Running Claude Code on a Spare Mac: The Value and Security Boundaries of an Isolated Agent Workstation

A detailed guide by ykdojo (the Claude Controls for Mac guide) describes a practical setup: turning a spare Mac into a dedicated workstation for Claude Code. This lets AI agents run for extended periods, operate macOS-only apps, and be controlled remotely from your main machine or phone. The appeal is clear – isolate agent operations from your daily environment – but the guide also includes high-permission configurations (passwordless sudo, skip-permissions flags) that are intended for the author’s experimental use, not as universal defaults. This article walks product builders and AI tool learners through the architecture, setup steps, security trade-offs, and practical use cases, always grounding claims in the source material.

Historically, AI coding agents like Claude Code run on the same machine as the developer, sharing access to personal files, credentials, and network. The novelty of this approach is creating a physically separate, always-on macOS environment solely for the agent. As the source guide explains: “I wanted to create a separate environment Claude Code can control on its own, so I can delegate tasks I don’t necessarily want to run on my own machine.” This shifts risk from the primary daily driver to an isolated box that can be wiped and reset without consequence. It also enables tasks that containers cannot fully handle, such as controlling macOS-native apps via computer use.

How the Architecture Works

The setup follows a client-server model:

• Main Mac / Phone (controller) sends tasks over SSH or the Claude app’s remote-control feature.
• Spare Mac (target) runs Claude Code, isolated repositories, scoped API credentials, and optionally full GUI access.

The source guide uses a dedicated local user account on the spare Mac, no Apple ID signed in, and a fresh macOS installation. The controller connects via SSH keys (passwordless), and a helper script ic.sh wraps common operations. This separation means that even if the agent misbehaves – installing malicious packages, deleting files, or exfiltrating data – the main machine’s photos, documents, browser sessions, and keychains remain untouched.

A Separate Machine Is Not Automatically Safe

The source guide provides step-by-step instructions. Below are the core steps, with commentary on where to exercise caution.

1. Fresh macOS and Isolated Account

Wipe the spare Mac (Erase All Content and Settings or disk utility) if it contains personal data. Create a new local admin account, but do not sign into an Apple ID. This prevents the agent from accessing iCloud, Keychain, or personal sync data.

2. Enable SSH and Passwordless sudo

Turn on Remote Login:

sudo systemsetup -setremotelogin on

The source then configures passwordless sudo for the dedicated user:

echo "<user> ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/<user>-nopasswd >/dev/null
sudo chmod 440 /etc/sudoers.d/<user>-nopasswd
sudo visudo -cf /etc/sudoers.d/<user>-nopasswd   # must print 'parsed OK'

Trade-off: This removes the password prompt for sudo – convenient for automation, but any mistake or malicious script gains full root access. The source author uses this in his experimental environment. For production or shared machines, consider granting passwordless sudo only for specific commands and using a dedicated low-privilege account for most tasks.

3. Set Up SSH Keys

From the main Mac:

ssh-keygen -t ed25519
ssh-copy-id <user>@<target-host>.local

Test with ssh <user>@<target-host>.local whoami. The target should respond without a password prompt.

4. Keep the Target Awake

Prevent the spare Mac from sleeping when plugged in:

sudo pmset -c sleep 0
sudo pmset -c disablesleep 1
sudo pmset -c displaysleep 0
defaults -currentHost write com.apple.screensaver idleTime 0

The source notes that on battery, use -a instead of -c but warns of battery drain.

5. Install Claude Code and Log In

Push the install command over SSH:

ssh <user>@<target-host>.local 'curl -fsSL https://claude.ai/install.sh | bash -s -- 2.1.219'

Ensure ~/.local/bin is on PATH by adding it to ~/.zshenv. Then ssh in and run claude to authenticate via browser. For GitHub, use gh auth login – the source recommends a separate GitHub account to avoid polluting your main account.

A Safer Setup Order

Computer use lets Claude see and interact with the desktop (screenshots, mouse, keyboard). This requires a workaround because SSH sessions lack Screen Recording and Accessibility permissions. The source’s solution: a tmux server launched as a LaunchAgent inside the GUI login session. Child processes inherit the GUI session’s permissions.

Setup Script

On the target, run:

ssh -t <user>@<target-host>.local \
  'curl -fsSL https://raw.githubusercontent.com/ykdojo/claude-controls-mac/main/setup-computer-use.sh -o setup-computer-use.sh && bash setup-computer-use.sh'

This installs the LaunchAgent, enables the built-in computer-use tool, and requires tmux and a Claude Pro or Max plan.

One-Time Permissions (Cannot Be Scripted)

macOS requires manual approval for Screen Recording and Accessibility. The source details:

• Grant tmux (not claude) under both Screen Recording and Accessibility in System Settings > Privacy & Security.
• Grant tmux Full Disk Access to suppress “access data from other apps” prompts.
• Restart the tmux server after granting permissions.

These steps must be done physically at the machine or via Screen Sharing (VNC). The source warns: “macOS blocks synthetic clicks on these prompts.”

Use from Main Machine

Install the ic script:

curl -fsSL https://raw.githubusercontent.com/ykdojo/claude-controls-mac/main/ic.sh -o ~/.local/bin/ic
chmod +x ~/.local/bin/ic
export IC_BOX="<user>@<target-host>.local"

Then ic starts a new Claude Code session on the box with computer use. Additional subcommands: ic -c to continue, ic ls to list sessions, ic rc for remote control, etc.

When GUI Control Is Worth It

Claude Code’s remote-control feature lets you drive a session from the Claude mobile app. On the target, either run /remote-control inside an existing session or start a server with claude remote-control. The ic rc command wraps the latter and ensures computer use is available. This is particularly useful for checking progress or issuing new tasks while away from your desk.

Who This Fits

The source guide is transparent about risks. Key limitations to consider:

• Passwordless sudo is a high-risk convenience. The source uses it, but states “run an agent with broad permissions is safer on a machine that has nothing to lose.” For most users, a better approach is to start with minimal sudo privileges and only expand as needed.
• The --dangerously-skip-permissions flag used by ic disables all permission prompts. Combine this with passwordless sudo, and a single misstep (or malicious code in a repository) can compromise the entire system.
• Network exposure: SSH open to the LAN is safer than the open internet, but still vulnerable to misconfiguration. The source does not cover firewall rules or VPN-only access.
• Computer use grants the agent screen capture and input control. The source recommends granting these only after the CLI workflow is solid, and only for the dedicated account with no personal data.
• Recovery: The box should be easily reproducible (code in Git, backups). Treat it as a disposable pod, not a production server.

A separate machine shrinks the blast radius but does not eliminate risk. The agent box still reaches the network, cloud accounts, source code, and API keys. The recurring failure modes: un-vetted packages or malicious repo scripts; over-broad sudo turning one bad command into system-level damage; SSH exposed to password guessing; personal GitHub, Apple ID, or primary cloud credentials copied onto the box; and computer-use grants (Screen Recording + Accessibility) that let the agent operate far more apps. Treat --dangerously-skip-permissions and NOPASSWD: ALL as endpoints of a gradual ramp — start with specific repositories, specific commands, and least-privilege credentials, and widen only as needed.

A spare Mac dedicated to Claude Code is a powerful addition for teams and individuals who need long-running AI agents, macOS app automation, or a clean separation from daily work. The setup is well-documented in the source guide, but treat its high-permission defaults as experimental. Start with:

1. A fresh local account with no personal data.
2. SSH key authentication, no passwordless sudo initially; keep the box awake with pmset (an idle Mac drops off the network after ~10 minutes by default) and sync clipboards over SSH via pbcopy/pbpaste — the guide’s clip.sh adds image support, so a screenshot copied on your phone can be pasted straight into the remote Claude Code session.
3. Scoped API tokens and separate GitHub account. For access from outside the LAN, the guide itself recommends Tailscale: WireGuard peer-to-peer tunnels with nothing exposed to the public internet, where joining the network grants reachability only — SSH and Screen Sharing still demand their own key or password on top. Phone control relays through the Claude app via Anthropic rather than opening remote ports.
4. Computer use only when explicitly needed.
5. A rebuild script so you can wipe and start over in minutes.

By respecting these boundaries, you gain the benefits of a full macOS agent workstation without turning it into a new vector of compromise.

Sources

• Original source

AI-assisted summary compiled from the sources above, reviewed by a human before publishing.