Home Docs Claude Documentation

One capture · claude-docs

One read of Claude Documentationclaude-docs-20261022T163706Z

4 pages moved out of 278 read.

Pages moved 4 significant first

Pages read 278 in this capture

Captured 22 Oct 2026 16:37 UTC

Corpus hash 24b87d0152f7 corpus-hash

What this read moved

1-4 of 4

cowork/changelog Changed · +75 / -0 lines

from line 2

33> Release notes for Claude Desktop

5**v3.6556.1**

7Bundled Claude Code version: 2.1.308.

9**General**

11* Changed read-only `allowedWorkspaceFolders` entries with an unset or unsupported `%VAR%` (any on SSH hosts): the folder holding it turns read-only (`~/Work` for `~/Work/%X%/a`), or every allowed folder if it starts the entry. Another system’s variable (`%APPDATA%` on macOS or SSH) is still ignored.

12* Fixed chats from an interrupted bulk delete coming back with no notice; the next launch now lists them.

13* Fixed dictation problems: keyboard focus being lost or jumping behind an open dialog when a recording starts or ends, a click or Enter meant to finish a dictation sending your message when the recording had just failed, and an empty recording moving the cursor to the start of your draft.

14* Fixed editing a new chat’s first message while it was still sending, which sent the edit to a chat that did not exist and lost it. Edit now appears once Claude starts to reply.

15* Fixed renaming an open artifact from its title menu reloading it and clearing anything you had typed or selected in it.

16* Fixed Reset App Data on Windows sometimes deleting files outside Claude’s data folder.

18**Code**

20* Added the ability for Claude to press keys such as Return, Delete and the arrows, rotate the simulator, and show or hide the on-screen keyboard in the iOS Simulator.

21* Changed `allowedWorkspaceFolders` on SSH hosts: an entry is left out, and allows nothing, unless it is a full path for that host (`~/work`, not `work`; on Windows `C:\work`, not `\work`) with no `..`. A symbolic link listed inside another listed folder is left out too: list the folder it points to.

22* Changed a folder’s permission mode to be saved separately for this computer, each SSH host, and each WSL distribution. Folders set to Bypass permissions start in their default mode until you pick it again and confirm; on SSH and WSL, earlier picks more permissive than their default no longer apply.

23* Fixed deleting a session right after opening it, which left its transcript on this computer.

24* Fixed SSH sessions being ended or auto-archived while their task was still running, messages sent during a connection loss never being delivered, sessions opening with only part of their history, and refused sign-ins being retried in the background, which could count toward the host’s lock-out.

25* Fixed the cloud environment editor losing, changing or reordering environment variables, and adding backslashes, when a value mixes quotes and backslashes or contains both kinds of quote.

27**Cowork**

29* Changed MCP tools that their server marks as needing a person to ask only on the in-app card, so their notifications have no Allow button and scheduled tasks go on without those calls.

30* Removed `/schedule` from the slash menu; typing it now fills in a request to schedule the task, like the Schedule button.

31* Fixed Claude not finding your plugins and skills in scheduled tasks and other tasks not open on screen, except in third-party deployments.

32* Fixed earlier tasks missing from the list on some Windows computers where an older version of the app had started blank and signed out. They come back the next time the app starts.

33* Fixed screen readers saying only “Claude wants to use:” when focus moves to a request to use your computer, without naming the apps or access it asks for.

34* Fixed the notice for a failed workspace start sometimes not appearing, and tasks started from a plugin’s setup card, a connector’s suggested prompts or an onboarding suggestion being silently dropped after Claude’s workspace failed to start.

36**3P**

38* Added `headersHelperArgs` and `envHelperArgs` to `managedMcpServers` entries: arguments for the entry’s `headersHelper` or `envHelper`, so one helper script can serve several servers.

39* Added `installedUpdateEnforcementEnabled` and `installedUpdateEnforcementHours`. With `disableAutoUpdates` and the first `true`, Claude restarts into a version installed while open after the second’s hours (1 to 72; unset: 72, then once idle). On Windows (MSIX) it may stay closed until reopened.

40* Added `quickEntryScreenshotsEnabled` and `quickEntryFileSharingEnabled` on macOS. Set to `false`, they turn off screenshots (and the Screen Recording request) and attaching the file open in another app (and the Accessibility request), in Quick Entry and in @-mentions of an app’s window.

41* Added a “Relaunch to update” notice on macOS, Linux and Windows (MSIX installs) when a newer version is installed while the app is open on a device with `disableAutoUpdates` set.

42* Added cached token counts, read and written, to each tab on Settings > Usage, so that the tokens behind the estimated cost can be seen.

43* Added Storage to Settings > This computer > System: it shows the disk space Claude uses, lets you free up space by deleting inactive chats and Cowork tasks and cleaning up inactive Code sessions, and opens from the new low-disk-space warning or with `/storage` in Chat, Cowork and Code.

44* Changed `sshClientPath` (beta) on Windows to accept Git for Windows’ `ssh.exe` or another OpenSSH 8.5 or newer under Program Files. Device management, or the bootstrap server it names, must set the key and also set `sshTransport` to `system-openssh`.

45* Changed the approval prompt for `managedMcpServers` from a bootstrap server: for a remote connector with a helper script, it now shows where the helper’s output is sent and asks again when that address changes. People who approved such a connector are asked once more after updating.

46* Changed the built-in GitHub connector to ask before every call of `issue_write`, `sub_issue_write`, `pull_request_review_write`, `add_reply_to_pull_request_comment` and five write tools that `toolsets` can enable. An exact `toolPolicy` key, or `"*"`, can still allow them.

47* Changed the built-in GitHub connector’s `actions_run_trigger` tool to ask before every call whatever `toolPolicy` says. `toolPolicy` can still block it.

48* Changed the built-in Microsoft 365 connector’s tool for reading files, messages and folders to ask for approval once more in Chat and Cowork after this update, where “Always allow” had been chosen.

49* Changed the Setup window’s firewall allowlist to list `hcaptcha.com` and `*.hcaptcha.com` for sign-ins on Anthropic’s pages (Claude Console, admin console, Claude.ai import) and the hosts of MCP servers and plugin marketplaces that a bootstrap server or the admin console delivers. Export it again.

50* Changed update checks to use `releases.claude.com` when `bootstrapUrl` is on `config.claude.com` and `bootstrapEnabled` is not off, even with `updateViaUpdatesHost` off.

51* Improved how quickly Cowork lists recent tasks and chats at launch when many sessions are saved: recent ones appear first, with a placeholder row at the end of the list while older ones load.

52* Fixed Cowork and Code showing empty session, project and scheduled-task lists when the app starts while the bootstrap server is unreachable, on devices that fetched their configuration before and whose profile sets no `inferenceProvider`. Scheduled tasks now wait until the connection is restored.

53* Fixed Cowork’s live list of steps and progress notes showing only when a reply began with steps. It now follows whichever steps Claude is working on, also after text or an answered question.

54* Fixed gateway sessions quietly running a newer Opus when Opus 4 or 4.1 was picked. The picked model is now requested. If your gateway, or the provider behind it, no longer serves it, sessions and scheduled tasks on it now fail: remove it from your model list and move those tasks to another model.

55* Fixed plugins being uninstalled when an admin moves an `allowedPluginMarketplaces` entry to a new source: in the same change, set the new entry’s `expectedName` to the old marketplace’s name. Plugins that the marketplace takes from another repository are still uninstalled.

56* Fixed plugins installed from a marketplace folder on this computer having no Settings tab on their page in Customize, so Code tab sessions ran them without the values they ask for. Values entered earlier in a terminal must be entered again in that tab.

57* Fixed Quick Entry not starting anything; a Quick Entry prompt now starts a session.

59**v3.1623.4**

61Bundled Claude Code version: 2.1.308.

63**General**

65* Changed plugins that the app loads to ask before using the tools they pre-approve when your organization's Claude Code managed settings, such as `managed-settings.json`, set `allowManagedPermissionRulesOnly`.

67**Code**

69* Fixed GitHub's MCP server write tools showing a form that closed without creating anything.

71**Cowork**

73* No user-facing changes.

75**3P**

77* Changed which servers in Claude Code's `managed-mcp.json` are stopped by `isLocalDevMcpEnabled` set to `false` or by `allowedPluginMcpServers`: a local MCP server that uses `${VAR}` only in its `env` values now runs. One with a variable in its command or arguments is still stopped.

78* Fixed every request failing when a gateway or cloud provider rejects tool search; the request is now sent again without it.

580**v3.1623.1**

681

782Bundled Claude Code version: 2.1.304.

third-party/claude-desktop/configuration Changed · +456 / -373 lines

### The Self-hosted install column

The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.

from line 73

7373

7474The reference below is generated from the configuration schema and grouped to match the sidebar of the in-app configuration window. The **Availability** column shows whether a key can be set in an MDM profile, returned from a [bootstrap server](/docs/third-party/claude-desktop/bootstrap), or both. Its second line is the Claude Desktop version that added the key. For how the keys under **Models** work together, see [Models and effort levels](/docs/third-party/claude-desktop/models). For how `desktopHome` overrides the other keys under **Chat surface** and **Cowork surface**, see [Unified Claude](/docs/third-party/claude-desktop/unified-claude#how-unified-claude-interacts-with-chat-and-cowork-settings). For which key under **Session retention** covers a conversation started from the home screen, see [Automatic deletion of idle sessions](/docs/third-party/claude-desktop/data-storage#automatic-deletion-of-idle-sessions).

7575

76### The Self-hosted install column

78The self-hosted word matters only on a self-hosted install, where sessions run on a session host that your organization operates and not on the person's computer. The word says who acts on the key on such an install, and so where to set it; the text beside it gives the reason. On any other install, ignore it.

80* `server`: in the document your session host reads; the host applies it itself.

81* `reported`: in the same document; the host passes it on to Claude Desktop, which applies it in its own windows or on the person's computer.

82* `client`: in Claude Desktop's own configuration on the computer (device management, the local file, or a bootstrap server that configuration names); the session host ignores it.

83* `none`: nothing acts on it on a self-hosted install, whichever of those places sets it.

85One exception to the four words: where a device-management profile sets only app-behavior keys, that profile alone decides all of them (of the keys here: `disableAutoUpdates`, `installedUpdateEnforcementEnabled`, `installedUpdateEnforcementHours`, `autoUpdaterEnforcementHours`, `updateViaUpdatesHost`, `releaseChannel`, `relaunchEnforcementHours`, `configRecheckIntervalMinutes`, `egressProxyUrl`, `egressProxyPacUrl`).

87The word is what this Claude Desktop release declares. A session host acts on a `server` or `reported` key only from the host version that reads it; until then nothing applies the key on a self-hosted install, and Claude Desktop does not fall back to a value set on the computer.

7689## Connection

7790

79| - | - | - | - | - |

80| Custom inference headers `inferenceCustomHeaders` | `object` | MDM + Bootstrap Added in 1.8089.0 | — | Extra headers on every inference request — routing and tenant headers only (org IDs, Bedrock Guardrails). No credentials; use the credential helper for tokens. |

83| Helper script (Windows) `inferenceCredentialHelperWindows` | `string` | MDM + Bootstrap Added in 2.2553.0 | — | Absolute path of the helper executable on Windows devices, used there instead of Helper script. Leave unset to use Helper script on every operating system. |

85| Helper script TTL `inferenceCredentialHelperTtlSec` | `integer` | MDM + Bootstrap Added in 1.2581.0 | `3600` | Helper output is cached for this many seconds; once it expires the helper re-runs without a relaunch (before the next turn when set above 120). Defaults to `3600`. |

86| Credential helper timeout `inferenceCredentialHelperTimeoutSec` | `integer` | MDM + Bootstrap Added in 1.8089.0 | `60` | Maximum wait for the helper executable to finish. Raise this if the helper opens a browser for interactive sign-in. Defaults to `60`. Range: 1–600. |

87| Re-run helper for silent refresh `inferenceCredentialHelperSilentRefreshEnabled` | `boolean` | MDM + Bootstrap Added in 1.10628.0 | `true` | On credential expiry, re-run the helper (CLAUDE\_HELPER\_CONTEXT=mid-session-refresh) to recover silently. Turn off if the helper can’t run non-interactively. Defaults to `true`. |

90| Enable IPv6 in the workspace VM `coworkVmIpv6Enabled` | `boolean` | MDM + Bootstrap Added in 1.52386.0 | — | Give the Cowork workspace VM an IPv6 address and route so the agent’s tools can reach IPv6-only hosts through the device. macOS and Windows; off by default. |

93| Credential kind `inferenceCredentialKind` | `enum` | MDM + Bootstrap Added in 1.8555.0 | — | Selects the credential source. When set, only that source is used (no fallback). One of: `static`, `helper-script`, `interactive`, `vendor-profile`, `workforce`, `external-idp`. Deprecated: `inferenceCredentialKind: "oauth" (Vertex AI)` (accepted until October 7, 2026); use "interactive" — the same Google sign-in under its new name (in hosted or nested documents, switch once every desktop is on a release that knows the Vertex "interactive" kind). If it is still present after that, "oauth" will no longer be a Vertex AI credential kind: the value will be reported as invalid and ignored — the device will then derive the kind from the credential fields present (Google sign-in when an OAuth client id is set), and the hosted editor will refuse to save the configuration until the kind is changed. Deprecated: `inferenceCredentialKind: "interactive" together with inferenceVertexWorkforceAudience (Vertex AI)` (accepted until October 7, 2026); use "workforce" — or remove inferenceVertexWorkforceAudience if Google sign-in ("interactive") is what is meant. If it is still present after that, the audience will no longer imply Workforce Identity: the kind will stay "interactive" (Google sign-in), which needs inferenceVertexOAuthClientId — without it the configuration will be reported as incomplete and inference will not start. Deprecated: `inferenceCredentialKind: "interactive" together with inferenceGatewayOidc (gateway)`; use "external-idp" once every desktop in the fleet is on a release that reads it. The original spelling will keep working ("interactive" with inferenceGatewayOidc is read as "external-idp"); no end date has been set. |

92| - | - | - | - | - | - |

93| Inference provider `inferenceProvider` | `enum` | MDM + Bootstrap Added in 1.2581.0 | — | Selects the inference backend. Setting this key activates third-party mode. One of: `gateway`, `anthropic`, `bedrock`, `mantle`, `vertex`, `foundry`. | [`none`](#self-hosted-column) Part of the device's own route to the model, and a session host's route is its operator's to set |

94| Credential kind `inferenceCredentialKind` | `enum` | MDM + Bootstrap Added in 1.8555.0 | — | Selects the credential source. When set, only that source is used (no fallback). One of: `static`, `helper-script`, `interactive`, `vendor-profile`, `workforce`, `external-idp`. Deprecated: `inferenceCredentialKind: "oauth" (Vertex AI)` (accepted until October 7, 2026); use "interactive" — the same Google sign-in under its new name (in hosted or nested documents, switch once every desktop is on a release that knows the Vertex "interactive" kind). If it is still present after that, "oauth" will no longer be a Vertex AI credential kind: the value will be reported as invalid and ignored — the device will then derive the kind from the credential fields present (Google sign-in when an OAuth client id is set), and the hosted editor will refuse to save the configuration until the kind is changed. Deprecated: `inferenceCredentialKind: "interactive" together with inferenceVertexWorkforceAudience (Vertex AI)` (accepted until October 7, 2026); use "workforce" — or remove inferenceVertexWorkforceAudience if Google sign-in ("interactive") is what is meant. If it is still present after that, the audience will no longer imply Workforce Identity: the kind will stay "interactive" (Google sign-in), which needs inferenceVertexOAuthClientId — without it the configuration will be reported as incomplete and inference will not start. Deprecated: `inferenceCredentialKind: "interactive" together with inferenceGatewayOidc (gateway)`; use "external-idp" once every desktop in the fleet is on a release that reads it. The original spelling will keep working ("interactive" with inferenceGatewayOidc is read as "external-idp"); no end date has been set. | [`client`](#self-hosted-column) In self-hosted mode it names the device's sign-in to the host, never the host's model credential |

95| Sign-in session lifetime `inferenceSessionLifetimeSec` | `integer` | MDM + Bootstrap Added in 1.14271.0 | — | How long a sign-in stays valid under your IdP’s session policy. Shows a re-authenticate banner before it expires. | [`none`](#self-hosted-column) The session host is the one source for how long a sign-in to it lasts, and it reads no figure from this key |

96| Artifact preview iframe origin `userContentRendererUrl` | `string` | MDM + Bootstrap Added in 1.24012.0 | — | HTTPS origin of the user-content-renderer deployment used for artifact and file previews. Defaults to the commercial host when unset. | [`none`](#self-hosted-column) Names where Desktop loads its previews from, and no session host passes the setting on to Desktop yet |

97| Custom inference headers `inferenceCustomHeaders` | `object` | MDM + Bootstrap Added in 1.8089.0 | — | Extra headers on every inference request — routing and tenant headers only (org IDs, Bedrock Guardrails). No credentials; use the credential helper for tokens. | [`server`](#self-hosted-column) The host makes the model calls, so it adds the admin's headers to them |

98| Helper script `inferenceCredentialHelper` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | Absolute path to an executable that prints the credential, optionally with per-request headers. | [`client`](#self-hosted-column) Names a program on the person's computer, reused for the device's sign-in to the host |

99| Helper script (Windows) `inferenceCredentialHelperWindows` | `string` | MDM + Bootstrap Added in 2.2553.0 | — | Absolute path of the helper executable on Windows devices, used there instead of Helper script. Leave unset to use Helper script on every operating system. | [`client`](#self-hosted-column) Names a Windows program on the person's computer, reused for the device's sign-in to the host |

100| Helper script arguments `inferenceCredentialHelperArgs` | `string[]` | MDM + Bootstrap Added in 2.110.0 | — | Arguments passed to the helper script, one per entry, in order. Leave unset to run it with none. | [`client`](#self-hosted-column) Gives arguments to a helper program on the person's computer, reused for the device's sign-in to the host |

101| Helper script TTL `inferenceCredentialHelperTtlSec` | `integer` | MDM + Bootstrap Added in 1.2581.0 | `3600` | Helper output is cached for this many seconds; once it expires the helper re-runs without a relaunch (before the next turn when set above 120). Defaults to `3600`. | [`client`](#self-hosted-column) Sets how long the desktop app caches its helper's output, reused for the device's sign-in to the host |

102| Credential helper timeout `inferenceCredentialHelperTimeoutSec` | `integer` | MDM + Bootstrap Added in 1.8089.0 | `60` | Maximum wait for the helper executable to finish. Raise this if the helper opens a browser for interactive sign-in. Defaults to `60`. Range: 1–600. | [`client`](#self-hosted-column) Bounds a helper program on the person's computer, reused for the device's sign-in to the host |

103| Re-run helper for silent refresh `inferenceCredentialHelperSilentRefreshEnabled` | `boolean` | MDM + Bootstrap Added in 1.10628.0 | `true` | On credential expiry, re-run the helper (CLAUDE\_HELPER\_CONTEXT=mid-session-refresh) to recover silently. Turn off if the helper can’t run non-interactively. Defaults to `true`. | [`client`](#self-hosted-column) Decides how the desktop app re-runs its helper on the person's computer, reused for sign-in to the host |

104| Proxy server URL `egressProxyUrl` | `string` | MDM only Added in 1.44121.1 | — | Send the app’s and the agent’s traffic through this HTTP proxy instead of the operating system’s proxy settings. | [`client`](#self-hosted-column) Names the proxy for the person's computer, and a host's network belongs to its operator |

105| Proxy auto-config (PAC) URL `egressProxyPacUrl` | `string` | MDM only Added in 1.44121.1 | — | URL of a PAC file that decides the proxy per request. Wins over the proxy server URL when both are set. | [`client`](#self-hosted-column) Describes the network of the person's computer, which Desktop applies to its own traffic |

106| Enable IPv6 in the workspace VM `coworkVmIpv6Enabled` | `boolean` | MDM + Bootstrap Added in 1.52386.0 | — | Give the Cowork workspace VM an IPv6 address and route so the agent’s tools can reach IPv6-only hosts through the device. macOS and Windows; off by default. | [`none`](#self-hosted-column) Configures Cowork's local virtual machine, which a host session does not have |

107

108> **inferenceProvider details**

109>

110> Setting this key asks for 3P mode. The app opens in 3P mode unless the user chose to sign in to Claude.ai at the login screen, a choice `disableDeploymentModeChooser` removes. In 3P mode, if the selected provider's required credential keys are missing or invalid, the app shows a configuration error. A value the app cannot read (a misspelt, wrongly cased or unknown provider, or a value of the wrong type) still counts as set when machine-wide device management sent it: a macOS configuration profile, Windows policy under `HKLM`, or the root-owned policy file on Linux. The app then asks for 3P mode and, in 3P mode, shows a configuration error whose details name this key. An unreadable `bootstrapUrl` from the same sources counts the same way unless `bootstrapEnabled` is `false`. An unreadable value does not count where the user can write it: the local configuration file, or Windows policy under `HKCU`. Neither does an empty value (a value of only spaces is unreadable, not empty), or a Windows value of type `REG_BINARY`, `REG_MULTI_SZ` or `REG_QWORD`. Each of those reads as not set. When this key is not set, the app launches in standard mode unless another setting asks for 3P mode, such as a `bootstrapUrl` that `bootstrapEnabled` has not turned off. Keys for providers other than the selected one are ignored. Each provider's required keys are documented on its dedicated page under Inference providers.

94111

95112> **inferenceCustomHeaders details**

96113>

from line 170

153170>

154171> Unset (default): the VM is IPv4-only and its resolver returns no IPv6 answers. A change takes effect the next time the workspace VM starts, typically at the next app launch. Does not apply to the Cowork workspace VM on Linux or to Code sessions, which use the device's own network stack.

155172

156> **inferenceProvider details**

157>

158> Setting this key asks for 3P mode. The app opens in 3P mode unless the user chose to sign in to Claude.ai at the login screen, a choice `disableDeploymentModeChooser` removes. In 3P mode, if the selected provider's required credential keys are missing or invalid, the app shows a configuration error. A value the app cannot read (a misspelt, wrongly cased or unknown provider, or a value of the wrong type) still counts as set when machine-wide device management sent it: a macOS configuration profile, Windows policy under `HKLM`, or the root-owned policy file on Linux. The app then asks for 3P mode and, in 3P mode, shows a configuration error whose details name this key. An unreadable `bootstrapUrl` from the same sources counts the same way unless `bootstrapEnabled` is `false`. An unreadable value does not count where the user can write it: the local configuration file, or Windows policy under `HKCU`. Neither does an empty value (a value of only spaces is unreadable, not empty), or a Windows value of type `REG_BINARY`, `REG_MULTI_SZ` or `REG_QWORD`. Each of those reads as not set. When this key is not set, the app launches in standard mode unless another setting asks for 3P mode, such as a `bootstrapUrl` that `bootstrapEnabled` has not turned off. Keys for providers other than the selected one are ignored. Each provider's required keys are documented on its dedicated page under Inference providers.

159

160173### Anthropic

161174

163| - | - | - | - | - |

176| - | - | - | - | - | - |

177| Claude API key `inferenceAnthropicApiKey` | `string` | MDM + Bootstrap Added in 1.8089.0 | — | Leave blank to sign in with your browser, or to supply the key via a credential helper. | [`none`](#self-hosted-column) Part of the device's own route to the model, and a session host's route is its operator's to set |

165178

166179### Bedrock

167180

169| - | - | - | - | - |

182| - | - | - | - | - | - |

185| Bedrock service tier `inferenceBedrockServiceTier` | `enum` | MDM + Bootstrap Added in 1.5186.0 | — | Sent as the X-Amzn-Bedrock-Service-Tier header. Leave unset for on-demand. One of: `flex`, `priority`. | [`none`](#self-hosted-column) Part of the device's own route to the model, and a session host's route is its operator's to set |

186| AWS bearer token `inferenceBedrockBearerToken` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | Static bearer token for inference. For providers that support profile or helper-script credentials, prefer those. | [`none`](#self-hosted-column) Part of the device's own route to the model, and a session host's route is its operator's to set |

187| AWS SSO start URL `inferenceBedrockSsoStartUrl` | `string` | MDM + Bootstrap Added in 1.6259.0 | — | Enables in-app AWS sign-in (no AWS CLI needed). Set with the three SSO fields below. | [`none`](#self-hosted-column) Drives a browser sign-in on the person's computer, and a host never calls Bedrock as the person |

190| AWS SSO role name `inferenceBedrockSsoRoleName` | `string` | MDM + Bootstrap Added in 1.6259.0 | — | IAM Identity Center permission-set name granting bedrock:InvokeModel\* on the account above. | [`none`](#self-hosted-column) Names an AWS role for a browser sign-in that is only possible on the person's computer |

181194

182195> **inferenceBedrockServiceTier details**

183196>

from line 198

185198

186199### Foundry

187200

189| - | - | - | - | - |

191| Azure AI Foundry base URL `inferenceFoundryBaseUrl` | `string` | MDM + Bootstrap Added in 2.110.0 | — | Full base URL for a gateway or proxy in front of Foundry, path included (replaces [https://RESOURCE.services.ai.azure.com/anthropic](https://RESOURCE.services.ai.azure.com/anthropic)). |

202| - | - | - | - | - | - |

203| Azure AI Foundry resource name `inferenceFoundryResource` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | Azure AI Foundry resource name used to construct the endpoint URL. | [`none`](#self-hosted-column) Part of the device's own route to the model, and a session host's route is its operator's to set |

204| Azure AI Foundry base URL `inferenceFoundryBaseUrl` | `string` | MDM + Bootstrap Added in 2.110.0 | — | Full base URL for a gateway or proxy in front of Foundry, path included (replaces [https://RESOURCE.services.ai.azure.com/anthropic](https://RESOURCE.services.ai.azure.com/anthropic)). | [`none`](#self-hosted-column) Part of the device's own route to the model, and a session host's route is its operator's to set |

207| Entra ID client ID `inferenceFoundryClientId` | `string` | MDM + Bootstrap Added in 1.9255.0 | — | Application (client) ID of the Entra ID app registration. Device-code sign-in requires the app to allow public client flows. | [`none`](#self-hosted-column) Configures an Entra sign-in the person completes on their computer |

208| Entra ID sign-in flow `inferenceFoundryAuthFlow` | `enum` | MDM + Bootstrap Added in 1.19367.0 | — | How Entra sign-in runs: device code (default), system browser, or the OS identity broker. One of: `device-code`, `browser`, `broker`. | [`none`](#self-hosted-column) Chooses how the person's Entra sign-in runs on their computer |

196209

197210> **inferenceFoundryBaseUrl details**

198211>

from line 221

208221

209222### Gateway

210223

212| - | - | - | - | - |

214| Stream idle timeout `inferenceStreamIdleTimeoutSec` | `integer` | MDM + Bootstrap Added in 1.44121.1 | — | Extra seconds to wait for model output on a streaming response that is sending only keep-alive pings. Gateway provider only. Default 300. Range: 300–1800. |

216| Gateway auth scheme `inferenceGatewayAuthScheme` | `enum` | MDM + Bootstrap Added in 1.3036.0 | `bearer` | How the gateway credential is sent on the wire (Authorization: Bearer vs x-api-key header). One of: `bearer`, `x-api-key`. Defaults to `bearer`. Deprecated: `inferenceGatewayAuthScheme: "sso"`; use inferenceCredentialKind: "interactive". The original spelling will keep working; no end date has been set. |

217| Gateway sign-in flow `inferenceGatewayOidcAuthFlow` | `enum` | MDM + Bootstrap Added in 1.25927.0 | — | How the IdP sign-in runs: system browser (default) or the OS Microsoft Entra broker. One of: `browser`, `broker`. Deprecated: `inferenceGatewayOidcAuthFlow`; use inferenceIdpAuthFlow together with inferenceIdpOidc once every desktop in the fleet is on a release that reads them. The original spelling will keep working; no end date has been set. |

218| Gateway SSO IdP (OIDC) `inferenceGatewayOidc` | `object` | MDM + Bootstrap Added in 1.6889.0 | — | External IdP for gateway sign-in. The user’s token from this issuer is sent to the gateway as the Bearer credential. Deprecated: `inferenceGatewayOidc`; use inferenceIdpOidc with inferenceCredentialKind: "external-idp" once every desktop in the fleet is on a release that reads them. The original spelling will keep working; no end date has been set. |

221

222> **inferenceStreamIdleTimeoutSec details**

223>

224> Raises how long Cowork, Chat and Code sessions wait for the next model event on an open streaming response (Claude Code's `CLAUDE_STREAM_IDLE_TIMEOUT_MS`). It only helps when the gateway writes SSE keep-alive `ping` events (or `:` comment lines) into the response while the upstream model is silent — for example a LiteLLM proxy with keep-alive pings enabled in front of Amazon Bedrock. With pings arriving, Claude Code accepts at least about five minutes of keep-alives and then waits this many seconds more for real model output before abandoning the request. Gateway provider only; the other providers keep Claude Code's defaults.

225>

226> A response on which nothing at all arrives — no pings — still fails after about 5 minutes regardless of this key, because at the device a silent connection cannot be told apart from a dead one. If long generations fail behind a gateway that does not send pings, configure the gateway to send them rather than raising this value. A common case is automatic compaction, in which a session sends its whole conversation in one streaming request and waits for a long summary; when that request fails, the error reads `Prompt is too long · automatic compaction failed:` followed by the cause. While this key is set, the app's value takes precedence over `CLAUDE_STREAM_IDLE_TIMEOUT_MS` in Claude Code's own managed settings for sessions the app starts; when it is unset, that setting still applies. Values outside 300–1800 are rejected at parse time (the error is listed in the diagnostics report) and the default applies.

225| - | - | - | - | - | - |

228| Gateway auth scheme `inferenceGatewayAuthScheme` | `enum` | MDM + Bootstrap Added in 1.3036.0 | `bearer` | How the gateway credential is sent on the wire (Authorization: Bearer vs x-api-key header). One of: `bearer`, `x-api-key`. Defaults to `bearer`. Deprecated: `inferenceGatewayAuthScheme: "sso"`; use inferenceCredentialKind: "interactive". The original spelling will keep working; no end date has been set. | [`none`](#self-hosted-column) Part of the device's own route to the model, and a session host's route is its operator's to set |

229| Gateway sign-in flow `inferenceGatewayOidcAuthFlow` | `enum` | MDM + Bootstrap Added in 1.25927.0 | — | How the IdP sign-in runs: system browser (default) or the OS Microsoft Entra broker. One of: `browser`, `broker`. Deprecated: `inferenceGatewayOidcAuthFlow`; use inferenceIdpAuthFlow together with inferenceIdpOidc once every desktop in the fleet is on a release that reads them. The original spelling will keep working; no end date has been set. | [`none`](#self-hosted-column) Deprecated name for the choice of sign-in window on the person's computer |

230| Gateway SSO IdP (OIDC) `inferenceGatewayOidc` | `object` | MDM + Bootstrap Added in 1.6889.0 | — | External IdP for gateway sign-in. The user’s token from this issuer is sent to the gateway as the Bearer credential. Deprecated: `inferenceGatewayOidc`; use inferenceIdpOidc with inferenceCredentialKind: "external-idp" once every desktop in the fleet is on a release that reads them. The original spelling will keep working; no end date has been set. | [`none`](#self-hosted-column) Deprecated name for a sign-in that runs on the person's computer |

231| Identity provider sign-in flow `inferenceIdpAuthFlow` | `enum` | MDM + Bootstrap Added in 2.7032.0 | — | How the identity-provider sign-in runs: system browser (default) or the OS Microsoft Entra broker. One of: `browser`, `broker`. | [`client`](#self-hosted-column) Chooses a sign-in window on the person's computer, also used for the device's sign-in to the host |

232| Identity provider (OIDC) `inferenceIdpOidc` | `object` | MDM + Bootstrap Added in 2.7032.0 | — | Your organization’s OpenID Connect identity provider. The user’s token is sent as the Bearer credential to the gateway or the Bedrock proxy. | [`client`](#self-hosted-column) Configures an interactive sign-in on the person's computer, reused to sign the device in to the host |

233| Stream idle timeout `inferenceStreamIdleTimeoutSec` | `integer` | MDM + Bootstrap Added in 1.44121.1 | — | Extra seconds to wait for model output on a streaming response that is sending only keep-alive pings. Gateway provider only. Default 300. Range: 300–1800. | [`server`](#self-hosted-column) The host makes the model calls, so it sets how long a stream sending only keep-alive pings may wait for output |

227234

228235> **inferenceGatewayOidcAuthFlow details**

229236>

from line 296

291298

299> **inferenceStreamIdleTimeoutSec details**

300>

301> Raises how long Cowork, Chat and Code sessions wait for the next model event on an open streaming response (Claude Code's `CLAUDE_STREAM_IDLE_TIMEOUT_MS`). It only helps when the gateway writes SSE keep-alive `ping` events (or `:` comment lines) into the response while the upstream model is silent — for example a LiteLLM proxy with keep-alive pings enabled in front of Amazon Bedrock. With pings arriving, Claude Code accepts at least about five minutes of keep-alives and then waits this many seconds more for real model output before abandoning the request. Gateway provider only; the other providers keep Claude Code's defaults.

302>

303> A response on which nothing at all arrives — no pings — still fails after about 5 minutes regardless of this key, because at the device a silent connection cannot be told apart from a dead one. If long generations fail behind a gateway that does not send pings, configure the gateway to send them rather than raising this value. A common case is automatic compaction, in which a session sends its whole conversation in one streaming request and waits for a long summary; when that request fails, the error reads `Prompt is too long · automatic compaction failed:` followed by the cause. While this key is set, the app's value takes precedence over `CLAUDE_STREAM_IDLE_TIMEOUT_MS` in Claude Code's own managed settings for sessions the app starts; when it is unset, that setting still applies. Values outside 300–1800 are rejected at parse time (the error is listed in the diagnostics report) and the default applies.

304

292305### Models

293306

295| - | - | - | - | - |

299| Default model effort `defaultModelEffort` | `enum` | MDM + Bootstrap Added in 2.110.0 | — | Effort level the default model (the first listed model) starts at, instead of Anthropic’s recommended level: low, medium, high, xhigh or max. One of: `low`, `medium`, `high`, `xhigh`, `max`. |

300| Always start with the default model `alwaysStartWithDefaultModel` | `boolean` | MDM + Bootstrap Added in 2.110.0 | — | When true, each new conversation or task starts on the default model, and a person’s model and effort changes are no longer saved as their default. |

308| - | - | - | - | - | - |

310| Use 1M wherever it’s available `modelPrefer1mContext` | `boolean` | MDM + Bootstrap Added in 1.28929.0 | — | Every model that offers 1M, in your list or from your gateway, shows one option and requests 1M. | [`server`](#self-hosted-column) When on, the host gives a session that names no model the 1M-token context, and tells Desktop |

312| Default model effort `defaultModelEffort` | `enum` | MDM + Bootstrap Added in 2.110.0 | — | Effort level the default model (the first listed model) starts at, instead of Anthropic’s recommended level: low, medium, high, xhigh or max. One of: `low`, `medium`, `high`, `xhigh`, `max`. | [`server`](#self-hosted-column) The host sets the effort of a session that names none, and tells Desktop what to preselect |

313| Always start with the default model `alwaysStartWithDefaultModel` | `boolean` | MDM + Bootstrap Added in 2.110.0 | — | New conversations and tasks start on the default model and effort level, not each person’s last-used ones. People can still change both for the current one. | [`reported`](#self-hosted-column) Desktop's model picker acts on it, starting each new session on the default model |

314| Show estimated cost `inferenceModelPricingEnabled` | `boolean` | MDM + Bootstrap Added in 1.37937.0 | — | Show an estimated cost on the Usage page at Anthropic list price; turn on to set a multiplier or per-model rates. | [`server`](#self-hosted-column) When on, the host gives its sessions the admin's rates and multiplier; Desktop shows cost once they report it per turn |

315| Price multiplier `inferenceModelPricingMultiplier` | `number` | MDM + Bootstrap Added in 1.37937.0 | — | Scales every estimated cost (0.85 = 85% of the price); between 0 and 1. Range: 0–1. | [`server`](#self-hosted-column) While Show estimated cost is on, the host hands Claude Code this multiplier for the cost its sessions report |

316| Model pricing `inferenceModelPricing` | `object[]` | MDM + Bootstrap Added in 1.37937.0 | — | Per-model rates replacing Anthropic list price in the Usage page’s estimate. | [`server`](#self-hosted-column) While Show estimated cost is on, the host hands Claude Code these rates for the cost its sessions report |

317| Model catalog metadata `modelCatalogEnabled` | `boolean` | MDM + Bootstrap Added in 2.110.0 | — | Fetch the published Claude Code model catalog to get model picker names, descriptions, and effort options. When off, the app uses only its bundled copy. | [`server`](#self-hosted-column) The host serves the model catalog's rows to Desktop, and to nobody for whom this is off |

318| Model catalog URL `modelCatalogUrl` | `string` | MDM + Bootstrap Added in 2.110.0 | — | Fetch the model catalog and its signature file from this URL (a mirror inside your network serving Anthropic’s published files) instead of downloads.claude.ai. | [`reported`](#self-hosted-column) Only Desktop versions too old to take the model catalog's rows from their session host fetch from here |

306319

307320> **modelDiscoveryEnabled details**

308321>

from line 407

394407

395408### Vertex

396409

398| - | - | - | - | - |

403| Vertex OAuth client secret `inferenceVertexOAuthClientSecret` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | Secret for the Desktop-app OAuth client above. Google classifies installed-app client secrets as non-confidential, so this may be set from hosted config. |

405| Vertex OAuth login hint `inferenceVertexOAuthLoginHint` | `string` | MDM + Bootstrap Added in 1.12603.0 | — | Pre-fill Google's account chooser and forward to your federated IdP. \{username} expands to the OS login name. |

409| Workforce Identity IdP (OIDC) `inferenceVertexWorkforceOidc` | `object` | MDM + Bootstrap Added in 1.10628.0 | — | Your organization’s OIDC IdP. The app runs an authorization-code-with-PKCE flow against this issuer and exchanges the returned ID token at GCP STS. |

411| - | - | - | - | - | - |

415| Vertex OAuth client ID `inferenceVertexOAuthClientId` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | Desktop-app OAuth client ID. Enables Sign in with Google instead of a credentials file. | [`none`](#self-hosted-column) Configures a Google browser sign-in on the person's computer, and a host calls Vertex as its own identity |

416| Vertex OAuth client secret `inferenceVertexOAuthClientSecret` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | Secret for the Desktop-app OAuth client above. Google classifies installed-app client secrets as non-confidential, so this may be set from hosted config. | [`none`](#self-hosted-column) Secret for the person's own Google sign-in, and a host calls Vertex as its own Google identity |

417| Vertex OAuth scopes `inferenceVertexOAuthScopes` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | Override the Google OAuth scopes (space-separated). Leave blank for the default. | [`none`](#self-hosted-column) Sets scopes for a browser sign-in on the person's computer, and a host calls Vertex as its own identity |

418| Vertex OAuth login hint `inferenceVertexOAuthLoginHint` | `string` | MDM + Bootstrap Added in 1.12603.0 | — | Pre-fill Google's account chooser and forward to your federated IdP. \{username} expands to the OS login name. | [`none`](#self-hosted-column) Steers a browser sign-in on the person's computer, and a host calls Vertex as its own Google identity |

419| Workforce Identity audience `inferenceVertexWorkforceAudience` | `string` | MDM + Bootstrap Added in 1.10628.0 | — | Workforce-pool provider audience. When set, sign-in uses your own IdP plus a GCP STS exchange instead of a Google identity. | [`none`](#self-hosted-column) Configures a sign-in the person completes on their computer, and a host calls Vertex as its own identity |

420| Workforce Identity billing project `inferenceVertexWorkforceUserProject` | `string` | MDM + Bootstrap Added in 1.10628.0 | — | GCP project for STS billing and quota. Defaults to the Vertex project ID above. | [`none`](#self-hosted-column) Bills the exchange of the person's own sign-in token, and a host calls Vertex as its own identity |

421| Workforce Identity sign-in flow `inferenceVertexWorkforceAuthFlow` | `enum` | MDM + Bootstrap Added in 1.25927.0 | — | How the IdP sign-in runs: system browser (default) or the OS Microsoft Entra broker. One of: `browser`, `broker`. | [`none`](#self-hosted-column) Chooses how the person signs in on their computer, and a host calls Vertex as its own identity |

422| Workforce Identity IdP (OIDC) `inferenceVertexWorkforceOidc` | `object` | MDM + Bootstrap Added in 1.10628.0 | — | Your organization’s OIDC IdP. The app runs an authorization-code-with-PKCE flow against this issuer and exchanges the returned ID token at GCP STS. | [`none`](#self-hosted-column) Sets up the person's sign-in on their own computer, and a host calls Vertex as its own Google identity |

411424

412425> **inferenceVertexWorkforceAuthFlow details**

413426>

from line 447

434447

435448### Authentication

436449

438| - | - | - | - | - |

451| - | - | - | - | - | - |

452| Disable Claude.ai sign-in `disableDeploymentModeChooser` | `boolean` | MDM + Bootstrap Added in 1.3834.0 | `false` | Users see only this provider at the login screen. The option to sign in to Claude.ai is hidden. Defaults to `false`. | [`client`](#self-hosted-column) Shapes Desktop's sign-in screen and configuration source, settled before Desktop reaches the host |

453| Disable claude:// deep-link handling `disableDeepLinkRegistration` | `boolean` | MDM + Bootstrap Added in 1.6889.0 | `false` | Stop external apps and websites from opening Claude Desktop via claude:// links. Defaults to `false`. | [`client`](#self-hosted-column) Desktop registers claude:// links on the person's computer at launch, before it has signed in to the host |

441454

442455> **disableDeploymentModeChooser details**

443456>

from line 458

445458

446459### Built-in browser

447460

449| - | - | - | - | - |

450| Allow the built-in browser `builtinBrowserEnabled` | `boolean` | MDM + Bootstrap Added in 2.2553.0 | `false` | Offer the built-in browser in Cowork and Code sessions so users and Claude can open and work with web pages. Site sign-ins stay on the device until cleared. Defaults to `false`. |

451| Default site policy in the built-in browser `builtinBrowserDefaultDomainPolicy` | `enum` | MDM + Bootstrap Added in 2.2553.0 | `allow` | Whether Claude may open sites in the built-in browser by default; the allowed or blocked list is the exception. Mirrors the Claude in Chrome site policy. One of: `allow`, `block`. Defaults to `allow`. |

452| Allowed sites in the built-in browser `builtinBrowserAllowedDomains` | `string[]` | MDM + Bootstrap Added in 2.2553.0 | — | Sites Claude may open, read, and act on in the built-in browser when the default site policy is block. Users can still view other sites. |

453| Blocked sites in the built-in browser `builtinBrowserBlockedDomains` | `string[]` | MDM + Bootstrap Added in 2.2553.0 | — | Sites Claude may not open, read, or act on in the built-in browser when the default site policy is allow. Users can still view them. |

462| - | - | - | - | - | - |

463| Allow the built-in browser `builtinBrowserEnabled` | `boolean` | MDM + Bootstrap Added in 2.2553.0 | `false` | Offer the built-in browser in Cowork and Code sessions so users and Claude can open and work with web pages. Site sign-ins stay on the device until cleared. Defaults to `false`. | [`none`](#self-hosted-column) The browser pane lives in Desktop on the person's computer, and host sessions get no browser tools |

464| Default site policy in the built-in browser `builtinBrowserDefaultDomainPolicy` | `enum` | MDM + Bootstrap Added in 2.2553.0 | `allow` | Whether Claude may open sites in the built-in browser by default; the allowed or blocked list is the exception. Mirrors the Claude in Chrome site policy. One of: `allow`, `block`. Defaults to `allow`. | [`none`](#self-hosted-column) Sets the default for Desktop's browser tools, and host sessions get no browser tools to allow or block |

465| Allowed sites in the built-in browser `builtinBrowserAllowedDomains` | `string[]` | MDM + Bootstrap Added in 2.2553.0 | — | Sites Claude may open, read, and act on in the built-in browser when the default site policy is block. Users can still view other sites. | [`none`](#self-hosted-column) Lists sites allowed for Desktop's browser tools, and host sessions get no browser tools |

466| Blocked sites in the built-in browser `builtinBrowserBlockedDomains` | `string[]` | MDM + Bootstrap Added in 2.2553.0 | — | Sites Claude may not open, read, or act on in the built-in browser when the default site policy is allow. Users can still view them. | [`none`](#self-hosted-column) Lists sites blocked for Desktop's browser tools, and host sessions get no browser tools |

454467

455468> **builtinBrowserEnabled details**

456469>

from line 471

458471>

459472> Off (default): no browser pane; Code sessions keep the localhost-only dev-server preview. With `bootstrapUrl` set, put this key in the served configuration: a device-profile value alone leaves the browser off. On an install managed from the Claude admin console this follows the console's Built-in browser switch.

460473>

461> When a public site opens or is framed in the pane, and before Claude works with it, the app checks its address (query removed) against Anthropic's site safety list on `releases.claude.com`, signed out, with no account, organization, or device identifier (Claude admin console installs: as the signed-in member on `api.anthropic.com`). A site it blocks stays blocked to Claude under every key below. Private addresses, names resolving to them, and internal-suffix or single-label names are never sent (a name under a public domain is checked even if only your VPN resolves it). Allow `releases.claude.com` through your firewall: if a check fails, users can browse but Claude's page tools stay off for that site.

474> When a public site opens or is framed in the pane, and before Claude works with it, the app checks its address (query removed) against Anthropic's site safety list on `releases.claude.com`, signed out, with no account, organization, or device identifier (admin console installs: signed in, on the host that serves their configuration). A site it blocks stays blocked to Claude under every key below. Private addresses, names resolving to them, and internal-suffix or single-label names are never sent (a name under a public domain is checked even if only your VPN resolves it). Allow `releases.claude.com` through your firewall: if a check fails, users can browse but Claude's page tools stay off for that site.

462475>

463476> `builtinBrowserDefaultDomainPolicy` and its two site lists restrict where Claude may browse. A separately deployed Claude Code [managed-settings](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings) file still applies: `disableBrowserExternalNavigation: true` keeps the browser off even with this key on, and `browserExternalPageTools: "disabled"` keeps the pane but turns Claude's page tools off for external sites. Takes effect after the app restarts.

464477

from line 501

488501

489502### Chat surface

490503

492| - | - | - | - | - |

505| - | - | - | - | - | - |

507| Desktop home `desktopHome` | `enum` | MDM + Bootstrap Added in 1.52386.0 | — | Unifies Chat and Cowork into one home. When set, it replaces Allow Chat, Advanced file analysis, and Allow Cowork. Leave unset to keep those. One of: `standard`, `off`. | [`server`](#self-hosted-column) Alone decides Cowork, which is on only while this is unset or standard; else the host refuses it and Desktop hides it |

508| Advanced file analysis `chatAdvancedFileAnalysisEnabled` | `boolean` | MDM + Bootstrap Added in 1.14271.0 | — | Allow Claude to run code in a local sandbox to analyze attached files it can’t read natively — like Excel and PowerPoint. Off by default. | [`none`](#self-hosted-column) Configures a Chat session's local sandbox, and no Chat session can start on a self-hosted install |

509

510> **desktopHome details**

511>

512> `standard` turns on Unified Claude, which combines Chat and Cowork into one experience. `off` turns Chat and Cowork off entirely. `isClaudeCodeForDesktopEnabled` still decides Code. Remove the key to hand control back to `chatTabEnabled`, `chatAdvancedFileAnalysisEnabled`, and `coworkTabEnabled`. Values are case-sensitive, so `Standard` is not recognized. A value that the app does not recognize is read as `off`, so update the app on devices before you deploy a value added in a later version.

496513

497514> **chatAdvancedFileAnalysisEnabled details**

498515>

from line 521

504521>

505522> Project folders are not available in the sandbox of a chat started while a rule on `Read`, `Grep` or `Glob` is set: in `disabledBuiltinTools`, in `builtinToolPolicy` with a value other than `allow`, or as a deny or ask rule in Claude Code's own managed settings on the device, whether or not the rule covers the folder. They are not available either where those managed settings cannot be read, or where Claude Code takes its managed settings from a gateway. Claude's file tools still read what the rules allow.

506523

507> **desktopHome details**

508>

509> `standard` turns on Unified Claude, which combines Chat and Cowork into one experience. `off` turns Chat and Cowork off entirely. `isClaudeCodeForDesktopEnabled` still decides Code. Remove the key to hand control back to `chatTabEnabled`, `chatAdvancedFileAnalysisEnabled`, and `coworkTabEnabled`. Values are case-sensitive, so `Standard` is not recognized. A value that the app does not recognize is read as `off`, so update the app on devices before you deploy a value added in a later version.

510

511524### Code surface

512525

514| - | - | - | - | - |

516| SSH host allowlist `sshHostAllowlist` | `string[]` | MDM + Bootstrap · Beta Added in 1.40609.0 | — | SSH hosts for Code sessions. Unset: off unless the device’s Claude Code managed settings list hosts. An admin’s empty list: off even then. \* allows any host. |

518| SSH connection engine `sshTransport` | `enum` | MDM + Bootstrap · Beta Added in 1.52386.0 | — | Which SSH engine carries Code sessions: the OpenSSH ssh program on the device, or the app’s built-in SSH library. Unset or auto: the build’s default. One of: `auto`, `system-openssh`, `builtin`. |

527| - | - | - | - | - | - |

529| SSH host allowlist `sshHostAllowlist` | `string[]` | MDM + Bootstrap · Beta Added in 1.40609.0 | — | SSH hosts for Code sessions. Unset: off unless the device’s Claude Code managed settings list hosts. An admin’s empty list: off even then. \* allows any host. | [`none`](#self-hosted-column) Governs SSH sessions started from the person's computer, which self-hosted installs never offer |

530| SSH client program `sshClientPath` | `string` | MDM + Bootstrap · Beta Added in 1.46388.1 | — | Absolute path to the OpenSSH ssh program the app runs for SSH sessions. Unset: the first ssh on the user’s PATH. | [`none`](#self-hosted-column) Names the ssh program on the person's computer, and self-hosted installs offer no SSH sessions |

531| SSH connection engine `sshTransport` | `enum` | MDM + Bootstrap · Beta Added in 1.52386.0 | — | Which SSH engine carries Code sessions: the OpenSSH ssh program on the device, or the app’s built-in SSH library. Unset or auto: the build’s default. One of: `auto`, `system-openssh`, `builtin`. | [`none`](#self-hosted-column) Chooses the SSH engine on the person's computer, and self-hosted installs offer no SSH sessions |

519532

520533> **sshHostAllowlist details**

521534>

from line 542

529542

530543> **sshClientPath details**

531544>

532> Pins which OpenSSH client the app runs wherever it starts `ssh`: evaluating the user's SSH configuration (`ssh -G`), making the SSH connection and its channels, and the Code tab's terminal. `ssh-keygen` and `ssh-add` are taken from the same directory when they exist there, otherwise from PATH. The program must be OpenSSH 7.6 or newer (on Windows, Win32-OpenSSH 9.4 or newer to carry the connection); on macOS and Linux a wrapper script that ends in one is accepted, on Windows it must be a native `.exe` (not a .cmd, .bat or .ps1 script). When this key is set and the program is missing, cannot be run, or is too old, SSH sessions fail with an error telling the user to ask their IT administrator (the configured path is in its details) — the app never falls back to another ssh. The connection itself runs through this program on the system-OpenSSH engine, which the SSH connection engine setting's `system-openssh` value selects on every platform, including Windows; when the app's built-in SSH library makes the connection instead, this key still governs configuration evaluation (`ssh -G`), host-key lookups (`ssh-keygen`) and the terminal. On a device that a Claude.ai sign-in has moved to an admin-console organization (see `disableDeploymentModeChooser`), the device profile's value is ignored: set the key in the admin console. There, until the organization's configuration has loaded, no client is pinned.

545> Pins which OpenSSH client the app runs wherever it starts `ssh`: evaluating the user's SSH configuration (`ssh -G`), making the SSH connection and its channels, and the Code tab's terminal. `ssh-keygen` and `ssh-add` are taken from the same directory when they exist there, otherwise from PATH. The program must be OpenSSH 7.6 or newer. To carry the connection on Windows it must be Win32-OpenSSH 9.4 or newer, or another OpenSSH 8.5 or newer under Program Files, such as Git for Windows' `usr\bin\ssh.exe`, only where device policy, or the configuration server it names, sets this key and sets the SSH connection engine setting to `system-openssh`; the app points such a client at the `.ssh` folder of the user's Windows profile, and asks for a password, code or key passphrase only on a direct connection (no jump host, `ProxyCommand`, `Match exec`, `KnownHostsCommand`, `PKCS11Provider` or `SecurityKeyProvider`); otherwise only a key that needs nothing typed signs in. Set such a client only on desktops with one user. On macOS and Linux a wrapper script that ends in one is accepted, on Windows it must be an `.exe` (no .cmd, .bat or .ps1). When this key is set and the program is missing, cannot be run, or is too old, SSH sessions fail with an error telling the user to ask their IT administrator — the app never falls back to another ssh. The connection itself runs through this program on the system-OpenSSH engine, which the SSH connection engine setting's `system-openssh` value selects on every platform; when the app's built-in SSH library makes the connection instead, this key still governs configuration evaluation (`ssh -G`), host-key lookups (`ssh-keygen`) and the terminal. On a device that a Claude.ai sign-in has moved to an admin-console organization (see `disableDeploymentModeChooser`), the device profile's value is ignored: set the key in admin settings (which cannot name such a client). There, until the organization's configuration has loaded, no client is pinned.

533546

534547> **sshTransport details**

535548>

536> `system-openssh`: the app makes every SSH connection by running an OpenSSH `ssh` program — the one `sshClientPath` names, otherwise the first `ssh` on the user's PATH (on Windows, a Win32-OpenSSH `ssh.exe`: the PATH one, else the in-box or Microsoft-installed client) — so the organization's own OpenSSH build, with its Kerberos/GSSAPI, certificate and `ssh_config` support, is what authenticates. The program must be OpenSSH 7.6 or newer (Windows: Win32-OpenSSH 9.4 or newer). When `sshClientPath` is set and that program cannot be used, sessions fail with an error telling the user to ask their IT administrator rather than falling back; when it is unset and Windows has no usable client, the built-in library is used.

549> `system-openssh`: the app makes every SSH connection by running an OpenSSH `ssh` program — the one `sshClientPath` names, otherwise the first `ssh` on the user's PATH (on Windows, a Win32-OpenSSH `ssh.exe`: the PATH one, else the in-box or Microsoft-installed client) — so the organization's own OpenSSH build, with its Kerberos/GSSAPI, certificate and `ssh_config` support, is what authenticates. The program must be OpenSSH 7.6 or newer (Windows: Win32-OpenSSH 9.4 or newer, or another OpenSSH that `sshClientPath` names: see that key). When `sshClientPath` is set and that program cannot be used, sessions fail with an error telling the user to ask their IT administrator rather than falling back; when it is unset and Windows has no usable client, the built-in library is used.

537550>

538551> `builtin`: the app's built-in SSH library makes the connection, whatever the build's default.

539552>

from line 556

543556

544557### Cowork surface

545558

547| - | - | - | - | - |

560| - | - | - | - | - | - |

561| Allow Cowork `coworkTabEnabled` | `boolean` | MDM + Bootstrap Added in 1.9659.0 | `true` | Enable Cowork. Claude works on longer tasks like research, analysis, and documents. Defaults to `true`. | [`none`](#self-hosted-column) On a session host desktopHome alone decides Cowork: to turn Cowork off, set desktopHome to off in its policy document |

549562

550563### Workspace

551564

553| - | - | - | - | - |

554| Allow user-added plugin marketplaces `userPluginMarketplacesEnabled` | `boolean` | MDM + Bootstrap Added in 1.37937.0 | — | Allow users to add plugin marketplaces. When off, marketplaces your organization did not provision are hidden and the app’s sessions do not load their plugins. |

558| Allow user-created skills `skillCreationEnabled` | `boolean` | MDM + Bootstrap Added in 1.25927.0 | — | Allow users to create and upload their own skills. When off, the creation and upload surfaces are hidden and the agent’s skill-creation tools are disabled. |

563| Built-in tool policy `builtinToolPolicy` | `object` | MDM + Bootstrap Added in 1.8089.0 | — | Approval per tool or rule such as Bash(curl \*). “ask” prompts the user before each matching call. “allow” is the default. To block, use Disabled built-in tools. |

570| Allowed egress hosts `coworkEgressAllowedHosts` | `string[]` | MDM + Bootstrap Added in 1.2581.0 | — | Hosts agent tools may reach in Cowork and Chat (Code: in part). An empty list acts as unset for tools, but stops Claude opening sites in the built-in browser. |

571| Require full VM sandbox `requireCoworkFullVmSandbox` | `boolean` | MDM + Bootstrap · Deprecated Added in 1.2581.0 | `false` | Runs tools inside an isolated VM instead of the host. Stronger isolation; slower file access and no host-process tools. Defaults to `false`. |

573

574> **userPluginMarketplacesEnabled details**

575>

576> When on (default), users can add plugin marketplaces from the plugin browser. Set to `false` to restrict plugins to your organization's marketplaces: the add-marketplace surfaces are hidden, and the app refuses adds that still reach it (deep links, stale UI). Any other marketplace present on the device is then hidden in every tab, whether a user added it in the app earlier or something outside the app registered it (for example Claude Code in a terminal, under `~/.claude`): its plugins are not listed, and installs and updates from it are refused. The sessions the app starts load plugins only from your organization's marketplaces, the organization plugins directory, the app's own uploads and the user's own skills folder, enforced through Claude Code's marketplace allowlist (`strictKnownMarketplaces`, passed as the app's managed settings). Nothing is deleted: removing the key or setting it back to `true` restores them. Marketplaces provisioned by your organization (`allowedPluginMarketplaces`) and the organization plugins directory are unaffected, and plugins users uploaded are governed by `userPluginUploadsEnabled`, not this key.

577>

578> This is a feature-availability control, not a data boundary. Claude Code in a terminal reads the same `~/.claude` folder and is governed only by its own managed settings, not by this key. Claude Code may ignore this allowlist on a device that deploys its own Claude Code managed settings; restrict marketplaces in those settings as well.

579>

580> This key applies only while the app runs in third-party mode. If users could otherwise sign in to Claude.ai on the device, also set `disableDeploymentModeChooser` so the app stays in third-party mode.

581

582> **userPluginUploadsEnabled details**

583>

584> When on (default), users can upload plugin files and create plugins with Claude. Set to `false` to stop users adding plugins of their own: every in-app option for doing so is hidden, and the app refuses uploads that still reach it.

585>

586> This is a feature-availability control enforced in the app, not a data boundary: plugins already installed (or placed on disk outside the app) are not removed or blocked by this key. Plugins from organization-provisioned marketplaces and the organization plugins directory are unaffected.

587>

588> This key applies only while the app runs in third-party mode. If users could otherwise sign in to Claude.ai on the device, also set `disableDeploymentModeChooser` so the app stays in third-party mode.

589

590> **disabledBuiltinTools details**

591>

592> Each entry is a Claude Code [tool name](https://code.claude.com/docs/en/tools-reference) such as `Bash`, `Edit`, `WebFetch` or `WebSearch`, or an argument-scoped [permission rule](https://code.claude.com/docs/en/permissions#permission-rule-syntax) such as `Bash(curl *)` or `Edit(//**/*.env)`. A bare name covers every call (a bare `Bash` entry also covers the `PowerShell` tool); a scoped rule covers matching calls in every permission mode, including Auto and bypass. Scopes are matched for `Bash(…)` and `PowerShell(…)` (a command pattern) and for file paths written as `Read(…)` (covers `Read`, `Grep`, `Glob`) or `Edit(…)` (covers `Edit`, `Write`, `NotebookEdit`); many other tools take `Tool(<field>:<pattern>)`. `WebSearch` and `WebFetch` are bare-name only: to allow specific hosts, use `coworkEgressAllowedHosts`.

593>

594> Scoped `Bash(…)` rules apply in Code sessions only; Cowork's shell follows only a bare `Bash` entry. Start absolute file paths with `//`, not `/`: a relative pattern such as `Read(**/.env)` covers only a Code session's project folder and none of Cowork's connected folders. Scoped rules need fleet-wide build support (`disableAutoUpdates` pins builds): an older build passes a scoped entry to Claude Code unchecked. An entry whose pattern contains `)` followed by a space or comma is enforced only through Claude Code's managed-settings channel, so another Claude Code [managed-settings source](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings) replaces it unless that source sets `parentSettingsBehavior` to `"merge"`; every other entry is enforced either way.

595>

596> An unusable entry (a tool name in the wrong letter case, an unbalanced parenthesis, a scoped `WebSearch(…)` or `WebFetch(…)`) is kept, because the deny list is served exactly as written, and raises a configuration warning.

597

598> **skillCreationEnabled details**

599>

600> When on (default), users can create new skills and upload skill files in the app. Set to `false` to block user skill creation: the skill-creation and upload surfaces are hidden (the `skill_creation` feature is served as blocked by the organization), and the agent's skill-creation tools (saving skills from a conversation, skill proposals) are not offered in sessions — the same effect as turning off the **User-created skills** organization setting available to claude.ai enterprise admins.

601>

602> This is a feature-availability control enforced in the app's UI, not a data boundary: skills are files on the user's machine, and files already present there (or placed there outside the app) are not removed or blocked by this key. Skills themselves remain usable; organization-distributed plugins and bundled skills are unaffected (to disable bundled skills, use `disableBundledSkills`).

603

604> **scheduledTasksEnabled details**

605>

606> When on (default), users can schedule Cowork tasks and Code sessions to run later or on a recurring schedule, and Claude can create such schedules when asked.

607>

608> Set to `false` to turn scheduled tasks off for every user. The Scheduled section in Cowork and the routines list in the Code tab are hidden, together with every other place a schedule can be created. Tasks that already exist on a device no longer run; they are kept, not deleted, and run again once the key is removed or set to `true`. Claude is not offered the tools that create, change or run these tasks, and sessions start without Claude Code's own in-session scheduling tools (the `/loop` command, its cron tools and its wake-up timer).

609>

610> It does not remove task files already on the user's machine. A change takes effect at the next app launch.

611

612> **keepAwakeEnabled details**

613>

614> When on (default), users can turn on **Keep computer awake** (Settings → This computer → System, also shown as **Keep awake** on the Scheduled page in Cowork and the Routines page in Code) so the computer does not idle-sleep while Claude is open and scheduled tasks keep running on an idle machine. The Code tab can also keep the computer awake while a session is working (**Keep computer awake while Claude works** in Settings → Claude Code, and a session's **Keep computer awake** menu item).

615>

616> Set to `false` to make sure Claude never prevents the computer from sleeping: those switches are hidden and no part of the app keeps the computer awake. Users' saved choices are kept but ignored, and apply again once the key is removed or set to `true`. Scheduled tasks are unaffected and still run only while the computer is awake and the app is open.

617>

618> A change takes effect on a running app.

619

620> **developerModeEnabled details**

621>

622> When on (default), a user can turn on **Developer Mode** (Help → Troubleshooting → Enable Developer Mode), which adds the **Developer** menu and lets them open the developer tools (Chrome DevTools, Inspect Element) and a debugger for the app's main process.

623>

624> Set to `false` to keep Developer Mode off on every device that receives this setting: the **Developer** menu and the Help → Troubleshooting → Enable Developer Mode item are removed, the developer tools and the debugger cannot be opened (any already open are closed), a user's own `developer_settings.json` opt-in is ignored, and the app refuses to install an extension from a folder. Packaged (`.mcpb`) extensions are governed by `isDesktopExtensionEnabled`, not this key.

625>

626> This is a feature control, not a sandbox: extensions already installed from a folder stay installed and keep working, and an extension folder copied into the app's extensions folder by hand is not blocked.

627>

628> A change takes effect on a running app, except that the **Install unpacked extension** button in Settings keeps its launch-time state until the app restarts (clicking it while the key is off shows an error).

629

630> **quickEntryDefaultShortcut details**

631>

632> Sets the default shortcut for Quick Entry, the small prompt window that opens over other apps. It replaces Claude's built-in shortcut (double-tap Option on macOS, Ctrl+Alt+Space on Windows and Linux) for users who haven't chosen their own.

633>

634> This is a default, not a lock. A shortcut that a user saves in Settings → This computer → System (**Quick access shortcut** on macOS, **Quick Entry keyboard shortcut** on Windows and Linux) takes precedence, including one saved before this key was set.

635>

636> Accepted values:

637>

638> * Modifiers and one key joined by `+`, such as `Ctrl+Alt+K` or `Alt+Space`. Modifiers include `Ctrl`, `Alt`, `Shift`, `Cmd` and `Super`. `CommandOrControl` means Cmd on macOS and Ctrl elsewhere, so one value works on every platform. A combination must pair `Ctrl`, `Cmd` or `Super` with `Alt` or `Shift`, except for `Alt+Space`. Write modifier and key names exactly as shown: `ctrl` is not read as `Ctrl`.

639> * `off` (the string, not `false`): no shortcut. Users can still open Quick Entry from Claude's tray or menu bar icon and set a shortcut in Settings.

640> * `double-tap-option`: macOS only. Windows and Linux keep the built-in shortcut.

641>

642> While Claude is running, other apps don't receive this shortcut. So Claude rejects other combinations, such as `F11`, `Ctrl+C`, `Shift+K` or `Alt+Shift+K`, which typing and other apps rely on. It also rejects any combination that includes `Insert`, `Capslock` or `F5`, which screen readers use. Choose a combination that users don't need elsewhere.

643>

644> If Claude can't use the value as a shortcut, it ignores the value and keeps the built-in one. If another app already uses the shortcut, Claude on macOS uses the built-in shortcut. On Windows and Linux, Quick Entry keeps its previous shortcut, or none at start-up. Users can choose another in Settings.

645>

646> A change takes effect on a running app.

647

648> **builtinToolPolicy details**

649>

650> Keys use the same tool names and argument-scoped rule syntax as **Disabled built-in tools** (`disabledBuiltinTools`), and scopes apply in the same sessions. A bare `Bash` key also governs Claude Code's `PowerShell` tool (its shell on Windows PCs without Git for Windows); argument-scoped `Bash(…)` keys do not. Scoped **ask** rules reach sessions only through Claude Code's managed-settings channel, so another Claude Code managed-settings source replaces them unless it sets `parentSettingsBehavior` to `"merge"` (bare names hold either way). They need the same fleet-wide build support, and an older build drops a scoped **ask** entry as a configuration error (which also blocks WSL sessions on Windows until that client updates), so the tool runs unprompted.

651>

652> An **ask** entry, bare or scoped, also turns off the app's remembered “always allow” choices for that tool, so each prompted call is confirmed individually. **ask** on a file tool (`Read`, `Write`, `Edit`, `Glob`, `Grep`) prompts in Cowork, Chat and Code sessions. Calls that Cowork and Chat always refuse are still refused without a prompt: paths outside the session's connected folders (in Chat, outside its scratch directory and its project's folders) and protected or sensitive files inside them. A scheduled task in Cowork waits at the prompt, which appears in the task's session and, when that session is not in view, as a desktop notification. Code side chats cannot prompt, so they block matching calls. An unusable entry is dropped and recorded as a configuration error; a value other than `allow` or `ask` is treated as `ask` and reported. To remove a tool or deny a rule outright, use **Disabled built-in tools** instead.

653

654> **autoModeEnabled details**

655>

656> Left unset, users can select **Auto mode** in Code and new Code sessions start in it; a mode the user already chose, or a Claude Code settings file's `permissions.defaultMode`, takes precedence, and Cowork does not offer it. Set to `true` to also offer **Automatically approve** in Cowork (Cowork sessions still start by asking before each action until the user picks it). Set to `false` to remove the option from both tabs. In Auto mode Claude runs a safety classifier on each action and only prompts for approval on actions it judges risky, instead of following the static per-tool policy.

657>

658> Requires a session model that supports the safety classifier — which models qualify depends on the deployment's provider and the app version. With a model that lacks support the option is greyed out and Code sessions do not start in it. `builtinToolPolicy` and this key may both be set; Auto mode is a user-selectable option alongside the default policy, not a replacement for it.

659>

660> By default on a gateway, the safety classifier sends its own requests through your gateway to Claude Sonnet 5, whatever model the session uses. Make sure your gateway accepts the exact ID `claude-sonnet-5` and the `context-1m-2025-08-07` value in the `anthropic-beta` request header. If you set `inferenceModels`, list that ID there and in any group's model list (no `supports1m` needed). Sonnet 5 then also shows in the model picker. If the gateway rejects those requests or the list omits the ID, Auto mode stays available but can block actions it would otherwise allow. In Code, users see those actions marked **Blocked**.

661>

662> In Code sessions, a separately deployed Claude Code [managed-settings](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings) file that sets `disableAutoMode` to `"disable"` also keeps Auto mode hidden and off, whatever this key says.

663

664> **disableBypassPermissionsMode details**

665>

666> When set to `true`, sessions cannot run in bypass permissions mode: the app stops offering the mode in Code and Cowork, and a session that requests it anyway is downgraded. This is the `disableBypassPermissionsMode` setting from the `permissions` section of Claude Code's [managed settings](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings); a separately deployed Claude Code managed-settings file that sets it to `"disable"` also removes the mode, whichever source sets it.

667>

668> Unset (default): users the deployment otherwise allows can choose bypass permissions mode.

669

670> **toolSearchEnabled details**

671>

672> When enabled, Cowork, Code, and Chat sessions place only tool names in context up front, and Claude fetches a tool's full schema the first time it needs it. Use this when many MCP tools are configured and their inlined schemas crowd out the context window. If your endpoint does not accept the request shape it then receives, requests fail with HTTP 400.

673>

674> * **Claude API, Vertex AI, Bedrock, or Bedrock Mantle with no custom base URL**: not needed. The app leaves Claude Code's experimental betas on there, as terminal Claude Code does, so tool search is on by default (on Vertex AI, for Claude 4.5 and newer models). To turn it off in Code, Cowork, and Chat, set `ENABLE_TOOL_SEARCH` to `false` in the `env` block of OS-level Claude Code managed settings (with `parentSettingsBehavior: "merge"`). Earlier app versions treat these like the last case.

675> * **Gateway provider, app versions bundling Claude Code 2.1.247 or later**: requests add only the tool-search shape (the `tool-search-tool-2025-10-19` `anthropic-beta` value, deferred tool loading, `tool_reference` content blocks); every other experimental Claude Code beta stays suppressed. OS-level Claude Code managed settings that keep that suppression or turn `ENABLE_TOOL_SEARCH` off still win; set `ENABLE_TOOL_SEARCH` to `force` there instead (with `parentSettingsBehavior: "merge"`). Sessions the app runs in Claude Code's gateway mode (an opt-in for users on the gateway's own sign-in) get its gateway-safe tool-search shape instead.

676> * **Foundry, a custom base URL, and earlier app versions**: the app suppresses Claude Code's experimental betas for the session and the key lifts that, so requests carry the tool-search shape together with Claude Code's other experimental betas for that provider. On Vertex with app versions bundling Claude Code older than 2.1.221, leave this unset while any model older than Claude 4.5 is in use; those engines send the header regardless of model and Vertex's pre-4.5 stacks reject it.

677

678> **skipWebFetchPreflight details**

679>

680> Before fetching a page, Claude Code's WebFetch tool asks `api.anthropic.com` whether the domain is on Anthropic's content blocklist, and refuses the fetch if that lookup cannot complete. Third-party deployments route inference elsewhere and often block `api.anthropic.com` at the firewall; with the lookup on, every WebFetch in Code sessions then fails with "Unable to verify if domain … is safe to fetch", and where the host is reachable, every fetched hostname is sent to Anthropic. (Cowork sessions fetch through the app's own allowlisted fetch and never run this lookup.)

681>

682> Off (default): the lookup runs as it does today, so `api.anthropic.com` must be reachable from users' machines for Code-session WebFetch to work (listed under Egress Requirements). Set to `true` when users' machines cannot reach `api.anthropic.com` (corporate firewall, government network) or you do not want fetched hostnames sent there: Code sessions then fetch without the lookup and never contact that host for it. This is the same `skipWebFetchPreflight` setting Claude Code reads from its own [managed-settings](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings) file; the app passes it to every session it starts. This key does not restrict which domains Claude may fetch. Neither does `coworkEgressAllowedHosts` in Code sessions, where it only pre-approves its hosts; `builtinToolPolicy` can require approval for every fetch.

566| - | - | - | - | - | - |

567| Allowed egress hosts `coworkEgressAllowedHosts` | `string[]` | MDM + Bootstrap Added in 1.2581.0 | — | Hosts agent tools may reach in Cowork and Chat (Code: in part). An empty list acts as unset for tools, but stops Claude opening sites in the built-in browser. | [`server`](#self-hosted-column) Tools in the host's sessions make the network calls, so the host limits which addresses they may reach |

568| Allowed workspace folders `allowedWorkspaceFolders` | `object[]` | MDM + Bootstrap Added in 1.2581.0 | — | Folders where Claude may work. Applies to Cowork and Code sessions and to the project folders a chat reads. Leave unset for unrestricted access. | [`server`](#self-hosted-column) The host refuses file access outside folders listed as full paths, and Desktop checks those listed with \~ or a variable |

569| Block reads outside working directories `blockReadsOutsideWorkingDirectories` | `boolean` | MDM + Bootstrap Added in 1.46388.1 | — | Keep Claude from reading files outside a Code session’s working directories. File tools refuse such reads; sandboxed shell commands lose the home directory. | [`server`](#self-hosted-column) The host starts Code sessions, so it hands Claude Code the block on reads outside their folders |

570| Allow Auto mode `autoModeEnabled` | `boolean` | MDM + Bootstrap Added in 1.10628.0 | — | Offer Auto mode in Code (on unless set to false); set to true to also offer it in Cowork as “Automatically approve”. Claude decides which actions need approval. | [`server`](#self-hosted-column) The host allows or refuses Auto mode for the sessions it runs, and tells Desktop what to offer |

571| Disable bypass permissions mode `disableBypassPermissionsMode` | `boolean` | MDM + Bootstrap Added in 1.46388.1 | — | Remove the bypass permissions mode from Code sessions and Cowork tasks, so Claude always follows the permission policy. Off by default. | [`none`](#self-hosted-column) A session host never offers bypass mode, so every session it runs already has it off |

572| Disable bundled skills and workflows `disableBundledSkills` | `boolean` | MDM + Bootstrap Added in 1.15962.0 | — | Disables Claude Code’s bundled skills and workflows (deep-research and similar). Use where WebFetch/WebSearch aren’t available. | [`server`](#self-hosted-column) The host starts Claude Code, so it is the one that turns the bundled skills off |

573| Allow user-created skills `skillCreationEnabled` | `boolean` | MDM + Bootstrap Added in 1.25927.0 | — | Allow users to create and upload their own skills. When off, the creation and upload surfaces are hidden and the agent’s skill-creation tools are disabled. | [`server`](#self-hosted-column) The host stores people's skills, so when this is off it refuses new ones and tells Desktop to hide creation |

574| Allow user-added plugin marketplaces `userPluginMarketplacesEnabled` | `boolean` | MDM + Bootstrap Added in 1.37937.0 | — | Allow users to add plugin marketplaces. When off, marketplaces your organization did not provision are hidden and the app’s sessions do not load their plugins. | [`reported`](#self-hosted-column) Desktop hides and refuses adding a marketplace when off; no session host loads a person's own marketplaces yet |

575| Allow user-added plugins `userPluginUploadsEnabled` | `boolean` | MDM + Bootstrap Added in 1.37937.0 | — | Allow users to add their own plugins. When off, every in-app option for adding one is hidden and uploads that still reach the app are refused. | [`server`](#self-hosted-column) The host keeps the plugins people upload and loads them in their sessions, and refuses new ones when this is off |

576| Allow scheduled tasks `scheduledTasksEnabled` | `boolean` | MDM + Bootstrap Added in 2.110.0 | — | Allow scheduled tasks in Cowork and Code. When off, the Scheduled page is hidden, existing tasks stop running, and Claude cannot create new ones. | [`server`](#self-hosted-column) The host runs scheduled tasks, so when this is off it refuses to create or run them |

577| Allow keep awake `keepAwakeEnabled` | `boolean` | MDM + Bootstrap Added in 2.7032.0 | — | Let Claude keep the computer awake. When off, Claude never prevents sleep and hides the keep-awake switches in Settings, the Scheduled page and the Code tab. | [`reported`](#self-hosted-column) Desktop itself asks the person's computer to stay awake, and shows the keep-awake switches |

578| Allow Developer Mode `developerModeEnabled` | `boolean` | MDM + Bootstrap Added in 2.37337.1 | — | Let users turn on Developer Mode. When off, the app’s developer tools and the option to install an unpacked extension are unavailable. | [`reported`](#self-hosted-column) Desktop offers its own Developer menu, developer tools and debugger on the person's computer |

579| Default Quick Entry shortcut `quickEntryDefaultShortcut` | `string` | MDM + Bootstrap Added in 3.1623.0 | — | Set the shortcut that opens Quick Entry, such as Ctrl+Alt+K, for users who haven’t set their own in Settings. Use “off” for no shortcut. | [`reported`](#self-hosted-column) Desktop registers its Quick Entry shortcut with the operating system of the person's computer |

580| Allow screenshots of the screen and other apps `quickEntryScreenshotsEnabled` | `boolean` | MDM + Bootstrap Added in 3.6556.1 | — | Let users take screenshots of their screen or other apps’ windows in Quick Entry on macOS. When off, it offers none and never asks for Screen Recording access. | [`reported`](#self-hosted-column) Desktop takes the picture on the person's computer and offers it in its own Quick Entry window |

581| Allow sharing files open in other apps `quickEntryFileSharingEnabled` | `boolean` | MDM + Bootstrap Added in 3.6556.1 | — | Let users attach the file open in another app’s window in Quick Entry on macOS. When off, it offers none and never asks for Accessibility access. | [`reported`](#self-hosted-column) Desktop finds the file on the person's computer and offers it in its own Quick Entry window |

582| Skip WebFetch domain check `skipWebFetchPreflight` | `boolean` | MDM + Bootstrap Added in 1.37937.0 | — | Skip Claude Code’s WebFetch domain lookup against api.anthropic.com in Code sessions. Off by default; turn on when that host is blocked. | [`none`](#self-hosted-column) A session host always skips the web fetch preflight check, whatever is written |

583| Built-in tool policy `builtinToolPolicy` | `object` | MDM + Bootstrap Added in 1.8089.0 | — | Approval per tool or rule such as Bash(curl \*). “ask” prompts the user before each matching call. “allow” is the default. To block, use Disabled built-in tools. | [`server`](#self-hosted-column) The host hands each session the admin's allow or ask rule for each built-in tool |

584| Disabled built-in tools `disabledBuiltinTools` | `string[]` | MDM + Bootstrap Added in 1.2581.0 | — | Built-in tools, or argument-scoped permission rules such as Read(//\*\*/.env), denied in Cowork and Code. | [`server`](#self-hosted-column) The host starts each session with the built-in tools and tool uses the admin denies turned off |

585| Enable tool search `toolSearchEnabled` | `boolean` | MDM + Bootstrap Added in 1.21459.0 | `false` | Load MCP tool schemas on demand (tool search) instead of inlining every schema into context. Defaults to `false`. | [`server`](#self-hosted-column) The host starts Claude Code, so it turns tool search on or off for its sessions |

586| Organization instructions `organizationInstructions` | `string` | MDM + Bootstrap Added in 1.37937.0 | — | Appended to Claude’s system prompt in Chat, Cowork, and Code. Guidance the model follows, not an enforced control. Up to 3,000 characters. | [`server`](#self-hosted-column) The host adds the admin's instructions to every session it starts |

587| Require full VM sandbox `requireCoworkFullVmSandbox` | `boolean` | MDM + Bootstrap · Deprecated Added in 1.2581.0 | `false` | Runs tools inside an isolated VM instead of the host. Stronger isolation; slower file access and no host-process tools. Defaults to `false`. | [`none`](#self-hosted-column) Chooses how Cowork runs on the person's own computer, and third-party installs no longer read it |

588

589> **coworkEgressAllowedHosts details**

590>

591> Applies only to **tool calls**, in Cowork, Code and Chat. In Cowork it covers the sandbox's web fetch, shell commands and package installs. In Chat it covers web fetch and commands in the file-analysis sandbox. In Code it's [translated into Claude Code's network sandbox allowlist](https://claude.com/docs/third-party/claude-desktop/code#applied-as-managed-policy), and by default a separately deployed Claude Code managed-settings file takes precedence. It does **not** cover Web Search (which runs at your inference provider), inference, or MCP traffic. A list other than `*` also bounds where Claude may browse in the built-in browser. When unset, Cowork and Chat refuse web fetch.

592>

593> Entries are exact hostnames (`api.github.com`), wildcards (`*.corp.com` matches subdomains at any depth, not `corp.com` itself), or `*` to allow all. IP addresses match only when listed exactly. In Cowork and Chat, web fetch always blocks `localhost` and private addresses, and shells reach only listed hosts (not your inference provider's, unless listed), or none when unset. Code's shell obeys that limit only on macOS, and with bubblewrap and socat on Linux or WSL2; elsewhere, Windows included, it reaches any host. Code's web fetch isn't limited.

594>

595> Any entry except bare `*` may carry a `:port` suffix (`*.corp.com:8443`) restricting it to that port. IPv6 literals are not supported. Invalid entries are dropped with a log warning and the rest still work. An unreadable value counts as an empty list. Ports are enforced for the Cowork sandbox's web fetch, shell, and package-install egress; plugin CLIs also reach hosts their plugin declares and ignore port-scoped entries for now, and the Code translation treats them as the bare host. Only deploy port-scoped entries once your whole fleet supports them (`disableAutoUpdates` pins builds). On an older build, a single one invalidates the session's whole shell and package-install allowlist.

596>

597> Open listed hosts on your network firewall too.

683598

684599> **allowedWorkspaceFolders details**

685600>

686> Paths can reference `~` and these environment variables, expanded per user: `%OneDrive%`, `%OneDriveCommercial%`, `%OneDriveConsumer%`, `%APPDATA%`, `%LOCALAPPDATA%`, `%USERNAME%`, `%XDG_DOCUMENTS_DIR%`. The set is fixed; an entry that references any other `%VAR%`, or one that is unset on the device, is ignored.

687>

688> Each folder is interpreted on the machine the session runs on. For a Code session on an SSH host, `~` means the remote user's home, an entry that references a `%VAR%` is ignored there (environment variables belong to the machine that defines them), and the session's working directory must fall inside one of the folders as they exist on that host. One list serves every machine: `["~/work", "/srv/work"]` governs `~/work` for each user, on a managed Mac or a Linux host, and `/srv/work` on a host that has it. A folder that names nothing real on a given machine simply allows nothing there. An empty list allows no folder at all; unset leaves access unrestricted.

601> Paths can reference `~` and these environment variables, expanded per user: `%OneDrive%`, `%OneDriveCommercial%`, `%OneDriveConsumer%`, `%APPDATA%`, `%LOCALAPPDATA%`, `%USERNAME%`, `%XDG_DOCUMENTS_DIR%`. The set is fixed; an entry that references any other `%VAR%`, or one that is unset on the device, allows none.

602>

603> Each folder is interpreted on the machine the session runs on. For a Code session on an SSH host, `~` means the remote user's home, an entry that references a `%VAR%` allows none there, and the session's working directory must be inside one of the folders as they exist on that host. One list serves every machine: `["~/work", "/srv/work"]` governs `~/work` for each user, on a managed Mac or a Linux host, and `/srv/work` on a host that has it. A folder that names nothing real on a given machine allows nothing there. On an SSH host, an entry counts only if it is an absolute path as that host spells one (`~/work`, not `work`; on Windows `C:\work`, not `\work`), with no `..`. On Linux or Mac a `\` counts as `/`, except a leading `\\`. One inside another listed folder does not count on its own (its read-only mode still applies); if it is a link, list the folder it points to. An empty list allows none; unset leaves access unrestricted.

689604>

690605> A listed folder is one Claude may write as well as read, unless the entry's `mode` (Access mode in Setup) makes it read-only; that field's own description says how far read-only reaches. A Code session can reach every listed folder, not only the one it was opened in. Setting this key also turns on Claude Code's sandbox where it runs (macOS, or Linux and SSH hosts with bubblewrap): there a shell command normally writes in the listed folders without an approval prompt, and its writes to most other places, such as a package cache in the home directory, are refused. A home directory holds shell start-up files and SSH keys, so list work folders, not a whole home directory.

691606>

from line 620

705620>

706621> Unset (default): nothing changes.

707622

708> **coworkEgressAllowedHosts details**

709>

710> Applies only to **tool calls**, in Cowork, Code and Chat. In Cowork it covers the sandbox's web fetch, shell commands and package installs. In Chat it covers web fetch and commands in the file-analysis sandbox. In Code it's [translated into Claude Code's network sandbox allowlist](https://claude.com/docs/third-party/claude-desktop/code#applied-as-managed-policy), and by default a separately deployed Claude Code managed-settings file takes precedence. It does **not** cover Web Search (which runs at your inference provider), inference, or MCP traffic. A list other than `*` also bounds where Claude may browse in the built-in browser. When unset, Cowork and Chat refuse web fetch.

711>

712> Entries are exact hostnames (`api.github.com`), wildcards (`*.corp.com` matches subdomains at any depth, not `corp.com` itself), or `*` to allow all. IP addresses match only when listed exactly. In Cowork and Chat, web fetch always blocks `localhost` and private addresses, and shells reach only listed hosts (not your inference provider's, unless listed), or none when unset. Code's shell obeys that limit only on macOS, and with bubblewrap and socat on Linux or WSL2; elsewhere, Windows included, it reaches any host. Code's web fetch isn't limited.

713>

714> Any entry except bare `*` may carry a `:port` suffix (`*.corp.com:8443`) restricting it to that port. IPv6 literals are not supported. Invalid entries are dropped with a log warning and the rest still work. An unreadable value counts as an empty list. Ports are enforced for the Cowork sandbox's web fetch, shell, and package-install egress; plugin CLIs also reach hosts their plugin declares and ignore port-scoped entries for now, and the Code translation treats them as the bare host. Only deploy port-scoped entries once your whole fleet supports them (`disableAutoUpdates` pins builds). On an older build, a single one invalidates the session's whole shell and package-install allowlist.

715>

716> Open listed hosts on your network firewall too.

623> **autoModeEnabled details**

624>

625> Left unset, users can select **Auto mode** in Code and new Code sessions start in it; a mode the user already chose, or a Claude Code settings file's `permissions.defaultMode`, takes precedence, and Cowork does not offer it. Set to `true` to also offer **Automatically approve** in Cowork (Cowork sessions still start by asking before each action until the user picks it). Set to `false` to remove the option from both tabs. In Auto mode Claude runs a safety classifier on each action and only prompts for approval on actions it judges risky, instead of following the static per-tool policy.

626>

627> Requires a session model that supports the safety classifier — which models qualify depends on the deployment's provider and the app version. With a model that lacks support the option is greyed out and Code sessions do not start in it. `builtinToolPolicy` and this key may both be set; Auto mode is a user-selectable option alongside the default policy, not a replacement for it.

628>

629> By default on a gateway, the safety classifier sends its own requests through your gateway to Claude Sonnet 5, whatever model the session uses. Make sure your gateway accepts the exact ID `claude-sonnet-5` and the `context-1m-2025-08-07` value in the `anthropic-beta` request header. If you set `inferenceModels`, list that ID there and in any group's model list (no `supports1m` needed). Sonnet 5 then also shows in the model picker. If the gateway rejects those requests or the list omits the ID, Auto mode stays available but can block actions it would otherwise allow. In Code, users see those actions marked **Blocked**.

630>

631> In Code sessions, a separately deployed Claude Code [managed-settings](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings) file that sets `disableAutoMode` to `"disable"` also keeps Auto mode hidden and off, whatever this key says.

632

633> **disableBypassPermissionsMode details**

634>

635> When set to `true`, sessions cannot run in bypass permissions mode: the app stops offering the mode in Code and Cowork, and a session that requests it anyway is downgraded. This is the `disableBypassPermissionsMode` setting from the `permissions` section of Claude Code's [managed settings](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings); a separately deployed Claude Code managed-settings file that sets it to `"disable"` also removes the mode, whichever source sets it.

636>

637> Unset (default): users the deployment otherwise allows can choose bypass permissions mode.

638

639> **skillCreationEnabled details**

640>

641> When on (default), users can create new skills and upload skill files in the app. Set to `false` to block user skill creation: the skill-creation and upload surfaces are hidden (the `skill_creation` feature is served as blocked by the organization), and the agent's skill-creation tools (saving skills from a conversation, skill proposals) are not offered in sessions — the same effect as turning off the **User-created skills** organization setting available to claude.ai enterprise admins.

642>

643> This is a feature-availability control enforced in the app's UI, not a data boundary: skills are files on the user's machine, and files already present there (or placed there outside the app) are not removed or blocked by this key. Skills themselves remain usable; organization-distributed plugins and bundled skills are unaffected (to disable bundled skills, use `disableBundledSkills`).

644

645> **userPluginMarketplacesEnabled details**

646>

647> When on (default), users can add plugin marketplaces from the plugin browser. Set to `false` to restrict plugins to your organization's marketplaces: the add-marketplace surfaces are hidden, and the app refuses adds that still reach it (deep links, stale UI). Any other marketplace present on the device is then hidden in every tab, whether a user added it in the app earlier or something outside the app registered it (for example Claude Code in a terminal, under `~/.claude`): its plugins are not listed, and installs and updates from it are refused. The sessions the app starts load plugins only from your organization's marketplaces, the organization plugins directory, the app's own uploads and the user's own skills folder, enforced through Claude Code's marketplace allowlist (`strictKnownMarketplaces`, passed as the app's managed settings). Nothing is deleted: removing the key or setting it back to `true` restores them. Marketplaces provisioned by your organization (`allowedPluginMarketplaces`) and the organization plugins directory are unaffected, and plugins users uploaded are governed by `userPluginUploadsEnabled`, not this key.

648>

649> This is a feature-availability control, not a data boundary. Claude Code in a terminal reads the same `~/.claude` folder and is governed only by its own managed settings, not by this key. Claude Code may ignore this allowlist on a device that deploys its own Claude Code managed settings; restrict marketplaces in those settings as well.

650>

651> This key applies only while the app runs in third-party mode. If users could otherwise sign in to Claude.ai on the device, also set `disableDeploymentModeChooser` so the app stays in third-party mode.

652

653> **userPluginUploadsEnabled details**

654>

655> When on (default), users can upload plugin files and create plugins with Claude. Set to `false` to stop users adding plugins of their own: every in-app option for doing so is hidden, and the app refuses uploads that still reach it.

656>

657> This is a feature-availability control enforced in the app, not a data boundary: plugins already installed (or placed on disk outside the app) are not removed or blocked by this key. Plugins from organization-provisioned marketplaces and the organization plugins directory are unaffected.

658>

659> This key applies only while the app runs in third-party mode. If users could otherwise sign in to Claude.ai on the device, also set `disableDeploymentModeChooser` so the app stays in third-party mode.

660

661> **scheduledTasksEnabled details**

662>

663> When on (default), users can schedule Cowork tasks and Code sessions to run later or on a recurring schedule, and Claude can create such schedules when asked.

664>

665> Set to `false` to turn scheduled tasks off for every user. The Scheduled section in Cowork and the routines list in the Code tab are hidden, together with every other place a schedule can be created. Tasks that already exist on a device no longer run; they are kept, not deleted, and run again once the key is removed or set to `true`. Claude is not offered the tools that create, change or run these tasks, and sessions start without Claude Code's own in-session scheduling tools (the `/loop` command, its cron tools and its wake-up timer).

666>

667> It does not remove task files already on the user's machine. A change takes effect at the next app launch.

668

669> **keepAwakeEnabled details**

670>

671> When on (default), users can turn on **Keep computer awake** (Settings → This computer → System, also shown as **Keep awake** on the Scheduled page in Cowork and the Routines page in Code) so the computer does not idle-sleep while Claude is open and scheduled tasks keep running on an idle machine. The Code tab can also keep the computer awake while a session is working (**Keep computer awake while Claude works** in Settings → Claude Code, and a session's **Keep computer awake** menu item).

672>

673> Set to `false` to make sure Claude never prevents the computer from sleeping: those switches are hidden and no part of the app keeps the computer awake. Users' saved choices are kept but ignored, and apply again once the key is removed or set to `true`. Scheduled tasks are unaffected and still run only while the computer is awake and the app is open.

674>

675> A change takes effect on a running app.

676

677> **developerModeEnabled details**

678>

679> When on (default), a user can turn on **Developer Mode** (Help → Troubleshooting → Enable Developer Mode), which adds the **Developer** menu and lets them open the developer tools (Chrome DevTools, Inspect Element) and a debugger for the app's main process.

680>

681> Set to `false` to keep Developer Mode off on every device that receives this setting: the **Developer** menu and the Help → Troubleshooting → Enable Developer Mode item are removed, the developer tools and the debugger cannot be opened (any already open are closed), a user's own `developer_settings.json` opt-in is ignored, and the app refuses to install an extension from a folder. Packaged (`.mcpb`) extensions are governed by `isDesktopExtensionEnabled`, not this key.

682>

683> This is a feature control, not a sandbox: extensions already installed from a folder stay installed and keep working, and an extension folder copied into the app's extensions folder by hand is not blocked.

684>

685> A change takes effect on a running app, except that the **Install unpacked extension** button in Settings keeps its launch-time state until the app restarts (clicking it while the key is off shows an error).

686

687> **quickEntryDefaultShortcut details**

688>

689> Sets the default shortcut for Quick Entry, the small prompt window that opens over other apps. It replaces Claude's built-in shortcut (double-tap Option on macOS, Ctrl+Alt+Space on Windows and Linux) for users who haven't chosen their own.

690>

691> This is a default, not a lock. A shortcut that a user saves in Settings → This computer → System (**Quick access shortcut** on macOS, **Quick Entry keyboard shortcut** on Windows and Linux) takes precedence, including one saved before this key was set.

692>

693> Accepted values:

694>

695> * Modifiers and one key joined by `+`, such as `Ctrl+Alt+K` or `Alt+Space`. Modifiers include `Ctrl`, `Alt`, `Shift`, `Cmd` and `Super`. `CommandOrControl` means Cmd on macOS and Ctrl elsewhere, so one value works on every platform. A combination must pair `Ctrl`, `Cmd` or `Super` with `Alt` or `Shift`, except for `Alt+Space`. Write modifier and key names exactly as shown: `ctrl` is not read as `Ctrl`.

696> * `off` (the string, not `false`): no shortcut. Users can still open Quick Entry from Claude's tray or menu bar icon and set a shortcut in Settings.

697> * `double-tap-option`: macOS only. Windows and Linux keep the built-in shortcut.

698>

699> While Claude is running, other apps don't receive this shortcut. So Claude rejects other combinations, such as `F11`, `Ctrl+C`, `Shift+K` or `Alt+Shift+K`, which typing and other apps rely on. It also rejects any combination that includes `Insert`, `Capslock` or `F5`, which screen readers use. Choose a combination that users don't need elsewhere.

700>

701> If Claude can't use the value as a shortcut, it ignores the value and keeps the built-in one. If another app already uses the shortcut, Claude on macOS uses the built-in shortcut. On Windows and Linux, Quick Entry keeps its previous shortcut, or none at start-up. Users can choose another in Settings.

702>

703> A change takes effect on a running app.

704

705> **quickEntryScreenshotsEnabled details**

706>

707> When on (default), Quick Entry on macOS lets a user click another app's window, or drag over part of the screen, to attach a picture of it to their prompt. Until the user grants the macOS Screen Recording permission, Quick Entry shows a **Turn on screenshots** button that asks for it.

708>

709> Set to `false` to turn this off on every device that receives this setting. Quick Entry still opens, but offers no screenshot and no such button, and Claude does not ask for that permission. Outside Quick Entry, another app's window that a user mentions with @ in a chat comes without its picture. Users cannot turn it back on.

710>

711> With `quickEntryFileSharingEnabled` off as well, Quick Entry shows no permission banner at all.

712>

713> On Windows and Linux, Quick Entry takes text only, so this key changes nothing there.

714>

715> This key does not cover:

716>

717> * A screenshot that a user takes with the operating system's own tools and then pastes or attaches. That is a file upload.

718> * Pictures that Claude takes of its own content, such as an artifact, a file preview, a page in the built-in browser (`builtinBrowserEnabled`) or the feedback form.

719> * A local MCP server or desktop extension that captures the screen (`isLocalDevMcpEnabled`, `isDesktopExtensionEnabled`).

720> * Other apps, or the operating system, capturing Claude's windows.

721>

722> A change takes effect on a running app.

723

724> **quickEntryFileSharingEnabled details**

725>

726> When on (default), Quick Entry on macOS offers, on another app's window, to attach the file that is open in it to the user's prompt. Claude learns which file that is through the macOS Accessibility permission. Until the user grants it, Quick Entry shows a **Turn on file sharing** button that asks for it.

727>

728> Set to `false` to turn this off on every device that receives this setting, including devices where the permission is already granted. Quick Entry still opens, but offers no file from another app's window and no such button, and it does not ask for that permission. Outside Quick Entry, another app's window that a user mentions with @ in a chat comes without its file. Users cannot turn it back on.

729>

730> With `quickEntryScreenshotsEnabled` off as well, Quick Entry shows no permission banner at all.

731>

732> On Windows and Linux, Quick Entry takes text only, so this key changes nothing there.

733>

734> This key does not cover:

735>

736> * A file that a user attaches, pastes or drags into Claude themselves. That is a file upload.

737> * Claude's other uses of the Accessibility permission where a user has granted it, such as telling a double tap of Option from a keyboard shortcut.

738>

739> A change takes effect on a running app.

740

741> **skipWebFetchPreflight details**

742>

743> Before fetching a page, Claude Code's WebFetch tool asks `api.anthropic.com` whether the domain is on Anthropic's content blocklist, and refuses the fetch if that lookup cannot complete. Third-party deployments route inference elsewhere and often block `api.anthropic.com` at the firewall; with the lookup on, every WebFetch in Code sessions then fails with "Unable to verify if domain … is safe to fetch", and where the host is reachable, every fetched hostname is sent to Anthropic. (Cowork sessions fetch through the app's own allowlisted fetch and never run this lookup.)

744>

745> Off (default): the lookup runs as it does today, so `api.anthropic.com` must be reachable from users' machines for Code-session WebFetch to work (listed under Egress Requirements). Set to `true` when users' machines cannot reach `api.anthropic.com` (corporate firewall, government network) or you do not want fetched hostnames sent there: Code sessions then fetch without the lookup and never contact that host for it. This is the same `skipWebFetchPreflight` setting Claude Code reads from its own [managed-settings](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings) file; the app passes it to every session it starts. This key does not restrict which domains Claude may fetch. Neither does `coworkEgressAllowedHosts` in Code sessions, where it only pre-approves its hosts; `builtinToolPolicy` can require approval for every fetch.

746

747> **builtinToolPolicy details**

748>

749> Keys use the same tool names and argument-scoped rule syntax as **Disabled built-in tools** (`disabledBuiltinTools`), and scopes apply in the same sessions. A bare `Bash` key also governs Claude Code's `PowerShell` tool (its shell on Windows PCs without Git for Windows); argument-scoped `Bash(…)` keys do not. Scoped **ask** rules reach sessions only through Claude Code's managed-settings channel, so another Claude Code managed-settings source replaces them unless it sets `parentSettingsBehavior` to `"merge"` (bare names hold either way). They need the same fleet-wide build support, and an older build drops a scoped **ask** entry as a configuration error (which also blocks WSL sessions on Windows until that client updates), so the tool runs unprompted.

750>

751> An **ask** entry, bare or scoped, also turns off the app's remembered “always allow” choices for that tool, so each prompted call is confirmed individually. **ask** on a file tool (`Read`, `Write`, `Edit`, `Glob`, `Grep`) prompts in Cowork, Chat and Code sessions. Calls that Cowork and Chat always refuse are still refused without a prompt: paths outside the session's connected folders (in Chat, outside its scratch directory and its project's folders) and protected or sensitive files inside them. A scheduled task in Cowork waits at the prompt, which appears in the task's session and, when that session is not in view, as a desktop notification. Code side chats cannot prompt, so they block matching calls. An unusable entry is dropped and recorded as a configuration error; a value other than `allow` or `ask` is treated as `ask` and reported. To remove a tool or deny a rule outright, use **Disabled built-in tools** instead.

752

753> **disabledBuiltinTools details**

754>

755> Each entry is a Claude Code [tool name](https://code.claude.com/docs/en/tools-reference) such as `Bash`, `Edit`, `WebFetch` or `WebSearch`, or an argument-scoped [permission rule](https://code.claude.com/docs/en/permissions#permission-rule-syntax) such as `Bash(curl *)` or `Edit(//**/*.env)`. A bare name covers every call (a bare `Bash` entry also covers the `PowerShell` tool); a scoped rule covers matching calls in every permission mode, including Auto and bypass. Scopes are matched for `Bash(…)` and `PowerShell(…)` (a command pattern) and for file paths written as `Read(…)` (covers `Read`, `Grep`, `Glob`) or `Edit(…)` (covers `Edit`, `Write`, `NotebookEdit`); many other tools take `Tool(<field>:<pattern>)`. `WebSearch` and `WebFetch` are bare-name only: to allow specific hosts, use `coworkEgressAllowedHosts`.

756>

757> Scoped `Bash(…)` rules apply in Code sessions only; Cowork's shell follows only a bare `Bash` entry. Start absolute file paths with `//`, not `/`: a relative pattern such as `Read(**/.env)` covers only a Code session's project folder and none of Cowork's connected folders. Scoped rules need fleet-wide build support (`disableAutoUpdates` pins builds): an older build passes a scoped entry to Claude Code unchecked. An entry whose pattern contains `)` followed by a space or comma is enforced only through Claude Code's managed-settings channel, so another Claude Code [managed-settings source](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings) replaces it unless that source sets `parentSettingsBehavior` to `"merge"`; every other entry is enforced either way.

758>

759> An unusable entry (a tool name in the wrong letter case, an unbalanced parenthesis, a scoped `WebSearch(…)` or `WebFetch(…)`) is kept, because the deny list is served exactly as written, and raises a configuration warning.

760

761> **toolSearchEnabled details**

762>

763> When enabled, Cowork, Code, and Chat sessions place only tool names in context up front, and Claude fetches a tool's full schema the first time it needs it. Use this when many MCP tools are configured and their inlined schemas crowd out the context window. If your endpoint does not accept the request shape it then receives, requests fail with HTTP 400.

764>

765> * **Claude API, Vertex AI, Bedrock, or Bedrock Mantle with no custom base URL**: not needed. The app leaves Claude Code's experimental betas on there, as terminal Claude Code does, so tool search is on by default (on Vertex AI, for Claude 4.5 and newer models). To turn it off in Code, Cowork, and Chat, set `ENABLE_TOOL_SEARCH` to `false` in the `env` block of OS-level Claude Code managed settings (with `parentSettingsBehavior: "merge"`). Earlier app versions treat these like the last case.

766> * **Gateway provider, app versions bundling Claude Code 2.1.247 or later**: requests add only the tool-search shape (the `tool-search-tool-2025-10-19` `anthropic-beta` value, deferred tool loading, `tool_reference` content blocks); every other experimental Claude Code beta stays suppressed. OS-level Claude Code managed settings that keep that suppression or turn `ENABLE_TOOL_SEARCH` off still win; set `ENABLE_TOOL_SEARCH` to `force` there instead (with `parentSettingsBehavior: "merge"`). Sessions the app runs in Claude Code's gateway mode (an opt-in for users on the gateway's own sign-in) get its gateway-safe tool-search shape instead.

767> * **Foundry, a custom base URL, and earlier app versions**: the app suppresses Claude Code's experimental betas for the session and the key lifts that, so requests carry the tool-search shape together with Claude Code's other experimental betas for that provider. On Vertex with app versions bundling Claude Code older than 2.1.221, leave this unset while any model older than Claude 4.5 is in use; those engines send the header regardless of model and Vertex's pre-4.5 stacks reject it.

717768

718769> **organizationInstructions details**

719770>

from line 776

725776

726777## Connectors

727778

729| - | - | - | - | - |

780| - | - | - | - | - | - |

781| Claude.ai data import `claudeAiImport` | `object` | MDM + Bootstrap Added in 1.10628.0 | — | Lets users import Claude.ai chats and projects, plus earlier Claude sessions on this computer, when `enabled` is true. `automatic3pImport` is a separate switch. | [`reported`](#self-hosted-column) Desktop can still export sessions stored on the person's computer, and imports none, since no session runs there |

731782

732783> **claudeAiImport details**

733784>

from line 792

741792

742793### Authentication

743794

745| - | - | - | - | - |

746| Microsoft 365 native sign-in broker `microsoftAuthBroker` | `enum` | MDM + Bootstrap Added in 1.19367.0 | `auto` | “disabled” forces browser-based Microsoft 365 sign-in; “required” fails sign-in when the OS broker is unavailable, so the refresh token stays broker-held. One of: `auto`, `disabled`, `required`. Defaults to `auto`. |

747| Microsoft 365 sign-in with the Windows account `microsoftAuthDefaultAccount` | `enum` | MDM + Bootstrap Added in 2.26454.0 | `disabled` | “enabled”: when a user clicks Connect on Windows, Microsoft 365 signs in with the work account already signed in to Windows, without the account picker. One of: `enabled`, `disabled`. Defaults to `disabled`. |

796| - | - | - | - | - | - |

797| Microsoft 365 native sign-in broker `microsoftAuthBroker` | `enum` | MDM + Bootstrap Added in 1.19367.0 | `auto` | “disabled” forces browser-based Microsoft 365 sign-in; “required” fails sign-in when the OS broker is unavailable, so the refresh token stays broker-held. One of: `auto`, `disabled`, `required`. Defaults to `auto`. | [`none`](#self-hosted-column) Steers the sign-in of Desktop's bundled Microsoft 365 connector, started for no session on a self-hosted install |

798| Microsoft 365 sign-in with the Windows account `microsoftAuthDefaultAccount` | `enum` | MDM + Bootstrap Added in 2.26454.0 | `disabled` | “enabled”: when a user clicks Connect on Windows, Microsoft 365 signs in with the work account already signed in to Windows, without the account picker. One of: `enabled`, `disabled`. Defaults to `disabled`. | [`none`](#self-hosted-column) Picks the account for Desktop's bundled Microsoft 365 connector, started for no session on a self-hosted install |

748799

749800> **microsoftAuthBroker details**

750801>

from line 807

756807

757808### Extensions

758809

760| - | - | - | - | - |

811| - | - | - | - | - | - |

813| Require signed extensions `isDesktopExtensionSignatureRequired` | `boolean` | MDM + Bootstrap Added in 1.2581.0 | `false` | Reject desktop extensions that are not signed by a trusted publisher. Defaults to `false`. | [`none`](#self-hosted-column) Desktop installs no extension on a self-hosted install, so there is no signature for it to require |

763814

764815> **isDesktopExtensionEnabled details**

765816>

from line 818

767818

768819### MCP

769820

771| - | - | - | - | - |

773| Allow persistent tool approvals `mcpPersistentAlwaysAllowEnabled` | `boolean` | MDM + Bootstrap Added in 1.24012.9 | `true` | Offer the persistent “Always allow” approval options for MCP tools. Disable to keep tool approvals per-call or session-scoped only. Defaults to `true`. |

774| Scheduled-task tool approval lifetime `mcpScheduledTaskApprovalLifetimeDays` | `integer` | MDM + Bootstrap Added in 2.7032.0 | — | How many days a scheduled task may reuse a lasting MCP-tool approval before it asks again. 0 removes the lasting option. Range: 0–3650. |

775| Allow user-added MCP servers `isLocalDevMcpEnabled` | `boolean` | MDM + Bootstrap Added in 1.2581.0 | `true` | Local stdio servers added via the Developer settings. On third-party deployments, off also stops plugins’ local servers. Remote servers keep working. Defaults to `true`. |

776| Allowed plugin MCP servers `allowedPluginMcpServers` | `object[]` | MDM + Bootstrap Added in 2.2553.0 | — | Servers plugins may connect in sessions, beyond the managed list above and organization plugins. An empty list allows none; unset keeps today’s rules. |

777| Blocked plugin MCP servers `deniedPluginMcpServers` | `object[]` | MDM + Bootstrap Added in 2.16120.0 | — | Remote servers plugins may not connect, even if the allowed list admits them; in Code sessions, configuration-file servers too. Unset or empty blocks none. |

822| - | - | - | - | - | - |

823| Managed MCP servers `managedMcpServers` | `object[]` | MDM + Bootstrap Added in 1.2581.0 | — | Org-pushed MCP servers: remote (HTTP/SSE) or local (stdio command). May embed bearer tokens. | [`server`](#self-hosted-column) The host connects the admin's MCP servers and applies each tool's rule, and tells Desktop which local ones to start |

824| Allow persistent tool approvals `mcpPersistentAlwaysAllowEnabled` | `boolean` | MDM + Bootstrap Added in 1.24012.9 | `true` | Offer the persistent “Always allow” approval options for MCP tools. Disable to keep tool approvals per-call or session-scoped only. Defaults to `true`. | [`server`](#self-hosted-column) When off, the host leaves lasting MCP tool approvals out of its sessions, and tells Desktop not to offer them |

825| Scheduled-task tool approval lifetime `mcpScheduledTaskApprovalLifetimeDays` | `integer` | MDM + Bootstrap Added in 2.7032.0 | — | How many days a scheduled task may reuse a lasting MCP-tool approval before it asks again. 0 removes the lasting option. Leave blank for no time limit. Range: 0–3650. | [`server`](#self-hosted-column) The host limits how many days a scheduled task may reuse a lasting MCP tool approval, and tells Desktop |

826| Allow local MCP servers `isLocalDevMcpEnabled` | `boolean` | MDM + Bootstrap Added in 1.2581.0 | `true` | Local stdio servers added via the Developer settings. On third-party deployments, off also stops plugins’ local servers. Remote servers keep working. Defaults to `true`. | [`server`](#self-hosted-column) When off, only the local MCP servers the host names start on the person's computer, and none the person added |

827| Allowed plugin MCP servers `allowedPluginMcpServers` | `object[]` | MDM + Bootstrap Added in 2.2553.0 | — | Servers plugins may connect in sessions, beyond the managed list above and organization plugins. An empty list allows none; unset keeps today’s rules. | [`server`](#self-hosted-column) The host connects a plugin's remote MCP server only where this list admits it; while it is unset, none connects |

828| Blocked plugin MCP servers `deniedPluginMcpServers` | `object[]` | MDM + Bootstrap Added in 2.16120.0 | — | Remote servers plugins may not connect, even if the allowed list admits them; in Code sessions, configuration-file servers too. Unset or empty blocks none. | [`server`](#self-hosted-column) The host refuses a plugin's remote MCP server that this list matches, even where the allowed list admits it |

779830

780831> **managedMcpServers details**

781832>

from line 850

804856> | `provider` | `enum` | — | Runs search from the desktop, for inference providers without native web search. Supply the provider’s API key through the headers helper script below. One of: `brave`, `tavily`, `exa`, `custom`. |

from line 879

828880> | `env` | `object` | — | Environment variables set for the command. |

832885

from line 943

890943

891944## Telemetry & updates

892945

894| - | - | - | - | - |

898| Block nonessential services `disableNonessentialServices` | `boolean` | MDM + Bootstrap Added in 1.2581.0 | `false` | Connector favicons, artifact-preview and MCP Apps iframes, and the Linux spellcheck dictionary. Connector widgets fall back to text; spellcheck is off on Linux. Defaults to `false`. |

947| - | - | - | - | - | - |

948| Organization UUID `deploymentOrganizationUuid` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | A UUID you generate. Tags telemetry so Anthropic support can locate your fleet’s events, and namespaces each user’s local data. Not used for auth. | [`client`](#self-hosted-column) Tags the desktop app's telemetry and names its local data on the person's computer |

949| Block essential telemetry `disableEssentialTelemetry` | `boolean` | MDM + Bootstrap Added in 1.2581.0 | `false` | Crash and performance reports to Anthropic. Defaults to `false`. | [`client`](#self-hosted-column) Desktop starts its crash reports to Anthropic at launch, before sign-in, and a host's sessions never send any |

950| Block nonessential telemetry `disableNonessentialTelemetry` | `boolean` | MDM + Bootstrap Added in 1.2581.0 | `false` | Product-usage analytics (no message content) and diagnostic-report uploads. Defaults to `false`. | [`client`](#self-hosted-column) Desktop sends usage analytics to Anthropic from before sign-in, and a host's sessions never send any |

951| Block nonessential services `disableNonessentialServices` | `boolean` | MDM + Bootstrap Added in 1.2581.0 | `false` | Connector favicons, artifact-preview and MCP Apps iframes, and the Linux spellcheck dictionary. Connector widgets fall back to text; spellcheck is off on Linux. Defaults to `false`. | [`client`](#self-hosted-column) Desktop fetches connector icons, preview frames and a dictionary, starting before it has signed in to the host |

899952

900953> **deploymentOrganizationUuid details**

901954>

from line 978

925978

926979### Auto update

927980

929| - | - | - | - | - |

933| Release channel `releaseChannel` | `enum` | MDM + Bootstrap Added in 3.1623.0 | `stable` | Which releases auto-update installs. Stable: each release as it rolls out. Staggered: a release only after it has been on stable for a while. One of: `stable`, `staggered`. Defaults to `stable`. |

982| - | - | - | - | - | - |

983| Block auto-updates `disableAutoUpdates` | `boolean` | MDM + Bootstrap Added in 1.2581.0 | `false` | Stop Claude Desktop from fetching updates entirely (no time limit). You’ll need to push new versions yourself. Defaults to `false`. | [`client`](#self-hosted-column) Desktop starts its updater at launch, before it has signed in to the host |

984| Restart to apply installed updates `installedUpdateEnforcementEnabled` | `boolean` | MDM + Bootstrap Added in 3.6556.1 | — | With auto-updates blocked, Claude restarts for a newer version installed while it was open, after 72 hours or your window. On Windows it may stay closed. | [`none`](#self-hosted-column) Governs Desktop's own restart for a version installed on the computer, and no session host passes it on to Desktop yet |

985| Installed-update enforcement window `installedUpdateEnforcementHours` | `integer` | MDM + Bootstrap Added in 3.6556.1 | — | Hours Claude waits to restart for a newer version installed while it was open. Blank: 72 hours, then until the computer is idle. A number skips the idle wait. Range: 1–72. | [`none`](#self-hosted-column) Times Desktop's own restart for a version installed on the computer, and no session host passes it on to Desktop yet |

986| Auto-update enforcement window `autoUpdaterEnforcementHours` | `integer` | MDM + Bootstrap Added in 1.2581.0 | — | Hours before a downloaded update force-installs. Only applies when auto-updates are enabled. Blank = 72-hour default. Range: 1–72. | [`reported`](#self-hosted-column) Desktop itself quits and installs a downloaded update of the app on the person's computer |

987| Check for updates on releases.claude.com `updateViaUpdatesHost` | `boolean` | MDM + Bootstrap Added in 1.26832.0 | `false` | Read the update feed from releases.claude.com so api.anthropic.com can stay blocked. Defaults to `false`. | [`none`](#self-hosted-column) Where the session host answers the app's update checks, no Anthropic update server is left to choose |

988| Release channel `releaseChannel` | `enum` | MDM + Bootstrap Added in 3.1623.0 | `stable` | On Stable, devices take each release as it rolls out. On Staggered, they update less often, usually to a version first out on Stable a week or more earlier. One of: `stable`, `staggered`. Defaults to `stable`. | [`client`](#self-hosted-column) On staggered, the person can update only once Desktop has downloaded a build; the session host ignores the channel |

934989

935990> **disableAutoUpdates details**

936991>

937992> In third-party deployments this also keeps Cowork's workspace image and tools from being fetched ahead of use; they are then fetched when a task first needs them.

993>

994> When a newer version is installed on a device while Claude is open, the app shows "Relaunch to update" in the sidebar. The check makes no network request. On Windows this covers installs from the MSIX package, for one person or for the whole device, not the Microsoft Store version or the .exe installer. There it offers the newest version it finds on the device, which may be one installed for someone else. The click quits Claude, and Windows may then open the newer version. Where it does not (it did not on the Windows Server machines tested), people open Claude again and get the newer version. If Windows refuses the switch, Claude comes back on the version it had, and so does the notice. The switch may also end the Cowork tasks of others signed in on that computer. A separate setting has Claude restart by itself if nobody relaunches within a set number of hours.

995

996> **installedUpdateEnforcementEnabled details**

997>

998> Set it where `disableAutoUpdates` is set. Both are app-behavior keys: a profile that sets any app-behavior key becomes the only source for all of them, so a profile that held this key alone would drop a `disableAutoUpdates` set elsewhere.

999>

1000> Applies only while `disableAutoUpdates` is on, where you distribute new versions yourself. When a newer version is installed on a device while Claude is open, the app shows "Relaunch to update" in the sidebar. With this setting on, if nobody relaunches within the window, the app restarts itself and comes back on the page it was showing. `installedUpdateEnforcementHours` sets the window and says what holds the restart off.

1001>

1002> On Windows this covers installs from the MSIX package. Claude closes, switches to the newest version on the device (it may be one installed for someone else), and Windows may then open it. Where it does not, Claude stays closed, and scheduled tasks and background work stop, until someone opens it; opened after five minutes, it starts on its default page. If Windows refuses the switch, Claude comes back on the version it had and does not try again until it is reopened. The switch may also end the Cowork tasks of others signed in on that computer.

1003>

1004> Where it is not set, the restart is off in third-party deployments, and in first-party deployments it follows Anthropic's own rollout; `false` keeps it off. An unreadable value counts as `false`. Turning it on starts a whole new window. It has no effect on updates that Claude downloads itself; `autoUpdaterEnforcementHours` times those.

1005>

1006> A version from before this setting existed does not restart by itself and does not know the name: it ignores it in a macOS profile, and from other sources it may show people a configuration warning at every launch. A Windows machine policy that holds only such names, or a Linux managed-settings file that holds one and sets no connection, is rejected as unusable, and the app then also ignores the configuration saved on the device itself.

1007

1008> **installedUpdateEnforcementHours details**

1009>

1010> No effect unless `disableAutoUpdates` is on and the restart is on (`installedUpdateEnforcementEnabled`). The window starts when the open app first finds a newer version installed; on Linux, where it cannot read the version, any replacement of the app counts. Only time with the app open and the computer awake counts.

1011>

1012> Leaving it blank uses the 72-hour default *and* then waits for the machine to be idle (10+ minutes without input) before restarting; setting any explicit value (including 72) restarts once the window elapses regardless of user activity. In both cases the restart holds off while Claude is mid-task, unless the task runs on an SSH host and the app expects to pick it up again after the restart. Where the system reports no idle time, as some Wayland sessions do, a blank window never restarts: set a number.

9381013

9391014> **autoUpdaterEnforcementHours details**

9401015>

941> Has no effect when `disableAutoUpdates` is in place at launch: the updater never starts, so nothing is downloaded and this timer never arms. If the policy reaches an already-running app after an update has downloaded, that one staged update still installs on this timer; no further updates are fetched.

1016> Has no effect when `disableAutoUpdates` is in place at launch: nothing is downloaded, so this timer never arms. If the policy reaches an already-running app after an update has begun to download, that one update still installs on this timer; no further updates are fetched.

9421017>

9431018> Leaving it blank uses the 72-hour default *and* then waits for the machine to be idle (10+ minutes without input) before restarting; setting any explicit value (including 72) restarts once the window elapses regardless of user activity. In both cases the restart holds off while Claude is mid-task, unless the task runs on an SSH host and the app expects to pick it up again after the restart.

9441019

from line 1022

9471022> By default the app asks `api.anthropic.com` which version to install. That host also serves the model APIs, so organizations that block un-approved LLM endpoints at the network edge end up blocking updates too.

9481023>

9491024> Turn this on to read the same feed from `releases.claude.com`, a hostname that carries no model API. `api.anthropic.com` can then stay blocked without breaking auto-update. Rollout behavior is unchanged; the installer download still comes from `downloads.claude.ai` as before.

1025>

1026> If a device profile sets `bootstrapUrl` to a URL on `config.claude.com` and leaves `bootstrapEnabled` on, the app reads the feed from `releases.claude.com` whatever this key says. Older versions of the app do so only when this key is on, so turn it on as well.

9501027

9511028> **releaseChannel details**

9521029>

953> Third-party deployments only. `stable` (default): devices take each release as it rolls out. `staggered`: devices update only to the release Anthropic has marked for this channel, after it has fully rolled out on stable, and skip the ones in between. They stay where they are until a newer one is marked, so features and fixes, security fixes included, reach them later.

954>

955> Devices never move to an older version. One already on a newer version than the marked one, a new install included, waits until the channel passes it. After a change to `stable`, or removal of the setting, devices update to the newest release. An update downloaded before the setting reached a device can still install. A change applies at the next update check, with no restart; a served one, once two configuration checks in a row return it. At each launch, a device last served this setting, with either value, follows `staggered` until it has fetched its configuration again. An unreadable value, such as a misspelling, counts as `staggered`.

956>

957> The setting applies only while the app is set up for your organization's deployment. A device managed from the admin console follows `stable` until its user signs in, and again after sign-out. Elsewhere, a user who signs in to Claude.ai instead follows `stable` too; `disableDeploymentModeChooser` removes that choice. A version from before this setting existed follows `stable`, and on Windows or Linux may reject a machine policy that names it and turn off local settings.

958>

959> With `disableAutoUpdates` on, nothing updates and this setting has no effect. Where something else delivers updates (apt on Linux, the Microsoft Store), it has no effect either. A device-management profile that sets only app-behavior keys becomes the only source for all of them, so put this key in that profile. Where a profile names a configuration server, or the admin console manages the device, set this key there.

1030> Default: `stable`, which takes each release as it rolls out.

1031>

1032> Alternative: `staggered`, which usually updates on Thursdays to a release that has been live in production on `stable` with no known breaking issues. Typically the `staggered` release will be 7-14 days behind `stable`; urgent fixes may be released sooner.

1033>

1034> Devices download their new version at the next update check and install it on restart. Devices on `staggered` receive features and fixes, security fixes included, later than devices on `stable`. A device that's currently ahead of `staggered` will stay ahead until `staggered` catches up to its version.

1035>

1036> Switching to `stable` or removing the setting updates devices to the newest release.

1037>

1038> * An unreadable value, such as a misspelling or capital letter, is read as `staggered`.

1039> * The setting applies only in third-party mode. A user who signs in to Claude.ai follows `stable`, unless their organization manages Claude Desktop from the admin console.

1040> * On a device managed from the admin console, this setting applies only while a user is signed in. With no one signed in, the device follows `stable`.

1041> * The setting has no effect on Linux or Microsoft Store installs.

1042> * See [the installation page](https://claude.com/docs/third-party/claude-desktop/installation) for more details on where to set the key.

9601043

9611044### Configuration updates

9621045

964| - | - | - | - | - |

965| Configuration relaunch window `relaunchEnforcementHours` | `integer` | MDM + Bootstrap Added in 1.40609.0 | `24` | Hours a user may keep working on the old configuration after a managed-configuration change is detected. 0 = restart required at once. Blank = 24 hours. Defaults to `24`. Range: 0–336. |

967| Keep only your organization ID and restrictions on disk `disableLocalConfigCache` | `boolean` | hybrid-only Added in 2.7032.0 | `false` | Don’t keep your organization’s name or any permissive setting on disk between launches; only your organization ID and the restrictions you turn on are kept. Defaults to `false`. |

1047| - | - | - | - | - | - |

1048| Configuration relaunch window `relaunchEnforcementHours` | `integer` | MDM + Bootstrap Added in 1.40609.0 | `24` | Hours a user may keep working on the old configuration after a managed-configuration change is detected. 0 = restart required at once. Blank = 24 hours. Defaults to `24`. Range: 0–336. | [`reported`](#self-hosted-column) Desktop itself restarts on the person's computer after a change to the settings it reads from the device |

1049| Configuration re-check interval `configRecheckIntervalMinutes` | `integer` | MDM + Bootstrap Added in 1.46388.1 | `10` | Minutes between the running app’s checks for a changed managed configuration. Blank = 10 minutes. Defaults to `10`. Range: 2–30. | [`server`](#self-hosted-column) The host refreshes its own copy of the policy at least this often, and tells Desktop how often to ask it again |

1050| Keep only your organization ID and restrictions on disk `disableLocalConfigCache` | `boolean` | hybrid-only Added in 2.7032.0 | `false` | Don’t keep your organization’s name or any permissive setting on disk between launches; only your organization ID and restrictions are kept. Defaults to `false`. | — |

9681051

9691052> **relaunchEnforcementHours details**

9701053>

from line 1063

9801063

9811064> **disableLocalConfigCache details**

9821065>

983> By default the app keeps on disk, from the last configuration the admin console served, your organization’s ID and name and the few settings a launch applies before the console answers (the telemetry switches, the Microsoft 365 sign-in broker setting, and any restriction you have turned on). When this is on, it keeps only your organization ID and those restrictions (for example telemetry blocked, or local MCP servers off), never the name or anything you have allowed, and cuts an earlier copy down at the next launch that reaches the console, or at once when a running app confirms the change; signing out deletes the kept copy too. While on: crash and performance reports to Anthropic do not start on these devices, and the sign-in screen and account switcher cannot show your organization’s name before the console answers.

1066> By default the app keeps on disk, from the last configuration the admin console served, your organization’s ID and name and the few settings a launch applies before the console answers (the telemetry switches, the Microsoft 365 sign-in broker setting, the default Quick Entry shortcut, and restrictions). When this is on, it keeps only your organization ID and those restrictions (for example telemetry blocked, or local MCP servers off), never the name or anything you have allowed, and cuts an earlier copy down at the next launch that reaches the console, or at once when a running app confirms the change; signing out deletes the kept copy too. While on: the app’s crash reporting does not start on these devices, and the sign-in screen cannot show your organization’s name before the console answers. Error stack traces and performance timings still leave these devices unless **Block essential telemetry** is on.

9841067>

9851068> A running app picks up a change to this setting once two configuration checks in a row have served it; changing it alone never asks for a relaunch. It applies only to organizations managed from the Claude admin console; the setting is ignored when a customer configuration server or a device profile sends it.

9861069

9871070### OTLP

9881071

990| - | - | - | - | - |

995| OpenTelemetry headers helper script `otlpHeadersHelper` | `string` | MDM + Bootstrap Added in 1.30096.1 | — | Absolute path to an executable that prints a JSON object of collector headers. Merged over the static headers and Collector authentication; the helper wins. |

997| Desktop telemetry export level `otlpDesktopLogLevel` | `enum` | MDM + Bootstrap Added in 1.9255.0 | `error` | Controls the Claude Desktop application’s events, separate from Cowork and Code sessions. Defaults to error. One of: `off`, `error`, `warn`, `info`, `debug`. Defaults to `error`. |

998| Content capture categories `otlpContentCapture` | `enum[]` | MDM + Bootstrap Added in 1.15962.0 | — | Content categories Claude Desktop sends unredacted to your collector. `userPrompts` also sends Claude’s responses. If empty, no category is enabled (default). One of: `userPrompts`, `assistantResponses`, `toolDetails`, `toolContent`, `rawApiBodies`. |

1000| Telemetry attribute length limit `otlpAttrMaxChars` | `integer` | MDM + Bootstrap Added in 2.31226.0 | — | Maximum length, in characters, of captured content such as a raw API body (256–15,000,000). Cowork tasks and Code sessions use 61,440 when unset. Range: 256–15000000. |

1073| - | - | - | - | - | - |

1075| OTLP protocol `otlpProtocol` | `enum` | MDM + Bootstrap Added in 1.2581.0 | `http/protobuf` | Transport protocol for the OpenTelemetry exporters. One of: `http/protobuf`, `http/json`, `grpc`. Defaults to `http/protobuf`. | [`none`](#self-hosted-column) Set beside the collector's address in the host's own configuration |

1076| OTLP headers `otlpHeaders` | `object` | MDM + Bootstrap Added in 1.2581.0 | — | Static collector headers — routing and tenant headers only. No credentials here; use Collector authentication or the headers helper script for tokens. | [`none`](#self-hosted-column) The host keeps the collector's headers in its own configuration, so no document that a device fetches holds them |

1077| Collector authentication `otlpAuthMode` | `enum` | MDM + Bootstrap Added in 1.30096.1 | — | inference-credential sends the user’s inference bearer token to the collector as Authorization: Bearer. One of: `none`, `inference-credential`. | [`none`](#self-hosted-column) Would send the person's model token to the collector; a self-hosted Desktop holds none, and no host reads this |

1078| OTLP headers helper script `otlpHeadersHelper` | `string` | MDM + Bootstrap Added in 1.30096.1 | — | Absolute path to an executable that prints a JSON object of collector headers. Merged over the static headers and Collector authentication; the helper wins. | [`none`](#self-hosted-column) Desktop sends its own events to the host, which holds the collector's headers, so it runs no helper |

1079| Resource attributes `otlpResourceAttributes` | `object` | MDM + Bootstrap Added in 1.5354.0 | — | Extra resource attributes to attach to every span/metric. A static enduser.id set here always wins over the runtime identity. | [`server`](#self-hosted-column) The host stamps these attributes on the session telemetry it sends and on Desktop's events that it forwards |

1080| Desktop telemetry export level `otlpDesktopLogLevel` | `enum` | MDM + Bootstrap Added in 1.9255.0 | `error` | Controls the Claude Desktop application’s events, separate from Cowork and Code sessions. Defaults to error. One of: `off`, `error`, `warn`, `info`, `debug`. Defaults to `error`. | [`server`](#self-hosted-column) The host tells Desktop at which level to send its own events, and filters them again before it forwards them |

1081| Content capture `otlpContentCapture` | `enum[]` | MDM + Bootstrap Added in 1.15962.0 | — | Content categories Claude Desktop sends unredacted to your collector. `userPrompts` also sends Claude’s responses. If empty, no category is enabled (default). One of: `userPrompts`, `assistantResponses`, `toolDetails`, `toolContent`, `rawApiBodies`. | [`server`](#self-hosted-column) The host decides how much of a session's content its telemetry carries |

1083| Telemetry attribute length limit `otlpAttrMaxChars` | `integer` | MDM + Bootstrap Added in 2.31226.0 | — | Maximum length, in characters, of captured content such as a raw API body (256–15,000,000). Cowork tasks and Code sessions use 61,440 when unset. Range: 256–15000000. | [`server`](#self-hosted-column) The host cuts long values in the session telemetry it sends |

10011084

10021085> **otlpProtocol details**

10031086>

from line 1092

10091092

10101093> **otlpHeadersHelper details**

10111094>

1012> Absolute path to an executable that prints a single JSON object of HTTP headers on stdout, e.g. `{"Authorization": "Bearer …"}`. The desktop runs it (no arguments; output cached for a few minutes, and a failure is not retried for 30 seconds) whenever it needs collector headers and merges the result over **OpenTelemetry exporter headers** and the **Collector authentication** header (the helper wins on conflict). Cowork tasks get the current output when they start; Code and Cowork sessions are also given the script as Claude Code’s own `otelHeadersHelper`, so an open session re-runs it as tokens rotate (on Windows this applies to `.exe`, `.cmd` and `.bat` helpers; a `.ps1` helper applies at session start only); the desktop’s own event exporter re-runs it per flush. Session start waits at most two seconds for a slow helper and otherwise proceeds without its headers until it finishes. Use this when the collector needs a credential the inference sign-in cannot provide, when the collector token rotates, or when the config comes from a hosted admin console, which cannot store header values. If the helper fails, telemetry is sent without its headers — check the app log.

1095> Absolute path to an executable that prints a single JSON object of HTTP headers on stdout, e.g. `{"Authorization": "Bearer …"}`. The desktop runs it (no arguments; output cached for a few minutes, and a failure is not retried for 30 seconds) whenever it needs collector headers and merges the result over **OTLP headers** and the **Collector authentication** header (the helper wins on conflict). Cowork tasks get the current output when they start; Code and Cowork sessions are also given the script as Claude Code’s own `otelHeadersHelper`, so an open session re-runs it as tokens rotate (on Windows this applies to `.exe`, `.cmd` and `.bat` helpers; a `.ps1` helper applies at session start only); the desktop’s own event exporter re-runs it per flush. Session start waits at most two seconds for a slow helper and otherwise proceeds without its headers until it finishes. Use this when the collector needs a credential the inference sign-in cannot provide, when the collector token rotates, or when the config comes from a hosted admin console, which cannot store header values. If the helper fails, telemetry is sent without its headers — check the app log.

10131096

10141097> **otlpResourceAttributes details**

10151098>

from line 1132

10491132

10501133### Session retention

10511134

1053| - | - | - | - | - |

1054| Chat retention period `chatSessionRetentionDays` | `integer` | MDM + Bootstrap Added in 1.52386.0 | — | Delete chats, with their files, after this many days without activity. Unset: kept until the user deletes them. Projects and memory stay. Range: 1–3650. |

1055| Cowork retention period `coworkSessionRetentionDays` | `integer` | MDM + Bootstrap Added in 1.52386.0 | — | Delete Cowork tasks, with their uploads and outputs, after this many days without activity. Unset: kept until the user deletes them. Spaces and memory stay. Range: 1–3650. |

1056| Code retention period `codeSessionRetentionDays` | `integer` | MDM + Bootstrap Added in 1.52386.0 | — | Delete Code sessions, conversation included, after this many days without activity. Unset: kept until the user deletes them. Uncommitted work stays on disk. Range: 1–3650. |

1136| - | - | - | - | - | - |

1137| Chat retention period `chatSessionRetentionDays` | `integer` | MDM + Bootstrap Added in 1.52386.0 | — | Delete chats, with their files, after this many days without activity. Unset: kept until the user deletes them. Projects and memory stay. Range: 1–3650. | [`none`](#self-hosted-column) Chat runs only on the person's computer, so a session host holds no chats to delete |

1138| Cowork retention period `coworkSessionRetentionDays` | `integer` | MDM + Bootstrap Added in 1.52386.0 | — | Delete Cowork tasks, with their uploads and outputs, after this many days without activity. Unset: kept until the user deletes them. Spaces and memory stay. Range: 1–3650. | [`server`](#self-hosted-column) The host keeps the Cowork sessions it runs, so it deletes those left idle longer than the admin allows |

1139| Code retention period `codeSessionRetentionDays` | `integer` | MDM + Bootstrap Added in 1.52386.0 | — | Delete Code sessions, conversation included, after this many days without activity. Unset: kept until the user deletes them. Uncommitted work stays on disk. Range: 1–3650. | [`server`](#self-hosted-column) The host keeps the Code sessions it runs, so it deletes those left idle longer than the admin allows |

1140| Suspend session deletion `sessionRetentionHold` | `boolean` | MDM + Bootstrap Added in 1.52386.0 | — | Suspend all automatic session deletion for these users (legal hold). While on, the retention periods above delete nothing. | [`server`](#self-hosted-column) The host keeps the sessions, so it is the one that stops deleting them during a hold |

10581141

10591142> **chatSessionRetentionDays details**

10601143>

from line 1157

10741157

10751158### Token limits

10761159

1078| - | - | - | - | - |

1161| - | - | - | - | - | - |

1162| Max tokens per window `inferenceMaxTokensPerWindow` | `integer` | MDM + Bootstrap Added in 1.2581.0 | — | Limits each person’s input and output tokens per window. Cached tokens do not count, so this does not cap your provider’s bill. Leave blank for no limit. | [`server`](#self-hosted-column) The host makes the model calls, so it counts each person's tokens and stops them at the cap |

1163| Token cap window `inferenceTokenWindowHours` | `integer` | MDM + Bootstrap Added in 1.2581.0 | — | The count resets to zero at the end of each window. A window can last 1 to 720 hours (30 days). Range: 1–720. | [`server`](#self-hosted-column) Sets the length of the window for the token cap, which the host counts |

10811164

10821165> **inferenceMaxTokensPerWindow details**

10831166>

from line 1176

10931176

10941177## Appearance

10951178

1097| - | - | - | - | - |

1101| Hide configuration deprecation warnings `disableConfigDeprecationWarnings` | `boolean` | MDM + Bootstrap Added in 1.40609.0 | — | Don’t show users the in-app warning that this configuration uses a deprecated field. The final reminder in the 24 hours before the cut-off still appears. |

1180| - | - | - | - | - | - |

1181| End-user attribution `endUserAttribution` | `boolean` | MDM + Bootstrap Added in 1.25927.0 | — | Show the signed-in user’s identity-provider identity in the sidebar and account menu, and emit it as the OpenTelemetry enduser.id resource attribute. | [`server`](#self-hosted-column) The host puts the person's identity on the telemetry it sends, and tells Desktop whether to show the person's name |

1182| Deployment display name `deploymentDisplayName` | `string` | MDM + Bootstrap Added in 1.24012.0 | — | Overrides the provider label shown in the sidebar footer, user-menu header, and connection-error banner. | [`reported`](#self-hosted-column) Desktop shows this name in place of the provider's name in its own window |

1183| Deployment display subtitle `deploymentDisplaySubtitle` | `string` | MDM + Bootstrap Added in 1.24012.0 | — | Optional detail shown after the deployment display name in the account-menu header. | [`reported`](#self-hosted-column) Desktop shows this detail after the deployment's name in its account menu |

1184| Hide configuration deprecation warnings `disableConfigDeprecationWarnings` | `boolean` | MDM + Bootstrap Added in 1.40609.0 | — | Don’t show users the in-app warning that this configuration uses a deprecated field. The final reminder in the 24 hours before the cut-off still appears. | [`reported`](#self-hosted-column) Desktop shows its warning about deprecated settings in its own window, for configuration that Desktop reads itself |

11031186

11041187> **endUserAttribution details**

11051188>

1106> When on (default), the app resolves the signed-in user's identity from the configured credential source (the identity provider claim, or the OS login name when no claim is available) and shows it in the sidebar footer, the account menu, and the Code session greeting. If an OpenTelemetry collector is configured, the same identity is also emitted as the `enduser.id` resource attribute on every span, metric, and log sent to your collector — unless you have set a static `enduser.id` under OpenTelemetry resource attributes, in which case your static value is kept and the runtime identity is not emitted. When off, no identity is shown in the app and no runtime `enduser.id` is emitted; a static `enduser.id` under OpenTelemetry resource attributes still passes through unchanged. This setting does not gate the `process.owner` resource attribute (the OS login name), which is standard OpenTelemetry process metadata and is always emitted — set a static `process.owner` under OpenTelemetry resource attributes to override it. Applies to both Cowork tasks and Code sessions.

1189> When on (default), the app resolves the signed-in user's identity from the configured credential source (the identity provider claim, or the OS login name when no claim is available) and shows it in the sidebar footer, the account menu, and the Code session greeting. If an OpenTelemetry collector is configured, the same identity is also emitted as the `enduser.id` resource attribute on every span, metric, and log sent to your collector — unless you have set a static `enduser.id` under **Resource attributes**, in which case your static value is kept and the runtime identity is not emitted. When off, no identity is shown in the app and no runtime `enduser.id` is emitted; a static `enduser.id` under **Resource attributes** still passes through unchanged. This setting does not gate the `process.owner` resource attribute (the OS login name), which is standard OpenTelemetry process metadata and is always emitted — set a static `process.owner` under **Resource attributes** to override it. Applies to both Cowork tasks and Code sessions.

11071190

11081191> **deploymentDisplayName details**

11091192>

from line 1214

11311214

11321215### Feature discovery

11331216

1135| - | - | - | - | - |

1136| Hide feature announcements `disableFeatureDiscovery` | `boolean` | MDM + Bootstrap Added in 1.21459.0 | `false` | Suppress unprompted feature-announcement UI: the post-update “What’s new” nudge and new-feature tips. Users can still open release notes themselves. Defaults to `false`. |

1218| - | - | - | - | - | - |

1219| Hide feature announcements `disableFeatureDiscovery` | `boolean` | MDM + Bootstrap Added in 1.21459.0 | `false` | Suppress unprompted feature-announcement UI: the post-update “What’s new” nudge and new-feature tips. Users can still open release notes themselves. Defaults to `false`. | [`reported`](#self-hosted-column) Desktop hides its own announcements of new features |

11371220

11381221> **disableFeatureDiscovery details**

11391222>

from line 1226

11431226

11441227## Plugins

11451228

1147| - | - | - | - | - |

1149| Plugin marketplaces `allowedPluginMarketplaces` | `object[]` | MDM + Bootstrap Added in 1.17377.1 | — | Git repositories or hosted marketplace.json URLs to surface as plugin marketplaces in the Directory’s Organization tab. The app re-fetches each periodically. |

1150

1151> **orgPluginSettings details**

1152>

1153> Locks per-tool permissions on MCP servers provided by any installed plugin — from the org-plugins directory or a plugin marketplace, remote or run locally — one entry per server name (compared case-insensitively):

1154>

1155> ```json theme={null}

1156> [{"serverName": "internal-search", "tools": [{"toolName": "delete_document", "permission": "blocked"}]}]

1157> ```

1158>

1159> The older record form (`{"mcpServers": {"internal-search": {"toolPolicy": {"delete_document": "blocked"}}}}`) is no longer accepted. Desktop versions before 1.15200.0 parse only the record form: on those builds an array value is ignored and plugin tool locks are **not enforced**, so update the fleet past 1.15200.0 before deploying the array form.

1160>

1161> If a Managed MCP servers entry is for the same server (same URL, else same name), that entry decides alone: its `toolPolicy` (if any) applies and the entry here is ignored. A value that cannot be read blocks every tool of every plugin-provided MCP server no Managed MCP servers entry covers.

1162>

1163> For a plugin server that Claude Code launches or connects to itself (a marketplace plugin's), the permissions travel on Claude Code's managed-settings channel: another Claude Code [managed-settings source](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings) on the device replaces them unless that source sets `parentSettingsBehavior` to `"merge"`. `blocked` on a server the app connects to itself holds either way.

1164>

1166> | - | - | - | - |

1230| - | - | - | - | - | - |

1231| Plugin marketplaces `allowedPluginMarketplaces` | `object[]` | MDM + Bootstrap Added in 1.17377.1 | — | Git repositories or hosted marketplace.json URLs to surface as plugin marketplaces in the Directory’s Organization tab. The app re-fetches each periodically. | [`server`](#self-hosted-column) The host fetches the admin's plugin marketplaces and loads their plugins into the sessions it runs |

11711233

11721234> **allowedPluginMarketplaces details**

11731235>

from line 1246

11841246> | `url` | `string` | — | HTTPS Git remote of the marketplace repository (git), or direct HTTPS URL of a hosted marketplace.json file (url). |

11861248

1249> **orgPluginSettings details**

1250>

1251> Locks per-tool permissions on MCP servers provided by any installed plugin — from the org-plugins directory or a plugin marketplace, remote or run locally — one entry per server name (compared case-insensitively):

1252>

1253> ```json theme={null}

1254> [{"serverName": "internal-search", "tools": [{"toolName": "delete_document", "permission": "blocked"}]}]

1255> ```

1256>

1257> The older record form (`{"mcpServers": {"internal-search": {"toolPolicy": {"delete_document": "blocked"}}}}`) is no longer accepted. Desktop versions before 1.15200.0 parse only the record form: on those builds an array value is ignored and plugin tool locks are **not enforced**, so update the fleet past 1.15200.0 before deploying the array form.

1258>

1259> If a Managed MCP servers entry is for the same server (same URL, else same name), that entry decides alone: its `toolPolicy` (if any) applies and the entry here is ignored. A value that cannot be read blocks every tool of every plugin-provided MCP server no Managed MCP servers entry covers.

1260>

1261> For a plugin server that Claude Code launches or connects to itself (a marketplace plugin's), the permissions travel on Claude Code's managed-settings channel: another Claude Code [managed-settings source](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings) on the device replaces them unless that source sets `parentSettingsBehavior` to `"merge"`. `blocked` on a server the app connects to itself holds either way.

1262>

1264> | - | - | - | - |

1269

11871270## Source

11881271

11891272### Bootstrap

11901273

1192| - | - | - | - | - |

1198| Trust bootstrap-delivered settings `trustBootstrapDelivery` | `boolean` | MDM only Added in 1.26832.0 | `false` | Skip the per-user consent prompt for sign-in targets, inference endpoints, helper scripts, and connectors the bootstrap server delivers. Defaults to `false`. |

1275| - | - | - | - | - | - |

1276| Use bootstrap config `bootstrapEnabled` | `boolean` | MDM only Added in 1.10628.0 | `true` | Fetch and apply the URL above at launch. Turn off to keep the URL saved but skip the fetch. Defaults to `true`. | [`client`](#self-hosted-column) Controls whether the desktop app fetches its configuration, so it cannot travel inside that document |

1277| Bootstrap config URL `bootstrapUrl` | `string` | MDM only Added in 1.10628.0 | — | HTTPS endpoint that returns a per-user JSON config overlay. Values from the response override local settings and become read-only. | [`client`](#self-hosted-column) Tells the desktop app where to fetch its configuration, so it cannot travel inside that document |

1278| Bootstrap OIDC parameters `bootstrapOidc` | `object` | MDM only Added in 1.10628.0 | — | When set, the bootstrap request sends a Bearer token from a browser sign-in (authorization-code-with-PKCE). | [`client`](#self-hosted-column) Names the sign-in the desktop app uses to fetch its configuration, so it cannot travel inside it |

1279| Bootstrap request headers `bootstrapHeaders` | `object` | MDM only Added in 1.32885.1 | — | HTTP headers sent on every bootstrap config fetch. Use this instead of embedding user:pass@ in the URL. | [`client`](#self-hosted-column) Sets headers the desktop app sends to fetch its configuration, so it cannot travel inside that document |

1280| Bootstrap headers helper script `bootstrapHeadersHelper` | `string` | MDM only Added in 1.32885.1 | — | Absolute path to an executable that prints a JSON object of bootstrap request headers. Merged over the static headers; the helper wins. | [`client`](#self-hosted-column) Names a program on the person's computer that supplies headers for fetching the app's configuration |

1281| Trust bootstrap-delivered settings `trustBootstrapDelivery` | `boolean` | MDM only Added in 1.26832.0 | `false` | Skip the per-user consent prompt for sign-in targets, inference endpoints, helper scripts, and connectors the bootstrap server delivers. Defaults to `false`. | [`client`](#self-hosted-column) Skips a consent prompt on the person's computer for what the configuration server sends |

11991282

12001283> **bootstrapOidc details**

12011284>

12021285

third-party/claude-desktop/configuration-changelog Changed · +45 / -0 lines

from line 4

55Configuration keys by Claude Desktop release. Each section lists keys added in that release, with the MDM key name (for plist/registry deployment) and the equivalent JSON shape (for local-file or bootstrap remote configuration).

7**v3.6556.1**

9| MDM key | Type | Description |

10| - | - | - |

11| [`installedUpdateEnforcementEnabled`](/docs/third-party/claude-desktop/configuration#installedupdateenforcementenabled) | `boolean` | Restart to apply installed updates |

12| [`installedUpdateEnforcementHours`](/docs/third-party/claude-desktop/configuration#installedupdateenforcementhours) | `integer` | Installed-update enforcement window |

13| [`quickEntryScreenshotsEnabled`](/docs/third-party/claude-desktop/configuration#quickentryscreenshotsenabled) | `boolean` | Allow screenshots of the screen and other apps |

14| [`quickEntryFileSharingEnabled`](/docs/third-party/claude-desktop/configuration#quickentryfilesharingenabled) | `boolean` | Allow sharing files open in other apps |

16**JSON (e.g. for non-MDM users or Bootstrap):**

18```json theme={null}

19{

20 "autoUpdate": {

21 "installedUpdateEnforcement": {

22 "enabled": "<boolean>",

23 "enforcementHours": "<integer>"

24 }

25 },

26 "workspace": {

27 "quickEntry": {

28 "screenshotsEnabled": "<boolean>",

29 "fileSharingEnabled": "<boolean>"

30 }

31 }

32}

33```

35**Changed:**

37* A `managedMcpServers` entry accepts `headersHelperArgs` (remote and web search entries) or `envHelperArgs` (local entries): arguments for its helper script. Its helpers, `oauth.clientSecretHelper` included, also get the entry's `name` in `CLAUDE_CODE_MCP_SERVER_NAME`. Earlier releases ignore the lists and run the helper with no arguments.

38* `allowedPluginMarketplaces`: moving an entry to a new source keeps its installed plugins when the new entry's `expectedName`, set in the same change, is the old marketplace's name. Plugins that the marketplace takes from another repository are still uninstalled.

39* `allowedWorkspaceFolders` on SSH hosts: an entry is left out, and allows nothing, unless it is a full path for that host with no `..` (`~/work`, not `work`; on Windows `C:\work`, not `\work`). A symbolic link listed inside another listed folder is left out too: list the folder it points to.

40* `allowedWorkspaceFolders`: a read-only entry whose `%VAR%` is unset or unsupported on a device (any `%VAR%` on an SSH host) now makes the folder holding the variable read-only (`~/Work` for `~/Work/%X%/a`; every allowed folder if the entry starts with it) instead of being ignored. A variable that only another operating system sets (`%APPDATA%` on macOS or on an SSH host) still leaves the entry without effect there.

41* `disableAutoUpdates`: when a newer version is installed while Claude is open, the app now offers to relaunch into it (macOS, Linux, and the MSIX package on Windows).

42* `managedMcpServers` with `server: "github"`: nine more write tools, among them `issue_write`, `pull_request_review_write` and `label_write`, now ask before every call. A `toolPolicy` key with a tool's exact name, or `"*"`, can still allow them. `actions_run_trigger` now asks before every call whatever `toolPolicy` says, and `toolPolicy` can still block it.

43* `sshClientPath` (beta) on Windows accepts Git for Windows' `ssh.exe` or another OpenSSH 8.5 or newer under Program Files, where device management, or the bootstrap server it names, sets the key and also sets `sshTransport` to `system-openssh`.

44* `updateViaUpdatesHost`: where `bootstrapUrl` is on `config.claude.com` and `bootstrapEnabled` is not off, update checks use `releases.claude.com` whatever this key says. Earlier releases do so only with the key on.

46**v3.1623.4**

48**Changed:**

50* `isLocalDevMcpEnabled` set to `false`, and `allowedPluginMcpServers`: a local MCP server from Claude Code's `managed-mcp.json` that uses `${VAR}` only in its `env` values now runs. One with a variable in its command or arguments is still stopped.

752**v3.1623.1**

853

954No configuration changes in this release.

third-party/claude-desktop/gateway Changed · +7 / -7 lines

from line 167

168168| - | - | - | - | - |

170| Stream idle timeout `inferenceStreamIdleTimeoutSec` | `integer` | MDM + Bootstrap Added in 1.44121.1 | — | Extra seconds to wait for model output on a streaming response that is sending only keep-alive pings. Gateway provider only. Default 300. Range: 300–1800. |

172171| Gateway auth scheme `inferenceGatewayAuthScheme` | `enum` | MDM + Bootstrap Added in 1.3036.0 | `bearer` | How the gateway credential is sent on the wire (Authorization: Bearer vs x-api-key header). One of: `bearer`, `x-api-key`. Defaults to `bearer`. Deprecated: `inferenceGatewayAuthScheme: "sso"`; use inferenceCredentialKind: "interactive". The original spelling will keep working; no end date has been set. |

173172| Gateway sign-in flow `inferenceGatewayOidcAuthFlow` | `enum` | MDM + Bootstrap Added in 1.25927.0 | — | How the IdP sign-in runs: system browser (default) or the OS Microsoft Entra broker. One of: `browser`, `broker`. Deprecated: `inferenceGatewayOidcAuthFlow`; use inferenceIdpAuthFlow together with inferenceIdpOidc once every desktop in the fleet is on a release that reads them. The original spelling will keep working; no end date has been set. |

from line 173

174173| Gateway SSO IdP (OIDC) `inferenceGatewayOidc` | `object` | MDM + Bootstrap Added in 1.6889.0 | — | External IdP for gateway sign-in. The user’s token from this issuer is sent to the gateway as the Bearer credential. Deprecated: `inferenceGatewayOidc`; use inferenceIdpOidc with inferenceCredentialKind: "external-idp" once every desktop in the fleet is on a release that reads them. The original spelling will keep working; no end date has been set. |

176| Stream idle timeout `inferenceStreamIdleTimeoutSec` | `integer` | MDM + Bootstrap Added in 1.44121.1 | — | Extra seconds to wait for model output on a streaming response that is sending only keep-alive pings. Gateway provider only. Default 300. Range: 300–1800. |

177177

178> **inferenceStreamIdleTimeoutSec details**

179>

180> Raises how long Cowork, Chat and Code sessions wait for the next model event on an open streaming response (Claude Code's `CLAUDE_STREAM_IDLE_TIMEOUT_MS`). It only helps when the gateway writes SSE keep-alive `ping` events (or `:` comment lines) into the response while the upstream model is silent — for example a LiteLLM proxy with keep-alive pings enabled in front of Amazon Bedrock. With pings arriving, Claude Code accepts at least about five minutes of keep-alives and then waits this many seconds more for real model output before abandoning the request. Gateway provider only; the other providers keep Claude Code's defaults.

181>

182> A response on which nothing at all arrives — no pings — still fails after about 5 minutes regardless of this key, because at the device a silent connection cannot be told apart from a dead one. If long generations fail behind a gateway that does not send pings, configure the gateway to send them rather than raising this value. A common case is automatic compaction, in which a session sends its whole conversation in one streaming request and waits for a long summary; when that request fails, the error reads `Prompt is too long · automatic compaction failed:` followed by the cause. While this key is set, the app's value takes precedence over `CLAUDE_STREAM_IDLE_TIMEOUT_MS` in Claude Code's own managed settings for sessions the app starts; when it is unset, that setting still applies. Values outside 300–1800 are rejected at parse time (the error is listed in the diagnostics report) and the default applies.

183

184178> **inferenceGatewayOidcAuthFlow details**

185179>

186180> * **`browser`** (default) — opens the system browser for an authorization-code (PKCE) sign-in on a loopback redirect URI. See the **IdP setup** notes on `inferenceGatewayOidc` for redirect-URI registration.

from line 238

241

242> **inferenceStreamIdleTimeoutSec details**

243>

244> Raises how long Cowork, Chat and Code sessions wait for the next model event on an open streaming response (Claude Code's `CLAUDE_STREAM_IDLE_TIMEOUT_MS`). It only helps when the gateway writes SSE keep-alive `ping` events (or `:` comment lines) into the response while the upstream model is silent — for example a LiteLLM proxy with keep-alive pings enabled in front of Amazon Bedrock. With pings arriving, Claude Code accepts at least about five minutes of keep-alives and then waits this many seconds more for real model output before abandoning the request. Gateway provider only; the other providers keep Claude Code's defaults.

245>

246> A response on which nothing at all arrives — no pings — still fails after about 5 minutes regardless of this key, because at the device a silent connection cannot be told apart from a dead one. If long generations fail behind a gateway that does not send pings, configure the gateway to send them rather than raising this value. A common case is automatic compaction, in which a session sends its whole conversation in one streaming request and waits for a long summary; when that request fails, the error reads `Prompt is too long · automatic compaction failed:` followed by the cause. While this key is set, the app's value takes precedence over `CLAUDE_STREAM_IDLE_TIMEOUT_MS` in Claude Code's own managed settings for sessions the app starts; when it is unset, that setting still applies. Values outside 300–1800 are rejected at parse time (the error is listed in the diagnostics report) and the default applies.

247247

248248To send additional HTTP headers on every inference request (tenant routing, org IDs, and similar), set [`inferenceCustomHeaders`](/docs/third-party/claude-desktop/configuration#inferencecustomheaders). It applies to all providers, not just gateways.

249249