Claude Code Sandbox

Claude Code Sandbox

A macOS sandbox configuration for Claude Code that restricts filesystem READ access for enhanced security.

Just about all sandbox-exec attempts for claude you'll find on GitHub allow full filesystem read access and full network access – all they protect against is file overwrites. But that's not very secure - prompt injection could leak data from all over your filesystem if claude can read it.

This project provides a macOS sandbox-exec profile that limits claude's access to your filesystem. It prevents Claude Code from reading your home directory (except for the current working directory) and restricts writes to only the target directory and temporary locations.

Features

- Restricted Read Access: Blocks reading from file system except for:
  - Current working directory (TARGET_DIR)
  - Git configuration files (.gitconfig, .config/git)
  - System directories (/usr, /bin, /opt, /var, /nix, /etc, /System, /Library/Java)
  - It allows _listing_ directories leading up to TARGET_DIR, because otherwise claude will glitch and set PATH to "" for agent.
    However, even though files in ~ can be listed with ls by claude, they (and their metadata) cannot be read

- Restricted Write Access: Only allows writing to:
  - Current working directory (TARGET_DIR)
  - Temporary directories (/tmp, /var/folders)
  - Cache directory (~/.cache)
  - Claude, Gemini & Codex configuration (~/.claude, ~/.gemini, ~/.codex)

- Network Access: Full network access enabled (required for Claude API)
- Keychain Access: Allows reading from macOS Keychain for API key storage

Installation

Manual Installation (Without Nix)

Run the installation script:

This will:
1. Concatenate the default sandbox profile noread.sb and claude-sandbox script together to make the script…