XDA just wrote about giving Claude Code a deny list so the terminal stops asking about every command. That is the promise most AI coding CLIs made in 2025 and the one they are still catching up on in 2026. If you sat through hundreds of “allow this command?” prompts, the deny list feature is the difference between watching every keystroke and actually walking away from the terminal. Seven CLIs offer real permission controls today, and their approaches sit on a spectrum from full sandbox to per-command allowlist to nothing at all.
What to look for in an AI CLI permission model
- Deny and allow lists. A regex or glob per command, saved per project.
- Sandbox execution. Whether commands run in a container, a scratch directory, or your real shell.
- File-write scope. Does the tool write outside the working directory without asking?
- Network gating. Can you block outbound requests from tool calls?
- Session vs project scope. Some tools remember a “yes always” only for this session, others save it forever.
- Audit trail. Whether you can review what the agent ran after the fact.
Quick comparison
| Tool | Best for | Platforms | Free | Paid | Rating |
|---|---|---|---|---|---|
| Claude Code | Deep deny lists and hooks | Win, Mac, Linux | Free tier | $20+/mo | 4.7 |
| Aider | Git-first, local file writes | Win, Mac, Linux | Free | Bring your own key | 4.6 |
| OpenAI Codex CLI | Approvals for shell commands | Mac, Linux, Win via WSL | Free | Requires API credit | 4.4 |
| Cursor CLI | Cursor rules in headless mode | Win, Mac, Linux | Trial | $20+/mo | 4.3 |
| Continue | IDE plus terminal with policies | Win, Mac, Linux | Free | Team $20/user | 4.4 |
| Gemini CLI | Sandbox-first design | Win, Mac, Linux | Free tier | Paid tier via Google Cloud | 4.3 |
| Zed AI | Terminal built into the editor | Mac, Linux, Win beta | Free | $20/mo Pro | 4.5 |
The seven AI CLI tools with permission controls
1. Claude Code, best deep deny lists and hooks
Claude Code ships with a per-project settings.json where you set an allow list, a deny list, and pre-tool and post-tool hooks that run before or after any command. XDA’s example was rm -rf on a deny list so the agent never asks and you never have to say no. Hooks let you gate git pushes, database mutations, or arbitrary shell patterns.
Where it falls short: JSON schema for hooks is deep, and mistakes are silent until a command is denied.
Pricing:
- Free: Free tier with Claude Haiku
- Paid: Pro at $20/mo, Max at $100/mo, Team seats separate
Platforms: Windows (WSL), macOS, Linux
Download: Anthropic
Claude Code for permission controls has the most granular model here, hooks alone make it worth the switch for readers who audit every command.
Bottom line: The pick for readers who want deny lists deep enough to walk away from the terminal.
2. Aider, best git-first local file writes
Aider works on your local repo and commits each change as a separate git commit. Nothing runs shell commands you did not explicitly enable, and the --no-auto-commits flag keeps everything staged for review. Model support spans Anthropic, OpenAI, and open weights via LiteLLM.
Where it falls short: No sandbox, and no built-in deny list. Permissions come from git and file scope rather than the tool.
Pricing:
- Free: Open source
- Paid: Bring your own API key
Platforms: Windows, macOS, Linux
Download: aider.chat
Aider for permission controls wins on the git model, every change is a commit and every commit is a diff you can revert.
Bottom line: The pick for readers who want the LLM to write code but never touch the shell.
3. OpenAI Codex CLI, best approvals for shell commands
OpenAI Codex CLI runs commands with a three-mode approval flow, “suggest” for review before every write, “auto-edit” for file changes without approval but shell commands still gated, and “full auto” with a sandbox. The sandbox uses Apple’s sandbox-exec on macOS and a scratch Docker container on Linux.
Where it falls short: Windows support runs through WSL only, and the sandbox model is thinner on Linux than on macOS.
Pricing:
- Free: Open source
- Paid: Requires OpenAI API credit, GPT-5 usage priced per token
Platforms: macOS, Linux, Windows via WSL
Download: GitHub
OpenAI Codex CLI for permission controls ships the strongest built-in sandbox of the mainstream CLIs.
Bottom line: The pick if you want an OS-level sandbox around shell commands.
4. Cursor CLI, best Cursor rules in headless mode
Cursor CLI brings the Cursor editor’s rules and .cursorrules file into a headless mode you can script. Rules gate what tools the agent can call, and the CLI honours per-file .cursorignore for reads and writes.
Where it falls short: Free plan is a trial, no bring-your-own-key at CLI level, and the rules DSL is under-documented.
Pricing:
- Free: Two-week Pro trial
- Paid: Pro at $20/mo, Business tier for team policies
Platforms: Windows, macOS, Linux
Download: cursor.com
Cursor CLI for permission controls works well if your team already uses Cursor rules in the editor.
Bottom line: The pick for shops that already standardised on Cursor.
5. Continue, best IDE plus terminal with policies
Continue is an open source AI coding assistant that runs in VS Code, JetBrains, or from a CLI. Its config.json lets teams define allowed tools, blocked commands, and models per project. Every action can require review before execution.
Where it falls short: Setup is heavier than Claude Code or Aider, config schema has grown large.
Pricing:
- Free: Open source, bring your own API keys
- Paid: Team hub at $20 per user per month
Platforms: Windows, macOS, Linux
Download: continue.dev
Continue for permission controls shines when the same policy needs to apply in editor and terminal both.
Bottom line: The pick for teams that want one policy for editor and CLI.
6. Gemini CLI, best sandbox-first design
Gemini CLI runs by default in a Docker sandbox and asks before every shell command outside its scratch. The --yolo flag turns approvals off, and the config file supports allow-list globs for commands you trust.
Where it falls short: Docker requirement adds setup, and free-tier rate limits hit hard on longer sessions.
Pricing:
- Free: Free tier with Gemini Flash
- Paid: Via Google Cloud usage-based billing
Platforms: Windows, macOS, Linux
Download: GitHub
Gemini CLI for permission controls defaults to a real sandbox rather than an approval prompt, which is the safer starting position.
Bottom line: The pick if you want sandbox-first rather than approval-first.
7. Zed AI, best terminal built into the editor
Zed AI integrates Anthropic and OpenAI models directly in the Zed editor’s terminal panel. Every tool call surfaces a review pane with a diff before it lands, and Zed’s project scope stops the agent from writing outside the workspace.
Where it falls short: Windows client is still beta, and the CLI outside the editor is minimal.
Pricing:
- Free: Zed editor and manual model use
- Paid: Zed Pro at $20/mo for hosted agent minutes
Platforms: macOS, Linux, Windows beta
Download: zed.dev
Zed AI for permission controls works best for readers who want the CLI experience inside their editor with visible diffs before every apply.
Bottom line: The pick for readers who want an editor-first agent with permission prompts.
How to pick the right one
- Want deep, saved deny lists and hooks: Claude Code
- Want the agent to write code but never touch the shell: Aider
- Want an OS-level sandbox: OpenAI Codex CLI or Gemini CLI
- Already use Cursor: Cursor CLI
- Need one policy for editor and terminal: Continue
- Want the editor plus agent in one window: Zed AI
FAQ
What is a deny list in an AI CLI?
A list of commands or patterns the agent may never run, even if the user says “allow all this session.” Claude Code and Continue both save it per project.
Which AI CLI runs in a sandbox by default?
Gemini CLI and OpenAI Codex CLI both ship with a real sandbox. Codex uses sandbox-exec on macOS and a Docker container on Linux, Gemini uses Docker by default.
Can I use these without a paid API key?
Aider, Continue, and Codex CLI are all bring-your-own-key. Claude Code has a free tier with Haiku, Gemini CLI has a Google free tier, Cursor is trial only.
Is Aider safer than Claude Code?
Different models of safe. Aider never runs shell commands unless you enabled them, so its blast radius is bounded to git. Claude Code runs commands but gives you granular deny lists and hooks.
Can I audit what an AI CLI ran?
Claude Code writes a session log per project. Aider’s audit trail is the git history. Codex, Continue, and Zed all keep a transcript pane you can export.
