# claude-code sandboxing deps.
    pkgs.socat
    pkgs.bubblewrap

      	sandbox = {
      	  enabled                   = true;
      	  autoAllowBashIfSandboxed  = true;
      	  excludedCommands          = [ "git" "jj" "docker" "just" ];
      	  allowUnsandboxedCommands  = true;
      	  network.allowUnixSockets  = [ "/run/user/1000/docker.sock" ];
      	  network.allowLocalBinding = true;
      	};

          zread = {
            type    = "remote";
            url     = "https://api.z.ai/api/mcp/zread/mcp";
            headers = {
              Authorization = "Bearer {file:${config.age.secrets.z-ai-key.path}}";
            };
          };

        claude mcp add -s user -t http zread https://api.z.ai/api/mcp/zread/mcp --header "Authorization: Bearer your_api_key"