claude-docs-20260910T180939Z / documentation capture

What this read moved

1–15 of 15

claude-science/changelog Changed · +5 / -0 lines

from line 2

33> Release notes for Claude Science, including new features, improvements, and bug fixes by version.

5<Update label="0.1.47" description="September 10, 2026">

6 * Claude Science is now available for Windows: download it from [claude.com/product/claude-science](https://claude.com/product/claude-science), and see [Run on Windows](/docs/claude-science/run-on-windows) for requirements and setup

7 * Various bug fixes and improvements

8</Update>

510<Update label="0.1.43" description="August 31, 2026">

611 * On Linux, commands, notebook cells, and local connectors work again on systems with bubblewrap's recent security update

712 * Cloud storage in Settings (Amazon S3, S3-compatible services, and Google Cloud Storage with HMAC keys) now works behind a TLS-inspecting proxy such as Zscaler or Netskope, trusting the same corporate root certificate as sign-in and the Claude API

claude-science/command-line-settings Changed · +3 / -2 lines

from line 3

33> Reference for the claude-science command: every subcommand, the serve flags, the single-use login link, and the environment variables Claude Science reads.

55Reference for the claude-science command: every subcommand, the serve flags, the single-use login link, and the environment variables Claude Science reads.\

6claude-science serve starts Claude Science and opens the web app in your browser at a single-use login link. Everyday use is that one command. The others manage the running program: they mint login links, report status, follow logs, install updates, and merge data directories. On Windows, the installer adds the command to your PATH for new terminals. There the app window you open from the Start menu is the everyday way in, and the commands below manage the same running program.

88## Commands

from line 17

1717| `claude-science stop` | Stop the program cleanly. |

1818| `claude-science update` | Check for and install an update. `--check` only reports; --to `<version>` installs a specific version, which is also how you roll back. Updates are signature-verified and replace the binary atomically. |

1919| `claude-science import` `<path>` | Merge another data directory, or its database file, into this one. |

20| `claude-science uninstall` | Windows only. Remove the app, its shortcuts, and its PATH entry while keeping your data; `--purge` also deletes the data directory. Quit Claude Science first. |

2021| `claude-science --version` | Print the version. |

2122| `claude-science` `<command>` --help | Print help for any command. |

2223

from line 27

2627

2728## Global flags

2829

29These two work on every command.

30These two work on every command. On Windows, `~` in the defaults below is your user profile folder, `%USERPROFILE%`.

3031

3132| Flag | Default | What it does |

3233| -------------------- | ------------------------------- | ------------------------------- |

claude-science/configuration-file-reference Changed · +16 / -13 lines

from line 2

33> Claude Science's config.toml file: where it lives, how its values interact with the Settings page, and the network-related keys for the outbound proxy, certificate bundles, package mirror, and sandbox network allowlist.

5Claude Science reads optional settings from a TOML file at `~/.claude-science/config.toml` on macOS and Linux. Every key has a default, so the app starts with no file present; administrators deploy the file with device management to set fleet policy. The file is read once at startup, so changes take effect after a restart. The `claude-science` command accepts `--config <file>` to read a different file for one run.

5Claude Science reads optional settings from a TOML file named `config.toml` in its default data folder, which is `~/.claude-science/config.toml` on macOS and Linux and `%USERPROFILE%\.claude-science\config.toml` on Windows. Every key has a default, so the app starts with no file present; administrators deploy the file with device management to set fleet policy. The file is read once at startup, so changes take effect after a restart. The `claude-science` command accepts `--config <file>` to read a different file for one run.

7On Windows, save the file as UTF-8 and write Windows paths inside it in single quotes (for example `'C:\ProgramData\corp\corporate-ca.pem'`) or with forward slashes, because a backslash inside a double-quoted TOML string is an escape sequence and a file that fails to parse prevents Claude Science from starting.

79## Network configuration

810

911The network-related keys, grouped by the TOML table each belongs to. For the package-mirror keys (`[conda] channel_mirror`, `pip_index_url`, and `ca_bundle`) and the proxy key (`[network] proxy`), a value set in the file takes precedence over the matching Settings control, which then shows as managed by your organization so a member cannot override it. The `[sandbox.network]` lists are additive instead: they add to the member-managed lists under **Settings** > **Network** and lock nothing. On Team and Enterprise plans, two settings made for the whole organization under **Organization settings** > **Claude Science** sit above both the file and the Settings page. An [organization package mirror](/docs/claude-science/admin-controls#organization-package-mirror) takes precedence over the mirror keys, and while the organization manages the [network allowlist](/docs/claude-science/admin-controls#network-allowlist), the file's `allowed_domains` are set aside and its `denied_domains` still apply. The `[network] ca_bundle`, `no_proxy`, and `mcp_x509_strict` keys and `[conda] allow_insecure_mirror` have no in-app control.

from line 14

1214

1315The `[network]` table configures the app's own connections.

1416

16| ----------------- | ------------------------------------ | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

17| `proxy` | string (URL) | unset | The outbound proxy for the app's HTTP and HTTPS connections, for example `http://proxy.example.corp:8080`. Supply Basic-authentication credentials in the address. An `https://` (TLS-to-proxy) address applies to the app's own connections only; sandboxed package downloads connect directly when the proxy is `https://`, so prefer `http://`. A proxy variable in the app's environment (including `ALL_PROXY`) takes precedence over this key, which takes precedence over the Settings proxy field and the macOS system proxy settings. |

18| `no_proxy` | string (comma-separated) | unset | Hosts that bypass the proxy, as exact hostnames or domain suffixes in one comma-separated string, for example `".example.corp,registry.example.corp"`. Combined with the `NO_PROXY` environment variable and, when the macOS system settings supply the proxy address, the system's bypass list. Loopback addresses always bypass the proxy. |

19| `ca_bundle` | string (absolute path) | unset | PEM file added to the app's default TLS trust for sign-in, the Claude API, Anthropic-hosted connectors, update checks, and [cloud storage](/docs/claude-science/cloud-storage) access from Settings (Amazon S3, S3-compatible stores, and Google Cloud Storage with an HMAC key); use it for a corporate root behind TLS inspection. It covers the app's own connections only, while package downloads use `[conda] ca_bundle`. The value must be an absolute path outside the app's data directory (`~/.claude-science`), temporary directories, and any directory you have granted Claude write access to; a system location such as `/etc/claude-science/corporate-ca.pem` is recommended. The file must exist, parse as a PEM bundle, and contain no private key; a failing value is ignored with a warning. |

20| `mcp_x509_strict` | `"auto"`, `"relaxed"`, or `"strict"` | `"auto"` | How strictly local connectors check a corporate certificate's profile. With `"auto"`, Claude Science relaxes the strict check when it detects TLS inspection from a configured `[network] ca_bundle`. Connectors pick up a change at their next relaunch. |

18| ----------------- | ------------------------------------ | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

19| `proxy` | string (URL) | unset | The outbound proxy for the app's HTTP and HTTPS connections, for example `http://proxy.example.corp:8080`. Supply Basic-authentication credentials in the address. An `https://` (TLS-to-proxy) address applies to the app's own connections only; sandboxed package downloads connect directly when the proxy is `https://`, so prefer `http://`. A proxy variable in the app's environment (including `ALL_PROXY`) takes precedence over this key, which takes precedence over the Settings proxy field and the proxy detected from macOS or Windows system settings. |

20| `no_proxy` | string (comma-separated) | unset | Hosts that bypass the proxy, as exact hostnames or domain suffixes in one comma-separated string, for example `".example.corp,registry.example.corp"`. Combined with the `NO_PROXY` environment variable and, when the macOS or Windows system settings supply the proxy address, the system's bypass list. Loopback addresses always bypass the proxy. |

21| `ca_bundle` | string (absolute path) | unset | PEM file added to the app's default TLS trust for sign-in, the Claude API, Anthropic-hosted connectors, update checks, and [cloud storage](/docs/claude-science/cloud-storage) access from Settings (Amazon S3, S3-compatible stores, and Google Cloud Storage with an HMAC key); use it for a corporate root behind TLS inspection. It covers the app's own connections only, while package downloads use `[conda] ca_bundle`. The value must be an absolute path outside the app's data directory (`~/.claude-science`), temporary directories, and any directory you have granted Claude write access to; a system location such as `/etc/claude-science/corporate-ca.pem`, or a folder under `C:\ProgramData` on Windows, is recommended. The file must exist, parse as a PEM bundle, and contain no private key; a failing value is ignored with a warning. On Windows, when this key and `[conda] ca_bundle` are both unset, the roots in the computer's Trusted Root Certification Authorities store are trusted automatically instead. |

22| `mcp_x509_strict` | `"auto"`, `"relaxed"`, or `"strict"` | `"auto"` | How strictly local connectors check a corporate certificate's profile. With `"auto"`, Claude Science relaxes the strict check when it detects TLS inspection from a configured `[network] ca_bundle`. Connectors pick up a change at their next relaunch. |

2123

2224### Package download keys

2325

2426The `[conda]` table configures where analysis environments fetch packages from and how those downloads verify certificates.

2527

27| ----------------------- | ---------------------- | ------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

28| `channel_mirror` | string (URL) | unset | Base URL of an internal conda mirror. Channel names resolve beneath it, so `<channel_mirror>/conda-forge/noarch/repodata.json` must return the conda-forge index. Setting it removes the public conda hosts from the sandbox allowlist and admits the mirror host, which environment builds contact directly from the workstation, not through an outbound proxy. Must be `https://` on port 443 or 8443 (an `http://` URL is accepted only when `allow_insecure_mirror` is set), by DNS name, with no embedded credentials. A deployed value these rules reject prevents the app from starting. An [organization package mirror](/docs/claude-science/admin-controls#organization-package-mirror) set under **Organization settings** > **Claude Science** takes precedence over this key. |

29| `pip_index_url` | string (URL) | unset | A PEP 503 simple index for Python packages, for example an Artifactory or Nexus PyPI remote ending in `/simple`. Setting it removes the public Python hosts from the sandbox allowlist. Same URL rules as `channel_mirror`, including the startup failure on an invalid value, and the same precedence of an organization package mirror. |

30| `ca_bundle` | string (absolute path) | unset | A complete PEM bundle (public roots plus your corporate roots) that package downloads verify against, replacing the default trust list; in this release the bundle alone may not be sufficient for pip, which verifies against the operating system's trust store. This key affects package downloads only and never fixes sign-in; behind TLS inspection, set `[network] ca_bundle` as well. When unset, Linux uses your distribution's system certificate bundle. Same path rules as `[network] ca_bundle`. |

31| `allow_insecure_mirror` | boolean | `false` | Allows `http://` mirror URLs in this file (the Settings page accepts `https://` only). Off by default because a plaintext mirror lets an on-path attacker substitute packages. |

29| ----------------------- | ---------------------- | ------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

30| `channel_mirror` | string (URL) | unset | Base URL of an internal conda mirror. Channel names resolve beneath it, so `<channel_mirror>/conda-forge/noarch/repodata.json` must return the conda-forge index. Setting it removes the public conda hosts from the sandbox allowlist and admits the mirror host, which environment builds contact directly from the workstation, not through an outbound proxy. Must be `https://` on port 443 or 8443 (an `http://` URL is accepted only when `allow_insecure_mirror` is set), by DNS name, with no embedded credentials. A deployed value these rules reject prevents the app from starting. An [organization package mirror](/docs/claude-science/admin-controls#organization-package-mirror) set under **Organization settings** > **Claude Science** takes precedence over this key. |

31| `pip_index_url` | string (URL) | unset | A PEP 503 simple index for Python packages, for example an Artifactory or Nexus PyPI remote ending in `/simple`. Setting it removes the public Python hosts from the sandbox allowlist. Same URL rules as `channel_mirror`, including the startup failure on an invalid value, and the same precedence of an organization package mirror. |

32| `ca_bundle` | string (absolute path) | unset | A complete PEM bundle (public roots plus your corporate roots) that package downloads verify against, replacing the default trust list; in this release the bundle alone may not be sufficient for pip, which verifies against the operating system's trust store. On macOS and Linux this key affects package downloads only, and it never fixes sign-in; behind TLS inspection, set `[network] ca_bundle` as well. When unset, Linux uses your distribution's system certificate bundle. On Windows, package downloads verify against the Windows certificate store and do not read this key; leave it unset there unless you need a custom bundle, because a file set on Windows becomes the complete certificate list that code inside sessions trusts and turns off the app's automatic use of the Windows certificate store. Same path rules as `[network] ca_bundle`. |

33| `allow_insecure_mirror` | boolean | `false` | Allows `http://` mirror URLs in this file (the Settings page accepts `https://` only). Off by default because a plaintext mirror lets an on-path attacker substitute packages. |

34| `ssl_no_revoke` | boolean | `true` | Windows only. When `true`, conda package downloads skip the certificate-revocation check, which networks that inspect TLS usually cannot answer. Set it to `false` to require the check, so that a revoked or uncheckable certificate is rejected. pip downloads and the app's own connections are unaffected. |

3235

3336### Sandbox network keys

3437

claude-science/corporate-networks Changed · +38 / -30 lines

### System proxy settings on macOS and Windows ### macOS system proxy settings

from line 22

2222

2323## What works on a corporate network

2424

25| Network shape | macOS | Linux |

26| ---------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

27| Explicit outbound HTTP proxy (HTTP CONNECT) | Supported; detected automatically from the system settings | Supported |

28| Proxy that requires Basic authentication | Supported, with credentials in the proxy address | Supported, with credentials in the proxy address |

29| Proxy that requires NTLM, Negotiate, or Kerberos authentication | Not supported | Not supported |

30| Network that only publishes a PAC or WPAD file | Not supported | Not supported |

31| SOCKS proxy | Not supported | Not supported |

32| TLS inspection on the app's own connections (Zscaler, Netskope, and similar) | Supported with a CA bundle setting | Supported with a CA bundle setting |

33| TLS inspection on conda package downloads | Supported with a CA bundle setting | Supported with a CA bundle setting |

34| TLS inspection on pip package downloads | Supported, with the corporate root also installed in the operating system's trust store (see [Corporate root for package downloads](#corporate-root-for-package-downloads)) | Supported, with the corporate root also installed in the operating system's trust store (see [Corporate root for package downloads](#corporate-root-for-package-downloads)) |

35| Internal package mirror (Artifactory, Nexus) | Supported | Supported |

36| Internal package mirror reached only through the corporate proxy | Not supported | Not supported |

37| Authenticated package mirror | Supported, with the credential saved in Settings | Supported, with the credential saved in Settings |

38| Local connectors (the bundled research tools) behind TLS inspection | Not supported | Not supported |

30| Network that only publishes a PAC or WPAD file | Not supported | Supported in the app window, which follows the proxy the script resolves (see [System proxy settings on macOS and Windows](#system-proxy-settings-on-macos-and-windows)) | Not supported |

32| TLS inspection on the app's own connections (Zscaler, Netskope, and similar) | Supported with a CA bundle setting | Supported; a corporate root in the computer's certificate store is trusted automatically | Supported with a CA bundle setting |

34| TLS inspection on pip package downloads | Supported, with the corporate root also installed in the operating system's trust store (see [Corporate root for package downloads](#corporate-root-for-package-downloads)) | Supported automatically through the Windows certificate store | Supported, with the corporate root also installed in the operating system's trust store (see [Corporate root for package downloads](#corporate-root-for-package-downloads)) |

3939

4040## Point package installs at an internal mirror

4141

from line 68

6868 noarch/<package>.conda

6969 linux-64/repodata.json

7070 osx-arm64/...

71 win-64/...

7172 bioconda/

7273 noarch/...

7374```

from line 85

8485

8586For a mirror that requires authentication, enter one username and access token under **Settings** > **Network** > **Package mirror** > **Mirror credentials**, using an account scoped to reading the mirror, then run the check so it signs in with the credential. The one credential is presented to both the conda-mirror host and the pip-index host, so if those need different accounts, keep one of them anonymous; the credential is sent only to `https://` mirror hosts.

8687

87Claude Science stores the credential encrypted in its local database, using a key kept in a file only the member's account can read (on macOS, a copy of that key is in the keychain for recovery), and also writes the credential, automatically, to a plaintext `.netrc` at `~/.claude-science/conda/.netrc` that the conda and pip download tools read during environment builds. Code that runs while an environment builds (a package's `setup.py`, for example) can read that file, Claude's analysis code cannot read either location, and a `.netrc` in the member's home directory is not used for these downloads. For a fleet that manages credentials centrally, deploy that `.netrc` file yourself instead, one `machine <mirror hostname>` block per mirror host with `login` and `password` lines and no comments, and use either the file or Settings, not both: a credential saved in Settings rewrites the file from the saved value at the save and at every restart and environment build, while a file deployed with no credential saved in Settings is left alone.

88Claude Science stores the credential encrypted in its local database, using a key kept in a file only the member's account can read (on macOS, a copy of that key is in the keychain for recovery), and also writes the credential, automatically, to a plaintext `.netrc` at `~/.claude-science/conda/.netrc` that the conda and pip download tools read during environment builds. Code that runs while an environment builds (a package's `setup.py`, for example) can read that file, Claude's analysis code cannot read either location, and a `.netrc` in the member's home directory is not used for these downloads. For a macOS or Linux fleet that manages credentials centrally, deploy that `.netrc` file yourself instead (on Windows, save the credential in Settings), one `machine <mirror hostname>` block per mirror host with `login` and `password` lines and no comments, and use either the file or Settings, not both: a credential saved in Settings rewrites the file from the saved value at the save and at every restart and environment build, while a file deployed with no credential saved in Settings is left alone.

8889

8990Environments a member registers from an existing project folder install their packages inside the analysis sandbox during a session, where the credential is hidden by design, so those environments need a mirror that allows anonymous reads.

9091

from line 104

1031041. The standard proxy variables in its own process environment: `HTTPS_PROXY`, `HTTP_PROXY`, and `NO_PROXY` (lowercase spellings also work). `ALL_PROXY` fills in for either proxy variable that is unset, an empty variable counts as unset, and `NO_PROXY="*"` sends all traffic directly.

1041052. The `[network] proxy` key in `config.toml`, the form to [deploy with device management](/docs/claude-science/manage-on-devices#deploy-configuration-with-device-management).

1051063. The proxy field under **Settings** > **Network**, where a member can paste a proxy address by hand. It takes effect at the next restart, and when `config.toml` sets the proxy, the field shows as managed by your organization so members cannot override it.

1064. On macOS only, an explicit web proxy configured in the system's network settings, which Claude Science detects automatically.

1074. On macOS and Windows, the proxy configured in the operating system's settings, which Claude Science detects automatically: an explicit web proxy in macOS network settings, or the proxy server in Windows proxy settings.

107108

108109Write the proxy as an `http://` URL; if it requires a username and password, embed them in the address and percent-encode special characters (for example, `@` in a password becomes `%40`):

109110

from line 116

115116

116117An `https://` (TLS-to-proxy) address works for the app's own connections only. Sandboxed package downloads tunnel only through `http://` proxies, so with an `https://` address they skip the proxy and connect directly; an `http://` address keeps every connection on the proxy.

117118

118Claude Science always bypasses the proxy for loopback addresses (`localhost`, `127.0.0.1`, and their IPv6 equivalents), whether or not they appear in `NO_PROXY`, so the app and its background service can always talk to each other. Add your internal domains to `NO_PROXY`; entries match a host exactly or as a domain suffix (`.example.corp` and `example.corp` behave the same), and CIDR ranges such as `10.0.0.0/8` are not matched. `NO_PROXY` entries from the environment, the configuration file, and (when the system settings supply the proxy address) the macOS bypass list are combined.

119Claude Science always bypasses the proxy for loopback addresses (`localhost`, `127.0.0.1`, and their IPv6 equivalents), whether or not they appear in `NO_PROXY`, so the app and its background service can always talk to each other. Add your internal domains to `NO_PROXY`; entries match a host exactly or as a domain suffix (`.example.corp` and `example.corp` behave the same), and CIDR ranges such as `10.0.0.0/8` are not matched. `NO_PROXY` entries from the environment, the configuration file, and (when the system settings supply the proxy address) the macOS or Windows bypass list are combined.

119120

120121### Proxy settings in the configuration file

121122

122123For a fleet, set `[network] proxy` and `no_proxy` in `config.toml`; both keys and their formats are in the [configuration file reference](/docs/claude-science/configuration-file-reference#app-connection-keys).

123124

124### macOS system proxy settings

125### System proxy settings on macOS and Windows

125126

126Claude Science detects an explicit system web proxy automatically, so a machine whose proxy your MDM already sets needs no Claude Science configuration unless the proxy requires authentication. macOS keeps an authenticated proxy entry's credentials in the keychain, where Claude Science cannot read them, so connections through the detected proxy fail with HTTP 407 (see [the troubleshooting entry](#the-proxy-requires-its-own-sign-in-http-407)); set `[network] proxy` with the credentials in the address instead. When the network publishes only a PAC or WPAD file, Claude Science detects it and names the PAC URL in the sign-in error, but does not evaluate it. Set `[network] proxy` to the proxy the PAC file resolves to for Anthropic's hosts.

127On macOS, Claude Science detects an explicit system web proxy automatically, so a machine whose proxy your MDM already sets needs no Claude Science configuration unless the proxy requires authentication. macOS keeps an authenticated proxy entry's credentials in the keychain, where Claude Science cannot read them, so connections through the detected proxy fail with HTTP 407 (see [the troubleshooting entry](#the-proxy-requires-its-own-sign-in-http-407)); set `[network] proxy` with the credentials in the address instead. When the network publishes only a PAC or WPAD file, Claude Science on macOS detects it and names the PAC URL in the sign-in error, but does not evaluate it. Set `[network] proxy` to the proxy the PAC file resolves to for Anthropic's hosts.

127128

129On Windows, Claude Science reads the proxy server and bypass list from Windows proxy settings at startup, which covers a proxy set under **Settings** > **Network & internet** > **Proxy**, in Internet Options, or by Group Policy, so a PC whose proxy your device management already sets needs no Claude Science configuration unless the proxy requires authentication. Windows proxy settings carry no credentials either, so for a proxy that requires Basic authentication, set `[network] proxy` with the credentials in the address. Bypass entries other than host names and domain suffixes are not applied, including the **Don't use the proxy server for local (intranet) addresses** option and entries written as IP ranges, so list internal domains in `[network] no_proxy`. To restart Claude Science on Windows after a settings change, quit it from its notification-area icon and open it again, because closing the window leaves it running.

130

131When the network publishes only a PAC or WPAD file, the Claude Science app window follows the proxy that the script resolves for Anthropic's hosts and restarts the app's background service once to apply it. A script-resolved proxy that demands a sign-in of any kind, refuses the connection, or does not answer within a few seconds is not used, and Claude Science keeps connecting as it did before, which on such a network means directly. For a proxy that needs credentials, set `[network] proxy` with them in the address. Claude Science started from a terminal with `claude-science serve` does not evaluate PAC files, so set `[network] proxy` there too.

132

128133### How the environment variables reach the app

129134

130135How the variables reach the app depends on the operating system:

131136

132137* On macOS, the menu-bar app reads `~/.claude-science/env`, a file of `KEY=VALUE` lines (`export KEY=VALUE` also works), when it launches. Put the three variables there, then quit and reopen the app; an app started from the Dock or Finder does not see variables exported in a terminal. The file's `NO_PROXY` entries merge with the other sources rather than replacing them.

138* On Windows, the app reads the variables from the user's environment when it starts, so set them as user environment variables, then quit Claude Science from its notification-area icon and open it again; variables typed into an open Command Prompt or PowerShell window do not reach an app started from the Start menu. Because Claude Science already follows Windows proxy settings, most PCs need no variables, and `[network] proxy` in `config.toml` is the form to deploy.

133139* On Linux, export the variables in the shell or service unit that starts `claude-science serve`. The `env` file is read only by the macOS app.

134140

135Only Basic proxy authentication, supplied in the proxy address, is supported; NTLM, Negotiate, and Kerberos proxies are not, and neither are networks whose only published proxy configuration is a PAC or WPAD file, because Claude Science does not evaluate PAC files.

141Only Basic proxy authentication, supplied in the proxy address, is supported; NTLM, Negotiate, and Kerberos proxies are not. On macOS and Linux, networks whose only published proxy configuration is a PAC or WPAD file are not supported either, because Claude Science does not evaluate PAC files there. On Windows, the app window follows a PAC or WPAD file as described under [System proxy settings on macOS and Windows](#system-proxy-settings-on-macos-and-windows).

136142

137143<Note>

138144 For a proxy that only speaks NTLM or Kerberos, a local relay such as `cntlm` or `px` works: the relay runs on the workstation, authenticates to your corporate proxy with the user's credentials, and exposes a plain HTTP proxy on the loopback interface. Point `HTTPS_PROXY` and `HTTP_PROXY` at the relay (for example `http://127.0.0.1:3128`). The loopback bypass governs which destinations skip the proxy, not whether the proxy can be reached, so a loopback relay works as a proxy address.

from line 154

148154

149155### Corporate root for app connections

150156

151The `[network] ca_bundle` key in `config.toml` points at a PEM file whose certificates Claude Science adds to its default trust for sign-in, the Claude API, Anthropic-hosted connectors, update checks, and [cloud storage](/docs/claude-science/cloud-storage) access from Settings. For cloud storage, the corporate root applies to Amazon S3 and S3-compatible connections, and to Google Cloud Storage connections that use an HMAC key. The public roots stay in place, so the file holds only your corporate root. The path rules are in the [configuration file reference](/docs/claude-science/configuration-file-reference#app-connection-keys). A failing value is ignored with a warning rather than stopping the app, so a sign-in error behind inspection usually means the bundle did not load, and the app re-reads the bundle every few minutes, so a corrected file takes effect without a restart. When you deploy a `config.toml`, deploy the bundle files alongside it.

157The `[network] ca_bundle` key in `config.toml` points at a PEM file whose certificates Claude Science adds to its default trust for sign-in, the Claude API, Anthropic-hosted connectors, update checks, and [cloud storage](/docs/claude-science/cloud-storage) access from Settings. For cloud storage, the corporate root applies to Amazon S3 and S3-compatible connections, and to Google Cloud Storage connections that use an HMAC key. The public roots stay in place, so the file holds only your corporate root. The path rules are in the [configuration file reference](/docs/claude-science/configuration-file-reference#app-connection-keys). A failing value is ignored with a warning rather than stopping the app, so a sign-in error behind inspection usually means the bundle did not load, and the app re-reads the bundle every few minutes (about every 30 minutes on Windows), so a corrected file takes effect without a restart. When you deploy a `config.toml`, deploy the bundle files alongside it.

152158

159On Windows, when neither `[network] ca_bundle` nor `[conda] ca_bundle` (the **CA bundle path** field in **Settings**) is set, Claude Science automatically trusts the root certificates installed for the whole computer (the computer's **Trusted Root Certification Authorities** store, not the current user's) and rechecks that store about every 30 minutes, so a PC whose device management already installs your corporate root there needs no setting. Claude Science reads that store with Windows PowerShell, so on PCs where Windows PowerShell is blocked or restricted for users, set `[network] ca_bundle` for the app's own connections and `[conda] ca_bundle` for code inside sessions instead of relying on the store. If you do set `[network] ca_bundle` on Windows, the file is used instead of the store; write its path in single quotes, for example `'C:\ProgramData\corp\corporate-ca.pem'`, because a backslash inside double quotes is a TOML escape and a file that fails to parse stops Claude Science from starting.

160

153161### Corporate root for package downloads

154162

155Conda package downloads for the analysis sandbox use their own setting, `[conda] ca_bundle`, the complete list of roots those downloads trust, so it must contain the public roots your packages come from as well as your corporate root. On Linux, when the key is not set, Claude Science uses your distribution's system certificate bundle (maintained by `update-ca-certificates` or `update-ca-trust`), so a Linux image that already trusts your corporate root needs no setting at all.

163Conda package downloads for the analysis sandbox use their own setting, `[conda] ca_bundle`, the complete list of roots those downloads trust, so it must contain the public roots your packages come from as well as your corporate root. On Linux, when the key is not set, Claude Science uses your distribution's system certificate bundle (maintained by `update-ca-certificates` or `update-ca-trust`), so a Linux image that already trusts your corporate root needs no setting at all. On Windows, leave `[conda] ca_bundle` unset unless Windows PowerShell is blocked or restricted for users (covered under [Corporate root for app connections](#corporate-root-for-app-connections)): package downloads there verify certificates through the Windows certificate store and do not read the key, so a corporate root installed for the whole computer is trusted with no setting. A `[conda] ca_bundle` file that exists on a Windows PC becomes the complete certificate list that code inside sessions trusts, in place of the store, and the app's own connections then stop trusting the Windows certificate store automatically, so set `[network] ca_bundle` as well.

156164

157`[conda] ca_bundle` affects package downloads only and never fixes sign-in. The CA bundle path field on the Settings page sets this same `[conda]` key, so filling it in helps package downloads only. Behind TLS inspection you also need `[network] ca_bundle`, which has no Settings field and is set in `config.toml`.

165On macOS and Linux, `[conda] ca_bundle` affects package downloads only, and it never fixes sign-in. The CA bundle path field on the Settings page sets this same `[conda]` key, so filling it in helps package downloads only, and on Windows leave the field empty. Behind TLS inspection you also need `[network] ca_bundle`, which has no Settings field and is set in `config.toml`.

158166

159pip verifies package downloads against the operating system's trust store, and in this release setting `[conda] ca_bundle` alone may not be sufficient for pip, so also install the corporate root in that trust store: on Linux with `update-ca-certificates` or `update-ca-trust`, and on macOS in the system keychain through your MDM.

167pip verifies package downloads against the operating system's trust store, and in this release setting `[conda] ca_bundle` alone may not be sufficient for pip, so also install the corporate root in that trust store: on Linux with `update-ca-certificates` or `update-ca-trust`, on macOS in the system keychain through your MDM, and on Windows in the computer's Trusted Root Certification Authorities store, which pip reads in environments on Python 3.10 or later, the default.

160168

161169```toml theme={null}

162170[conda]

from line 174

166174The same path rules apply as for `[network] ca_bundle`; the [configuration file reference](/docs/claude-science/configuration-file-reference#package-download-keys) lists them.

167175

168176<Warning>

169 Do not point `[conda] ca_bundle` at the single-root file you use for `[network] ca_bundle`: the package-download setting replaces the whole trust list, so a file containing only your corporate root breaks every package download on any network your proxy does not inspect, such as a laptop on home Wi-Fi. Build the `[conda]` bundle from your system's public roots plus the corporate root.

177 Do not point `[conda] ca_bundle` at the single-root file you use for `[network] ca_bundle`: the package-download setting replaces the whole trust list, so a file containing only your corporate root breaks every package download (on Windows, every download made by code inside a session) on any network your proxy does not inspect, such as a laptop on home Wi-Fi. Build the `[conda]` bundle from your system's public roots plus the corporate root.

170178</Warning>

171179

172180### What the certificate settings do not cover

173181

174Code that Claude runs inside a session, such as a `pip install` typed into a cell or an R `install.packages()` call, is covered on macOS but not on Linux. On macOS, Python, pip, curl, git, and downloads from R in the session's environments trust the same certificates as environment builds: the `[conda] ca_bundle` file if you set one, otherwise the system's public roots plus the corporate root Claude Science finds in the macOS keychain (`[network] ca_bundle` alone does not reach in-session code). On Linux, neither bundle reaches code inside a session: curl and git there honor a root installed in the operating system's trust store, but the environment's Python, pip, and R see public roots only, so behind TLS inspection, have Claude install packages into an environment rather than in a cell.

182Code that Claude runs inside a session, such as a `pip install` typed into a cell or an R `install.packages()` call, is covered on macOS but not on Linux. On macOS, Python, pip, curl, git, and downloads from R in the session's environments trust the same certificates as environment builds: the `[conda] ca_bundle` file if you set one, otherwise the system's public roots plus the corporate root Claude Science finds in the macOS keychain (`[network] ca_bundle` alone does not reach in-session code). On Windows, Python, pip, and curl inside a session are pointed at an export of the root certificates installed for the whole computer (or the `[conda] ca_bundle` file if one is set). On Linux, neither bundle reaches code inside a session: curl and git there honor a root installed in the operating system's trust store, but the environment's Python, pip, and R see public roots only, so behind TLS inspection, have Claude install packages into an environment rather than in a cell.

175183

176184The local connectors (the bundled research tools) do not work behind TLS inspection in this release: they run in their own Python environment, and nothing delivers your corporate root to that environment, so their connections fail certificate verification. This is a known limitation. Claude Science does detect TLS inspection from your configured CA bundle and relax the connectors' strict certificate-profile check, which stops them from rejecting a corporate root whose Basic Constraints extension is not marked critical, but that relaxation adds no trust. The Anthropic-hosted connectors keep working once `[network] ca_bundle` is set. Connector installs that use `npm` also keep npm's own certificate configuration.

177185

from line 195

187195

188196### The proxy requires its own sign-in (HTTP 407)

189197

190Sign-in fails with this message when the proxy demands credentials the app is not sending, because the proxy address carries none or the proxy was detected from the macOS system settings, which never supply credentials. Include the Basic-authentication credentials in the proxy address (percent-encoding special characters) under **Settings** > **Network** > **Proxy address**, in `[network] proxy`, or in `HTTPS_PROXY`, then restart the app. Only Basic authentication works, so a proxy that requires NTLM, Negotiate, or Kerberos cannot be satisfied this way. During an environment build, a proxy authentication failure surfaces as a generic HTTP 502 error rather than a 407 message.

198Sign-in fails with this message when the proxy demands credentials the app is not sending, because the proxy address carries none or the proxy was detected from the macOS or Windows system settings, which never supply credentials. Include the Basic-authentication credentials in the proxy address (percent-encoding special characters) under **Settings** > **Network** > **Proxy address**, in `[network] proxy`, or in `HTTPS_PROXY`, then restart the app. Only Basic authentication works, so a proxy that requires NTLM, Negotiate, or Kerberos cannot be satisfied this way. During an environment build, a proxy authentication failure surfaces as a generic HTTP 502 error rather than a 407 message.

191199

192200### Package downloads are being blocked by network policy

193201

claude-science/get-started Changed · +38 / -25 lines

from line 1

11# Get started

3> Install Claude Science on macOS or Linux, sign in with your Claude account, and run your first analysis.

3> Install Claude Science on macOS, Windows, or Linux, sign in with your Claude account, and run your first analysis.

55## Install

7macOS: Download the installer from claude.com/product/claude-science and double-click to install. On first launch, the app sets up its runtime and starter Python and R environments, which takes a few minutes, then opens a new tab in your default browser. If no browser tab appears, choose Open from the menu bar icon.

7<Tabs>

8 <Tab title="macOS">

9 Download the installer from [claude.com/product/claude-science](https://claude.com/product/claude-science) and double-click to install. On first launch, the app sets up its runtime and starter Python and R environments, which takes a few minutes, then opens a new tab in your default browser. If no browser tab appears, choose Open from the menu bar icon.

10 </Tab>

811

9<Note>

10 Although Claude Science opens in a browser tab, it's a local application, not a website: there's no public URL to visit. Open it from the application itself, with the menu bar icon on macOS or the `claude-science` command on Linux. On a remote server, the sign-in link reaches your browser through an SSH tunnel; see [Run on a remote Linux server](/docs/claude-science/run-on-remote-linux-server).

11</Note>

12 <Tab title="Windows">

13 Download the installer from [claude.com/product/claude-science](https://claude.com/product/claude-science) and open it. It installs Claude Science for your user account without administrator rights, adds **Claude Science** to the Start menu and the desktop, and opens the app in its own window. The first launch sets up the sandbox and downloads the app window engine (about 150 MB) before the window appears, so it takes longer than later launches, and the starter Python and R environments keep setting up in the background. For requirements, updates, and uninstalling, see [Run on Windows](/docs/claude-science/run-on-windows).

14 </Tab>

1215

13Linux: install the sandbox dependencies, then run the installer. The sandbox needs bubblewrap 0.8.0 or later and socat, and installing them takes administrator (`sudo`) access; if you don't have it, ask your system administrator to install them.

16 <Tab title="Linux">

17 Install the sandbox dependencies, then run the installer. The sandbox needs bubblewrap 0.8.0 or later and socat, and installing them takes administrator (`sudo`) access; if you don't have it, ask your system administrator to install them.

1418

15* Ubuntu or Debian: `sudo apt-get update && sudo apt-get install -y curl bubblewrap socat`

16* Fedora or RHEL: `sudo dnf install -y curl bubblewrap socat`

17* Arch: `sudo pacman -S curl bubblewrap socat`

19 * Ubuntu or Debian: `sudo apt-get update && sudo apt-get install -y curl bubblewrap socat`

20 * Fedora or RHEL: `sudo dnf install -y curl bubblewrap socat`

21 * Arch: `sudo pacman -S curl bubblewrap socat`

1822

19Ubuntu 24.04's repositories carry a new enough bubblewrap and Ubuntu 22.04's don't; on any distribution, confirm with `bwrap --version` that the installed version is 0.8.0 or later before you start Claude Science.

23 Ubuntu 24.04's repositories carry a new enough bubblewrap and Ubuntu 22.04's don't; on any distribution, confirm with `bwrap --version` that the installed version is 0.8.0 or later before you start Claude Science.

2024

21```bash theme={null}

22curl -fsSL https://claude.ai/install-claude-science.sh | bash

23```

25 ```bash theme={null}

26 curl -fsSL https://claude.ai/install-claude-science.sh | bash

27 ```

2428

25```bash theme={null}

26claude-science serve

27```

29 ```bash theme={null}

30 claude-science serve

31 ```

2832

29First launch prints a local URL right away, then continues setting up its starter Python and R environments. To run Claude Science on a remote server and use it from your computer, see [Run on a remote Linux server](/docs/claude-science/run-on-remote-linux-server).

33 First launch prints a local URL right away, then continues setting up its starter Python and R environments. To run Claude Science on a remote server and use it from your computer, see [Run on a remote Linux server](/docs/claude-science/run-on-remote-linux-server).

34 </Tab>

35</Tabs>

3036

37<Note>

38 Claude Science is a local application, not a website, so there's no public URL to visit. On Windows it opens in its own window, and on macOS and Linux it opens in a browser tab. Open it from the application itself: the menu bar icon on macOS, the Start menu on Windows, or the `claude-science` command on Linux. On a remote server, the sign-in link reaches your browser through an SSH tunnel; see [Run on a remote Linux server](/docs/claude-science/run-on-remote-linux-server).

39</Note>

3141## Sign in and complete setup

3242

33When the app opens in your browser, sign in with your Claude account. If the OAuth redirect can't return to the app (for example, through an SSH tunnel), use the Paste a code option on the sign-in screen instead. No API key is required.

43When the app opens, sign in with your Claude account. On Windows, the app opens claude.ai in your default browser for this and continues in the app window once you approve the sign-in. If the sign-in redirect can't return to the app (for example, through an SSH tunnel), use the **Paste code instead** option on the sign-in screen. No API key is required.

3444

3545After sign-in, a setup wizard walks you through enabling connectors and skills, setting which websites Claude can access, and choosing whether memory is on. You can change these at any time in Settings.

3646

3747<Note>

38 Claude Science keeps all of its data in a single folder (`~/.claude-science`) in your home directory; on Linux, the `claude-science` command itself installs to `~/.local/bin`. It doesn't modify your existing conda installation, R libraries, or shell configuration.

48 Claude Science keeps your data in a single folder in your home directory: `~/.claude-science` on macOS and Linux, and `%USERPROFILE%\.claude-science` on Windows. On Linux, the `claude-science` command itself installs to `~/.local/bin`, and on Windows the app installs to `%LOCALAPPDATA%\Programs\ClaudeScience` and adds that folder to your user PATH. Beyond that, it doesn't modify your existing conda installation, R libraries, or shell configuration.

3949</Note>

4050

4151<Warning>

42 Deleting that folder removes all projects, artifacts, and conversation history. Deleting the folder and the application removes Claude Science entirely.

52 Deleting the data folder removes all projects, artifacts, and conversation history. Deleting the folder and the application removes Claude Science entirely; on Windows, [uninstall the app](/docs/claude-science/run-on-windows#uninstall) from **Settings** > **Apps** > **Installed apps**.

4353</Warning>

4454

4555## Run your first analysis

from line 63

5363## Troubleshooting first launch

5464

5565* macOS says the application isn't supported, or the app icon appears crossed out: the download page picked the build for the wrong processor. Return to the download page and choose Mac (Intel) or Mac (Apple Silicon) to match your Mac. To check which you have, open the Apple menu, choose About This Mac, and look at the Chip or Processor line.

56* No browser tab appeared: on macOS, choose Open from the menu bar icon. On Linux, copy the printed URL into a browser on the same machine, or run `claude-science url` to print a fresh one.

66* No browser tab appeared on macOS or Linux: on macOS, choose Open from the menu bar icon. On Linux, copy the printed URL into a browser on the same machine, or run `claude-science url` to print a fresh one.

67* A Claude Science message on Windows says the app was not installed because the file could not be confirmed: download the installer again from [claude.com/product/claude-science](https://claude.com/product/claude-science) and open the new file. If the message persists, the PC could not verify the publisher's signature, so ask your IT team.

68* The Windows app reports that it couldn't set up the app window engine: the first launch downloads that engine from `downloads.claude.ai`, and this usually means the app couldn't reach it. Check the internet connection, and on a corporate network ask IT to allow that domain (see [Network requirements](/docs/claude-science/network-requirements)).

69* On Windows, environment builds or other features fail and the PC doesn't have the Microsoft Visual C++ Redistributable (x64): install the latest supported x64 version from [Microsoft's download page](https://learn.microsoft.com/cpp/windows/latest-supported-vc-redist), then quit Claude Science from its notification-area icon and open it again.

5770* Linux refuses to start: a sandbox dependency is missing (install bubblewrap and socat as shown in the Install section), too old, or blocked. Check your bubblewrap version with `bwrap --version`, then match the error message to its fix in the [Linux troubleshooting table](/docs/claude-science/run-on-remote-linux-server#troubleshooting).

5871* Projects from another computer don't appear: by design, Claude Science keeps your work on the computer where it's installed, so each computer starts with its own projects. Your earlier projects are still on the other computer. See [Use Claude Science on more than one computer](/docs/claude-science/multiple-computers).

5972* Sign-in stops at claude.ai: your account is on the Free plan (upgrade required), the redirect couldn't return (use Paste a code), or your Team or Enterprise organization hasn't [enabled Claude Science](/docs/claude-science/enable-claude-science) yet.

claude-science/manage-on-devices Changed · +7 / -5 lines

from line 8

99The app writes to two locations on each member's computer:

1010

11Configuration: \~/.claude-science/config.toml holds all app settings. Every key is optional; the app starts with no file present. This is the file to deploy through device management.\

11Configuration: config.toml in the app's default data folder (`~/.claude-science/config.toml` on macOS and Linux, `%USERPROFILE%\.claude-science\config.toml` on Windows) holds all app settings. Every key is optional; the app starts with no file present. This is the file to deploy through device management.\

1212Data: the app's data directory holds conversations, generated artifacts, delegation configurations, and workspace files in a per-organization subfolder (orgs/`<organization-id>`/), stored as a local database plus files.

1313

14Authentication tokens and the shared package environment live under \~/.claude-science/ regardless of the data directory, so endpoint backup or wipe policies that target the data directory don't affect sign-in state.

14Authentication tokens and the shared package environment live under the default data folder (`~/.claude-science/`, or `%USERPROFILE%\.claude-science\` on Windows) regardless of the data directory, so endpoint backup or wipe policies that target the data directory don't affect sign-in state.

1515

16On Windows, the program itself installs per user, without administrator rights, to `%LOCALAPPDATA%\Programs\ClaudeScience` and registers under the signed-in user's **Settings** > **Apps** > **Installed apps** rather than machine-wide. The app also writes launch logs and state to `%LOCALAPPDATA%\ClaudeScience` and keeps a sandbox state folder under `%LOCALAPPDATA%`, and it unpacks components it runs, such as the app window engine and the sandbox launcher, under the data folder, so allow-listing by path needs both the program folder and the data folder. Uninstalling removes the program and sandbox state; `claude-science uninstall --purge` also removes the data and state folders.

1618Your endpoint tooling governs these folders the same way it governs any other local application data. Anthropic doesn't host a copy of these folders, so Custom Data Retention and Org Data Export don't reach them. [How Claude Science works with your data](/docs/claude-science/how-claude-science-works-with-your-data) covers what Anthropic does receive from the app, including the session transcripts available to Enterprise organizations with the Compliance API enabled.

1719

1820## Deploy configuration with device management

1921

20To set configuration keys organization-wide, deploy \~/.claude-science/config.toml through your MDM or endpoint tool. Claude Science doesn't read a system-level managed-preferences file, so there's no native MDM configuration channel. Deploying the per-member config.toml is the supported approach. The sandbox network allowlist and the package mirror can instead be set once for every member under **Organization settings** > **Claude Science** (see [Organization settings](/docs/claude-science/admin-controls#organization-settings)). The keys most relevant to admins are:

22To set configuration keys organization-wide, deploy the per-member config.toml (at the path given under [Where the app stores data](#where-the-app-stores-data)) through your MDM or endpoint tool. Claude Science doesn't read its settings from a system-level managed-preferences file or registry policy keys, so there's no native MDM configuration channel on any operating system. Deploying the per-member config.toml is the supported approach. The sandbox network allowlist and the package mirror can instead be set once for every member under **Organization settings** > **Claude Science** (see [Organization settings](/docs/claude-science/admin-controls#organization-settings)). The keys most relevant to admins are:

2123

2224| Key | Effect |

2325| ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------- |

from line 38

3638

3739To turn telemetry and error reports off on managed devices, use either of:

3840

39Set disable\_telemetry = true in \~/.claude-science/config.toml (deployable through MDM).\

41Set disable\_telemetry = true in config.toml (deployable through MDM).\

4042Set the DO\_NOT\_TRACK environment variable (for example to 1) on the device.

4143

4244Both are device-level settings. There's no per-member or per-organization telemetry toggle in Organization settings.

from line 45

4345

4446## Endpoint detection and response

4547

46Claude Science runs analysis code inside a local sandbox on the member's computer. On macOS, sandboxed analysis processes run as ordinary child processes and are visible to host-level EDR tools. On Linux, they run inside a separate PID namespace with an isolated process view, so host-level EDR won't see them as ordinary children of the app.

48Claude Science runs analysis code inside a local sandbox on the member's computer. On macOS, sandboxed analysis processes run as ordinary child processes and are visible to host-level EDR tools. On Windows, they run under the member's account inside a Windows AppContainer, the operating system's built-in app isolation, started by a sandbox launcher that ships inside the app, without WSL or Hyper-V. Installing and running need no administrator rights, and Windows asks once, optionally, for administrator approval so that Command Prompt scripts and git can run inside cells and PowerShell cells can change folders, while Python and R cells work without it. If security software holds the sandbox launcher or quarantines files in an analysis environment, Claude Science names the affected folder in its error message so you can add an exclusion. On Linux, sandboxed processes run inside a separate PID namespace with an isolated process view, so host-level EDR won't see them as ordinary children of the app.

4749

4850## Required updates

4951

claude-science/network-requirements Changed · +10 / -9 lines

from line 12

1212

1313Every Claude Science install makes these connections, which travel through the member's outbound proxy and TLS inspection, so they need the proxy and corporate-certificate settings from the corporate networks page. All are outbound HTTPS on TCP 443.

1414

15| Domain | Required when | Purpose |

16| --------------------------------------- | --------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

17| `claude.ai` | Always | Browser-based sign-in, usage analytics, feature configuration, and the catalog of available connectors |

18| `platform.claude.com` | Always | Completing sign-in (the OAuth token exchange) |

19| `api.anthropic.com` | Always | The Claude API for every request Claude makes, plus account and usage information |

20| `o1158394.ingest.us.sentry.io` | When telemetry is on (the default) | Crash and error reporting (the error type and where it happened in Claude Science's own code, never error messages, conversation content, or research data); blocking it degrades diagnostics only |

21| `*.mcp.claude.com` | When members use the Anthropic-hosted connectors | PubMed, ClinicalTrials.gov, ChEMBL, and bioRxiv connectors |

22| `storage.googleapis.com` | When automatic updates are on | Update manifests and installers |

23| `api.github.com`, `codeload.github.com` | When members import skills from a GitHub repository | Fetching the skill repository's contents |

15| Domain | Required when | Purpose |

16| --------------------------------------- | --------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

17| `claude.ai` | Always | Browser-based sign-in, usage analytics, feature configuration, and the catalog of available connectors |

18| `platform.claude.com` | Always | Completing sign-in (the OAuth token exchange) |

19| `api.anthropic.com` | Always | The Claude API for every request Claude makes, plus account and usage information |

21| `*.mcp.claude.com` | When members use the Anthropic-hosted connectors | PubMed, ClinicalTrials.gov, ChEMBL, and bioRxiv connectors |

22| `storage.googleapis.com` | When automatic updates are on | Update manifests and installers |

23| `downloads.claude.ai` | On Windows, at first launch and when an update changes it | The app window engine, the component that displays the app window |

24| `api.github.com`, `codeload.github.com` | When members import skills from a GitHub repository | Fetching the skill repository's contents |

2425

2526Custom connectors and remote compute that members add reach whatever hosts they are configured with, so allow those case by case. Installs with telemetry turned off (see [Telemetry](/docs/claude-science/manage-on-devices#telemetry)) send no error reports, and blocking `o1158394.ingest.us.sentry.io` affects only error reporting, not the rest of the app.

2627

claude-science/overview Changed · +3 / -2 lines

from line 2

33> Anthropic's AI workbench for rigorous science.

5Claude Science is a desktop application that pairs Claude with an analysis environment on your computer. Available in beta on macOS and Linux.

5Claude Science is a desktop application that pairs Claude with an analysis environment on your computer. Available in beta on macOS, Windows, and Linux.

77You describe a research task or analysis in plain language; Claude writes and runs Python, R, or shell code in a sandbox, reads the folders you grant it, pulls data from scientific databases through connectors, and saves results as versioned artifacts with a full provenance record. A background reviewer can check Claude's claims against the work that was actually run.

from line 15

1515## Requirements

1616

1717* A Claude account on a Pro, Max, Team, or Enterprise plan. On Team and Enterprise plans, an Owner must [enable Claude Science for the organization](/docs/claude-science/enable-claude-science) first.

18* macOS 13 or later (Apple silicon or Intel), or Linux x64 on a glibc-based distribution.

18* macOS 13 or later (Apple silicon or Intel), Windows 11 (x64), or Linux x64 on a glibc-based distribution.

1919* About 5 GB of free disk space for the runtime and starter environments.

2020* On Linux: socat, bubblewrap 0.8.0 or later, and unprivileged user namespaces permitted by the kernel.

21* On Windows: the Microsoft Visual C++ Redistributable (x64), which some features depend on and most PCs already have (see [Run on Windows](/docs/claude-science/run-on-windows#requirements)).

2122

claude-science/run-on-remote-linux-server Changed · +11 / -11 lines

from line 63

6363

6464Open the printed link in your computer's browser. The link is single-use and expires about three minutes after it's printed; run `claude-science url` on the server to print a fresh one at any time. Restarting with `claude-science stop` then `claude-science serve --no-browser` also prints a fresh link.

6565

66Sign in with your Claude account. If the sign-in redirect can't find its way back through the tunnel, choose **Paste a code** on the sign-in screen. Then complete the setup wizard as described in [Get started](/docs/claude-science/get-started).

66Sign in with your Claude account. If the sign-in redirect can't find its way back through the tunnel, choose **Paste code instead** on the sign-in screen. Then complete the setup wizard as described in [Get started](/docs/claude-science/get-started).

6767

6868## Keep it up to date

6969

from line 71

7171

7272## Troubleshooting

7373

74| Symptom | What it means |

75| ----------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |

76| `command not found: claude-science` | `~/.local/bin` isn't on your PATH yet. Run `. ~/.profile` or open a new terminal. |

77| An error mentioning `bwrap too old` | The server's bubblewrap is older than 0.8.0. Upgrade it, or use a distribution that ships a newer version, such as Ubuntu 24.04 or later. |

78| An error mentioning `cannot create unprivileged user namespaces` | The kernel or an AppArmor profile blocks the sandbox from creating user namespaces; some Ubuntu 24.04 images restrict this. The error message names the exact setting to change for your distribution. |

79| The sign-in link shows an expired-link page | Links are single-use and valid for about three minutes. Run `claude-science url` on the server and open the fresh link; restarting with `claude-science stop` then `claude-science serve --no-browser` also prints one. |

80| Sign-in stops at claude.ai | The redirect couldn't return through the tunnel (choose **Paste a code**), your account is on the Free plan (an upgrade is required), or your Team or Enterprise organization hasn't [enabled Claude Science](/docs/claude-science/enable-claude-science) yet. |

81| Interactive HTML previews render as static snapshots after a short delay (charts don't respond) | The tunnel isn't forwarding the preview port. Add the second `-L` forward; the preview port is the web app port plus one (8001 by default). |

82| The browser can't reach `localhost:8000` | The tunnel isn't up; rerun the `ssh -L` command. If the tunnel is up, confirm Claude Science is running on the server with `claude-science status`. |

83| The installer reports no binary for your platform | Claude Science on Linux needs x64 with glibc. arm64 servers and musl-based distributions such as Alpine aren't supported. |

74| Symptom | What it means |

76| `command not found: claude-science` | `~/.local/bin` isn't on your PATH yet. Run `. ~/.profile` or open a new terminal. |

77| An error mentioning `bwrap too old` | The server's bubblewrap is older than 0.8.0. Upgrade it, or use a distribution that ships a newer version, such as Ubuntu 24.04 or later. |

80| Sign-in stops at claude.ai | The redirect couldn't return through the tunnel (choose **Paste code instead**), your account is on the Free plan (an upgrade is required), or your Team or Enterprise organization hasn't [enabled Claude Science](/docs/claude-science/enable-claude-science) yet. |

82| The browser can't reach `localhost:8000` | The tunnel isn't up; rerun the `ssh -L` command. If the tunnel is up, confirm Claude Science is running on the server with `claude-science status`. |

83| The installer reports no binary for your platform | Claude Science on Linux needs x64 with glibc. arm64 servers and musl-based distributions such as Alpine aren't supported. |

8484

claude-science/run-on-windows New page · 56 lines, new page

# Run on Windows ## Requirements ## Install ## First launch and sign-in ## Updates ## Where Claude Science stores data ## Uninstall ## Corporate networks ## Differences on Windows ## The Linux version under WSL

A whole new page. There's nothing to diff it against, so here is what it says.

# Run on Windows

> Install Claude Science on a Windows PC: requirements, what the installer does, first launch and sign-in, updates, where data lives, and how to uninstall.

Claude Science runs on Windows as a desktop app in its own window. It installs for your user account without administrator rights, and Claude's code runs in a sandbox built on Windows' own app isolation rather than on WSL, Hyper-V, or Docker.

## Requirements

* Windows 11, 64-bit (x64).
* The Microsoft Visual C++ Redistributable (x64), which some Claude Science features depend on. Most PCs already have it. If yours doesn't, install the latest supported x64 version from [Microsoft's download page](https://learn.microsoft.com/cpp/windows/latest-supported-vc-redist).
* Free disk space for the app and its analysis environments, as listed under [Claude Science requirements](/docs/claude-science/overview#requirements).
* An internet connection on first launch, to download the app window engine (the component that displays the window, about 150 MB) from `downloads.claude.ai`.
* A Claude account on a Pro, Max, Team, or Enterprise plan.

## Install

Download the Windows installer from [claude.com/product/claude-science](https://claude.com/product/claude-science) and open it. It needs no administrator approval. It installs Claude Science for your user account under `%LOCALAPPDATA%\Programs\ClaudeScience`, adds **Claude Science** to the Start menu and the desktop, puts the `claude-science` command on your PATH, lists the app under **Settings** > **Apps** > **Installed apps**, and opens it. The installer is signed by Anthropic, PBC.

If a Claude Science message says the app was not installed because the file could not be confirmed as the published copy, the copy you opened still runs but isn't installed. Download the installer again and open the new file, and if the message persists, ask your IT team, because the PC could not verify the publisher's signature.

## First launch and sign-in

On first launch, Claude Science sets up the sandbox and downloads its app window engine from `downloads.claude.ai` before the window appears, so the first start takes longer than later ones, and a notice shows progress. The starter Python and R environments keep setting up in the background for several minutes after the window opens.

To sign in, click the **Sign in on the web** button and confirm with **Continue**. Claude Science opens claude.ai in your default browser and continues once you approve the sign-in there; if the browser can't hand the sign-in back, choose the **Paste code instead** option. Then complete the setup wizard as described in [Get started](/docs/claude-science/get-started#sign-in-and-complete-setup).

If Claude Science asks for one-time permission from Windows so that cells can run git and Command Prompt scripts and PowerShell can change folders, **Yes** lets Windows ask for approval (an administrator's password if you aren't one) and **No** leaves those features off. Python and R cells work either way, and the **Ask Windows now** button under **Settings** > **Permissions** grants the permission later.

Closing the window leaves Claude Science running, with an icon in the notification area of the taskbar. Click the icon to reopen the window, or choose **Quit Claude Science** from the icon's menu to stop the app.

## Updates

Claude Science checks for updates in the background and shows **Update available** when one is ready; choose **Restart to update** to install it. Administrators who distribute the app themselves can turn the background check off with `[update] auto_update = false` (see [Manage Claude Science on devices](/docs/claude-science/manage-on-devices#deploy-configuration-with-device-management)). To update by hand instead, open a newer installer, which upgrades the installed copy in place and keeps your data.

## Where Claude Science stores data

Your projects, conversations, artifacts, analysis environments, logs, and `config.toml` live in the data folder, `%USERPROFILE%\.claude-science`, and **Settings** > **Storage** > **Data location** shows the folder in use. The program lives in `%LOCALAPPDATA%\Programs\ClaudeScience`, and launch logs and app state in `%LOCALAPPDATA%\ClaudeScience`.

## Uninstall

Quit Claude Science from its notification-area icon first, because the uninstaller refuses to run while the app is running. Then uninstall **Claude Science** from **Settings** > **Apps** > **Installed apps**, or run `claude-science uninstall` in a terminal. Either way your data is kept. To remove the data as well, run `claude-science uninstall --purge` in a terminal instead.

## Corporate networks

Claude Science follows the proxy configured in Windows proxy settings and trusts corporate root certificates installed for the whole computer, so most managed PCs need no Claude Science configuration. Networks that allow only listed domains must allow `downloads.claude.ai` in addition to the domains every install needs. See [Use Claude Science on a corporate network](/docs/claude-science/corporate-networks) and [Network requirements](/docs/claude-science/network-requirements).

## Differences on Windows

* Claude runs shell commands with PowerShell. Command Prompt scripts, git inside cells, and folder changes in PowerShell need the [one-time Windows permission](#first-launch-and-sign-in).
* Only folders on local NTFS or ReFS drives can be granted, not network shares, mapped network drives, FAT or exFAT drives (many USB sticks and memory cards), or a whole drive such as `D:\`. Copy such files to a local folder or attach them in the chat.
* [Custom connectors](/docs/claude-science/custom-connectors) that run a local command start with `npx`, `node`, `python`, or the full path of a program. Connectors launched through `npm` or a `.cmd`, `.bat`, or `.ps1` file aren't supported.
* The **Model endpoints** section of **Settings** > **Compute** (NVIDIA BioNeMo NIM) isn't available.

## The Linux version under WSL

The Linux command-line version of Claude Science also runs under Windows Subsystem for Linux (WSL 2) with Ubuntu 24.04 or later. Inside the Ubuntu terminal, follow the Linux steps in [Get started](/docs/claude-science/get-started#install), start Claude Science with `claude-science serve --port 8765 --no-browser`, and open the printed link in a Windows browser.

claude-science/run-on-windows-wsl Page removed · 90 lines, page removed

# Run on Windows with WSL ## Enable WSL ## Install dependencies ## Install Claude Science ## Run it ## First launch ## Keep it running ## Troubleshooting

The page is gone upstream. What it last said is kept here.

connectors/custom/remote-mcp Changed · +7 / -7 lines

from line 65

6565

6666**Name**: the display name shown in the connectors list.

6767

68**Remote MCP server URL**: the HTTPS address where the server accepts MCP requests, for example `https://mcp.example.com/mcp`. After you continue, Claude checks the URL and pre-fills the authentication settings it detects, marked "Detected."

68**MCP server URL**: the HTTPS address where the server accepts MCP requests, for example `https://mcp.example.com/mcp`. After you continue, Claude checks the URL and pre-fills the authentication settings it detects, marked "Detected."

6969

7070**Authentication**: how people connect to the server.

7171

72* **Always required**: each user signs in through the server's OAuth flow before using it.

73* **Required when the server asks**: Claude connects without credentials and prompts users to sign in when the server asks.

74* **None**: no sign-in. Anyone with access to the server URL can use the connector. If the server uses an API key, choose None and add the key under **Request headers**; Claude stores it as the connector's credential.

72* **Sign in now**: each user signs in through the server's OAuth flow before using it.

73* **Sign in when needed**: Claude connects without credentials and prompts users to sign in when the server asks.

74* **No sign-in**: anyone with access to the server URL can use the connector. If the server uses an API key, choose **No sign-in** and add the key under **Request headers**; Claude stores it as the connector's credential.

7575

76**OAuth client** (shown unless you chose None): how Claude identifies itself to the server's authorization server.

76**OAuth client** (shown unless you chose **No sign-in**): how Claude identifies itself to the server's authorization server.

7777

78* **Use Anthropic's hosted client metadata** (recommended): the server reads Claude's client details from a URL Anthropic hosts (Client ID Metadata Document). Nothing to set up; the server must support it.

79* **No client ID — register one automatically**: Claude registers OAuth clients with the server as users connect (Dynamic Client Registration). Works with most servers, but adds client registrations over time.

78* **Use Claude's published identity** (recommended): the server reads Claude's client details from a URL Anthropic hosts (Client ID Metadata Document). Nothing to set up; the server must support it.

79* **Register automatically**: Claude registers OAuth clients with the server as users connect (Dynamic Client Registration). Works with most servers, but adds client registrations over time.

8080* **Use your own OAuth client**: enter a client ID you registered with the server. Leave the secret blank unless your authorization server requires one. See [Authentication for connectors](/docs/connectors/building/authentication).

8181

8282**Request headers**: fixed credentials such as API keys, sent on every request. See [Authenticating with request headers](#authenticating-with-request-headers).

claude-science/compute-providers Changed · +1 / -1 lines

from line 42

4242

4343### NVIDIA BioNeMo NIM

4444

45In Settings > Compute, under Model endpoints, click Connect on NVIDIA BioNeMo NIM. Import the skills from the BioNeMo Agent Toolkit, add your NVIDIA NGC API credential, and connect to NVIDIA-hosted API endpoint, or choose to run the model as a local container (On a machine with an NVIDIA GPU). Once connected, ask Claude to start a local Docker NIM container or set up a remote connection for a specific NIM skill from the BioNeMo Agent Toolkit.

45Model endpoints are available in Claude Science on macOS and Linux. In Settings > Compute, under Model endpoints, click Connect on NVIDIA BioNeMo NIM. Import the skills from the BioNeMo Agent Toolkit, add your NVIDIA NGC API credential, and connect to NVIDIA-hosted API endpoint, or choose to run the model as a local container (On a machine with an NVIDIA GPU). Once connected, ask Claude to start a local Docker NIM container or set up a remote connection for a specific NIM skill from the BioNeMo Agent Toolkit.

4646

claude-science/custom-connectors Changed · +1 / -1 lines

from line 14

1414 Skip approvals disables the per-call card for every tool on that connector. Only use connectors from developers you trust.

1515</Warning>

1616

17Local-command connectors run inside the sandbox with the same network limits as Claude's code and a per-connector writable directory. Environment variables for local connectors are saved unencrypted in a configuration file readable by your account only; don't put high-value secrets there. On Windows, a local-command connector starts with `npx`, `node`, `python`, or the full path of a program. Connectors launched through `npm` or a `.cmd`, `.bat`, or `.ps1` file aren't supported there.

1818

claude-science/tools-and-environments Changed · +1 / -1 lines

from line 2

33> Claude writes and runs Python, R, and shell commands.

5Claude writes and runs Python, R, and shell commands. Python and R run in a persistent kernel that keeps variables in memory across steps in a session. The kernel ends after about 30 minutes idle, when a package install restarts its environment, or when the session ends.

5Claude writes and runs Python, R, and shell commands (PowerShell on Windows). Python and R run in a persistent kernel that keeps variables in memory across steps in a session. The kernel ends after about 30 minutes idle, when a package install restarts its environment, or when the session ends.

77## Starter environments

One read of Claude Documentation

What this read moved

claude-science/changelog Changed · +5 / -0 lines

claude-science/command-line-settings Changed · +3 / -2 lines

claude-science/configuration-file-reference Changed · +16 / -13 lines

claude-science/corporate-networks Changed · +38 / -30 lines

claude-science/get-started Changed · +38 / -25 lines

claude-science/manage-on-devices Changed · +7 / -5 lines

claude-science/network-requirements Changed · +10 / -9 lines

claude-science/overview Changed · +3 / -2 lines

claude-science/run-on-remote-linux-server Changed · +11 / -11 lines

claude-science/run-on-windows New page · 56 lines, new page

claude-science/run-on-windows-wsl Page removed · 90 lines, page removed

connectors/custom/remote-mcp Changed · +7 / -7 lines

claude-science/compute-providers Changed · +1 / -1 lines

claude-science/custom-connectors Changed · +1 / -1 lines

claude-science/tools-and-environments Changed · +1 / -1 lines