Unclear It is not stated which setting a reader writes literal path entries in.
The sandbox is the protective boundary that limits which files commands run by Claude Code can read or write. Each entry in its filesystem rules can now be either a plain path or an object of the form { path, literal: true }. A literal entry names one exact path and is not expanded like a wildcard pattern. Any other shape is rejected with an error saying a filesystem path entry must be a path, or { path, literal: true }.
On macOS, the sandbox now builds separate literal versions of its allow and deny lists, including paths allowed inside a denied area, and keeps a list of the folders where writing is permitted.
Pinning an exact path means a rule cannot accidentally cover more or fewer files than intended, which directly affects what the sandbox lets through or blocks.
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Braces match as ordinary characters in a name, so `~/data/{keys,tokens}` covers a directory literally named `{keys,tokens}`, not two alternatives. To cover `~/data/keys` and `~/data/tokens`, add each as its own entry.settings-reference see the edit
* For `"sdk_host_builtin_mcp"` tools: `mcp_server_name` and `mcp_tool_name` are included even when `OTEL_LOG_TOOL_DETAILS` is off, because the host application defines these names; without them, a rejected call to one of these built-in ser…monitoring-usage see the edit
It is not stated which setting a reader writes literal path entries in.
Anthropic's documentation has since written up literal, on Monitoring.