A practical walkthrough of Claude Code deep links: the claude-cli:// URL scheme, how to build links with repo, cwd, and prompt parameters, embedding them in runbooks and alerts, and the safety model where prompts are inert until you press Enter.
Open the source and read safety notes before installing.
Source-backed facts for citing this resource, derived directly from the registry — also available as plain text for AI assistants.
Decision playbook
Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.
0
63
—
No baseline selected
No major trust-signal divergence detected in the current selection.
Confirm ownership and provenance before trusting install instructions.
Source link availableRequired
Open the canonical repository and verify ownership.
Source provenance statusRequired
Marked as source-backed.
Metadata reviewed
No reviewed flag detected in metadata.
Validate risk disclosures before installation or API wiring.
Safety notes presentRequired
Review the listed safety guidance before running commands.
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
Trust level risk gateRequired
Trust level does not block evaluation.
Check package metadata and artifact integrity signals.
Install payload available
Install or copy payload is available for review.
Package verification flag
No package verification flag provided.
Checksum metadata
No checksum provided for downloaded artifact.
Use compare context to validate trade-offs before adoption.
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
Baseline comparison available
No baseline peer selected yet.
Diverging trust signals identified
No major trust-signal divergence found.
Setup at a glance
Copy-ready — paste the snippet to get started.
Adoption plan
Current risk score 24/100. Use staged verification before broader rollout.
Validate source and review signals before any execution.
Confirm source provenanceRequired
Source URL/provenance metadata is present.
Confirm metadata review state
No review metadata found; increase manual validation.
Verify install payload
Install/config payload exists and can be inspected.
Confirm safety, privacy, and package integrity signals.
Review safety notesRequired
Safety notes are present.
Review privacy notesRequired
Privacy notes are present.
Verify package integrity metadata
No package verification/checksum metadata.
Adopt in controlled steps based on the selected plan.
Run in isolated sandbox firstRequired
Use a constrained sandbox and observe behavior across multiple tasks.
Roll out graduallyRequired
Roll out to a small cohort before wider usage.
Set monitoring and fallback
Define rollback path and monitor errors after adoption.
Evidence readiness
Missing required evidence: Metadata review. Risk score 31.
Source repository/provenance is listed.
Required in this preset
Review metadata is missing.
Required in this preset
Safety notes are present.
Required in this preset
Privacy notes are present.
Optional in this preset
Package integrity metadata is missing.
Optional in this preset
Install payload is available.
Required in this preset
Required gaps: Metadata review
Decision timeline
Blocking gaps: Check metadata review status. Risk 28.
triage
Source/provenance metadata is available.
triage
Review metadata is missing.
verify
Safety notes are available.
verify
Privacy notes are available.
verify
Package integrity metadata is missing.
rollout
Install payload is available.
Blockers: Check metadata review status
Prerequisite readiness
3 prerequisites to line up before setup. Have accounts and credentials ready first.
Safety & privacy surface
4 safety and 3 privacy notes across 5 risk areas. Review closely: credentials & tokens, permissions & scopes, network access.
## Overview
A deep link is a `claude-cli://` URL that opens Claude Code in a new terminal
window, optionally in a specific repository and with a prompt already typed. It
turns a runbook step, alert, or dashboard into a one-click starting point for a
task. The prompt is pre-filled but never sent until you press Enter.
## Build a link
Every link starts with `claude-cli://open` and takes optional query parameters:
| Parameter | Description |
| --- | --- |
| `q` | Prompt text to pre-fill. URL-encode it; use `%0A` for newlines. Max 5,000 chars. |
| `cwd` | Absolute working directory. Network and UNC paths are rejected. |
| `repo` | A GitHub `owner/name` slug resolved to a local clone you have used before. |
If both `cwd` and `repo` are present, `cwd` wins. Example:
```text
claude-cli://open?repo=acme/payments&q=Investigate%20the%20failed%20deploy.%0ACheck%20recent%20commits%20to%20main.
```
Clicking it opens Claude Code in your local clone of `acme/payments` with the
decoded two-line prompt ready to edit and send.
## Embed in a runbook
```markdown
## High 5xx rate on web-gateway
1. Acknowledge the page.
2. [Open Claude Code in the gateway repo](claude-cli://open?repo=acme/web-gateway&q=5xx%20rate%20is%20elevated.%20Check%20recent%20deploys%20and%20error%20logs.)
3. Post findings in the incident channel.
```
Note: GitHub-rendered Markdown strips `claude-cli://`, so on GitHub put the link
in a code block for readers to copy. Use a wiki, dashboard, or chat tool that
allows custom URL schemes for true one-click behavior.
## Trigger from the shell
```bash
# macOS
open "claude-cli://open?repo=acme/payments&q=review%20open%20PRs"
# Linux
xdg-open "claude-cli://open?repo=acme/payments&q=review%20open%20PRs"
```
On Windows, `Start-Process "claude-cli://open?..."` in PowerShell.
## cwd vs repo
- Use `cwd` when everyone has the project at the same absolute path (for example
a standardized devcontainer).
- Use `repo` when each person clones to a different location; Claude Code opens
the matching clone you used most recently. It only finds clones where you have
run Claude Code at least once, and the link does not change the checked-out
branch.
## Safety model
The launched session shows a `Prompt from an external link` warning until you
send or clear it. For prompts over 1,000 characters, the warning includes the
length and reminds you to scroll and review. Nothing runs until you press Enter,
and normal permission rules, CLAUDE.md, and trust prompts still apply.
## Tip
Store long runbook prompts as a `/skill` in the repo so the link's `q` parameter
only has to name the skill.
## Source
- Launch sessions from links: https://code.claude.com/docs/en/deep-linksA deep link is a claude-cli:// URL that opens Claude Code in a new terminal
window, optionally in a specific repository and with a prompt already typed. It
turns a runbook step, alert, or dashboard into a one-click starting point for a
task. The prompt is pre-filled but never sent until you press Enter.
Every link starts with claude-cli://open and takes optional query parameters:
| Parameter | Description |
|---|---|
q |
Prompt text to pre-fill. URL-encode it; use %0A for newlines. Max 5,000 chars. |
cwd |
Absolute working directory. Network and UNC paths are rejected. |
repo |
A GitHub owner/name slug resolved to a local clone you have used before. |
If both cwd and repo are present, cwd wins. Example:
claude-cli://open?repo=acme/payments&q=Investigate%20the%20failed%20deploy.%0ACheck%20recent%20commits%20to%20main.
Clicking it opens Claude Code in your local clone of acme/payments with the
decoded two-line prompt ready to edit and send.
## High 5xx rate on web-gateway
1. Acknowledge the page.
2. [Open Claude Code in the gateway repo](claude-cli://open?repo=acme/web-gateway&q=5xx%20rate%20is%20elevated.%20Check%20recent%20deploys%20and%20error%20logs.)
3. Post findings in the incident channel.
Note: GitHub-rendered Markdown strips claude-cli://, so on GitHub put the link
in a code block for readers to copy. Use a wiki, dashboard, or chat tool that
allows custom URL schemes for true one-click behavior.
# macOS
open "claude-cli://open?repo=acme/payments&q=review%20open%20PRs"
# Linux
xdg-open "claude-cli://open?repo=acme/payments&q=review%20open%20PRs"
On Windows, Start-Process "claude-cli://open?..." in PowerShell.
cwd when everyone has the project at the same absolute path (for example
a standardized devcontainer).repo when each person clones to a different location; Claude Code opens
the matching clone you used most recently. It only finds clones where you have
run Claude Code at least once, and the link does not change the checked-out
branch.The launched session shows a Prompt from an external link warning until you
send or clear it. For prompts over 1,000 characters, the warning includes the
length and reminds you to scroll and review. Nothing runs until you press Enter,
and normal permission rules, CLAUDE.md, and trust prompts still apply.
Store long runbook prompts as a /skill in the repo so the link's q parameter
only has to name the skill.
Show that Deep Links into Claude Code Runbooks and Alerts is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/guides/deep-links-into-claude-code-runbooks-and-alerts)Deep Links into Claude Code Runbooks and Alerts side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
2 trust signals differ across this comparison (Source provenance, Submitter).
| Field | A practical walkthrough of Claude Code deep links: the claude-cli:// URL scheme, how to build links with repo, cwd, and prompt parameters, embedding them in runbooks and alerts, and the safety model where prompts are inert until you press Enter. Open dossier | Configure Claude Code auto mode hard-deny rules that block high-risk actions unconditionally, complement soft-deny prompts and team permission policy. Open dossier | A practical walkthrough of Claude Code channels: how an MCP-server channel pushes messages, alerts, and webhooks into a running session, how to install and enable Telegram, Discord, or iMessage, sender allowlists, and enterprise controls. Open dossier | Set up Claude Code GitHub Actions for pull request review: install the Claude GitHub app, store ANTHROPIC_API_KEY in secrets, pin anthropics/claude-code-action to an audited commit SHA with least-privilege permissions, and follow documented security practices. Open dossier |
|---|---|---|---|---|
| Next steps | ||||
| Trust | ||||
| Review status | Not reviewed | Not reviewed | Not reviewed | Not reviewed |
| Package trust | Package not verified | Package not verified | Package not verified | Package not verified |
| Source provenanceDiffers | Source-backed | Submission linkedSource submission | Source-backed | Submission linkedSource submission |
| SubmitterDiffers | JPette1783 | kiannidev | JPette1783 | kiannidev |
| Install risk | Review first | Review first | Review first | Review first |
| Notes | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ |
| Brand | — | — | — | |
| Category | guides | guides | guides | guides |
| Source | Source-backed | Source-backed | Source-backed | Source-backed |
| Author | JPette1783 | kiannidev | JPette1783 | kiannidev |
| Added | 2026-06-05 | 2026-06-13 | 2026-06-05 | 2026-06-16 |
| Platforms | ||||
| Harness | ||||
| Source repo | — | — | — | — |
| Safety notes | ✓A deep link only chooses a directory and pre-fills the prompt box; nothing reaches the model until you read it and press Enter. Treat links from untrusted sources with care: review the pre-filled prompt, especially long ones, before sending, since long prompts can scroll off screen. Permission rules, CLAUDE.md, and directory trust prompts apply to a link-launched session the same as any other session. Administrators can disable handler registration with disableDeepLinkRegistration in managed settings. | ✓Hard-deny rules block regardless of user intent or allow exceptions—misconfiguration can halt legitimate workflows. Auto mode classifiers can still fail open with evaluation errors; hard deny is not a substitute for branch protection and CI gates. Do not rely on auto mode alone for secrets handling; deny credential reads and outbound bulk transfers explicitly. | ✓Channel input is untrusted external content; treat incoming messages as data, not as instructions that should widen permissions. Events only arrive while the session is open; for unattended use, --dangerously-skip-permissions bypasses prompts and should be used only in trusted environments. Each channel keeps a sender allowlist; only paired/allowlisted IDs can push messages, and anyone who can reply can also approve permission relays if enabled, so allowlist only trusted senders. | ✓The Claude GitHub app requests Contents, Issues, and Pull requests read and write permissions—scope installation to intended repositories. Never commit API keys; use GitHub encrypted secrets such as ANTHROPIC_API_KEY, and only expose them to workflows you trust. Pin third-party GitHub Actions to reviewed immutable commit SHAs rather than mutable tags. Declare least-privilege GITHUB_TOKEN permissions explicitly before enabling AI review workflows. Review Claude suggestions before merging; automation should not bypass CODEOWNERS. Workflows consume GitHub Actions minutes and Claude API tokens—set timeouts and max-turn limits. |
| Privacy notes | ✓The link itself can be hosted anywhere, but the session always opens locally on the machine where you click; no remote execution occurs. Encode prompts carefully and avoid embedding secrets or sensitive identifiers in shared link URLs. The cwd parameter rejects network and UNC paths; repo only resolves to clones Claude Code has already seen. | ✓Auto mode classifiers evaluate tool names, arguments, and session context that may include file paths and repository metadata. Denial messages and debug logs can retain snippets of blocked commands; restrict log access on shared machines. Managed settings sync may expose rule text to all enrolled clients—avoid embedding internal codenames you do not want widely visible. | ✓A channel is an MCP server you configure with your own credentials; tokens are stored locally (for example ~/.claude/channels/telegram/.env). Incoming and outgoing messages pass through the third-party platform (Telegram, Discord, Apple Messages); review what data flows there. The iMessage channel reads your Messages database and requires Full Disk Access; understand that exposure before enabling it. | ✓PR diffs and issue comments are attacker-controlled on public repositories; treat them as prompt-injection input and avoid giving untrusted PRs secret-backed tool access. PR diffs and issue comments are sent to the model provider during workflow runs. Logs may retain prompts—align retention with corporate data handling rules. Use repository secrets rather than echoing credentials in workflow YAML. |
| Prerequisites |
|
|
|
|
| Install | — | — | — | — |
| Config | — | — | — | — |
| Citations | ||||
| Claim | Unclaimed | Unclaimed | Unclaimed | Unclaimed |
Set autoMode.hard_deny rules to block risky actions in auto mode.
Loading live community signals…
A short, calm digest of reviewed Claude resources. Unsubscribe any time.