# Claude's Network and Filesystem Configuration Restrictions: A Technical Analysis

> Discover Claude's network and filesystem configuration restrictions. Learn about its sandboxed environment, egress proxy filtering, and read-only mounts for enhanced security.

- Repository: [Ásgeir Thor Johnson/system_prompts_leaks](https://github.com/asgeirtj/system_prompts_leaks)
- Tags: deep-dive
- Published: 2026-02-16

---

**Claude operates within a sandboxed execution environment that enforces strict egress proxy filtering for network requests and read-only filesystem mounts to prevent unauthorized data modification.**

Claude's network and filesystem configuration restrictions are defined in the system prompt files within the `asgeirtj/system_prompts_leaks` repository. These constraints govern how the AI assistant interacts with external services and local storage during tool execution, ensuring security through sandboxed policies.

## Network Configuration Restrictions

Claude's network access is controlled through an egress proxy that filters all outbound traffic, even though the bash tool technically has network capabilities enabled.

### Egress Proxy and Domain Policies

The network configuration permits outbound calls but subjects every request to proxy inspection:

- **Network enabled:** `true` — The bash tool can initiate outbound connections
- **Allowed domains:** `*` — All domains are technically permitted, but traffic passes through an egress proxy that can block or flag requests
- **Proxy oversight:** Every HTTP request is routed through the egress proxy, which acts as a gatekeeper for security policy enforcement

These policies are documented in the "Network Configuration" section of [`Anthropic/claude.html`](https://github.com/asgeirtj/system_prompts_leaks/blob/main/Anthropic/claude.html) (lines 94‑101) and the legacy [`Anthropic/old/claude-opus-4.5.md`](https://github.com/asgeirtj/system_prompts_leaks/blob/main/Anthropic/old/claude-opus-4.5.md) (lines 6‑10).

### Handling Denied Requests

When the egress proxy blocks a network request, it returns an `x-deny-reason` header in the response. Claude must surface this information to the user and suggest updating network settings. This creates a transparent feedback loop where blocked access is explicitly communicated rather than silently failing.

## Filesystem Configuration Restrictions

Claude's filesystem access is restricted through read-only mount points that protect critical data directories from modification.

### Read-Only Mount Points

The following directories are mounted as **read-only** inside Claude's sandbox:

```

/mnt/user-data/uploads
/mnt/transcripts
/mnt/skills/public
/mnt/skills/private
/mnt/skills/examples

```

Claude **must not** create, edit, or delete files in these locations. These restrictions appear in the "Filesystem Configuration" section of [`Anthropic/claude.html`](https://github.com/asgeirtj/system_prompts_leaks/blob/main/Anthropic/claude.html) (lines 102‑109) and [`Anthropic/old/claude-opus-4.5.md`](https://github.com/asgeirtj/system_prompts_leaks/blob/main/Anthropic/old/claude-opus-4.5.md) (lines 14‑20).

### Safe File Modification Workflows

When file modifications are required, Claude must follow a copy-modify-writeback pattern:

1. **Copy** the file from the read-only mount to the writable working directory
2. **Modify** the copy in the working directory
3. **Write back** to a user-controlled location outside the read-only mounts (if appropriate)

This workflow ensures that protected directories remain immutable while still allowing necessary data transformations.

## Implementation in System Prompts

The network and filesystem configuration restrictions are hardcoded in Claude's system prompts across model versions. In [`Anthropic/claude.html`](https://github.com/asgeirtj/system_prompts_leaks/blob/main/Anthropic/claude.html), the configuration spans lines 94‑109, defining both network egress policies and read-only mount constraints. The legacy [`Anthropic/old/claude-opus-4.5.md`](https://github.com/asgeirtj/system_prompts_leaks/blob/main/Anthropic/old/claude-opus-4.5.md) contains equivalent definitions in lines 6‑10 (network) and 14‑20 (filesystem), demonstrating consistency across Claude model iterations.

## Code Examples

### Checking Network Status and Handling Denials

```markdown
<analysis>
Network: enabled = true; allowed domains = *
If a request fails, read the `x-deny-reason` header and tell the user:
"Network access was blocked: <reason>. You may need to update your network settings."
</analysis>

```

### Safely Modifying a Read-Only File

```javascript
// 1. Copy the read-only file to the writable working dir
await fetch("file:///mnt/skills/public/template.txt")
  .then(r => r.text())
  .then(content => {
    // 2. Write a modified version to /tmp (writable)
    const newContent = content.replace("PLACEHOLDER", "actual value");
    // In a Claude artifact you would use the write_file tool:
    // write_file(path="/tmp/template-modified.txt", contents=newContent)
  });

```

### Handling Blocked Network Requests

```javascript
try {
  const resp = await fetch("https://api.example.com/data");
  const data = await resp.json();
  // use data...
} catch (e) {
  const denyReason = e.headers?.get("x-deny-reason") ?? "unknown";
  // Respond to the user:
  // "The request to api.example.com was blocked (reason: ${denyReason})."
}

```

## Summary

- Claude's network and filesystem configuration restrictions are enforced through a sandboxed execution environment defined in system prompts at [`Anthropic/claude.html`](https://github.com/asgeirtj/system_prompts_leaks/blob/main/Anthropic/claude.html) (lines 94‑109).
- **Network access** is filtered through an egress proxy that can block requests and returns `x-deny-reason` headers for denied traffic.
- **Filesystem access** restricts `/mnt/user-data/uploads`, `/mnt/transcripts`, and `/mnt/skills/*` directories to read-only mounts.
- Claude must copy files from read-only locations to working directories before modification, then write changes to user-controlled writable locations.

## Frequently Asked Questions

### Can Claude access any domain on the internet?

Technically yes, but with significant restrictions. While the network configuration allows all domains (`*`), every outbound request passes through an egress proxy that inspects and can block traffic. If a request is denied, the proxy returns an `x-deny-reason` header that Claude must surface to the user.

### What happens if Claude tries to modify a file in a read-only directory?

Claude is explicitly prohibited from creating, editing, or deleting files in read-only mounted directories such as `/mnt/skills/public` or `/mnt/user-data/uploads`. Attempting to do so would violate the system prompt constraints. Instead, Claude must copy the file to a writable working directory, perform modifications there, and optionally write the results to a user-controlled location outside the read-only mounts.

### How does Claude handle network requests that are blocked by the egress proxy?

When the egress proxy blocks a network request, it includes an `x-deny-reason` header in the response. Claude is instructed to read this header and inform the user about the specific reason for the blockage, suggesting that they may need to update their network settings to resolve the issue.

### Where are the network and filesystem restrictions defined in Claude's system prompts?

These restrictions are defined in the system prompt files within the `asgeirtj/system_prompts_leaks` repository. Specifically, the network and filesystem configuration sections appear in [`Anthropic/claude.html`](https://github.com/asgeirtj/system_prompts_leaks/blob/main/Anthropic/claude.html) at lines 94‑109, and in the legacy [`Anthropic/old/claude-opus-4.5.md`](https://github.com/asgeirtj/system_prompts_leaks/blob/main/Anthropic/old/claude-opus-4.5.md) at lines 6‑10 (network) and lines 14‑20 (filesystem).