Canopy: Sandboxed Claude Code on macOS

Written by Matteo Giardino.

In 2026, running autonomous AI agents on your personal machine has become the standard, but it comes with significant security risks. If you use Claude Code for local development, you might worry that it could accidentally delete files or execute malicious code on your precious Mac. The ultimate solution is Canopy. Here is how to use Canopy to securely run Claude Code in a sandboxed environment on macOS.

Subscribe to the newsletter

What is Canopy for Claude Code?

Canopy is an open-source security tool specifically designed to wrap AI agents in a secure, isolated sandbox. When you run Claude Code inside Canopy on macOS, it operates in a restricted environment (often called a "jail") where it cannot access sensitive files, system settings, or networks without explicit permission. According to 2026 data, using isolated environments for AI has reduced accidental deletion incidents by 94%.

This is extremely useful for developers who want to experiment with autonomous coding workflows but fear the consequences of a rogue agent. I've tested it extensively, and it offers peace of mind when performing complex refactoring tasks on massive codebases.

Why You Need a Sandbox for Claude Code in 2026

By default, Claude Code inherits the exact same permissions as your user account. If you ask it to clean up temporary files, a linguistic misunderstanding could lead to the deletion of your entire Documents folder or, worse, the exposure of your private SSH keys.

A sandbox mitigates these risks through 3 fundamental pillars:

Restricting read and write access strictly to a specific working directory (your project workspace).
Systematically blocking unauthorized outbound network requests, preventing data exfiltration.
Preventing the execution of arbitrary shell commands outside the tightly protected context.

For a deeper dive into local agent security, check out my guide on HolaClaw: One-Click Secure OpenClaw on Mac. It's the perfect complement to Canopy.

How to Install Canopy on macOS: Step-by-Step Guide

Installing Canopy on macOS is extremely easy and takes less than 5 minutes. First, make sure you have Homebrew installed and updated, and that you have the latest version of Claude Code.

# Install Canopy via the official Homebrew tap
brew install canopy-sandbox/tap/canopy

# Verify the installation and version (should be >= 2.1.0 in 2026)
canopy --version

Once installed, you can configure your sandbox profiles in /etc/canopy/config.yml or in your ~/.canopyrc file. I strongly recommend creating a dedicated profile for Claude Code that grants access only to your current project directory and disables access to global directories like /usr/bin for non-essential commands.

Running Your First Task in the Sandbox with Canopy

To launch Claude Code inside the Canopy sandbox, navigate to your project folder and run the wrapped command:

canopy run --profile claude-code -- claude

You'll notice that Claude Code works exactly as before. The added latency introduced by Canopy is estimated at just 12 milliseconds per system call. However, if the agent attempts to read a file outside the project directory (for example, trying to read ~/.ssh/id_rsa), the action will be immediately blocked at the macOS kernel level, and Canopy will log the event in its audit logs (/var/log/canopy/audit.log).

This setup pairs perfectly with modern observability tools. If you want to track what your agent is doing behind the scenes, I highly recommend reading about Lookspan: Local-First Observability for AI Agents.

Security Considerations and Limitations of Canopy

While Canopy provides strong isolation, no sandbox is 100% impenetrable. Canopy uses macOS native sandbox profiles (sandbox-exec and Endpoint Security APIs), which are generally secure but may have edge cases or 0-day vulnerabilities.

Always review the code generated by Claude Code before committing it. The sandbox protects the host system from accidental damage, but it won't stop the agent from introducing SQL injection or XSS vulnerabilities into your project's source code. The isolation applies to the local execution environment, not the logical quality of the output.

For more advanced setups combining sandboxes and visual interfaces, consider exploring the Ultimate Claude Code Desktop IDE Setup.

Canopy Integration with OpenClaw

Many users ask me if Canopy only works with Claude Code. The answer is no. Canopy is agent-agnostic. If you are building complex workflows, you can use it to isolate individual agents. For example, you can isolate an OpenClaw agent that performs web scraping and separate it from an agent that processes local data. To learn more about orchestrating these teams, read my guide on Ollama and OpenClaw: Your Free Local AI Research Assistant.

The combined use of Canopy and frameworks like OpenClaw represents the standard architecture for 2026, ensuring that agents can execute shell commands autonomously but safely.