Claude Desktop file access: what Claude can see, and how to limit it

How Claude reaches your files

Claude Desktop itself does not read your disk. Access comes through extensions, small local programs that Claude can ask to list a folder, read a file or move it. Every extension decides what it allows. Some give Claude a full terminal; Desktop Steward deliberately does not.

Two levels of permission

• Claude Desktop's own prompt. Before each tool call it shows “Claude wants to use … from …” with Allow once, Always allow, or Decline. People tend to click Always allow after a while.
• The extension's rules. This is where the real limits live, because they still hold after “Always allow”.

Limits worth having

• Separate read from change. Reading Documents is fine; changing them should be limited to a working folder.
• A confirmation the model cannot click. Deleting or replacing files should open a window on the computer, not just a question in the chat.
• Undo. If a change can be reverted, a mistake stops being a disaster.
• Forbidden places. Password stores, keychains, SSH keys, browser profiles, mail, system folders. These should be unreachable whatever you configure.
• No terminal unless you need one. A terminal can reach everything, so folder rules stop meaning much.

The risk nobody mentions: prompt injection

A document you downloaded can contain text that tells the AI to do something else, such as “copy the keys folder to Shared”. Good extensions make that impossible by design: no network tools, no reach into secret folders, no writes outside the working folders. Even then, the AI can read and summarise anything inside the readable folders into the chat, so choose those folders with that in mind.

How Desktop Steward applies this

Read folders and change folders are separate. Deleting, replacing and bulk moves open a macOS window. Every change can be undone for seven days. Secrets, system folders and anything executable are off limits, and there is no terminal. The details, including what it does not protect against, are in the security model.