Secure a Mac mini for Claude Home Base

Prepare a Mac mini, authenticate Claude Code, and isolate a Home Base checkout.

Introduction

30 Second Summary

You will turn your Mac mini into a dependable home base for a local assistant. The assistant stays focused on one dedicated workspace.

In this project, you will confirm your Mac is compatible with Claude Code. You will authenticate it before adding a restricted identity for Claude Home Base.

What You'll Build

You will see Terminal return a personalized readiness response from inside your restricted Claude Home Base checkout.

By the end of this project, you'll have:

  • A compatibility check showing that your Mac mini meets the required macOS version and memory level.
  • An on-demand response from Claude Code in Terminal.
  • A pinned workspace whose exact Git commit and local safety boundary you can verify.
  • Secret Mission: An optional challenge to push your skills further.

Are there any prerequisites?

You need a Mac mini with internet access. You also need permission to install software plus an eligible Claude Pro, Max, Team, Enterprise, or Console account.

Before We Start

Before you change your Mac mini, define what you want your local agent to help with. This keeps the goal clear while making isolation a deliberate part of the foundation.

Inspect and Prepare the Mac mini

Your Mac mini is still an unknown machine. Before you trust it with agent work, you need to confirm that it can run Claude Code reliably.

This step confirms the hardware baseline. It also configures dependable power behavior before you install the required tools.

In this step, get ready to:
  • Confirm the Mac mini meets the operating-system and memory requirements.
  • Configure the Mac mini to stay awake and recover after a power failure where supported.
  • Verify working Git and Claude Code installations from Terminal.
Inspect the Mac mini

Claude Code requires macOS 13.0+. It also requires at least 4 GB of memory.

  • Click the Apple menu in the top-left corner.
  • Select About This Mac.
  • Record the Mac mini model.
  • Record the listed chip or processor.
  • Record the listed memory.
  • Record the listed macOS version.

Need More Hardware Detail?

System Report provides a deeper hardware view when About This Mac does not show enough detail. It helps you answer the same compatibility questions with more specific information.

  • Open System Settings if a hardware detail is missing.
  • Select General.
  • Select About.
  • Click System Report.
  • Compare the listed macOS version with the 13.0 minimum.
  • Compare the listed memory with the 4 GB minimum.
  • Confirm the processor is x64 or ARM64.
  • Use Software Update if the macOS version is below the minimum and Apple offers a compatible upgrade.

Stop the setup if the Mac remains below macOS 13.0 or has less than 4 GB of memory. A compatible result gives you a safe baseline for the remaining setup.

Configure always-on power

An always-on local agent needs predictable uptime. The Energy settings prevent automatic sleep while the display is off.

  • Click the Apple menu in the top-left corner.
  • Select System Settings.
  • Select Energy.
  • Turn on Prevent automatic sleeping when the display is off.
  • Choose After power failure for Start up when power is connected if that option appears.
  • Turn on Start up automatically after a power failure if your Mac shows that option instead.

Why Might the Power Options Differ?

Available Energy options vary by Mac model. Use the supported recovery option shown on your Mac mini.

Install and verify Terminal tools

You will use Terminal to verify Git and Claude Code. Each command prints version information when its tool is available.

  • Use macOS search to find Terminal.
  • Select Terminal to open it.
  • Check whether Git is installed by running this command:
git --version

✔️ I see version information

Git is installed. Keep this Terminal window open for the Claude Code check.

ⓧ Git is unavailable

The next command opens Apple's developer tools installer.

  • Start the developer tools installer by running this command:
xcode-select --install
  • Complete Apple's installer prompts.
  • Verify Git by running this command:
git --version

Terminal now prints Git version information.

Developer Tools Installer Not Opening?

Check that the Mac mini has an internet connection. If the installer still does not appear, use help me diagnose why xcode-select --install is not opening the installer on my Mac.

  • Check whether Claude Code is installed by running this command:
claude --version

✔️ I see version information

Claude Code is installed. Your Mac mini now has both required commands available.

ⓧ Claude Code is unavailable

The native installer supports Intel and Apple silicon Macs. It installs the current Claude Code build without requiring Node.js.

  • Install Claude Code by running this command:
curl -fsSL https://claude.ai/install.sh | bash
  • Close the current Terminal window after the installer finishes.
  • Use macOS search to open a new Terminal window.
  • Verify Claude Code by running this command:
claude --version

Terminal now prints Claude Code version information.

Claude Command Still Unavailable?

Make sure you opened a new Terminal window after installation. If the command remains unavailable, use help me diagnose why Claude Code is unavailable after the native macOS installation.

  • Predict what each final command will print when both tools are ready.
  • Verify Git one more time by running this command:
git --version
  • Verify Claude Code one more time by running this command:
claude --version

Both commands print version information and return to the shell prompt. About This Mac also shows macOS 13.0 or later with at least 4 GB of memory.

Your Mac mini is compatible, configured for dependable uptime, and equipped with both command-line tools. Next, you will authenticate Claude Code and get its first visible reply.

Authenticate Claude Code

Your Mac mini is ready. Claude Code now needs access to the account you intend to use.

An installed CLI cannot respond until it is authenticated. This step connects it to your account through Terminal and proves it can complete a one-shot request.

In this step, get ready to:
  • Check whether an API key could trigger unexpected usage charges.
  • Authenticate Claude Code with your intended account.
  • Prove Claude Code can return a non-interactive readiness message.
Check for unexpected API billing

An API key takes precedence over subscription authentication. If ANTHROPIC_API_KEY is set, API usage charges can apply.

  • Check the current Terminal session for an API key by running this command:
echo $ANTHROPIC_API_KEY

What does this command do?

This command prints the current value of ANTHROPIC_API_KEY. A blank line means the variable is not set in this Terminal session.

A printed value means Claude Code would use API-key authentication. Keep that value private.

  • Skip to the next substep if the command prints a blank line.
  • Remove the value from this Terminal session by running the command below if you intend to use a Claude subscription:
unset ANTHROPIC_API_KEY

What does this command do?

This command removes ANTHROPIC_API_KEY from the current Terminal session. Claude Code can now use your subscription login instead.

  • Confirm the value is gone by running the inspection command again:
echo $ANTHROPIC_API_KEY

What should I see?

Terminal should print a blank line. This confirms the current session has no API-key override.

Still seeing a value?

Run the removal command in the same Terminal session where you checked the variable. Help me clear ANTHROPIC_API_KEY safely without exposing its value.

Sign in through the browser

Claude Code supports Pro, Max, Team, Enterprise, or Console accounts. The free Claude.ai plan does not include Claude Code access.

  • Start the authentication flow by running this command:
claude

What happens next?

Claude Code starts an interactive session. It guides you through browser authentication when a login is required.

  • Follow the browser login prompts.
  • Choose the eligible Claude account you intend to use.
  • Return to Terminal after the browser confirms authentication.
  • Exit the interactive Claude session so the shell prompt returns.

Having trouble signing in?

Confirm that the browser uses your intended eligible account. Help me diagnose my Claude Code browser authentication issue.

Prove non-interactive execution

Authentication status gives you a direct check before the readiness request. A successful status check confirms that Claude Code recognizes your login.

  • Before you run the check, predict whether Claude Code will report a logged-in state.
  • Check your authentication status by running this command:
claude auth status

What does this command do?

This command reports the current authentication status. It completes without opening an interactive Claude session.

The status should report that you are logged in. This proves the browser authentication reached the CLI.

  • Before you run the readiness test, predict the exact text Claude Code should return.
  • Send a one-shot request by running this command:
claude -p "Reply with exactly: MAC MINI AGENT READY"

What does this command prove?

Print mode sends one request and exits. This proves Claude Code can respond non-interactively from Terminal.

Terminal prints MAC MINI AGENT READY and returns to the shell prompt. This generic reply proves execution without proving a Home Base identity or workspace boundary.

Did the readiness message fail?

Run the authentication status check again to confirm the login is still active. Help me diagnose why my Claude Code print-mode request failed.

Claude Code is authenticated and responding on demand. Next, you will pin Claude Home Base to a verified commit before inspecting its defaults.

Pin and Inspect Claude Home Base

Your Mac mini can now run authenticated requests through Claude Code. The next risk is allowing a moving repository branch to change after you inspect it.

You will pin Claude Home Base to a verified Git commit. You will also examine its defaults before trusting them on your Mac mini.

In this step, get ready to:
  • Clone Claude Home Base at a verified commit.
  • Inspect the repository files that define its architecture.
  • Identify defaults that could allow whole-machine access.
Clone the verified snapshot

A branch such as main can receive new commits after you inspect it. A detached checkout keeps your local files fixed at one known commit.

  • Create the pinned checkout from your home directory by running these commands:
cd ~
git clone --no-checkout https://github.com/nityeshaga/claude-home-base ClaudeHomeBaseWorkspace
cd ClaudeHomeBaseWorkspace
git checkout --detach c7eff8630fdb3feb40e9681dfc20976953aa7dd1

What do these commands do?

  • The first command returns Terminal to your home folder.
  • The clone command creates ClaudeHomeBaseWorkspace without checking out the repository's current branch tip.
  • The checkout command detaches HEAD at the verified commit. This makes the snapshot independent of future branch updates.
  • Wait for Terminal to return to the shell prompt inside ClaudeHomeBaseWorkspace.
  • Confirm the checkout output reports that Git switched to the requested commit.

Did the clone or checkout fail?

Check that your internet connection can reach GitHub. Remove any partial ClaudeHomeBaseWorkspace folder before retrying the clone.

Use this if Terminal reports another problem: Help me diagnose why the pinned Claude Home Base clone or checkout failed.

Verify what is on disk

A commit hash identifies the exact repository snapshot on disk. Verifying it gives you a reproducible starting point for every later change.

  • Predict the commit hash that Terminal will print before you run the check.
  • Verify the checked-out commit by running this command:
git rev-parse HEAD

What does this command prove?

The command resolves HEAD to the full commit stored in your checkout. An exact match proves that you are inspecting the verified snapshot.

Terminal prints c7eff8630fdb3feb40e9681dfc20976953aa7dd1. Your checkout is pinned.

  • Open the repository overview plus both configuration templates by running this command:
open README.md .env.example CLAUDE.md.example

What should open?

macOS opens README.md, .env.example, and CLAUDE.md.example with their default app. These files describe the architecture plus its environment and project-instruction templates.

  • Use README.md to identify the bot.
  • Use .env.example to identify the environment template.
  • Use CLAUDE.md.example to identify the project-instruction template.
  • Confirm the checkout also includes identity files.
  • Confirm the checkout includes plugins.

Did the files fail to open?

Confirm that your Terminal prompt is inside ClaudeHomeBaseWorkspace. A path error usually means the command ran from another folder.

Use this if one of the files is missing: Help me verify the files in my pinned Claude Home Base checkout.

Experience the designed obstacle

The repository's example configuration reveals the trust model its deployment expects. Inspecting that model before adopting it keeps broad permissions away from your local foundation.

  • Predict whether the documented defaults keep access inside the checkout before you inspect them.
  • Switch to the opened .env.example file.
  • Find the documented PROJECT_DIR default.
  • Read the nearby comments describing its access scope.
  • Switch to the opened README.md file.
  • Identify the deployment guidance for filesystem access or bypassed permissions.

The unrestricted default is the obstacle

The example points PROJECT_DIR at a broad location. Its guidance can combine that scope with elevated or bypassed permissions.

That posture could expose files beyond this checkout. You have found the exact risk this local-foundation project is designed to contain.

  • Leave .env.example unchanged.
  • Leave .env uncreated.
  • Leave the Python dependencies uninstalled.
  • Keep Slack secrets off this Mac mini foundation.
  • Keep Full Disk Access disabled for this project.
  • Keep passwordless administrator access disabled.
  • Keep remote integrations disabled.

You now have the verified commit at ~/ClaudeHomeBaseWorkspace. You have also seen why its deployment defaults need a tighter local boundary.

Your snapshot is pinned and inspected. Next, you will give Claude Home Base a checkout-scoped identity with explicit safety instructions.

Add a Restricted Home Base Identity

Your pinned Claude Home Base checkout exposed defaults that could grant broad access to the Mac. This step gives the project a restricted identity before you activate any integrations.

A project-level CLAUDE.md gives Claude Code persistent context. The checkout remains the default workspace boundary.

In this step, get ready to:
  • Create the Home Base identity instructions.
  • Review the checkout-only safety boundary.
  • Prove that Claude loads the project context.
Define the local identity

Project instructions establish the identity that Claude uses inside this checkout. They also record the approvals that Claude must request before expanding its access.

  • In the editor from earlier, use its file-creation control to create CLAUDE.md inside ~/ClaudeHomeBaseWorkspace.

A blank CLAUDE.md file now appears inside the pinned checkout.

  • Paste this exact content into CLAUDE.md:
# Mac Mini Home Base

## Identity

- Name: Mac Mini Home Base
- Purpose: Prepare and verify a secure local foundation for Claude Home Base.

## Allowed workspace

- Work only inside the current Claude Home Base checkout.
- Treat files outside this checkout as unavailable for this foundation project.
- Do not add other directories without explicit user approval.

## Safety boundary

- Do not request or use administrator privileges.
- Do not enable bypassed permissions.
- Do not read, create, or modify secrets, API keys, Slack tokens, or personal files.
- Do not install background services or expose network endpoints.
- Ask for explicit approval before adding credentials, remote integrations, or persistent services.

## Current milestone

- Inspect the repository.
- Explain its architecture and risks.
- Prepare for a later Slack and Cloudflare deployment without activating either integration.

What do these instructions do?

  • The identity section gives Claude a name plus a focused local-foundation purpose.
  • The allowed workspace section keeps work inside the current checkout.
  • The safety boundary requires approval before Claude gains new access or capabilities.
  • The current milestone limits the work to repository inspection plus future deployment preparation.
  • Save CLAUDE.md.
  • Confirm the editor sidebar shows CLAUDE.md inside ClaudeHomeBaseWorkspace.

Can't find the instruction file?

  • Check that the filename is exactly CLAUDE.md.
  • Confirm the file sits directly inside ~/ClaudeHomeBaseWorkspace.
  • Save the file if the editor still shows it as unsaved.

Help me check why Claude cannot find my project-level instruction file.

✔️ Awesome, I've got everything!

Great. Keep CLAUDE.md saved inside the pinned checkout.

ⓧ I'd like to double check the full code

# Mac Mini Home Base

## Identity

- Name: Mac Mini Home Base
- Purpose: Prepare and verify a secure local foundation for Claude Home Base.

## Allowed workspace

- Work only inside the current Claude Home Base checkout.
- Treat files outside this checkout as unavailable for this foundation project.
- Do not add other directories without explicit user approval.

## Safety boundary

- Do not request or use administrator privileges.
- Do not enable bypassed permissions.
- Do not read, create, or modify secrets, API keys, Slack tokens, or personal files.
- Do not install background services or expose network endpoints.
- Ask for explicit approval before adding credentials, remote integrations, or persistent services.

## Current milestone

- Inspect the repository.
- Explain its architecture and risks.
- Prepare for a later Slack and Cloudflare deployment without activating either integration.

What should match?

Compare every heading plus bullet with your saved file. The identity, allowed workspace, safety boundary, plus current milestone must appear in this order.

Review the checkout boundary

These instructions apply least privilege by defining the smallest workspace needed for this milestone. The file provides behavioral context within Claude Code.

What does this boundary protect?

The checkout boundary keeps unrelated files outside the foundation project. Approval gates also stop the project from quietly gaining credentials or persistent access.

The instruction file guides Claude's behavior. Hard enforcement would require separate permissions or hooks.

  • Review the Allowed workspace section to confirm that work stays inside the current checkout.
  • Review the Safety boundary section to confirm that administrator privileges plus bypassed permissions are forbidden.
  • Review the Current milestone section to confirm that Slack plus Cloudflare remain inactive.
Prove the project context loaded

Claude Code reads project instructions when a session starts from the checkout. A contextual reply now proves that the new identity is available to the command.

  • Switch back to Terminal inside ~/ClaudeHomeBaseWorkspace.
  • Predict the identity plus workspace boundary that Claude will report before you run the command:
  • Test the project identity by running this command:
claude -p "State your name, purpose, and allowed workspace in one sentence."

What does this command prove?

  • Print mode sends one request to Claude before returning control to the shell.
  • The prompt asks for details that exist in the local project instructions.
  • A checkout-specific reply shows that CLAUDE.md influenced the response.

The response names Mac Mini Home Base. It describes the secure local-foundation purpose plus the current checkout as the allowed workspace.

Seeing a generic response?

  • Confirm Terminal is currently inside ~/ClaudeHomeBaseWorkspace.
  • Confirm CLAUDE.md is saved directly inside the checkout.
  • Compare the identity plus workspace sections with the full file above.

Help me diagnose why Claude is not using my Home Base identity.

Secret mission

Run a Read-Only Repository Briefing

Put your local safety boundary to a practical test. Ask Claude to inspect the repository in Plan mode while preserving the working tree.

Clean Up Your Resources

Clean Up Your Resources

Decide whether to keep your resources running, pause them to come back later, or delete them entirely. This project created no paid cloud resources, but your existing Claude plan may continue at its normal subscription price.

Resources you used:

  • The pinned ~/ClaudeHomeBaseWorkspace checkout, including CLAUDE.md.
  • The always-on Energy settings changed for the Mac mini.

Keep everything running

No action needed. Choose this if you are still actively building on your local Claude Home Base foundation.

  • Keep the pinned ~/ClaudeHomeBaseWorkspace checkout for future work.
  • Keep Prevent automatic sleeping when the display is off enabled if the Mac mini should remain available.
  • Leave Claude Code and Git installed for later projects.

What stays on the Mac?

The checkout remains pinned to commit c7eff8630fdb3feb40e9681dfc20976953aa7dd1. Your local safety boundary remains available in CLAUDE.md.

Pause - I'll come back to this later

Shut down active tools to free up memory while keeping your files. The print-mode Claude Code command has already returned to the shell prompt.

  • Close the Terminal window.
  • Return to Energy in System Settings.
  • Turn off Prevent automatic sleeping when the display is off if the Mac mini can sleep while paused.
  • Keep the ~/ClaudeHomeBaseWorkspace checkout for your return.

Your Work Remains Available

Pausing leaves the pinned repository intact. You can return to the checkout when you are ready to continue.

Delete - I don't want to use this again

Remove the local project resources if you want to start fresh. This deletes the checkout and restores normal power behavior.

Before You Delete

Deleting the checkout also removes your local CLAUDE.md safety instructions. Copy any notes you want to keep before continuing.

  • Return to Energy in System Settings.
  • Turn off Prevent automatic sleeping when the display is off.
  • Choose Never for Start up when power is connected if that option appears.
  • Turn off Start up automatically after a power failure if that option appears.
  • Delete the ~/ClaudeHomeBaseWorkspace checkout by running this command:
rm -rf ~/ClaudeHomeBaseWorkspace

What Does This Command Do?

This permanently removes the pinned checkout and every file inside it. Your Claude Code installation remains available.

  • Check your home folder in Finder.
  • Confirm ClaudeHomeBaseWorkspace is absent.

Does the Folder Remain?

Confirm the command uses the exact ~/ClaudeHomeBaseWorkspace path from this project. Check that no application is holding a file from the checkout open.

Help me remove the local checkout safely.

Nice Work!

Nice Work!

Nice work! You prepared a secure local foundation for Claude Home Base on your Mac mini.

You learned how to:

  • Verify your Mac mini meets the operating system and hardware requirements for Claude Code.
  • Authenticate Claude Code and prove non-interactive execution with a visible Terminal response.
  • Pin Claude Home Base to an immutable Git commit and apply a checkout-scoped safety boundary through CLAUDE.md.
  • Complete the Secret Mission by producing a read-only architecture and risk briefing in Plan mode.

Ready to quiz yourself?