From the doc, this suggestion is hardly satisfactory:
replyThe sandbox covers shell commands only. Claude’s file tools, MCP servers, and hooks run outside it.
Also this is in my view the main job of a scaffold like claude code - to restrict what the agent can see and make sure it doesn't use info it should not. It's not something a user can easily or should have to attempt to control themselves.
File tools, by default asks permission to edit outside directory. There is no MCP tools or hooks by default and if you install it you need explicit permission to trust it.
replyThese CLI sandboxes are trash, use something else. Container, VM, not your computer. Just don't run it on your bare system, please.
reply