Home Docs Claude Documentation

One capture · claude-docs

One read of Claude Documentationclaude-docs-20261013T230706Z

7 pages moved out of 265 read.

Pages moved 7 significant first

Pages read 265 in this capture

Captured 13 Oct 2026 23:07 UTC

Corpus hash 7ca494ede494 corpus-hash

What this read moved

1-7 of 7

claude-science/changelog Changed · +11 / -0 lines

from line 2

33> Release notes for Claude Science, including new features, improvements, and bug fixes by version.

5<Update label="0.1.61" description="October 13, 2026">

6 * Sessions you start in the Example project now show on the home screen

7 * A GitHub token you paste in **Settings > Credentials** now stays after a restart, instead of switching back to the token found on your computer; if yours switched back, paste it again

8 * Fixed some figures in Claude's answers showing a "Load" button where the picture should be

9 * Linux: fixed Featured connectors that run on your computer sometimes failing to start right after your first sign-in

10 * Linux: Claude Science now needs bubblewrap and socat installed for the whole system, from your distribution's packages or by an administrator. If yours came from conda, Homebrew, or a folder in your home directory, the app refuses to start and its message says what to do

11 * Windows: Claude Science is now signed with a renewed certificate from the same publisher, Anthropic, PBC. If your IT team allows the app by certificate thumbprint, add the new SHA-1 thumbprint `60C2D9C51F09822FFF4F194DE9EEDB67451292D1` and keep the previous one, both listed under [Windows signing certificate](/docs/claude-science/manage-on-devices#windows-signing-certificate)

12 * Security hardening of the analysis sandbox on Mac, Windows, and Linux

13 * Various bug fixes and security improvements

14</Update>

516<Update label="0.1.60" description="October 7, 2026">

617 * Mac: fixed a problem introduced in 0.1.59 where Python, R, and some shell commands could fail to run when Claude Science has access to many folders

718 * **Settings > Network > Package mirror** now shows a mirror credential file your organization deployed, instead of asking for a token

claude-science/get-started Changed · +4 / -4 lines

from line 43

4343 </Tab>

4444

4545 <Tab title="Linux">

46 Install the sandbox dependencies, then run the installer. The sandbox needs bubblewrap 0.8.0 or later and socat, and installing them takes administrator (root or `sudo`) access; if you don't have it, ask your system administrator to install them, or see [Run Claude Science without administrator access](/docs/claude-science/run-on-remote-linux-server#run-claude-science-without-administrator-access).

46 Install the sandbox dependencies, then run the installer. The sandbox needs bubblewrap 0.8.0 or later and socat, and installing them takes administrator (root or `sudo`) access. Claude Science runs them only from system folders such as `/usr/bin` and `/usr/local/bin` and doesn't search your PATH, so install them with your distribution's package manager, not with conda or Homebrew. If you don't have administrator access, ask your system administrator to install them, or see [Run Claude Science without administrator access](/docs/claude-science/run-on-remote-linux-server#run-claude-science-without-administrator-access).

4747

4848 * Ubuntu or Debian: `sudo apt-get update && sudo apt-get install -y curl bubblewrap socat`

4949 * Fedora or RHEL: `sudo dnf install -y curl bubblewrap socat`

from line 175

175175* The Windows app reports that it couldn't set up the app window engine: the first launch downloads that engine from `downloads.claude.ai`, and this usually means the app couldn't reach it. Check the internet connection, and on a corporate network ask IT to allow that domain (see [Network requirements](/docs/claude-science/network-requirements)).

176176* On Linux, the installer stops with `The download service may be unreachable, or not yet available in your region`: the installer couldn't get the latest version from `storage.googleapis.com`. Check the internet connection, and on a corporate network ask IT to allow that domain (see [Network requirements](/docs/claude-science/network-requirements#app-connections)). Claude Science is available where Anthropic offers claude.ai. See [Supported countries and regions](https://www.anthropic.com/supported-countries).

177177* On Linux, the shell reports `command not found` for `claude-science`: `~/.local/bin` isn't on your PATH. Add the PATH line that the installer printed to your shell profile, then open a new terminal.

178* On Linux, `claude-science serve` stops with `Sandbox unavailable: bwrap not found on PATH`: bubblewrap isn't installed, or isn't on your PATH. Install bubblewrap and socat with the command for your distribution in the Linux tab of [Install](#install).

179* On Linux, `claude-science serve` stops with `Sandbox unavailable: bwrap too old`: the installed bubblewrap is older than 0.8.0. Check the version with `bwrap --version`, then upgrade bubblewrap. Ubuntu 24.04's repositories carry a new enough version and Ubuntu 22.04's don't.

178* On Linux, `claude-science serve` stops with a `Sandbox unavailable:` message that says `bwrap not found in` a list of folders, or `bwrap was found on PATH at` a path: bubblewrap isn't installed in a system folder. Claude Science runs bubblewrap and socat only from the system folders that the message lists, such as `/usr/bin` and `/usr/local/bin`. It doesn't search your PATH, so it doesn't use a copy from conda, Homebrew, or a folder in your home directory. Install bubblewrap and socat with the command for your distribution in the Linux tab of [Install](#install).

179* On Linux, `claude-science serve` stops with a `Sandbox unavailable:` message such as `/usr/bin/bwrap is too old`: the bubblewrap it names is older than 0.8.0. Check its version in a terminal with that path, for example `/usr/bin/bwrap --version`, then upgrade bubblewrap. Ubuntu 24.04's repositories carry a new enough version and Ubuntu 22.04's don't.

180180* On Linux, `claude-science serve` stops with `Sandbox unavailable: bwrap cannot create unprivileged user namespaces`: the kernel or an AppArmor profile blocks the sandbox from creating user namespaces. The rest of the message names the settings to check on Ubuntu, Debian, and other distributions, and changing them takes administrator (`sudo`) access.

181* On Linux, an error says `socat is required for Linux sandbox networking but was not found in PATH`: socat isn't installed, or isn't on your PATH. Install socat with the command for your distribution in the Linux tab of [Install](#install).

181* On Linux, `claude-science serve` stops with `Sandbox unavailable: socat is required for Linux sandbox networking`: socat isn't installed in a system folder (Claude Science doesn't search your PATH, so it doesn't use a copy from conda, Homebrew, or a folder in your home directory). Install socat with the command for your distribution in the Linux tab of [Install](#install).

182182* Projects from another computer don't appear: by design, Claude Science keeps your work on the computer where it's installed, so each computer starts with its own projects. Your earlier projects are still on the other computer. See [Use Claude Science on more than one computer](/docs/claude-science/multiple-computers).

183183* Projects you created under another sign-in on this computer don't appear automatically, for example, after you move from a personal plan to your organization's Team plan: your earlier projects are still in that sign-in's folder. Select the **Review** button on the banner at the top of the home screen, or select **Review** next to **Access previously saved Claude Science work on this computer** under **Settings** > **General** > **Account**, to access them. On Team and Enterprise plans, if there's no banner and the setting is grayed out, your admin controls it. See [Access work from another sign-in on your computer](/docs/claude-science/multiple-computers#access-work-from-another-sign-in-on-your-computer).

184184* Sign-in stops at claude.ai: your account is on the Free plan (upgrade required), the redirect couldn't return (use **Paste code instead**), or your Team or Enterprise organization hasn't [enabled Claude Science](/docs/claude-science/enable-claude-science) yet.

claude-science/manage-on-devices Changed · +11 / -0 lines

## Windows signing certificate

from line 47

4747

4848Claude Science runs analysis code inside a local sandbox on the member's computer. On macOS, sandboxed analysis processes run as ordinary child processes and are visible to host-level EDR tools. On Windows, they run under the member's account inside a Windows AppContainer, the operating system's built-in app isolation, started by a sandbox launcher that ships inside the app, without WSL or Hyper-V. Windows asks once, optionally, for administrator approval so that Command Prompt scripts and git can run inside cells and PowerShell cells can change folders, while Python and R cells work without it. If security software holds the sandbox launcher or quarantines files in an analysis environment, Claude Science names the affected folder in its error message so you can add an exclusion. On Linux, sandboxed processes run inside a separate PID namespace with an isolated process view, so host-level EDR won't see them as ordinary children of the app.

4949

50## Windows signing certificate

52Claude Science for Windows is signed by Anthropic, PBC. If your security software allows apps by their signature, allow the publisher, Anthropic, PBC, rather than one exact certificate, because a renewed certificate has a new thumbprint.

54If you allow by SHA-1 thumbprint, keep both of these on your list until every PC runs version 0.1.61 or later:

56* **From version 0.1.61**: `60C2D9C51F09822FFF4F194DE9EEDB67451292D1` (valid until October 28, 2027)

57* **Through version 0.1.60**: `0D7581D2C51C59DF686C3000C70BF543F9F6C6CB`

59Windows still treats versions signed with the certificate used through version 0.1.60 as validly signed after that certificate expires, because each signature carries a trusted timestamp.

5061## Required updates

5162

5263Anthropic may set a minimum supported version of the app. When a member's installed version falls below that floor, the app shows a full-page notice that the installed version is no longer supported and blocks further use until the member updates. Admins don't configure this floor; it's set by Anthropic. If your organization distributes the app through its own channel with auto-update disabled, plan to push updates promptly when Anthropic raises the floor.

claude-science/run-on-remote-linux-server Changed · +5 / -5 lines

from line 28

2828

2929If you don't have administrator (root or `sudo`) access to a shared server or cluster, choose one of these:

3030

31* **Ask the server's administrator** to set up what the sandbox needs: bubblewrap 0.8.0 or later, socat, and a kernel that allows unprivileged user namespaces.

31* **Ask the server's administrator** to set up what the sandbox needs: bubblewrap 0.8.0 or later and socat, installed for the whole system (from the distribution's packages, or by root in `/usr/local/bin`), and a kernel that allows unprivileged user namespaces. Claude Science doesn't use a copy you install yourself with conda or Homebrew, or into your home folder.

3232* **Use the server as an SSH host.** Install Claude Science on your own computer and add the server as an SSH host (see [Remote compute clusters](/docs/claude-science/remote-compute-clusters)), if your organization allows SSH hosts. Claude runs jobs on the server under your own account, with your approval. Jobs run outside the sandbox, so the server doesn't need bubblewrap, socat, or the kernel setting, and you don't need administrator access there.

3333

34Administrators usually install bubblewrap and socat, and only an administrator can change the kernel setting. On Ubuntu 23.10 and later, bubblewrap can also need an AppArmor profile that lets it create user namespaces. Claude Science checks for these when it starts and names the first one that's missing. Once that's fixed, the next start names the next one, if any.

34An administrator installs bubblewrap and socat, and only an administrator can change the kernel setting. On Ubuntu 23.10 and later, bubblewrap can also need an AppArmor profile that lets it create user namespaces. Claude Science checks for these when it starts and names the first one that's missing. Once that's fixed, the next start names the next one, if any.

3535

3636Installing Claude Science itself doesn't need root or `sudo`. The installer puts the `claude-science` command in `~/.local/bin`, or in another folder you own if you export `CLAUDE_SCIENCE_INSTALL_DIR` with that folder's path before you run it.

3737

from line 96

9696| Symptom | What it means |

9797| - | - |

9898| `command not found: claude-science` | `~/.local/bin` isn't on your PATH yet. Run `. ~/.profile` or open a new terminal. |

99| An error mentioning `bwrap not found on PATH` | bubblewrap isn't installed, or isn't on your PATH. Install it as shown in [Install dependencies](#install-dependencies), or ask the server's administrator. |

100| An error mentioning `socat is required` | socat isn't installed, or isn't on your PATH. Install it as shown in [Install dependencies](#install-dependencies), or ask the server's administrator. |

101| An error mentioning `bwrap too old` | The server's bubblewrap is older than 0.8.0. Upgrade it, or use a distribution that ships a newer version, such as Ubuntu 24.04 or later. |

99| An error mentioning `bwrap not found in` or `bwrap was found on PATH at` | bubblewrap isn't installed in a system folder. Claude Science doesn't search your PATH, so it doesn't use a copy from conda, Homebrew, or a folder in your home directory. Install it as shown in [Install dependencies](#install-dependencies), or ask the server's administrator. |

100| An error mentioning `socat is required` | socat isn't installed in a system folder; Claude Science doesn't use a copy that's only elsewhere on your PATH. Install it as shown in [Install dependencies](#install-dependencies), or ask the server's administrator. |

101| An error mentioning `bwrap is too old` | The copy of bubblewrap that the message names is older than 0.8.0. Upgrade it, or use a distribution that ships a newer version, such as Ubuntu 24.04 or later. |

102102| An error mentioning `cannot create unprivileged user namespaces` | The kernel or an AppArmor profile blocks the sandbox from creating user namespaces; some Ubuntu 24.04 images restrict this. The error message names the settings to check on Ubuntu, Debian, and other distributions. |

103103| An error mentioning `port 8765 is already in use by another app` | Another program is using the port you chose with `--port`. Quit that program, or choose a different port. After you start Claude Science, `claude-science url` prints both ports to forward. |

104104| An error mentioning `port 8765 is already in use by another Claude Science daemon` | Another copy of Claude Science, probably one using a different data folder, holds the port. Run `claude-science stop` where that copy was started, or choose a different port. |

third-party/claude-desktop/ssh-remote-sessions Changed · +98 / -18 lines

### Where MCP servers run in a remote session ### Devices that move to an admin console organization ### Read-only folders on the remote host ### Your organization doesn't allow this SSH connection ### SSH to this device isn't available ### SSH sessions can't use your model provider settings ### Ask your IT administrator to set sshTransport to system-openssh ### This computer won't start Claude's SSH sign-in helper ### This computer's ssh refuses a backslash or dollar sign in user names ### SSH isn't allowed by your organization ### SSH to this machine isn't available ### Remote sessions aren't available with this inference setup

from line 30

3030

3131On a Linux or macOS host, if Claude Desktop stayed open, it rejoins the running engine when it reconnects after device sleep or a dropped SSH link. It catches up from the buffer, and loads the part of the conversation that the buffer has dropped from the transcript stored on the host. If it can't load all of it, the session shows "Some output produced while you were disconnected may be missing here."

3232

33### Where MCP servers run in a remote session

35An MCP server in a remote session runs on the device or on the host, depending on how it was added.

37* **[Managed MCP servers](/docs/third-party/claude-desktop/extensions#managed-mcp-servers-admin), and servers from plugins in the [`org-plugins` directory](/docs/third-party/claude-desktop/extensions#organization-plugins-admin)**: the device. Claude Desktop connects to the remote (HTTP or SSE) MCP servers and starts the local (stdio) ones on the device, and exposes them to the engine as tools.

38* **Local servers that a user adds under Settings > Developer**: the host, not the device. Claude Desktop sends the host a server's command, its arguments, and only those of its environment variables whose names start with `MCP_` or are one of a few fixed logging and runtime names, such as `DEBUG` and `NODE_ENV`. A secret in an argument or in an `MCP_` variable reaches the host. On a Linux or macOS host, Claude Desktop leaves out a server whose command is a path under a macOS or Windows folder, such as `/Applications/` or `C:\`.

39* **Servers bundled in any other plugin that Claude Desktop copies to the host**: the host. The engine starts the plugin's local servers there, and connects to its remote MCP servers from there.

40* **Servers in Claude Code's own configuration on the host**: the host. The engine reads files such as `~/.claude.json` in the SSH user's home directory and a project's `.mcp.json`, and starts their local servers and connects to their remote MCP servers from there.

42[`isLocalDevMcpEnabled`](/docs/third-party/claude-desktop/configuration#islocaldevmcpenabled), `managedMcpServers`, `allowedPluginMcpServers`, and `deniedPluginMcpServers` decide which of these servers a remote session loads, as they do for a local Code session (see [Applied as managed policy](/docs/third-party/claude-desktop/code#applied-as-managed-policy)). If the host has its own Claude Code managed settings, those take precedence over the Claude Code policy these keys produce (see [Managed configuration on the remote host](#managed-configuration-on-the-remote-host)).

3344## Enable SSH remote sessions

3445

3546Set [`sshHostAllowlist`](/docs/third-party/claude-desktop/configuration#sshhostallowlist) in your managed configuration. It appears in the **Code surface** section of the [in-app configuration window](/docs/third-party/claude-desktop/in-app-configuration) while Code is enabled.

from line 80

6980

7081Claude Code has its own `sshHostAllowlist` setting, which you can deploy on the device through a [Claude Code managed-settings file](https://code.claude.com/docs/en/settings#settings-files) or OS policy. The app resolves the two sources in this order:

7182

721. `sshHostAllowlist` from the Claude Desktop configuration, when that configuration is delivered by an administrator: through machine-scoped device management (`HKLM` policy on Windows, a configuration profile on macOS, `/etc/claude-desktop` on Linux), or by a bootstrap server the app trusts (a `bootstrapUrl` set through device management or covered by `trustBootstrapDelivery`; see [Keys that require user consent](/docs/third-party/claude-desktop/bootstrap#keys-that-require-user-consent)). User-scope registry policy (`HKCU`) counts as applied locally.

831. `sshHostAllowlist` from the Claude Desktop configuration, when that configuration is delivered by an administrator: through machine-scoped device management (`HKLM` policy on Windows, a configuration profile on macOS, `/etc/claude-desktop` on Linux), through the [Enterprise Admin Console](/docs/third-party/claude-desktop/admin-console), or by a bootstrap server the app trusts (a `bootstrapUrl` set through device management or covered by `trustBootstrapDelivery`; see [Keys that require user consent](/docs/third-party/claude-desktop/bootstrap#keys-that-require-user-consent)). User-scope registry policy (`HKCU`) counts as applied locally.

73842. `sshHostAllowlist` from Claude Code's managed settings on the device.

74853. `sshHostAllowlist` from a Claude Desktop configuration the user applied locally in the [in-app configuration window](/docs/third-party/claude-desktop/in-app-configuration#apply-locally-or-export-for-a-fleet).

75864. Off.

from line 87

7687

7788On devices where users applied the configuration locally, deploy `sshHostAllowlist` in Claude Code's managed settings. That restricts SSH without an MDM profile taking ownership of the whole configuration (see [Update keys and managed precedence](/docs/third-party/claude-desktop/mdm#update-keys-and-managed-precedence)).

7889

90### Devices that move to an admin console organization

92A device that gets its SSH keys from a managed profile, a registry policy, or the profile's bootstrap server moves to the configuration from the [Enterprise Admin Console](/docs/third-party/claude-desktop/admin-console) when its user signs in to an organization that uses the console and chooses that organization in the dialog that follows. The app then restarts. A device that used such an organization before its profile arrived, and whose user hasn't signed out of the app since, moves back at its first launch on Claude Desktop 2.37337.0 or later, with no new sign-in and without asking the user, even if the stored sign-in has expired. To prevent that, add `disableDeploymentModeChooser` to the profile before devices update. `forceLoginOrgUUID` prevents it only for organizations it leaves out. Before Claude Desktop 2.37337.0, a device with such a profile ignores the admin console.

94After the move, `sshHostAllowlist`, `sshTransport`, and `sshClientPath` from the profile, or from the profile's bootstrap server, don't apply, even where the console leaves them unset. For the profile's other settings, see [Which settings apply on a device with a managed profile](/docs/third-party/claude-desktop/admin-console#which-settings-apply-on-a-device-with-a-managed-profile).

96* **Which hosts**: the console's `sshHostAllowlist` applies. If the console leaves the key unset (**Not set**), or the app hasn't yet downloaded the console's configuration at this launch (the copy a device keeps of the last download holds no lists), `sshHostAllowlist` from Claude Code's managed settings on the device applies. With neither, SSH remote sessions are off.

97* **Which SSH client**: the console's `sshTransport` and `sshClientPath` apply. A key that the console leaves unset takes its default under [Host requirements](#host-requirements). Until the app has downloaded the console's configuration at a launch, both keys count as unset.

99To prevent or limit the move, set one of these keys in the profile itself:

100

101* **Keep the device on its profile**: set [`disableDeploymentModeChooser`](/docs/third-party/claude-desktop/configuration#disabledeploymentmodechooser) to `true`. The app ignores the admin console, and the sign-in screen doesn't offer **Or sign in with Claude.ai**. A device that has already moved returns to its profile at its next launch.

102* **Allow only your organization**: set [`forceLoginOrgUUID`](/docs/cowork/hipaa-setup#what-each-claude-desktop-key-does) to your organization ID, and set the SSH keys you rely on in the console too. The key also limits standard Claude Desktop sign-in on the device to your organization.

103

104Before you add either key to a profile that sets only [app-behavior keys](/docs/third-party/claude-desktop/mdm#update-keys-and-managed-precedence), such as `disableAutoUpdates`, read the warning under [Keep a device on its managed profile](/docs/third-party/claude-desktop/admin-console#keep-a-device-on-its-managed-profile).

105

79106## Inference credentials on the remote host

80107

81108<Warning>

from line 120

93120| [Amazon Bedrock Mantle](/docs/third-party/claude-desktop/mantle) | Bearer token, credential helper | |

94121| [Google Cloud's Agent Platform](/docs/third-party/claude-desktop/vertex) | In-app Workforce Identity sign-in, credential helper | In-app Google sign-in, service-account key or credentials file, application default credentials on the device |

95122

96When the configured credential is a refused kind, the session fails before anything is deployed to the host, with the card [Remote sessions aren't available with this inference setup](#remote-sessions-aren%E2%80%99t-available-with-this-inference-setup).

123When the configured credential is a refused kind, the session fails at session start, with the card [SSH sessions can't use your model provider settings](#ssh-sessions-can%E2%80%99t-use-your-model-provider-settings).

97124

98125When the remote engine's credential expires during a turn, Claude Desktop obtains a new one on the device, by re-running a [credential helper](/docs/third-party/claude-desktop/credential-helper) or using a sign-in's refresh token, and sends it over the SSH connection. When the user signs out of the inference provider in the app, Claude Desktop ends the remote engine.

99126

from line 133

106133* `disableEssentialTelemetry` and `disableNonessentialTelemetry`.

107134* `otlpEndpoint`, `otlpProtocol`, `otlpHeaders`, `otlpResourceAttributes`, and `otlpContentCapture`. Remote sessions appear in your collector under the same `service.name` as local Code sessions. A collector at `localhost` on the device is not forwarded. An `otlpHeadersHelper` runs on the device at session start, and the remote session keeps those headers for its lifetime.

108135* `disabledBuiltinTools`, `builtinToolPolicy`, `autoModeEnabled`, and `disableBypassPermissionsMode`.

109* [`allowedWorkspaceFolders`](/docs/third-party/claude-desktop/configuration#allowedworkspacefolders), evaluated against the host's filesystem. `~` is the SSH user's home on the host, `%VAR%` entries are ignored, and Claude Desktop refuses to start a session in a directory outside every entry, so a fleet value such as `~/Documents/Claude` confines remote sessions to that path under the SSH user's home. A folder with `mode` set to `ro` is allowed on the host but not read-only there.

136* [`allowedWorkspaceFolders`](/docs/third-party/claude-desktop/configuration#allowedworkspacefolders), evaluated against the host's filesystem. `~` is the SSH user's home on the host, `%VAR%` entries are ignored, and Claude Desktop refuses to start a session in a directory outside every entry, so with a fleet value such as `~/Documents/Claude`, remote sessions start only under that path in the SSH user's home. For an entry with `mode` set to `ro`, see [Read-only folders on the remote host](#read-only-folders-on-the-remote-host).

110137* [`blockReadsOutsideWorkingDirectories`](/docs/third-party/claude-desktop/configuration#blockreadsoutsideworkingdirectories), evaluated on the host, so the working directories and the home directory it hides from shell commands are the SSH user's there. Hiding files from shell commands needs the host's sandbox dependencies (next item); on a host without them, or a Windows host, shell reads outside the working directories ask for approval instead, and the file-tool restriction applies regardless. Files a user attaches to a remote session stay readable, except on a Windows host, where the session's plugin files and attachments stay outside the file tools' reach under this key.

111138* `coworkEgressAllowedHosts`, as Claude Code managed settings. The network and filesystem sandbox it produces with `allowedWorkspaceFolders` depends on the host having Claude Code's sandbox dependencies installed (see [Claude Code sandboxing](https://code.claude.com/docs/en/sandboxing)). Without them, commands run unsandboxed. See [Sandbox status on the remote host](#sandbox-status-on-the-remote-host) for the message the session shows.

112* `managedMcpServers`, as the Claude Code managed setting that keeps users from adding their own MCP servers. The managed servers themselves are reached from the device.

139* `managedMcpServers`, as the Claude Code managed setting that keeps the session from loading MCP servers that users define in Claude Code's own configuration on the host. The managed servers themselves are reached from the device (see [Where MCP servers run in a remote session](#where-mcp-servers-run-in-a-remote-session)).

113140* Plugins from your [allowed marketplaces](/docs/third-party/claude-desktop/extensions), copied to the host. A plugin's `hooks` directory is not copied, so its hooks do not run in a remote session, and a plugin whose manifest declares hooks elsewhere is not copied at all.

114141

115142If the host has its own Claude Code managed settings, those take precedence over the policy Claude Desktop supplies, as described under [Interaction with Claude Code's own managed settings](/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings) for local sessions.

116143

144### Read-only folders on the remote host

145

146On a Linux or macOS host, Claude Desktop applies `mode` set to `ro` on an [`allowedWorkspaceFolders`](/docs/third-party/claude-desktop/configuration#allowedworkspacefolders) entry by supplying Claude Code with permission rules that deny edits under the entry's path. The rules are Claude Code's own checks on what Claude does, not file permissions on the host. Where a folder must not change, use the host's file permissions to keep the SSH user from writing to it. Before Claude Desktop 2.31226.0, a folder with `mode` set to `ro` was allowed on the host but not read-only there.

147

148A remote session doesn't enforce `mode` in these cases:

149

150* **Windows hosts.**

151* **Hosts with their own Claude Code managed settings**: Claude Code ignores the rules, and the sandbox settings that Claude Desktop supplies with them, unless those settings set `parentSettingsBehavior` to `"merge"`. Under `"merge"` the host's own values still win where the two differ, so `sandbox.enabled` set to `false` there leaves shell commands unsandboxed (see [Interaction with Claude Code's own managed settings](/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings)).

152* **An entry that is or contains the SSH user's `~/.claude` folder, such as `~`**: Claude Code keeps its own files there. List narrower folders.

153

154Where the rules apply, they cover the following:

155

156* **Claude's file tools**: they refuse to create or change a file under the path, even in bypass permissions mode. A writable entry listed inside a read-only one is read-only for them too.

157* **Shell commands that Claude runs**: Claude Code's sandbox keeps them from writing under the path on a host where it runs, which on Linux needs Claude Code's [sandbox dependencies](https://code.claude.com/docs/en/sandboxing). The sandbox doesn't cover commands listed in Claude Code's `sandbox.excludedCommands`, or a path that contains one of `* ? [ ] ( ) { } | +` or a double quote. It may not stop commands in a folder that is listed through a symbolic link, so list each read-only folder by its real path, and keep it outside writable entries. On a host where the sandbox doesn't run, shell commands can still change the folder. For how the app reports that, see [Sandbox status on the remote host](#sandbox-status-on-the-remote-host).

158

159The rules don't bind the SSH user, or other programs that run under that account. MCP servers on the host, hooks from Claude Code's configuration on the host, and the session's terminal can change the folder, and Claude Desktop and Claude Code can create git worktrees inside it.

160

117161### Sandbox status on the remote host

118162

119163Claude Desktop asks Claude Code on the host whether the [sandbox](/docs/third-party/claude-desktop/code#applied-as-managed-policy) from your Claude Desktop policy is turned on and running there. The answer is Claude Code's own report, and it doesn't compare each allowed host or folder. Your policy includes the sandbox, and Claude Desktop asks, unless `coworkEgressAllowedHosts` contains `*` and `allowedWorkspaceFolders` is unset. Requires Claude Desktop 2.26454.0 or later.

from line 208

164208| Path on the host | Contents |

165209| - | - |

166210| `~/.claude/remote/srv/<version>/` | The remote server that Claude Desktop talks to |

167| `~/.claude/remote/ccd-cli/<version>` | The Claude Code engine, one file per version (the three most recent versions are kept) |

211| `~/.claude/remote/ccd-cli/` | The Claude Code engine, one file per build, under a name that starts with its version (the three most recent are kept) |

168212| `~/.claude/remote/run/<id>/` | The server's socket, token, and log |

169213| `~/.claude/remote/plugins/<id>/` | Plugins synced from the device, in one folder for each Claude Desktop installation that connects |

170214| `~/.claude/uploads/<session-id>/` | Files the user attached to a message. Not removed when the session ends |

from line 223

179223

180224Claude Desktop applies the host's entry in the user's `~/.ssh/config`. With the device's OpenSSH client (the default on macOS and Linux), `ssh` reads the entry itself, so settings such as `ProxyJump`, certificate host keys, and GSSAPI authentication apply, and the app still connects only to the resolved hostname that passed `sshHostAllowlist`. The built-in client (the default on Windows) applies the hostname, port, user, identity file, SSH agent, and `ProxyCommand`.

181225

182* For hosts behind a bastion, configure a `ProxyJump` or `ProxyCommand`. `ProxyJump` works only when the device's OpenSSH client carries the connection (the default on macOS and Linux); the built-in client refuses it with a message suggesting `ProxyCommand`.

226* For hosts behind a bastion, configure a `ProxyJump` or `ProxyCommand`. `ProxyJump` works only when the device's OpenSSH client carries the connection (the default on macOS and Linux). The built-in client refuses it. For the card that the user sees, see [Ask your IT administrator to set sshTransport to system-openssh](#ask-your-it-administrator-to-set-sshtransport-to-system-openssh).

183227* With the device's OpenSSH client, OpenSSH's own host key checking applies. For a host whose key isn't on record yet, where the app can show a prompt, it shows the key's fingerprint, asks the user whether to trust it, and records a trusted key in the user's `known_hosts` file, unless the user's own SSH configuration accepts new keys without asking. The app can't show a prompt on every connection, for example when it reconnects in the background. Distribute the host keys or a host certificate authority to the devices, so that each host's key is on record before users connect. `@cert-authority` entries are honored. A key that differs from the one on record for the host is refused, whatever the entry's `StrictHostKeyChecking` says, unless another setting in the SSH configuration that applies to the host takes that check away, such as `NoHostAuthenticationForLocalhost yes` for a host on a loopback address.

184228* With the built-in client, the host's key must already be in the device's `~/.ssh/known_hosts` as a plain entry. The app does not prompt to accept a new key and does not evaluate `@cert-authority` entries, so have users connect once from a terminal before adding the host in the app.

185229* With the built-in client, an identity file protected by a passphrase is skipped, not prompted for. Load it into the SSH agent, or use an unencrypted key. With the device's OpenSSH client, the app asks for the passphrase once the host's key is verified, and skips the key if the user cancels.

from line 241

197241

198242## Troubleshoot

199243

200### SSH isn't allowed by your organization

244### Your organization doesn't allow this SSH connection

201245

202The `sshHostAllowlist` in effect on this device is unset, empty, or has no entry that matches the host. The card's details say which. The name that must match is the `HostName` that the device's `~/.ssh/config` resolves the entered host to, so an entry that lists only an alias doesn't allow the host. Which configuration source supplies the key on a device follows [Interaction with Claude Code managed settings on the device](#interaction-with-claude-code-managed-settings-on-the-device). The connection test reports the same denial as "Your organization's settings do not allow this connection."

246The `sshHostAllowlist` in effect on this device is unset, empty, or has no entry that matches the host. The card's details say which. The name that must match is the `HostName` that the device's `~/.ssh/config` resolves the entered host to, so an entry that lists only an alias doesn't allow the host. Which configuration source supplies the key on a device follows [Interaction with Claude Code managed settings on the device](#interaction-with-claude-code-managed-settings-on-the-device). For a device that moved to an admin console organization, see [Devices that move to an admin console organization](#devices-that-move-to-an-admin-console-organization). The connection test reports the same denial as "Your organization's settings do not allow this connection." Before Claude Desktop 2.31226.0, the card's title was "SSH isn't allowed by your organization".

203247

204### SSH to this machine isn't available

248### SSH to this device isn't available

205249

206The host resolves to the device itself (`localhost`, `127.0.0.1`, or a tunnel or port forward that ends on the device) while `allowedWorkspaceFolders` restricts workspace folders. A session over SSH to the device reaches the same disk the policy restricts, so it is refused. Connect to a different host, or use a local session.

250The host resolves to the device itself (`localhost`, `127.0.0.1`, or a tunnel or port forward that ends on the device) while `allowedWorkspaceFolders` restricts workspace folders. A session over SSH to the device reaches the same disk the policy restricts, so it is refused. Connect to a different host, or use a local session. Before Claude Desktop 2.31226.0, the card's title was "SSH to this machine isn't available".

207251

208### Remote sessions aren't available with this inference setup

252### SSH sessions can't use your model provider settings

209253

210The configured inference credential is one of the kinds listed as refused under [Inference credentials on the remote host](#inference-credentials-on-the-remote-host), or the inference endpoint is on the device itself. The card's details say which. Switch the deployment to a credential kind that works on a remote host, or point the app at an endpoint the host can reach.

254The configured inference credential is one of the kinds listed as refused under [Inference credentials on the remote host](#inference-credentials-on-the-remote-host), or the inference endpoint is on the device itself. The card's details say which. Switch the deployment to a credential kind that works on a remote host, or point the app at an endpoint the host can reach. Before Claude Desktop 2.31226.0, the card's title was "Remote sessions aren't available with this inference setup".

211255

212256### SSH host key verification failed

213257

214258The host's key has changed, or it is not in the device's `~/.ssh/known_hosts` and was not trusted in the app (the built-in client never asks). Connect to the host from a terminal on the device to check and record the current key, then retry.

215259

260### Ask your IT administrator to set sshTransport to system-openssh

261

262The built-in client made the connection, and the host needs the device's OpenSSH client. Where the app can name a step, the card's title gives it, and the card's text gives the cause, either "Claude's built-in SSH library can't connect through a jump host (ProxyJump)." or "Claude's built-in SSH library can't check host keys against a certificate authority or another known\_hosts file."

263

264* **"Ask your IT administrator to set sshTransport to system-openssh"**: the built-in client is the device's default, and the device has a usable OpenSSH client. Set [`sshTransport`](/docs/third-party/claude-desktop/configuration#sshtransport) to `system-openssh`.

265* **"Ask your IT administrator to change sshTransport from builtin to system-openssh"**: your configuration sets `sshTransport` to `builtin`. Change it to `system-openssh`.

266* **"Ask your admin to correct the sshTransport setting"**: the app can't read the value that your configuration gives `sshTransport`, for example a misspelling, so the built-in client makes the connection. Correct the value. Requires Claude Desktop 2.37337.0 or later.

267* **"Ask your IT administrator to install Microsoft OpenSSH 9.4 or newer and set sshTransport to system-openssh, then quit and reopen Claude"**: the built-in client is the device's default, and the app found no usable OpenSSH client on the device. Install the client, and set the key.

268* **"Ask your IT administrator to install Microsoft OpenSSH 9.4 or newer, then quit and reopen Claude"**: `sshTransport` is `system-openssh`, and the app found no usable OpenSSH client on the device. Install the client.

269* **"Quit and reopen Claude; if this comes back, ask your IT administrator to let Claude use the system OpenSSH client"**: the device couldn't start the OpenSSH client earlier in this run of the app (see [Host requirements](#host-requirements)).

270

271Where the app can name no step, the card's title gives the cause: `<host> needs a jump host, which Claude can't use here`, with the text "A ProxyCommand for this host may work instead, once you quit and reopen Claude.", or `Claude can't check <host>'s key here`.

272

273These cards require Claude Desktop 2.31226.0 or later. Before Claude Desktop 2.31226.0, the built-in client refused a `ProxyJump` host with a message that suggests `ProxyCommand`.

274

275### This computer won't start Claude's SSH sign-in helper

276

277On a Windows device where the device's OpenSSH client makes the connection, Windows refused to start one of the helper programs through which Claude Desktop shows `ssh`'s prompts. Without them the app can't ask for a password or a one-time code, so the user can't sign in to a host that needs one. Select **View details** on the card for the blocked program's path and the error code. Allow `claude-ssh-askpass.exe`, `claude-ssh-broker.exe`, and `claude-ssh-proxy.exe` in that folder, then have the user try again. Requires Claude Desktop 2.37337.0 or later.

278

279### This computer's ssh refuses a backslash or dollar sign in user names

280

281On a macOS or Linux device where the device's OpenSSH client makes the connection, that client refuses the user name on its command line because the name has a `\` or a `$`, as in `DOMAIN\user`. Claude Desktop passes such a name to `ssh` in a configuration file that it writes, and shows this card where it can't. Select **View details** on the card and match the last line:

282

283* **`needs the Include line in this file to use a full path`**: the system's `ssh_config`, or a file read through it, has an `Include` with a relative path. The line names the file. Write that path in full, starting with `/`.

284* **`couldn't find which system ssh_config this ssh reads` or `couldn't write that file`**: have the user try again. With the second, the app couldn't write the file in a private temporary folder.

285* **`the name is the jump host's`**: the card's title is "This computer's ssh refuses the jump host's user name". In the user's `~/.ssh/config`, move the name from `ProxyJump` to a `User` line in the jump host's own `Host` block.

286

287This card requires Claude Desktop 2.37337.0 or later.

288

216289### Setup on the host fails after SSH connects

217290

218291SSH connected, but Claude Desktop couldn't place or start the remote server or the engine on the host. Select **View details** on the failure card to read the app's own message, which can end with a code in square brackets. Match the code, or the start of the message:

219292

220293* **`[SFTP_UNAVAILABLE]`**: the host's SSH server refused the SFTP subsystem. Enable `Subsystem sftp` in the server's `sshd_config`.

294* **`[SESSION_LIMIT]`**: the host's SSH server refused to open another session on the connection. Raise `MaxSessions` in the server's `sshd_config`, and reload the SSH server. See [Host requirements](#host-requirements).

295* **`[SFTP_NOT_STARTED]`**: the host's SSH server accepted the request for SFTP, but the SFTP server ended before its first answer, or text arrived in place of that answer. In a terminal on the device, run `sftp` with the same host, for example `sftp [email protected]`, to see what stops it. Then check the settings and files that the message names.

296* **`[EXEC_NO_INPUT]`**: the host's SSH server ran the app's command but passed it no input, which setup and the session's own link need. In a terminal on the device, run `echo hi | ssh` with the same host and `cat`, for example `echo hi | ssh [email protected] cat`. It prints `hi` on a host that passes input. Have the host's administrator let commands run over SSH receive input.

221297* **`[ENOSPC]` or `[EDQUOT]`**: a disk is full, or a quota is used up. In a message that starts with `Couldn't prepare the deploy locally`, the disk is the device's. In any other message it is the host's, so free space in the SSH user's home directory. [Host requirements](#host-requirements) gives the space the app needs.

222298* **`Unsupported remote platform`**: the host's operating system or processor isn't among those under [Host requirements](#host-requirements).

223* **`Couldn't install the Claude CLI on the remote (cli archive)`, with no code**: the engine's install on the host failed. One cause is a glibc older than 2.17, where the engine can't start and the remote server removes it. Run `ldd --version` on the host to check.

299* **`[CLI_NOT_RUNNABLE]`**: the remote server installed the engine, but the engine's first run didn't start or didn't exit cleanly, so the remote server removed it. One cause is a glibc older than 2.17. Run `ldd --version` on the host to check. Before Claude Desktop 2.37337.0, the message has no code and starts with `Couldn't install the Claude CLI on the remote (cli archive)`.

224300* **`[NO_INSTALL_RESULT]`**: the remote server's install step printed no result. A home directory mounted `noexec` is one cause.

301

302`[SESSION_LIMIT]` and `[SFTP_NOT_STARTED]` require Claude Desktop 2.31226.0 or later, and appear only when the device's OpenSSH client makes the connection. `[SESSION_LIMIT]` appears only on macOS and Linux devices. Their cards are titled `<host> allows too few SSH sessions per connection` and `SFTP doesn't start on <host>`.

303

304`[CLI_NOT_RUNNABLE]` and `[EXEC_NO_INPUT]` require Claude Desktop 2.37337.0 or later. `[EXEC_NO_INPUT]` appears only on Windows devices where the device's OpenSSH client makes the connection. Their cards are titled `Claude Code didn't run on <host>` and `<host> doesn't pass input to commands run over SSH`. From the same version, the card is titled `Couldn't copy Claude Code to <host>` where the app couldn't put its files on the host, and `Couldn't install Claude Code on <host>` where the engine's install failed, each for a cause with no card of its own.

225305

226306## Related

227307

claude-science/compute-providers Changed · +2 / -0 lines

from line 44

4444

4545Model endpoints are available in Claude Science on macOS and Linux. In Settings > Compute, under Model endpoints, click Connect on NVIDIA BioNeMo NIM. Import the skills from the BioNeMo Agent Toolkit, add your NVIDIA NGC API credential, and connect to NVIDIA-hosted API endpoint, or choose to run the model as a local container (On a machine with an NVIDIA GPU). Once connected, ask Claude to start a local Docker NIM container or set up a remote connection for a specific NIM skill from the BioNeMo Agent Toolkit.

4646

47To run a local container, install Docker for the whole computer. If Docker is installed only in your home folder, ask Claude to call it by its full path in the endpoint's start and stop scripts.

third-party/claude-desktop/local-access Changed · +1 / -1 lines

from line 23

2323| Field | Description |

2424| - | - |

2525| `path` | The folder path (required). Subfolders are included. |

26| `mode` | `rw` (the default) or `ro`. The agent can view and search a read-only folder but cannot modify it in Cowork. In Code sessions, read-only applies to Claude's file tools only; shell commands and [SSH remote sessions](/docs/third-party/claude-desktop/ssh-remote-sessions) do not enforce it. |

26| `mode` | `rw` (the default) or `ro`. The agent can view and search a read-only folder but cannot modify it in Cowork. In Code sessions other than SSH remote sessions, read-only applies to Claude's file tools only, and shell commands don't enforce it. For SSH remote sessions, see [Read-only folders on the remote host](/docs/third-party/claude-desktop/ssh-remote-sessions#read-only-folders-on-the-remote-host). |

2727| `isDefaultSelected` | When `true`, the folder appears already selected on the new-task page and skips the trust prompt. Users can remove it. |

2828

2929For example, `[{"path": "~/Documents/Claude"}, {"path": "/Volumes/Shared/Reference", "mode": "ro"}]` lets users work in their own folder and consult the shared reference folder without changing it.