Stop AI agents changing their own settings
An agent that can edit its own settings can approve itself, add an MCP server or point itself at another model endpoint. With the settings lock on, it can't. You still can, outside the AI.
● Bash(claude mcp add helper -- npx helper-mcp)
⎿Muzzle blocked this: AI tools can't change their own settings. If you meant to, change it yourself outside the AI.
● Edit(~/.claude/settings.json)
⎿Muzzle blocked this: AI tools can't change their own settings. If you meant to, change it yourself outside the AI.
What's locked
Claude Code settings
Block~/.claude/settings.json, settings.local.json, ~/.claude.json, .mcp.jsonCodex and Cursor settings
Block~/.codex/config.toml, ~/.codex/hooks.json, .cursor/mcp.jsonAdding MCP servers from the agent
Blockclaude mcp add, codex mcp add, claude config setAnother model endpoint
BlockANTHROPIC_BASE_URL or OPENAI_BASE_URL pointed away from Anthropic or OpenAI, for an agentApprovals off
Block--dangerously-skip-permissions, --yolo, bypassPermissionsUndo changes made outside the agent
With Pro, a new MCP server, a changed base URL, removed Muzzle hooks or bypassed approvals show up in Activity, with Undo to put the previous version back.
Questions
Can I still change my settings?
Yes. The lock applies to the AI's tool calls. Edit the file yourself, or run the command in your own terminal.
Does pointing my own app at a gateway count?
No. A base URL change is blocked only when it reaches Claude Code or Codex, such as in a shell profile or a command that starts the agent.
Is it on by default?
Yes, on Free and Pro. You can switch it off in Settings.
Related
Put Muzzle between your agents and the internet
Download for Mac
Free · Apple Silicon · macOS 12 or later