Can Claude Code read files outside your project folder?

You start Claude Code in ~/code/app. Can it read ~/code/other-client, or your notes one folder up? Mostly no: the folder you start in is a fence, and tools that reach past it need your approval. But the fence is on the paths Claude Code can see in a command, not on everything a command does.

We tested it with Claude Code 2.1.318 in claude -p (where a request for approval counts as refused): a project folder proj, and a file ../other/notes.txt next to it.

What got through#

The shell commands were caught even with cat and cp allowed. Claude Code checks the paths in a command line, and said so:

cat in '…/f/other/notes.txt' was blocked. For security, Claude Code may only concatenate files from the allowed working directories

acceptEdits approves edits inside the folder, not anywhere on disk.

The gap: anything that runs code#

show.py was one line:

print(open("../other/notes.txt").read())

With Bash(python3:*) allowed, the agent ran it and printed the file. Claude Code can see python3 show.py; it can't see what the script opens. The same goes for node script.js, npm run …, make and your test runner. Allowing one of those is allowing whatever the code it runs can reach. And the agent can write the script first: inside the project folder, writing a new file is an ordinary edit.

Closing it#

Deny the folders you care about by full path. Deny rules are checked first. Start the path with // to mean an absolute path:

{
  "permissions": {
    "deny": ["Read(//Users/you/code/other-client/**)"]
  }
}

With that in the project's .claude/settings.json, the Read was refused even though we'd also passed --add-dir for that folder. A rule written as Read(../other/**) did not block it in our test, so use the full path.

Don't allow interpreters by prefix if the folder matters. Bash(python3:*) or Bash(node:*) runs any script, including one the agent just wrote. Allow the exact commands you need, such as Bash(npm test), and let the rest ask.

Use the sandbox for real isolation. Deny rules and path checks cover Claude Code's own tools. A script runs as you, with your access. The sandbox limits what the process itself can open; our post on keeping Claude Code away from .env files walks through it and what it closes.

Open the folder on purpose. When the agent does need another folder, add it for that session with --add-dir ../other instead of starting Claude Code one level up. Starting in ~/code puts every project inside the fence.

Check your own setup in a minute#

Your settings may differ from ours: an allow rule in your user settings, a hook, or a different mode. Put a file one folder up and ask a print-mode run to read it:

echo "fence test" > ../fence-test.txt
claude -p "Read ../fence-test.txt and reply with only its contents." --output-format json < /dev/null \
  | jq '{result, denied: [.permission_denials[].tool_name]}'
rm ../fence-test.txt

On our machine the read was refused and the denial was listed:

"denied": [
  "Read"
]

If yours prints "fence test" instead, something in your settings already opens that folder. Run /permissions in a session to see every allow rule and where it comes from, and look for an additionalDirectories entry in your settings files, which works like a permanent --add-dir.

Several projects, one person#

The fence works best when each agent runs in its own project folder. Joxo shows every session grouped by project on your phone and desktop, so it's clear which agent is working where, and you can answer each one without switching terminals. See running several Claude Code sessions at once.

Frequently asked questions#

Can Claude Code read files outside the folder I started it in?#

Not with its own tools without your approval. In our test, Read, Write, cat and cp on a file one folder up were all refused in print mode, even with cat and cp allowed and edits auto-accepted.

Does acceptEdits let Claude Code write anywhere?#

No. In our test it wrote inside the project folder, and the write to ../other/new.txt was refused.

How can Claude Code still reach files outside the project?#

Through code it is allowed to run. With Bash(python3:*) allowed, a script that opened ../other/notes.txt printed it. Claude Code checks paths in the command line, not what a program opens.

How do I block a folder from Claude Code completely?#

Add a deny rule with the absolute path, such as Read(//Users/you/code/other-client/**), and use the sandbox for scripts. In our test the deny rule beat --add-dir; a relative ../ pattern did not block.