Home Docs Claude Documentation

One capture · claude-docs

One read of Claude Documentationclaude-docs-20261015T203709Z

8 pages moved out of 267 read.

Pages moved 8 significant first

Pages read 267 in this capture

Captured 15 Oct 2026 20:37 UTC

Corpus hash 54c23a3d05da corpus-hash

What this read moved

1-8 of 8

claude-science/command-line-settings Changed · +3 / -3 lines

from line 15

1515| `claude-science status` | Print whether the program is running, the version, and the port, as JSON. |

1616| `claude-science logs` | Print the newest log file from the data directory. `--tail` follows it live. |

1717| `claude-science stop` | Stop the program cleanly. |

18| `claude-science update` | Check for and install an update. `--check` only reports; `--to <build>` installs a specific build, which is also how you roll back (see [Roll back to an earlier build](#roll-back-to-an-earlier-build)). Updates are signature-verified and replace the binary atomically. On a Mac where Claude Science opens in its own window, update the app with **Claude Science > Check for App Updates…** in the menu bar. |

1919| `claude-science import` `<path>` | Merge another data directory, or its database file, into this one. |

2020| `claude-science install` | Windows only. Install the app for your user account, with a PATH entry, a Start menu shortcut, and an uninstall entry under Windows **Settings > Apps > Installed apps**. Run it again to repair them. |

2121| `claude-science uninstall` | Windows only. Remove the app, its shortcuts, and its PATH entry while keeping your data; `--purge` also deletes the data directory. Quit Claude Science first. |

from line 28

2828

2929### Roll back to an earlier build

3030

31`claude-science update --to <build>` installs one specific build. `<build>` is an 8-character build ID such as `3f9a01bc`, not a version number. `claude-science update --check` prints the ID of the installed build as `Current`.

31On a Mac where Claude Science opens in its own window, `claude-science update --to` doesn't change the app, so you can't roll the app back this way. `claude-science update --to <build>` installs one specific build. `<build>` is an 8-character build ID such as `3f9a01bc`, not a version number. `claude-science update --check` prints the ID of the installed build as `Current`.

3232

33Claude Science checks for updates in the background and shows **Update available** when one is ready. Note the `Current` ID before you choose **Restart to update**, so you know which build to go back to.

33In a browser tab and in the Windows app, Claude Science checks for updates in the background and shows **Update available** when one is ready. Note the `Current` ID before you choose **Restart to update**, so you know which build to go back to.

3434

3535If a newer build has already changed how your data directory stores sessions, the command refuses an older build and installs nothing, because an older build can permanently lose part of every session it writes to. The refusal names a flag that overrides it, `--accept-layout-downgrade`, and says when that is safe. If you cannot tell from the message whether it is safe for you, do not add the flag.

3636

claude-science/corporate-networks Changed · +12 / -8 lines

### Proxy and certificates for updates in the Mac app window

from line 8

99* The app's own connections (sign-in, the Claude API, Anthropic-hosted connectors, update checks) traverse your outbound proxy and TLS inspection.

1010* The analysis sandbox's connections (package hosts and research databases, when Claude runs code) are filtered by the app's own network allowlist; package downloads can be redirected to your internal mirror.

11* Interactive previews load display libraries from public content-delivery networks in the browser, as ordinary browser traffic governed by your endpoint's web policy.

11* Interactive previews load display libraries from public content-delivery networks. In a browser tab, that's ordinary browser traffic governed by your endpoint's web policy. When Claude Science opens in its own window, previews load inside that window.

1212

1313## Setup at a glance

1414

from line 27

30| Network that only publishes a PAC or WPAD file | Not supported | Supported in the app window, which follows the proxy the script resolves (see [System proxy settings on macOS and Windows](#system-proxy-settings-on-macos-and-windows)) | Not supported |

30| Network that only publishes a PAC or WPAD file | Supported when Claude Science opens in its own window, not when it opens in a browser tab (see [System proxy settings on macOS and Windows](#system-proxy-settings-on-macos-and-windows)) | Supported in the app window, which follows the proxy the script resolves (see [System proxy settings on macOS and Windows](#system-proxy-settings-on-macos-and-windows)) | Not supported |

32| TLS inspection on the app's own connections (Zscaler, Netskope, and similar) | Supported with a CA bundle setting | Supported; a corporate root in the computer's certificate store is trusted automatically | Supported with a CA bundle setting |

32| TLS inspection on the app's own connections (Zscaler, Netskope, and similar) | Supported with a CA bundle setting. When Claude Science opens in its own window, its updates need the corporate root to be trusted by macOS (see [Proxy and certificates for updates in the Mac app window](#proxy-and-certificates-for-updates-in-the-mac-app-window)) | Supported; a corporate root in the computer's certificate store is trusted automatically | Supported with a CA bundle setting |

3434| TLS inspection on pip package downloads | Supported, with the corporate root also installed in the operating system's trust store (see [Corporate root for package downloads](#corporate-root-for-package-downloads)) | Supported automatically through the Windows certificate store | Supported, with the corporate root also installed in the operating system's trust store (see [Corporate root for package downloads](#corporate-root-for-package-downloads)) |

from line 157

157157

158158### System proxy settings on macOS and Windows

159159

160On macOS, Claude Science detects an explicit system web proxy automatically, so a machine whose proxy your MDM already sets needs no Claude Science configuration unless the proxy requires authentication. macOS keeps an authenticated proxy entry's credentials in the keychain, where Claude Science cannot read them, so connections through the detected proxy fail with HTTP 407 (see [the troubleshooting entry](#the-proxy-requires-its-own-sign-in-http-407)); set `[network] proxy` with the credentials in the address instead. When the network publishes only a PAC or WPAD file, Claude Science on macOS detects it and names the PAC URL in the sign-in error, but does not evaluate it. Set `[network] proxy` to the proxy the PAC file resolves to for Anthropic's hosts.

160On macOS, Claude Science detects an explicit system web proxy automatically, so a machine whose proxy your MDM already sets needs no Claude Science configuration unless the proxy requires authentication. macOS keeps an authenticated proxy entry's credentials in the keychain, where Claude Science cannot read them, so connections through the detected proxy fail with HTTP 407 (see [the troubleshooting entry](#the-proxy-requires-its-own-sign-in-http-407)); set `[network] proxy` with the credentials in the address instead. When the network publishes only a PAC or WPAD file, Claude Science in a browser tab names the PAC URL in the sign-in error but doesn't evaluate the file. Set `[network] proxy` to the proxy the PAC file resolves to for Anthropic's hosts.

161161

162162On Windows, Claude Science reads the proxy server and bypass list from Windows proxy settings at startup, which covers a proxy set under **Settings** > **Network & internet** > **Proxy**, in Internet Options, or by Group Policy, so a PC whose proxy your device management already sets needs no Claude Science configuration unless the proxy requires authentication. Windows proxy settings carry no credentials either, so for a proxy that requires Basic authentication, set `[network] proxy` with the credentials in the address. Bypass entries other than host names and domain suffixes are not applied, including the **Don't use the proxy server for local (intranet) addresses** option and entries written as IP ranges, so list internal domains in `[network] no_proxy`. To restart Claude Science on Windows after a settings change, quit it from its notification-area icon and open it again, because closing the window leaves it running.

163163

164164When the network publishes only a PAC or WPAD file, the Claude Science app window follows the proxy that the script resolves for Anthropic's hosts and restarts the app's background service once to apply it. A script-resolved proxy that demands a sign-in of any kind, refuses the connection, or does not answer within a few seconds is not used, and Claude Science keeps connecting as it did before, which on such a network means directly. For a proxy that needs credentials, set `[network] proxy` with them in the address. Claude Science started from a terminal with `claude-science serve` does not evaluate PAC files, so set `[network] proxy` there too.

165165

166### Proxy and certificates for updates in the Mac app window

167

168When Claude Science opens in its own window on a Mac, its updates use the proxy in macOS network settings, including a PAC or WPAD file. They also use the certificates that macOS trusts. A proxy set in the [`env` file](#how-the-environment-variables-reach-the-app), in `config.toml`, or in the **Proxy address** field under **Settings > Network** doesn't apply to them, and neither does `[network] ca_bundle`. For these updates, set the proxy in macOS network settings, and install your corporate root as a trusted certificate, for example with a configuration profile from your device management.

169

166170### How the environment variables reach the app

167171

168172How the variables reach the app depends on the operating system:

from line 173

169173

170174* On macOS, the Claude Science app reads a file named `env` in its data folder (`~/.claude-science/env` unless you moved the data folder) when it launches. The file holds `KEY=VALUE` lines (`export KEY=VALUE` also works). Put the three proxy variables there, then quit and reopen the app; an app started from the Dock or Finder does not see variables exported in a terminal. The file's `NO_PROXY` entries merge with the other sources rather than replacing them.

171175

172 The app applies only a fixed list of variables from this file, which includes the proxy variables and `DO_NOT_TRACK`, and skips any other line with a warning in `~/.claude-science/logs/app.log`. A `GITHUB_TOKEN` line, for example, is skipped, so add the token under **Settings > Credentials** (see [Environment variables](/docs/claude-science/command-line-settings#environment-variables)). Before version 0.1.56, the file could set any variable.

176 The app applies only a fixed list of variables from this file, which includes the proxy variables and `DO_NOT_TRACK`, and skips any other line with a warning in `~/.claude-science/logs/app.log`. When Claude Science opens in its own window on a Mac, the warning goes to `~/Library/Application Support/Claude Science/logs/host-local.log` instead. A `GITHUB_TOKEN` line, for example, is skipped, so add the token under **Settings > Credentials** (see [Environment variables](/docs/claude-science/command-line-settings#environment-variables)). Before version 0.1.56, the file could set any variable.

173177* On Windows, the app reads the variables from the user's environment when it starts, so set them as user environment variables, then quit Claude Science from its notification-area icon and open it again; variables typed into an open Command Prompt or PowerShell window do not reach an app started from the Start menu. Because Claude Science already follows Windows proxy settings, most PCs need no variables, and `[network] proxy` in `config.toml` is the form to deploy.

174178* On Linux, export the variables in the shell or service unit that starts `claude-science serve`. The `env` file is read only by the macOS app.

175179

176Only Basic proxy authentication, supplied in the proxy address, is supported; NTLM, Negotiate, and Kerberos proxies are not. On macOS and Linux, networks whose only published proxy configuration is a PAC or WPAD file are not supported either, because Claude Science does not evaluate PAC files there. On Windows, the app window follows a PAC or WPAD file as described under [System proxy settings on macOS and Windows](#system-proxy-settings-on-macos-and-windows).

180Only Basic proxy authentication, supplied in the proxy address, is supported; NTLM, Negotiate, and Kerberos proxies aren't. Claude Science doesn't evaluate PAC files on Linux or on a Mac where it opens in a browser tab, so networks that publish only a PAC or WPAD file aren't supported there. The app window on Windows and macOS follows a PAC or WPAD file as described under [System proxy settings on macOS and Windows](#system-proxy-settings-on-macos-and-windows).

177181

178182<Note>

179183 For a proxy that only speaks NTLM or Kerberos, a local relay such as `cntlm` or `px` works: the relay runs on the workstation, authenticates to your corporate proxy with the user's credentials, and exposes a plain HTTP proxy on the loopback interface. Point `HTTPS_PROXY` and `HTTP_PROXY` at the relay (for example `http://127.0.0.1:3128`). The loopback bypass governs which destinations skip the proxy, not whether the proxy can be reached, so a loopback relay works as a proxy address.

180184</Note>

181185

182Environment builds reach a configured [package mirror](#point-package-installs-at-an-internal-mirror) directly, not through the proxy. Separately, the `claude-science update` terminal command is its own process: it honors proxy variables exported in that shell but not the macOS `env` file, so export the variables in the terminal first. The background updater inside the running app uses the app's proxy settings.

186Environment builds reach a configured [package mirror](#point-package-installs-at-an-internal-mirror) directly, not through the proxy. Separately, on Linux, on Windows, and on a Mac where Claude Science opens in a browser tab, the `claude-science update` terminal command is its own process. It honors proxy variables exported in that shell but not the macOS `env` file, so export the variables in the terminal first. The background updater inside the running app uses the app's proxy settings, except on a Mac where Claude Science opens in its own window (see [Proxy and certificates for updates in the Mac app window](#proxy-and-certificates-for-updates-in-the-mac-app-window)).

183187

184188## Work behind TLS inspection

185189

from line 193

189193

190194### Corporate root for app connections

191195

192The `[network] ca_bundle` key in `config.toml` points at a PEM file whose certificates Claude Science adds to its default trust for sign-in, the Claude API, Anthropic-hosted connectors, update checks, and [cloud storage](/docs/claude-science/cloud-storage) access from Settings. For cloud storage, the corporate root applies to Amazon S3 and S3-compatible connections, and to Google Cloud Storage connections that use an HMAC key. The public roots stay in place, so the file holds only your corporate root. The path rules are in the [configuration file reference](/docs/claude-science/configuration-file-reference#app-connection-keys). A failing value is ignored with a warning rather than stopping the app, so a sign-in error behind inspection usually means the bundle did not load, and the app re-reads the bundle every few minutes (about every 30 minutes on Windows), so a corrected file takes effect without a restart. When you deploy a `config.toml`, deploy the bundle files alongside it.

196The `[network] ca_bundle` key in `config.toml` points at a PEM file whose certificates Claude Science adds to its default trust for sign-in, the Claude API, Anthropic-hosted connectors, update checks, and [cloud storage](/docs/claude-science/cloud-storage) access from Settings. On a Mac where Claude Science opens in its own window, the app's own updates use the certificates that macOS trusts instead (see [Proxy and certificates for updates in the Mac app window](#proxy-and-certificates-for-updates-in-the-mac-app-window)). For cloud storage, the corporate root applies to Amazon S3 and S3-compatible connections, and to Google Cloud Storage connections that use an HMAC key. The public roots stay in place, so the file holds only your corporate root. The path rules are in the [configuration file reference](/docs/claude-science/configuration-file-reference#app-connection-keys). A failing value is ignored with a warning rather than stopping the app, so a sign-in error behind inspection usually means the bundle did not load, and the app re-reads the bundle every few minutes (about every 30 minutes on Windows), so a corrected file takes effect without a restart. When you deploy a `config.toml`, deploy the bundle files alongside it.

193197

194198On Windows, when neither `[network] ca_bundle` nor `[conda] ca_bundle` (the **CA bundle path** field in **Settings**) is set, Claude Science automatically trusts the root certificates installed for the whole computer (the computer's **Trusted Root Certification Authorities** store, not the current user's) and rechecks that store about every 30 minutes, so a PC whose device management already installs your corporate root there needs no setting. Claude Science reads that store with Windows PowerShell, so on PCs where Windows PowerShell is blocked or restricted for users, set `[network] ca_bundle` for the app's own connections and `[conda] ca_bundle` for code inside sessions instead of relying on the store. If you do set `[network] ca_bundle` on Windows, the file is used instead of the store; write its path in single quotes, for example `'C:\ProgramData\corp\corporate-ca.pem'`, because a backslash inside double quotes is a TOML escape and a file that fails to parse stops Claude Science from starting.

195199

claude-science/get-started Changed · +12 / -7 lines

from line 9

99<Tabs>

1010 <Tab title="macOS">

1111 Download the installer from [claude.com/product/claude-science](https://claude.com/product/claude-science) and double-click to install. On first launch, the app sets up its runtime and starter Python and R environments, which takes a few minutes, then opens a new tab in your default browser. If no browser tab appears, click **Claude Science** in the Dock.

13 **Updates.** Installing an update from inside Claude Science can switch it from a browser tab to its own window. See [Claude Science in its own window on macOS](/docs/claude-science/mac-app-window).

15 * **If it opens in a browser tab**: Claude Science checks for updates in the background and shows **Update available** when one is ready. Choose **Restart to update** to install it.

16 * **If it opens in its own window**: Claude Science downloads updates by itself and installs them when you quit. To check for an update right away, choose **Claude Science > Check for App Updates…** in the menu bar.

1217 </Tab>

1318

1419 <Tab title="Windows">

from line 23

1823

1924 **Notification-area icon.** Closing the window leaves Claude Science running, with an icon in the notification area of the taskbar. Click the icon to reopen the window, or choose **Quit Claude Science** from the icon's menu to stop the app.

2025

21 **Updates.** Claude Science checks for updates in the background and shows **Update available** when one is ready; choose **Restart to update** to install it. Administrators who distribute the app themselves can turn the background check off with `[update] auto_update = false` (see [Manage Claude Science on devices](/docs/claude-science/manage-on-devices#deploy-configuration-with-device-management)). To update by hand instead, open a newer installer, which upgrades the installed copy in place and keeps your data.

26 **Updates.** Claude Science checks for updates in the background and shows **Update available** when one is ready; choose **Restart to update** to install it. Administrators who distribute the app themselves can turn the background check off with `auto_update = false` under `[update]` in `config.toml` (see [Manage Claude Science on devices](/docs/claude-science/manage-on-devices#deploy-configuration-with-device-management)). To update Claude Science yourself instead, open a newer installer, which upgrades the installed copy in place and keeps your data.

2227

2328 **Uninstall.** To remove the app, follow the Windows steps in [Uninstall Claude Science](#uninstall-claude-science).

2429

from line 69

6469</Tabs>

6570

6671<Note>

67 Claude Science is a local application, not a website, so there's no public URL to visit. On Windows it opens in its own window, and on macOS and Linux it opens in a browser tab. Open it from the application itself: Claude Science in Applications or the Dock on macOS, the Start menu on Windows, or the `claude-science` command on Linux. On a remote server, the sign-in link reaches your browser through an SSH tunnel; see [Run on a remote Linux server](/docs/claude-science/run-on-remote-linux-server).

72 Claude Science is a local application, not a website, so there's no public URL to visit. On Windows it opens in its own window, and on Linux it opens in a browser tab. On a Mac it opens in a browser tab, or in its own window once an update has switched it over (see [Claude Science in its own window on macOS](/docs/claude-science/mac-app-window)). Open it from the application itself: Claude Science in Applications or the Dock on macOS, the Start menu on Windows, or the `claude-science` command on Linux. On a remote server, the sign-in link reaches your browser through an SSH tunnel; see [Run on a remote Linux server](/docs/claude-science/run-on-remote-linux-server).

6873</Note>

6974

7075## Sign in and complete setup

7176

72When the app opens, sign in with your Claude account. On Windows, click the **Sign in on the web** button and confirm with **Continue**; the app opens claude.ai in your default browser and continues in the app window once you approve the sign-in there. No API key is required.

77When the app opens, sign in with your Claude account. If Claude Science opens in its own window, on Windows or on a Mac, click the **Sign in on the web** button and confirm with **Continue**. Claude Science then opens claude.ai in your default browser. Once you approve the sign-in there, Claude Science continues in its own window. No API key is required.

7378

74If you approve the sign-in in your browser but Claude Science doesn't continue (for example, on a remote server when the sign-in can't return through the SSH tunnel), sign in with a code instead:

79In a browser tab or in the Windows app, if you approve the sign-in in your browser but Claude Science doesn't continue (for example, on a remote server when the sign-in can't return through the SSH tunnel), sign in with a code instead:

7580

76811. Go back to the Claude Science sign-in screen and select **Paste code instead**, then **Open on web**.

77822. Approve access in the browser, then copy the whole code the page shows.

from line 127

122127 </Step>

123128 </Steps>

124129

125 To remove your data as well, delete the `~/.claude-science` folder.

130 To remove your data as well, delete the `~/.claude-science` folder. If Claude Science opened in its own window, also delete `~/Library/Application Support/Claude Science`, which holds that window's own settings and stored data.

126131 </Tab>

127132

128133 <Tab title="Windows">

from line 174

169174## Troubleshooting first launch

170175

171176* macOS says the application isn't supported, or the app icon appears crossed out: the download page picked the build for the wrong processor. Return to the download page and choose Mac (Intel) or Mac (Apple Silicon) to match your Mac. To check which you have, open the Apple menu, choose About This Mac, and look at the Chip or Processor line.

172* No browser tab appeared on macOS or Linux: on macOS, click **Claude Science** in the Dock. On Linux, copy the printed URL into a browser on the same machine, or run `claude-science url` to print a fresh one.

177* Nothing opened on macOS, or no browser tab appeared on Linux: on macOS, click **Claude Science** in the Dock, or open it from the **Applications** folder. On Linux, copy the printed URL into a browser on the same machine, or run `claude-science url` to print a fresh one.

173178* On macOS, some of Claude's tools can't start and the error mentions the Xcode license, usually right after an Xcode update: macOS won't run the Python that comes with Apple's developer tools until the license is accepted. Open Xcode and agree to the license with an administrator account, or run `sudo xcodebuild -license accept` in Terminal, then ask Claude to try again.

174179* A Claude Science message on Windows says the app was not installed because the file could not be confirmed: the copy you opened still runs but isn't installed. Download the installer again from [claude.com/product/claude-science](https://claude.com/product/claude-science) and open the new file. If the message persists, the PC could not verify the publisher's signature, so ask your IT team.

175180* The Windows app reports that it couldn't set up the app window engine: the first launch downloads that engine from `downloads.claude.ai`, and this usually means the app couldn't reach it. Check the internet connection, and on a corporate network ask IT to allow that domain (see [Network requirements](/docs/claude-science/network-requirements)).

from line 188

183188* On Linux, a line starting `[sandbox]` says `no usable socat command was found on this computer`, in the terminal where `claude-science serve` runs or in the output of `claude-science logs`: Claude Science started, but the sandbox has no network access. The sandbox runs socat only from system folders such as `/usr/bin`, and doesn't use a copy from conda, Homebrew, or a folder in your home directory. Code that Claude runs can't reach the internet, and environment setup can fail with `Package downloads are being blocked by network policy` even when your network blocks nothing. Install socat with the command for your distribution in the Linux tab of [Install](#install), or if you don't have administrator access, ask your system administrator to install it for the whole system.

184189* Projects from another computer don't appear: by design, Claude Science keeps your work on the computer where it's installed, so each computer starts with its own projects. Your earlier projects are still on the other computer. See [Use Claude Science on more than one computer](/docs/claude-science/multiple-computers).

185190* Projects you created under another sign-in on this computer don't appear automatically, for example, after you move from a personal plan to your organization's Team plan: your earlier projects are still in that sign-in's folder. Select the **Review** button on the banner at the top of the home screen, or select **Review** next to **Access previously saved Claude Science work on this computer** under **Settings** > **General** > **Account**, to access them. On Team and Enterprise plans, if there's no banner and the setting is grayed out, your admin controls it. See [Access work from another sign-in on your computer](/docs/claude-science/multiple-computers#access-work-from-another-sign-in-on-your-computer).

186* Sign-in stops at claude.ai: your account is on the Free plan (upgrade required), the redirect couldn't return (use **Paste code instead**), or your Team or Enterprise organization hasn't [enabled Claude Science](/docs/claude-science/enable-claude-science) yet.

191* Sign-in stops at claude.ai: your account is on the Free plan (upgrade required), the redirect couldn't return (in a browser tab or in the Windows app, use **Paste code instead**), or your Team or Enterprise organization hasn't [enabled Claude Science](/docs/claude-science/enable-claude-science) yet.

187192* After you paste a code, Claude Science says the code wasn't recognized or was issued for an earlier sign-in attempt: select **Open on web** again, approve access, and paste the whole new code. If it says `PKCE state missing or expired` instead, select **Back** and follow the steps in [Sign in and complete setup](#sign-in-and-complete-setup) again.

188193

claude-science/mac-app-window New page · 28 lines, new page

# Claude Science in its own window on macOS ## What changes when Claude Science switches to its own window ## Use Claude Science in its own window ## macOS permissions for Claude Science

A whole new page. There's nothing to diff it against, so here is what it says.

# Claude Science in its own window on macOS

> Keep working when Claude Science switches to its own window on a Mac: open, quit, and update it, and turn macOS permissions back on.

On a Mac, Claude Science can now run as its own app, in its own window, rather than in the browser. If yours opens in a browser tab, installing an update from inside Claude Science, such as with **Restart to update**, can switch it over. Installing an update doesn't switch a copy that another account on your Mac installed, such as one that your organization's device management installed. To check whether yours has switched, open Claude Science from your **Applications** folder after the update. If it still opens in a browser tab, it hasn't switched, and you keep using it as before.

<Note>
To manage Claude Science on your organization's Macs, see [Manage Claude Science on devices](/docs/claude-science/manage-on-devices#macs-where-claude-science-opens-in-its-own-window).
</Note>

## What changes when Claude Science switches to its own window

After the update that switches it over, Claude Science opens in its own window. If it doesn't, open it from your **Applications** folder. Close any old browser tab, even one that still says Claude Science is restarting or that the restart failed.

Your projects, conversations, artifacts, and Python and R environments are all there, and you stay signed in. If a setting such as the theme, the default model, or your pinned projects looks different, set it again.

macOS asks again for some [permissions](#macos-permissions-for-claude-science), and you turn others, such as Full Disk Access, back on yourself.

## Use Claude Science in its own window

* **Opening and quitting**: open Claude Science from your **Applications** folder. Closing the window keeps Claude Science and any sessions running. To quit, press Command-Q, which stops running sessions unless you started Claude Science from Terminal with `claude-science serve`.
* **Updates**: Claude Science downloads updates by itself and installs them the next time you quit. To check for an update right away, choose **Claude Science > Check for App Updates…** in the menu bar.

## macOS permissions for Claude Science

macOS treats Claude Science in its own window as a different app from the browser version, so macOS asks again for some permissions, such as access to your Documents or Desktop folder. Dictation needs microphone access. If dictation doesn't work, see [Dictation](/docs/claude-science/troubleshooting#dictation) in Troubleshoot Claude Science.

Access you turned on yourself, such as Full Disk Access, doesn't carry over from the browser version. To turn it on again, go to **System Settings > Privacy & Security**, choose the kind of access, and turn on the **Claude Science** toggle. If **Claude Science** isn't listed, click the add button (+) and choose **Claude Science** in the **Applications** folder. Do the same if a **Claude Science** entry is already on but Claude Science still can't reach your files, because that entry can be the browser version's.

claude-science/manage-on-devices Changed · +27 / -7 lines

## Macs where Claude Science opens in its own window

from line 2

33> Claude Science is a desktop application that stores member content locally.

5Claude Science is a desktop application that stores member content locally. This page covers what IT and endpoint teams need to know: where the app writes data, how to deploy configuration with device management, what telemetry is sent, and what members see when Anthropic requires an update.

5Claude Science is a desktop application that stores member content locally. This page covers what IT and endpoint teams need to know: where the app writes data, how to deploy configuration with device management, what changes when Claude Science opens in its own window on a Mac, what telemetry is sent, and what members see when Anthropic requires an update.

77## Where the app stores data

9The app writes to two locations on each member's computer:

9The app writes to these locations on each member's computer:

1010

1111Configuration: config.toml in the app's default data folder (`~/.claude-science/config.toml` on macOS and Linux, `%USERPROFILE%\.claude-science\config.toml` on Windows) holds all app settings. Every key is optional; the app starts with no file present. This is the file to deploy through device management.\

1212Data: the app's data directory holds conversations, generated artifacts, delegation configurations, and workspace files in a per-organization subfolder (orgs/`<organization-id>`/), stored as a local database plus files.

from line 13

1313

1414Authentication tokens and the shared package environment live under the default data folder (`~/.claude-science/`, or `%USERPROFILE%\.claude-science\` on Windows) regardless of the data directory, so endpoint backup or wipe policies that target the data directory don't affect sign-in state.

1515

16On Windows, the program itself installs per user to `%LOCALAPPDATA%\Programs\ClaudeScience` and registers under the signed-in user's **Settings** > **Apps** > **Installed apps** rather than machine-wide. The app also writes launch logs and state to `%LOCALAPPDATA%\ClaudeScience` and keeps a sandbox state folder under `%LOCALAPPDATA%`, and it unpacks components it runs, such as the app window engine and the sandbox launcher, under the data folder, so allow-listing by path needs both the program folder and the data folder. Uninstalling removes the program and sandbox state; `claude-science uninstall --purge` also removes the data and state folders.

16On Windows and macOS, the program is in these places:

1717

18* **Windows**: the program itself installs per user to `%LOCALAPPDATA%\Programs\ClaudeScience` and registers under the signed-in user's **Settings** > **Apps** > **Installed apps** rather than machine-wide. The app also writes launch logs and state to `%LOCALAPPDATA%\ClaudeScience` and keeps a sandbox state folder under `%LOCALAPPDATA%`, and it unpacks components it runs, such as the app window engine and the sandbox launcher, under the data folder, so allow-listing by path needs both the program folder and the data folder. Uninstalling removes the program and sandbox state; `claude-science uninstall --purge` also removes the data and state folders.

19* **macOS**: the app is **Claude Science** in the **Applications** folder, or in the **Applications** folder inside the member's home folder. When Claude Science opens in a browser tab, it runs its program from a copy at `~/.claude-science/bin/claude-science`. When it opens in its own window, it runs the program from inside the app. In its own window, Claude Science also keeps window settings, logs, and the window's page storage, which includes unsent message drafts, in `~/Library/Application Support/Claude Science` (see [Macs where Claude Science opens in its own window](#macs-where-claude-science-opens-in-its-own-window)).

1821Your endpoint tooling governs these folders the same way it governs any other local application data. Anthropic doesn't host a copy of these folders, so Custom Data Retention and Org Data Export don't reach them. [How Claude Science works with your data](/docs/claude-science/how-claude-science-works-with-your-data) covers what Anthropic does receive from the app, including the session transcripts available to Enterprise organizations with the Compliance API enabled.

1922

2023## Deploy configuration with device management

from line 26

2326

2427| Key | Effect |

2528| - | - |

26| disable\_telemetry = true | Stops the app from sending product-usage telemetry and error reports to Anthropic. |

27| data\_dir = "`<path>`" | Moves conversations, artifacts, and workspaces to a managed location (for example, a volume your backup tooling covers). |

28| \[update] auto\_update = false | Prevents the app from updating itself; pair with your own distribution channel. |

29| \[sandbox.network] enabled = false | Blocks network access from the app's local code-execution sandbox. The similarly named \[sandbox] network\_isolated key does not control this. |

29| `disable_telemetry = true` | Stops the app from sending product-usage telemetry and error reports to Anthropic. |

30| `data_dir = "<path>"` | Moves conversations, artifacts, and workspaces to a managed location (for example, a volume your backup tooling covers). |

31| `auto_update = false` under `[update]` | Turns off the background check for updates on Windows, on Linux, and on a Mac where Claude Science opens in a browser tab; pair with your own distribution channel. A member can still check for and install an update from inside Claude Science. |

32| `enabled = false` under `[sandbox.network]` | Blocks network access from the app's local code-execution sandbox. The similarly named `network_isolated` key under `[sandbox]` doesn't control this. |

3033

3134The [configuration file reference](/docs/claude-science/configuration-file-reference) documents the network-related keys and their defaults, and [Use Claude Science on a corporate network](/docs/claude-science/corporate-networks) covers the proxy, TLS-inspection, and mirror settings.

36## Macs where Claude Science opens in its own window

38On a Mac, Claude Science opens either in a browser tab or in its own window. When a member installs an update from inside Claude Science, the update can switch Claude Science to its own window. It switches only if the member's account owns the installed app and can replace it, so a copy that device management installed as root never switches. When the account that owns the app switches it, Claude Science opens in its own window for every account that opens that copy.

40Claude Science in its own window has the bundle identifier `com.anthropic.claudescience`, so macOS treats it as a different app from Claude Science in a browser tab. Add an entry for `com.anthropic.claudescience` to any Privacy Preferences Policy Control (PPPC) profile that grants Claude Science access. An allow-list rule on the Apple Team ID `Q6L2SF6YDW` covers both apps, and also the app's helper programs, which are signed with identifiers such as `com.anthropic.claudescience.helper`.

42Claude Science in a browser tab and in its own window get updates in different ways:

44| What differs | In a browser tab | In its own window |

45| - | - | - |

46| Updates | Checks in the background and shows **Update available** | Downloads updates by itself and installs them when the app quits |

47| Connections for updates | Use the app's proxy settings | Use the proxy in macOS network settings and the certificates that macOS trusts (see [Proxy and certificates for updates in the Mac app window](/docs/claude-science/corporate-networks#proxy-and-certificates-for-updates-in-the-mac-app-window)) |

49If the member's account can't write to the app or its folder, Claude Science in its own window doesn't check for updates in the background. The member can still choose **Claude Science > Check for App Updates…**, and macOS then asks for an administrator's password to install the update.

51Setting `auto_update = false` under `[update]` doesn't stop Claude Science from switching to its own window, because a member can still install an update from inside Claude Science.

3252

3353## Telemetry

3454

claude-science/network-requirements Changed · +6 / -1 lines

from line 92

9292

9393## Domains the member's browser loads

9494

95Sign-in pages and interactive previews load in the member's web browser, so they are governed by your web-filtering policy rather than the outbound proxy or the sandbox allowlist. If your policy blocks these domains, sign-in pages fail to load or interactive previews render blank or broken.

95The Claude sign-in pages load in the member's web browser, so they are governed by your web-filtering policy rather than the outbound proxy or the sandbox allowlist. Interactive previews load:

97* **When Claude Science opens in a browser tab**: in the member's web browser, under the same web-filtering policy.

98* **When Claude Science opens in its own window, on Windows or on a Mac**: inside that window.

100If your policy blocks these domains, sign-in pages fail to load or interactive previews render blank or broken.

96101

97102| Domain | Purpose |

98103| - | - |

claude-science/troubleshooting Changed · +18 / -2 lines

### Couldn't check for updates

from line 50

5050* If setup failed because of your organization's network, the dialog that **Details** opens links to settings for a package mirror, a CA bundle, or mirror credentials. When you save any of these settings, Claude Science retries the failed setups automatically. See also [Troubleshooting corporate network errors](/docs/claude-science/corporate-networks#troubleshooting-corporate-network-errors).

5151* To retry the environments that failed, select **Retry builds**.

5252

53If the notice reads "Analysis is unavailable" instead, no Python or R code can run until Claude Science restarts. Fix the cause the notice names, then quit and reopen Claude Science. On Windows, closing the window leaves Claude Science running, so right-click its icon in the notification area of the taskbar and choose **Quit Claude Science**.

53If the notice reads "Analysis is unavailable" instead, no Python or R code can run until Claude Science restarts. Fix the cause the notice names, then quit and reopen Claude Science. Closing the window or browser tab leaves Claude Science running, so quit it this way:

5454

55* **macOS**: Control-click **Claude Science** in the Dock and choose **Quit**.

56* **Windows**: right-click its icon in the notification area of the taskbar and choose **Quit Claude Science**.

57* **Started from a terminal with `claude-science serve`**: run `claude-science stop` in a terminal.

5559### failed to load 5 times in a row — automatic retries are paused

5660

5761This message appears in **Settings > Connectors** on a Featured connector marked **Failed** (hold the pointer over **Failed**) and on the connector's own page. The connector runs on your computer and failed to start five times in a row, so Claude Science stopped trying. Turn the connector off and on again in **Settings > Connectors**, or restart Claude Science.

from line 74

7074

7175## Updates

7276

73When an update is ready, Claude Science shows an "Update available" notice. If installing the update fails, that notice shows the error.

77Claude Science shows updates and their errors in these places:

7478

79* **In a browser tab and in the Windows app**: an "Update available" notice appears when an update is ready. If installing the update fails, that notice shows the error.

80* **In its own window on a Mac**: the **Updates** window shows the update and any error. Open it with **Claude Science > Check for App Updates…** in the menu bar.

7582### cannot reach the public release endpoint

7683

7784Claude Science couldn't reach the update server. Check your internet connection, then select **Restart to update** on the "Update available" notice to try again, or run `claude-science update` again. On a corporate network, see [Network requirements](/docs/claude-science/network-requirements#app-connections) for the domains Claude Science connects to.

from line 88

8188On the "Update available" notice, this means the new version was downloaded but didn't start. If Claude Science is still running, it's the version you had, and you can try again: select **Check for updates** under **Settings > General > About**, then select **Restart to update** there. If Claude Science has stopped, start it again.

8289

8390On Linux, an update to version 0.1.61 ends this way on a computer where bubblewrap or socat came from conda, Homebrew, or a folder in your home directory, because version 0.1.61 needs both installed for the whole system. Version 0.1.62 withdraws that requirement, so trying again as above now gets a version that starts. If Claude Science won't start at all, run `claude-science update` in a terminal, then start it again.

92### Couldn't check for updates

94On a Mac where Claude Science opens in its own window, the **Updates** window shows this message when Claude Science couldn't get update information from Anthropic's update server. The same steps apply when it says "Couldn't download the update":

96* If the window says to check your internet connection, check it, then select **Try again**.

97* If you cancelled a request from macOS for an administrator's password, select **Try again**.

98* Otherwise, such as when it says "Updates aren't available right now", wait a few minutes, then select **Try again**.

99* On a corporate network, ask your IT team to allow `storage.googleapis.com` (see [Proxy and certificates for updates in the Mac app window](/docs/claude-science/corporate-networks#proxy-and-certificates-for-updates-in-the-mac-app-window)).

84100

claude-science/configuration-file-reference Changed · +2 / -2 lines

from line 16

1616

1818| - | - | - | - |

19| `proxy` | string (URL) | unset | The outbound proxy for the app's HTTP and HTTPS connections, for example `http://proxy.example.corp:8080`. Supply Basic-authentication credentials in the address. An `https://` (TLS-to-proxy) address applies to the app's own connections only; sandboxed package downloads connect directly when the proxy is `https://`, so prefer `http://`. A proxy variable in the app's environment (including `ALL_PROXY`) takes precedence over this key, which takes precedence over the Settings proxy field and the proxy detected from macOS or Windows system settings. On a Mac where Claude Science opens in its own window, the app's own updates use the proxy in macOS network settings instead (see [Proxy and certificates for updates in the Mac app window](/docs/claude-science/corporate-networks#proxy-and-certificates-for-updates-in-the-mac-app-window)). |

2020| `no_proxy` | string (comma-separated) | unset | Hosts that bypass the proxy, as exact hostnames or domain suffixes in one comma-separated string, for example `".example.corp,registry.example.corp"`. Combined with the `NO_PROXY` environment variable and, when the macOS or Windows system settings supply the proxy address, the system's bypass list. Loopback addresses always bypass the proxy. |

21| `ca_bundle` | string (absolute path) | unset | PEM file added to the app's default TLS trust for sign-in, the Claude API, Anthropic-hosted connectors, update checks, and [cloud storage](/docs/claude-science/cloud-storage) access from Settings (Amazon S3, S3-compatible stores, and Google Cloud Storage with an HMAC key); use it for a corporate root behind TLS inspection. It covers the app's own connections only, while package downloads use `[conda] ca_bundle`. The value must be an absolute path outside the app's data directory (`~/.claude-science`), temporary directories, and any directory you have granted Claude write access to; a system location such as `/etc/claude-science/corporate-ca.pem`, or a folder under `C:\ProgramData` on Windows, is recommended. The file must exist, parse as a PEM bundle, and contain no private key; a failing value is ignored with a warning. On Windows, when this key and `[conda] ca_bundle` are both unset, the roots in the computer's Trusted Root Certification Authorities store are trusted automatically instead. |

21| `ca_bundle` | string (absolute path) | unset | PEM file added to the app's default TLS trust for sign-in, the Claude API, Anthropic-hosted connectors, update checks, and [cloud storage](/docs/claude-science/cloud-storage) access from Settings (Amazon S3, S3-compatible stores, and Google Cloud Storage with an HMAC key); use it for a corporate root behind TLS inspection. It covers the app's own connections only, while package downloads use `[conda] ca_bundle`. On a Mac where Claude Science opens in its own window, the app's own updates use the certificates that macOS trusts instead of this file. The value must be an absolute path outside the app's data directory (`~/.claude-science`), temporary directories, and any directory you have granted Claude write access to; a system location such as `/etc/claude-science/corporate-ca.pem`, or a folder under `C:\ProgramData` on Windows, is recommended. The file must exist, parse as a PEM bundle, and contain no private key; a failing value is ignored with a warning. On Windows, when this key and `[conda] ca_bundle` are both unset, the roots in the computer's Trusted Root Certification Authorities store are trusted automatically instead. |

2222| `mcp_x509_strict` | `"auto"`, `"relaxed"`, or `"strict"` | `"auto"` | How strictly local connectors check a corporate certificate's profile. With `"auto"`, Claude Science relaxes the strict check when it detects TLS inspection from a configured `[network] ca_bundle`. Connectors pick up a change at their next relaunch. |

2323

2424### Package download keys