I made --dangerously-skip-permissions safe on macOS creating a containment tool

I built this for my own Claude Code workflow on macOS. It's called Hazmat, I'm the author, and it's MIT-licensed / free to try.

Context: macOS, local repos, longer multi-step tasks, no "trust the agent with my real user account" assumption.

The problem I was trying to solve was pretty simple: I wanted the productivity of --dangerously-skip-permissions without running Claude Code as my real user account.

I spent 8 years as a CTO, so I couldn't really pretend "runs as me" was an abstract concern. On macOS that means SSH keys, Keychain access, cloud creds, shell config, browser state, and the rest of my home directory.

So instead of adding another prompt check, I changed the trust boundary.

Hazmat gives Claude its own macOS user, wraps the session in Seatbelt, blocks obvious credential paths, adds pf-based network restrictions, disables npm install scripts by default, and snapshots the workspace so I can diff or roll back bad runs.

The main thing I learned building it: for this workflow, a different user account matters more than another prompt check. Once Claude isn't running in my real account, the rest of the layers start to make sense.

Typical flow:

hazmat claude

hazmat claude -p "refactor auth module"

You can return the system to the state before using hazmat with hazmat rollback if you decide against using it.

A few honest caveats:

- macOS only

- defense-in-depth, not a VM

- if you already run Claude inside a VM or container, you may not need this

Who this is for: people using Claude Code heavily on macOS, especially if permission prompts are becoming the bottleneck.

Cost: free / MIT

Repo: https://github.com/dredozubov/hazmat

If you're doing something similar, I'd be interested in where this still feels too loose, too annoying, or unnecessary.

,