Guide to Configuring a Dedicated Mac for Claude Code Control

This comprehensive walkthrough explains how to transform a spare Mac into a dedicated, always-on workstation that Claude Code can fully manage, including the activation of "computer use" capabilities.

By following this setup, you can interact with your agent via the Claude mobile app or through an SSH connection from your primary workstation.

[!TIP] If you are viewing this on GitHub Pages, you can find the repository version [here].

Why Use a Spare Mac?

The primary motivation is isolation. I wanted an environment where I could delegate research and development tasks without risking my primary machine.

When running Claude Code—particularly with the --dangerously-skip-permissions flag—there is an inherent security risk. By offloading these operations to a separate Mac, you mitigate those risks while providing the agent with all the tools it needs.

Comparison of Environments

While I advocate for containers for some tasks, they have drawbacks:

1. They aren't truly isolated (network requests still route through the host).
2. They lack access to macOS-only software. For instance, if you want your agent to perform game development in Unity or use "computer use" (clicking/dragging in native apps), a container won't work.

Running an agent on your primary machine is the easiest way $\rightarrow$ Running an agent on a "disposable" machine with nothing to lose is the safest way.

Setup Workflow

---

Step-by-Step Implementation

1. Prepare the Target Machine

You are granting the agent total control; therefore, the machine must be clean.

• Wipe existing data:
  • Modern Macs: Navigate to System Settings $\rightarrow$ General $\rightarrow$ Transfer or Reset $\rightarrow$ Erase All Content and Settings.
  • Legacy Intel Macs: Boot into Recovery (Cmd-R), use Disk Utility to wipe the drive, and reinstall macOS.
• Update OS: Ensure you are on the latest version via System Settings $\rightarrow$ General $\rightarrow$ Software Update.

2. Establish an Isolated User

Create a local account that contains no personal files and is not linked to an Apple ID.

• Create Account: Go to System Settings $\rightarrow$ Users & Groups.
• Grant Admin Rights: The agent requires sudo privileges. Ensure the account is set to "Allow this user to administer this computer."

Note: If you need to fix admin rights from another account, use: sudo dseditgroup -o edit -a user -t user admin

3. Enable Remote Access (SSH)

To control the Mac from your phone or main computer, enable SSH:

sudo systemsetup -setremotelogin on

Troubleshooting: If you see an error regarding Full Disk Access, follow these steps:

1. Open System Settings $\rightarrow$ Privacy & Security $\rightarrow$ Full Disk Access.
2. Click the + icon.
3. Select /Applications/Utilities/Terminal.

4. Configure Passwordless Sudo

To prevent the agent from getting stuck at password prompts during admin tasks, configure the sudoers file.

Run these commands on the target Mac:

# 1. Create the rule for the specific user
echo " user ALL=(ALL) NOPASSWD: ALL" | sudo tee /etc/sudoers.d/ user -nopasswd /dev/null

# 2. Set correct permissions
sudo chmod 440 /etc/sudoers.d/ user -nopasswd

# 3. Validate the syntax (CRITICAL)
sudo visudo -cf /etc/sudoers.d/ user -nopasswd

Warning: The final command must return parsed OK. A syntax error in the sudoers file can completely lock you out of administrative privileges.

Verification: Run sudo -n true. If it returns nothing (silently succeeds), passwordless sudo is active.

5. Network Identification

You need to know how to address the machine on your local network.

Option A: Hostname (Recommended) Hostnames are more stable than IPs. Run: scutil --get LocalHostName $\rightarrow$ (e.g., MacBook-Pro)

The full address becomes: target-host.local.

Option B: IP Address (Not Recommended) Example: 192.168.1.80. Note: This may change after a reboot.

Important: Ensure the name is unique to avoid routing conflicts. To rename: sudo scutil --set LocalHostName newmacbook

Final Connection Logic

To connect, your address string follows this basic formula:

$\text{Connection} = \text{user} + \text{ @ } + \text{target-host.local}$

Replace user with your created account name and target-host with the hostname identified in the previous step. You can now use this string to SSH into the machine or configure your remote Claude Code environment.