sandbox-status

name	sandbox-status
description	Display native sandbox status, configuration, and recent violations
effort	low
when_to_use	Use to check whether Claude Code sandbox mode is active and what restrictions apply.
disable-model-invocation	true

Sandbox Status Command

Inspect the native Claude Code sandbox state, active configuration, and security events.

Usage

/sandbox-status

What It Does

1. Check sandbox availability

   • Verify OS primitives installed (bubblewrap on Linux, Seatbelt on macOS)
   • Display platform support status

2. Show active configuration

   • Sandbox mode (Auto-allow vs Regular permissions)
   • Filesystem policies (allowed writes, denied reads)
   • Network policies (domain allowlist/denylist)
   • Excluded commands

3. List recent sandbox violations

   • Blocked filesystem access attempts
   • Blocked network connections
   • Escape hatch invocations (dangerouslyDisableSandbox)

Implementation

#!/bin/bash

echo "=== Native Sandbox Status ==="
echo

# 1. Platform Check
echo "Platform:"
case "$OSTYPE" in
  darwin*)
    echo "  ✅ macOS (Seatbelt built-in)"
    ;;
  linux*)
    if which bubblewrap >/dev/null 2>&1; then
      echo "  ✅ Linux (bubblewrap installed)"
      bubblewrap --version 2>/dev/null | head -1
    else
      echo "  ❌ Linux (bubblewrap NOT installed)"
      echo "     Install: sudo apt-get install bubblewrap socat"
    fi
    if which socat >/dev/null 2>&1; then
      echo "  ✅ socat installed"
    else
      echo "  ❌ socat NOT installed"
    fi
    ;;
  *)
    echo "  ❌ Unsupported platform: $OSTYPE"
    ;;
esac
echo

# 2. Configuration
echo "Configuration (from settings.json):"
if [ -f .claude/settings.json ]; then
  CONFIG=".claude/settings.json"
elif [ -f ~/.claude/settings.json ]; then
  CONFIG="~/.claude/settings.json"

   
  CONFIG=


 [ -n  ]; 
   

  
  AUTO_ALLOW=$(jq -r   2>/dev/null)
   

  
  ESCAPE=$(jq -r   2>/dev/null)
   

  
  WRITE_PATHS=$(jq -r   2>/dev/null |   )
   

  
  CRED_FILES=$(jq -r   2>/dev/null |   )
   

  
  STRICT=$(jq -r   2>/dev/null)
   

  
  DOMAINS=$(jq -r   2>/dev/null |  -3 |   )
  DOMAINS_COUNT=$(jq -r   2>/dev/null)
   [ -n  ]; 
     
  
     
  

  
  EXCLUDED=$(jq -r   2>/dev/null |   )
   




 
 
 



 
  npx >/dev/null 2>&1; 
   
   

   




 
 
 
 

Example Output

=== Native Sandbox Status ===

Platform:
  ✅ macOS (Seatbelt built-in)

Configuration (from settings.json):
  Source: .claude/settings.json
  Auto-allow: true
  dangerouslyDisableSandbox allowed: false
  Allowed writes: ${CWD}, /tmp
  Denied credential files: ~/.ssh, ~/.aws, ~/.gnupg
  Strict allowlist: not set (default false)
  Allowed domains: api.anthropic.com, registry.npmjs.com, github.com... (9 total)
  Excluded commands: docker, kubectl, podman

Recent sandbox violations:
  ℹ️  Log inspection not yet implemented
  Tip: Check Claude Code session logs for sandbox violation notifications

Open-Source Runtime:
  ✅ npx available - can use @anthropic-ai/sandbox-runtime
  Usage: npx @anthropic-ai/sandbox-runtime <command>

Documentation:
  Guide: guide/security/sandbox-native.md
  Official: https://code.claude.com/docs/en/sandboxing
  Runtime: https://github.com/anthropic-experimental/sandbox-runtime

Use Cases

• Pre-deployment: Verify sandbox config before running autonomous workflows
• Debugging: Investigate why certain commands are blocked
• Security audit: Review allowed domains and filesystem access
• Onboarding: Help new team members understand project sandbox policy

See Also

• Native Sandboxing Guide - Complete technical reference
• /sandbox-unblock - Diagnostic protocol when something looks blocked
• Sandbox Validation Hook - Pre-command validation
• Sandbox Config Example - Production-ready settings