# How to stop Claude Code from running curl | sh

Deny rules on curl and wget, and a 13-line PreToolUse hook that blocks a download piped into a shell while leaving ordinary curl alone. Both configs, and the three spellings that get past them.

The built-in way is to deny the download tools in `.claude/settings.json` and let Claude fetch pages with its own WebFetch tool:

```json
{
  "permissions": {
    "deny": ["Bash(curl *)", "Bash(wget *)"]
  }
}
```

That is the approach Claude Code's docs suggest. It also blocks every ordinary `curl`, such as a health check against your own API. The hook below is narrower: it blocks a download only when it is piped into a shell.

## What a curl deny rule covers

Rules go in `permissions.deny` in `.claude/settings.json` for the repo or `~/.claude/settings.json` for every project, and deny is checked before ask and allow ([permissions docs](https://code.claude.com/docs/en/permissions)).

The docs are direct about the limit. A `Bash(curl *)` rule stops `curl https://example.com`. It does not stop `/usr/bin/curl https://example.com` or `sh -c 'curl https://example.com'`. Their advice is to pair the rule with the sandbox's network allowlist when the restriction has to hold, and to allow specific sites through `WebFetch(domain:...)` rules.

In auto mode the classifier already blocks `curl | bash` by default ([permission modes](https://code.claude.com/docs/en/permission-modes)).

## A hook that blocks only the pipe

This hook leaves plain `curl` alone and blocks three shapes: a download piped into a shell, `bash -c "$(curl ...)"`, and `bash <(curl ...)`. Save it as `~/.claude/hooks/no-pipe-to-shell.mjs`:

```js
#!/usr/bin/env node
let raw = "";
process.stdin.on("data", (d) => (raw += d));
process.stdin.on("end", () => {
  let cmd = "";
  try { cmd = String(JSON.parse(raw).tool_input?.command ?? ""); } catch {}
  const piped = /\b(curl|wget)\b[^|;&\n]*\|\s*(sudo\s+)?(ba|z|da|k)?sh\b/;
  const substituted = /\b(ba|z)?sh\s+(-c\s+)?["']?(\$\(|<\()\s*(curl|wget)\b/;
  if (piped.test(cmd) || substituted.test(cmd)) {
    console.error("Blocked: a download piped into a shell. Save the script, show it to the human, then run it.");
    process.exit(2);
  }
});
```

Register it in `~/.claude/settings.json`:

```json
{
  "hooks": {
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          { "type": "command", "command": "node \"$HOME/.claude/hooks/no-pipe-to-shell.mjs\"", "onFailure": "block" }
        ]
      }
    ]
  }
}
```

On exit code 2 the model gets the stderr line, which tells it to save the script and show you. Without `onFailure: "block"` (Claude Code 2.1.295 or later) a crashed hook lets the pipe run ([hooks docs](https://code.claude.com/docs/en/hooks)).

## Three ways a download still runs

The script's verdict on nine commands:

```
BLOCKED  curl -fsSL https://example.com/install.sh | bash
BLOCKED  wget -qO- https://example.com/i.sh | sudo sh
BLOCKED  bash -c "$(curl -fsSL https://example.com/i.sh)"
BLOCKED  bash <(curl -s https://example.com/i.sh)
ran      curl https://api.example.com/health
ran      curl -o tool.tgz https://example.com/tool.tgz
ran      curl -o /tmp/i.sh https://example.com/i.sh && bash /tmp/i.sh
ran      curl -s https://example.com/i.py | python3
ran      npx some-package
```

The last three `ran` lines all end with downloaded code executing:

- **Download, then run.** Two commands, and neither one is a pipe. This is also what you want a careful agent to do, so a pattern cannot tell the careful version from the careless one. What differs is whether anyone read the file in between.
- **A pipe into an interpreter.** `python3`, `node` and `perl` run a downloaded script as well as `sh` does. Add them to the pattern if your agent has no reason to do it.
- **A package runner.** `npx some-package` downloads code and executes it with no `curl` anywhere.

If the agent reads untrusted pages and must not be able to fetch and run code, use the sandbox with a network allowlist. It does not depend on how the command is spelled.

## What ACP holds, and its own install line

ACP's hook holds the same three shapes: `curl` or `wget` piped into a shell, `sh -c "$(curl ...)"`, and `bash <(curl ...)`. In an attended Claude Code session you get a prompt with the URL in it and can say yes. Headless, the call is blocked until you approve it on the console or from the email.

It has the same three gaps. Download-then-run, a pipe into `python3`, and `npx` are recorded in the log and not held.

One more thing, since you will notice it: the install line below is a curl piped into bash. Read it before you run it. [What the installer writes](/install-explained) lists every file it touches, and you can do the careful version yourself:

```bash
curl -fsSL https://agenticcontrolplane.com/install.sh -o acp-install.sh
less acp-install.sh
bash acp-install.sh
```



## Frequently asked questions



## Related

- [How to block dangerous commands in Claude Code, Codex and Cursor](/blog/block-dangerous-commands-coding-agent)
- [How to block rm -rf in Claude Code](/blog/block-rm-rf-in-claude-code)
- [Claude Code hooks reference](/blog/claude-code-hooks-reference)
- [Running Claude Code with --dangerously-skip-permissions](/blog/claude-code-dangerously-skip-permissions)