Claude Plugin Filesystem Access Permissions: A Complete Guide to the Sandbox Model

Claude plugins operate in a read-only sandbox that permits file access only within the cached repository directory while explicitly blocking write, edit, and execute operations across the entire host filesystem.

The anthropics/claude-plugins-community repository implements a strict permission model to isolate plugins from the underlying system. According to the source code, all filesystem interactions are governed by the opencode.json configuration file, which defines a deny-by-default security posture with selective read-only exceptions.

How Permissions Are Defined in opencode.json

The global permission matrix resides in the repository root at opencode.json. This JSON file establishes the contract between the Claude Code runtime and plugin execution, explicitly enumerating which operations are permitted or denied.

The permission object uses wildcard patterns to enforce scope:

{
  "permission": {
    "*": "deny",
    "read": {
      "*": "deny",
      "/cache/repos/github.com/anthropics/claude-plugins-community/main/**": "allow"
    },
    "grep": "allow",
    "glob": "allow",
    "list": "allow",
    "lsp": "allow",
    "write": "deny",
    "edit": "deny",
    "bash": "deny",
    "external_directory": {
      "*": "deny",
      "/cache/repos/github.com/anthropics/claude-plugins-community/main/**": "allow"
    }
  }
}

Read-Only Access Rules

Plugins receive read access exclusively to files within the cached repository path: /cache/repos/github.com/anthropics/claude-plugins-community/main/**.

The configuration employs a hierarchical denial system where "*": "deny" serves as the default policy, followed by a specific exception for the cached directory. This pattern ensures that any attempt to read files outside the designated sandbox—such as system files or user directories—will be rejected by the runtime.

Blocked Write and Execute Operations

The sandbox explicitly prohibits any modification of the host environment. The write, edit, and bash permissions are all set to "deny" at the global level, preventing plugins from:

• Creating new files or directories
• Modifying existing file contents
• Executing shell commands
• Deleting or moving files

These restrictions are enforced by the Claude Code runtime, which intercepts filesystem calls and raises PermissionError when violations occur.

Permitted Non-Filesystem Operations

Despite the restrictive filesystem policy, several utility operations remain available. The grep, glob, list, and lsp permissions are set to "allow", enabling plugins to search content, match file patterns, enumerate directory structures, and interact with language servers—all within the bounds of the read-only directory.

Plugin Manifest Limitations

The .claude-plugin/plugin.json file serves exclusively as a metadata descriptor for the plugin. Unlike opencode.json, this manifest does not grant or configure filesystem permissions; it only defines user-configurable fields and plugin identity information. The sandbox restrictions defined in opencode.json act as the ultimate authority, meaning no plugin can override the read-only constraint through its individual manifest configuration.

Filesystem Access Examples

The following Python examples demonstrate the enforced permission boundaries as implemented in the anthropics/claude-plugins-community source.

Reading Allowed Files

Accessing files within the cached repository directory succeeds:

# Valid read operation within sandbox

with open(
    "/cache/repos/github.com/anthropics/claude-plugins-community/main/README.md"
) as f:
    content = f.read()
print("Read succeeded, length:", len(content))

This operation completes successfully because the target path matches the allowed pattern in the read permission object.

Attempting Unauthorized Writes

Any write operation outside the allowed scope is blocked:

# Invalid write operation (blocked by sandbox)

try:
    with open("/tmp/unauthorized.txt", "w") as f:
        f.write("Attempting to write")
except PermissionError as e:
    print("Write blocked as expected:", e)

The runtime raises PermissionError immediately, as the write permission is globally denied and no exceptions exist for /tmp or other host directories.

Summary

• Read access is restricted exclusively to /cache/repos/github.com/anthropics/claude-plugins-community/main/** as defined in opencode.json.
• Write, edit, and bash permissions are universally denied, preventing file modification or command execution.
• The .claude-plugin/plugin.json manifest cannot override these security constraints; it handles metadata only.
• Utility operations like grep, glob, and list remain functional but operate within the same read-only boundaries.
• The Claude Code runtime enforces these rules at the system call level, raising PermissionError for violations.

Frequently Asked Questions

Can Claude plugins write files to the host system?

No. According to the opencode.json configuration in the anthropics/claude-plugins-community repository, the write permission is explicitly set to "deny" for all paths. Plugins cannot create, modify, or delete files anywhere on the host filesystem, including temporary directories like /tmp.

What specific directory can plugins read from?

Claude plugins are permitted to read files only within the cached repository directory: /cache/repos/github.com/anthropics/claude-plugins-community/main/**. This path represents the only filesystem location where the read permission is set to "allow"; all other paths default to "deny".

Are there any exceptions to the write restrictions?

No exceptions exist for write operations. The permission matrix uses a wildcard denial ("*": "deny") for the write, edit, and bash categories without any subsequent "allow" entries. This architectural choice ensures absolute isolation between plugin execution and host filesystem modification.

How do grep and list permissions work if filesystem access is restricted?

The grep, glob, list, and lsp permissions are set to "allow" independently of the read/write matrix. These operations function as read-only utilities within the sandboxed directory, allowing plugins to search file contents and enumerate directory structures without violating the restriction against file modification.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}