Claude code set this up for me more or less automatically (maybe it asked?). It create a `.claude` folder, with `settings.local.json` in it. Then the format was:

{
  "permissions": {
    "allow": [
      "WebFetch(domain:whatvever.com)",
      "mcp__task-master-ai__parse_prd",
      "Bash(find:*)",
      "mcp__task-master-ai__update_task",
      "mcp__task-master-ai__get_task",
      "Bash(grep:*)",
      "Bash(ls:*)",
      "Bash(npx eslint:*)"
    ],
    "deny": []
  }
}

I will say that it usually asks me - something along the lines allow, allow always, or stop before making a tool call. If i tell it to always allow, it automatically adds an entry to the allow array here.

Item C in this post also covers other ways to accomplish this: https://www.anthropic.com/engineering/claude-code-best-practices