Your chief of staff has a shell: rules for MARVIN's API calls

MARVIN is an AI chief of staff built on Claude Code. Type /start and you get a briefing: priorities, deadlines, progress on your goals. It remembers last week's conversation, writes your weekly report, and pushes back when an idea is weak.

Because it's Claude Code underneath, it can also run commands, edit files and call APIs. Connect it to Stripe through Swytchcode, and it can look up invoices and issue refunds, with each refund waiting for your approval.

We set that up and tested it in two states: MARVIN as it ships, and MARVIN after one very ordinary click.

Before: MARVIN as it ships

Out of the box, Claude Code asks before almost everything. Every command, every file edit, and every MCP tool, even a harmless lookup.

That's safe. We ran MARVIN 1.1.0 on Claude Code 2.1.306 against a mocked Stripe, and with these defaults, nothing touched Swytchcode's files:

• Claude Code found all 11 Swytchcode tools, and the skill loaded from the workspace.
• The balance lookup ran. The refund stopped before reaching Stripe, held for approval.
• Asked to add an "allow" rule, or to replace the approval rule, MARVIN was refused by Swytchcode and handed the command for a person to run.

It's also noisy. By the third prompt to approve a search, you start looking for the "don't ask again" option.

One thing that doesn't work by default, or at all: MARVIN's Telegram bot. It's a separate program with its own fixed file tools and no MCP, so it can't reach Swytchcode. Talk to MARVIN in Claude Code.

The click

Then we allowed Bash, the way a busy person would on a Monday morning.

One sed command later, the approval rule had a new name. We picked a harmless edit on purpose. The same command could just as easily have deleted the rule, or loosened it.

No trick was involved. Swytchcode's tools can't remove a rule, and they didn't. But the rules live in a file on your machine, and Bash can edit files. Allowing Bash means allowing everything a shell can do, including editing the guardrails.

That's not a MARVIN bug or a Claude Code bug. It applies to any agent with a shell. Claude Code just happens to ship the tools to fix it.

After: four deny rules and a sandbox

The fix lives in ~/marvin/.claude/settings.json:

{
  "permissions": {
    "allow": ["mcp__swytchcode"],
    "deny": [
      "Read(~/agent-swy/.swytchcode/**)",
      "Edit(~/agent-swy/**)",
      "Read(~/.swytchcode/**)",
      "Edit(~/.swytchcode/**)"
    ]
  },
  "sandbox": {
    "enabled": true,
    "autoAllowBashIfSandboxed": true,
    "allowUnsandboxedCommands": false
  }
}

Each part does one job:

Swytchcode itself isn't sandboxed, so its tools keep working. We reran all seven checks with this in place, with Bash allowed, and they all passed. The folders simply weren't there for Bash.

Two details. The settings take effect only once you trust the workspace, which Claude Code asks the first time you open it. And on Linux, the sandbox needs bubblewrap and socat installed. We haven't tested the macOS sandbox yet.

Connecting Swytchcode

With a Swytchcode account (approvals need the Business or Enterprise plan), and ~/marvin as your MARVIN workspace:

npm install -g swytchcode
swy init --operator --editor=none --project ~/agent-swy
swy login

cd ~/marvin
claude mcp add swytchcode -- swytchcode mcp serve --profile operator --project ~/agent-swy
mkdir -p .claude/skills
cp -R ~/agent-swy/agent-skill/swytchcode-operator .claude/skills/

Keep the Swytchcode project outside the MARVIN workspace. Then add the settings above before you connect a real account. The MARVIN setup guide covers connecting your first app.

A chief of staff with a budget

A good chief of staff gets a lot of freedom and a spending limit. You don't write the limit on a sticky note and hope they read it. It's set by finance, and they can't change it.

MARVIN's profile is the sticky note: it shapes how MARVIN behaves, but it can't stop anything. Swytchcode is the finance team. And the four deny rules make sure your chief of staff can't walk into finance and edit the limit.

Allow Bash if you want to. Just add the sandbox first.