Sandbox blocks Unix domain socket creation in TMPDIR (/tmp/claude)

Summary

Claude Code's sandbox sets TMPDIR=/tmp/claude for child processes, but blocks Unix domain socket listen() calls in that directory. This breaks tools like tsx that create IPC pipes in TMPDIR.

Reproduction

1. Configure an MCP server in .mcp.json that uses tsx to run a TypeScript file:

``json
{
"mcpServers": {
"my-server": {
"command": "bash",
"args": ["-c", "cd .claude/mcp && npx tsx server.ts"]
}
}
}
``

1. The MCP server fails to start with:

``
Error: listen EPERM: operation not permitted /tmp/claude/tsx-501/<pid>.pipe
at Server.setupListenHandle [as _listen2] (node:net:1918:21)
...
``

Cause

tsx creates a Unix domain socket in TMPDIR for IPC between its parent and child processes. The sandbox allows regular file writes to /tmp/claude but blocks listen() on Unix domain sockets there. The /tmp/claude directory also has the com.apple.provenance extended attribute, which may contribute to the restriction.

Regular file I/O works fine — only socket operations are blocked.

Impact

Any MCP server or Bash tool command that uses tsx (or other tools that create Unix domain sockets in TMPDIR) will fail with EPERM.

Workaround

Bundle TypeScript to JavaScript at startup using esbuild (which is a transitive dependency of tsx) to avoid tsx's IPC mechanism entirely:

{
  "mcpServers": {
    "my-server": {
      "command": "bash",
      "args": ["-c", "cd .claude/mcp && npx esbuild server.ts --bundle --platform=node --format=esm --outfile=.server.mjs && node .server.mjs"]
    }
  }
}

Expected behavior

If Claude Code designates /tmp/claude as TMPDIR for child processes, Unix domain socket operations should be permitted there — not just regular file I/O.

Environment

• macOS 24.6.0 (Darwin)
• Node.js v22.21.1
• tsx v4.19.4
• Claude Code desktop app