[BUG] Sandbox `.mcp.json` ancestor walk goes past `$HOME` into `/home`, so every Bash command fails with `bwrap: Can't create file at /home/.mcp.json`

Preflight Checklist

• [x] I have searched existing issues and this hasn't been reported yet
• [x] This is a single bug report (please file separate reports for different bugs)
• [x] I am using the latest version of Claude Code

What's Wrong?

Summary

When the Bash sandbox is active, Claude Code hides ancestor configuration
files by bind-mounting /dev/null over them. The walk that collects ancestor
.mcp.json paths continues past the user's home directory and includes
/home/.mcp.json, and on a normal Linux system /home is owned by root and
not writable by the user. bubblewrap cannot create the mount point there, so
it aborts during sandbox setup and every Bash command fails before it
runs, including echo and pwd.

The equivalent walk for .claude directories stops correctly at $HOME, so
the same invocation binds /home/<user>/.claude but never /home/.claude.
The .mcp.json walk appears to take one step too many.

Impact

Non-interactive sessions with the sandbox enabled cannot execute any shell
command in any repository under /home/<user>, which is the default location
for user projects on Linux. There is no per-session workaround through
--settings: sandbox.filesystem.disabled is documented as the escape hatch,
but flag-provided settings may only harden the sandbox, so the value is
ignored. The only ways out are to disable the sandbox entirely or to move the
work outside /home.

Evidence

Placing a logging shim ahead of bwrap on PATH captures the argument list.
The ancestor walk for a working directory of
/home/<user>/Desktop/project/repo produces, in order:

--ro-bind /dev/null /home/<user>/Desktop/project/repo/.mcp.json
--ro-bind /dev/null /home/<user>/Desktop/project/.mcp.json
--ro-bind /dev/null /home/<user>/Desktop/.mcp.json
--ro-bind /dev/null /home/<user>/.mcp.json
--ro-bind /dev/null /home/.mcp.json          <-- fails here

For comparison, the .claude walk in the same invocation ends at
/home/<user>/.claude and never reaches /home/.claude.

/home on this system:

drwxr-xr-x 4 root root 4096 /home

Notes

• Reproduced consistently on 2.1.220; not tested on earlier versions.
• --strict-mcp-config does not avoid it: the hiding happens in the sandbox

layer, independently of which MCP configurations are loaded.

• Systems where the user's home is directly under a writable parent, or where

/home/.mcp.json happens to exist, will not see the failure, which may
explain why it is not more widely reported.

What Should Happen?

Expected behaviour

The ancestor walk for .mcp.json (and any similarly walked configuration
file) should stop at $HOME, matching the .claude walk. Failing that, a
deny path whose mount point cannot be created outside the user's home
directory should be skipped with a debug line rather than aborting sandbox
setup: the code already has a "Skipping deny path not within allowed paths"
branch for related cases.

Error Messages/Logs

Observed reply:


bwrap: Can't create file at /home/.mcp.json: Permission denied


The command exits 1 during sandbox setup; the shell command itself never
runs. The same failure occurs through `sandbox.enabled: true` in settings,
since both paths build the same bubblewrap argument list.

Steps to Reproduce

Reproduction

On a Linux host where /home is root-owned (the default), in any git
repository under /home/<user>:

cd ~/some-project
printf '%s' 'Run the bash command: echo MINIMAL-PROBE. Reply with only the
command output, or the verbatim error text if it fails.' \
  | CLAUDE_CODE_SUBPROCESS_ENV_SCRUB=1 claude --print --model sonnet \
      --no-session-persistence --allowedTools Bash

Claude Model

Not sure / Multiple models

Is this a regression?

I don't know

Last Working Version

_No response_

Claude Code Version

2.1.220

Platform

Anthropic API

Operating System

Ubuntu/Debian Linux

Terminal/Shell

VS Code integrated terminal

Additional Information

_No response_