I run Claude Code with permission prompts off, so I put it in a VM

Description and use

Mudroom isolates agent execution from the real project folder, provides a reviewable diff, selective application, and undo capability, and limits network access to an allowlist, thereby mitigating unintended changes while preserving speed benefits of disabled permission prompts.

Problem

Running Claude Code with permission prompts off is faster but leaves the user unaware of all changes made to the project, including untracked or ignored files and files outside the repo.

Outcome

Mudroom isolates agent execution from the real project folder, provides a reviewable diff, selective application, and undo capability, and limits network access to an allowlist, thereby mitigating unintended changes while preserving speed benefits of disabled permission prompts.

Workflow

• Create an APFS copy‑on‑write clone of the project folder, including untracked and ignored files.
• Boot a Linux micro‑VM using Apple’s container tool and mount only the clone; the real folder is never mounted.
• Run the desired agent (Claude Code, Codex, Gemini CLI, opencode, Aider, or any command) inside the VM via a normal Terminal window.
• When the agent exits, generate a diff that lists added, modified, deleted, and permission changes per file, with checkboxes for each hunk.
• Review the diff in the Mudroom UI or CLI, then apply all changes, selected files, or individual hunks; each apply can be undone later.
• If a file was edited by the user during the agent run, flag it and prevent overwriting.
• Use the network tab to review hosts the VM attempted to reach; add legitimate hosts to the allowlist with one click.
• Use mudroom agent login claude to store the Claude token in the macOS Keychain for future sessions.
• Undo any applied changes with mudroom undo last if needed.

Evidence

I use Claude Code every day, and I run it with permission prompts off. It's much faster that way.

Source

The downside is finding out afterwards what else it did. Git can bring back tracked files, but not untracked or ignored ones, and not anything outside the repo.

Source

Mudroom makes an APFS copy-on-write clone of the whole project folder, untracked and ignored files included. The clone takes no extra disk until files change.

Source

It boots a Linux micro-VM with Apple's container tool and mounts only the clone. Your real folder is never mounted.

Source

When the agent exits, you get a diff that looks like a pull request: added, modified, deleted and permission changes, file by file.

Source

You apply everything, some files, or single hunks. Every apply can be undone. If you edited a file yourself while the agent was running, it's flagged and never overwritten.

Source

By default the VM sits on a host-only network with no DNS and no route out. The only way out is a logging proxy that lets through the agent's own API hosts...

Source

mudroom agent login claude runs claude setup-token and stores the token in the macOS Keychain, so later sessions start signed in.

Source

The app and the VM need macOS 26 or later on Apple silicon. Linux and Intel Macs get a CLI-only build on Docker or Podman, which is a container, not a VM.

Source