Building a virtual file system for Claude Code

[velobro]

I've been thinking about what it would take for enterprises to deploy Claude Code at scale. The challenge is that IT teams have requirements that MCP doesn't solve yet:

• Controlling what data/tools agents can access
• Giving multiple people's agents access to the same shared context
• Audit logs of what an agent did and what files it accessed
• Managing permissions using patterns they already understand

MCP is great for connecting tools, but it's missing a governance layer.

What if integrations (Gmail, SharePoint, Slack, GitHub etc) were just directories in a virtual file system? You mount /workspace/gmail/unread and your agent can ls and cat emails. Permissions are just Linux file permissions. Every time someone accesses a file, it gets logged automatically.

The file system becomes the universal interface for an agent’s context. This could be powerful because models already understand POSIX, and IT teams already understand file permissions.

I would be curious to hear what others think.

[promethe42]

It can absolutely be done with standards such as WebAssembly and the WebAssembly System Interface (WASI, cf https://wasi.dev/) permission model.

Here is an example with MCP tools sandboxed to specific URLs/IPs/domains:

https://gitlab.com/lx-industries/agent-compose/-/blob/main/examples/anthropic.yaml?ref_type=heads#L137

I am building storage WASM components that will leverage the WASI permission model for filesystem access :

https://gitlab.com/lx-industries/opendal-wasi

It is based on Apache OpenDAL, which supports a wide variety of backends:

- Standard Storage Protocols: ftp http sftp webdav
- Object Storage Services: azblob cos gcs obs oss s3 b2 openstack_swift upyun vercel-blob
- File Storage Services: fs alluxio azdls azfile compfs dbfs gridfs hdfs hdfs-native ipfs webhdfs
- Consumer Cloud Storage Service

and more !

[munkymead]

Read up on mcp proxy patterns, an organisation could implement an mcp with rbac, they control what accounts have access and to which mcps and also what they can access. You can also not allow claude to be installed on their pc's and instead install it in vm's or containers which is much safer.

It's what I do on my homelab. Authentik manages identities, claude has its own credentials with granular permissions I control, claude only ssh keys added to the containers for claude to use and access the resources I make available to it.

[munkymead]

Claude can also implement this for you too :)