# Claude Plugin Filesystem Access Permissions: A Complete Guide to the Sandbox Model

> Understand Claude plugin filesystem access permissions. Explore the read-only sandbox, cached directory access, and blocked write operations. Learn how Claude plugins operate securely.

- Repository: [Anthropic/claude-plugins-community](https://github.com/anthropics/claude-plugins-community)
- Tags: how-to-guide
- Published: 2026-09-13

---

**Claude plugins operate in a read-only sandbox that permits file access only within the cached repository directory while explicitly blocking write, edit, and execute operations across the entire host filesystem.**

The `anthropics/claude-plugins-community` repository implements a strict permission model to isolate plugins from the underlying system. According to the source code, all filesystem interactions are governed by the **[`opencode.json`](https://github.com/anthropics/claude-plugins-community/blob/main/opencode.json)** configuration file, which defines a deny-by-default security posture with selective read-only exceptions.

## How Permissions Are Defined in [`opencode.json`](https://github.com/anthropics/claude-plugins-community/blob/main/opencode.json)

The global permission matrix resides in the repository root at **[`opencode.json`](https://github.com/anthropics/claude-plugins-community/blob/main/opencode.json)**. This JSON file establishes the contract between the Claude Code runtime and plugin execution, explicitly enumerating which operations are permitted or denied.

The `permission` object uses wildcard patterns to enforce scope:

```json
{
  "permission": {
    "*": "deny",
    "read": {
      "*": "deny",
      "/cache/repos/github.com/anthropics/claude-plugins-community/main/**": "allow"
    },
    "grep": "allow",
    "glob": "allow",
    "list": "allow",
    "lsp": "allow",
    "write": "deny",
    "edit": "deny",
    "bash": "deny",
    "external_directory": {
      "*": "deny",
      "/cache/repos/github.com/anthropics/claude-plugins-community/main/**": "allow"
    }
  }
}

```

### Read-Only Access Rules

Plugins receive **read access exclusively** to files within the cached repository path: `/cache/repos/github.com/anthropics/claude-plugins-community/main/**`. 

The configuration employs a hierarchical denial system where `"*": "deny"` serves as the default policy, followed by a specific exception for the cached directory. This pattern ensures that any attempt to read files outside the designated sandbox—such as system files or user directories—will be rejected by the runtime.

### Blocked Write and Execute Operations

The sandbox explicitly prohibits any modification of the host environment. The **`write`**, **`edit`**, and **`bash`** permissions are all set to `"deny"` at the global level, preventing plugins from:

- Creating new files or directories
- Modifying existing file contents
- Executing shell commands
- Deleting or moving files

These restrictions are enforced by the Claude Code runtime, which intercepts filesystem calls and raises `PermissionError` when violations occur.

### Permitted Non-Filesystem Operations

Despite the restrictive filesystem policy, several utility operations remain available. The **`grep`**, **`glob`**, **`list`**, and **`lsp`** permissions are set to `"allow"`, enabling plugins to search content, match file patterns, enumerate directory structures, and interact with language servers—all within the bounds of the read-only directory.

## Plugin Manifest Limitations

The **[`.claude-plugin/plugin.json`](https://github.com/anthropics/claude-plugins-community/blob/main/.claude-plugin/plugin.json)** file serves exclusively as a metadata descriptor for the plugin. Unlike [`opencode.json`](https://github.com/anthropics/claude-plugins-community/blob/main/opencode.json), this manifest does not grant or configure filesystem permissions; it only defines user-configurable fields and plugin identity information. The sandbox restrictions defined in [`opencode.json`](https://github.com/anthropics/claude-plugins-community/blob/main/opencode.json) act as the ultimate authority, meaning no plugin can override the read-only constraint through its individual manifest configuration.

## Filesystem Access Examples

The following Python examples demonstrate the enforced permission boundaries as implemented in the `anthropics/claude-plugins-community` source.

### Reading Allowed Files

Accessing files within the cached repository directory succeeds:

```python

# Valid read operation within sandbox

with open(
    "/cache/repos/github.com/anthropics/claude-plugins-community/main/README.md"
) as f:
    content = f.read()
print("Read succeeded, length:", len(content))

```

This operation completes successfully because the target path matches the allowed pattern in the `read` permission object.

### Attempting Unauthorized Writes

Any write operation outside the allowed scope is blocked:

```python

# Invalid write operation (blocked by sandbox)

try:
    with open("/tmp/unauthorized.txt", "w") as f:
        f.write("Attempting to write")
except PermissionError as e:
    print("Write blocked as expected:", e)

```

The runtime raises `PermissionError` immediately, as the `write` permission is globally denied and no exceptions exist for `/tmp` or other host directories.

## Summary

- **Read access** is restricted exclusively to `/cache/repos/github.com/anthropics/claude-plugins-community/main/**` as defined in [`opencode.json`](https://github.com/anthropics/claude-plugins-community/blob/main/opencode.json).
- **Write, edit, and bash permissions** are universally denied, preventing file modification or command execution.
- The **[`.claude-plugin/plugin.json`](https://github.com/anthropics/claude-plugins-community/blob/main/.claude-plugin/plugin.json)** manifest cannot override these security constraints; it handles metadata only.
- Utility operations like `grep`, `glob`, and `list` remain functional but operate within the same read-only boundaries.
- The Claude Code runtime enforces these rules at the system call level, raising `PermissionError` for violations.

## Frequently Asked Questions

### Can Claude plugins write files to the host system?

No. According to the [`opencode.json`](https://github.com/anthropics/claude-plugins-community/blob/main/opencode.json) configuration in the `anthropics/claude-plugins-community` repository, the `write` permission is explicitly set to `"deny"` for all paths. Plugins cannot create, modify, or delete files anywhere on the host filesystem, including temporary directories like `/tmp`.

### What specific directory can plugins read from?

Claude plugins are permitted to read files only within the cached repository directory: `/cache/repos/github.com/anthropics/claude-plugins-community/main/**`. This path represents the only filesystem location where the `read` permission is set to `"allow"`; all other paths default to `"deny"`.

### Are there any exceptions to the write restrictions?

No exceptions exist for write operations. The permission matrix uses a wildcard denial (`"*": "deny"`) for the `write`, `edit`, and `bash` categories without any subsequent `"allow"` entries. This architectural choice ensures absolute isolation between plugin execution and host filesystem modification.

### How do `grep` and `list` permissions work if filesystem access is restricted?

The `grep`, `glob`, `list`, and `lsp` permissions are set to `"allow"` independently of the read/write matrix. These operations function as read-only utilities within the sandboxed directory, allowing plugins to search file contents and enumerate directory structures without violating the restriction against file modification.