How to Secure Claude Code on a Mac: Permissions, Tools, and Security Settings

Claude Code can read project files, edit code, run terminal commands, and connect to external tools. These capabilities make it useful for development, but they also create security risks when an AI agent receives more access than it needs. The safest approach is to combine restricted permissions, macOS sandboxing, credential protection, and careful control of MCP servers.

Why You Should Secure Claude Code Before Giving It Access to Your Mac

Claude Code is more than a chatbot. It is an AI coding agent that can interact with your development environment and perform actions through approved tools.

That creates a different security problem. A normal chatbot may suggest a command, but an AI coding agent can execute it when its permissions allow it.

Consider a simple example. You ask Claude Code to fix a bug in your website. It reads project files, examines configuration settings, edits code, and runs tests. However, your project may also contain database passwords, API keys, SSH credentials, and private environment variables.

If the agent receives unnecessary access, those resources could become exposed through an unsafe command, malicious project instruction, or compromised external tool.

Why AI coding agents create new security risks

There are several important threats:

• Excessive file access: An agent may read files outside the project it needs to modify.
• Unsafe terminal commands: A command can delete files, change configurations, or execute downloaded scripts.
• Credential exposure: API keys and SSH credentials may become accessible to tools or subprocesses.
• Malicious MCP integrations: An untrusted server can introduce unsafe tools or expose connected data.
• Prompt injection: Malicious instructions hidden in repository files or external content can influence agent behavior.

The credential problem deserves particular attention.

According to GitGuardian’s 2026 State of Secrets Sprawl report, researchers detected 1,275,105 exposed AI-service secrets in 2025, an 81% year-over-year increase. The report also identified 24,008 unique secrets in MCP configuration files. These findings cover broader developer ecosystems, not Claude Code alone, but they demonstrate why AI development credentials need stronger protection. GitGuardian Annual Report+1

What Apple’s October 2026 announcement means for Mac users

Apple announced additional controls for Full Disk Access on October 2, 2026. The company explained that Full Disk Access can expose files, emails, messages, and browsing history. It also said it would introduce more explicit user actions before granting this level of access.

Apple specifically highlighted the growing risks associated with autonomous AI agents.

This announcement does not mean Claude Code requires Full Disk Access. It reinforces a practical security rule: never grant an AI application broad access to your Mac unless its actual functions require it.

Understand Claude Code’s Security and Permission Modes

Claude Code uses permission rules to control which tools can run and which actions require approval. These controls are enforced by Claude Code itself, not simply by instructions given to the AI model.

Understand the permission modes

Claude Code provides several permission modes. Their availability and starting behavior can depend on the account, environment, and application version.

Mode	How it works	Security consideration
Default	Uses permission rules and prompts for actions that need approval	Useful for interactive development
Plan	Focuses on planning before implementation	Helpful before approving major changes
Accept Edits	Automatically approves supported file edits	Use with trusted project boundaries
Auto	Uses an additional classifier to review actions when available	Not a replacement for sandboxing
Bypass Permissions	Skips normal permission prompts	High risk; avoid for ordinary development

Manual approval and automatic approval are not the same as operating-system isolation. Always check the actual mode shown in your current Claude Code session.

Configure Allow, Ask, and Deny rules

Claude Code supports three important permission decisions:

• Allow: Approves matching actions without another prompt.
• Ask: Requires approval before matching actions.
• Deny: Blocks matching actions.

For example, you might allow a project-specific test command while blocking access to .env files.

These rules are more useful when they are narrow and specific. Avoid granting broad access simply to reduce the number of permission prompts.

Avoid bypassing permission checks

The --dangerously-skip-permissions option removes normal approval safeguards. It should not be treated as a convenient way to make Claude Code faster.

For sensitive projects, keep normal permission checks enabled. If you need automation, configure a restricted sandbox instead of removing every approval boundary. Anthropic documents these controls separately because permission modes and sandbox restrictions solve different problems.

Restrict Claude Code’s File Access on macOS

Your project folder should be the main working boundary for Claude Code. There is rarely a good reason to give a coding agent unrestricted access to your entire home directory.

Keep Claude Code inside the required project directory

Start Claude Code from the project you want it to work on:

cd ~/Projects/my-website
claude

Avoid adding unrelated directories unless the task genuinely requires them.

Claude Code supports user, shared project, and project-local settings. The main configuration files include:

File	Scope
~/.claude/settings.json	Your settings across projects
.claude/settings.json	Shared project settings
.claude/settings.local.json	Personal settings for one project

Use project-local settings for experiments and personal configuration. Keep shared security rules in the project settings when your team needs the same restrictions.

Block sensitive files with deny rules

You can configure Claude Code to block reads of sensitive files.

Open your project settings file:

mkdir -p .claude
nano .claude/settings.json

Add the following configuration:

{
  "$schema": "https://json.schemastore.org/claude-code-settings.json",
  "permissions": {
    "deny": [
      "Read(.env)",
      "Read(.env.*)",
      "Read(**/.env)",
      "Read(**/.env.*)"
    ]
  }
}

Save the file and check whether Claude Code loads the configuration.

The patterns above are intended to block matching environment files under the current project. Review the actual rule matching behavior in Anthropic’s permission documentation before relying on custom patterns.

Important limitation: Permission deny rules control Claude Code’s built-in tools. They are not a universal operating-system restriction on every arbitrary subprocess. Use sandbox filesystem restrictions for stronger command-level isolation.

Avoid unnecessary Full Disk Access

To review application privacy permissions on macOS:

1. Open System Settings.
2. Select Privacy & Security.
3. Open Full Disk Access.
4. Review the applications listed.
5. Disable access for applications that do not need it.

Do not enable Full Disk Access for Claude Code simply because an installation guide or third-party tutorial suggests it. Check the actual permission requirement first.

Enable Claude Code Sandboxing on Mac

Sandboxing is one of the most important security features to understand when using Claude Code.

Anthropic’s sandboxing approach uses operating-system-level restrictions. On macOS, it relies on Apple’s Seatbelt framework to help isolate shell commands and their child processes. It can restrict both filesystem access and network connections.

How filesystem sandboxing works

Filesystem isolation restricts which directories sandboxed shell commands can access or modify.

For example, Claude Code may need permission to edit files inside your website project but should not need unrestricted write access to your private documents or SSH configuration.

The sandbox can define approved write locations and block access to other paths.

How network sandboxing works

Network isolation controls where sandboxed commands can connect.

This matters because a malicious command could attempt to send private information to an external server or download an unsafe script.

Claude Code uses a local proxy to enforce network restrictions for sandboxed shell commands. You can configure approved and denied domains.

Enable sandboxing through Claude Code

Follow these steps:

1. Open your project in Claude Code.
2. Run the following command:

/sandbox

3. Open the sandbox configuration panel.
4. Review the Mode, Overrides, and Config tabs.
5. Select the appropriate sandbox mode.
6. Review whether commands can retry outside the sandbox.

You can also enable sandboxing through your user settings:

{
  "sandbox": {
    "enabled": true
  }
}

Save this in:

~/.claude/settings.json

For stricter configurations, consider these additional settings:

{
  "sandbox": {
    "enabled": true,
    "allowUnsandboxedCommands": false,
    "failIfUnavailable": true
  }
}

The two additional settings matter because they prevent Claude Code from silently falling back to unsandboxed command execution when the sandbox cannot operate. Test compatibility before using this configuration on a production project.

Verify that sandboxing works

Anthropic documents practical checks for sandbox behavior.

For example, ask Claude Code to run:

touch ~/sandbox-probe

If your home directory is outside the sandbox’s allowed write locations, this should fail with an operation-not-permitted error on macOS.

You can also test network isolation:

curl --noproxy '*' https://example.com

A sandboxed command should not be able to bypass the configured network proxy.

Do not run these checks by typing them directly into the shell-mode prompt. Anthropic notes that commands entered there normally run outside the sandbox. Ask Claude Code to execute them through its sandboxed Bash tool instead.

An important distinction: Claude Code’s sandbox does not automatically cover every component. Built-in file tools, local MCP servers, hooks, plugin monitors, and some helper processes operate outside the Bash sandbox. This is why sandboxing must be combined with permission rules and integration reviews.

Protect API Keys, SSH Keys and Environment Variables

Credentials are among the most valuable resources on a developer’s Mac. A single exposed key can provide access to cloud services, databases, source-code repositories, or production infrastructure.

Keep credentials outside source code

Avoid placing API keys directly inside application source files.

Use environment variables or an appropriate secret manager instead. For example:

export OPENAI_API_KEY="your-secret-key"

Do not paste real credentials into shared configuration files, documentation, screenshots, or public repositories.

Protect sensitive credential files

Review access to files and directories such as:

• .env and .env.local
• ~/.ssh/
• ~/.aws/
• ~/.config/
• Cloud service credential files
• Database connection configuration

Use Claude Code permission rules to block unnecessary reads, and sandbox restrictions to limit what subprocesses can access.

Add secret files to Git exclusions

Your .gitignore file should include sensitive development files:

.env
.env.*
!.env.example

*.pem
*.key

Check existing tracking before assuming these rules protect your credentials. If a secret has already entered Git history, adding it to .gitignore does not remove the historical exposure.

If an API key or password is exposed, revoke or rotate it immediately.

Secure MCP Servers Before Connecting Them to Claude Code

The Model Context Protocol (MCP) allows Claude Code to connect to external tools and services. These integrations can be useful, but they also expand the agent’s security boundary.

An MCP server may access files, databases, APIs, or other services depending on its implementation and granted credentials.

Review the MCP server before installation

Before connecting a server:

1. Check its official repository.
2. Verify the developer or organization behind it.
3. Review its source code and dependencies.
4. Check whether it downloads or executes external scripts.
5. Understand which credentials it requires.
6. Avoid unnecessary access to production resources.

A popular repository is not automatically a trustworthy one.

Limit MCP permissions and credentials

Use separate credentials for different integrations. Grant each server only the access required for its purpose.

For example, a database research integration should preferably use a read-only account rather than a production administrator account.

Avoid storing API keys directly in shared project configuration.

Review your active MCP servers

Use these commands to inspect your MCP setup:

claude mcp list

To inspect a particular server:

claude mcp get server-name

Inside Claude Code, you can also use:

/mcp

Remove servers you no longer need. The fewer unnecessary integrations you maintain, the smaller your potential attack surface.

Audit Claude Code Skills, Plugins and Hooks

Claude Code can use skills, plugins, and hooks to extend its capabilities. These extensions can save time, but they may also introduce security risks if you install them without reviewing their contents.

Anthropic explains that skills can contain instructions, scripts, and supporting resources. Hooks can execute commands automatically during specific events in a Claude Code session. Claude by

Inspect Agent Skills before installing them

A skill may look like a simple instruction file, but it can also include executable scripts and external resources.

Before installing a third-party skill:

• Review its SKILL.md file.
• Inspect scripts and commands included in the package.
• Check external URLs and download instructions.
• Verify the publisher and repository.
• Avoid skills that request unnecessary credentials or permissions.

Do not assume that a skill is safe just because it appears in a marketplace.

Review plugins and their sources

Only install plugins that serve a genuine development need. Check their publishers, dependencies, installation scripts, and requested access.

Remove unused plugins and review updates before accepting changes to security-sensitive components.

Monitor hooks and automated commands

Hooks deserve special attention because some execute automatically when particular events occur.

Review commands registered for events such as PreToolUse, PostToolUse, and session lifecycle events.

A PreToolUse hook can enforce deterministic restrictions on tool calls. This is more reliable than relying on an instruction in CLAUDE.md when a command must always be blocked.

For business environments, Anthropic also offers organization-level skill and plugin scanning for eligible Enterprise plans. However, its documentation distinguishes these scans from MCP server scanning, which is not covered by that feature. Claude Help Center

Protect Claude Code Against Prompt Injection

Prompt injection is a serious concern for AI coding agents because they process information from different sources, not just instructions written directly by their users.

A malicious instruction could appear in a repository README, documentation file, issue description, webpage, or external tool response.

For example, you ask Claude Code to inspect a GitHub project. A malicious file contains instructions telling the agent to read a credential file and send its contents to an external server.

The agent may encounter that instruction while performing an otherwise legitimate task.

How to reduce prompt injection risks

Use several safeguards together:

1. Treat external content as untrusted. Do not assume repository instructions or downloaded documentation are safe.
2. Restrict file access. Block unnecessary access to credential files and private directories.
3. Enable sandboxing. Limit filesystem and network access for shell commands.
4. Review MCP integrations. Check the tools and permissions exposed by each server.
5. Inspect sensitive actions. Review commands involving credentials, external connections, deletion, or deployment.
6. Use deterministic controls. Apply permission rules and hooks for actions that must be restricted.

A particularly important point: telling Claude Code to ignore malicious instructions is not a security boundary. Instructions can influence model behavior, but operating-system restrictions and enforced permission rules provide stronger protection.

Anthropic’s sandboxing research explains why combining filesystem and network isolation matters. A compromised agent should not be able to freely access private files and communicate with arbitrary external servers.

Should You Use Bitdefender AI Guardian With Claude Code?

Claude Code already provides native security features. However, developers who use multiple AI tools, external integrations, and sensitive credentials may want another layer of monitoring.

Bitdefender AI Guardian is designed to monitor and control actions taken by supported AI agents.

Official website: Bitdefender AI Guardian

How AI Guardian adds another security layer

According to Bitdefender’s September 30, 2026 announcement, its public beta supports Claude Code version 2.1.121 or later.

Its announced capabilities include:

• Prompt injection detection: Identifies potentially malicious instructions and related actions.
• MCP tool verification: Checks MCP tools for malicious or tampered behavior.
• Skill scanning: Reviews supported agent skills before execution.
• Credential protection: Helps protect API keys, SSH keys, and sensitive files.
• Action monitoring: Evaluates agent actions and records security decisions.
• Audit logs: Provides a record of allowed, flagged, and blocked actions.

Bitdefender says prompt analysis runs locally on the device, although selected checks, such as URL reputation, use its cloud services. Bitdefender

AI Guardian vs native Claude Code security

Security capability	Claude Code	AI Guardian
Permission rules	Native	Additional policy layer
Filesystem sandbox	Native	Additional monitoring
Network isolation	Native	Additional security checks
MCP protection	Permission and trust controls	Tool verification
Skill inspection	Manual review	Automated scanning for supported skills
Prompt injection	Native safeguards and restrictions	Additional detection
Credential protection	File and permission controls	Additional credential monitoring
Activity records	Session and application information	Security decision audit logs

These products have different roles. AI Guardian should complement Claude Code’s native controls rather than replace them.

Who should consider AI Guardian?

It may be useful if you:

• Frequently connect multiple MCP servers.
• Work with sensitive API keys and SSH credentials.
• Install third-party skills and plugins.
• Want additional visibility into AI agent actions.
• Prefer centralized monitoring instead of reviewing every integration manually.

However, casual developers working on small, non-sensitive projects may find native Claude Code permissions and sandboxing sufficient for their needs.

What about pricing and availability?

At its September 30, 2026 launch, Bitdefender announced free access throughout the public beta period. It also stated that the initial release was available for macOS, with additional operating-system support planned. These are launch-period terms, not a guarantee of future pricing or availability. Bitdefender

For a more detailed product evaluation, read our Bitdefender AI Guardian review. Check that the review is available before publishing this link.

Monitor Claude Code Activity and Review Security Logs

Security configuration is not a one-time task. Your project changes, new MCP servers appear, and permissions may accumulate as you approve additional actions.

Make a habit of reviewing your configuration.

Check which settings Claude Code actually loaded

Run:

/status

This displays the settings sources loaded for the current session.

If you suspect a configuration error, run:

claude doctor

This helps identify rejected settings and configuration problems.

Review active integrations

Periodically inspect:

• Connected MCP servers.
• Installed skills and plugins.
• Permission allow and deny rules.
• Hooks and automated commands.
• Additional directories.
• Sandbox network and filesystem settings.

Remove unused integrations and revoke credentials that are no longer necessary.

If you use AI Guardian, review its security decision logs as well. Investigate unexpected flagged or blocked actions rather than automatically approving them.

Claude Code Mac Security Checklist

Use this checklist before allowing Claude Code to work on an important project.

1. Start Claude Code from the correct project directory.
2. Keep Full Disk Access disabled unless genuinely required.
3. Use appropriate permission rules and approval modes.
4. Block unnecessary access to .env files and credentials.
5. Enable macOS filesystem and network sandboxing.
6. Disable unsandboxed command retries when appropriate.
7. Use separate, least-privilege API credentials.
8. Review MCP server sources before connecting them.
9. Inspect third-party skills, plugins, and hooks.
10. Review unexpected terminal commands and external connections.
11. Run /status and check the active settings.
12. Remove unused integrations and rotate exposed credentials.

FAQs: How to Secure Claude Code on Mac

Secure Your Mac Before Giving AI Agents More Control

Claude Code can make development more efficient, but developers should decide how much access an AI agent actually needs.

Start with restricted project access, review permission rules, enable sandboxing, and protect credentials. Treat MCP servers and third-party skills as external software that needs inspection.

If you need additional monitoring, consider Bitdefender AI Guardian alongside Claude Code’s native security features.

The goal is not to prevent Claude Code from doing useful work. It is to give it enough access to complete its tasks without unnecessarily exposing your Mac or development environment.

Start by reviewing your current Claude Code permissions and running /sandbox before your next important development session.