Skip to content

Cowork's Built-In Shell Is a Sandbox, Not the Local Machine

TL;DR — A Cowork session's built-in shell tool runs in an isolated cloud/container sandbox — not on the physical machine Claude Desktop is running on. It has no Tailscale, no SSH keys, and no filesystem visibility beyond folders you've explicitly connected. If you need real local execution (reaching the Tailscale fleet, running local dev tools, etc.), install the actual local shell MCP (@mkusaka/mcp-shell-server) as an mcpServers entry in claude_desktop_config.json — Cowork sessions on that machine will pick it up automatically alongside the built-in tools.

Symptom

A Cowork session's shell tool can run commands, but:

  • hostname returns something generic (e.g. claude, or a random session name) — not the actual machine's hostname
  • There's no ~/.ssh directory, and any SSH/Tailscale hostname (ssh root@fleethost) fails with Could not resolve hostname
  • Only the folder(s) explicitly connected to the Cowork session are visible under a mount path (e.g. /sessions/<id>/mnt/) — nothing else on the real machine (~/Documents/OtherFolder, /opt/homebrew, etc.) is reachable, even though it obviously exists on the physical Mac

This is easy to misread as "Cowork's shell must have a config problem" or "this machine's Tailscale must be broken" — neither is true. The sandbox is working exactly as designed; it's just not the same thing as the local machine.

Why this happens

Cowork mode's built-in file/shell access is a deliberately isolated environment — a security boundary, not a convenience shortcut for "run this on my Mac." It gives Claude a safe place to read/write connected folders and run arbitrary commands without those commands ever touching the real host filesystem, network, or credentials.

This is architecturally different from the older Claude Desktop pattern of manually configuring local MCP servers (filesystem, shell, custom vault/mail servers, etc.) via claude_desktop_config.json's mcpServers block — those are spawned as real subprocesses on the physical machine, with real local filesystem access, real network access (including Tailscale), and whatever credentials the local user has.

A machine that's only ever been set up with Cowork's built-in access — and never had the local shell/filesystem/other custom MCPs configured — genuinely has no path from a Cowork session to anything outside the connected folder(s). It's not a bug to work around; it's a capability that was never installed.

Confirmed 2026-07-30: once a real local MCP (shell, via @mkusaka/mcp-shell-server) is added to claude_desktop_config.json and Claude Desktop is fully restarted, an already-open Cowork chat session picks up the new tool immediately — no separate Cowork-side setup step. Cowork sessions do inherit locally-configured Desktop MCP servers; they just don't have any by default beyond the sandboxed built-ins.

Diagnostic chain

  1. Check which shell tool actually ran the failing command. If a session has both the sandboxed built-in and a locally-configured MCP (e.g. mcp__workspace__bash vs. mcp__shell__shell_exec), they behave completely differently — always confirm which one produced a given result before concluding something is unreachable.
  2. Confirm the sandbox's identity: 
    hostname && whoami && ls -la ~/.ssh 2>&1
    A generic hostname, an unfamiliar username, and a missing .ssh directory all point to the sandbox, not the real machine.
  3. Check what's mounted: 
    ls -la ~/mnt/ 2>/dev/null || ls -la /sessions/*/mnt/ 2>/dev/null
    Only explicitly connected folders will appear here.
  4. If real local access is needed, check Claude Desktop → Settings → Developer → Local MCP servers. If it says "No servers added," that's the gap — not a Cowork bug.

Fix

Add the local shell MCP to claude_desktop_config.json (macOS: ~/Library/Application Support/Claude/claude_desktop_config.json):

{
  "mcpServers": {
    "shell": {
      "command": "npx",
      "args": ["-y", "@mkusaka/mcp-shell-server"]
    }
  }
}

Merge this into the existing file rather than overwriting it — on newer Claude Desktop builds, claude_desktop_config.json also carries unrelated Cowork/Desktop-app preference keys (preferences, coworkUserFilesPath, etc.) that must be left intact.

Full-quit Claude Desktop (Cmd+Q on macOS — closing the window is not enough) and relaunch. An already-open Cowork chat will show the new tool as a "deferred tool" available via tool search; a fresh session will show it immediately.