sandbox

A Claude Code settings key, read out of the shipped bundle. It was in the build from v2.1.138 and was gone by v2.1.302.

Releases whose published page names sandbox.

1. v2.1.305 20 Oct 2026
   Device-tool refusal now names the nested user namespaces sandbox setting

   The message about device tools being withheld now lists sandbox.allowNestedUserNamespaces among the settings that weaken isolation

   found in this entry's text

2. v2.1.301 15 Oct 2026
   Sandbox credential settings errors are now checked separately

   Problems in sandbox and sandbox.credentials settings, including warnings, are now judged by their own check for whether they stop settings from loading

   found in this entry's text

3. v2.1.300 14 Oct 2026
   claude remote-control now rejects --sandbox and --no-sandbox

   Passing --sandbox or --no-sandbox to claude remote-control is now an error instead of being silently accepted

   found in this entry's text

4. v2.1.300 14 Oct 2026
   Remote sessions no longer force sandbox off when it is not set

   In Remote Control start-up settings, leaving sandbox unset no longer means off, so another default can apply

   found in this entry's text

5. v2.1.293 7 Oct 2026
   Fixed sandbox host for MCP apps and a new monitor event name

   Claude Code now names a fixed host, sandbox.claudemcpcontent.com, for MCP app sandboxes, and adds a monitor_watch_closed event name

   found in this entry's text

6. v2.1.286 30 Sep 2026
   More sandbox settings now block serving device tools remotely

   Claude Code now refuses to serve device tools when seccomp is unavailable or more sandbox-weakening settings are on

   found in this entry's text

7. v2.1.283 25 Sep 2026
   A bad sandbox setting no longer switches off the whole sandbox block

   Invalid sandbox settings are now handled one field at a time, falling back to the restrictive value instead of the whole block being ignored

   found in this entry's text

8. v2.1.282 24 Sep 2026
   Broken managed settings now fail safe, including permission and sandbox blocks

   An invalid value in managed settings now becomes its most restrictive value, and a block with an unreadable deny rule loses its allow grants

   found in this entry's text

9. v2.1.281 23 Sep 2026
   Auto mode can hold locally auto-allowed shell commands for a server-side classifier

   In auto mode, shell commands allowed locally by sandbox or read-only rules can now be held for a server-side classifier to review

   found in this entry's text

10. v2.1.280 22 Sep 2026
    Bridge (headless) session start gains structured telemetry

    Headless bridge sessions now emit structured start and thread-requeue telemetry

    found in this entry's text

11. v2.1.233 14 Aug 2026
    Hidden claude plugin sandbox install and status commands

    Hidden sandbox install and status commands set up the Windows sandbox user with one UAC prompt.

    found in this entry's text

12. v2.1.232 13 Aug 2026
    Sandbox binary paths now re-prompt for consent when changed

    Changing sandbox binary paths now re-prompts for approval, like status line and hook commands already did.

    found in this entry's text

13. v2.1.224 7 Aug 2026
    Invalid sandbox credential settings now fail closed instead of being ignored

    A malformed sandbox.credentials block now denies everything instead of quietly disabling protection.

    found in this entry's text

14. v1.0.4 28 May 2025
    Sandbox Mode for Bash Commands

    found in this entry's text

15. v0.2.65 7 Apr 2025
    New Features

    found in this entry's text

16. v0.2.65 7 Apr 2025
    Developer Notes

    found in this entry's text

No release's published evidence quotes this name. The ledger indexes the Evidence lines of every changelog on this site, so this says nobody here has ever quoted it; it says nothing about how old the name is.

One row per release since the first build this name was read out of. Absent means the build was read and the name was not in it, never mined means no bundle for that release was ever archived, and a declared type or a default is only ever what that release's own bundle stated.

Read out of the published npm bundle release by release, and out of Anthropic's own documentation as this site captured it. Nothing on this page is a description anybody here wrote about what the settings key does. All settings keys.