Free Claude Code security setup: one command, sandbox on, 110 deny rules

In Claude Code, a deny rule like Bash(rm *) does not stop r''m -rf ~. Same command, written a little differently, and the rule misses it.

That gap is why I built claude-code-setup.

Most people install Claude Code, click "allow" a few dozen times, and end up with an AI agent that runs shell commands with their full user access. Your SSH keys, cloud credentials, browser cookies and .env files are all one prompt injection away. A README, a GitHub issue or a web page can carry instructions Claude will follow.

So I put together the setup I wish I'd had on day one. One command on macOS or Linux, and Claude Code is locked down at the user level:

- Sandbox on by default. Shell commands can only write inside your project and temp folders, and network access is filtered.

- 110 deny rules covering SSH keys, AWS/GCP/Azure credentials, browser cookies, keyrings, .env files and Claude's own config.

- A deny-guard hook that reads the whole command, so it catches tricks like r''m, \rm, eval and base64 -d | sh. 77 test cases check what it has to block.

- Claude can't edit its own guardrails: global settings, hooks, your global CLAUDE.md, git config or your shell profile.

- Package installs, git push and every gh command ask you first.

Need more room on one project? Loosen that project's local settings. The deny and ask rules from your global settings still apply. Tune the rules to fit your work, just please don't switch them off completely.

It also comes with a starter kit: Context7 for current docs, security review plugins, reviewed and frozen third-party mods, a status line with cost and limits, and a local dashboard.

To install, run this in your terminal: git clone https://github.com/kryo-o/claude-code-setup && cd claude-code-setup && bash install.sh

It's free and MIT licensed: https://github.com/kryo-o/claude-code-setup

If it helps you, a ⭐ on the repo helps more builders find it.

If you try it, tell me what it blocked or what got in your way.

@Nate Herk

, everything is getting attacked right now, and a lot of us building with agents need to start with the basics. If you think this is useful, would you share it with the community, or tell us what you'd lock down first?

0:08

5 comments

Free Claude Code security setup: one command, sandbox on, 110 deny rules