Claude Code Cheat Sheet 2026: Shortcuts, Commands & Flags

Every CLI flag, slash command, keyboard shortcut, config key, hook event, and environment variable in one place. For deep explanations, see the full Claude Code guide. For first-time setup, see the quickstart.

1. Installation

Three installation methods, in order of preference.

# Native binary (recommended)
curl -fsSL https://claude.ai/install.sh | bash

# Homebrew (macOS)
brew install --cask claude-code

# NPM (deprecated — migrate with `claude install`)
npm install -g @anthropic-ai/claude-code

Install a specific version:

curl -fsSL https://claude.ai/install.sh | bash -s 1.0.58

Verify installation:

claude doctor
claude --version

On 2.1.288 through 2.1.290, update to 2.1.291 or later: it fixes a 2.1.288 regression that could lose a session’s last messages on quit and a 2.1.290 regression where cloud sessions could drop answers to permission prompts.

Authenticate:

claude auth login       # Log in or switch accounts
claude auth status      # Check current auth state
claude auth logout      # Clear stored credentials

2. CLI Flags

Subcommand added in v2.1.212: claude auto-mode reset resets your auto-mode state from the terminal; pass --yes to skip the confirmation prompt.⁷

Session and data subcommands: claude attach <name> and claude logs <name> take part of a background session’s name in place of its id (v2.1.290+). claude purge [path] deletes a project’s local Claude Code state (--dry-run previews); it was claude project purge before v2.1.288, and the old name still works with a notice. As of v2.1.300, claude remote-control no longer accepts --sandbox or --no-sandbox (they had no effect; set sandbox.enabled in settings). As of v2.1.309, claude ultrareview requires workspace trust: it asks on a terminal and refuses otherwise; scripts pass --trust-workspace (no value; put a PR number or base branch before it) or set CLAUDE_CODE_DISABLE_ULTRAREVIEW_TRUST_CHECK=1.¹⁴ claude self-hosted-runner --hold-idle-file <path> --max-hold-min <n> keeps an idle session while your host keeps changing the file, releasing it after n minutes anyway (default 1440; v2.1.311+).

3. Slash Commands

Custom commands: Create .claude/commands/my-command.md (project) or ~/.claude/commands/my-command.md (personal) and invoke with /my-command. Commands support YAML frontmatter for description, allowed tools, model override, and argument interpolation via $ARGUMENTS or positional $1, $2.

---
description: Fix a GitHub issue
allowed-tools: Read, Edit, Bash(git:*)
model: opus
argument-hint: [issue-number]
---

Fix GitHub issue #$ARGUMENTS following our coding standards.

Usage: /fix-issue 123

4. Keyboard Shortcuts

General Controls

Quick Prefixes

Multiline Input

Keybindings are customizable via /keybindings (stored in ~/.claude/keybindings.json). As of v2.1.284, the effortSlider:decreaseEffort, increaseEffort, and toggleUltracode actions rebind the /effort slider’s arrow and Tab keys.

5. Configuration Files

Precedence Hierarchy (highest to lowest)

First match wins. Enterprise settings cannot be bypassed.

6. Settings.json Reference

Key settings with types and examples. Place in any settings file from the hierarchy above.

{
  "$schema": "https://json.schemastore.org/claude-code-settings.json",
  "model": "claude-sonnet-4-6",
  "permissions": {
    "allow": ["Read", "Glob", "Grep", "Bash(npm run:*)", "Bash(git:*)", "Edit(src/**)"],
    "deny": ["Read(.env*)", "Bash(rm -rf:*)", "Bash(sudo:*)"],
    "ask": ["WebFetch", "Bash(docker:*)"],
    "defaultMode": "acceptEdits",
    "additionalDirectories": ["../shared-lib"]
  },
  "env": {
    "NODE_ENV": "development"
  },
  "hooks": {},
  "sandbox": {
    "enabled": false,
    "autoAllowBashIfSandboxed": true
  },
  "cleanupPeriodDays": 30,
  "respectGitignore": true,
  "showTurnDuration": true,
  "language": "en",
  "autoMemoryDirectory": ".claude/memory",
  "plansDirectory": ".claude/plans"
}

Permission rule syntax: Tool(pattern:*) provides prefix matching. Bash(npm run test:*) allows npm run test, npm run test:unit, etc. File patterns use glob syntax: Edit(src/**). As of v2.1.214, a single-segment dir/** allow rule matches only <cwd>/dir — no longer any dir/ anywhere in the tree; write Edit(**/src/**) for any-depth matching. deny/ask rules keep any-depth matching, and hook if: conditions get the same cwd scoping. As of v2.1.299 an MCP allow rule reaches only the server it names: mcp__a no longer covers a server named a__b or a_; write mcp__<server>__* with the whole normalized name.

New keys (v2.1.118+):

For the complete settings schema, see the Configuration Deep Dive in the full guide.

7. CLAUDE.md Quick Reference

CLAUDE.md is your project’s instruction file. Claude reads it at the start of every session.

Where it lives:

AGENTS.md (v2.1.277+): in a project with no CLAUDE.md, Claude Code reads AGENTS.md instead – change the behavior under “Project instructions” in /config (not yet on Bedrock/Vertex/Foundry).

What to include:

# Project Name

## Stack

- Backend: FastAPI, Python 3.11+
- Frontend: HTMX + Alpine.js + Bootstrap 5

## Commands

- Dev: `uvicorn app.main:app --reload --port 8000`
- Test: `python -m pytest -v`
- Lint: `ruff check .`

## Conventions

- Conventional commits: feat:, fix:, docs:, refactor:
- Never force push to main
- Always activate venv before Python commands

## Key Files

- app/main.py — FastAPI app and routes
- app/models.py — SQLAlchemy models

Keep it scannable. Dense prose wastes context tokens every session. Use bullet points, tables, and short code blocks. Avoid long paragraphs — Claude reads CLAUDE.md at the start of every session, so every word costs context.

Pro tips:

• Use # prefix in the REPL to add things to auto-memory without editing CLAUDE.md: # Always use TypeScript strict mode
• CLAUDE.md in subdirectories is loaded when Claude reads files in that directory
• Team-shared rules go in .claude/rules/*.md for modular organization

8. Permission Modes

Auto Mode (v2.1.85+) is the built-in starting mode for interactive terminal and VS Code sessions on every plan and provider: v2.1.283 extended it to third-party providers and telemetry-off sessions, and v2.1.284 to every plan and provider; before that it was the default only on Pro, Max, and Team (since August 14, 2026). From v2.1.285 to v2.1.301, claude -p and Python Agent SDK sessions on third-party providers or with telemetry off also started in auto mode when no permission mode was configured; v2.1.302 reverses that: a claude -p or Agent SDK session with no permission mode starts in Manual on third-party providers, with telemetry off, and on a fresh install, as it always did where feature flags are fetched, and --permission-mode auto keeps auto.¹³ permissions.defaultMode overrides the built-in default ("default" pins Manual), and disableAutoMode disables it org-wide. It is the recommended replacement for --dangerously-skip-permissions. Read-only and file edits are auto-approved; since v2.1.281, where the classifier review runs server-side, read-only and sandboxed shell commands also wait for it and are blocked when it flags them. Custom allow/deny rules resolve first. Everything else goes to the safety classifier. Auto-blocked by default: curl | bash, force-push to main, production deploys, mass cloud deletions, IAM changes, sending sensitive data externally.¹

Circuit breaker: 3 consecutive blocks or 20 total in a session pauses back to manual prompting.

Auto mode’s prompt before a read outside the working directories offers Yes, but ask again next time (v2.1.284+): allow that one read and still be asked about later ones.

Dangerous rm in unattended modes (v2.1.281): in auto mode and --dangerously-skip-permissions, the dangerous rm prompt waits 2 minutes, then denies the command with a rewrite hint so the session keeps going. A recursive rm whose target is only command-substitution output, such as rm -rf "$(pwd)", now asks even with a Bash allow rule.

# Enable at startup (--enable-auto-mode was removed in v2.1.111)
claude --permission-mode auto

# Cycle during session
Shift+Tab    # Manual (aka default) -> acceptEdits -> auto -> plan

Permission changes (v2.1.288-290): pyright is no longer treated as read-only and asks first, as do more forms of ps (v2.1.290). A project’s settings files can no longer turn on Claude in Chrome; use --chrome, /chrome, or your user settings (v2.1.290). The client-side auto mode classifier ignores an ANTHROPIC_DEFAULT_SONNET_MODEL pin naming Sonnet 5.5 or Opus 5.5 and uses Claude Sonnet 5 (v2.1.288).

PowerShell auto-approval (v2.1.119+): PowerShell tool commands auto-approve in permission mode the same way Bash commands do. Allow rules like PowerShell(Get-*:*) bypass prompts for read-only operations. Use v2.1.149+ on PowerShell-heavy workflows; it fixes built-in cd permission bypasses, prefix/wildcard allow-rule matching, and stale directory variable tracking.

9. Hook Events

| InstructionsLoaded | CLAUDE.md loaded | No | | ConfigChange | Config file changes mid-session | Yes | | DirectoryAdded | /add-dir or SDK register_repo_root adds a working directory mid-session (v2.1.219+) | No | | WorktreeCreate | Worktree being created | Yes | | WorktreeRemove | Worktree being removed | No | | PreCompact | Before context compaction | No | | PostCompact | After context compaction | No | | Elicitation | MCP requests structured input | Yes | | ElicitationResult | User responds to MCP dialog | Yes | | StopFailure | Turn ends due to API error | No | | PermissionRequest | Permission dialog shown | Yes | | PermissionDenied | Auto mode denies an action (v2.1.88+) | No | | CwdChanged | Working directory changes (v2.1.83+) | No | | FileChanged | Watched file modified externally (v2.1.83+) | No | | TaskCreated | New task created (v2.1.84+) | No | | TeammateIdle | Agent team member idles | Yes | | TaskCompleted | Task marked complete | Yes |

For the full hook protocol (input/output JSON, matchers, exit codes), see Hooks Deep Dive in the full guide.

10. Hook Configuration

Hooks live in settings.json or a dedicated hooks.json. Minimal example:

{
  "hooks": {
    "PostToolUse": [
      {
        "matcher": "Edit|Write",
        "hooks": [
          {
            "type": "command",
            "command": "npx prettier --write \"$FILE_PATH\""
          }
        ]
      }
    ],
    "PreToolUse": [
      {
        "matcher": "Bash",
        "hooks": [
          {
            "type": "command",
            "command": ".claude/hooks/validate-bash.sh"
          }
        ]
      }
    ]
  }
}

Matcher syntax:

Exit codes:

Async hooks run in the background without blocking: add "async": true to the hook object.² Prompt and agent hooks run at most 12 of one event at a time as of v2.1.302; the rest wait their turn.¹³

Hook output / input fields:

• duration_ms on PostToolUse / PostToolUseFailure hook input (v2.1.119+) — tool execution time excluding permission prompts and PreToolUse hooks.
• hookSpecificOutput.updatedToolOutput (v2.1.121+) — replace tool output for any tool (v2.1.118 introduced this for MCP only; v2.1.121 extends to all tools).
• hookSpecificOutput.sessionTitle (v2.1.96+) — set session title from a UserPromptSubmit hook.
• args: string[] on command hooks (v2.1.139+) — pass structured argv without shell quoting.
• Skill hook caps (v2.1.304+): the skills of one source (a repo, your own folder, or a plugin) can register at most 1,024 hooks and 16,384 matcher characters per session; a skill’s once hook no longer removes another skill’s identical hook.
• continueOnBlock on PostToolUse hooks (v2.1.139+) — feed the block reason back to Claude and continue the turn.
• subagent_type on agent hook input (v2.1.140+) — identify which agent type is running.
• terminalSequence in hook JSON output (v2.1.141+) — emit terminal-control sequences for notifications, window titles, and bells.
• onFailure: "block" on command and HTTP hooks (v2.1.295+) – a hook that cannot start, times out, exits with a code other than 0 or 2, gets an HTTP error, or prints invalid JSON blocks the action (what exit 2 does on that event; a denial on PermissionRequest). Default "continue"; ignored on Stop, SubagentStop, TaskCompleted, TeammateIdle, and async hooks.

11. MCP Quick Setup

Add an MCP server in one command:

# Remote HTTP server (recommended)
claude mcp add --transport http github https://api.githubcopilot.com/mcp/

# Remote with auth header
claude mcp add --transport http api https://api.example.com/mcp \
  --header "Authorization: Bearer $TOKEN"

# Local stdio server
claude mcp add --transport stdio postgres \
  --env "DATABASE_URL=postgresql://user:pass@localhost/db" \
  -- npx -y @anthropic-ai/mcp-server-postgres

Scope control:

claude mcp add --scope project ...   # Team-shared (.mcp.json)
claude mcp add --scope user ...      # Personal (~/.claude.json)

Project .mcp.json example:

{
  "mcpServers": {
    "github": {
      "type": "http",
      "url": "https://api.githubcopilot.com/mcp/"
    },
    "database": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@anthropic-ai/mcp-server-postgres"],
      "env": {
        "DATABASE_URL": "postgresql://user:pass@localhost/db"
      }
    }
  }
}

MCP now has 100 million monthly downloads and 3,000+ indexed servers.³ For transport types, elicitation, and tool search configuration, see the MCP section in the full guide.

alwaysLoad (v2.1.121+): Opt a trusted server out of Tool Search deferral. All its tools load at session start, no ToolSearch round-trip:

{
  "mcpServers": {
    "github": {
      "type": "http",
      "url": "https://api.githubcopilot.com/mcp/",
      "alwaysLoad": true
    }
  }
}

alwaysLoad: false (v2.1.287+) does the opposite: all of that server’s tools wait behind tool search.

Auto-retry (v2.1.121+): MCP servers that error during startup are retried up to 3 times before being marked disconnected.

URL prompts (v2.1.287+): MCP servers on the 2025-11-25 protocol can open URL prompts, for example to sign in. If a server stops connecting after the update, add "bareElicitationCapability": true to its MCP config entry.

SDK mcp_authenticate redirectUri (v2.1.121+): Required for completing OAuth on custom URI schemes — desktop apps and claude.ai connector flows.

11.5. Plugin CLI Commands

Mods (v2.1.287+): a mod is a plugin whose JavaScript or TypeScript handlers run inside Claude Code: it can draw panes, add commands, and watch or change tool calls. Mods are on by default; --safe-mode stops them for one session and "disableAllHooks": true for every session, and neither stops built-in mods.⁸

LSP servers (v2.1.288+): an LSP server entry takes requestTimeout in milliseconds (default 60000), so a server that never answers fails the request after 60 seconds instead of hanging.

12. Subagent Types

Claude automatically delegates to subagents. You can also request them explicitly:

> Use the explore agent to find all auth-related files
> Have a subagent analyze the database schema

Custom subagents are defined in .claude/agents/ (project) or ~/.claude/agents/ (personal) as markdown files with YAML frontmatter. Up to 20 subagents run concurrently by default; CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS changes the cap.⁴ As of v2.1.292, the Agent tool takes an effort parameter, so you can ask Claude to run a subagent at a given effort level, and agent names are capped at 256 characters (a longer name in a skill or plugin file is ignored). As of v2.1.302, fork subagents (subagent_type: "fork") are on by default in claude -p, the Agent SDK, the desktop app, and VS Code as well as the terminal (CLAUDE_CODE_FORK_SUBAGENT=0 turns them off; claude mcp serve never offers them), and the desktop app and VS Code always run the main conversation’s subagents in the background.¹³

claude agents opens Agent View in current releases: a research-preview operations screen for running, blocked, and completed Claude Code sessions. claude agents --cwd <path> scopes the view to one directory (v2.1.141+), v2.1.142 adds dispatch flags for background sessions, and v2.1.143 applies those flags consistently to the dashboard and background sessions: --add-dir, --settings, --mcp-config, --plugin-dir, --permission-mode, --model, --effort, and --dangerously-skip-permissions. v2.1.144 adds /resume support for background sessions and marks them with bg; v2.1.145 adds claude agents --json, awaiting-input tab counts, and Agent View reply-pane fixes; v2.1.147 adds pinned background sessions that stay alive when idle and restart in place for updates; v2.1.287 adds an n:<text> filter that matches session names and tasks; v2.1.288 adds Ctrl+F to find a session by name and Alt+Up / Alt+Down to jump between groups, both rebindable in keybindings.json (agents:find for Ctrl+F). Use Agent View for monitoring, not as proof that the work passed quality gates.⁶

Custom agent frontmatter fields:

Example custom agent (.claude/agents/security-reviewer.md):

---
name: security-reviewer
description: Expert security code reviewer. Use PROACTIVELY after code changes to auth or data handling.
tools: Read, Grep, Glob, Bash
model: opus
permissionMode: plan
---

You are a senior security engineer. Analyze for OWASP Top 10 vulnerabilities,
secrets, hardcoded credentials, and SQL injection. Report findings with severity
levels and remediation steps.

13. Environment Variables

Authentication and API

Model Configuration

Cloud Providers

Behavior Control

Tool Configuration

Background commands (v2.1.285+): background Bash and PowerShell commands stop after a time limit – their timeout with run_in_background, default 30 minutes, maximum 2 hours – and Claude is notified when one is stopped. As of v2.1.288 the limit applies only in unattended sessions (-p, Agent SDK, CI, cloud); terminal, desktop app, and VS Code sessions have no limit.

Network and Proxy

For the complete list, see Environment Variables in the full guide.

14. Cost Reference

Pricing per 1 million tokens (as of October 2026).⁵¹⁰

A typical session consumes 50K-200K input tokens and 10K-50K output tokens. Haiku 5.5 session: about $0.01-$0.05 at the rates for prompts up to 100K tokens. Opus 5.5 session: $0.40-$1.80.

Default model in Claude Code (by plan): Opus on every plan as of v2.1.280 (Sep 22, 2026) – Pro and Team Standard moved from Sonnet to Opus, matching Max, Team Premium, and Enterprise – and the default Opus model is Opus 5.5 (claude-opus-5-5), where the opus alias now lands. The v2.1.251 split (Opus 5 on the premium plans, Sonnet 5 on Pro/Team Standard) and the v2.1.197 Sonnet-5-everywhere default are history. Admins can set an org-wide default, shown as “Org default” in /model (v2.1.196+). Claude Platform on AWS, Amazon Bedrock, and Google Cloud’s Agent Platform default to Opus 5.5 too; Microsoft Foundry is the only exception (default Sonnet 4.5, and the one place opus resolves to Opus 4.6) – pin a specific model via ANTHROPIC_DEFAULT_OPUS_MODEL / ANTHROPIC_DEFAULT_SONNET_MODEL.

Opus 5.5, Sonnet 5.5, Haiku 5.5, Sonnet 5, Opus 5, Opus 4.8, Fable 5, and Fable 5.1 use adaptive reasoning only (no fixed thinking budgets), with /effort xhigh for the hardest coding/agentic work. effort defaults to high on all of them except Opus 5.5 and Sonnet 5.5, which default to medium, as Haiku 5.5 does on the Claude API – and as of v2.1.280 an effort level you saved before /effort became per-model no longer carries onto newly released models like Opus 5.5, so it starts at its own default until you pick one. Thinking cannot be turned off on Opus 5.5, Sonnet 5.5, or the Fable models (MAX_THINKING_TOKENS=0 has no effect there). Opus 5 breaking changes vs Opus 4.8: thinking is on by default for requests that omit the thinking field, and thinking: {type: "disabled"} with effort xhigh or max returns a 400.

Fast mode (/fast) applies to Opus 5.5 and Opus 5, and to Opus 4.8 until November 30, 2026 (deprecated October 30; after the removal a fast-mode request on Opus 4.8 errors instead of running at standard speed), with Opus 5.5 the default from v2.1.280 – $8 / $40 per MTok on Opus 5.5, $10 / $50 on Opus 5 and 4.8 (2× base in each case) for up to 2.5× output tokens per second. Opus 4.7 was removed: claude-opus-4-7 + speed: "fast" now errors instead of falling back to standard speed. Research preview, Claude API and subscriptions only (not Bedrock/Vertex/Foundry or Claude Platform on AWS); switching speeds invalidates the prompt cache. As of v2.1.271, fast mode also works in Claude Code Remote sessions (cloud and self-hosted runners): the host’s fast-mode setting or /fast typed in the session applies where your organization allows it.

Switch models during a session:

/model opus       # Switch to Opus 5.5 (v2.1.280+)
/model sonnet     # Switch to Sonnet 5.5 on the Anthropic API (v2.1.284+)
/model haiku      # Switch to Haiku 5.5 on the Anthropic API (v2.1.293+)
/model fable      # Switch to Fable 5.1 (tier above Opus, v2.1.257+)
/effort xhigh     # Recommended for the hardest coding/agentic work

Decision rule: Simple exploration goes to Haiku. Cost-sensitive daily coding goes to Sonnet. Hard reasoning, architecture, agentic loops, and security analysis go to Opus. Use opusplan for complex refactoring (Opus plans, Sonnet executes).

15. Key File Locations

16. Changelog

17. References

This cheat sheet is the quick-lookup companion to the full Claude Code CLI guide. For setup walkthroughs, see the Claude Code quickstart. For iOS and macOS projects specifically, see the iOS Agent Development guide, the XcodeBuildMCP integration patterns, and the Apple Ecosystem Series. Last updated October 6, 2026.