The goal of CCIso is to protect local privacy and keep Claude working within boundaries you control. You should be able to see what protection covers, what needs attention, and then decide whether to continue.
CCIso for macOS is available; Windows and Linux are still planned. The sections below separate what is provided today from what is not finished. Full private-folder isolation and outbound content inspection are not implemented.
Three different boundaries
| Your question | Current implementation scope | What it does not establish |
|---|---|---|
| How does Claude connect? | Connection rules route included processes through a designated local forwarding port | The contents of an allowed connection have passed a privacy check |
| Where are passwords and keys kept? | The system service restricts access to proxy secrets; rules and permission checks cover specific Claude credential files | Every login secret and personal file is isolated from Claude |
| Is protection working? | Checks examine rules, entry points, processes outside the boundary and some credential permissions | A green status means every read or upload was reviewed |
Connection rules: control the route
The macOS core assigns a dedicated group to target processes and applies system firewall rules to their connections. A local forwarding engine sends connections to your configured proxy. Its generated configuration contains no direct outbound route.
This mechanism is intended to keep included processes within those rules. A controlled connection should stop when the proxy is unavailable. Checks still need to establish that the rules are active and the relevant processes are included; entering a proxy address is not sufficient evidence.
Connection control is one part of privacy protection. It does not determine whether an upload contains your contracts, source code or personal information.
Credentials: distinguish two kinds of secrets
Proxy passwords and imported keys are used by the CCIso system service. The current macOS implementation stores them in directories restricted to the system administrator identity and passes forwarding configuration to the engine through a memory pipe. Files remain on disk. This is not completed Keychain integration or a promise of no plaintext storage.
Claude login credentials have separate protections. Current code adds Read-tool deny rules for two named credential files and can check and tighten the permissions of the credentials file. These are not an independent filesystem sandbox. The rules alone do not establish isolation from other programs running as the same user or every other way of reading a file. Claude Desktop login storage is a separate case.
Files: an unfinished part of the goal
Current CCIso does not create a separate operating-system user or home directory for Claude, and does not isolate all personal folders such as Documents or Desktop. A group used for network rules does not remove the file access already held by the current user.
If you need Claude to access only files you explicitly select, current CCIso does not yet meet that full requirement. Review Claude’s own tool permissions and sandbox separately in Anthropic’s permissions documentation and sandboxing documentation.
See a finding, then take action
The macOS version provides a Health check that pairs findings with next steps, such as repairing a missing rule or restarting a process that has not been included. Rely on the results the app actually shows.
A check reports the items it actually observes. It is not a file-access history or an approval record for outgoing data. The planned process tree is not a replacement for either record.
Platform status
| Platform | Current status | What still needs confirmation |
|---|---|---|
| macOS | Available: universal PKG installer, signed and notarized by Apple, macOS 13 or later | Tested on a real Mac with Claude Code 2.1.316 and Claude Desktop 4.4212.0; the process tree view is not available yet |
| Windows | Planned, not released | Coverage of main processes, children and loopback connections in tested releases |
| Linux | Planned, not released | Dedicated groups, nftables and later cgroup/eBPF work remain platform designs, not shipped capabilities |
Installing CCIso does not establish coverage of Cowork virtual machines, cloud execution or browser activity. Connections and name resolution performed through system services also need separate assessment.
Not activated and activated
The app is free. Core connection rules, status and checks are the same with or without activation; an activation code turns on always-on protection, automatic updates and deep clean (encrypted backup first). The process tree view is still planned. Activation does not add private-folder isolation or content inspection that has not been implemented. See editions and activation.
Continue
Sources reviewed on November 1, 2026: Anthropic’s network configuration, permissions and sandboxing documentation. CCIso descriptions refer to macOS version 0.1.7.