Isolation model

The container executing Claude Code holds zero external service tokens and possesses no direct network connectivity to services like GitLab, Slack, or SharePoint. When a project enables an integration, that service runs in an independent worker container with read-only credential mounts. While Claude reasons and drafts modifications, raw credentials never pass through the model environment. See Credentials management for details.

Defense-in-depth container hardening

Every container rendered by Speedwave (the Claude container, the central hub, and all service workers) implements strict security baselines:

• All standard Linux capabilities are dropped.
• Privilege escalation is disabled (no-new-privileges).
• The root filesystem is mounted strictly read-only.
• The /tmp directory is mounted as a noexec tmpfs filesystem.
• CPU and memory allocations enforce resource governance to prevent runaway process exhaustion.

Claude never communicates with external services directly. It communicates with the central MCP hub, which forwards requests to the appropriate service worker holding the required credentials. Compromising a single worker exposes only that specific service, while a compromised hub contains no credentials. The office worker (which parses Word, Excel, PowerPoint, and PDF files) goes further: it operates with no credentials on an internal network with no default gateway, preventing document-parsing exploits from accessing the internet.

flowchart LR
  Claude["Claude container<br/>(zero tokens)"] -->|HTTP| Hub["MCP Hub<br/>(zero credentials)"]
  Hub -->|HTTP| Slack["Slack worker"]
  Hub -->|HTTP| GH["GitHub worker"]
  Slack -->|"reads"| ST[("Slack credentials, read-only")]
  GH -->|"reads"| GT[("GitHub credentials, read-only")]

Host toolchain boundary

The Claude container provides standard execution environments for Node.js (with npm), Python 3 (with pip), Git, and standard shell utilities. It possesses no access to host toolchains (such as host JDK, Gradle, Go, .NET installations, or host container sockets). Restricting execution exclusively to the container sandbox guarantees that model operations cannot affect host system state.

Safe outbound link handling and SSRF prevention

When users click links generated by Claude, the desktop application delegates URL resolution to an external handler rather than rendering content in-app. URLs are validated against length limits (maximum 8192 characters) and strict SSRF rules: only http and https protocols are permitted, while loopback, private RFC 1918, and link-local ranges are blocked. This prevents crafted links from probing internal intranet endpoints. The same validation applies to plugin OAuth endpoints; see Write a plugin.

Project-scoped network segregation

Isolation is applied consistently across workspaces. Each project is provisioned with a private container network and dedicated token storage, preventing workers in one workspace from discovering or accessing assets belonging to another. See Container topology for network mapping details.

These container controls are reinforced by a dedicated virtual machine layer (Lima on macOS, WSL2 on Windows) providing kernel-level separation from the host operating system. Even in the theoretical event of a container sandbox escape, execution remains contained within the virtual machine boundary. See How Speedwave works for architectural context.