Follow Discord
Sweep 22 Oct 2026 · 04:32Z Build v2.1.308 527 read Stable v2.1.308 Latest v2.1.308 Next v2.1.308 Feeds RSS JSON llms.txt llms-full.txt Unofficial
Home / Reference / Settings keys

dangerouslyDisableSandbox

setting never mined JSON

A Claude Code settings key, read out of the shipped bundle. No mined inventory carries it: everything below comes from what this site has written about it.

The MCP server you expose now validates tool arguments and aborts work when a client cancels.

Not Anthropic's. This is the line from the earliest changelog entry here that named it, v2.1.234.

First seen — never in a mined build
Last seen — never in a mined build
Builds0 / 149on this box, as of v2.1.308
Written about v2.0.30 first named in a changelog, 30 Oct 2025

In the changelogs

12

Releases whose published page names dangerouslyDisableSandbox.

  1. v2.1.307
    More commands get the "Run outside of the sandbox" prompt

    When Claude asks to run a command outside the sandbox, a command that would have prompted you anyway now shows the "Run outside of the sandbox" prompt with its reason

    named in this entry, found in this entry's text

  2. v2.1.305
    On Windows, the sandbox's local connection setting is fixed when the sandbox is installed

    On Windows, changing sandbox.network.allowLocalBinding now needs /sandbox install and a restart, and Claude Code warns when they disagree

    found in this entry's text

  3. v2.1.305
    Some commands too complex to analyse no longer always ask for permission

    Some shell commands too complex to analyse can now be allowed by your existing permission rules instead of always prompting

    found in this entry's text

  4. v2.1.292
    Some callers can no longer turn off the sandbox or run commands in the background

    For a restricted kind of caller, shell commands that ask to skip the sandbox or run in the background are refused or forced off

    found in this entry's text, named in this entry

  5. v2.1.284
    Claude is not offered the sandbox escape option when unsandboxed commands are disabled

    Where unsandboxed commands are disabled, the option to run a command outside the sandbox is removed from the Bash and PowerShell tools

    found in this entry's text, named in this entry

  6. v2.1.284
    Claude is no longer offered the sandbox bypass when it is disallowed

    When your sandbox settings disallow unsandboxed commands, Claude's Bash tool no longer includes the dangerouslyDisableSandbox option

    found in this entry's text, named in this entry

  7. v2.1.281
    Sandbox prompt: new macOS guidance for local port binding and open/osascript

    On macOS, Claude is now told how to recognise sandbox blocks on local ports and on open/osascript, and what to offer the user instead

    found in this entry's text

  8. v2.1.257
    Bash tool permission matcher now includes more deciding fields

    Bash remote execution lists which input fields decide whether an existing permission still covers a call.

    found in this entry's text, named in this entry

  9. v2.1.246
    A Bash call using dangerouslyDisableSandbox no longer blocks remote execution

    A Bash call using dangerouslyDisableSandbox can still run on a remote device instead of being forced local.

    named in this entry, found in this entry's text

  10. v2.1.239
    Tools can declare whether they run remotely; Bash is the first, and it is scaffolding

    Tools now say whether they can run on a remote device; Bash says yes but nothing ships.

    found in this entry's text

  11. v2.1.234
    Built-in MCP server gains schema validation, cancellation, and an unreachable locked-down HTTP mode

    The MCP server you expose now validates tool arguments and aborts work when a client cancels.

    found in this entry's text

  12. v2.0.30
    Enhanced Sandbox Security Policy

    found in this entry's text

First cited

5

The earliest release whose published evidence quoted dangerouslyDisableSandbox was v2.1.246, 25 Aug 2026. That is the oldest release this project wrote about it, so it is a floor on the name's age and not the release that introduced it. It is not a presence reading: which builds carried the name is the table below.

ReleaseDateThe span that was quoted
v2.1.24625 Aug 2026dangerouslyDisableSandbox
v2.1.2571 Sep 2026decidingInputFields: [ "command", "run_in_background", "dangerouslyDisableSandbox", ]
v2.1.26810 Sep 2026If the `<sandbox_violations>` block names a denied host, re-run the command with that host in its `allowed_domains` (auto mode); otherwise retry with `dangerouslyDisableSandbox: true` directly
v2.1.28428 Sep 2026"dangerouslyDisableSandbox"
v2.1.28428 Sep 2026var Upr = ["dangerouslyDisableSandbox"]

Presence across releases

0

The miner has never read a build containing this name. It is here because a changelog entry of ours names it, which is evidence that it existed and not evidence of which releases carried it. The inventory starts at v2.1.138 and everything older than that was never mined.

Read out of the published npm bundle release by release, and out of Anthropic's own documentation as this site captured it. Nothing on this page is a description anybody here wrote about what the settings key does. All settings keys.

Feedback