01
Confine the workspace
Filesystem reads, writes, listings, and shell execution can be restricted to one project directory, including protection against absolute-path escapes.
// Security
Sandboxed by default
PasClaw treats filesystem and shell access as security boundaries, combining workspace confinement with an always-on command denylist.
Workspace boundaryShell denylistPath allowlistsExplicit policy
02
Block dangerous commands
High-risk shell patterns are denied before execution, independent of the model provider or prompt instructions.
03
Grant narrow exceptions
Regular-expression allowlists provide controlled access to required paths without opening the entire host filesystem.
04
Layer your controls
Combine the sandbox with tool allowlists, hooks, approval gates, OS permissions, and container isolation for higher-risk workloads.
From the documentation
Technical details
Implementation notes drawn from the PasClaw repository documentation.
Filesystem policy
The sandbox can restrict all file operations to a workspace while granting narrow, regular-expression-based exceptions.
- Read and write exceptions are configured separately.
- Absolute paths and traversal attempts are checked against policy.
- A container shell backend can add isolation beyond process-level checks.
Command and network defenses
Shell commands pass through a built-in denylist, while web_fetch guards against server-side request forgery.
- Custom deny expressions can extend the built-in shell rules.
- Private and link-local network destinations can be blocked.
- Redirect targets are checked again, including the cloud metadata address 169.254.169.254.
Source documentation
Common questions
Frequently asked questions
Keep exploring
See how the rest of PasClaw fits together.