Windows-MCP

Least-privilege permissions

• Run Claude Desktop with a limited user account — Create a separate Windows user account with minimal permissions for running the AI agent, rather than using an admin account. This limits damage if the agent is compromised.
• Remove access to sensitive folders — Delete or restrict the agent's access to folders containing passwords, financial data, or confidential files using Windows file permissions.
• Disable credential storage — Clear saved passwords and API keys from the user account before running the agent; store secrets in a separate secure location the agent cannot reach.
• Use app-specific tokens instead of passwords — When the agent needs to access services (email, cloud storage), provide temporary or limited-scope access tokens rather than full account passwords.

Network isolation

• Run on an isolated network segment — If possible, run Claude Desktop on a computer or virtual machine that has limited network access, preventing stolen data from reaching the internet easily.
• Use a firewall or proxy — Monitor and restrict outbound connections from Claude Desktop to only necessary services (Claude's API endpoint); block other destinations.
• Disable direct internet access for sensitive work — For handling confidential documents, run the agent on a machine with no internet connection, then manually transfer results to a connected device.
• Log all outbound traffic — Enable firewall logging to see what data the agent sends externally; review logs regularly for suspicious activity.

Monitoring

• Enable Windows audit logging — Turn on detailed audit logs to record which files the agent accessed, what registry changes it made, and which programs it ran.
• Review file and folder access logs — Check Windows Event Viewer weekly for unexpected file operations, especially deletions or bulk copying of files.
• Monitor Claude Desktop network traffic — Use network monitoring tools to see what data is being sent to external services; flag large data transfers.
• Keep an activity log of agent instructions — Document what tasks you ask the agent to perform and when, so you can compare against actual actions taken and spot discrepancies.

Red flags to watch for

• Unexpected file deletions or modifications — If files disappear or change without your instruction, immediately stop the agent and investigate.
• Large data transfers to unknown locations — Watch for sudden uploads of files to external websites or cloud services you didn't authorize.
• System settings changes — If firewall rules, network settings, or user permissions change unexpectedly, the agent may have been compromised.
• Requests to bypass security controls — If Claude asks you to disable antivirus, remove file protections, or provide admin passwords, refuse and report it as a potential compromise.