305 pages for sandbox.
Titles and paths first, then pages whose text carries it. Each row opens that page as this site last read it.
Data storage and retention
Claude Documentation · in the page
office-agents/data-storage
…OS the store is split by Office app instead. Each app runs in its own sandbox container, so Excel, Word, PowerPoint, and Outlook always keep separate histories, and local storage sits inside the folde…
Use Claude for M365 with third-party platforms
Claude Documentation · in the page
office-agents/third-party-platforms
…to Anthropic. The add-in stores the token in localStorage within its sandboxed iframe, in the same place and form as a Claude account sign-in, and refreshes it in the background. It is not synced to…
Create custom skills
Claude Documentation · in the page
skills/how-to
…l's whole folder, scripts included, is copied into the code execution sandbox, so also keep the path readable relative to `SKILL.md`, such as `scripts/render.py`. In Claude Code, running a script is…
Skills overview
Claude Documentation · in the page
skills/overview
…le on Pro, Max, Team, and Enterprise plans. They run in Claude's code sandbox, so **Code execution and file creation** must be on: turn it on under [**Settings > Capabilities**](https://claude.ai/sett…
Deploy Claude Desktop on 3P with Amazon Bedrock
Claude Documentation · in the page
third-party/claude-desktop/bedrock
…pp AWS sign-in, the browser flow runs on the host (outside the Cowork sandbox), so it uses the user's existing identity-provider session and any security keys or passkeys configured on the device. The…
Chat in Claude Desktop on 3P
Claude Documentation · in the page
third-party/claude-desktop/chat
…earch). | | Web fetch | Runs in the app on the device, never inside a sandbox. Every fetch is checked against `coworkEgressAllowedHosts`; with no allowlist configured, fetch is disabled. See [Web fetc…
Code in Claude Desktop on 3P
Claude Documentation · in the page
third-party/claude-desktop/code
…licy it produces | | - | - | | `coworkEgressAllowedHosts` | A network sandbox restricted to your hosts, `allowManagedDomainsOnly`, and `WebFetch` allow rules for the same hosts, which [don't block oth…
Configuration reference
Claude Documentation · in the page
third-party/claude-desktop/configuration
…s | Capabilities | Self-hosted Admin Console | | [`requireCoworkFullVmSandbox`](#requirecoworkfullvmsandbox) | Require full VM sandbox | Capabilities | | | [`disableDeploymentModeChooser`](#disabledep…
Configuration changelog
Claude Documentation · in the page
third-party/claude-desktop/configuration-changelog
…led` and `coworkEgressAllowedHosts`: commands in Chat's file-analysis sandbox can now reach the listed hosts. With no list, or an empty one, they have no network access. * `mcpPersistentAlwaysAllowEna…
Connect to Salesforce
Claude Documentation · in the page
third-party/claude-desktop/connectors-salesforce
…or example `["https://yourorg.my.salesforce.com"]`. For a Salesforce sandbox org, complete step 1 in the sandbox and enter the sandbox's login URL as the authorization server, for example `["https://…
User identity and local data
Claude Documentation · in the page
third-party/claude-desktop/data-storage
…plication and configuration-validation events), `cowork_vm_node.log` (sandbox VM activity), `claude.ai-web.log` (renderer events), and `mcp.log` / `mcp-server-<name>.log` (MCP connection events). Sep…
MCP, plugins, skills, and hooks
Claude Documentation · in the page
third-party/claude-desktop/extensions
…renders in place of a plain-text tool result. Each widget loads in a sandboxed iframe on `*.claudemcpcontent.com`, and setting [`disableNonessentialServices`](/docs/third-party/claude-desktop/configu…
Desktop and filesystem access
Claude Documentation · in the page
third-party/claude-desktop/local-access
…s anywhere inside those folders, and run code against them inside the sandbox VM. In Claude Desktop on 3P, administrators can constrain which folders users are allowed to attach. ## Workspace folder…
Deploy with MDM
Claude Documentation · in the page
third-party/claude-desktop/mdm
…of Cowork, Code, and Chat are available Allowed egress hosts for the sandbox Disabled built-in tools Allowed workspace folders | | **Connectors** | Managed MCP servers pushed to all users Whether use…
Migrate Claude Desktop from a cloud provider to Claude Enterprise
Claude Documentation · in the page
third-party/claude-desktop/move-to-claude-enterprise
…-security-controls). Special cases: * If Cowork runs only in its VM sandbox in your organization (for example, because [`requireCoworkFullVmSandbox`](/docs/third-party/claude-desktop/configuration#r…
Network proxy
Claude Documentation · in the page
third-party/claude-desktop/network-proxy
…eb fetches, remote MCP connections, and plugin installs. * **Cowork's sandboxed shell**: the isolated environment where commands the agent runs in a Cowork session (`curl`, `pip`, `npm`, and so on) ex…
Overview
Claude Documentation · in the page
third-party/claude-desktop/overview
…third-party/claude-desktop/ssh-remote-sessions.md) | | Code execution sandbox | Local VM | Local VM (identical) | | Configuration | Admin console at claude.ai | OS-native configuration (MDM-managed or…
SSH remote sessions in Claude Desktop on 3P
Claude Documentation · in the page
third-party/claude-desktop/ssh-remote-sessions
…e SSH user's there. Hiding files from shell commands needs the host's sandbox dependencies (next item); on a host without them, or a Windows host, shell reads outside the working directories ask for a…
Telemetry and egress
Claude Documentation · in the page
third-party/claude-desktop/telemetry
…try-false). Claude Code sends this telemetry from outside the agent's sandbox, so the host needs no entry in `coworkEgressAllowedHosts`. ### Non-essential services Cosmetic third-party fetches: favi…
Deploy Claude Desktop on 3P with Google Cloud's Agent Platform
Claude Documentation · in the page
third-party/claude-desktop/vertex
…Google sign-in, the browser flow runs on the host (outside the Cowork sandbox), so it can use the user's existing Google session and any security keys or passkeys configured on the device. Users can s…
Web search and web fetch
Claude Documentation · in the page
third-party/claude-desktop/web-tools
…oworkEgressAllowedHosts` governs client-side egress (Web Fetch and in-sandbox shell network activity). The SDK Web Search tool in the table above executes server-side at your inference provider, so th…
Security Policy
Model Context Protocol · in the page
community/security
…asses, implementation bugs such as injection or memory-safety issues, sandbox escapes, session hijacking, token leakage, and cross-tenant access. The full [SECURITY.md](https://github.com/modelcontex…
Filesystems Charter
Model Context Protocol · in the page
community/working-groups/filesystems
…ources. The WG broadens the existing Resources primitive. * Host-side sandbox and local-disk semantics. The WG standardizes the client and server wire format. How a host materializes resources into…
Client Best Practices
Model Context Protocol · in the page
docs/2024-11-05/develop/clients/client-best-practices
…ectly, the model writes code that calls tools. The code executes in a sandboxed environment, and only the final result returns to the model. Programmatic tool calling is powerful and allows for more…
Understanding MCP clients
Model Context Protocol · in the page
docs/2024-11-05/learn/client-concepts
…e enforced at the operating system level, via file permissions and/or sandboxing. **Root structure:** ```json theme={null} { "uri": "file:///Users/agent/travel-planning", "name": "Travel Plannin…
Security Best Practices
Model Context Protocol · in the page
docs/2024-11-05/tutorials/security/security_best_practices
…ed and executed on the same machine as the MCP client. Without proper sandboxing and consent requirements in place, the following attacks become possible: 1. An attacker includes a malicious "startup…
Client Best Practices
Model Context Protocol · in the page
docs/2025-03-26/develop/clients/client-best-practices
…ectly, the model writes code that calls tools. The code executes in a sandboxed environment, and only the final result returns to the model. Programmatic tool calling is powerful and allows for more…
Understanding MCP clients
Model Context Protocol · in the page
docs/2025-03-26/learn/client-concepts
…e enforced at the operating system level, via file permissions and/or sandboxing. **Root structure:** ```json theme={null} { "uri": "file:///Users/agent/travel-planning", "name": "Travel Plannin…
Security Best Practices
Model Context Protocol · in the page
docs/2025-03-26/tutorials/security/security_best_practices
…ed and executed on the same machine as the MCP client. Without proper sandboxing and consent requirements in place, the following attacks become possible: 1. An attacker includes a malicious "startup…
Client Best Practices
Model Context Protocol · in the page
docs/2025-06-18/develop/clients/client-best-practices
…ectly, the model writes code that calls tools. The code executes in a sandboxed environment, and only the final result returns to the model. Programmatic tool calling is powerful and allows for more…
Understanding MCP clients
Model Context Protocol · in the page
docs/2025-06-18/learn/client-concepts
…e enforced at the operating system level, via file permissions and/or sandboxing. **Root structure:** ```json theme={null} { "uri": "file:///Users/agent/travel-planning", "name": "Travel Plannin…
Security Best Practices
Model Context Protocol · in the page
docs/2025-06-18/tutorials/security/security_best_practices
…ed and executed on the same machine as the MCP client. Without proper sandboxing and consent requirements in place, the following attacks become possible: 1. An attacker includes a malicious "startup…
Client Best Practices
Model Context Protocol · in the page
docs/2025-11-25/develop/clients/client-best-practices
…ectly, the model writes code that calls tools. The code executes in a sandboxed environment, and only the final result returns to the model. Programmatic tool calling is powerful and allows for more…
Understanding MCP clients
Model Context Protocol · in the page
docs/2025-11-25/learn/client-concepts
…e enforced at the operating system level, via file permissions and/or sandboxing. **Root structure:** ```json theme={null} { "uri": "file:///Users/agent/travel-planning", "name": "Travel Plannin…
Security Best Practices
Model Context Protocol · in the page
docs/2025-11-25/tutorials/security/security_best_practices
…ed and executed on the same machine as the MCP client. Without proper sandboxing and consent requirements in place, the following attacks become possible: 1. An attacker includes a malicious "startup…
Client Best Practices
Model Context Protocol · in the page
docs/2026-07-28/develop/clients/client-best-practices
…ectly, the model writes code that calls tools. The code executes in a sandboxed environment, and only the final result returns to the model. Programmatic tool calling is powerful and allows for more…
Understanding MCP clients
Model Context Protocol · in the page
docs/2026-07-28/learn/client-concepts
…e enforced at the operating system level, via file permissions and/or sandboxing. **Root structure:** ```json theme={null} { "uri": "file:///Users/agent/travel-planning", "name": "Travel Plannin…
Configuration and flags
Model Context Protocol · in the page
docs/2026-07-28/tools/inspector/configuration
…_INSPECTOR_API_TOKEN`, used only when the new name is unset. | | `MCP_SANDBOX_PORT` | MCP Apps sandbox port. Defaults to `6275`; `0` asks the OS for a free port. | | `SERVER_PORT` | v1's proxy port, n…
mcpdo connection client
Model Context Protocol · in the page
docs/2026-07-28/tools/inspector/mcpdo
…e the stdio command a container: ```bash theme={null} mcpdo connect @sandboxed -- docker run -i --rm --network none -v "$PWD:/work:ro" <server-image> ``` Without `@sandboxed`, the connection would b…
Recipes
Model Context Protocol · in the page
docs/2026-07-28/tools/inspector/recipes
…} TOKEN="$(openssl rand -hex 24)" HOST=127.0.0.1 CLIENT_PORT=6274 MCP_SANDBOX_PORT=6275 \ MCP_AUTO_OPEN_ENABLED=false MCP_INSPECTOR_API_TOKEN="$TOKEN" \ mcp-inspector --web & ``` Pinning `MCP_SANDBOX…
Web client
Model Context Protocol · in the page
docs/2026-07-28/tools/inspector/web
…*Apps** | The server exposes MCP App tools | Renders a tool's UI in a sandboxed frame. | | **Tools** | `tools` capability | Browse schemas, fill arguments, call, inspect results. | | **Prompts** | `pr…
Local Server Security
Model Context Protocol · in the page
docs/2026-07-28/tutorials/security/local-server-security
…Server Can Touch A local MCP server is not a plugin running inside a sandbox the protocol provides. It is an ordinary operating system process, launched by your host application, with all the access…
Security Best Practices
Model Context Protocol · in the page
docs/2026-07-28/tutorials/security/security_best_practices
…ed and executed on the same machine as the MCP client. Without proper sandboxing and consent requirements in place, the following attacks become possible: 1. An attacker includes a malicious "startup…
Client Best Practices
Model Context Protocol · in the page
docs/draft/develop/clients/client-best-practices
…ectly, the model writes code that calls tools. The code executes in a sandboxed environment, and only the final result returns to the model. Programmatic tool calling is powerful and allows for more…
Understanding MCP clients
Model Context Protocol · in the page
docs/draft/learn/client-concepts
…e enforced at the operating system level, via file permissions and/or sandboxing. **Root structure:** ```json theme={null} { "uri": "file:///Users/agent/travel-planning", "name": "Travel Plannin…
Configuration and flags
Model Context Protocol · in the page
docs/draft/tools/inspector/configuration
…_INSPECTOR_API_TOKEN`, used only when the new name is unset. | | `MCP_SANDBOX_PORT` | MCP Apps sandbox port. Defaults to `6275`; `0` asks the OS for a free port. | | `SERVER_PORT` | v1's proxy port, n…
mcpdo connection client
Model Context Protocol · in the page
docs/draft/tools/inspector/mcpdo
…e the stdio command a container: ```bash theme={null} mcpdo connect @sandboxed -- docker run -i --rm --network none -v "$PWD:/work:ro" <server-image> ``` Without `@sandboxed`, the connection would b…
Recipes
Model Context Protocol · in the page
docs/draft/tools/inspector/recipes
…} TOKEN="$(openssl rand -hex 24)" HOST=127.0.0.1 CLIENT_PORT=6274 MCP_SANDBOX_PORT=6275 \ MCP_AUTO_OPEN_ENABLED=false MCP_INSPECTOR_API_TOKEN="$TOKEN" \ mcp-inspector --web & ``` Pinning `MCP_SANDBOX…
Web client
Model Context Protocol · in the page
docs/draft/tools/inspector/web
…*Apps** | The server exposes MCP App tools | Renders a tool's UI in a sandboxed frame. | | **Tools** | `tools` capability | Browse schemas, fill arguments, call, inspect results. | | **Prompts** | `pr…
Local Server Security
Model Context Protocol · in the page
docs/draft/tutorials/security/local-server-security
…Server Can Touch A local MCP server is not a plugin running inside a sandbox the protocol provides. It is an ordinary operating system process, launched by your host application, with all the access…