# How to run Claude Code in full-auto mode on macOS without risking your files or keys > Source: > Published: 2026-11-13 00:00:00+00:00 Claude Code works best when it doesn't stop to ask. Give it a task and it runs the tests, installs what it needs and tries again until it's done. That's what `--dangerously-skip-permissions` turns on, and the flag's name tells you the catch. Anthropic's docs say to use it only inside a [container or a VM](https://code.claude.com/docs/en/sandbox-environments). This guide shows the simplest way to do that on a Mac: a [MacVisor AI sandbox](https://scaleninja.com/macvisor/ai-sandboxes/claude-code/), a throwaway VM made for the job. ## What's at risk With prompts off, Claude Code runs every command it decides to run, as you. On your Mac it can: - read and change any file your account can, including `~/.ssh` and your other projects - read API keys from your shell, `.env` files and config folders - reach the internet, your local network and services running on your Mac - rewrite git history or push with your credentials It doesn't have to be malicious. Mistakes happen, and a README, an issue or a web page can carry text written to steer an agent. With prompts off, the only safety left is where the agent runs. ## Your options | Option | Good for | Watch out for | |---|---|---| | Claude Code's `/sandbox` | Everyday work. Built in, nothing to install. | It still runs on your Mac, as you. | | A container | Linux-only projects. Light. | Keys usually go in as variables the agent can read. Linux only. | | A VM | Full isolation, Linux or macOS, keys kept outside. | Uses more memory. | For a Linux-only project with low-stakes keys, a container is often enough. If you want your keys out of reach, need macOS, or want to review every change before it lands, use a VM. ## Run Claude Code in a MacVisor sandbox You need an Apple Silicon Mac with macOS 27, and a project in a git repository. AI sandboxes are a Tech Preview. **1. Store your Anthropic key on the Mac, once.** ``` mvz ai keys set anthropic ``` The key stays in the Mac's Keychain. MacVisor adds it to each request as it leaves the Mac, so the VM never sees it. To use a Claude subscription instead, create the sandbox with `--egress open`, store no key, and sign in inside the VM. **2. Create the sandbox.** ``` mvz sandbox create ~/src/app --agent claude ``` Or click **New AI Sandbox…** in the app. MacVisor makes a Linux VM, copies in your project, installs Claude Code and saves a checkpoint called `pristine`. It takes about a minute. The sandbox is named after the folder, here `app-1`. Add `--os macos` if the work needs macOS or Xcode. **3. Give it a task.** ``` mvz sandbox run app-1 -- "the integration tests fail on the new schema; fix them" ``` Claude Code runs with permissions off, inside the VM. To chat with it instead, use `mvz sandbox attach app-1`. **4. Allow only the sites it needs.** The sandbox reaches the models and nothing else until you allow more: ``` mvz sandbox allow app-1 npm # or github, pypi, ubuntu, homebrew mvz sandbox log app-1 --egress # what it tried to reach ``` **5. Review the changes.** ``` mvz sandbox diff app-1 --patch ``` The diff is made on your Mac, with your own git. MacVisor flags changes that could run code later, such as scripts, git hooks, CI files and `.claude/` settings. Read those first. **6. Apply, or start over.** ``` mvz sandbox apply app-1 # or --branch for a new branch mvz sandbox rollback app-1 pristine # try another prompt from scratch mvz sandbox discard app-1 # done: the VM goes to the Trash ``` `apply` brings in exactly what you reviewed, all or nothing, and commits nothing. ## Prefer Claude Code on your Mac? Run `mvz mcp install claude-code`. Claude Code on your Mac can then run commands in sandboxes, read their files, show their diffs and take checkpoints, while its own permission prompts stay on for your Mac. Your other VMs stay hidden from it unless you open one to agents. See [AI agents and MCP](https://scaleninja.com/docs/macvisor/ai-agents/). ## Good to know - You can use a local model instead of a cloud key: Ollama, LM Studio, llama.cpp or oMLX on the Mac. - A Mac runs two macOS VMs at a time, so at most two macOS sandboxes. Linux sandboxes have no such limit. - Sandboxes on the allow-list network can reach each other. - AI sandboxes are a Tech Preview, so commands may still change. ## Try it free MacVisor runs Claude Code, Codex, Goose, Aider and OpenCode in sandboxes, next to your macOS, Windows and Linux VMs. It's free for 30 days, then a one-time Pro license, with every single-Mac feature in every license. [Download MacVisor free](https://scaleninja.com/macvisor/) [See pricing](https://scaleninja.com/macvisor/#pricing) More detail: the [Claude Code sandbox guide](https://scaleninja.com/macvisor/ai-sandboxes/claude-code/) and the [AI sandboxes docs](https://scaleninja.com/docs/macvisor/ai-sandboxes/).