Use Claude Code on Mac without constant permission prompts
Claude Code asks constantly: read this file, run that command, create this directory. Click „Allow" a hundred times a day and eventually you stop reading. The official escape hatch is claude --dangerously-skip-permissions — which runs the agent with zero prompts and your full user rights, including ~/.ssh, keychains and cloud credentials.
There's a third option: put the terminal Claude Code runs in inside the macOS Seatbelt sandbox. You set the access boundaries before launch — then the agent works without prompts, but only within those boundaries.
The idea: sandbox the terminal, not the tool
Claude Code runs inside a terminal. So sandboxing doesn't need to hit the AI itself — it wraps the session around it: a ScopeShelf launcher for your terminal (iTerm or Terminal.app) governs everything running inside — Claude Code, scripts, helper commands. The rules don't live inside the session; they're a reusable launcher with a visible zone model. Claude Code's own built-in sandboxing is unaffected and can run on top.
Step-by-step setup
Tested with Claude Code 2.1.267 (native installer) on macOS 26:
- Install ScopeShelf and launch it once.
- Create a launcher for your terminal: New launcher → choose app → iTerm (there's a preset with its known data folders) or Terminal.app.
- Add these grants (the folder picker also accepts individual files):
# Writable: ~/your-project-folder # the code the AI works on ~/.claude # Claude Code settings and session data ~/.local/bin # native installer: symlink to versioned binaries ~/.local/share/claude # native installer: the actual binaries # Individual files (granted as files, not folders): ~/.claude.json # global config ~/.gitconfig # optional: git identity for commits
- Keep network „allowed" — Claude Code needs network for the API. The protection targets files.
- Launch the terminal via ScopeShelf (the „Start" button or a Dock starter) and work as usual:
claude— no--dangerously-skip-permissions, but also no constant prompts for granted folders.
Prefer the CLI?
# Create the launcher scopeshelf add "Terminal Claude" --app /Applications/iTerm.app \ --write ~/repos/my-project --write ~/.claude --write ~/.local/bin \ --write ~/.local/share/claude # Inspect the profile first: scopeshelf dry terminal-claude # Launch: scopeshelf run terminal-claude
The protection test (how we verified it)
Inside the sandboxed terminal:
claude --version # works normally cat ~/.ssh/config # Operation not permitted — the folder does not exist for this session cat ~/.zshrc # also invisible
Everything else in your home folder is completely invisible to the session — not „please don't touch", but refused by the kernel. If a process tries anyway, macOS blocks it and ScopeShelf's audit log shows you the attempt (operation, path, how often).
The honest limits
- Writable means writable. Inside the granted project folder the AI may delete and modify — that's the point. Use version control (git) and it's harmless.
- Network stays open. Claude Code needs the API. ScopeShelf's network switch is all-or-nothing per launcher — for AI tools, „allowed" is the normal setting.
- Allowed system services stay allowed. The profile denies your home folder specifically (
deny subpath $HOME) instead of everything — system paths outside stay usable so apps don't break. That's a documented design choice, not a hole. - No protection against prompt injection in the granted area. If the AI reads a manipulated file inside the project folder, your grants apply there. The sandbox limits access — not the intent of content.
Bottom line
Instead of approving every action one by one — or opening everything with --dangerously-skip-permissions — you limit file access once before launch and let Claude Code work inside. The boundaries are visible, reusable, and apply just the same to Codex or any other tool you start in that terminal.
ScopeShelf: €19 once, 7-day free trial, no account. Download · Read next: Codex CLI in YOLO mode: limit file access