Force "Ask" Instead of "Allow" for a Named Risky Tool
Auto mode can be a net productivity win while still being wrong for one specific, named tool. This downgrades `permissionDecision` to `ask` for a configured tool name no matter what mode the session is running in, so that one tool always gets a human's eyes first.
1. Save this as the hook script
#!/usr/bin/env python3
"""PreToolUse hook — forces permissionDecision "ask" for a configured
tool regardless of auto mode."""
import json, sys
data = json.load(sys.stdin)
tool_name = data.get("tool_name", "")
ALWAYS_ASK_TOOLS = {"mcp__accounting_mcp__post_journal_entry"}
if tool_name in ALWAYS_ASK_TOOLS:
print(json.dumps({
"hookSpecificOutput": {
"hookEventName": "PreToolUse",
"permissionDecision": "ask",
"permissionDecisionReason": f"{tool_name} always requires human confirmation.",
}
}))
sys.exit(0)
Save to a path inside your project, e.g. .claude/hooks/force-ask-for-named-risky-tool.sh, then chmod +x it.
2. Wire it into .claude/settings.json
{
"hooks": {
"PreToolUse": [
{
"hooks": [
{"type": "command", "command": "python3 .claude/hooks/force-ask-for-named-risky-tool.py"}
]
}
]
}
}
Before you use this
A hook runs with your local shell's permissions — review the script above before adding it, the same way you'd review any script you didn't write yourself. See our guide on hook security risks for the specific CVEs this category of feature has already produced.
Related hooks