Is it safe to approve Claude Code actions from your phone?

01How remote approval works

Claude Code has a hook event called PermissionRequest. It runs when Claude Code is about to ask you for permission to use a tool. A hook can answer with a decision, allow or deny, and Claude Code uses it instead of waiting for you to answer in the terminal. Remote approval tools use this hook: the hook sends the request to your phone, waits, and returns your answer. The PermissionRequest guide shows the JSON.

Three properties of this design matter for safety. All come from Anthropic's hooks documentation:

• It only fires when there would be a prompt. If your permission mode or allow rules already let an action through, there is no request. Remote approval cannot give Claude more power than you would have had at the keyboard.
• Deny rules still win. A hook returning allow does not bypass deny rules from your settings. If you deny Read(./.env), a tap on a phone cannot let Claude read it.
• The hook runs as you. Command hooks run with your full user permissions. Whatever program you install as a hook can read and change anything your account can. That makes the choice of tool part of your security, not just the phone.

02The risks, and what limits each one

Someone else answers

The worst case is that a person or device you did not intend approves an action. What limits it:

• Pairing. A phone can only answer for a computer it has been paired with. With Claude Code Notifier, pairing uses a QR code or a 6-digit code that lasts 24 hours, and each computer can have up to three phones.
• Revoking. ccn devices lists the phones paired with a computer, and ccn devices revoke <name> removes one. ccn forget erases the computer and its pairings from the server.
• Your phone's lock. Anyone holding your unlocked phone can answer. Treat the phone as a key to your computer's Claude Code sessions, and use a passcode or biometric lock.

You approve something you did not read

On a phone, a long shell command is easy to skim. Some habits help:

• Read the whole command before you tap allow. If it is not obviously fine, deny it and look at the terminal later.
• Prefer allow once over allow for the session for anything that changes state outside the project, such as git push, deploys or package installs.
• Put risky commands behind ask rules and secrets behind deny rules in your settings, so the dangerous cases are decided by rules you wrote calmly, not by a tap in a queue. The permission modes guide shows the syntax.

You are actually at the keyboard

If a request reaches the phone while you are sitting at the computer, two people (you and your phone) can answer the same prompt. Claude Code Notifier checks presence on the computer: if you typed in the last 30 seconds, nothing waits for the phone and the terminal asks as usual. If you are away, the terminal waits for the phone's answer up to a ceiling you choose, and stops waiting the moment you touch the keyboard. The idle check happens on the computer and its result is never sent.

Project details leave your computer

To show you a request, something has to send its details to your phone. That is the privacy trade-off of any phone notification for Claude Code, do-it-yourself or not. With Claude Code Notifier, as set out in its Privacy Policy:

• There are no accounts. Each computer and phone is identified by a random ID.
• What a notification can contain: the project's name and folder path, Claude's message or the question it is asking, the start of your prompt, and for a permission prompt the tool name and a summary of its input, such as the shell command or file path (up to 200 characters).
• Where it goes: through TouchTap's relay server, which runs on Cloudflare, and a shorter version to Apple or Google to deliver the push. Project folder paths are not sent to Apple or Google.
• How long it is kept: the server deletes notifications, and your answers to them, within 48 hours. The relay server does not store your IP address.
• In transit: all communication with the server uses TLS (HTTPS and WSS). The relay holds the notification content for delivery, so this is encryption in transit, not end-to-end encryption.
• Not sold: data is not sold or used for advertising.

On the computer, ccn's credential is a random token. By default it is kept in the macOS Keychain or Windows Credential Manager, and on Linux in a file only your user account can read; ccn config set credential_store switches between the system keychain and a file.

If you work on confidential code, the policy's own advice is to consider whether phone notifications are appropriate, and which kinds to turn on for each computer. You can turn off notify_on_done, notify_on_permission or notify_on_question separately, per computer, from the command line or the phone app.

The lock screen shows too much

A banner with a command or a client's project name is visible to anyone who glances at your phone. Both iPhone and Android let you hide notification previews until the phone is unlocked, for all apps or one app. On iPhone this is under Settings, then Notifications. On Android it is in the lock screen notification settings, usually as an option to hide sensitive content.

03Do-it-yourself remote approval

You can build remote approval yourself with a PermissionRequest hook and a chat bot or push service. You are then building an authentication system: only you must be able to answer, an old answer must not apply to a new request, and a stalled request must not leave a session stuck. On a shared public push server, a topic name is the only thing keeping strangers out, so treat it like a password. The guides to ntfy and Telegram, Slack or Discord cover notification-only setups, which carry far less risk because they cannot approve anything.

04Hooks from repositories you did not write

One more risk applies to every hook, not just approval. Hooks can be committed in a project's .claude/settings.json. In an interactive session, Claude Code holds back hooks until you accept the workspace trust dialog for the folder, so read a repository's .claude/ files before you trust it. In claude -p and SDK runs there is no dialog and the folder is treated as trusted, so committed hooks run. For scripted runs over code you did not write, pass --settings '{"disableAllHooks": true}'.

05Where Claude Code Notifier fits

Claude Code Notifier is an independent tool made by TouchTap Ltd. It is not made, endorsed or sponsored by Anthropic. Its command line tool, ccn, runs as Claude Code hooks on Mac, Windows and Linux, and its iPhone and Android apps let you allow once, allow for the session, or deny. ccn is source-available on GitHub, so you can read exactly what runs as your hook before you install it. The phone approval guide covers setup.

06FAQ