ldayton/Dippy: Auto-Approve Safe Commands in Claude Code

ldayton/Dippy: Auto-Approve Safe Commands in Claude Code

Every developer who has used Claude Code knows the rhythm: type a command, wait for approval, click approve, repeat. For safe operations like ls, git status, or cat README.md, this constant interruption destroys flow state. You check Slack, come back, and your assistant is just sitting there waiting. ldayton/Dippy solves this permission fatigue by auto-approving safe shell commands while still guarding against destructive operations.

What is ldayton/Dippy?

ldayton/Dippy is a shell command hook designed specifically for Claude Code. Built in Python^{↗ Bright Coding Blog} and released under the MIT License, it intercepts Bash tool use before execution and makes a rapid allow/deny decision based on command structure and configured rules. The project is maintained by ldayton and has accumulated 241 GitHub stars and 21 forks as of its last commit on June 12, 2026.

The tool's core architectural decision is notable: rather than relying on external parsing libraries, Dippy is built on Parable, a hand-written bash parser maintained by the same author. This means zero external dependencies beyond Python itself. The combined test suite between Dippy and Parable exceeds 14,000 tests, suggesting serious investment in correctness for a tool that sits in the security-critical path between an AI agent and your shell.

Dippy occupies a specific niche in the growing ecosystem of AI coding assistants. While tools like GitHub Copilot or Cursor focus on code generation, Dippy addresses the operational friction of AI-driven terminal use. As Claude Code and similar agents gain adoption, the "approval bottleneck" becomes a genuine productivity concern. Dippy's approach—granular command analysis rather than blanket permission disabling—reflects a pragmatic security posture.

Key Features

Intelligent command classification distinguishes read-only operations from potentially destructive ones. Dippy parses the full command structure including pipelines, chains, redirects, and command substitutions to make holistic safety determinations.

Custom deny messages transform blocked commands from dead ends into corrective guidance. When Dippy rejects an operation, it can attach a specific message that steers Claude back toward the intended workflow without wasting conversation turns.

Zero-dependency architecture via the hand-built Parable parser eliminates supply chain concerns and version conflicts. The entire toolchain is pure Python.

Granular configuration supports both global rules in ~/.dippy/config and per-project rules in .dippy files. Rules can target specific commands, patterns, or redirect behaviors.

Destructive chain blocking prevents bypass attempts. A command like rm -rf node_modules && npm install gets blocked in its entirety, not just the rm portion.

Subshell injection detection catches obfuscated threats like git $(echo rm) foo.txt or echo $(rm -rf /) that simpler string-matching approaches would miss.

Use Cases

Daily development workflows benefit most immediately. The git status && git log --oneline -5 && git diff --stat pattern—common when orienting yourself in a repository—flows without interruption. Similarly, ps aux | grep python | awk '{print $2}' | head -10 for process inspection requires no manual approval.

Cloud infrastructure debugging becomes smoother. Commands like aws↗ Bright Coding Blog ec2 describe-instances --filters "Name=tag:Environment,Values=prod" or docker↗ Bright Coding Blog logs --tail 100 api-server 2>&1 | grep ERROR execute immediately, preserving context while troubleshooting production issues.

Safe automation in CI-like local environments where Claude Code might run repeated diagnostic commands. The grep -r "TODO" src/ 2>/dev/null pattern or ls &>/dev/null redirects work transparently.

Command substitution patterns that combine safe operations, like ls $(pwd) or git diff foo-$(date).txt, are correctly identified as non-destructive despite their dynamic structure.

Preventing common AI mistakes through proactive guidance. When Claude suggests python script.py in a project using uv, a configured deny rule responds with "Use uv run python, which runs in project environment"—correcting the assistant without human intervention.

Installation & Setup

Homebrew (recommended)

brew tap ldayton/dippy
brew install dippy

The tap adds ldayton's repository to Homebrew's source list, and the install command downloads and installs the dippy binary with standard Homebrew conventions.

Manual installation

git clone https://github.com/ldayton/Dippy.git

For manual installs, you will need to reference the full path to the hook script in configuration rather than relying on PATH resolution.

Configure Claude Code

Add to ~/.claude/settings.json (or use /hooks interactively):

{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [{ "type": "command", "command": "dippy" }]
      }
    ]
  }
}

If you installed manually, use the full path instead: /path/to/Dippy/bin/dippy-hook

The PreToolUse hook fires before Claude Code executes any Bash tool. The matcher: "Bash" ensures Dippy only evaluates shell commands, not other tool types. The type: "command" specification tells Claude Code to invoke an external process and use its exit code to determine whether to proceed (0 for allow, non-zero for deny).

Real Code Examples

Dippy's configuration syntax supports several rule types. These examples come directly from the project's documentation:

Basic deny with guidance:

deny python "Use uv run python, which runs in project environment"

This rule triggers when the literal command python is invoked, rejecting it with a message that redirects Claude toward the project's preferred tooling. The message becomes part of Claude's context, allowing it to self-correct in the next turn.

Destructive operation redirect:

deny rm -rf "Use trash instead"

The rm -rf pattern is blocked with a suggestion to use the trash CLI tool, which moves files to system trash rather than permanently deleting them.

Redirect-based secret protection:

deny-redirect **/.env* "Never write secrets, ask me to do it"

The deny-redirect rule specifically targets output redirection to paths matching .env files. This catches patterns like echo "KEY=val" >> .env or curl https://example.com > .env.local that might otherwise leak secrets through automated execution.

Complex approved pipeline:

ps aux | grep python | awk '{print $2}' | head -10

This pipeline is auto-approved because every stage is read-only: process listing, filtering, field extraction, and line limiting. Dippy's parser recognizes the pipeline structure and verifies no stage performs mutation.

Blocked destructive chain:

rm -rf node_modules && npm install

Despite the && suggesting sequential independent operations, Dippy blocks the entire chain because the first component is destructive. This prevents the common pattern where an AI might "recover" from a failed install by aggressively cleaning state.

Advanced Usage & Best Practices

Layer global and project configurations for maintainable rules. Keep universal safety rules (blocking rm -rf /, kubectl delete) in ~/.dippy/config, while project-specific guidance (preferred Python runner, deployment conventions) lives in .dippy at repository root.

Write actionable deny messages. A message like "Don't do that" wastes a turn; "Use make migrate instead of python manage.py migrate" preserves momentum. Consider what context Claude needs to self-correct.

Test rules before deploying. The Dippy Wiki documents extension capabilities beyond shell filtering; review these before assuming Dippy's scope is limited.

Monitor blocked commands initially. When first deploying Dippy, observe what gets blocked and whether denials align with your intent. Adjust rules based on actual Claude behavior in your codebase rather than theoretical concerns.

For teams standardizing on Claude Code, consider maintaining a shared .dippy template in your [INTERNAL_LINK: developer onboarding documentation] to ensure consistent AI behavior across projects.

Comparison with Alternatives

Dippy occupies a middle ground that alternatives don't cleanly match. Built-in permissions are secure but friction-heavy. Disabling them is fast but dangerous. Shell aliases lack structural awareness. Dippy's parser-based approach enables nuanced decisions without sacrificing the safety boundary entirely.

FAQ

Does Dippy work with Claude Code only? The README documents Claude Code integration specifically; other AI assistants with similar hook mechanisms might work but aren't documented.

What Python version is required? The README doesn't specify; check the repository's pyproject.toml or setup.py for requirements.

Can Dippy block network requests? It analyzes command structure, not runtime behavior. A curl to a safe URL is approved; curl https://example.com > script.sh is blocked for the redirect, not the fetch itself.

Is the MIT License permissive for commercial use? Yes, MIT allows commercial use, modification, and distribution with attribution. See the full license text in the repository.

How do I uninstall? Remove the hook entry from ~/.claude/settings.json, then brew uninstall dippy if installed via Homebrew.

What if Dippy misclassifies a command? Rules are configurable; add explicit allow or deny entries for edge cases. The 14,000+ test suite aims to minimize parser errors.

Does Dippy slow down command execution? The README claims "up to 40% faster development" by reducing approval waits; parsing overhead isn't quantified but is designed to be negligible versus human response time.

Conclusion

ldayton/Dippy addresses a genuine friction point in AI-assisted development: the death by a thousand approvals that comes from treating ls and rm -rf with equal suspicion. For developers using Claude Code heavily, it offers a principled middle ground between disabling safety entirely and accepting constant interruption.

The tool suits teams and individuals who have established conventions they want AI assistants to follow automatically—preferred package managers, secret handling procedures, destructive operation policies. The MIT license and pure-Python architecture lower adoption barriers, though the configuration investment means it's most valuable for sustained Claude Code use rather than casual experimentation.

If permission fatigue is slowing your AI-assisted workflow, explore the full documentation and source at https://github.com/ldayton/Dippy.