If you have a file in your repository that is not safe to run you have bigger problems than your development system getting compromised.

What I mean by this is that if you restrict python execution to the entry point of your software and then Claude wants to run a command anyway so it threads it through the main.py script, you are no longer running something that is contained to your local development environment.

But when you think about it, what exactly prevents Claude from doing that anyway?

Claude could add malware into your project directly.

So the case where you say it doesn't matter which python script it can execute, actually does matter. Restricting python execution to a subset of all files buys you security.

The next step would be to get Claude to stop adding malware to your software, which it hopefully already does not do.