Full permissions, without wrecking your machine
Approval prompts are what make an agent useless on a phone — and removing them on your laptop is how people lose an afternoon. The fix is not bravery, it's putting the agent somewhere you would not mind rebuilding.
Claude Code asks before it does anything consequential. At a desk that is right: you glance, you approve, you carry on. Away from the desk it is fatal — the agent stops on step three of a twenty-minute task and waits for a tap that comes forty minutes later, and the entire point of delegating was that you were not watching.
So people reach for the flag that turns prompts off. That flag is genuinely dangerous on the wrong machine, and genuinely fine on the right one. The difference is not how careful you are. It is what the agent can reach when it does something you did not intend.
Think in blast radius
Before relaxing permissions anywhere, answer one question: if this process ran an arbitrary destructive command right now, what would I lose?
On a typical laptop the honest answer is uncomfortable. Your SSH private keys. Cloud credentials in ~/.aws and ~/.config. Browser profiles with live sessions. A .env with production database URLs. Every other repository you have checked out, including the ones with uncommitted work. A logged-in gh or kubectl. Nothing has to be malicious for that to go wrong — a confidently wrong rm, a migration pointed at the wrong environment, a force-push to the wrong remote.
On a disposable VPS with one project on it, the answer is: that project, which is pushed anyway, and an hour of rebuild time. That is a blast radius you can accept, and once you accept it, running unattended stops being reckless.
Three places to put it
A container on your own machine
Cheapest and closest. Run a Linux container with Docker or OrbStack, install Claude Code inside it, mount only the project you want it to touch, and give it its own SSH port. The host filesystem, your keys and your other repositories are simply not visible.
Points worth getting right:
- Mount one project, not your home directory. A bind mount of
~undoes the whole exercise. - Do not pass host credentials in. Give the container its own deploy key with the narrowest scope that works.
- Do not run it with
--privilegedor mount the Docker socket. Both hand back the host. - Add Tailscale if you want to reach it from a phone when you are not at home.
Our local setup guide walks through a working configuration.
A dedicated VPS
The most comfortable option, and the one most people settle on. A €4–6/month box, one project, nothing else on it. It is always on, so tasks run while everything of yours is off, and if it is ever compromised you destroy it and build another. See running Claude Code on a VPS.
Keep it disposable and it stays safe:
- Push to a remote often, so the server holds nothing unique.
- Scope its deploy key to the repositories it actually needs.
- Keep production credentials off it. If it needs a database, give it a staging one.
- Assume you will rebuild it one day, and make that boring — a short setup script rather than a machine you have hand-tuned for a year.
An ephemeral cloud sandbox
If your work lives on GitHub, Anthropic's own cloud sessions run each task in an environment they provision and tear down, which is a strong isolation story with no infrastructure for you to maintain. The constraints are the repository requirement, no access to your private network, and — per Anthropic's docs — you cannot select Bypass permissions from the mobile app anyway.
What not to do
- Do not skip permissions on your primary machine because you will be watching. The times it matters are the times you got distracted.
- Do not run the agent as root. A normal user with sudo where needed keeps accidents recoverable.
- Do not give the box production credentials so that one task is easier. That is how a test run truncates a real table.
- Do not reuse your personal SSH key as the container or server's outbound key. Generate one scoped to the job.
- Do not leave it exposed with password auth. Keys only, root login off.
Full permissions are not a risk setting, they are a placement decision. Put Claude Code somewhere with nothing worth stealing and nothing you cannot rebuild, and you can let it run unattended with a clear head. Leave it on the machine that holds your keys and your client work, and no amount of care makes that a good trade.
Where Maude fits
Maude runs Claude Code with full permissions by default, and everything above is why that is defensible: it is built for a server or container you own and can rebuild, not for your laptop. That is also the practical difference from driving Claude Code through Anthropic's mobile app, which does not offer Bypass permissions from the phone — a sound default for a general-purpose client, and the wrong one when the whole job is unattended work on a disposable box.
