Deterministic Rule based auto-approver for Claude/Codex Anumati, a deterministic auto-approver for AI coding agents, now supports both Claude Code and OpenAI Codex, automatically allowing safe shell commands like git status, npx tsc, and cargo test while prompting for risky ones. The tool uses explicit matchers with a strict grammar, is allow-only, and splits commands at top-level operators to ensure every sub-command is safe. It offers self-building config via suggestions and can be installed via npm or npx. Stop approving the same Bash commands over and over. anumati is a deterministic auto-approver for AI coding agents. From a small config of named matchers it auto-allows safe shell commands — so git status , npx tsc , cargo test , jq , and friends just run, while genuinely risky commands still get a prompt. It's agent-agnostic : one shared config drives both Claude Code https://code.claude.com via its PreToolUse hook and OpenAI Codex https://developers.openai.com/codex via its PermissionRequest hook . When something falls through, anumati tells you the exact one-liner to allow it next time — so your config builds itself from real usage . bash $ git status && cargo test | tail -20 ✓ auto-approved no prompt $ terraform apply ⤳ prompt shown · 💡 anumati: no matcher covers "terraform" - Deterministic, not vibes. Approval is decided by explicit matchers with a strict grammar — not an LLM guessing whether a command is safe. The same command always gets the same answer. - Safe by construction. Matchers allow only read-only / build / test shapes. Redirects that write files, $ ... substitution, network curl to unlisted domains, git push , rm — all fall through to a real prompt. anumati is allow-only : it can approve a call or step aside, but never blocks anything itself, and never widens what the agent would otherwise refuse. - Composes across a whole command line. git status && cargo build | tail is approved only if every piece is independently safe — you can't smuggle rm -rf / in by chaining it onto an allowed command. - Self-building config. Every passthrough comes with a verified suggestion anumati add … and a logged reason, so you extend coverage from what you actually run. - Bash-only by design. anumati vets Bash — the hard problem. Read / Write / Edit stay with the agent's own permission flow. Every time the agent is about to run a Bash command, anumati checks it against your allow rules: 1. A rule matches → auto-approved, no prompt. 2. No rule matches → the agent shows its normal permission prompt, and anumati prints a 💡 suggestion for allowing it next time. A command is approved one of two ways: a single matcher accepts the whole thing, or — failing that — anumati splits it at top-level && , ; , || , & , and newlines and approves only if every sub-command is independently accepted. php flowchart TD A Bash command -- B{"A single rule's matcher