.org/claude-code-settings.json",
  "permissions": { "...": "..." },
  "hooks": { "...": "..." },
  "env": { "...": "..." },
  "enabledPlugins": { "...": "..." },
  "pluginConfigs": { "...": "..." },
  "extraKnownMarketplaces": { "...": "..." },
  "outputStyle": "concise",
  "companyAnnouncements": [ "..." ]
}

The $schema line points to the official JSON Schema; add to settings.json to enable autocomplete in VS Code and other editors.

Permission Configuration

Five permission modes (config value takes priority, display name mapping in Glossary · Permission Modes):

Config Value (defaultMode)Display NameBehaviorRecommended Scenario
defaultNormalAsk confirmation before each executionMost cautious
autoAutoAI classifier auto-decides: safe ops auto-approve, dangerous ops blockedRecommended for daily use
planPlanRead-only analysis, no changes executedPlan before acting
acceptEditsAccept EditsAuto-approve edit operations, others askEdit without executing commands
bypassPermissionsAuto-AcceptAuto-approve all operationsWhen fully trusted
json
{
  "permissions": {
    "defaultMode": "auto",
    "allow": ["Bash(git:*)", "Read"],
    "deny": ["Bash(rm -rf:*)", "Read(.env*)"]
  }
}

Permission rule syntax: Rule format ToolName or ToolName(pattern), evaluation order deny → ask → allow, first matching rule decides result (not by specificity).

RuleMatch Scope
BashAll Bash commands
Bash(npm run *)Commands starting with npm run
Read(./.env)Reading .env file
WebFetch(domain:example.com)Fetches to example.com
mcp__github__get_*GitHub MCP get-series tools
*Match all tools (deny only)

Bash permission security constraints: * matches entire command not just arguments; ** matches multiple directory levels in paths; use Bash(git:*) not Bash(git *) to avoid argument injection.

Model and Response Settings

json
{
  "model": "claude-sonnet-4-6",
  "outputStyle": "concise",
  "maxThinkingTokens": 10000
}
KeyDescription
modelDefault model, switch in-session with /model. Read at startup, no hot reload
outputStyleOutput style (concise/explanation/none), part of system prompt, rebuilt on /clear
maxThinkingTokensExtended Thinking budget ceiling

Hook Configuration

json
{
  "hooks": {
    "PostToolUse": [
      { "matcher": "Edit|Write", "hooks": [
        { "type": "command", "command": "prettier --write \"$CLAUDE_TOOL_INPUT_FILE_PATH\"" }
      ]}
    ]
  }
}
EventTrigger TimeMost Common Use
PreToolUseBefore tool callIntercept dangerous commands, modify params
PostToolUseAfter tool callFormat, lint, test
SessionStartSession startLoad env vars, initialize
SessionEndSession endCleanup, report
UserPromptSubmitUser submits messageLog, verify
NotificationLong-running operation notificationsProgress hints
ConfigChangeSettings file changedReload custom config

Three Hook types: command (shell command), prompt (inject extra prompt), mcp_tool (call MCP server).

Hook security settings (settings level):

json
{
  "allowedHttpHookUrls": ["https://hooks.example.com/*"],
  "httpHookAllowedEnvVars": ["MY_TOKEN", "HOOK_SECRET"]
}

When allowManagedHooksOnly is true (Managed settings only), only Managed hooks and marketplace force-enabled plugin hooks are loaded, user and project hooks are blocked.

Subagent Configuration

Custom subagents are Markdown files in agents/ directory (YAML frontmatter + instructions): ~/.claude/agents/<name>.md (user-level) / .claude/agents/<name>.md (project-level, team-shared).

yaml
---
name: security-reviewer
description: Call for security review, permission check, OWASP compliance
tools: Read, Grep, Glob
model: claude-opus-4-6
permissionMode: ask
---
FieldRequiredDescription
nameAgent identifier (letters, numbers, hyphens)
descriptionWhen Claude calls this agent
toolsAllowed tool list, inherits all if omitted
modelSpecify model (sonnet/opus/haiku)
permissionModeOverride global permission mode
colorDisplay color in UI

Built-in subagents: Explore (codebase exploration, read-only), Plan (planning research).

Plugin Configuration

json
{
  "enabledPlugins": {
    "formatter@acme-tools": true,
    "analyzer@security-plugins": false
  }
}

Format: "plugin-name@marketplace-name": true/false, no explicit entry falls back to defaultEnabled. Scope rules: project settings > user settings; locally disable project plugin in .claude/settings.local.json set false; Managed force-enabled plugins cannot be locally disabled.

json
{
  "pluginConfigs": {
    "deployer@acme-tools": { "options": { "api_endpoint": "https://api.example.com" } }
  }
}

pluginConfigs only read from user settings, --settings flag, and Managed settings; entries in project settings.json/settings.local.json are ignored.

json
{
  "extraKnownMarketplaces": {
    "acme-tools": { "source": { "source": "github", "repo": "acme-corp/claude-plugins" } }
  }
}

Declare at project level, team members prompted to install marketplace when trusting repo.

Plugin installation security: Enabling plugins from external sources (GitHub/npm) in project's .claude/settings.json doesn't auto-install for others; each user must run claude plugin install to install and trust plugin before use.

Environment Variables

json
{
  "env": {
    "CLAUDE_CODE_ENABLE_TELEMETRY": "1",
    "OTEL_METRICS_EXPORTER": "otlp",
    "ANTHROPIC_BASE_URL": "https://your-proxy.example.com"
  }
}

Can also export directly in Shell, or specify temporarily before command: ANTHROPIC_BASE_URL=https://proxy.claude.com claude

VariablePurpose
ANTHROPIC_API_KEYAPI key (used when not logged in)
CLAUDE_CODE_ENABLE_TELEMETRYTelemetry reporting (1 to enable)
CLAUDE_CODE_DISABLE_UPDATE_CHECKDisable update check (useful in CI)
OTEL_METRICS_EXPORTEROpenTelemetry metrics export
CLAUDE_CONFIG_DIRSpecify config directory (for isolated debugging)

Sandbox Settings Essentials

Sandbox isolates Bash commands from filesystem and network, suitable for running Claude Code in untrusted environments.

json
{
  "sandbox": {
    "enabled": true,
    "failIfUnavailable": true,
    "autoAllowBashIfSandboxed": true,
    "excludedCommands": ["docker *"],
    "allowUnsandboxedCommands": false
  }
}

Filesystem rules:

json
{ "sandbox": { "filesystem": {
  "allowWrite": ["/tmp/build", "~/.kube"],
  "denyWrite": ["/etc", "/usr/local/bin"],
  "denyRead": ["~/.aws/credentials"],
  "allowRead": ["."]
}}}

Network rules:

json
{ "sandbox": { "network": {
  "allowedDomains": ["github.com", "*.npmjs.org"],
  "deniedDomains": ["sensitive.cloud.example.com"],
  "allowUnixSockets": ["~/.ssh/agent-socket"],
  "allowLocalBinding": true
}}}

Credential protection:

json
{ "sandbox": { "credentials": {
  "files": [{ "path": "~/.aws/credentials", "mode": "deny" }],
  "envVars": [
    { "name": "GITHUB_TOKEN", "mode": "deny" },
    { "name": "AWS_SECRET_ACCESS_KEY", "mode": "mask", "injectHosts": ["api.github.com"] }
  ]
}}}

Security note: allowManagedReadPathsOnly (Managed settings only) can restrict sandbox to only recognize Managed scope allowRead rules, preventing project settings from relaxing file access.

Path prefixes: / absolute path · ~/ home directory · ./ or no prefix (project root, or ~/.claude under Managed settings).

When Configuration Takes Effect

Most settings take effect immediately (hot reload): permissions, hooks, apiKeyHelper, env; changes to user/project/local/Managed settings all trigger ConfigChange hook.

Read once at startup (restart or use command to switch after modifying):

KeyAlternative Switch Method
modelSwitch in-session with /model
outputStyle/clear or rebuilt after restart

Verifying Your Configuration

When configuration doesn't take effect, troubleshoot in order:

bash
/doctor                              # 1. Comprehensive diagnosis
/context                             # 2. Check context window
/hooks                               # 3. Check hooks status
/mcp                                 # 4. Check MCP servers
claude --safe-mode                   # 5. Safe mode isolate issues
CLAUDE_CONFIG_DIR=/tmp/claude-test claude   # 6. Isolated config directory to exclude interference
SymptomCauseSolution
auto mode not effectiveauto ignored in project settings (v2.1.142+)Move to ~/.claude/settings.json
Hook not triggeringMatcher format error or wrong pathUse /hooks check registration status
MCP server won't connectWrong path or env varUse /mcp view logs
Permission rules not effectiveWrong rule orderdeny → ask → allow, first match applies
Sandbox fails to startMissing dependency or unsupported platformSet failIfUnavailable: false
Plugin not effective in teamTeammate not installedEach user must run claude plugin install

Common Configuration Templates

Frontend team project template:

json
{
  "permissions": {
    "defaultMode": "auto",
    "allow": [
      "Bash(git:*)", "Bash(npm run *)", "Bash(npx *)", "Bash(pnpm *)",
      "Read", "Edit", "Write", "Grep", "Glob",
      "WebFetch(domain:github.com)", "WebFetch(domain:stackoverflow.com)"
    ],
    "deny": ["Read(./.env)", "Read(./.env.*)", "Read(./secrets/**)", "Bash(curl *)"]
  },
  "hooks": {
    "PostToolUse": [{ "matcher": "Edit|Write", "hooks": [
      { "type": "command", "command": "npx prettier --write \"$CLAUDE_TOOL_INPUT_FILE_PATH\" 2>/dev/null || true" }
    ]}]
  },
  "env": { "CLAUDE_CODE_ENABLE_TELEMETRY": "1" }
}

Personal global preference template:

json
{
  "permissions": {
    "defaultMode": "auto",
    "allow": ["Bash(git:*)", "Bash(npm run *)", "Bash(pnpm *)", "Read", "Edit", "Write", "Grep", "Glob"],
    "deny": ["Read(.*.key)", "Read(.*.pem)", "Bash(rm -rf:*)"]
  },
  "env": { "CLAUDE_CODE_ENABLE_TELEMETRY": "1" }
}

Enterprise security policy template (Managed):

json
{
  "permissions": {
    "defaultMode": "default",
    "disableBypassPermissionsMode": "disable",
    "deny": ["Bash(curl *)", "Bash(wget *)", "Read(*.env)", "Read(*.pem)"]
  },
  "sandbox": {
    "enabled": true,
    "failIfUnavailable": true,
    "allowUnsandboxedCommands": false,
    "network": {
      "allowManagedDomainsOnly": true,
      "allowedDomains": ["github.com", "*.npmjs.org", "registry.npmjs.org"]
    },
    "credentials": { "envVars": [
      { "name": "GITHUB_TOKEN", "mode": "deny" },
      { "name": "AWS_SECRET_ACCESS_KEY", "mode": "deny" }
    ]}
  }
}

High-Quality Information Sources

Complete verification checklist for official docs/Cookbook/blogs, social accounts (four-tier: by company/product/lead/core dev), high-quality GitHub repos, awesome lists, third-party blogs — not just reader references, but data foundation driving this tutorial's continuous updates. Organization method (how to systematically discover sources, verify social account identities) in repo .claude/skills/doc-research/references/sources/_template.md.

Last systematic verification: 2026-08-17.

Official Documentation

Claude Code actually spans two different official documentation sites, easy to confuse:

Official Cookbooks, Example Repos, and Other Official Resources

  • Claude Cookbook — Official Cookbook site, covering 11 categories of code examples including Agent Patterns, Tools, Claude Agent SDK, Managed Agents, RAG, Multimodal, Evals, etc. Mainly for Claude API / Agent SDK developers, not Claude Code CLI usage tips collection, but "Claude Agent SDK" category is strongly related to Claude Code's underlying technology

Official and Core Team Social Accounts

Tiered by "information density for Claude Code tool usage," not by follower count — weighting: ① whether first-hand info (writing code/defining product/modifying features) ② whether teaching real usage (worktree/CLAUDE.md/skill/hook not "100 tips" collage) ③ whether updates keep up with versions (now almost weekly small version) ④ ratio of promoting courses/selling automation (higher subtracts points).

The following tiering and commentary are compiled from Grok deep search results (search scope approx 2026-07 to 2026-08-16), Grok's judgment based on recent interaction data and content quality, not facts independently verified by this site — account existence and official identity cross-reference verified, but rankings and commentary please re-verify as needed. Follower counts/view counts quickly become outdated, only long-standing qualitative judgments retained here.

S-tier (first-hand sources, nearly single source of truth)

AccountIdentityWhy Ranked Here
@bchernyClaude Code author/leadNo more upstream source. The team methodology "multi-worktree parallel, Plan first, write to CLAUDE.md after changes, package repeated actions as skill" came from him, publicly discusses worktree cleanup, auto mode and other evolving features
@trq212Claude Code engineer (Thariq Shihipar, Anthropic technical staff, formerly YC W20/South Park Commons/MIT Media Lab)More "how-to" than lead account: how auto mode locks dangerous ops, when to let it keep going. Proposed widely adopted "9 skill categories" framework
@_catwuClaude Code + Cowork product lead (Cat Wu, identity independently confirmed by TechCrunch, Lenny's Newsletter etc.)See where product is going: embedded desktop browser, multi-person collaboration, route from individual CLI to team-resident agent
@ClaudeDevsOfficial developer accountFirst landing point for feature launches, suitable as "version radar." Identity cross-confirmed by @trq212 announcement post "this is official channel for all Claude Code and Claude platform updates"
@adocompleteAnthropic Community / Claude CodeMost operation-focused among official accounts, closer than official press releases to "open terminal how to press"

A-tier (high-frequency useful, complementary sources)

AccountIdentityFor Whom
@amorriscodeClaude Code @ Anthropic, formerly StripeSpecializes in Desktop usage, CLI users can skim, must-follow for desktop users
@The_Whole_DaisyClaude Code engineer, cross session/SendMessage relatedPosts few but all implementation details, for those already running multi Claude sessions
@ClaudeCodeLogUnofficial changelog bot (bio claims unofficial but tolerated)Splits CLI/feature flag/prompt changes by version, low-cost "daily scan for new flags" solution
@oikon48Japanese engineer, author of "Claude Code Practical Introduction"Highest signal-to-noise practice account among Chinese/Japanese users, distills changelog into actionable items, not selling courses
@simonwDatasette / Django co-authorIndependent, critical thinking, counterbalance to official optimistic narrative
@alexalbert__Anthropic ResearchOccasionally drops internal usage data, not command cheat sheet account
@claudeaiOfficial product accountSecurity plugin, limits, desktop redesign and such major features debut here

B-tier (useful but filter packaging)

AccountFor WhomNotes
@dexhorthyAlready running multi-agent workflowsHarness-focused, not introductory content
@svpinoWant quick keyboard shortcut collectionPractice-oriented collection, use as cheat sheet
@claude_codeBrowse community project dynamicsCommunity account, unofficial, uneven quality

Not recommended as primary follows: Many top-ranked accounts when searching "Claude Code" are training/acquisition accounts (Japanese growth accounts especially common, common pitch like "XX million exposure/pure profit XX/seminar traffic diversion") — judgment criterion simple: whether they mention specific version numbers/flags/commands, or only generic rhetoric like "10x efficiency."

Core Maintainer and Team Blogs

High-Quality GitHub Repos

  • anthropics/claude-code (official, 140k+ star) — Note: not complete source repo, public content is CLI binary distribution + plugins (plugins/, examples/) + docs/issue tracking, core Agent implementation not open source. Suitable for viewing CHANGELOG, Issues, official plugin examples
  • anthropics/claude-code-action (official) — GitHub Actions integration, official implementation of @claude triggering Claude Code in CI

Awesome Lists and Resource Aggregators

⚠️ Many similarly named repos (like jqueryscript/awesome-claude-code, rohitg00/awesome-claude-code-toolkit), always include owner when referencing, don't just write repo name.

High-Quality Third-Party Blogs and Communities

English: Codingscape: How Anthropic engineering teams use Claude Code every day — Deep dive based on official engineering blog

Chinese: Claude Code Best Practices Chinese Edition (Zhihu) — Chinese translation of official best practices; Strongest Coding Agent: Claude Code Authoritative Practice Guide (Zhihu) — Interpretation and organization based on official engineering blog

Chinese content in search results dominated by Zhihu/CSDN mix translation/reposting and original, check if original source is credited before citing.

To Be Verified

  • ClaudeLog (claudelog.com): Suspected dedicated resource site, but access returns 403 (anti-scraping), cannot confirm content quality and operator identity
  • Multiple CSDN articles with titles indicating practical pitfall collections, only titles recorded, specific URLs and originality not confirmed, need re-search to locate and verify before use

Built for frontend engineers · Powered by VitePress