Configure the sandboxed Bash tool changedsandboxing
Upstream edited this page at 7 Nov 2026 04:00 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 7 Nov 2026 04:07 UTC.
Upstream edited
Recorded here
Lines+1added
Lines−0removed
From line
37
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits63to this page, all time
The whole hunk
from line 37, old and new numbered
/
from line 37
3737
3838* **Built-in file and web tools**: tools such as Read, Edit, Write, WebFetch, and WebSearch follow [permission rules](https://code.claude.com/docs/en/permissions.md) instead. A `denyRead` entry doesn't stop the Read tool, and `allowedDomains` doesn't limit WebFetch
3939* **Other processes Claude Code starts**: command [hooks](https://code.claude.com/docs/en/hooks.md), local [MCP servers](https://code.claude.com/docs/en/mcp.md), [plugin monitors](https://code.claude.com/docs/en/plugins/components.md#monitors), [LSP servers](https://code.claude.com/docs/en/tools-reference.md#lsp-tool-behavior), and helper commands such as your [status line](https://code.claude.com/docs/en/statusline.md) command and `apiKeyHelper` run with your full access
40* **Mods**: a [mod](https://code.claude.com/docs/en/plugins/mods/overview.md) runs its own code inside Claude Code, so its file access, network requests, and programs started with [`$.process`](https://code.claude.com/docs/en/plugins/mods/api#reach-files-processes-and-the-network) aren't sandboxed. See [What a mod can reach](https://code.claude.com/docs/en/plugins/mods/overview.md#what-a-mod-can-reach)
4041
4142Some shell commands also run outside the sandbox, depending on your settings:
4243
No line in this hunk matches that.