Kobel vs Claude Desktop

Claude is the assistant. Kobel is the permission layer. Here is exactly what each one controls, where Claude's own settings are already enough, and where they stop.

Last reviewed: 2026-08-19

At a glance

What Claude Desktop already does well

It would be dishonest to pretend Claude has no permission model. It has a good one, and it has improved sharply through 2026:

• Workspace folders. You attach specific folders rather than exposing the whole disk. In managed deployments an administrator can pin an allowlist of folders and mark each one rw or ro, enforced against the resolved path so symlinks and .. cannot escape.
• Approval modes. Manual approval prompts before writes and commands; automatic approval hands that judgement to a classifier model instead.
• Deletion consent. Cowork always requires explicit permission before a file is permanently deleted.
• Reviewed connectors and OS-encrypted secrets. Connectors in Anthropic's directory are reviewed against listing criteria, and their secrets are encrypted with the operating system's secure storage — Keychain on macOS, Credential Manager on Windows.
• Injection screening. Untrusted content is screened before it reaches the model.

If you use only Claude, only for a well-defined project folder, that may be enough. Say so out loud before you buy anything.

Where the gaps are

1. Two settings are not a permission model

Read-only or read-write is a binary. Real work is not. The setting most freelancers and agencies actually want is "the AI may read my client's contract but must never modify the original" — read the source, write the output somewhere else. Claude does not express that. Kobel's orange level is exactly that rule, and its teal level covers the other half: allow the write, but snapshot the file first.

2. It governs Claude, and only Claude

Almost nobody uses one AI tool anymore. The moment you add a second assistant, a coding agent or a local model runner, Claude's careful settings say nothing about it. A permission layer that lives on the machine rather than inside one vendor's app is the only way to get one consistent answer to "what may AI touch here?"

3. Local setup is still a developer path

Anthropic's one-click desktop extensions have removed most of this friction for packaged connectors. But connecting an arbitrary local MCP server still means editing claude_desktop_config.json in ~/Library/Application Support/Claude/ or %APPDATA%\Claude\ and passing allowed directories as command-line arguments — and even with an extension, the allowed-directory decision lives inside that server's own configuration rather than in one place you control. That is a fine experience for engineers and an awkward one for a tax adviser.

4. Enforcement has known sharp edges

Using them together

The intended setup is not either/or:

1. Kobel detects the AI clients installed on your machine and connects to them over MCP.
2. You drag in the folders, apps and accounts you want available, and assign each a colour.
3. Claude — and any other MCP-capable assistant — sees only what Kobel exposes, at the level Kobel allows.
4. Every access is written to the local activity log, whichever assistant made it.

Claude's own approval prompts still apply on top. Two independent checks are better than one, and they fail in different ways — which is the whole argument for running both rather than picking one.

Verdict

Kobel's five permission levels

Every folder, app and account gets exactly one of these five levels. You set it by dragging a folder in and picking a colour — there is no configuration file.

• GreenRead and write. The AI may open files and save changes in place.
• TealWrite with automatic backup. Every change is preceded by a backup copy, so a bad edit is always reversible.
• OrangeRead the original, write only to copies. The AI can work with your data but cannot alter the source file.
• YellowRead only. Look, don't touch.
• RedBlocked. The resource is invisible to the AI.

Keep reading

Sources