███╗ ███╗██████╗ ██████╗ ████╗ ████║██╔══██╗██╔════╝ ██╔████╔██║██████╔╝██║ ██║╚██╔╝██║██╔══██╗██║ ██║ ╚═╝ ██║██║ ██║╚██████╗ ╚═╝ ╚═╝╚═╝ ╚═╝ ╚═════╝
Run Claude Code at full permissions inside a locked-down Docker container. An iptables firewall blocks everything except the handful of domains it actually needs. Your code stays on the host. Your databases stay unreachable. The Schwartz stays strong.
--dangerously-skip-permissions makes Claude Code fly. But an agent running unattended on
your laptop can reach your production database, read every .env you own, push to any remote,
and phone home to anywhere. "It probably won't" is not a security model.
YOLO mode on the host. Full network. Full filesystem. One confidently-wrong command away from a very bad afternoon.
Approve every tool call by hand. Safe, but you've turned a tireless agent back into a very expensive autocomplete.
Let him run wild — inside a sealed room. The container is the boundary; the firewall is the lock. He can't reach what isn't there.
One install script, one API key, one command. First run builds the image (~2 min); after that he's ready in about five seconds.
Prefer source? git clone the repo and symlink mrc.js — see the
installation docs. Requires Node.js 22+, Docker CLI, and Colima.
mrc ~/your/repoThe Node.js launcher auto-starts Colima, builds a Docker image stamped with your UID/GID, discovers your .sandboxignore files, spins up in-process clipboard & notification proxies, and boots the container with your repo bind-mounted at /workspace.
Inside the container, iptables sets a default-DROP policy and an ipset allowlist. Only a few domains resolve. IPv6 is blocked. Host services — Postgres, Redis, that staging box — are unreachable. It verifies the lock by confirming example.com is dead.
--dangerously-skip-permissions is perfectly safe here, because the container is the sandbox. He installs packages, runs tests, rewrites files — and VS Code on your host sees every change instantly through the bind mount.
The allowlist is resolved to IPs at boot and pinned in an ipset. Outbound traffic to anything else gets an immediate REJECT — fast feedback, no hanging sockets.
Pass --web (or set it in .mrcrc) to open outbound HTTPS for web search and fetch — while every other restriction stays in place. Add your own private registries by editing one loop in init-firewall.sh.
Default-DROP policy, ipset allowlist, IPv6 blocked, host services sealed off. Verified at every boot.
securityRun Claude Code by default, or --agent codex for OpenAI's CLI. Both get their own persistent config volume.
Paste images straight into Claude. An in-process TCP proxy serves your host clipboard — no socat, no external deps.
Native macOS/Linux pings when Claude finishes, with repo name and a one-line summary. Work elsewhere; he taps your shoulder.
built-inAuto-resume, named sessions, an arrow-key picker, AI-generated names & summaries, and tool-miss detection on exit.
sessionsRecursive, like .gitignore. Listed files appear empty; listed directories appear as empty dirs. He doesn't know what he's missing.
A live bar showing context-window usage plus 5-hour and 7-day rate-limit gauges, color-coded as you approach compaction.
visibilityGlobal defaults in ~/.mrcrc, per-repo overrides in <repo>/.mrcrc. One flag per line. CLI always wins.
Run several sessions against one repo. Each gets its own config volume and dynamically allocated proxy ports. No collisions.
scaleConversation history and memory live in .mrc/ inside the repo — survives volume resets, travels with the project.
--daemon runs detached and prints a container ID; --json streams stream-json for scripting and CI.
Defaults the VM to all your cores and half your RAM (8 GB floor). Override with --colima-cpu / --colima-memory.
Mister Claude can run a whole team of agents — an architect, engineers, a critic, an adversary — each sealed in its own container behind the same firewall, addressing each other by @mention. You steer from a web dashboard or your phone. They propose; you steer; you commit. The crew works; you stay in command.
Declare a roster (or pick a preset) and mrc team up. Each member boots in its own sandbox with its own write territory, so they never clobber each other's files. They collaborate by @mention; a critic reviews risky work; you commit.
One local web app for the whole org: every team room, the @you inbox, live transcripts. Watch, steer or pause any member, suspend a project and resume it later — each member picks up its own conversation. Built in, no extra service.
built-inLink a bot and the team's questions and updates push to your phone with stable #ids. Reply from Telegram and it routes back to the right agent. A quick BotFather + Confirm to link, then you're set.
remoteA team.json roster, a ready-made preset, or build one in the dashboard.
mrc team upEvery member boots in its own sealed container — you accept each one in.
They collaborate by @mention; you direct from the leads room and commit the work. Close a tab to suspend; reopen to resume.
You're always in the loop — by design. Members can't overwrite each other's files or reach the open internet, a critic reviews the work, and you commit every change. That's not friction; it's how a team moves fast without you waking up to a dropped table.
Pinned to the bottom of every session. Green under 60%, amber from 60–76%, red past 77% — because Claude reserves ~15% for compaction.
mrc status sweeps every repo and shows live containers with uptime and flags — no API key required.
An arrow-key picker over named, auto-summarized sessions. Reopening a repo resumes the last one automatically.
"God willing, we'll all meet again in Spaceballs 2: The Search for More Money."— Yogurt
Seal the room, hand over the keys, and let Claude actually work.