One read of Claude Documentationclaude-docs-20261022T180711Z
268 pages moved out of 279 read.
Pages moved
268
significant first
Pages read
279
in this capture
Captured
18:07 UTC
Corpus hash
510ab6f6a194
corpus-hash
What this read moved
1-25 of 268, page 1 of 11This capture is too large to show at once. Changes 1-25 of 268 are below, significant first; the rest are on the following screens.
build/overview Changed · +27 / -27 lines
from line 2
22
33> Build a plugin people use inside Claude: an MCP connector to your product, skills for your workflows, optional MCP Apps UI, and a listing in the directory.
44
5To bring your product or workflow into Claude, you build a [plugin](/docs/plugins/build): a package people add once and then use on claude.ai, in the desktop and mobile apps, in Cowork, and in Claude Code. A plugin packages whatever your integration needs, in any combination, and a plugin with only one of these pieces is complete:
5To bring your product or workflow into Claude, you build a [plugin](/docs/plugins/build.md): a package people add once and then use on claude.ai, in the desktop and mobile apps, in Cowork, and in Claude Code. A plugin packages whatever your integration needs, in any combination, and a plugin with only one of these pieces is complete:
66
7* **[An MCP connector](/docs/connectors/building/index)**: include one when Claude needs to reach your product or data. It points at an MCP server that you build and host
8* **[Skills](/docs/skills/how-to)**: include them to teach Claude your workflows, such as the sequence of steps, the defaults, and what good output looks like
9* **[An MCP App](/docs/connectors/building/mcp-apps/getting-started)**: include one when you want the connector to show interactive UI in the conversation
10* **Commands and agents**: include named actions, or specialists Claude can delegate to, which [Plugin structure and testing](/docs/plugins/build) covers
7* **[An MCP connector](/docs/connectors/building/index.md)**: include one when Claude needs to reach your product or data. It points at an MCP server that you build and host
8* **[Skills](/docs/skills/how-to.md)**: include them to teach Claude your workflows, such as the sequence of steps, the defaults, and what good output looks like
9* **[An MCP App](/docs/connectors/building/mcp-apps/getting-started.md)**: include one when you want the connector to show interactive UI in the conversation
10* **Commands and agents**: include named actions, or specialists Claude can delegate to, which [Plugin structure and testing](/docs/plugins/build.md) covers
1111
12When the plugin is ready, you can [submit it](/docs/directory/publish) to Anthropic's directory at [claude.ai/directory](https://claude.ai/directory), the catalog inside Claude where people find and add plugins and connectors, so that anyone on a paid plan can add it. Anthropic checks each submission before it's listed, and there's no partner program to apply to first.
12When the plugin is ready, you can [submit it](/docs/directory/publish.md) to Anthropic's directory at [claude.ai/directory](https://claude.ai/directory), the catalog inside Claude where people find and add plugins and connectors, so that anyone on a paid plan can add it. Anthropic checks each submission before it's listed, and there's no partner program to apply to first.
1313
1414## Choose a starting page
1515
16> **[Build a plugin](/docs/plugins/build)**
16> **[Build a plugin](/docs/plugins/build.md)**
1717>
1818> Lay out the plugin folder and manifest, write the skills, reference your MCP server, and test the plugin in Claude.
1919
20> **[Write skills](/docs/skills/how-to)**
20> **[Write skills](/docs/skills/how-to.md)**
2121>
2222> Teach Claude your workflows: the SKILL.md frontmatter, the instructions, reference files, and scripts.
2323
24> **[Build an MCP server](/docs/connectors/building/index)**
24> **[Build an MCP server](/docs/connectors/building/index.md)**
2525>
2626> Give the plugin access to your product or data: implement the server, set up authentication for Claude's clients, and test it.
2727
28> **[Add interactive UI](/docs/connectors/building/mcp-apps/getting-started)**
28> **[Add interactive UI](/docs/connectors/building/mcp-apps/getting-started.md)**
2929>
3030> Have your MCP server show interactive components in the conversation with MCP Apps. Optional.
3131
32> **[Submit your plugin or MCP server](/docs/directory/publish)**
32> **[Submit your plugin or MCP server](/docs/directory/publish.md)**
3333>
3434> List it in Anthropic's directory so anyone can add it: who can submit, what review involves, and the developer portal steps. Submit your MCP server as a connector too, even when your plugin references it.
3535
3636> [!NOTE]
3737>
38> * If you want to connect a tool or install a plugin for yourself, see the [Customize Claude](/docs/extend/overview) tab
39> * If you're not sure whether your plugin needs an MCP server at all, see [Decide what to include in your plugin](/docs/connectors/building/what-to-build)
40> * If you're distributing only inside your organization, see [Roll out a plugin to your whole organization](/docs/plugins/org-rollout)
38> * If you want to connect a tool or install a plugin for yourself, see the [Customize Claude](/docs/extend/overview.md) tab
39> * If you're not sure whether your plugin needs an MCP server at all, see [Decide what to include in your plugin](/docs/connectors/building/what-to-build.md)
40> * If you're distributing only inside your organization, see [Roll out a plugin to your whole organization](/docs/plugins/org-rollout.md)
4141> * If you're building only for Claude Code's terminal and IDE users, see the [Claude Code plugin docs](https://code.claude.com/docs/en/plugins/create), which cover what that surface alone supports
4242
4343## Steps to build and publish a plugin
from line 44
4444
4545Building and publishing a plugin follows these steps in order:
4646
471. **Lay out the plugin**: create the folder and manifest and reference any MCP server it uses. Start with [Build your first plugin](/docs/plugins/quickstart) if you haven't made one before, or [Plugin structure and testing](/docs/plugins/build) for the full layout. Chat, Cowork, and Claude Code each load different parts of a plugin, so check [Plugin feature support across platforms](/docs/plugins/platform-support) before you commit to a design.
482. **Write the skills**: teach Claude your workflows in `SKILL.md` files inside the plugin. [Create a skill](/docs/skills/how-to) covers the frontmatter, the instructions, reference files, and scripts
493. **Build the MCP server**: if the plugin needs to reach your product or data, implement the server, get authentication right for Claude's clients, and test it against Claude. Start with [Build an MCP server for Claude](/docs/connectors/building/index), or with [Build your first MCP server for Claude](/docs/connectors/building/quickstart) if you haven't written one before. A local server can also be packaged as a [desktop extension](/docs/connectors/building/mcpb).
504. **Add interactive UI**: if you want your server to show interactive components in the conversation, build them with [MCP Apps](/docs/connectors/building/mcp-apps/getting-started). This step is optional.
515. **Test it**: try the plugin in Claude before you publish it. [Test the plugin on each surface](/docs/plugins/build#test-the-plugin-on-each-surface) covers claude.ai, Cowork, and Claude Code, and [Test your MCP server](/docs/connectors/building/testing) covers adding your server as a custom connector
526. **Publish**: submit the plugin to the directory, submit its MCP server as a connector, and maintain the listing. Start with [Publish to the directory](/docs/directory/publish).
471. **Lay out the plugin**: create the folder and manifest and reference any MCP server it uses. Start with [Build your first plugin](/docs/plugins/quickstart.md) if you haven't made one before, or [Plugin structure and testing](/docs/plugins/build.md) for the full layout. Chat, Cowork, and Claude Code each load different parts of a plugin, so check [Plugin feature support across platforms](/docs/plugins/platform-support.md) before you commit to a design.
482. **Write the skills**: teach Claude your workflows in `SKILL.md` files inside the plugin. [Create a skill](/docs/skills/how-to.md) covers the frontmatter, the instructions, reference files, and scripts
493. **Build the MCP server**: if the plugin needs to reach your product or data, implement the server, get authentication right for Claude's clients, and test it against Claude. Start with [Build an MCP server for Claude](/docs/connectors/building/index.md), or with [Build your first MCP server for Claude](/docs/connectors/building/quickstart.md) if you haven't written one before. A local server can also be packaged as a [desktop extension](/docs/connectors/building/mcpb.md).
504. **Add interactive UI**: if you want your server to show interactive components in the conversation, build them with [MCP Apps](/docs/connectors/building/mcp-apps/getting-started.md). This step is optional.
515. **Test it**: try the plugin in Claude before you publish it. [Test the plugin on each surface](/docs/plugins/build.md#test-the-plugin-on-each-surface) covers claude.ai, Cowork, and Claude Code, and [Test your MCP server](/docs/connectors/building/testing.md) covers adding your server as a custom connector
526. **Publish**: submit the plugin to the directory, submit its MCP server as a connector, and maintain the listing. Start with [Publish to the directory](/docs/directory/publish.md).
53537. **Measure**: after people have it, [see whether they use it](#measure-usage-of-what-you-built).
5454
5555### Tools that help you build and check a plugin
from line 67
6767
6868Usage figures for a directory listing are in the developer portal, and figures for a plugin you distribute yourself or inside your organization are in Claude Code or in **Customize**. Each of these pages covers one case:
6969
70* **A plugin listed in the directory**: [How a published plugin is used](/docs/connectors/building/after-publishing#track-published-plugin-usage) covers installs, versions, how often each skill and MCP server runs, and error rates
71* **A connector listed in the directory**: [Manage your directory listing](/docs/connectors/building/managing-your-listing#server-health-and-usage-metrics) covers the dashboard's server health, usage by product and by tool, and error breakdown
70* **A plugin listed in the directory**: [How a published plugin is used](/docs/connectors/building/after-publishing.md#track-published-plugin-usage) covers installs, versions, how often each skill and MCP server runs, and error rates
71* **A connector listed in the directory**: [Manage your directory listing](/docs/connectors/building/managing-your-listing.md#server-health-and-usage-metrics) covers the dashboard's server health, usage by product and by tool, and error breakdown
7272* **A plugin you rolled out to your organization's Claude Code users**: [Measure and evaluate plugins](https://code.claude.com/docs/en/plugins/measure) covers what a plugin costs in context, whether it's used, and the OpenTelemetry events that answer organization-wide questions
73* **A plugin or skill used inside your organization on claude.ai**: [How a plugin is used in your organization](/docs/plugins/overview#track-plugin-usage-in-your-organization) covers the adoption and activity figures on its page in **Customize**
73* **A plugin or skill used inside your organization on claude.ai**: [How a plugin is used in your organization](/docs/plugins/overview.md#track-plugin-usage-in-your-organization) covers the adoption and activity figures on its page in **Customize**
7474
7575## Next steps
7676
77* [Build your first plugin](/docs/plugins/quickstart): build a small example plugin, test it, and push it to GitHub, ready to submit your own
78* [Plugin structure and testing](/docs/plugins/build): the folder layout, manifest, skills, MCP server reference, and testing
79* [Build an MCP server for Claude](/docs/connectors/building/index): implement the server, authentication, and testing against Claude
80* [Decide what to include in your plugin](/docs/connectors/building/what-to-build): decide whether your plugin needs an MCP server, commands, agents, or UI
77* [Build your first plugin](/docs/plugins/quickstart.md): build a small example plugin, test it, and push it to GitHub, ready to submit your own
78* [Plugin structure and testing](/docs/plugins/build.md): the folder layout, manifest, skills, MCP server reference, and testing
79* [Build an MCP server for Claude](/docs/connectors/building/index.md): implement the server, authentication, and testing against Claude
80* [Decide what to include in your plugin](/docs/connectors/building/what-to-build.md): decide whether your plugin needs an MCP server, commands, agents, or UI
8181
claude-science/admin-controls Changed · +40 / -35 lines
### Auto mode
from line 6
66
77## Organization settings
88
9The [**Organization settings** > **Claude Science**](https://claude.ai/admin-settings/claude-science) page in claude.ai holds the controls that apply to every member of your Team or Enterprise organization who uses the app. An Owner or Primary Owner turns Claude Science on or off there (see [Enable Claude Science](/docs/claude-science/enable-claude-science)), and the other controls unlock once Claude Science is on. On the [Claude Team plan for scientists](https://claude.com/programs/team-plan-for-scientists), Claude Science starts on. On Enterprise plans, you can also limit some of the controls to certain custom roles (see [Capabilities in custom roles](#capabilities-in-custom-roles)). Each section below covers one control: what it governs, its default, and what changes for members when you turn it off.
9The [**Organization settings** > **Claude Science**](https://claude.ai/admin-settings/claude-science) page in claude.ai holds the controls that apply to every member of your Team or Enterprise organization who uses the app. An Owner or Primary Owner turns Claude Science on or off there (see [Enable Claude Science](/docs/claude-science/enable-claude-science.md)), and the other controls unlock once Claude Science is on. On the [Claude Team plan for scientists](https://claude.com/programs/team-plan-for-scientists), Claude Science starts on. On Enterprise plans, you can also limit some of the controls to certain custom roles (see [Capabilities in custom roles](#capabilities-in-custom-roles)). Each section below covers one control: what it governs, its default, and what changes for members when you turn it off.
1010
1111### Defaults by plan
1212
from line 24
2424| Allow members to connect to Modal | On | Off |
2525| Show scientific model endpoint providers on the Compute tab | On | On |
2626| Turn on memory for your team | On | On |
27| Allow members to use auto mode | On | Off |
2728
28¹ For HIPAA-eligible organizations, note that Claude Science (beta) is not covered under your Business Associate Agreement (BAA) and should not be used with protected health information (PHI). Administrators who enable Claude Science are responsible for ensuring their workforce uses it in compliance with applicable legal obligations. Featured and custom connectors, SSH hosts, Modal, scientific model endpoints, memory, and access to previously saved Claude Science work are all off by default for HIPAA-eligible organizations.
29¹ For HIPAA-eligible organizations, note that Claude Science (beta) is not covered under your Business Associate Agreement (BAA) and should not be used with protected health information (PHI). Administrators who enable Claude Science are responsible for ensuring their workforce uses it in compliance with applicable legal obligations. Featured and custom connectors, SSH hosts, Modal, scientific model endpoints, memory, and access to previously saved Claude Science work are all off by default for HIPAA-eligible organizations. Organizations with HIPAA compliance enabled can't turn on auto mode.
2930
3031### How changes reach members
3132
3233Changes you save reach each member's running app within a few minutes and apply on the member's next turn or request. An app that is closed picks up your changes when it next starts, and an app that can't reach claude.ai keeps applying the last settings it received.
3334
34The settings apply to members running version 0.1.41 or later of the Claude Science app. A member still on an earlier version isn't governed by these settings until the member updates (see [Required updates](/docs/claude-science/manage-on-devices#required-updates)). For Team and Enterprise organizations, Claude Science enforces a minimum version of 0.1.41. A member on an older version sees a notice that the version is no longer supported, with an **Update now** button. If the update doesn't complete after a second try, [Update Claude Science](/docs/claude-science/update-claude-science) has the member's next steps for each kind of install; projects and settings on the computer are kept.
35The settings apply to members running version 0.1.41 or later of the Claude Science app; the auto mode switch needs a later version (see [Auto mode](#auto-mode)). A member still on an earlier version isn't governed by these settings until the member updates (see [Required updates](/docs/claude-science/manage-on-devices.md#required-updates)). For Team and Enterprise organizations, Claude Science enforces a minimum version of 0.1.41. A member on an older version sees a notice that the version is no longer supported, with an **Update now** button. If the update doesn't complete after a second try, [Update Claude Science](/docs/claude-science/update-claude-science.md) has the member's next steps for each kind of install; projects and settings on the computer are kept.
3536
3637Each member's app also has to reach claude.ai regularly to confirm these settings. If an app can't reach claude.ai for 72 hours, it pauses memory, custom connectors, SSH hosts, Modal, model endpoints, adding custom skills, and accessing previously saved Claude Science work until it reconnects, and keeps applying the network allowlist, package mirror, and Featured connector and skill choices it last received.
3738
from line 60
5960* **Control on, built-in role**: members whose role is User, Admin, Owner, or Primary Owner can use the feature, because custom roles affect only members whose role is set to **Custom**. On Team plans, which don't have custom roles, that's every member.
6061* **Control on, custom roles**: a member whose role is set to **Custom** can use the feature only if at least one of their custom roles has the capability turned on.
6162
62Turning on the **Claude Science** capability in a role also turns on the seven under it, and you can then turn off the ones that role shouldn't have. Any capability whose control your organization can't turn on stays off. Turning the **Claude Science** capability off turns them all off. A role whose **Capability access** setting is **All capabilities** already includes all seven. A role set to **All generally available** gets them when you turn on its **Claude Science** capability (see [Who gets access after you enable](/docs/claude-science/enable-claude-science#who-gets-access-after-you-enable)).
63Turning on the **Claude Science** capability in a role also turns on the seven under it, and you can then turn off the ones that role shouldn't have. Any capability whose control your organization can't turn on stays off. Turning the **Claude Science** capability off turns them all off. A role whose **Capability access** setting is **All capabilities** already includes all seven. A role set to **All generally available** gets them when you turn on its **Claude Science** capability (see [Who gets access after you enable](/docs/claude-science/enable-claude-science.md#who-gets-access-after-you-enable)).
6364
6465> [!NOTE]
6566>
from line 72
7172
7273### Featured connectors and skills
7374
74Featured connectors and Featured skills come with Claude Science, and admins can control whether they are enabled or disabled for your members (see [Connectors and skills](/docs/claude-science/connectors-and-skills)). The **Featured connectors** and **Featured skills** sections list them with one switch per item, so you can choose which ones members can use. Every item is on by default for Team and Enterprise organizations. In an organization with HIPAA compliance enabled, every Featured connector and skill starts disabled; turn on the ones you have reviewed.
75Featured connectors and Featured skills come with Claude Science, and admins can control whether they are enabled or disabled for your members (see [Connectors and skills](/docs/claude-science/connectors-and-skills.md)). The **Featured connectors** and **Featured skills** sections list them with one switch per item, so you can choose which ones members can use. Every item is on by default for Team and Enterprise organizations. In an organization with HIPAA compliance enabled, every Featured connector and skill starts disabled; turn on the ones you have reviewed.
7576
7677Each section shows how many items are enabled. Expand it to see the list, and select an item to see its tools or instructions, author, license, and third-party terms.
7778
from line 84
8384
8485Members can still turn off, in their own app, any item you leave on. The app remembers each member's choice, so it applies again if you turn an item off and later back on. Turning a Featured skill off doesn't stop a member from writing a skill of their own; whether members can add their own skills is governed by [Custom skills](#custom-skills).
8586
86When you turn Claude Science on, the [**Turn on Claude Science** dialog](/docs/claude-science/enable-claude-science#turn-on-claude-science) notes: "By continuing, you represent that your team has the necessary rights to access these resources and you authorize Claude to do so on their behalf. You can review terms in Settings."
87When you turn Claude Science on, the [**Turn on Claude Science** dialog](/docs/claude-science/enable-claude-science.md#turn-on-claude-science) notes: "By continuing, you represent that your team has the necessary rights to access these resources and you authorize Claude to do so on their behalf. You can review terms in Settings."
8788
8889### Connectors you add in claude.ai
8990
90Connectors you add for your organization in claude.ai also work in Claude Science. Every connector on **Organization settings > Connectors**, whether you added it from the [Connectors Directory](/docs/connectors/directory) or by its web address (a custom connector), shows up in the Claude Science app under **Settings > Connectors** for the members who can use it. If you remove one in claude.ai, it disappears from the app too.
91Connectors you add for your organization in claude.ai also work in Claude Science. Every connector on **Organization settings > Connectors**, whether you added it from the [Connectors Directory](/docs/connectors/directory.md) or by its web address (a custom connector), shows up in the Claude Science app under **Settings > Connectors** for the members who can use it. If you remove one in claude.ai, it disappears from the app too.
9192
9293If a connector needs a sign-in, each member signs in with their own account; the app opens claude.ai for them to do it. Connector permissions in Enterprise custom roles apply the same way; see [Connectors](#connectors) under How other admin settings apply to Claude Science.
9394
from line 96
9596
9697### Custom connectors
9798
98Custom connectors are Model Context Protocol (MCP) servers a member adds under **Settings** > **Connectors** in the Claude Science app, either a remote server at an HTTPS URL or a local command on their computer (see [Custom connectors](/docs/claude-science/custom-connectors)). The **Allow custom connectors** switch decides whether members can add and use them. It's on by default for Team organizations and off by default for Enterprise organizations. Organizations with HIPAA compliance enabled can't turn it on.
99Custom connectors are Model Context Protocol (MCP) servers a member adds under **Settings** > **Connectors** in the Claude Science app, either a remote server at an HTTPS URL or a local command on their computer (see [Custom connectors](/docs/claude-science/custom-connectors.md)). The **Allow custom connectors** switch decides whether members can add and use them. It's on by default for Team organizations and off by default for Enterprise organizations. Organizations with HIPAA compliance enabled can't turn it on.
99100
100101When the switch is off, members can't add, change, or authorize custom connectors, and Claude no longer sees the custom connectors members may have added earlier. Those connectors stay listed in the member's settings, grayed, with a note that custom connectors are disabled by your admin. Featured connectors and the connectors you add on **Organization settings > Connectors** aren't affected by this switch.
101102
from line 104
103104
104105Connectors are built on an open standard called the Model Context Protocol (MCP). When your organization needs a connector it doesn't have yet, what to do depends on where the data lives:
105106
106* **Your own systems and data**, such as an internal database or lab system: have your developers build a connector for it, then add its web address for everyone under **Organization settings > Connectors > Add > Custom** (see [Add a connector by URL](/docs/connectors/custom/add-unlisted#add-a-connector-by-url)). Claude connects to it from Anthropic's servers, so it must be reachable from the internet. For a system that isn't, Enterprise organizations can request an MCP tunnel, a secure link from their own network to Anthropic (in research preview; see [MCP tunnels](/docs/connectors/mcp-tunnels/overview)).
107* **Another company's product**: the company that makes the product usually builds and runs its connector, not Anthropic. Check the [Connectors Directory](/docs/connectors/directory) first. If the company offers a connector that isn't listed there, add its web address under **Organization settings > Connectors > Add > Custom**; a connector doesn't need to be in the directory to work (see [Connector verification](/docs/connectors/verification)). If the company doesn't offer one, ask them to build one. They can [submit it to the Connectors Directory](/docs/connectors/building/submission) for review; if Anthropic accepts it, any Claude user can find it there.
108* **Public scientific databases and tools**: Claude may not need a connector at all. Code that Claude runs on members' computers can reach any site on Claude Science's list of allowed sites, so adding the site to that list is often enough. By default, members allow a new site themselves when Claude asks. If you turn on **Manage network allowlist** on **Organization settings > Claude Science**, you add sites for them under **Custom domains** instead (see [Network allowlist](#network-allowlist)). If a connector would still help, look for one in the [Connectors Directory](/docs/connectors/directory) and add it on **Organization settings > Connectors**.
107* **Your own systems and data**, such as an internal database or lab system: have your developers build a connector for it, then add its web address for everyone under **Organization settings > Connectors > Add > Custom** (see [Add a connector by URL](/docs/connectors/custom/add-unlisted.md#add-a-connector-by-url)). Claude connects to it from Anthropic's servers, so it must be reachable from the internet. For a system that isn't, Enterprise organizations can request an MCP tunnel, a secure link from their own network to Anthropic (in research preview; see [MCP tunnels](/docs/connectors/mcp-tunnels/overview)).
108* **Another company's product**: the company that makes the product usually builds and runs its connector, not Anthropic. Check the [Connectors Directory](/docs/connectors/directory.md) first. If the company offers a connector that isn't listed there, add its web address under **Organization settings > Connectors > Add > Custom**; a connector doesn't need to be in the directory to work (see [Connector verification](/docs/connectors/verification.md)). If the company doesn't offer one, ask them to build one. They can [submit it to the Connectors Directory](/docs/connectors/building/submission.md) for review; if Anthropic accepts it, any Claude user can find it there.
109* **Public scientific databases and tools**: Claude may not need a connector at all. Code that Claude runs on members' computers can reach any site on Claude Science's list of allowed sites, so adding the site to that list is often enough. By default, members allow a new site themselves when Claude asks. If you turn on **Manage network allowlist** on **Organization settings > Claude Science**, you add sites for them under **Custom domains** instead (see [Network allowlist](#network-allowlist)). If a connector would still help, look for one in the [Connectors Directory](/docs/connectors/directory.md) and add it on **Organization settings > Connectors**.
109110
110111### Custom skills
111112
112Skills are instructions, sometimes with helper code, that Claude loads when a task calls for them (see [Skills](/docs/claude-science/connectors-and-skills#skills)). Members add their own by writing one, uploading one, importing one from a public GitHub repository (or a private repo if a [GitHub credential](/docs/claude-science/connectors-and-skills#skills) is stored), or asking Claude to create one from a session. The **Allow custom skills** switch decides whether members can add skills of their own, including creating one from the Claude Science app so it's also available to them in claude.ai. It's on by default for Team and Enterprise organizations, including those with HIPAA compliance enabled.
113Skills are instructions, sometimes with helper code, that Claude loads when a task calls for them (see [Skills](/docs/claude-science/connectors-and-skills.md#skills)). Members add their own by writing one, uploading one, importing one from a public GitHub repository (or a private repo if a [GitHub credential](/docs/claude-science/connectors-and-skills.md#skills) is stored), or asking Claude to create one from a session. The **Allow custom skills** switch decides whether members can add skills of their own, including creating one from the Claude Science app so it's also available to them in claude.ai. It's on by default for Team and Enterprise organizations, including those with HIPAA compliance enabled.
113114
114115When the switch is off, members can't add new skills of their own or publish them, and the app notes that custom skills are disabled by your admin. Skills a member added earlier still work and can still be edited, and Featured skills aren't affected. Custom skills are how members teach Claude their own workflows and analysis pipelines, so Anthropic recommends leaving this switch on.
115116
from line 126
125126
126127Without one of these options, no skills from claude.ai and none of your organization's plugins reach that member's app. To give the member one, turn it on in the **Capabilities** tab of one of their custom roles (see [Capabilities in custom roles](#capabilities-in-custom-roles)). If your organization keeps **Cloud code execution and file creation** off, the **Chat** and **Code execution and file creation** option has no effect. Choose **Claude Code**, or **Cowork** if Cowork is turned on for your organization.
127128
128To let members manage their own skills, host them in a GitHub repository. Put one `skills/<name>/SKILL.md` folder per skill in the repository and share the link. Members import them in the Claude Science app under **Settings** > **Skills** > **Add skill** > **Import from GitHub**. Claude Science records the commit each skill came from. When the repository has new commits, **Check for updates…** flags the skills whose files differ from its latest commit; each member chooses when to import again (see [Update skills imported from GitHub](/docs/claude-science/connectors-and-skills#update-skills-imported-from-github)). Private repositories work after a member adds a GitHub token in the Claude Science app under **Settings** > **Credentials**.
129To let members manage their own skills, host them in a GitHub repository. Put one `skills/<name>/SKILL.md` folder per skill in the repository and share the link. Members import them in the Claude Science app under **Settings** > **Skills** > **Add skill** > **Import from GitHub**. Claude Science records the commit each skill came from. When the repository has new commits, **Check for updates…** flags the skills whose files differ from its latest commit; each member chooses when to import again (see [Update skills imported from GitHub](/docs/claude-science/connectors-and-skills.md#update-skills-imported-from-github)). Private repositories work after a member adds a GitHub token in the Claude Science app under **Settings** > **Credentials**.
129130
130131To stop members from adding their own skills, turn off the **Allow custom skills** switch on the **Organization settings** > **Claude Science** page (see [Custom skills](#custom-skills)).
131132
132133### Previously saved Claude Science work
133134
134A member who used Claude Science under another sign-in on the same computer (for example, a personal plan before joining your organization) can access the projects, sessions, and artifacts from that sign-in and move it into the app's folder for your organization on that computer (see [Access work from another sign-in on your computer](/docs/claude-science/multiple-computers#access-work-from-another-sign-in-on-your-computer)). The **Allow members to access Claude Science work previously saved on their computer** switch decides whether the app offers this access. It's on by default for Team organizations and off by default for Enterprise organizations, and organizations with HIPAA compliance enabled can't turn it on.
135A member who used Claude Science under another sign-in on the same computer (for example, a personal plan before joining your organization) can access the projects, sessions, and artifacts from that sign-in and move it into the app's folder for your organization on that computer (see [Access work from another sign-in on your computer](/docs/claude-science/multiple-computers.md#access-work-from-another-sign-in-on-your-computer)). The **Allow members to access Claude Science work previously saved on their computer** switch decides whether the app offers this access. It's on by default for Team organizations and off by default for Enterprise organizations, and organizations with HIPAA compliance enabled can't turn it on.
135136
136137The access happens on the member's computer and uploads nothing. Claude Science work the app accesses will follow your organization's settings from then on. Content your organization doesn't allow isn't copied or moved and stays in its original folder, and credentials such as API keys and connector sign-ins are never copied or moved. When the switch is off, the app doesn't offer the access, and its **Access previously saved Claude Science work on this computer** setting is grayed out with a note that it's off for your organization.
137138
138139### Network allowlist
139140
140When Claude runs code for a member, that code can reach only the domains on the analysis sandbox's network allowlist: the package hosts, the scientific databases behind the Featured connectors, and hosts the member approved. See [Sandbox](/docs/claude-science/core-concepts#sandbox) and the domain tables in [Network requirements](/docs/claude-science/network-requirements#analysis-sandbox-domains).
141When Claude runs code for a member, that code can reach only the domains on the analysis sandbox's network allowlist: the package hosts, the scientific databases behind the Featured connectors, and hosts the member approved. See [Sandbox](/docs/claude-science/core-concepts.md#sandbox) and the domain tables in [Network requirements](/docs/claude-science/network-requirements.md#analysis-sandbox-domains).
141142
142143By default, each member manages that list on their own computer. The **Manage network allowlist** switch transfers control of the list from members to you. While it's on, every member's app uses the organization's list instead of the member's own, and members see the list in their **Network** settings read-only, apart from domains they have blocked themselves, with a note that the domain allowlist is controlled by their admin. It's off by default for Team and Enterprise organizations, and on for organizations with HIPAA compliance enabled, which can't turn it off.
143144
144145Turning the switch on sets aside what members allowed themselves, including the domains a deployed configuration file adds with its `[sandbox.network]` keys; those settings are kept and apply again when you turn the switch off. Domains the file denies stay denied.
145146
146Your list is enforced by the app's sandbox (see [Sandbox](/docs/claude-science/core-concepts#sandbox)). On a computer where the sandbox is turned off or can't start, the app pauses new sessions and messages and tells the member the computer doesn't meet the organization's security requirements, until the member restarts the app with the sandbox on or you turn the switch off. Turning the switch off keeps your saved list, which applies again the next time you turn it on.
147Your list is enforced by the app's sandbox (see [Sandbox](/docs/claude-science/core-concepts.md#sandbox)). On a computer where the sandbox is turned off or can't start, the app pauses new sessions and messages and tells the member the computer doesn't meet the organization's security requirements, until the member restarts the app with the sandbox on or you turn the switch off. Turning the switch off keeps your saved list, which applies again the next time you turn it on.
147148
148149With the switch on, **Claude Science domains** shows the Featured domains in the same groups as the app, such as **Package management**, **Literature & citations**, and **NCBI / NIH**, with one switch per domain. A group switch turns all of its domains on or off. Below it, **Custom domains** adds your own. The rules for an entry are:
149150
from line 156
155156
156157Until you change the list, members use Claude Science's Featured list, including domains added in later versions of Claude Science. Once you change it, the list is saved exactly as you left it, so a domain added in a later version stays off until you turn it on. **Reset** returns to the Featured list and removes your custom domains, for all members.
157158
158You can also turn off the **Package management** domains (PyPI, conda, CRAN and Bioconductor, npm, and GitHub), with limits. The PyPI and conda domains can be turned off only while the [organization package mirror](#organization-package-mirror) covers them. Turning the CRAN and Bioconductor, npm, or GitHub domains off means members can't install packages from them, and the page asks you to confirm. The domains the sandbox always blocks (see [Network requirements](/docs/claude-science/network-requirements#domains-the-sandbox-always-blocks)) stay blocked whichever list is in force.
159You can also turn off the **Package management** domains (PyPI, conda, CRAN and Bioconductor, npm, and GitHub), with limits. The PyPI and conda domains can be turned off only while the [organization package mirror](#organization-package-mirror) covers them. Turning the CRAN and Bioconductor, npm, or GitHub domains off means members can't install packages from them, and the page asks you to confirm. The domains the sandbox always blocks (see [Network requirements](/docs/claude-science/network-requirements.md#domains-the-sandbox-always-blocks)) stay blocked whichever list is in force.
159160
160161The allowlist governs the network connections of code Claude runs in the sandbox on the member's computer, the local-command connectors that run inside it, and, while you manage it, the [model endpoints](#scientific-model-endpoints) members connect by host name. Jobs on SSH hosts use the host's own network, so the allowlist doesn't apply to them, and the [**Allow members to connect SSH hosts**](#ssh-hosts) switch is the control for those.
161162
from line 164
163164
164165### Organization package mirror
165166
166Analysis environments install Python and conda packages from the public hosts unless a mirror is set. Members or IT can set a mirror per computer under **Settings** > **Network** > **Package mirror** or in the [configuration file](/docs/claude-science/configuration-file-reference#package-download-keys). See [Point package installs at an internal mirror](/docs/claude-science/corporate-networks#point-package-installs-at-an-internal-mirror) for the mirror layout and credentials.
167Analysis environments install Python and conda packages from the public hosts unless a mirror is set. Members or IT can set a mirror per computer under **Settings** > **Network** > **Package mirror** or in the [configuration file](/docs/claude-science/configuration-file-reference.md#package-download-keys). See [Point package installs at an internal mirror](/docs/claude-science/corporate-networks.md#point-package-installs-at-an-internal-mirror) for the mirror layout and credentials.
167168
168169The **Organization package mirror** section sets the same two addresses once for every member: a **Conda channel URL** and a **Python package index URL (PyPI)**. The section applies whether or not you manage the [network allowlist](#network-allowlist), and there is no organization mirror by default.
169170
from line 172
171172
172173An organization mirror takes precedence over a mirror a member set in Settings or in their configuration file. The member's values are kept but not used, and their Settings show that the package mirror is controlled by their admin. The mirror host is allowed automatically and the public hosts it replaces are removed from the allowlist, as for a member-set mirror. While you manage the network allowlist, those hosts stay removed even if they are switched on in your list.
173174
174Mirror credentials stay with each member. A member signs in to your mirror once per mirror host under **Settings > Network > Package mirror > Mirror credentials**, unless you [deploy the credential as a file](/docs/claude-science/corporate-networks#deploy-the-mirror-credential-as-a-file), and the organization settings never store a credential.
175Mirror credentials stay with each member. A member signs in to your mirror once per mirror host under **Settings > Network > Package mirror > Mirror credentials**, unless you [deploy the credential as a file](/docs/claude-science/corporate-networks.md#deploy-the-mirror-credential-as-a-file), and the organization settings never store a credential.
175176
176177### SSH hosts
177178
178Members can register a machine they reach over SSH, such as a lab workstation or an HPC login node, so Claude can run jobs on it (see [Remote compute clusters](/docs/claude-science/remote-compute-clusters)). The **Allow members to connect SSH hosts** switch decides whether they can. It's on by default for Team and Enterprise organizations, and off by default for organizations with HIPAA compliance enabled, which can turn it on. On Enterprise plans, you can also limit SSH hosts to certain custom roles with the **Connect to SSH hosts** capability (see [Capabilities in custom roles](#capabilities-in-custom-roles)).
179Members can register a machine they reach over SSH, such as a lab workstation or an HPC login node, so Claude can run jobs on it (see [Remote compute clusters](/docs/claude-science/remote-compute-clusters.md)). The **Allow members to connect SSH hosts** switch decides whether they can. It's on by default for Team and Enterprise organizations, and off by default for organizations with HIPAA compliance enabled, which can turn it on. On Enterprise plans, you can also limit SSH hosts to certain custom roles with the **Connect to SSH hosts** capability (see [Capabilities in custom roles](#capabilities-in-custom-roles)).
179180
180181When the switch is off, members can't add SSH hosts, and hosts they added earlier are kept but refuse new commands and file transfers; the app shows that SSH host setup is disabled by your admin. A job that is already running can still be stopped and its results collected.
181182
from line 184
183184
184185### Modal
185186
186[Modal](https://modal.com/) is a third-party cloud computing service. Members can connect a Modal account they own so Claude can run jobs that need a GPU or more memory than their computer has. Modal bills that account directly, and Anthropic never sees a payment method (see [Compute providers](/docs/claude-science/compute-providers#connecting-modal)). The **Allow members to connect to Modal** switch decides whether members can connect Modal in the Claude Science app in **Settings** > **Compute**. It's on by default for Team organizations, off by default for Enterprise organizations, and off by default for organizations with HIPAA compliance enabled, which can turn it on.
187[Modal](https://modal.com/) is a third-party cloud computing service. Members can connect a Modal account they own so Claude can run jobs that need a GPU or more memory than their computer has. Modal bills that account directly, and Anthropic never sees a payment method (see [Compute providers](/docs/claude-science/compute-providers.md#connecting-modal)). The **Allow members to connect to Modal** switch decides whether members can connect Modal in the Claude Science app in **Settings** > **Compute**. It's on by default for Team organizations, off by default for Enterprise organizations, and off by default for organizations with HIPAA compliance enabled, which can turn it on.
187188
188189When the switch is off, members can't set up Modal or start new Modal jobs, and the app shows that Modal setup is disabled by your admin. A job that is already running can still be stopped, and the member's Modal settings are kept.
189190
from line 196
195196
196197### Scientific model endpoints
197198
198Members can connect a scientific model server, such as NVIDIA BioNeMo NIM, that Claude calls directly from analyses (see [Scientific model endpoints](/docs/claude-science/compute-providers#scientific-model-endpoints)). The **Show scientific model endpoint providers on the Compute tab** switch decides whether members can connect the providers listed on the app's **Compute** tab. It's on by default for Team and Enterprise organizations, and off by default for organizations with HIPAA compliance enabled, which can turn it on.
199Members can connect a scientific model server, such as NVIDIA BioNeMo NIM, that Claude calls directly from analyses (see [Scientific model endpoints](/docs/claude-science/compute-providers.md#scientific-model-endpoints)). The **Show scientific model endpoint providers on the Compute tab** switch decides whether members can connect the providers listed on the app's **Compute** tab. It's on by default for Team and Enterprise organizations, and off by default for organizations with HIPAA compliance enabled, which can turn it on.
199200
200201When the switch is off, members can't connect these providers or use the endpoints they set up earlier, and the app shows that scientific model endpoint setup is disabled by your admin; the settings they entered are kept. The switch governs third-party model endpoints only and has no effect on which Claude models members can use.
201202
from line 204
203204
204205### Memory
205206
206Memory lets Claude save short facts about a member, their projects, and their files across sessions, stored in the app's local database on the member's computer (see [Memory](/docs/claude-science/core-concepts#memory)). Each member chooses whether their own memory is on, during first-time setup or later in **Settings** > **Memory**. The **Turn on memory for your team** switch decides whether members can use memory at all. It's on by default for Team and Enterprise organizations, and off by default for organizations with HIPAA compliance enabled, which can turn it on.
207Memory lets Claude save short facts about a member, their projects, and their files across sessions, stored in the app's local database on the member's computer (see [Memory](/docs/claude-science/core-concepts.md#memory)). Each member chooses whether their own memory is on, during first-time setup or later in **Settings** > **Memory**. The **Turn on memory for your team** switch decides whether members can use memory at all. It's on by default for Team and Enterprise organizations, and off by default for organizations with HIPAA compliance enabled, which can turn it on.
207208
208209When the switch is off, memory is off for every member, whatever they chose in their own settings; Claude neither recalls nor saves facts, first-time setup skips its memory step, and the **Memory** setting shows that memory is disabled by your admin. Facts a member saved earlier stay on their computer, the member can still review and delete them, and Claude uses them again if you turn the switch back on.
209210
210When Claude recalls saved facts for a session, those facts are sent to Anthropic as part of that session's conversation and handled like the rest of the conversation (see [How Claude Science works with your data](/docs/claude-science/how-claude-science-works-with-your-data)). The **Capabilities** > **Memory** setting in claude.ai **Organization settings** doesn't control memory in Claude Science. In a custom role, the **Memory** row under **Claude Science** is the capability for the app's memory, and the **Memory** row under **Chat** is for claude.ai chat (see [Capabilities in custom roles](#capabilities-in-custom-roles)).
211When Claude recalls saved facts for a session, those facts are sent to Anthropic as part of that session's conversation and handled like the rest of the conversation (see [How Claude Science works with your data](/docs/claude-science/how-claude-science-works-with-your-data.md)). The **Capabilities** > **Memory** setting in claude.ai **Organization settings** doesn't control memory in Claude Science. In a custom role, the **Memory** row under **Claude Science** is the capability for the app's memory, and the **Memory** row under **Chat** is for claude.ai chat (see [Capabilities in custom roles](#capabilities-in-custom-roles)).
211212
213### Auto mode
214
215With auto mode, an automated safety check approves a member's code and connector requests that look safe, so the member answers fewer permission cards in the Claude Science app (see [Auto mode](/docs/claude-science/auto-mode.md)). The **Allow members to use auto mode** switch decides whether members can use auto mode at all in Claude Science. It's on by default for Team organizations and off by default for Enterprise organizations. While the switch is on, auto mode starts on for members who can use it, and each member can turn it off in the Claude Science app. While the switch is off, members get a permission card for each request that needs one, as they do without auto mode, and the auto mode toggle in the Claude Science app's **Settings > Permissions** is grayed out. The switch applies to members whose app is recent enough to support it.
216
212217## How other admin settings apply to Claude Science
213218
214219In the tables below, each setting is named by its page in claude.ai **Organization settings** and, where it has one, its label there (for example, **Capabilities** > **Web search**). Apart from the **Enable for your organization** toggle, the controls on the **Claude Science** page itself are described under [Organization settings](#organization-settings).
from line 243
238243
239244| Setting in claude.ai | Status for Claude Science | Note |
240245| - | - | - |
241| Claude Science > Enable for your organization | Supported in Claude Science | Off by default for Team and Enterprise, and on by default for the Claude Team plan for scientists. An Owner or Primary Owner turns it on or off under **Organization settings** > **Claude Science** (see [Enable Claude Science](/docs/claude-science/enable-claude-science)). Assigning seats doesn't turn it on. |
242| Data and privacy > Rate chats | Supported in Claude Science | When you turn this off, the app hides the **Send feedback** link on the [**Chat paused**](/docs/claude-science/safeguards#when-safeguards-flag-a-message) card. If your organization uses customer-managed encryption keys (CMEK), you can't turn this setting on and the app doesn't show that link. |
246| Claude Science > Enable for your organization | Supported in Claude Science | Off by default for Team and Enterprise, and on by default for the Claude Team plan for scientists. An Owner or Primary Owner turns it on or off under **Organization settings** > **Claude Science** (see [Enable Claude Science](/docs/claude-science/enable-claude-science.md)). Assigning seats doesn't turn it on. |
247| Data and privacy > Rate chats | Supported in Claude Science | When you turn this off, the app hides the **Send feedback** link on the [**Chat paused**](/docs/claude-science/safeguards.md#when-safeguards-flag-a-message) card. If your organization uses customer-managed encryption keys (CMEK), you can't turn this setting on and the app doesn't show that link. |
243248| Organization and access > Organization instructions | Supported in Claude Science | Anthropic adds your organization instructions to the app's requests to Claude, as it does for claude.ai chat, so members don't need to update the app for a change to apply. |
244249| Plugins & skills > skills you add for your organization, and the Policy tab | Supported in Claude Science | The **Skills** switch in the **Policy** tab has to be on for Claude Science to get your organization's plugins and to get skills from claude.ai. Skills from claude.ai include the ones you add for your organization. A member whose role is set to **Custom** also needs one of the capability options listed under [Organization skills](#organization-skills). **User-created skills**, on the same tab, decides whether a member can publish a skill from the app to their own claude.ai account. Publishing one also needs **Cloud code execution and file creation** to be on (see its row under [Capability toggles](#capability-toggles)). The skills that come with the app and the skills members add in it are controlled on the **Claude Science** page: one switch per Featured skill, and **Allow custom skills** for skills members add themselves (see [Featured connectors and skills](#featured-connectors-and-skills) and [Custom skills](#custom-skills)). |
245250| Capabilities > Web search | Not applicable in Claude Science | This setting governs claude.ai chat. Claude Science can search the web regardless of it, and the **Claude Science** page has no switch for web search. |
246251| Capabilities > Cloud code execution and file creation | Partially supported in Claude Science | This setting governs the code sandbox Anthropic hosts for claude.ai chat. Running code on the member's computer, or on compute the member connects, is the core of Claude Science and can't be turned off; you govern what that code can reach with the [network allowlist](#network-allowlist), [SSH hosts](#ssh-hosts), and [Modal](#modal) controls. In the app, a member needs this setting turned on to publish a skill to their claude.ai account or to delete a published one. For a member whose role is set to **Custom**, this setting is also part of one capability option for getting skills from claude.ai and your organization's plugins (see [Organization skills](#organization-skills)). |
247| Capabilities > Allow network egress and Domain allowlist | Supported in Claude Science | These settings govern the hosted sandbox for claude.ai chat. Claude Science's sandbox has its own allowlist: manage it for the whole organization with the **Manage network allowlist** switch on the **Claude Science** page (see [Network allowlist](#network-allowlist)), or leave it off and let members manage their own. Administrators can also extend a member's list per device with the sandbox network keys in the [configuration file reference](/docs/claude-science/configuration-file-reference). |
252| Capabilities > Allow network egress and Domain allowlist | Supported in Claude Science | These settings govern the hosted sandbox for claude.ai chat. Claude Science's sandbox has its own allowlist: manage it for the whole organization with the **Manage network allowlist** switch on the **Claude Science** page (see [Network allowlist](#network-allowlist)), or leave it off and let members manage their own. Administrators can also extend a member's list per device with the sandbox network keys in the [configuration file reference](/docs/claude-science/configuration-file-reference.md). |
248253| Data and privacy > Location metadata | Not applicable in Claude Science | Claude Science doesn't send location data with requests to Claude, so there is nothing for this setting to govern. |
249254| Capabilities > Memory (Enable memory for your team) | Supported in Claude Science | This setting governs memory in claude.ai chat. Claude Science keeps a separate memory on each member's computer, which you turn on or off with the **Turn on memory for your team** switch on the **Claude Science** page (see [Memory](#memory)). On Enterprise plans, a custom role's **Memory** capability under **Claude Science** can limit it to certain roles (see [Capabilities in custom roles](#capabilities-in-custom-roles)). |
250255| Settings for claude.ai projects (Public projects, Retention period for projects) | Not applicable in Claude Science | Claude Science doesn't use claude.ai projects. Its projects are folders on the member's computer. |
from line 269
264269
265270| Setting in claude.ai | Status for Claude Science | Note |
266271| - | - | - |
267| Data and privacy > Encryption keys (customer-managed keys) | Supported in Claude Science | The content Anthropic stores from Claude Science (model-call logs, skills members publish, and, where the Compliance API is enabled, session transcripts) is encrypted under your key. Data stored on the member's computer isn't hosted by Anthropic, and work members send to their own SSH hosts, Modal account, or scientific model endpoints doesn't pass through Anthropic, so neither is under your key. In organizations that use customer-managed encryption keys, the app also hides the **Send feedback** link on the [**Chat paused**](/docs/claude-science/safeguards#when-safeguards-flag-a-message) card. See [Customer-managed encryption keys](/docs/claude-science/how-claude-science-works-with-your-data#customer-managed-encryption-keys). |
272| Data and privacy > Encryption keys (customer-managed keys) | Supported in Claude Science | The content Anthropic stores from Claude Science (model-call logs, skills members publish, and, where the Compliance API is enabled, session transcripts) is encrypted under your key. Data stored on the member's computer isn't hosted by Anthropic, and work members send to their own SSH hosts, Modal account, or scientific model endpoints doesn't pass through Anthropic, so neither is under your key. In organizations that use customer-managed encryption keys, the app also hides the **Send feedback** link on the [**Chat paused**](/docs/claude-science/safeguards.md#when-safeguards-flag-a-message) card. See [Customer-managed encryption keys](/docs/claude-science/how-claude-science-works-with-your-data.md#customer-managed-encryption-keys). |
268273| Data and privacy > Data residency (US-only inference), or the regional processing terms in your contract | Supported in Claude Science | Governs where Anthropic processes Claude Science requests to Claude, as for your other Claude products. It doesn't cover code that runs on the member's computer, SSH hosts, or Modal account (the same boundary as Claude Code). |
269274| Data and privacy > HIPAA Compliance | Not applicable in Claude Science | Organizations with HIPAA compliance enabled can turn Claude Science on, but its use isn't covered under your BAA and members must keep protected health information out of it. These organizations start from stricter defaults, listed under [Defaults by plan](#defaults-by-plan). |
270| Data and privacy > Retention period for chats and projects (Enterprise) | Partially supported in Claude Science | The window doesn't reach data stored on members' computers. For Enterprise organizations with the Compliance API enabled, Anthropic keeps each Claude Science session transcript it captures for the window in effect at the time of capture, or for 6 years when no window is set. See [How Claude Science works with your data](/docs/claude-science/how-claude-science-works-with-your-data) for what Anthropic keeps and for how long. |
275| Data and privacy > Retention period for chats and projects (Enterprise) | Partially supported in Claude Science | The window doesn't reach data stored on members' computers. For Enterprise organizations with the Compliance API enabled, Anthropic keeps each Claude Science session transcript it captures for the window in effect at the time of capture, or for 6 years when no window is set. See [How Claude Science works with your data](/docs/claude-science/how-claude-science-works-with-your-data.md) for what Anthropic keeps and for how long. |
271276
272277### Audit and compliance
273278
from line 279
274279| Setting in claude.ai | Status for Claude Science | Note |
275280| - | - | - |
276281| Data and privacy > Export audit logs | Not available in Claude Science | Claude Science doesn't write events to the audit log. For Enterprise organizations with the Compliance API enabled, changes to your Claude Science organization settings are recorded in its Activity Feed instead. |
277| Data and privacy > Compliance API | Supported in Claude Science | Enterprise plans only. The [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api) returns read-only transcripts of members' Claude Science sessions (this coverage is in beta) and records changes to your Claude Science organization settings in its Activity Feed. Sessions in organizations with HIPAA compliance enabled aren't captured. See [Compliance API coverage](/docs/claude-science/how-claude-science-works-with-your-data#compliance-api-coverage). |
282| Data and privacy > Compliance API | Supported in Claude Science | Enterprise plans only. The [Compliance API](https://platform.claude.com/docs/en/manage-claude/compliance-api) returns read-only transcripts of members' Claude Science sessions (this coverage is in beta) and records changes to your Claude Science organization settings in its Activity Feed. Sessions in organizations with HIPAA compliance enabled aren't captured. See [Compliance API coverage](/docs/claude-science/how-claude-science-works-with-your-data.md#compliance-api-coverage). |
278283| Data and privacy > Export data | Not available in Claude Science | The organization export doesn't include Claude Science conversations and files, which are stored on members' computers (the same as Claude Code). |
279284
280285### Usage, models, and billing
from line 286
281286
282287| Setting in claude.ai | Status for Claude Science | Note |
283288| - | - | - |
284| Usage > Extra usage and Spend limits | Supported in Claude Science | Claude Science usage counts the same way as Claude Code and Cowork usage. See [Plans and usage](/docs/claude-science/overview#plans-and-usage). |
289| Usage > Extra usage and Spend limits | Supported in Claude Science | Claude Science usage counts the same way as Claude Code and Cowork usage. See [Plans and usage](/docs/claude-science/overview.md#plans-and-usage). |
285290| Billing | Supported in Claude Science | Claude Science uses the same seat as the rest of claude.ai, so there is nothing separate to purchase. |
286291| Models > Model access and Default model (Enterprise) | Supported in Claude Science | Claude Science follows your **Models** page. Turning a model off, for the whole organization or for a custom role, removes it from those members' model picker in the app within a few minutes, and requests for that model are refused. Your **Default model** setting applies in the app as it does in claude.ai. Team plans don't have the **Models** page. |
287| Analytics (from the user menu) | Supported in Claude Science | Analytics has a **Claude Science** tab with adoption and session metrics, and the spend charts on the **Overview** tab can be filtered to Claude Science (see [Monitor usage](/docs/claude-science/monitor-usage)). |
292| Analytics (from the user menu) | Supported in Claude Science | Analytics has a **Claude Science** tab with adoption and session metrics, and the spend charts on the **Overview** tab can be filtered to Claude Science (see [Monitor usage](/docs/claude-science/monitor-usage.md)). |
288293
289294### Offboarding and local data
290295
291296| Setting in claude.ai | Status for Claude Science | Note |
292297| - | - | - |
293| Removing a member (local data) | Not available in Claude Science | Removing a member ends their access to Claude Science but doesn't delete data already on their computer. Use your device management software for that (see [Manage on devices](/docs/claude-science/manage-on-devices)). |
294| Deleting local data | Not available in Claude Science | When a member deletes Claude Science data on their computer, nothing Anthropic holds is deleted: the model-call logs and, where captured, Compliance API session transcripts remain until their own retention periods end (see [How Claude Science works with your data](/docs/claude-science/how-claude-science-works-with-your-data)). |
298| Removing a member (local data) | Not available in Claude Science | Removing a member ends their access to Claude Science but doesn't delete data already on their computer. Use your device management software for that (see [Manage on devices](/docs/claude-science/manage-on-devices.md)). |
299| Deleting local data | Not available in Claude Science | When a member deletes Claude Science data on their computer, nothing Anthropic holds is deleted: the model-call logs and, where captured, Compliance API session transcripts remain until their own retention periods end (see [How Claude Science works with your data](/docs/claude-science/how-claude-science-works-with-your-data.md)). |
295300
claude-science/auto-mode New page · 38 lines, new page
# Auto mode ## Turn auto mode on or off ## What auto mode needs in Claude Science ## What auto mode checks ## What each check sends to Anthropic
A whole new page. There's nothing to diff it against, so here is what it says.
# Auto mode > Auto mode in Claude Science lets a safety check approve code and connector calls. Auto mode in Claude Science lets Claude run code and call connectors without routine [permission cards](/docs/claude-science/core-concepts.md#permission-cards). A separate safety check reviews code, and the connector calls that would otherwise ask you, before they run. It approves the ones that look safe and holds anything that escalates beyond your request, is destructive or hard to undo, or appears driven by hostile content Claude read. Anything the check holds or can't check still shows you the card. Allow or deny the request as you would with auto mode off. > [!WARNING] > > Auto mode in Claude Science reduces permission cards but does not guarantee safety. Use it for tasks where you trust the general direction, not as a replacement for review on sensitive operations. ## Turn auto mode on or off Where auto mode is available to you, it starts on. * **For new sessions**: go to **Settings > Permissions** and turn the **Auto mode on for new sessions** toggle off or on. * **For the current session**: open the session settings menu in the message box and turn the **Auto mode** row on or off. The **Auto mode on for new sessions** toggle also decides for sessions that don't have their own auto mode setting, such as sessions you started before Anthropic made auto mode available to you. A session with its own setting keeps it when you change the toggle, so turn auto mode off in that session from the session settings menu in the message box. ## What auto mode needs in Claude Science Auto mode in Claude Science is available only when all of these requirements are met: * **Sandbox**: the [sandbox](/docs/claude-science/core-concepts.md#sandbox) is on. With the sandbox off, auto mode approves nothing. * **Organization**: on Team and Enterprise plans, your organization's admin allows it (see [Auto mode in Admin controls](/docs/claude-science/admin-controls.md#auto-mode)). * **Availability**: Anthropic has made auto mode available to you in Claude Science. If the toggle is missing or grayed out, one of these requirements is unmet. ## What auto mode checks Auto mode in Claude Science checks code that Claude runs in the sandbox (Python, R, shell, and PowerShell cells) and calls to remote and directory connectors. A permission you saved for code cells doesn't skip the check while auto mode is on. Everything else asks as it does with auto mode off. That includes network access, access to files outside the session's workspace folder, remote compute, Claude's package and environment tools, and any tool you set to **Ask each time**. ## What each check sends to Anthropic Each check in Claude Science is a separate request to a Claude model at Anthropic and counts toward your usage. It includes the pending action in full and these parts of the conversation so far: your messages, Claude's questions with your answers, and each action Claude took. Each action still in the conversation is sent in full, such as the code Claude ran, the text it wrote to a file, a short message it sent you while it worked, or the instructions it wrote when it delegated part of the work. Claude's other replies and the output of those actions are left out, except where a summary of older parts of a long conversation restates them. When code runs anywhere but the top level of the Claude Science session's workspace folder, the request includes the full path of the folder the code runs in, which can include your computer's user name.
claude-science/changelog Changed · +62 / -4 lines
from line 4
44
55**0.1.70**
66
7October 21, 2026
8
79* Bug fixes and reliability improvements
810
911**0.1.69**
1012
11* A new **Trouble updating?** link opens [Update Claude Science](/docs/claude-science/update-claude-science), a help page with other ways to update. It shows in **Settings > General > About**, in the **Update required** box, and on the "Update available" notice while an update downloads or after one fails
13October 21, 2026
14
15* A new **Trouble updating?** link opens [Update Claude Science](/docs/claude-science/update-claude-science.md), a help page with other ways to update. It shows in **Settings > General > About**, in the **Update required** box, and on the "Update available" notice while an update downloads or after one fails
1216* Cloud storage in Settings now works with Google Cloud Storage HMAC keys on computers where no AWS region is set
1317* Mac: if `config.toml` has `auto_update = false` under `[update]`, Claude Science in its own window no longer checks for updates in the background. You can still check with **Claude Science > Check for App Updates…** in the menu bar
1418* Linux: fixed updates from 0.1.66 or earlier failing with "restart aborted" when Claude Science was started by typing only `claude-science`
from line 21
1721
1822**0.1.68**
1923
24October 20, 2026
25
2026* **Export session** files now list the approval decisions made in the session from this version on: whether each action was approved, how it was settled, and when
2127* From this version on, when an update is required while sessions are running, you can stop them and update in one step, and resume them afterwards
2228* Mac and Linux: the starter Python and R environments, and the environments Claude Science sets up for connectors and compute providers, now keep their own downloaded packages. The first conda install into them after you update downloads packages again, so it needs a network connection and takes longer, and Claude Science can use about 3 GB more disk space
from line 31
2531
2632**0.1.67**
2733
34October 19, 2026
35
2836* The Example project now holds nine new example sessions from various scientific fields
2937* If Claude Science opens in its own window, on Windows or on a Mac, you can now search the page you're on with Ctrl+F (Cmd+F on a Mac)
3038* The Genomes connector's five UCSC Genome Browser tools and the Regulation connector's UniBind region lookup are unavailable for now
from line 44
3644
3745**0.1.66**
3846
47October 18, 2026
48
3949* Bug fixes and reliability improvements
4050
4151**0.1.63**
4252
53October 14, 2026
54
4355* Tabs in the right pane are now all one width, and the tab you're viewing always shows its close button
4456* Newly saved artifacts now list more of their input files in Provenance when the code that created them read many files
4557* Linux: Claude Science now detects an NVIDIA GPU only if `nvidia-smi` can run without your `LD_LIBRARY_PATH` and is in `/usr/bin` or one of a few other fixed folders (`/usr/local/bin` isn't one). Otherwise the app finds no GPU, and the **Host GPU** switch in **Settings > Compute** is hidden unless it's already on
from line 60
4860
4961**0.1.62**
5062
63October 13, 2026
64
5165* Linux: if Claude Science won't start after updating to 0.1.61, run `claude-science update` in a terminal to get 0.1.62 or later, then start it again. If it's still running and the "Update available" notice shows "restart aborted", select "Check for updates" in **Settings > General > About** so it finds the newer version, then "Restart to update"
5266* Linux: Claude Science starts again when bubblewrap or socat comes from conda, Homebrew, or a folder in your home directory. 0.1.61's requirement that both be installed for the whole system is withdrawn for now, though installing them that way is still recommended
5367* Fixed the app sometimes becoming unresponsive after Claude saves results from an analysis that read large files
from line 69
5569
5670**0.1.61**
5771
72October 13, 2026
73
5874* Sessions you start in the Example project now show on the home screen
5975* A GitHub token you paste in **Settings > Credentials** now stays after a restart, instead of switching back to the token found on your computer; if yours switched back, paste it again
6076* Linux: fixed Featured connectors that run on your computer sometimes failing to start right after your first sign-in
6177* Linux: Claude Science now needs bubblewrap and socat installed for the whole system, from your distribution's packages or by an administrator. If yours came from conda, Homebrew, or a folder in your home directory, the app refuses to start and its message says what to do
62* Windows: Claude Science is now signed with a renewed certificate from the same publisher, Anthropic, PBC. If your IT team allows the app by certificate thumbprint, add the new SHA-1 thumbprint `60C2D9C51F09822FFF4F194DE9EEDB67451292D1` and keep the previous one, both listed under [Windows signing certificate](/docs/claude-science/manage-on-devices#windows-signing-certificate)
78* Windows: Claude Science is now signed with a renewed certificate from the same publisher, Anthropic, PBC. If your IT team allows the app by certificate thumbprint, add the new SHA-1 thumbprint `60C2D9C51F09822FFF4F194DE9EEDB67451292D1` and keep the previous one, both listed under [Windows signing certificate](/docs/claude-science/manage-on-devices.md#windows-signing-certificate)
6379* Security hardening of the analysis sandbox on Mac, Windows, and Linux
6480* Various bug fixes and security improvements
6581
6682**0.1.60**
6783
84October 7, 2026
85
6886* Mac: fixed a problem introduced in 0.1.59 where Python, R, and some shell commands could fail to run when Claude Science has access to many folders
6987* **Settings > Network > Package mirror** now shows a mirror credential file your organization deployed, instead of asking for a token
7088
7189**0.1.59**
7290
91October 6, 2026
92
7393* Saved approvals for tools from your organization's plugins are cleared, so Claude asks again; new approvals apply only to the plugin that added the tool
7494* Skills from plugins your organization's admin uploads now appear under Organization in **Settings > Skills**, instead of under Featured
7595* Comment boxes on figures, PDFs, reports, and files now grow as you type, and a new comment that fails to save keeps your text and shows an error
from line 100
80100
81101**0.1.56**
82102
103October 2, 2026
104
83105* When safeguards flag a message for life sciences content, Claude Science can now retry it once on another model automatically, depending on the model; turn this off with **Switch models when a message is flagged** in **Settings > General > Model**
84106* Excel (.xlsx) previews now show cell colors, bold text, and color-scale heat maps
85107* Reviewer findings now open in place, with a button to the reviewer's full transcript
from line 118
96118
97119**0.1.55**
98120
121September 29, 2026
122
99123* New sessions on an organization's default model with more life sciences restrictions now show a notice with a one-click switch to another model
100124* Fixed an error Claude ran into when outlining an existing multi-panel figure or drafting a paper's brief from its abstract and figure captions
101125
102126**0.1.54**
103127
128September 28, 2026
129
104130* Sessions on Claude Sonnet 5.5 now default to Extra high reasoning effort
105131* Windows: after an update, the app window reopens on the new version by itself
106132* Pinned artifacts (formerly starred) and pinned projects now show a pushpin instead of a star
from line 137
111137
112138**0.1.53**
113139
140September 24, 2026
141
114142* Paste a list of domains in **Settings > Network** to allow them all at once
115143* In Markdown files, editing table cells in place now works in files with up to 2,500 table cells, however long their text
116144* **Settings > Connectors**: a Featured connector that was turned off during setup now shows as off, and turning it back on lets Claude use it again
from line 149
121149
122150**0.1.52**
123151
152September 22, 2026
153
124154* Clicking a figure in Claude's answer now opens it beside the chat; Ctrl/Cmd-click or the new "Open fullscreen" button opens it full screen
125155* Opening or closing the right pane now keeps your place in a long answer
126156* Markdown files no longer rotate in Safari after they load
from line 161
131161
132162**0.1.51**
133163
164September 22, 2026
165
134166* Pinned sessions (formerly starred) from across all your projects now appear at the top of the session list; a new switch in **Settings > General > Appearance** lets you limit them to the open project
135167* In Markdown files, click a plain-text cell in a table to edit it in place
136168* Tables in Markdown files keep their scroll position when Claude saves another file
from line 177
145177
146178**0.1.50**
147179
180September 17, 2026
181
148182* Tables in Markdown files now show as a compact grid; a long table keeps its header row in view, and row labels stay in view when you scroll sideways
149183* Tabs in the right pane can be reordered by dragging, or with Ctrl/Cmd+Shift+Left/Right
150184* Pasted images are now saved to your uploads, so Claude can keep working with them later in the conversation
from line 190
156190
157191**0.1.49**
158192
159* If your organization is in Anthropic's Life Sciences Verification Program (beta), you can now [choose a use case](/docs/claude-science/safeguards#choose-a-use-case) for your sessions
193September 16, 2026
194
195* If your organization is in Anthropic's Life Sciences Verification Program (beta), you can now [choose a use case](/docs/claude-science/safeguards.md#choose-a-use-case) for your sessions
160196* Saved credentials now reach Claude's code only when it asks for them and you approve. They're no longer present in every cell
161197* Access Claude Science work saved on your computer from other sign-ins, from Home or Settings. Admins control it on Team and Enterprise plans
162198* Claude can send you a short message, such as a link to a file, while it keeps working on a task
from line 207
171207
172208**0.1.48**
173209
210September 14, 2026
211
174212* On Windows, environment setup now handles user folders with accented or non-Latin names, tries again if Windows briefly refuses to start the environment installer, and no longer needs the Microsoft Visual C++ Redistributable
175213* The app now warns you a few days before your sign-in expires and offers a "Sign in again" button
176214* Various bug fixes and security improvements
from line 215
177215
178216**0.1.47**
179217
180* Claude Science is now available for Windows: download it from [claude.com/product/claude-science](https://claude.com/product/claude-science), and see [Get started](/docs/claude-science/get-started) for setup
218September 10, 2026
219
220* Claude Science is now available for Windows: download it from [claude.com/product/claude-science](https://claude.com/product/claude-science), and see [Get started](/docs/claude-science/get-started.md) for setup
181221* Various bug fixes and improvements
182222
183223**0.1.43**
184224
225August 31, 2026
226
185227* On Linux, commands, notebook cells, and local connectors work again on systems with bubblewrap's recent security update
186228* Cloud storage in Settings (Amazon S3, S3-compatible services, and Google Cloud Storage with HMAC keys) now works behind a TLS-inspecting proxy such as Zscaler or Netskope, trusting the same corporate root certificate as sign-in and the Claude API
187229* Various bug fixes and security improvements
from line 230
188230
189231**0.1.41**
190232
233August 27, 2026
234
191235* Messages now show when they were sent: hover one of your messages to see the time, and Claude's replies show it next to their copy and feedback buttons
192236* Reviewer findings now appear as cards directly under the message they refer to, instead of a single summary card; click a card to open the reviewer's reasoning
193237* When a connector's sign-in expires mid-session, Claude now tells you which connector to reconnect, and Settings > Connectors shows "Sign-in expired" with a Reconnect button
from line 245
201245
202246**0.1.27**
203247
248August 7, 2026
249
204250* On macOS, installs that showed an environment setup error in their first session now repair themselves automatically after updating; the Featured connectors become available once the repair finishes, which can take a few minutes
205251* Star a session from its menu to keep it in a Starred section at the top of your project's session list
206252* Get notified when any of your sessions finishes or needs your input, even while you work in another project. In-app notifications are on by default; sound and desktop notifications are under Settings > General > Notifications
from line 257
211257
212258**0.1.21**
213259
260July 21, 2026
261
214262**New**
215263
216264* **Improved context preservation.** On Max, Team, and Enterprise plans, sessions go much further before older messages are summarized.
from line 281
233281
234282**0.1.18**
235283
284July 9, 2026
285
236286**Features**
237287
238288* Sessions now pause and ask for your confirmation before spending extra usage. Billed usage credits are never drawn on a dismissible warning alone.
from line 301
251301
252302**0.1.17**
253303
304July 8, 2026
305
254306* **Fixed a bug where idle sessions were consuming usage.**
255307* Lots of other miscellaneous improvements and fixes.
256308
257309**0.1.16**
258310
311July 7, 2026
312
259313**Features**
260314
261315* Auto-review is now available on the Pro plan: turn it on from the session settings, and it stays off until you do.
from line 332
278332
279333**0.1.15**
280334
335July 1, 2026
336
281337* Corporate networks: environment builds now work behind TLS-inspecting proxies (such as Zscaler or Netskope). On macOS, corporate root CAs in your keychain are picked up automatically for conda/pip package downloads; on macOS or Linux you can also point at a CA-bundle file under Settings > Network > Package mirror. The mirror card's Check button now verifies TLS trust with the same bundle the builds use. (In-session `pip`/`curl` and the Desktop app's guest-VM builds are not covered)
282338* Package mirrors: point conda and pip at your organization's internal mirror (Artifactory/Nexus) via Settings > Network > Package mirror. Setting a mirror also drops the public package hosts from the sandbox network allowlist
283339* OpenAlex now requires a free API key for full-text access. Claude Science resolves access automatically or asks you in the session when a key is needed; you can also add and validate a key anytime under Settings > Credentials
from line 341
285341* Lots of other miscellaneous improvements and fixes
286342
287343**0.1.14**
344
345June 30, 2026
288346
289347* Public launch of Claude Science
290348
claude-science/command-line-settings Changed · +9 / -9 lines
from line 52
5252When serve starts, it prints a line of the form `Web UI → http://localhost:<port>/?nonce=...`. The nonce is a one-time password: it signs one browser tab in and then expires, about three minutes after it is printed. The signed-in tab stays signed in until you restart the program.\
5353You never need to keep a link. claude-science open mints a fresh one and opens it in your browser whenever you want to sign in again.
5454
55The app listens on 127.0.0.1 unless you change `--host`, so it is reachable only from the machine it runs on. For a machine you reach over SSH, first forward two ports from your computer, the web app port and the preview port (by default the web app port plus one), as [Run on a remote Linux server](/docs/claude-science/run-on-remote-linux-server#forward-the-ports-from-your-computer) shows. Then run claude-science url on that machine and open the link it prints in your own browser.
55The app listens on 127.0.0.1 unless you change `--host`, so it is reachable only from the machine it runs on. For a machine you reach over SSH, first forward two ports from your computer, the web app port and the preview port (by default the web app port plus one), as [Run on a remote Linux server](/docs/claude-science/run-on-remote-linux-server.md#forward-the-ports-from-your-computer) shows. Then run claude-science url on that machine and open the link it prints in your own browser.
5656
5757## Flags for serve
5858
from line 74
7474
7575> [!WARNING]
7676>
77> * `--dangerously-no-sandbox` turns the [sandbox](/docs/claude-science/core-concepts#sandbox) off. On macOS and Linux, the code Claude runs then has full read and write access to your home directory and unrestricted network access. On Windows, code cells do not run at all while the flag is set.
78> * `--dangerously-skip-approvals` approves [permission cards](/docs/claude-science/core-concepts#permission-cards) for you without showing them, until you restart without the flag. That includes Claude's requests to run code, reach network hosts, open folders, and use connector tools. Cards still show for a connector tool you set to [**Ask each time**](/docs/claude-science/custom-connectors) and for requests only you can answer, such as entering an SSH password, permanently deleting artifacts, or spending usage credits. On Linux, the card for a folder too large to check for credential files also still shows. Questions Claude asks you still appear.
77> * `--dangerously-no-sandbox` turns the [sandbox](/docs/claude-science/core-concepts.md#sandbox) off. On macOS and Linux, the code Claude runs then has full read and write access to your home directory and unrestricted network access. On Windows, code cells do not run at all while the flag is set.
78> * `--dangerously-skip-approvals` approves [permission cards](/docs/claude-science/core-concepts.md#permission-cards) for you without showing them, until you restart without the flag. That includes Claude's requests to run code, reach network hosts, open folders, and use connector tools. Cards still show for a connector tool you set to [**Ask each time**](/docs/claude-science/custom-connectors.md) and for requests only you can answer, such as entering an SSH password, permanently deleting artifacts, or spending usage credits. On Linux, the card for a folder too large to check for credential files also still shows. Questions Claude asks you still appear.
7979>
8080> These flags are acceptable only on a machine that is already isolated, such as a container or a disposable virtual machine. Never use them with data or prompts that came from someone else, because Claude may follow instructions hidden in them. Neither belongs in everyday use.
8181
82If your organization [manages the network allowlist](/docs/claude-science/admin-controls#network-allowlist), the app ignores `--dangerously-no-sandbox` and keeps the sandbox on. If the app learns of that setting only after it has started without the sandbox, it pauses new sessions and messages until you restart it.
82If your organization [manages the network allowlist](/docs/claude-science/admin-controls.md#network-allowlist), the app ignores `--dangerously-no-sandbox` and keeps the sandbox on. If the app learns of that setting only after it has started without the sandbox, it pauses new sessions and messages until you restart it.
8383
8484## Environment variables
8585
86`DO_NOT_TRACK`, set to any value other than `0` or `false`, turns usage analytics and error reports off. It is the same switch as `disable_telemetry = true` in the configuration file. `GITHUB_TOKEN` (or `GH_TOKEN`) is optional and is used only against `api.github.com`, to lift the rate limit when you install a skill from a GitHub repository. Claude Science also reads the standard proxy variables (`HTTPS_PROXY`, `HTTP_PROXY`, `NO_PROXY`, and `ALL_PROXY`); see [Use Claude Science on a corporate network](/docs/claude-science/corporate-networks#connect-through-an-outbound-proxy). The proxy address variables are the one case where the environment overrides the configuration file, and `NO_PROXY` is merged with the `no_proxy` key rather than replacing it. Every other setting belongs in the configuration file.
86`DO_NOT_TRACK`, set to any value other than `0` or `false`, turns usage analytics and error reports off. It is the same switch as `disable_telemetry = true` in the configuration file. `GITHUB_TOKEN` (or `GH_TOKEN`) is optional and is used only against `api.github.com`, to lift the rate limit when you install a skill from a GitHub repository. Claude Science also reads the standard proxy variables (`HTTPS_PROXY`, `HTTP_PROXY`, `NO_PROXY`, and `ALL_PROXY`); see [Use Claude Science on a corporate network](/docs/claude-science/corporate-networks.md#connect-through-an-outbound-proxy). The proxy address variables are the one case where the environment overrides the configuration file, and `NO_PROXY` is merged with the `no_proxy` key rather than replacing it. Every other setting belongs in the configuration file.
8787
8888An app started from the macOS Dock or Finder, or from the Windows Start menu, does not see variables exported in a terminal.
8989
from line 90
9090* **macOS**: the app reads the `env` file in the data directory (by default `~/.claude-science/env`) when it starts. It applies only a fixed list of variables from the file, which includes `DO_NOT_TRACK` and the proxy variables but not `GITHUB_TOKEN` or `GH_TOKEN`. Put `DO_NOT_TRACK` or a proxy variable there as a `KEY=VALUE` line, then quit and reopen the app. Add a GitHub token under **Settings > Credentials** instead, and delete its line from the file. Before version 0.1.56, the file could set any variable.
9191* **Windows**: set the variable as a user environment variable, then quit and reopen the app.
9292
93See [How the environment variables reach the app](/docs/claude-science/corporate-networks#how-the-environment-variables-reach-the-app).
93See [How the environment variables reach the app](/docs/claude-science/corporate-networks.md#how-the-environment-variables-reach-the-app).
9494
9595## See also
9696
97> **[Run on a remote Linux server](/docs/claude-science/run-on-remote-linux-server)**
97> **[Run on a remote Linux server](/docs/claude-science/run-on-remote-linux-server.md)**
9898>
9999> Install Claude Science on a server and use it from your own browser through an SSH tunnel.
100100
101> **[Configuration file reference](/docs/claude-science/configuration-file-reference)**
101> **[Configuration file reference](/docs/claude-science/configuration-file-reference.md)**
102102>
103103> Find the `config.toml` file and set its network-related keys.
104104
105> **[Remote compute clusters](/docs/claude-science/remote-compute-clusters)**
105> **[Remote compute clusters](/docs/claude-science/remote-compute-clusters.md)**
106106>
107107> Connect an SSH host and run jobs on it.
108108
claude-science/compute-providers Changed · +3 / -3 lines
from line 10
1010
1111### Workspace restrictions set by your organization
1212
13On Team and Enterprise plans, your organization's admin can limit Modal to specific workspaces. When Claude uses your Modal token, the app checks the workspace that Modal reports for that token, not the label in your `~/.modal.toml`. If that workspace isn't on your organization's list, the app tells you that this Modal workspace is not allowed by your admin, and Claude can't run jobs there until you connect a token from an allowed workspace. Your admin can also turn Modal on or off for the organization (see [Modal](/docs/claude-science/admin-controls#modal)).
13On Team and Enterprise plans, your organization's admin can limit Modal to specific workspaces. When Claude uses your Modal token, the app checks the workspace that Modal reports for that token, not the label in your `~/.modal.toml`. If that workspace isn't on your organization's list, the app tells you that this Modal workspace is not allowed by your admin, and Claude can't run jobs there until you connect a token from an allowed workspace. Your admin can also turn Modal on or off for the organization (see [Modal](/docs/claude-science/admin-controls.md#modal)).
1414
15If your organization manages the network allowlist, set **Network restrictions** on the Modal page under **Settings** > **Compute** to **Allowlist** or **No network** before you run jobs. Jobs from a Modal setup with unrestricted network access are refused while your organization manages the list (see [Network allowlist](/docs/claude-science/admin-controls#network-allowlist)).
15If your organization manages the network allowlist, set **Network restrictions** on the Modal page under **Settings** > **Compute** to **Allowlist** or **No network** before you run jobs. Jobs from a Modal setup with unrestricted network access are refused while your organization manages the list (see [Network allowlist](/docs/claude-science/admin-controls.md#network-allowlist)).
1616
1717## Running cloud jobs
1818
from line 38
3838
3939Claude Science can connect to a model server (hosted, or a container you run) that serves a scientific model over HTTP, and call it directly from analyses.
4040
41On Team and Enterprise plans, your organization's admin can turn off scientific model endpoints for the organization. When your admin turns them off, you can't connect these providers or use endpoints you set up earlier, and the settings you entered are kept. Turning them off doesn't change which Claude models you can use (see [Scientific model endpoints](/docs/claude-science/admin-controls#scientific-model-endpoints)). If your organization manages the network allowlist, an endpoint at a public or internal host name works only while that list includes the host.
41On Team and Enterprise plans, your organization's admin can turn off scientific model endpoints for the organization. When your admin turns them off, you can't connect these providers or use endpoints you set up earlier, and the settings you entered are kept. Turning them off doesn't change which Claude models you can use (see [Scientific model endpoints](/docs/claude-science/admin-controls.md#scientific-model-endpoints)). If your organization manages the network allowlist, an endpoint at a public or internal host name works only while that list includes the host.
4242
4343### NVIDIA BioNeMo NIM
4444
claude-science/configuration-file-reference Changed · +9 / -9 lines
from line 8
88
99## Network configuration
1010
11The network-related keys, grouped by the TOML table each belongs to. For the package-mirror keys (`[conda] channel_mirror`, `pip_index_url`, and `ca_bundle`) and the proxy key (`[network] proxy`), a value set in the file takes precedence over the matching Settings control, which then shows as managed by your organization so a member cannot override it. The `[sandbox.network]` lists are additive instead: they add to the member-managed lists under **Settings** > **Network** and lock nothing. On Team and Enterprise plans, two settings made for the whole organization under **Organization settings** > **Claude Science** sit above both the file and the Settings page. An [organization package mirror](/docs/claude-science/admin-controls#organization-package-mirror) takes precedence over the mirror keys, and while the organization manages the [network allowlist](/docs/claude-science/admin-controls#network-allowlist), the file's `allowed_domains` are set aside and its `denied_domains` still apply. The `[network] ca_bundle`, `no_proxy`, and `mcp_x509_strict` keys and `[conda] allow_insecure_mirror` have no in-app control.
11The network-related keys, grouped by the TOML table each belongs to. For the package-mirror keys (`[conda] channel_mirror`, `pip_index_url`, and `ca_bundle`) and the proxy key (`[network] proxy`), a value set in the file takes precedence over the matching Settings control, which then shows as managed by your organization so a member cannot override it. The `[sandbox.network]` lists are additive instead: they add to the member-managed lists under **Settings** > **Network** and lock nothing. On Team and Enterprise plans, two settings made for the whole organization under **Organization settings** > **Claude Science** sit above both the file and the Settings page. An [organization package mirror](/docs/claude-science/admin-controls.md#organization-package-mirror) takes precedence over the mirror keys, and while the organization manages the [network allowlist](/docs/claude-science/admin-controls.md#network-allowlist), the file's `allowed_domains` are set aside and its `denied_domains` still apply. The `[network] ca_bundle`, `no_proxy`, and `mcp_x509_strict` keys and `[conda] allow_insecure_mirror` have no in-app control.
1212
1313### App connection keys
1414
from line 16
1616
1717| Key | Type | Default | Effect |
1818| - | - | - | - |
19| `proxy` | string (URL) | unset | The outbound proxy for the app's HTTP and HTTPS connections, for example `http://proxy.example.corp:8080`. Supply Basic-authentication credentials in the address. An `https://` (TLS-to-proxy) address applies to the app's own connections only; sandboxed package downloads connect directly when the proxy is `https://`, so prefer `http://`. A proxy variable in the app's environment (including `ALL_PROXY`) takes precedence over this key, which takes precedence over the Settings proxy field and the proxy detected from macOS or Windows system settings. On a Mac where Claude Science opens in its own window, the app's own updates use the proxy in macOS network settings instead (see [Proxy and certificates for updates in the Mac app window](/docs/claude-science/corporate-networks#proxy-and-certificates-for-updates-in-the-mac-app-window)). |
19| `proxy` | string (URL) | unset | The outbound proxy for the app's HTTP and HTTPS connections, for example `http://proxy.example.corp:8080`. Supply Basic-authentication credentials in the address. An `https://` (TLS-to-proxy) address applies to the app's own connections only; sandboxed package downloads connect directly when the proxy is `https://`, so prefer `http://`. A proxy variable in the app's environment (including `ALL_PROXY`) takes precedence over this key, which takes precedence over the Settings proxy field and the proxy detected from macOS or Windows system settings. On a Mac where Claude Science opens in its own window, the app's own updates use the proxy in macOS network settings instead (see [Proxy and certificates for updates in the Mac app window](/docs/claude-science/corporate-networks.md#proxy-and-certificates-for-updates-in-the-mac-app-window)). |
2020| `no_proxy` | string (comma-separated) | unset | Hosts that bypass the proxy, as exact hostnames or domain suffixes in one comma-separated string, for example `".example.corp,registry.example.corp"`. Combined with the `NO_PROXY` environment variable and, when the macOS or Windows system settings supply the proxy address, the system's bypass list. Loopback addresses always bypass the proxy. |
21| `ca_bundle` | string (absolute path) | unset | PEM file added to the app's default TLS trust for sign-in, the Claude API, Anthropic-hosted connectors, update checks, and [cloud storage](/docs/claude-science/cloud-storage) access from Settings (Amazon S3, S3-compatible stores, Azure Blob Storage, and Google Cloud Storage); use it for a corporate root behind TLS inspection. It covers the app's own connections only, while package downloads use `[conda] ca_bundle`. On a Mac where Claude Science opens in its own window, the app's own updates use the certificates that macOS trusts instead of this file. The value must be an absolute path outside the app's data directory (`~/.claude-science`), temporary directories, and any directory you have granted Claude write access to; a system location such as `/etc/claude-science/corporate-ca.pem`, or a folder under `C:\ProgramData` on Windows, is recommended. The file must exist, parse as a PEM bundle, and contain no private key; a failing value is ignored with a warning. On Windows, when this key and `[conda] ca_bundle` are both unset, the roots in the computer's Trusted Root Certification Authorities store are trusted automatically instead. |
21| `ca_bundle` | string (absolute path) | unset | PEM file added to the app's default TLS trust for sign-in, the Claude API, Anthropic-hosted connectors, update checks, and [cloud storage](/docs/claude-science/cloud-storage.md) access from Settings (Amazon S3, S3-compatible stores, Azure Blob Storage, and Google Cloud Storage); use it for a corporate root behind TLS inspection. It covers the app's own connections only, while package downloads use `[conda] ca_bundle`. On a Mac where Claude Science opens in its own window, the app's own updates use the certificates that macOS trusts instead of this file. The value must be an absolute path outside the app's data directory (`~/.claude-science`), temporary directories, and any directory you have granted Claude write access to; a system location such as `/etc/claude-science/corporate-ca.pem`, or a folder under `C:\ProgramData` on Windows, is recommended. The file must exist, parse as a PEM bundle, and contain no private key; a failing value is ignored with a warning. On Windows, when this key and `[conda] ca_bundle` are both unset, the roots in the computer's Trusted Root Certification Authorities store are trusted automatically instead. |
2222| `mcp_x509_strict` | `"auto"`, `"relaxed"`, or `"strict"` | `"auto"` | How strictly local connectors check a corporate certificate's profile. With `"auto"`, Claude Science relaxes the strict check when it detects TLS inspection from a configured `[network] ca_bundle`. Connectors pick up a change at their next relaunch. |
2323
2424### Package download keys
from line 27
2727
2828| Key | Type | Default | Effect |
2929| - | - | - | - |
30| `channel_mirror` | string (URL) | unset | Base URL of an internal conda mirror. Channel names resolve beneath it, so `<channel_mirror>/conda-forge/noarch/repodata.json` must return the conda-forge index. Setting it removes the public conda hosts from the sandbox allowlist and admits the mirror host, which environment builds contact directly from the workstation, not through an outbound proxy. Must be `https://` on port 443 or 8443 (an `http://` URL is accepted only when `allow_insecure_mirror` is set), by DNS name, with no embedded credentials. A deployed value these rules reject prevents the app from starting. An [organization package mirror](/docs/claude-science/admin-controls#organization-package-mirror) set under **Organization settings** > **Claude Science** takes precedence over this key. |
30| `channel_mirror` | string (URL) | unset | Base URL of an internal conda mirror. Channel names resolve beneath it, so `<channel_mirror>/conda-forge/noarch/repodata.json` must return the conda-forge index. Setting it removes the public conda hosts from the sandbox allowlist and admits the mirror host, which environment builds contact directly from the workstation, not through an outbound proxy. Must be `https://` on port 443 or 8443 (an `http://` URL is accepted only when `allow_insecure_mirror` is set), by DNS name, with no embedded credentials. A deployed value these rules reject prevents the app from starting. An [organization package mirror](/docs/claude-science/admin-controls.md#organization-package-mirror) set under **Organization settings** > **Claude Science** takes precedence over this key. |
3131| `pip_index_url` | string (URL) | unset | A PEP 503 simple index for Python packages, for example an Artifactory or Nexus PyPI remote ending in `/simple`. Setting it removes the public Python hosts from the sandbox allowlist. Same URL rules as `channel_mirror`, including the startup failure on an invalid value, and the same precedence of an organization package mirror. |
3232| `ca_bundle` | string (absolute path) | unset | A complete PEM bundle (public roots plus your corporate roots) that package downloads verify against, replacing the default trust list; in this release the bundle alone may not be sufficient for pip, which verifies against the operating system's trust store. On macOS and Linux this key affects package downloads only, and it never fixes sign-in; behind TLS inspection, set `[network] ca_bundle` as well. When unset, Linux uses your distribution's system certificate bundle. On Windows, package downloads verify against the Windows certificate store and do not read this key; leave it unset there unless you need a custom bundle, because a file set on Windows becomes the complete certificate list that code inside sessions trusts and turns off the app's automatic use of the Windows certificate store. Same path rules as `[network] ca_bundle`. |
3333| `allow_insecure_mirror` | boolean | `false` | Allows `http://` mirror URLs in this file (the Settings page accepts `https://` only). Off by default because a plaintext mirror lets an on-path attacker substitute packages. |
from line 40
4040| Key | Type | Default | Effect |
4141| - | - | - | - |
4242| `enabled` | boolean | `true` | When `false`, code Claude runs has no network access: package installs and data fetches inside the analysis fail, while the app's own connections are unaffected. This is a no-network mode, not a way to skip the allowlist. |
43| `allowed_domains` | array of strings | `[]` | Domains added to the built-in allowlist, as exact hostnames or wildcards such as `*.example.org`. While the organization manages the [network allowlist](/docs/claude-science/admin-controls#network-allowlist) under **Organization settings** > **Claude Science**, these domains are set aside and the organization's list applies. |
43| `allowed_domains` | array of strings | `[]` | Domains added to the built-in allowlist, as exact hostnames or wildcards such as `*.example.org`. While the organization manages the [network allowlist](/docs/claude-science/admin-controls.md#network-allowlist) under **Organization settings** > **Claude Science**, these domains are set aside and the organization's list applies. |
4444| `denied_domains` | array of strings | `[]` | Domains added to the built-in denylist. A denied domain is blocked even if it also appears on the allowlist, and the built-in denylist entries cannot be removed. |
4545
4646## Web search and upload keys
from line 60
6060
6161## Related resources
6262
63* [Use Claude Science on a corporate network](/docs/claude-science/corporate-networks): how to apply these keys for a proxy, TLS inspection, or an internal mirror
64* [Network requirements](/docs/claude-science/network-requirements): the built-in allowlist and denylist these keys adjust
65* [Manage Claude Science on devices](/docs/claude-science/manage-on-devices): deploying `config.toml` with device management
66* [Command line settings](/docs/claude-science/command-line-settings): the `--config` and `--data-dir` flags
63* [Use Claude Science on a corporate network](/docs/claude-science/corporate-networks.md): how to apply these keys for a proxy, TLS inspection, or an internal mirror
64* [Network requirements](/docs/claude-science/network-requirements.md): the built-in allowlist and denylist these keys adjust
65* [Manage Claude Science on devices](/docs/claude-science/manage-on-devices.md): deploying `config.toml` with device management
66* [Command line settings](/docs/claude-science/command-line-settings.md): the `--config` and `--data-dir` flags
6767
claude-science/connectors-and-skills Changed · +8 / -8 lines
from line 6
66
77## Featured connectors
88
9Claude Science includes Featured connectors to public research databases, most of them in the life sciences. They're on by default and can be turned off individually in **Settings > Connectors**. On Team and Enterprise plans, your organization can also turn individual Featured connectors off for everyone, and in organizations with HIPAA compliance enabled they start off until an admin turns them on. A connector your organization has off stays listed, grayed, and Claude can't use it (see [Featured connectors and skills](/docs/claude-science/admin-controls#featured-connectors-and-skills)). Featured connectors are read-only and don't require an account or key, except that the Literature Graph needs a free OpenAlex API key to search OpenAlex (see [Available credentials](/docs/claude-science/literature-access#available-credentials)). Some underlying databases have non-commercial or attribution terms; review each source's license for your use case.
9Claude Science includes Featured connectors to public research databases, most of them in the life sciences. They're on by default and can be turned off individually in **Settings > Connectors**. On Team and Enterprise plans, your organization can also turn individual Featured connectors off for everyone, and in organizations with HIPAA compliance enabled they start off until an admin turns them on. A connector your organization has off stays listed, grayed, and Claude can't use it (see [Featured connectors and skills](/docs/claude-science/admin-controls.md#featured-connectors-and-skills)). Featured connectors are read-only and don't require an account or key, except that the Literature Graph needs a free OpenAlex API key to search OpenAlex (see [Available credentials](/docs/claude-science/literature-access.md#available-credentials)). Some underlying databases have non-commercial or attribution terms; review each source's license for your use case.
1010
1111| Connector | Sources |
1212| - | - |
from line 45
4545
4646If what you need still isn't there, try these:
4747
48* **Ask Claude first.** Many public databases and tools work without a connector, because the code Claude runs can reach websites directly. The first time Claude needs a new site, a permission card asks you to allow it. If your organization manages the list of allowed sites, ask an admin to add it. See [Sandbox](/docs/claude-science/core-concepts#sandbox).
48* **Ask Claude first.** Many public databases and tools work without a connector, because the code Claude runs can reach websites directly. The first time Claude needs a new site, a permission card asks you to allow it. If your organization manages the list of allowed sites, ask an admin to add it. See [Sandbox](/docs/claude-science/core-concepts.md#sandbox).
4949* **Add one from the Connectors Directory.** Go to **Settings > Connectors > Add connector > Browse Connectors Directory**, which opens the directory in claude.ai. On Pro and Max plans, add the connector there and it appears in Claude Science. On Team and Enterprise plans, you may be able to add it yourself; if not, an admin can add it for your organization. On a Team plan, select **Request** on the connector's listing to ask your admins.
50* **Add one yourself.** If the tool's maker gives you a web address for its connector (sometimes called an MCP server URL), go to **Settings > Connectors > Add connector > Remote URL** and paste it in. If the maker gives you a command to run instead, choose **Local command** and enter it there. On Team and Enterprise plans, this works only if your organization allows custom connectors. See [Custom connectors](/docs/claude-science/custom-connectors).
51* **Ask the tool's maker.** If no connector exists yet, ask them to build one and [submit it to the Connectors Directory](/docs/connectors/building/submission).
50* **Add one yourself.** If the tool's maker gives you a web address for its connector (sometimes called an MCP server URL), go to **Settings > Connectors > Add connector > Remote URL** and paste it in. If the maker gives you a command to run instead, choose **Local command** and enter it there. On Team and Enterprise plans, this works only if your organization allows custom connectors. See [Custom connectors](/docs/claude-science/custom-connectors.md).
51* **Ask the tool's maker.** If no connector exists yet, ask them to build one and [submit it to the Connectors Directory](/docs/connectors/building/submission.md).
5252
53Admins can find the full set of options in [Add a connector your organization needs](/docs/claude-science/admin-controls#add-a-connector-your-organization-needs).
53Admins can find the full set of options in [Add a connector your organization needs](/docs/claude-science/admin-controls.md#add-a-connector-your-organization-needs).
5454
5555## Skills
5656
from line 60
6060
6161Claude loads a skill automatically when the work calls for it. Type **/** in the composer to open the skill picker and insert one explicitly. On Team and Enterprise plans, your organization can turn individual Featured skills off; a skill it has off stays listed, grayed, and Claude doesn't load it.
6262
63**Add skill** lets you create your own via **Chat with Claude**, **Write from scratch**, **Upload a skill**, or **Import from GitHub**. You can also ask Claude to distill a workflow from an existing session into a skill. On Team and Enterprise plans, adding skills of your own is available only if your organization allows custom skills; skills you added earlier keep working either way (see [Custom skills](/docs/claude-science/admin-controls#custom-skills)).
63**Add skill** lets you create your own via **Chat with Claude**, **Write from scratch**, **Upload a skill**, or **Import from GitHub**. You can also ask Claude to distill a workflow from an existing session into a skill. On Team and Enterprise plans, adding skills of your own is available only if your organization allows custom skills; skills you added earlier keep working either way (see [Custom skills](/docs/claude-science/admin-controls.md#custom-skills)).
6464
6565**Import from GitHub** works with private repositories too, once you add a GitHub token under **Settings > Credentials**. An import has two 100 MB limits, one on the repository's download from GitHub and one on the combined size of its skill folders.
6666
67Your admin can also add skills for your organization from claude.ai. See [Organization skills](/docs/claude-science/admin-controls#organization-skills).
67Your admin can also add skills for your organization from claude.ai. See [Organization skills](/docs/claude-science/admin-controls.md#organization-skills).
6868
6969### Update skills imported from GitHub
7070
from line 72
7272
7373If the repository no longer offers a skill you imported, Claude Science says so, and your copy stays and keeps working.
7474
75On Team and Enterprise plans, you can update imported skills only if your organization allows custom skills (see [Custom skills](/docs/claude-science/admin-controls#custom-skills)).
75On Team and Enterprise plans, you can update imported skills only if your organization allows custom skills (see [Custom skills](/docs/claude-science/admin-controls.md#custom-skills)).
7676
claude-science/core-concepts Changed · +3 / -3 lines
from line 10
1010
1111## Files stay on your computer
1212
13Claude reads and writes files in place, in the folders you grant. Anthropic doesn't host or store your files; file content that Claude reads to answer a prompt is sent to Anthropic as part of the conversation, and Anthropic retains it as [How Claude Science works with your data](/docs/claude-science/how-claude-science-works-with-your-data) describes. If you sign in to Claude Science on a different computer, your files, artifacts, and conversation history don't follow you there. See [Use Claude Science on more than one computer](/docs/claude-science/multiple-computers) for what your account does carry between computers.
13Claude reads and writes files in place, in the folders you grant. Anthropic doesn't host or store your files; file content that Claude reads to answer a prompt is sent to Anthropic as part of the conversation, and Anthropic retains it as [How Claude Science works with your data](/docs/claude-science/how-claude-science-works-with-your-data.md) describes. If you sign in to Claude Science on a different computer, your files, artifacts, and conversation history don't follow you there. See [Use Claude Science on more than one computer](/docs/claude-science/multiple-computers.md) for what your account does carry between computers.
1414
1515The one exception to working in place is **Attach files** in the composer: attached files are copied into the application's local data folder so they stay with the conversation.
1616
from line 34
3434
3535All standing grants are listed in Settings > Permissions and can be revoked there.
3636
37On Linux, a uv, conda, mamba, or pixi environment in a folder you've granted **Read & write** can still be read-only to Claude. See [Environments in granted folders](/docs/claude-science/tools-and-environments#environments-in-granted-folders).
37On Linux, a uv, conda, mamba, or pixi environment in a folder you've granted **Read & write** can still be read-only to Claude. See [Environments in granted folders](/docs/claude-science/tools-and-environments.md#environments-in-granted-folders).
3838
3939## Plans
4040
from line 54
5454
5555Saved facts are stored in the app's local database on your computer; they aren't synced to Anthropic. The Memory settings page lists every saved fact. You can edit, delete, add, or clear facts there. A per-session toggle in the session settings menu turns memory off for that session only.
5656
57Facts Claude recalls for a session are sent to Anthropic as part of that session's conversation, and Anthropic retains them as [How Claude Science works with your data](/docs/claude-science/how-claude-science-works-with-your-data) describes. On Team and Enterprise plans, your organization's admin can turn memory off for the organization. Memory is then off for you whatever you chose, and your saved facts stay on your computer, where you can still review and delete them (see [Memory](/docs/claude-science/admin-controls#memory) in the admin controls).
57Facts Claude recalls for a session are sent to Anthropic as part of that session's conversation, and Anthropic retains them as [How Claude Science works with your data](/docs/claude-science/how-claude-science-works-with-your-data.md) describes. On Team and Enterprise plans, your organization's admin can turn memory off for the organization. Memory is then off for you whatever you chose, and your saved facts stay on your computer, where you can still review and delete them (see [Memory](/docs/claude-science/admin-controls.md#memory) in the admin controls).
5858
5959## Composer shortcuts
6060
claude-science/corporate-networks Changed · +10 / -10 lines
from line 2
22
33> How to run Claude Science behind an outbound proxy, a TLS-inspecting proxy, an internal package mirror, and an egress firewall, with the settings your network team needs for each.
44
5Claude Science runs on each member's computer and connects out for sign-in, the Claude API, and package and research hosts, usually through controls your IT organization manages on a corporate network. This page shows the administrator who runs those controls how to point Claude Science at an internal package mirror, configure an outbound proxy and TLS inspection, and hand the firewall team the [network requirements](/docs/claude-science/network-requirements) it needs.
5Claude Science runs on each member's computer and connects out for sign-in, the Claude API, and package and research hosts, usually through controls your IT organization manages on a corporate network. This page shows the administrator who runs those controls how to point Claude Science at an internal package mirror, configure an outbound proxy and TLS inspection, and hand the firewall team the [network requirements](/docs/claude-science/network-requirements.md) it needs.
66
77Claude Science makes three kinds of outbound connections, each passing through a different part of your network policy:
88
from line 13
1313## Setup at a glance
1414
15151. Check the [support table](#what-works-on-a-corporate-network) for your operating systems and network shape.
162. Hand the [network requirements](/docs/claude-science/network-requirements) page to the team that manages your proxy or firewall allowlist.
162. Hand the [network requirements](/docs/claude-science/network-requirements.md) page to the team that manages your proxy or firewall allowlist.
17173. [Point package installs at your internal mirror](#point-package-installs-at-an-internal-mirror) if the public package hosts are blocked, and deploy the mirror credential.
18184. [Connect through an outbound proxy](#connect-through-an-outbound-proxy) if your network uses one.
19195. If your proxy inspects TLS, [deploy your corporate root certificate](#work-behind-tls-inspection) as two bundles: one for the app, and a differently built one for package downloads.
206. [Deploy the settings with device management](/docs/claude-science/manage-on-devices#deploy-configuration-with-device-management) rather than by hand.
206. [Deploy the settings with device management](/docs/claude-science/manage-on-devices.md#deploy-configuration-with-device-management) rather than by hand.
21217. If sign-in or a first build fails, match the error against [Troubleshooting](#troubleshooting-corporate-network-errors).
2222
2323## What works on a corporate network
from line 41
4141
4242When your network blocks the public package hosts (`conda.anaconda.org`, `repo.anaconda.com`, `pypi.org`), point Claude Science at your internal artifact repository instead, and every environment build fetches packages through it. You can set the mirror in three places: once for the whole organization under **Organization settings** > **Claude Science** > **Organization package mirror**, for a fleet with the `[conda] channel_mirror` and `pip_index_url` keys in a [deployed `config.toml`](/docs/claude-science/manage-on-devices#deploy-configuration-with-device-management), or for a single machine under **Settings** > **Network** > **Package mirror**, where the same two settings are called the conda channel mirror and the pip index URL. The steps below use the Settings page, the quickest way to test a mirror URL before you deploy it.
4343
44The organization setting takes a conda channel URL and a Python package index (PyPI) URL, which apply to every member whether or not the organization manages the network allowlist. They take precedence over a mirror set in a member's configuration file or Settings; the member's values are kept but not used, and their Settings show the package mirror as controlled by their admin. The same URL rules apply as below, and an address that breaks those rules is ignored for that registry rather than stopping the app. Members still sign in to the mirror themselves, once for each mirror host (see [Mirror credentials](#mirror-credentials)), unless you [deploy the credential as a file](#deploy-the-mirror-credential-as-a-file). The mirror removes the public hosts it replaces for every member. See [Organization package mirror](/docs/claude-science/admin-controls#organization-package-mirror).
44The organization setting takes a conda channel URL and a Python package index (PyPI) URL, which apply to every member whether or not the organization manages the network allowlist. They take precedence over a mirror set in a member's configuration file or Settings; the member's values are kept but not used, and their Settings show the package mirror as controlled by their admin. The same URL rules apply as below, and an address that breaks those rules is ignored for that registry rather than stopping the app. Members still sign in to the mirror themselves, once for each mirror host (see [Mirror credentials](#mirror-credentials)), unless you [deploy the credential as a file](#deploy-the-mirror-credential-as-a-file). The mirror removes the public hosts it replaces for every member. See [Organization package mirror](/docs/claude-science/admin-controls.md#organization-package-mirror).
4545
4646Set both a conda channel mirror and a pip index: analysis environments are built from conda packages, so a pip index alone leaves the first build stuck trying to reach the public conda host.
4747
from line 133
133133Claude Science reads its proxy configuration once at startup, so restart it after a change. The first source that sets a proxy address wins:
134134
1351351. The standard proxy variables in its own process environment: `HTTPS_PROXY`, `HTTP_PROXY`, and `NO_PROXY` (lowercase spellings also work). `ALL_PROXY` fills in for either proxy variable that is unset, an empty variable counts as unset, and `NO_PROXY="*"` sends all traffic directly.
1362. The `[network] proxy` key in `config.toml`, the form to [deploy with device management](/docs/claude-science/manage-on-devices#deploy-configuration-with-device-management).
1362. The `[network] proxy` key in `config.toml`, the form to [deploy with device management](/docs/claude-science/manage-on-devices.md#deploy-configuration-with-device-management).
1371373. The proxy field under **Settings** > **Network**, where a member can paste a proxy address by hand. It takes effect at the next restart, and when `config.toml` sets the proxy, the field shows as managed by your organization so members cannot override it.
1381384. On macOS and Windows, the proxy configured in the operating system's settings, which Claude Science detects automatically: an explicit web proxy in macOS network settings, or the proxy server in Windows proxy settings.
139139
from line 151
151151
152152### Proxy settings in the configuration file
153153
154For a fleet, set `[network] proxy` and `no_proxy` in `config.toml`; both keys and their formats are in the [configuration file reference](/docs/claude-science/configuration-file-reference#app-connection-keys).
154For a fleet, set `[network] proxy` and `no_proxy` in `config.toml`; both keys and their formats are in the [configuration file reference](/docs/claude-science/configuration-file-reference.md#app-connection-keys).
155155
156156### System proxy settings on macOS and Windows
157157
from line 171
171171
172172* On macOS, the Claude Science app reads a file named `env` in its data folder (`~/.claude-science/env` unless you moved the data folder) when it launches. The file holds `KEY=VALUE` lines (`export KEY=VALUE` also works). Put the three proxy variables there, then quit and reopen the app; an app started from the Dock or Finder does not see variables exported in a terminal. The file's `NO_PROXY` entries merge with the other sources rather than replacing them.
173173
174 The app applies only a fixed list of variables from this file, which includes the proxy variables and `DO_NOT_TRACK`, and skips any other line with a warning in `~/.claude-science/logs/app.log`. When Claude Science opens in its own window on a Mac, the warning goes to `~/Library/Application Support/Claude Science/logs/host-local.log` instead. A `GITHUB_TOKEN` line, for example, is skipped, so add the token under **Settings > Credentials** (see [Environment variables](/docs/claude-science/command-line-settings#environment-variables)). Before version 0.1.56, the file could set any variable.
174 The app applies only a fixed list of variables from this file, which includes the proxy variables and `DO_NOT_TRACK`, and skips any other line with a warning in `~/.claude-science/logs/app.log`. When Claude Science opens in its own window on a Mac, the warning goes to `~/Library/Application Support/Claude Science/logs/host-local.log` instead. A `GITHUB_TOKEN` line, for example, is skipped, so add the token under **Settings > Credentials** (see [Environment variables](/docs/claude-science/command-line-settings.md#environment-variables)). Before version 0.1.56, the file could set any variable.
175175* On Windows, the app reads the variables from the user's environment when it starts, so set them as user environment variables, then quit Claude Science from its notification-area icon and open it again; variables typed into an open Command Prompt or PowerShell window do not reach an app started from the Start menu. Because Claude Science already follows Windows proxy settings, most PCs need no variables, and `[network] proxy` in `config.toml` is the form to deploy.
176176* On Linux, export the variables in the shell or service unit that starts `claude-science serve`. The `env` file is read only by the macOS app.
177177
from line 191
191191
192192### Corporate root for app connections
193193
194The `[network] ca_bundle` key in `config.toml` points at a PEM file whose certificates Claude Science adds to its default trust for sign-in, the Claude API, Anthropic-hosted connectors, update checks, and [cloud storage](/docs/claude-science/cloud-storage) access from Settings. On a Mac where Claude Science opens in its own window, the app's own updates use the certificates that macOS trusts instead (see [Proxy and certificates for updates in the Mac app window](#proxy-and-certificates-for-updates-in-the-mac-app-window)). For cloud storage, the corporate root applies to Amazon S3 and S3-compatible connections, to Azure Blob Storage connections, and to Google Cloud Storage connections. The public roots stay in place, so the file holds only your corporate root. The path rules are in the [configuration file reference](/docs/claude-science/configuration-file-reference#app-connection-keys). A failing value is ignored with a warning rather than stopping the app, so a sign-in error behind inspection usually means the bundle did not load, and the app re-reads the bundle every few minutes (about every 30 minutes on Windows), so a corrected file takes effect without a restart. When you deploy a `config.toml`, deploy the bundle files alongside it.
194The `[network] ca_bundle` key in `config.toml` points at a PEM file whose certificates Claude Science adds to its default trust for sign-in, the Claude API, Anthropic-hosted connectors, update checks, and [cloud storage](/docs/claude-science/cloud-storage.md) access from Settings. On a Mac where Claude Science opens in its own window, the app's own updates use the certificates that macOS trusts instead (see [Proxy and certificates for updates in the Mac app window](#proxy-and-certificates-for-updates-in-the-mac-app-window)). For cloud storage, the corporate root applies to Amazon S3 and S3-compatible connections, to Azure Blob Storage connections, and to Google Cloud Storage connections. The public roots stay in place, so the file holds only your corporate root. The path rules are in the [configuration file reference](/docs/claude-science/configuration-file-reference.md#app-connection-keys). A failing value is ignored with a warning rather than stopping the app, so a sign-in error behind inspection usually means the bundle did not load, and the app re-reads the bundle every few minutes (about every 30 minutes on Windows), so a corrected file takes effect without a restart. When you deploy a `config.toml`, deploy the bundle files alongside it.
195195
196196On Windows, when neither `[network] ca_bundle` nor `[conda] ca_bundle` (the **CA bundle path** field in **Settings**) is set, Claude Science automatically trusts the root certificates installed for the whole computer (the computer's **Trusted Root Certification Authorities** store, not the current user's) and rechecks that store about every 30 minutes, so a PC whose device management already installs your corporate root there needs no setting. Claude Science reads that store with Windows PowerShell, so on PCs where Windows PowerShell is blocked or restricted for users, set `[network] ca_bundle` for the app's own connections and `[conda] ca_bundle` for code inside sessions instead of relying on the store. If you do set `[network] ca_bundle` on Windows, the file is used instead of the store; write its path in single quotes, for example `'C:\ProgramData\corp\corporate-ca.pem'`, because a backslash inside double quotes is a TOML escape and a file that fails to parse stops Claude Science from starting.
197197
from line 208
208208ca_bundle = "/etc/claude-science/complete-bundle.pem"
209209```
210210
211The same path rules apply as for `[network] ca_bundle`; the [configuration file reference](/docs/claude-science/configuration-file-reference#package-download-keys) lists them.
211The same path rules apply as for `[network] ca_bundle`; the [configuration file reference](/docs/claude-science/configuration-file-reference.md#package-download-keys) lists them.
212212
213213> [!WARNING]
214214>
from line 256
256256When a `.netrc` file you deployed (see [Deploy the mirror credential as a file](#deploy-the-mirror-credential-as-a-file)) doesn't work, find the case that matches:
257257
258258* **An environment build fails with `401` or `403`**: check the file's name, contents, permissions, and token (see [HTTP 401 or 403 during an environment build](#http-401-or-403-during-an-environment-build)). On Windows, Claude Science doesn't use a file it can't open or whose keywords or characters it doesn't accept, and Python package installs then don't sign in with it. In a terminal, `claude-science logs` says why.
259* **Your mirror's request log shows nothing**: if your network also allows the public package hosts, setup can use them before the organization's mirror address arrives. In that case, set the mirror in `config.toml` (see [Configuration file reference](/docs/claude-science/configuration-file-reference)) on another machine where Claude Science has never run, before the install, and repeat the test.
259* **Your mirror's request log shows nothing**: if your network also allows the public package hosts, setup can use them before the organization's mirror address arrives. In that case, set the mirror in `config.toml` (see [Configuration file reference](/docs/claude-science/configuration-file-reference.md)) on another machine where Claude Science has never run, before the install, and repeat the test.
260260* **The file reached a machine while a credential was still saved**: have the member select **Remove** under **Settings > Network > Package mirror > Mirror credentials**, then deploy the file again, because removing can empty it. On Windows, have the member then quit Claude Science from its notification-area icon and open it again.
261261
262262### Green check, then nothing provides the package
claude-science/enable-claude-science Changed · +8 / -8 lines
from line 2
22
33> Claude Science is a desktop app for scientific research.
44
5Claude Science is a desktop app for scientific research. It's off by default for Team and Enterprise organizations, and on by default for organizations on the [Claude Team plan for scientists](https://claude.com/programs/team-plan-for-scientists). Turning it on in **Organization settings** > **Claude Science** opens a short dialog that covers who gets access and which connectors to turn on. You can change any of it later on the same page, which also holds the other [organization settings](/docs/claude-science/admin-controls#organization-settings) for Claude Science: which connectors, skills, compute, network access, and memory members can use, and whether members can access previously saved Claude Science work.
5Claude Science is a desktop app for scientific research. It's off by default for Team and Enterprise organizations, and on by default for organizations on the [Claude Team plan for scientists](https://claude.com/programs/team-plan-for-scientists). Turning it on in **Organization settings** > **Claude Science** opens a short dialog that covers who gets access and which connectors to turn on. You can change any of it later on the same page, which also holds the other [organization settings](/docs/claude-science/admin-controls.md#organization-settings) for Claude Science: which connectors, skills, compute, network access, and memory members can use, and whether members can access previously saved Claude Science work.
66
77## Availability
88
from line 16
1616| Pro and Max | On; no admin action needed |
1717| Free | Not available |
1818
19On the Claude Team plan for scientists, members can [download Claude Science](https://claude.com/product/claude-science) and sign in with their claude.ai account without any admin action. An Owner or Primary Owner can [turn Claude Science off](#turn-off-claude-science) or change the other [organization settings](/docs/claude-science/admin-controls#organization-settings) at any time in [**Organization settings > Claude Science**](https://claude.ai/admin-settings/claude-science). The **PubMed**, **Clinical Trials**, **ChEMBL**, and **bioRxiv** connectors aren't added to your organization automatically (see [Set up connectors](#set-up-connectors)).
19On the Claude Team plan for scientists, members can [download Claude Science](https://claude.com/product/claude-science) and sign in with their claude.ai account without any admin action. An Owner or Primary Owner can [turn Claude Science off](#turn-off-claude-science) or change the other [organization settings](/docs/claude-science/admin-controls.md#organization-settings) at any time in [**Organization settings > Claude Science**](https://claude.ai/admin-settings/claude-science). The **PubMed**, **Clinical Trials**, **ChEMBL**, and **bioRxiv** connectors aren't added to your organization automatically (see [Set up connectors](#set-up-connectors)).
2020
2121If your organization has HIPAA compliance enabled, Claude Science app access is off by default, whatever your plan. You can turn it on, but usage isn't covered under your Business Associate Agreement (BAA) and the app shouldn't be used with protected health information (PHI). These organizations also start with stricter organization settings (see [HIPAA organizations](#hipaa-organizations)).
2222
from line 25
2525Go to **Organization settings** > **Claude Science**.\
2626Turn on the **Enable for your organization** toggle. The **Turn on Claude Science** dialog opens.\
2727Complete each step of the dialog, described below, then select **Turn on Claude Science**. Nothing is saved until you do.\
28Review the [organization settings](/docs/claude-science/admin-controls#organization-settings) below the toggle, which unlock once Claude Science is on.\
28Review the [organization settings](/docs/claude-science/admin-controls.md#organization-settings) below the toggle, which unlock once Claude Science is on.\
2929Members with access can [download Claude Science](https://claude.com/product/claude-science) and sign in with their claude.ai account.
3030
3131You need an Owner or Primary Owner role to turn Claude Science on or off. If you have the Admin role, you can add members and assign seats, but you can't turn on Claude Science. Ask an Owner or Primary Owner to turn it on.
from line 38
3838
3939Turn on the tools and data sources your team will use in Claude Science. You can change all of it later.
4040
41Under **Featured connectors**, the **Claude Science local connectors** row covers the connectors that are built by Anthropic, ship with the app, and run on each member's computer. Expand it to turn individual connectors on or off for the whole organization; you can change this later under [Featured connectors and skills](/docs/claude-science/admin-controls#featured-connectors-and-skills), and members can also turn individual local connectors off for themselves in the app. The **PubMed**, **Clinical Trials**, **ChEMBL**, and **bioRxiv** rows are connectors Anthropic hosts. They start selected, and turning Claude Science on adds the selected ones to **Organization settings** > **Connectors** for your organization, which makes them available to members in Claude Science and in claude.ai.
41Under **Featured connectors**, the **Claude Science local connectors** row covers the connectors that are built by Anthropic, ship with the app, and run on each member's computer. Expand it to turn individual connectors on or off for the whole organization; you can change this later under [Featured connectors and skills](/docs/claude-science/admin-controls.md#featured-connectors-and-skills), and members can also turn individual local connectors off for themselves in the app. The **PubMed**, **Clinical Trials**, **ChEMBL**, and **bioRxiv** rows are connectors Anthropic hosts. They start selected, and turning Claude Science on adds the selected ones to **Organization settings** > **Connectors** for your organization, which makes them available to members in Claude Science and in claude.ai.
4242
4343Under **From the Claude connector directory**, you can select additional life-sciences connectors, which are added to your organization the same way.
4444
45On the Claude Team plan for scientists, Claude Science is on without the **Turn on Claude Science** dialog, so the **PubMed**, **Clinical Trials**, **ChEMBL**, and **bioRxiv** connectors aren't added to your organization automatically. To add them, go to [**Organization settings > Claude Science**](https://claude.ai/admin-settings/claude-science) and turn on their switches under **Featured connectors** (see [Featured connectors and skills](/docs/claude-science/admin-controls#featured-connectors-and-skills)).
45On the Claude Team plan for scientists, Claude Science is on without the **Turn on Claude Science** dialog, so the **PubMed**, **Clinical Trials**, **ChEMBL**, and **bioRxiv** connectors aren't added to your organization automatically. To add them, go to [**Organization settings > Claude Science**](https://claude.ai/admin-settings/claude-science) and turn on their switches under **Featured connectors** (see [Featured connectors and skills](/docs/claude-science/admin-controls.md#featured-connectors-and-skills)).
4646
4747The **PubMed**, **Clinical Trials**, **ChEMBL**, and **bioRxiv** rows and the directory list are read-only if your organization has HIPAA compliance enabled or your role can't add connectors for the organization; add those connectors from **Organization settings** > **Connectors** after enabling. The switches for the local connectors still work, and in an organization with HIPAA compliance enabled they start off so you can turn on the ones you have reviewed.
4848
from line 58
5858
5959This is the same pattern as other Claude apps you enable per organization.
6060
61In a custom role, the **Claude Science** capability has seven capabilities under it, one for each feature you can limit by role, such as SSH hosts, Modal, and memory. Turning on the **Claude Science** capability turns these on too, and you can then turn off the ones that role shouldn't have (see [Capabilities in custom roles](/docs/claude-science/admin-controls#capabilities-in-custom-roles)). Any that goes with an organization setting you can't turn on stays off.
61In a custom role, the **Claude Science** capability has seven capabilities under it, one for each feature you can limit by role, such as SSH hosts, Modal, and memory. Turning on the **Claude Science** capability turns these on too, and you can then turn off the ones that role shouldn't have (see [Capabilities in custom roles](/docs/claude-science/admin-controls.md#capabilities-in-custom-roles)). Any that goes with an organization setting you can't turn on stays off.
6262
6363## What members see
6464
from line 72
7272
7373Organizations with HIPAA compliance enabled can turn on Claude Science during the beta, but usage isn't covered under your BAA, so keep protected health information out of it. The **Turn on Claude Science** dialog opens with a step that says so. In its connectors step the local connectors start off, and you can turn on the ones you have reviewed. The Anthropic-hosted and directory connectors in that step are read-only because the dialog's quick-enable path doesn't include the per-connector HIPAA attestation, so add those from **Organization settings** > **Connectors** instead, where the attestation is required.
7474
75These organizations also start with stricter organization settings. Featured connectors and skills, SSH hosts, Modal, model endpoints, and memory are off until you turn them on (including for members who were already using them), custom connectors and access to previously saved Claude Science work can't be turned on, and the organization always manages the network allowlist. See [Defaults by plan](/docs/claude-science/admin-controls#defaults-by-plan).
75These organizations also start with stricter organization settings. Featured connectors and skills, SSH hosts, Modal, model endpoints, and memory are off until you turn them on (including for members who were already using them), custom connectors and access to previously saved Claude Science work can't be turned on, and the organization always manages the network allowlist. See [Defaults by plan](/docs/claude-science/admin-controls.md#defaults-by-plan).
7676
7777## Turn off Claude Science
7878
79Go to **Organization settings** > **Claude Science** and turn off the **Enable for your organization** toggle. Members can no longer sign in to the app, and members who are already signed in lose access within a few minutes. The app stops accepting new messages and shows a notice that Claude Science isn't available for their account. The other settings on the page keep their values and apply again when you turn Claude Science back on. Data already on members' computers stays there; see [How Claude Science works with your data](/docs/claude-science/how-claude-science-works-with-your-data) for details.
79Go to **Organization settings** > **Claude Science** and turn off the **Enable for your organization** toggle. Members can no longer sign in to the app, and members who are already signed in lose access within a few minutes. The app stops accepting new messages and shows a notice that Claude Science isn't available for their account. The other settings on the page keep their values and apply again when you turn Claude Science back on. Data already on members' computers stays there; see [How Claude Science works with your data](/docs/claude-science/how-claude-science-works-with-your-data.md) for details.
8080
claude-science/get-started Changed · +15 / -15 lines
from line 2
22
33> Install Claude Science on macOS, Windows, or Linux, sign in with your Claude account, and run your first analysis.
44
5Install Claude Science on your computer, sign in with your Claude account, and run your first analysis. You need a Claude Pro, Max, Team, or Enterprise plan. The [Claude Team plan for scientists](https://claude.com/programs/team-plan-for-scientists) has Claude Science on by default. On other Team and Enterprise plans, an Owner must [turn Claude Science on](/docs/claude-science/enable-claude-science) first. For what each plan includes and how usage works, see [Plans and usage](/docs/claude-science/overview#plans-and-usage).
5Install Claude Science on your computer, sign in with your Claude account, and run your first analysis. You need a Claude Pro, Max, Team, or Enterprise plan. The [Claude Team plan for scientists](https://claude.com/programs/team-plan-for-scientists) has Claude Science on by default. On other Team and Enterprise plans, an Owner must [turn Claude Science on](/docs/claude-science/enable-claude-science.md) first. For what each plan includes and how usage works, see [Plans and usage](/docs/claude-science/overview.md#plans-and-usage).
66
77## Install
88
from line 10
1010
1111Download the installer from [claude.com/product/claude-science](https://claude.com/product/claude-science) and double-click to install. On first launch, the app sets up its runtime and starter Python and R environments, which takes a few minutes, then opens a new tab in your default browser. If no browser tab appears, click **Claude Science** in the Dock.
1212
13**Updates.** Installing an update from inside Claude Science can switch it from a browser tab to its own window. See [Claude Science in its own window on macOS](/docs/claude-science/mac-app-window).
13**Updates.** Installing an update from inside Claude Science can switch it from a browser tab to its own window. See [Claude Science in its own window on macOS](/docs/claude-science/mac-app-window.md).
1414
1515* **If it opens in a browser tab**: Claude Science checks for updates in the background and shows **Update available** when one is ready. Choose **Restart to update** to install it.
1616* **If it opens in its own window**: Claude Science downloads updates by itself and installs them when you quit. To check for an update right away, choose **Claude Science > Check for App Updates…** in the menu bar.
from line 23
2323
2424**Notification-area icon.** Closing the window leaves Claude Science running, with an icon in the notification area of the taskbar. Click the icon to reopen the window, or choose **Quit Claude Science** from the icon's menu to stop the app.
2525
26**Updates.** Claude Science checks for updates in the background and shows **Update available** when one is ready; choose **Restart to update** to install it. Administrators who distribute the app themselves can turn the background check off with `auto_update = false` under `[update]` in `config.toml` (see [Manage Claude Science on devices](/docs/claude-science/manage-on-devices#deploy-configuration-with-device-management)). To update Claude Science yourself instead, open a newer installer, which upgrades the installed copy in place and keeps your data.
26**Updates.** Claude Science checks for updates in the background and shows **Update available** when one is ready; choose **Restart to update** to install it. Administrators who distribute the app themselves can turn the background check off with `auto_update = false` under `[update]` in `config.toml` (see [Manage Claude Science on devices](/docs/claude-science/manage-on-devices.md#deploy-configuration-with-device-management)). To update Claude Science yourself instead, open a newer installer, which upgrades the installed copy in place and keeps your data.
2727
2828**Uninstall.** To remove the app, follow the Windows steps in [Uninstall Claude Science](#uninstall-claude-science).
2929
30**Corporate networks.** Claude Science follows the proxy configured in Windows proxy settings and trusts corporate root certificates installed for the whole computer, so most managed PCs need no Claude Science configuration. See [Use Claude Science on a corporate network](/docs/claude-science/corporate-networks).
30**Corporate networks.** Claude Science follows the proxy configured in Windows proxy settings and trusts corporate root certificates installed for the whole computer, so most managed PCs need no Claude Science configuration. See [Use Claude Science on a corporate network](/docs/claude-science/corporate-networks.md).
3131
3232**Differences on Windows:**
3333
3434* Claude runs shell commands with PowerShell. Command Prompt scripts, git inside cells, and folder changes in PowerShell need the one-time Windows permission.
3535* Only folders on local NTFS or ReFS drives can be granted, not network shares, mapped network drives, FAT or exFAT drives (many USB sticks and memory cards), or a whole drive such as `D:\`. Copy such files to a local folder or attach them in the chat.
36* [Custom connectors](/docs/claude-science/custom-connectors) that run a local command start with `npx`, `node`, `python`, or the full path of a program. Connectors launched through `npm` or a `.cmd`, `.bat`, or `.ps1` file aren't supported.
36* [Custom connectors](/docs/claude-science/custom-connectors.md) that run a local command start with `npx`, `node`, `python`, or the full path of a program. Connectors launched through `npm` or a `.cmd`, `.bat`, or `.ps1` file aren't supported.
3737* The **Model endpoints** section of **Settings** > **Compute** (NVIDIA BioNeMo NIM) isn't available.
3838
3939**Linux version under WSL.** To use Claude Science from a Linux environment on your Windows computer, run the Linux command-line version under Windows Subsystem for Linux (WSL 2, not WSL 1) with Ubuntu 24.04 or later. The Windows app itself doesn't need WSL. Inside the Ubuntu terminal, follow the install steps in the Linux tab, then start Claude Science with `claude-science serve --port 8765 --no-browser` and open the printed link, which starts with `http://127.0.0.1:8765`, in a Windows browser. Projects you create there stay in WSL, and the Windows app keeps its own.
from line 48
4848
4949**Linux**
5050
51Install the sandbox dependencies, then run the installer. The sandbox needs bubblewrap 0.8.0 or later and socat, and installing them takes administrator (root or `sudo`) access; if you don't have it, ask your system administrator to install them, or see [Run Claude Science without administrator access](/docs/claude-science/run-on-remote-linux-server#run-claude-science-without-administrator-access).
51Install the sandbox dependencies, then run the installer. The sandbox needs bubblewrap 0.8.0 or later and socat, and installing them takes administrator (root or `sudo`) access; if you don't have it, ask your system administrator to install them, or see [Run Claude Science without administrator access](/docs/claude-science/run-on-remote-linux-server.md#run-claude-science-without-administrator-access).
5252
5353* Ubuntu or Debian: `sudo apt-get update && sudo apt-get install -y curl bubblewrap socat`
5454* Fedora or RHEL: `sudo dnf install -y curl bubblewrap socat`
from line 64
6464claude-science serve
6565```
6666
67First launch prints a local URL right away, then continues setting up its starter Python and R environments. To run Claude Science on a remote server and use it from your computer, see [Run on a remote Linux server](/docs/claude-science/run-on-remote-linux-server).
67First launch prints a local URL right away, then continues setting up its starter Python and R environments. To run Claude Science on a remote server and use it from your computer, see [Run on a remote Linux server](/docs/claude-science/run-on-remote-linux-server.md).
6868
69To update Claude Science later, or when it asks you to update, see [Update Claude Science](/docs/claude-science/update-claude-science).
69To update Claude Science later, or when it asks you to update, see [Update Claude Science](/docs/claude-science/update-claude-science.md).
7070
7171> [!NOTE]
7272>
73> Claude Science is a local application, not a website, so there's no public URL to visit. On Windows it opens in its own window, and on Linux it opens in a browser tab. On a Mac it opens in a browser tab, or in its own window once an update has switched it over (see [Claude Science in its own window on macOS](/docs/claude-science/mac-app-window)). Open it from the application itself: Claude Science in Applications or the Dock on macOS, the Start menu on Windows, or the `claude-science` command on Linux. On a remote server, the sign-in link reaches your browser through an SSH tunnel; see [Run on a remote Linux server](/docs/claude-science/run-on-remote-linux-server).
73> Claude Science is a local application, not a website, so there's no public URL to visit. On Windows it opens in its own window, and on Linux it opens in a browser tab. On a Mac it opens in a browser tab, or in its own window once an update has switched it over (see [Claude Science in its own window on macOS](/docs/claude-science/mac-app-window.md)). Open it from the application itself: Claude Science in Applications or the Dock on macOS, the Start menu on Windows, or the `claude-science` command on Linux. On a remote server, the sign-in link reaches your browser through an SSH tunnel; see [Run on a remote Linux server](/docs/claude-science/run-on-remote-linux-server.md).
7474
7575## Sign in and complete setup
7676
from line 169
169169* Nothing opened on macOS, or no browser tab appeared on Linux: on macOS, click **Claude Science** in the Dock, or open it from the **Applications** folder. On Linux, copy the printed URL into a browser on the same machine, or run `claude-science url` to print a fresh one.
170170* On macOS, some of Claude's tools can't start and the error mentions the Xcode license, usually right after an Xcode update: macOS won't run the Python that comes with Apple's developer tools until the license is accepted. Open Xcode and agree to the license with an administrator account, or run `sudo xcodebuild -license accept` in Terminal, then ask Claude to try again.
171171* A Claude Science message on Windows says the app was not installed because the file could not be confirmed: the copy you opened still runs but isn't installed. Download the installer again from [claude.com/product/claude-science](https://claude.com/product/claude-science) and open the new file. If the message persists, the PC could not verify the publisher's signature, so ask your IT team.
172* The Windows app reports that it couldn't set up the app window engine: the first launch downloads that engine from `downloads.claude.ai`, and this usually means the app couldn't reach it. Check the internet connection, and on a corporate network ask IT to allow that domain (see [Network requirements](/docs/claude-science/network-requirements)).
173* On Linux, the installer stops with `The download service may be unreachable, or not yet available in your region`: the installer couldn't get the latest version from `storage.googleapis.com`. Check the internet connection, and on a corporate network ask IT to allow that domain (see [Network requirements](/docs/claude-science/network-requirements#app-connections)). Claude Science is available where Anthropic offers claude.ai. See [Supported countries and regions](https://www.anthropic.com/supported-countries).
174* On Linux, the installer stops with `was NOT installed` and says the copy you already had `was left as it is`: Claude Science was already installed, so the installer first tried to check that the new version starts on this computer. The check didn't succeed, so nothing was replaced. The message and the lines under it say why and, where there is a fix, what to do. If they point to the [configuration file](/docs/claude-science/configuration-file-reference), `~/.claude-science/config.toml`, fix what they report in that file, then run the installer again from the Linux tab of [Install](#install). Otherwise, keep using the copy you already had.
172* The Windows app reports that it couldn't set up the app window engine: the first launch downloads that engine from `downloads.claude.ai`, and this usually means the app couldn't reach it. Check the internet connection, and on a corporate network ask IT to allow that domain (see [Network requirements](/docs/claude-science/network-requirements.md)).
173* On Linux, the installer stops with `The download service may be unreachable, or not yet available in your region`: the installer couldn't get the latest version from `storage.googleapis.com`. Check the internet connection, and on a corporate network ask IT to allow that domain (see [Network requirements](/docs/claude-science/network-requirements.md#app-connections)). Claude Science is available where Anthropic offers claude.ai. See [Supported countries and regions](https://www.anthropic.com/supported-countries).
174* On Linux, the installer stops with `was NOT installed` and says the copy you already had `was left as it is`: Claude Science was already installed, so the installer first tried to check that the new version starts on this computer. The check didn't succeed, so nothing was replaced. The message and the lines under it say why and, where there is a fix, what to do. If they point to the [configuration file](/docs/claude-science/configuration-file-reference.md), `~/.claude-science/config.toml`, fix what they report in that file, then run the installer again from the Linux tab of [Install](#install). Otherwise, keep using the copy you already had.
175175* On Linux, the shell reports `command not found` for `claude-science`: `~/.local/bin` isn't on your PATH. Add the PATH line that the installer printed to your shell profile, then open a new terminal.
176176* On Linux, `claude-science serve` stops with a `Sandbox unavailable:` message that mentions `bwrap was found on PATH at`, `is not where Claude Science runs it from`, `(PATH is not searched)`, or `is deliberately not used`: version 0.1.61 prints these messages, because it needs bubblewrap and socat installed for the whole system. If you updated to it from inside the app, the "Update available" notice shows "restart aborted" instead of these messages. Version 0.1.62 withdraws that requirement. Run `claude-science update` in a terminal, then start Claude Science again.
177177* On Linux, `claude-science serve` stops with `Sandbox unavailable: bwrap not found on PATH`: bubblewrap isn't installed, or isn't on your PATH. Install bubblewrap and socat with the command for your distribution in the Linux tab of [Install](#install).
from line 179
179179* On Linux, `claude-science serve` stops with `Sandbox unavailable: bwrap cannot create unprivileged user namespaces`: the kernel or an AppArmor profile blocks the sandbox from creating user namespaces. The rest of the message names the settings to check on Ubuntu, Debian, and other distributions, and changing them takes administrator (`sudo`) access.
180180* On Linux, an error says `socat is required for Linux sandbox networking but was not found in PATH`: socat isn't installed, or isn't on your PATH. Install socat with the command for your distribution in the Linux tab of [Install](#install).
181181* On Linux, a line starting `[sandbox]` says `no usable socat command was found on this computer`, in the terminal where `claude-science serve` runs or in the output of `claude-science logs`: Claude Science started, but the sandbox has no network access. The sandbox runs socat only from system folders such as `/usr/bin`, and doesn't use a copy from conda, Homebrew, or a folder in your home directory. Code that Claude runs can't reach the internet, and environment setup can fail with `Package downloads are being blocked by network policy` even when your network blocks nothing. Install socat with the command for your distribution in the Linux tab of [Install](#install), or if you don't have administrator access, ask your system administrator to install it for the whole system.
182* Projects from another computer don't appear: by design, Claude Science keeps your work on the computer where it's installed, so each computer starts with its own projects. Your earlier projects are still on the other computer. See [Use Claude Science on more than one computer](/docs/claude-science/multiple-computers).
183* Projects you created under another sign-in on this computer don't appear automatically, for example, after you move from a personal plan to your organization's Team plan: your earlier projects are still in that sign-in's folder. Select the **Review** button on the banner at the top of the home screen, or select **Review** next to **Access previously saved Claude Science work on this computer** under **Settings** > **General** > **Account**, to access them. On Team and Enterprise plans, if there's no banner and the setting is grayed out, your admin controls it. See [Access work from another sign-in on your computer](/docs/claude-science/multiple-computers#access-work-from-another-sign-in-on-your-computer).
184* Sign-in stops at claude.ai: your account is on the Free plan (upgrade required), the redirect couldn't return (in a browser tab or in the Windows app, use **Paste code instead**), or your Team or Enterprise organization hasn't [enabled Claude Science](/docs/claude-science/enable-claude-science) yet.
182* Projects from another computer don't appear: by design, Claude Science keeps your work on the computer where it's installed, so each computer starts with its own projects. Your earlier projects are still on the other computer. See [Use Claude Science on more than one computer](/docs/claude-science/multiple-computers.md).
183* Projects you created under another sign-in on this computer don't appear automatically, for example, after you move from a personal plan to your organization's Team plan: your earlier projects are still in that sign-in's folder. Select the **Review** button on the banner at the top of the home screen, or select **Review** next to **Access previously saved Claude Science work on this computer** under **Settings** > **General** > **Account**, to access them. On Team and Enterprise plans, if there's no banner and the setting is grayed out, your admin controls it. See [Access work from another sign-in on your computer](/docs/claude-science/multiple-computers.md#access-work-from-another-sign-in-on-your-computer).
184* Sign-in stops at claude.ai: your account is on the Free plan (upgrade required), the redirect couldn't return (in a browser tab or in the Windows app, use **Paste code instead**), or your Team or Enterprise organization hasn't [enabled Claude Science](/docs/claude-science/enable-claude-science.md) yet.
185185* After you paste a code, Claude Science says the code wasn't recognized or was issued for an earlier sign-in attempt: select **Open on web** again, approve access, and paste the whole new code. If it says `PKCE state missing or expired` instead, select **Back** and follow the steps in [Sign in and complete setup](#sign-in-and-complete-setup) again.
186186
claude-science/glossary Changed · +5 / -5 lines
from line 4
44
55One-sentence definitions for the terms you meet in Claude Science, from artifact to workspace.
66
7**[Artifact](/docs/claude-science/artifacts)**: any file Claude makes and saves for you, listed in its session's Files view.
7**[Artifact](/docs/claude-science/artifacts.md)**: any file Claude makes and saves for you, listed in its session's Files view.
88
99**Cell**: one block of code Claude runs in a kernel; the cell, its output, and the environment it ran in are recorded in the session's Notebook.
1010
1111**Cloud provider**: your own account at a cloud service where Claude can start jobs; you pay that provider directly.
1212
13**[Comment](/docs/claude-science/comments)**: a note you pin to part of an artifact by selecting it; Claude reads pending comments as instructions on its next turn.
13**[Comment](/docs/claude-science/comments.md)**: a note you pin to part of an artifact by selecting it; Claude reads pending comments as instructions on its next turn.
1414
1515**Connector**: an outside data source or tool wired into Claude over MCP; Claude Science includes a featured set, you can access partner connectors from the Connectors Directory, and you can add your own under Settings > Connectors.
1616
1717**Data directory**: the `~/.claude-science` folder on your computer holding the database, artifacts, session workspaces, and logs.
1818
19**[Environment](/docs/claude-science/tools-and-environments)**: a named set of installed packages (conda) that a kernel runs in, reused across sessions.
19**[Environment](/docs/claude-science/tools-and-environments.md)**: a named set of installed packages (conda) that a kernel runs in, reused across sessions.
2020
2121**Execution log**: the slice of a session's Notebook cells that produced a given artifact version, shown as a tab in its Provenance pane.
2222
from line 32
3232
3333**Provenance (the artifact record)**: the panel behind every artifact version showing the code, cells, conversation, environment, and findings that produced it.
3434
35**[Reviewer](/docs/claude-science/the-reviewer)**: the independent agent that re-examines Claude's claims and artifacts at checkpoints, recording each issue it raises as a finding on the artifact's Review tab; on some plans it runs in the background automatically.
35**[Reviewer](/docs/claude-science/the-reviewer.md)**: the independent agent that re-examines Claude's claims and artifacts at checkpoints, recording each issue it raises as a finding on the artifact's Review tab; on some plans it runs in the background automatically.
3636
3737**Sandbox**: the isolated environment all of Claude's code runs in; reaching outside it needs your approval.
3838
from line 46
4646
4747**SSH host**: a remote machine (server, cluster node, or a job submission host) added by its SSH name, that Claude can run jobs on, or dispatch jobs from.
4848
49**[Use case](/docs/claude-science/safeguards#choose-a-use-case)**: a research purpose that Anthropic has approved for your organization under the Life Sciences Verification Program (beta); if you have more than one, you choose which one a session uses.
49**[Use case](/docs/claude-science/safeguards.md#choose-a-use-case)**: a research purpose that Anthropic has approved for your organization under the Life Sciences Verification Program (beta); if you have more than one, you choose which one a session uses.
5050
5151**Version**: one immutable save of an artifact; saving again adds a new version on top instead of overwriting.
5252
claude-science/how-claude-science-works-with-your-data Changed · +13 / -13 lines
from line 8
88
99On Team and Enterprise plans the [Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms) apply. Under them Anthropic "may not train models on Customer Content from Services," and, as between the parties and to the extent permitted by applicable law, your organization "retains all rights to its Inputs" and "owns its Outputs," including the analyses, code, and results your researchers produce with Claude Science. Anthropic may use content to improve its models only when your organization otherwise expressly chooses to allow it (see [Is my data used for model training?](https://privacy.claude.com/en/articles/7996868-is-my-data-used-for-model-training)). Safety feedback a member sends when Claude's safeguards pause a chat goes to Anthropic for future improvements to its safety systems. To turn off the ability for your researchers to provide feedback, an Owner can turn off the **Rate chats** toggle under **Organization settings** > **Data and privacy**.
1010
11On Pro and Max plans the [Consumer Terms of Service](https://www.anthropic.com/legal/consumer-terms), [Anthropic Privacy Policy](https://www.anthropic.com/legal/privacy), and your Claude privacy settings in the Settings panel apply (see [Legal and compliance](/docs/claude-science/legal-and-compliance)).
11On Pro and Max plans the [Consumer Terms of Service](https://www.anthropic.com/legal/consumer-terms), [Anthropic Privacy Policy](https://www.anthropic.com/legal/privacy), and your Claude privacy settings in the Settings panel apply (see [Legal and compliance](/docs/claude-science/legal-and-compliance.md)).
1212
1313## Where Claude Science data lives
1414
1515| Where | What |
1616| - | - |
17| The computer running Claude Science | Conversation history, project files and artifacts, saved memory, most settings, and stored credentials, in a local folder Anthropic doesn't host or sync (see [Manage Claude Science on devices](/docs/claude-science/manage-on-devices)) |
17| The computer running Claude Science | Conversation history, project files and artifacts, saved memory, most settings, and stored credentials, in a local folder Anthropic doesn't host or sync (see [Manage Claude Science on devices](/docs/claude-science/manage-on-devices.md)) |
1818| Anthropic | The items listed under [What Anthropic receives](#what-anthropic-receives) |
19| Services your organization or members connect | Jobs, files, and queries sent to your SSH hosts, your Modal account, scientific model endpoints, cloud storage, and the external services that local (Featured and custom) connectors, sandboxed code, and remote jobs call, directly from the computer or your own compute and without passing through Anthropic (see [Admin controls](/docs/claude-science/admin-controls#organization-settings)) |
19| Services your organization or members connect | Jobs, files, and queries sent to your SSH hosts, your Modal account, scientific model endpoints, cloud storage, and the external services that local (Featured and custom) connectors, sandboxed code, and remote jobs call, directly from the computer or your own compute and without passing through Anthropic (see [Admin controls](/docs/claude-science/admin-controls.md#organization-settings)) |
2020
2121Sign-in tokens and the credentials members store for compute and cloud storage are encrypted on the computer, and the rest of the local folder relies on operating-system permissions, so apply your full-disk encryption and device management policies to it.
2222
2323## What Anthropic receives
2424
25The app sends the following to Anthropic, over TLS and signed in with the member's Claude account (see [Network requirements](/docs/claude-science/network-requirements#app-connections) for the domains):
25The app sends the following to Anthropic, over TLS and signed in with the member's Claude account (see [Network requirements](/docs/claude-science/network-requirements.md#app-connections) for the domains):
2626
2727* **Requests to Claude** every time Claude responds, carrying the conversation so far, including the member's prompts, the contents of files Claude has read (PDFs included), code and command output, connector results, images Claude is shown, and recalled memory facts. Anthropic keeps these as model-call logs (see [What Anthropic keeps and for how long](#what-anthropic-keeps-and-for-how-long)).
2828* **Web search queries**, run by Anthropic's web search service through a third-party search provider listed among [Anthropic's subprocessors](https://www.anthropic.com/subprocessors).
2929* **Dictation audio**, streamed to Anthropic's speech-to-text service only while a member dictates. If the app can't use that service while Claude Science is open in a browser such as Chrome or Edge, it falls back to the browser's built-in speech recognition, and that browser's vendor then processes the audio.
30* **Safety feedback**, only when a member sends it from the [**Chat paused** card](/docs/claude-science/safeguards#when-safeguards-flag-a-message) that appears when Claude's safeguards pause a chat, consisting of the member's optional comment and a copy of that conversation (members are reminded before submission) with known credential formats and email addresses redacted. It goes to Anthropic for future improvements to its safety systems. Not accepted from organizations with HIPAA compliance or customer-managed encryption keys.
30* **Safety feedback**, only when a member sends it from the [**Chat paused** card](/docs/claude-science/safeguards.md#when-safeguards-flag-a-message) that appears when Claude's safeguards pause a chat, consisting of the member's optional comment and a copy of that conversation (members are reminded before submission) with known credential formats and email addresses redacted. It goes to Anthropic for future improvements to its safety systems. Not accepted from organizations with HIPAA compliance or customer-managed encryption keys.
3131* **Custom skills a member publishes**, stored with the member's claude.ai skills.
32* **Usage telemetry and error reports**, which carry app, device, and timing data, plus account and organization identifiers on telemetry events, but no conversation content, file contents, or file names (see [Telemetry](/docs/claude-science/manage-on-devices#telemetry) for the device setting that turns them, and feedback, off).
32* **Usage telemetry and error reports**, which carry app, device, and timing data, plus account and organization identifiers on telemetry events, but no conversation content, file contents, or file names (see [Telemetry](/docs/claude-science/manage-on-devices.md#telemetry) for the device setting that turns them, and feedback, off).
3333* **Calls to connectors Anthropic hosts** from your claude.ai connector directory, which pass through Anthropic's connector service as in claude.ai, plus routine account, settings, and update traffic.
3434
3535## What Anthropic keeps and for how long
from line 44
4444
4545## Controls available to your organization
4646
47* **Organization settings** for connectors, skills, the sandbox network allowlist, SSH hosts, Modal, model endpoints, memory, and access to previously saved Claude Science work (see [Admin controls](/docs/claude-science/admin-controls)). There is no organization setting for web search, dictation, or telemetry.
47* **Organization settings** for connectors, skills, the sandbox network allowlist, SSH hosts, Modal, model endpoints, memory, and access to previously saved Claude Science work (see [Admin controls](/docs/claude-science/admin-controls.md)). There is no organization setting for web search, dictation, or telemetry.
4848* **US-only inference** (usage-based Enterprise plans) runs model inference for Claude Science requests in the United States, as for your other Claude apps (see [Enable US-only inference](https://support.claude.com/en/articles/15422948-enable-us-only-inference-for-your-organization)).
49* **Device configuration** turns off telemetry, error reports, and feedback and relocates the local data folder (see [Manage Claude Science on devices](/docs/claude-science/manage-on-devices)).
50* **Running Claude Science next to your data**, on a Linux server or virtual machine you control, keeps datasets on your infrastructure, apart from what Claude reads into the conversation, while Claude's inference runs on Anthropic's service (see [Run on a remote Linux server](/docs/claude-science/run-on-remote-linux-server)).
51* **Usage analytics** show adoption and session metrics without conversation content (see [Monitor usage](/docs/claude-science/monitor-usage)).
49* **Device configuration** turns off telemetry, error reports, and feedback and relocates the local data folder (see [Manage Claude Science on devices](/docs/claude-science/manage-on-devices.md)).
50* **Running Claude Science next to your data**, on a Linux server or virtual machine you control, keeps datasets on your infrastructure, apart from what Claude reads into the conversation, while Claude's inference runs on Anthropic's service (see [Run on a remote Linux server](/docs/claude-science/run-on-remote-linux-server.md)).
51* **Usage analytics** show adoption and session metrics without conversation content (see [Monitor usage](/docs/claude-science/monitor-usage.md)).
5252
5353## Compliance API coverage
5454
from line 60
6060
6161The app's conversation history, files, artifacts, and memory are stored on the member's computer and aren't hosted by Anthropic; of these, only what the app sends to Claude reaches Anthropic, where your key covers it as this section describes. Work members send to their own SSH hosts, Modal account, or scientific model endpoints goes directly there, not through Anthropic, and isn't under your key or any Anthropic-managed key, so review those providers' data handling. You can turn these connections off under **Organization settings** > **Claude Science**.
6262
63In organizations with CMEK enabled, the app hides the **Send feedback** link on the [**Chat paused**](/docs/claude-science/safeguards#when-safeguards-flag-a-message) card.
63In organizations with CMEK enabled, the app hides the **Send feedback** link on the [**Chat paused**](/docs/claude-science/safeguards.md#when-safeguards-flag-a-message) card.
6464
6565## What isn't available for Claude Science
6666
67Zero data retention (a Claude Code zero-data-retention arrangement covers Claude Code sessions, not Claude Science), Enterprise Frontier Safeguards, coverage under Anthropic's Business Associate Agreement (keep protected health information out of Claude Science), and inference through a third-party cloud platform or your own cloud tenancy aren't available for Claude Science. See [Admin controls](/docs/claude-science/admin-controls#how-other-admin-settings-apply-to-claude-science) for how the other claude.ai admin settings apply to the app.
67Zero data retention (a Claude Code zero-data-retention arrangement covers Claude Code sessions, not Claude Science), Enterprise Frontier Safeguards, coverage under Anthropic's Business Associate Agreement (keep protected health information out of Claude Science), and inference through a third-party cloud platform or your own cloud tenancy aren't available for Claude Science. See [Admin controls](/docs/claude-science/admin-controls.md#how-other-admin-settings-apply-to-claude-science) for how the other claude.ai admin settings apply to the app.
6868
6969## Related resources
7070
71[Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms), [Data Processing Addendum](https://www.anthropic.com/legal/data-processing-addendum), [subprocessor list](https://www.anthropic.com/subprocessors), [Usage Policy](https://www.anthropic.com/legal/aup), the [Anthropic Trust Center](https://trust.anthropic.com) for certifications and security documentation, and [Admin controls](/docs/claude-science/admin-controls).
71[Commercial Terms of Service](https://www.anthropic.com/legal/commercial-terms), [Data Processing Addendum](https://www.anthropic.com/legal/data-processing-addendum), [subprocessor list](https://www.anthropic.com/subprocessors), [Usage Policy](https://www.anthropic.com/legal/aup), the [Anthropic Trust Center](https://trust.anthropic.com) for certifications and security documentation, and [Admin controls](/docs/claude-science/admin-controls.md).
7272
claude-science/manage-on-devices Changed · +5 / -5 lines
from line 18
1818* **Windows**: the program itself installs per user to `%LOCALAPPDATA%\Programs\ClaudeScience` and registers under the signed-in user's **Settings** > **Apps** > **Installed apps** rather than machine-wide. The app also writes launch logs and state to `%LOCALAPPDATA%\ClaudeScience` and keeps a sandbox state folder under `%LOCALAPPDATA%`, and it unpacks components it runs, such as the app window engine and the sandbox launcher, under the data folder, so allow-listing by path needs both the program folder and the data folder. Uninstalling removes the program and sandbox state; `claude-science uninstall --purge` also removes the data and state folders.
1919* **macOS**: the app is **Claude Science** in the **Applications** folder, or in the **Applications** folder inside the member's home folder. When Claude Science opens in a browser tab, it runs its program from a copy at `~/.claude-science/bin/claude-science`. When it opens in its own window, it runs the program from inside the app. In its own window, Claude Science also keeps window settings, logs, and the window's page storage, which includes unsent message drafts, in `~/Library/Application Support/Claude Science` (see [Macs where Claude Science opens in its own window](#macs-where-claude-science-opens-in-its-own-window)).
2020
21Your endpoint tooling governs these folders the same way it governs any other local application data. Anthropic doesn't host a copy of these folders, so Custom Data Retention and Org Data Export don't reach them. [How Claude Science works with your data](/docs/claude-science/how-claude-science-works-with-your-data) covers what Anthropic does receive from the app, including the session transcripts available to Enterprise organizations with the Compliance API enabled.
21Your endpoint tooling governs these folders the same way it governs any other local application data. Anthropic doesn't host a copy of these folders, so Custom Data Retention and Org Data Export don't reach them. [How Claude Science works with your data](/docs/claude-science/how-claude-science-works-with-your-data.md) covers what Anthropic does receive from the app, including the session transcripts available to Enterprise organizations with the Compliance API enabled.
2222
2323## Deploy configuration with device management
2424
25To set configuration keys organization-wide, deploy the per-member config.toml (at the path given under [Where the app stores data](#where-the-app-stores-data)) through your MDM or endpoint tool. Claude Science doesn't read its settings from a system-level managed-preferences file or registry policy keys, so there's no native MDM configuration channel on any operating system. Deploying the per-member config.toml is the supported approach. The sandbox network allowlist and the package mirror can instead be set once for every member under **Organization settings** > **Claude Science** (see [Organization settings](/docs/claude-science/admin-controls#organization-settings)). The keys most relevant to admins are:
25To set configuration keys organization-wide, deploy the per-member config.toml (at the path given under [Where the app stores data](#where-the-app-stores-data)) through your MDM or endpoint tool. Claude Science doesn't read its settings from a system-level managed-preferences file or registry policy keys, so there's no native MDM configuration channel on any operating system. Deploying the per-member config.toml is the supported approach. The sandbox network allowlist and the package mirror can instead be set once for every member under **Organization settings** > **Claude Science** (see [Organization settings](/docs/claude-science/admin-controls.md#organization-settings)). The keys most relevant to admins are:
2626
2727| Key | Effect |
2828| - | - |
from line 31
3131| `auto_update = false` under `[update]` | Turns off the background check for updates; pair with your own distribution channel. On a Mac where Claude Science opens in its own window, the key requires version 0.1.69 or later. A member can still check for and install an update from inside Claude Science. |
3232| `enabled = false` under `[sandbox.network]` | Blocks network access from the app's local code-execution sandbox. The similarly named `network_isolated` key under `[sandbox]` doesn't control this. |
3333
34The [configuration file reference](/docs/claude-science/configuration-file-reference) documents the network-related keys and their defaults, and [Use Claude Science on a corporate network](/docs/claude-science/corporate-networks) covers the proxy, TLS-inspection, and mirror settings.
34The [configuration file reference](/docs/claude-science/configuration-file-reference.md) documents the network-related keys and their defaults, and [Use Claude Science on a corporate network](/docs/claude-science/corporate-networks.md) covers the proxy, TLS-inspection, and mirror settings.
3535
3636## Macs where Claude Science opens in its own window
3737
from line 44
4444| What differs | In a browser tab | In its own window |
4545| - | - | - |
4646| Updates | Checks in the background and shows **Update available** | Downloads updates by itself and installs them when the app quits |
47| Connections for updates | Use the app's proxy settings | Use the proxy in macOS network settings and the certificates that macOS trusts (see [Proxy and certificates for updates in the Mac app window](/docs/claude-science/corporate-networks#proxy-and-certificates-for-updates-in-the-mac-app-window)) |
47| Connections for updates | Use the app's proxy settings | Use the proxy in macOS network settings and the certificates that macOS trusts (see [Proxy and certificates for updates in the Mac app window](/docs/claude-science/corporate-networks.md#proxy-and-certificates-for-updates-in-the-mac-app-window)) |
4848
4949If the member's account can't write to the app or its folder, Claude Science in its own window doesn't check for updates in the background. The member can still choose **Claude Science > Check for App Updates…**, and macOS then asks for an administrator's password to install the update.
5050
from line 59
5959To turn telemetry and error reports off on managed devices, use either of:
6060
6161Set disable\_telemetry = true in config.toml (deployable through MDM).\
62Set the DO\_NOT\_TRACK environment variable (for example to 1) where the app reads it at launch. See [How the environment variables reach the app](/docs/claude-science/corporate-networks#how-the-environment-variables-reach-the-app).
62Set the DO\_NOT\_TRACK environment variable (for example to 1) where the app reads it at launch. See [How the environment variables reach the app](/docs/claude-science/corporate-networks.md#how-the-environment-variables-reach-the-app).
6363
6464Both are device-level settings. There's no per-member or per-organization telemetry toggle in Organization settings.
6565
claude-science/multiple-computers Changed · +3 / -3 lines
from line 6
66
77## Your work stays on your computer
88
9Anthropic doesn't sync your projects, artifacts, or conversation history to your Claude account, so there's no cloud copy for you to browse or sync from another computer. Claude reads and writes your files in place, in the folders you grant, and your work sits alongside them on your computer, where your own backup tools can cover it like any other application data. Your prompts, Claude's responses, and the file content Claude reads to answer them still go to Anthropic as part of each conversation, and Anthropic retains them as [How Claude Science works with your data](/docs/claude-science/how-claude-science-works-with-your-data) describes.
9Anthropic doesn't sync your projects, artifacts, or conversation history to your Claude account, so there's no cloud copy for you to browse or sync from another computer. Claude reads and writes your files in place, in the folders you grant, and your work sits alongside them on your computer, where your own backup tools can cover it like any other application data. Your prompts, Claude's responses, and the file content Claude reads to answer them still go to Anthropic as part of each conversation, and Anthropic retains them as [How Claude Science works with your data](/docs/claude-science/how-claude-science-works-with-your-data.md) describes.
1010
1111You can install Claude Science on more than one computer and sign in to each with the same Claude account. Your account carries your plan and usage limits to every computer. Skills from your organization, along with any you published from the app, also reappear when you sign in on another computer (to the same organization, if your account belongs to more than one). Memory, most settings, and the connectors you added in the app stay with each computer.
1212
1313Because the only copy is on your computer, include the app's data folder in your regular backups. In the app, **Settings > Storage > Data location** shows where the folder is.
1414
15To take a single result to another computer, choose **Download** from the artifact's menu. A file saved with **Export session** is for technical support and troubleshooting, and can't be loaded into Claude Science on another computer. To reach the same projects from several computers instead, you can install Claude Science once on a Linux server you control and connect to it through an SSH tunnel from the browser on each computer. See [Run on a remote Linux server](/docs/claude-science/run-on-remote-linux-server).
15To take a single result to another computer, choose **Download** from the artifact's menu. A file saved with **Export session** is for technical support and troubleshooting, and can't be loaded into Claude Science on another computer. To reach the same projects from several computers instead, you can install Claude Science once on a Linux server you control and connect to it through an SSH tunnel from the browser on each computer. See [Run on a remote Linux server](/docs/claude-science/run-on-remote-linux-server.md).
1616
1717## Access work from another sign-in on your computer
1818
1919Claude Science keeps the work from each sign-in in its own folder on your computer. When you sign in to a different organization or personal account on that computer (for example, a Team plan after a personal plan), a banner at the top of the home screen offers access to the earlier work. Select the **Review** button on the banner, select the folders to access, choose the **Copy** option (the original folder keeps the work too) or the **Move** option (what's accessed is then removed from the original folder), and select the **Copy** or **Move** button. To access later instead, select **Review** next to **Access previously saved Claude Science work on this computer** under **Settings** > **General** > **Account**.
2020
21The access happens entirely on your computer and uploads nothing. Credentials such as API keys and connector sign-ins aren't copied or moved and stay in their original folder. On Team and Enterprise plans, your admin controls whether the app offers this access (it's off by default on Enterprise plans). Content your organization doesn't allow, such as memory, isn't copied or moved and stays in its original folder (see [Previously saved Claude Science work](/docs/claude-science/admin-controls#previously-saved-claude-science-work)).
21The access happens entirely on your computer and uploads nothing. Credentials such as API keys and connector sign-ins aren't copied or moved and stay in their original folder. On Team and Enterprise plans, your admin controls whether the app offers this access (it's off by default on Enterprise plans). Content your organization doesn't allow, such as memory, isn't copied or moved and stays in its original folder (see [Previously saved Claude Science work](/docs/claude-science/admin-controls.md#previously-saved-claude-science-work)).
2222
claude-science/network-requirements Changed · +7 / -7 lines
from line 6
66
77Connections are outbound-only and almost entirely HTTPS on TCP 443 (an internal package mirror may use 8443). The app's own domains are fixed, apart from open-access full-text downloads (covered below); the analysis-sandbox domains are a built-in allowlist that members adjust during onboarding or under **Settings** > **Network**, or that the organization manages for every member (see [Analysis sandbox domains](#analysis-sandbox-domains)).
88
9The domains fall into three groups: the app's own connections every member needs, the analysis sandbox's package and research domains, and the domains the member's browser loads. For the proxy and TLS-inspection settings, see [Use Claude Science on a corporate network](/docs/claude-science/corporate-networks).
9The domains fall into three groups: the app's own connections every member needs, the analysis sandbox's package and research domains, and the domains the member's browser loads. For the proxy and TLS-inspection settings, see [Use Claude Science on a corporate network](/docs/claude-science/corporate-networks.md).
1010
1111## App connections
1212
from line 23
2323| `downloads.claude.ai` | On Windows, at first launch and when an update changes it | The app window engine, the component that displays the app window |
2424| `api.github.com`, `codeload.github.com` | When members import skills from a GitHub repository | Fetching the skill repository's contents |
2525
26Custom connectors and remote compute that members add reach whatever hosts they are configured with, so allow those case by case. Installs with telemetry turned off (see [Telemetry](/docs/claude-science/manage-on-devices#telemetry)) send no error reports, and blocking `o1158394.ingest.us.sentry.io` affects only error reporting, not the rest of the app.
26Custom connectors and remote compute that members add reach whatever hosts they are configured with, so allow those case by case. Installs with telemetry turned off (see [Telemetry](/docs/claude-science/manage-on-devices.md#telemetry)) send no error reports, and blocking `o1158394.ingest.us.sentry.io` affects only error reporting, not the rest of the app.
2727
2828### Full-text and literature retrieval
2929
from line 42
4242
4343When Claude runs code, its network access passes through a local filtering proxy that allows only the domains on the sandbox's built-in allowlist, grouped by purpose below. By default, each member manages the list on their own computer. Members can turn off any group except package management, during onboarding or under **Settings > Network**, and add allowed domains of their own in Settings, one at a time or by pasting a list. An administrator can also use the per-device configuration file, whose `[sandbox.network]` keys add allowed or denied domains, or disable sandbox networking entirely.
4444
45An organization can instead manage the list for every member from **Organization settings** > **Claude Science**, with one switch per domain and custom domains of its own. Members then see their **Network** settings read-only, and the domains a member or a configuration file added are set aside while the organization manages the list. See [Network allowlist](/docs/claude-science/admin-controls#network-allowlist) for what the organization's list covers and how changes reach members.
45An organization can instead manage the list for every member from **Organization settings** > **Claude Science**, with one switch per domain and custom domains of its own. Members then see their **Network** settings read-only, and the domains a member or a configuration file added are set aside while the organization manages the list. See [Network allowlist](/docs/claude-science/admin-controls.md#network-allowlist) for what the organization's list covers and how changes reach members.
4646
4747### Package management domains
4848
from line 58
5858
5959Claude Science itself does not require GitHub; the package manager ships inside the app. The GitHub domains are used only when a package Claude installs is published as a GitHub release or a member imports a skill from a GitHub repository, and blocking them fails only those operations.
6060
61When you configure a conda channel mirror, Claude Science removes only the conda hosts (`conda.anaconda.org`, `repo.anaconda.com`, `anaconda.org`, `*.anaconda.org`) from the allowlist, and a Python index mirror removes only `pypi.org`, `*.pypi.org`, and `files.pythonhosted.org`. The `*.conda.io`, CRAN and Bioconductor, npm, and GitHub rows stay. A removed host is reachable again if a member re-adds it under **Settings** > **Network** or an administrator lists it in `[sandbox.network] allowed_domains`, which takes precedence over the removal. Environment builds contact the mirror host directly from the workstation, not through the outbound proxy, so it must be reachable directly (over your VPN or internal network if the mirror is internal, HTTPS on TCP 443 or 8443). A proxy allowlist entry alone does not make the mirror reachable for builds, and build-time mirror traffic will not appear in your proxy logs. See [Point package installs at an internal mirror](/docs/claude-science/corporate-networks#point-package-installs-at-an-internal-mirror).
61When you configure a conda channel mirror, Claude Science removes only the conda hosts (`conda.anaconda.org`, `repo.anaconda.com`, `anaconda.org`, `*.anaconda.org`) from the allowlist, and a Python index mirror removes only `pypi.org`, `*.pypi.org`, and `files.pythonhosted.org`. The `*.conda.io`, CRAN and Bioconductor, npm, and GitHub rows stay. A removed host is reachable again if a member re-adds it under **Settings** > **Network** or an administrator lists it in `[sandbox.network] allowed_domains`, which takes precedence over the removal. Environment builds contact the mirror host directly from the workstation, not through the outbound proxy, so it must be reachable directly (over your VPN or internal network if the mirror is internal, HTTPS on TCP 443 or 8443). A proxy allowlist entry alone does not make the mirror reachable for builds, and build-time mirror traffic will not appear in your proxy logs. See [Point package installs at an internal mirror](/docs/claude-science/corporate-networks.md#point-package-installs-at-an-internal-mirror).
6262
6363An organization package mirror set under **Organization settings** > **Claude Science** removes the same hosts for every member and is admitted the same way. When the organization manages the allowlist, the removed hosts stay unreachable even if they are switched on in the organization's list, and a member's own mirror host is reachable only if the organization's list includes it.
6464
from line 110
110110
111111## Related resources
112112
113* [Use Claude Science on a corporate network](/docs/claude-science/corporate-networks): proxy, TLS-inspection, and package-mirror settings
114* [Configuration file reference](/docs/claude-science/configuration-file-reference): the network keys in the configuration file
115* [Manage Claude Science on devices](/docs/claude-science/manage-on-devices): deploying the configuration file with device management
113* [Use Claude Science on a corporate network](/docs/claude-science/corporate-networks.md): proxy, TLS-inspection, and package-mirror settings
114* [Configuration file reference](/docs/claude-science/configuration-file-reference.md): the network keys in the configuration file
115* [Manage Claude Science on devices](/docs/claude-science/manage-on-devices.md): deploying the configuration file with device management
116116
claude-science/overview Changed · +9 / -9 lines
from line 2
22
33> Anthropic's AI workbench for rigorous science.
44
5Claude Science is a desktop application that pairs Claude with an analysis environment on your computer. Available in beta on macOS, Windows, and Linux. You install it separately from the Claude desktop app; see [Get started](/docs/claude-science/get-started#install) for the installers.
5Claude Science is a desktop application that pairs Claude with an analysis environment on your computer. Available in beta on macOS, Windows, and Linux. You install it separately from the Claude desktop app; see [Get started](/docs/claude-science/get-started.md#install) for the installers.
66
77You describe a research task or analysis in plain language; Claude writes and runs Python, R, or shell code in a sandbox, reads the folders you grant it, pulls data from scientific databases through connectors, and saves results as versioned artifacts with a full provenance record. A background reviewer can check Claude's claims against the work that was actually run.
88
from line 14
1414
1515## Use Claude Science outside the life sciences
1616
17Claude Science isn't limited to the life sciences. Besides biology, chemistry, and clinical and medical research, it supports computer science and machine learning, engineering, materials science, mathematics, physics, the social sciences, and other fields. Claude Science is for anyone who works through the loop of scientific discovery: generating hypotheses, reviewing literature, designing experiments, running long and complex data analyses, and turning the results into reproducible figures and findings. Claude writes and runs code and [installs the packages](/docs/claude-science/tools-and-environments#installing-packages) an analysis needs.
17Claude Science isn't limited to the life sciences. Besides biology, chemistry, and clinical and medical research, it supports computer science and machine learning, engineering, materials science, mathematics, physics, the social sciences, and other fields. Claude Science is for anyone who works through the loop of scientific discovery: generating hypotheses, reviewing literature, designing experiments, running long and complex data analyses, and turning the results into reproducible figures and findings. Claude writes and runs code and [installs the packages](/docs/claude-science/tools-and-environments.md#installing-packages) an analysis needs.
1818
1919In any field, Claude Science also gives you these tools:
2020
21* **Remote compute.** For long-running or heavy analyses, Claude can run jobs on [a workstation or Slurm cluster you reach over SSH](/docs/claude-science/remote-compute-clusters), or on cloud GPUs through [your own Modal account](/docs/claude-science/compute-providers). On Team and Enterprise plans, your organization's admin decides whether you can use SSH hosts and Modal.
22* **Credentials.** Store credentials for [licensed literature](/docs/claude-science/literature-access), [cloud storage](/docs/claude-science/cloud-storage), and other APIs in **Settings > Credentials**, where they're encrypted on your computer.
23* **Review.** [The reviewer](/docs/claude-science/the-reviewer) can check Claude's claims against the work that actually ran, and you can add review criteria for your own field in **Settings > Specialists > Reviewer**.
21* **Remote compute.** For long-running or heavy analyses, Claude can run jobs on [a workstation or Slurm cluster you reach over SSH](/docs/claude-science/remote-compute-clusters.md), or on cloud GPUs through [your own Modal account](/docs/claude-science/compute-providers.md). On Team and Enterprise plans, your organization's admin decides whether you can use SSH hosts and Modal.
22* **Credentials.** Store credentials for [licensed literature](/docs/claude-science/literature-access.md), [cloud storage](/docs/claude-science/cloud-storage.md), and other APIs in **Settings > Credentials**, where they're encrypted on your computer.
23* **Review.** [The reviewer](/docs/claude-science/the-reviewer.md) can check Claude's claims against the work that actually ran, and you can add review criteria for your own field in **Settings > Specialists > Reviewer**.
2424
25Researchers in the life sciences also get specialized [Featured connectors](/docs/claude-science/connectors-and-skills#featured-connectors) to databases in their fields, and skills for specific models, such as AlphaFold2 for protein structure. Other Featured connectors and skills work in any field: for example, the Literature Graph and Research Resources connectors search scholarly literature and funding opportunities, and the literature review skill helps Claude find, verify, and synthesize papers. To give Claude a data source or method from your own field, see [When the connector you need isn't listed](/docs/claude-science/connectors-and-skills#when-the-connector-you-need-isn%E2%80%99t-listed) and [Skills](/docs/claude-science/connectors-and-skills#skills).
25Researchers in the life sciences also get specialized [Featured connectors](/docs/claude-science/connectors-and-skills.md#featured-connectors) to databases in their fields, and skills for specific models, such as AlphaFold2 for protein structure. Other Featured connectors and skills work in any field: for example, the Literature Graph and Research Resources connectors search scholarly literature and funding opportunities, and the literature review skill helps Claude find, verify, and synthesize papers. To give Claude a data source or method from your own field, see [When the connector you need isn't listed](/docs/claude-science/connectors-and-skills.md#when-the-connector-you-need-isn%E2%80%99t-listed) and [Skills](/docs/claude-science/connectors-and-skills.md#skills).
2626
2727## Requirements
2828
29* A Claude account on a Pro, Max, Team, or Enterprise plan. The [Claude Team plan for scientists](https://claude.com/programs/team-plan-for-scientists) has Claude Science on by default. On other Team and Enterprise plans, an Owner must [enable Claude Science for the organization](/docs/claude-science/enable-claude-science) first.
29* A Claude account on a Pro, Max, Team, or Enterprise plan. The [Claude Team plan for scientists](https://claude.com/programs/team-plan-for-scientists) has Claude Science on by default. On other Team and Enterprise plans, an Owner must [enable Claude Science for the organization](/docs/claude-science/enable-claude-science.md) first.
3030* A country or region where Anthropic offers claude.ai. See [Supported countries and regions](https://www.anthropic.com/supported-countries).
3131* macOS 13 or later (Apple silicon or Intel), Windows 11 (x64), or Linux x64 on a glibc-based distribution.
3232* About 5 GB of free disk space for the runtime and starter environments.
from line 34
3434
3535## Plans and usage
3636
37Claude Science is included in Pro, Max, Team, and Enterprise plans, with nothing separate to buy. Team and Enterprise Owners control whether Claude Science is available to their members through [an admin setting](/docs/claude-science/enable-claude-science). Claude Science isn't available on the Free plan. Scientists at academic and nonprofit research institutions can also get it through the discounted [Claude Team plan for scientists](https://claude.com/programs/team-plan-for-scientists).
37Claude Science is included in Pro, Max, Team, and Enterprise plans, with nothing separate to buy. Team and Enterprise Owners control whether Claude Science is available to their members through [an admin setting](/docs/claude-science/enable-claude-science.md). Claude Science isn't available on the Free plan. Scientists at academic and nonprofit research institutions can also get it through the discounted [Claude Team plan for scientists](https://claude.com/programs/team-plan-for-scientists).
3838
3939Your Claude Science usage counts toward the same usage limits as the rest of your Claude plan, including Claude Code and Cowork. In Claude Science, **Settings > Usage** shows how much you've used and when each limit resets.
4040
from line 42
4242
4343* **Usage credits and extra usage.** On Pro and Max plans, you can turn on usage credits under **Settings > Usage** in Claude Science to keep working past your limits, and set a monthly spend limit there. Team plans call the same option extra usage, and your admin turns it on. In Claude Science it appears as **Usage credits**, but only Pro and Max plans can change it there. On Team and Enterprise plans, your admin sets spend limits. Some models need usage credits on some plans, and [Claude pricing](https://claude.com/pricing) lists which models each plan includes.
4444* **Usage-based Enterprise plans.** Instead of fixed usage limits, your organization pays for usage on top of the seat price, within the spend limits your admin sets.
45* **Services you connect with your own account.** Services such as [Modal](/docs/claude-science/compute-providers) bill you directly. Anthropic doesn't bill for them.
45* **Services you connect with your own account.** Services such as [Modal](/docs/claude-science/compute-providers.md) bill you directly. Anthropic doesn't bill for them.
4646
4747### When you reach a usage limit
4848
claude-science/run-on-remote-linux-server Changed · +8 / -8 lines
from line 6
66
77> [!NOTE]
88>
9> This page covers running all of Claude Science on a remote machine. To keep Claude Science on your own computer and have it run jobs on a machine you reach over SSH, see [Remote compute clusters](/docs/claude-science/remote-compute-clusters).
9> This page covers running all of Claude Science on a remote machine. To keep Claude Science on your own computer and have it run jobs on a machine you reach over SSH, see [Remote compute clusters](/docs/claude-science/remote-compute-clusters.md).
1010
11The server needs x64 Linux on a glibc-based distribution (arm64 and musl-based distributions such as Alpine aren't supported), about 10 GB of free disk space, and the system packages below. Your Claude account needs a Pro, Max, Team, or Enterprise plan; see [Requirements](/docs/claude-science/overview#requirements).
11The server needs x64 Linux on a glibc-based distribution (arm64 and musl-based distributions such as Alpine aren't supported), about 10 GB of free disk space, and the system packages below. Your Claude account needs a Pro, Max, Team, or Enterprise plan; see [Requirements](/docs/claude-science/overview.md#requirements).
1212
1313## Install dependencies
1414
1515Claude runs code inside a sandbox, and the sandbox needs two system packages: bubblewrap and socat. Installing them takes administrator (`sudo`) access. Without it, see [Run Claude Science without administrator access](#run-claude-science-without-administrator-access).
1616
17On Fedora, RHEL, or Arch, use the command for your distribution from the Linux tab of [Install](/docs/claude-science/get-started#install). On Ubuntu or Debian, run:
17On Fedora, RHEL, or Arch, use the command for your distribution from the Linux tab of [Install](/docs/claude-science/get-started.md#install). On Ubuntu or Debian, run:
1818
1919```bash theme={null}
2020sudo apt-get update && sudo apt-get install -y curl bubblewrap socat
from line 29
2929If you don't have administrator (root or `sudo`) access to a shared server or cluster, choose one of these:
3030
3131* **Ask the server's administrator** to set up what the sandbox needs: bubblewrap 0.8.0 or later, socat, and a kernel that allows unprivileged user namespaces.
32* **Use the server as an SSH host.** Install Claude Science on your own computer and add the server as an SSH host (see [Remote compute clusters](/docs/claude-science/remote-compute-clusters)), if your organization allows SSH hosts. Claude runs jobs on the server under your own account, with your approval. Jobs run outside the sandbox, so the server doesn't need bubblewrap, socat, or the kernel setting, and you don't need administrator access there.
32* **Use the server as an SSH host.** Install Claude Science on your own computer and add the server as an SSH host (see [Remote compute clusters](/docs/claude-science/remote-compute-clusters.md)), if your organization allows SSH hosts. Claude runs jobs on the server under your own account, with your approval. Jobs run outside the sandbox, so the server doesn't need bubblewrap, socat, or the kernel setting, and you don't need administrator access there.
3333
3434Administrators usually install bubblewrap and socat, and only an administrator can change the kernel setting. On Ubuntu 23.10 and later, bubblewrap can also need an AppArmor profile that lets it create user namespaces. Claude Science checks for these when it starts and names the first one that's missing. Once that's fixed, the next start names the next one, if any.
3535
from line 85
8585
8686Open the printed link in your computer's browser. The link is single-use and expires about three minutes after it's printed; run `claude-science url` on the server to print a fresh one at any time. Restarting with `claude-science stop` then `claude-science serve --no-browser` also prints a fresh link.
8787
88Sign in with your Claude account. If the sign-in redirect can't find its way back through the tunnel, choose **Paste code instead** on the sign-in screen. Then complete the setup wizard as described in [Get started](/docs/claude-science/get-started).
88Sign in with your Claude account. If the sign-in redirect can't find its way back through the tunnel, choose **Paste code instead** on the sign-in screen. Then complete the setup wizard as described in [Get started](/docs/claude-science/get-started.md).
8989
9090## Keep it up to date
9191
92`claude-science update` checks for and installs updates. See [Command line settings](/docs/claude-science/command-line-settings) for the command reference, including `logs` and the `serve` flags.
92`claude-science update` checks for and installs updates. See [Command line settings](/docs/claude-science/command-line-settings.md) for the command reference, including `logs` and the `serve` flags.
9393
9494## Troubleshooting
9595
from line 107
107107| A message mentioning `port 8000 is in use by another app — using port 8001 instead` | Claude Science started on the port it names. `claude-science url` prints both ports. Forward each one with that number on both sides. Or stop Claude Science and start it again with `--port`. |
108108| A message mentioning `daemon already running on port 8000` | Claude Science is already running. Run `claude-science url` for a fresh sign-in link, or `claude-science stop` to stop it. |
109109| The sign-in link shows an expired-link page | Links are single-use and valid for about three minutes. Run `claude-science url` on the server and open the fresh link; restarting with `claude-science stop` then `claude-science serve --no-browser` also prints one. |
110| Sign-in stops at claude.ai | The redirect couldn't return through the tunnel (choose **Paste code instead**), your account is on the Free plan (an upgrade is required), or your Team or Enterprise organization hasn't [enabled Claude Science](/docs/claude-science/enable-claude-science) yet. |
110| Sign-in stops at claude.ai | The redirect couldn't return through the tunnel (choose **Paste code instead**), your account is on the Free plan (an upgrade is required), or your Team or Enterprise organization hasn't [enabled Claude Science](/docs/claude-science/enable-claude-science.md) yet. |
111111| Interactive HTML previews render as static snapshots after a short delay (charts don't respond) | The tunnel isn't forwarding the preview port. Add the second `-L` forward for the preview port that `claude-science url` prints (8001 by default), with that number on both sides. |
112112| The browser can't reach `localhost:8000` | The tunnel isn't up; rerun the `ssh -L` command. If the tunnel is up, confirm Claude Science is running on the server with `claude-science status`. |
113113| The installer reports no binary for your platform | Claude Science on Linux needs x64 with glibc. arm64 servers and musl-based distributions such as Alpine aren't supported. |
114| The installer stops with a message mentioning `was NOT installed` | Claude Science was already installed on the server, so the installer first tried to check that the new version starts there. The check didn't succeed, so nothing was replaced. The message and the lines under it say why and, where there is a fix, what to do. If they point to the [configuration file](/docs/claude-science/configuration-file-reference), `~/.claude-science/config.toml`, fix what they report in that file, then run the installer again as shown in [Install Claude Science](#install-claude-science). Otherwise, keep using the copy you already had. |
114| The installer stops with a message mentioning `was NOT installed` | Claude Science was already installed on the server, so the installer first tried to check that the new version starts there. The check didn't succeed, so nothing was replaced. The message and the lines under it say why and, where there is a fix, what to do. If they point to the [configuration file](/docs/claude-science/configuration-file-reference.md), `~/.claude-science/config.toml`, fix what they report in that file, then run the installer again as shown in [Install Claude Science](#install-claude-science). Otherwise, keep using the copy you already had. |
115115
claude-science/tools-and-environments Changed · +3 / -3 lines
from line 23
2323* Python: pip from PyPI
2424* R: CRAN and Bioconductor
2525
26To have conda and pip download packages from an internal mirror instead, see [Point package installs at an internal mirror](/docs/claude-science/corporate-networks#point-package-installs-at-an-internal-mirror).
26To have conda and pip download packages from an internal mirror instead, see [Point package installs at an internal mirror](/docs/claude-science/corporate-networks.md#point-package-installs-at-an-internal-mirror).
2727
2828A package installed into an environment is permanent and available in every session and project using that environment. A package installed inline in a code cell (`pip install` or `install.packages()`) lasts only until the kernel restarts. To keep a package, ask Claude to install it into the environment.
2929
from line 39
3939
4040To add packages, choose one of these:
4141
42* **In a uv project, ask Claude to use a separate environment.** Have Claude set `UV_PROJECT_ENVIRONMENT` to the full path of a folder in the session's [workspace folder](/docs/claude-science/core-concepts#projects-and-sessions) and run uv as usual. The variable has to stay set for later uv commands, including `uv run` and `uv sync`. The separate environment belongs to that session, so another session starts without it. For a change every session keeps, change the environment yourself in a terminal outside Claude Science.
42* **In a uv project, ask Claude to use a separate environment.** Have Claude set `UV_PROJECT_ENVIRONMENT` to the full path of a folder in the session's [workspace folder](/docs/claude-science/core-concepts.md#projects-and-sessions) and run uv as usual. The variable has to stay set for later uv commands, including `uv run` and `uv sync`. The separate environment belongs to that session, so another session starts without it. For a change every session keeps, change the environment yourself in a terminal outside Claude Science.
4343* **With any of these tools, change the environment yourself.** In a terminal outside Claude Science, use the tool's own commands to add, update, or remove packages.
4444
4545## GPUs
from line 50
5050>
5151> Turning on the **Host GPU** switch reduces the default sandboxing configuration applied by Claude Science.
5252
53If Claude Science finds no GPU, Claude notes this when a task needs one and can run the work on the remote compute you've connected. See [Remote compute clusters](/docs/claude-science/remote-compute-clusters) and [Compute providers](/docs/claude-science/compute-providers). If your machine has an NVIDIA GPU but the **Host GPU** switch isn't in **Settings > Compute**, or Claude says there's no GPU in a session started with the switch on, see [How Claude Science detects a GPU](#how-claude-science-detects-a-gpu).
53If Claude Science finds no GPU, Claude notes this when a task needs one and can run the work on the remote compute you've connected. See [Remote compute clusters](/docs/claude-science/remote-compute-clusters.md) and [Compute providers](/docs/claude-science/compute-providers.md). If your machine has an NVIDIA GPU but the **Host GPU** switch isn't in **Settings > Compute**, or Claude says there's no GPU in a session started with the switch on, see [How Claude Science detects a GPU](#how-claude-science-detects-a-gpu).
5454
5555### How Claude Science detects a GPU
5656
claude-science/troubleshooting Changed · +10 / -10 lines
from line 4
44
55This page covers error messages that Claude Science shows while you work. Other problems have their own troubleshooting sections:
66
7* Installing and signing in for the first time: [Troubleshooting first launch](/docs/claude-science/get-started#troubleshooting-first-launch).
8* Running Claude Science on a Linux server: the troubleshooting table on [Run on a remote Linux server](/docs/claude-science/run-on-remote-linux-server#troubleshooting).
9* Proxies, TLS inspection, and package mirrors: [Troubleshooting corporate network errors](/docs/claude-science/corporate-networks#troubleshooting-corporate-network-errors).
10* A session that pauses at a usage limit: [When you reach a usage limit](/docs/claude-science/overview#when-you-reach-a-usage-limit).
7* Installing and signing in for the first time: [Troubleshooting first launch](/docs/claude-science/get-started.md#troubleshooting-first-launch).
8* Running Claude Science on a Linux server: the troubleshooting table on [Run on a remote Linux server](/docs/claude-science/run-on-remote-linux-server.md#troubleshooting).
9* Proxies, TLS inspection, and package mirrors: [Troubleshooting corporate network errors](/docs/claude-science/corporate-networks.md#troubleshooting-corporate-network-errors).
10* A session that pauses at a usage limit: [When you reach a usage limit](/docs/claude-science/overview.md#when-you-reach-a-usage-limit).
1111
1212## Sign-in and replies
1313
from line 28
2828
2929### Claude is at capacity — retrying
3030
31Claude is busy or is limiting your requests, and Claude Science is retrying. Claude Science keeps retrying on its own, and once a retry goes through, Claude's reply starts again. Select **Check service status** to see whether there's an incident. To stop waiting, select the stop button in the composer. If your plan's usage limit runs out while Claude Science is retrying, the session pauses instead, as described in [When you reach a usage limit](/docs/claude-science/overview#when-you-reach-a-usage-limit).
31Claude is busy or is limiting your requests, and Claude Science is retrying. Claude Science keeps retrying on its own, and once a retry goes through, Claude's reply starts again. Select **Check service status** to see whether there's an incident. To stop waiting, select the stop button in the composer. If your plan's usage limit runs out while Claude Science is retrying, the session pauses instead, as described in [When you reach a usage limit](/docs/claude-science/overview.md#when-you-reach-a-usage-limit).
3232
3333These other retry messages can appear in the same place:
3434
from line 47
4747
4848A notice such as "2 environments failed" means Claude Science couldn't set up one or more of the environments Claude uses to run code, and it names them. Select **Details** to see each environment's status and, for any that failed, the error.
4949
50* If setup failed because of your organization's network, the dialog that **Details** opens links to settings for a package mirror, a CA bundle, or mirror credentials. When you save any of these settings, Claude Science retries the failed setups automatically. See also [Troubleshooting corporate network errors](/docs/claude-science/corporate-networks#troubleshooting-corporate-network-errors).
50* If setup failed because of your organization's network, the dialog that **Details** opens links to settings for a package mirror, a CA bundle, or mirror credentials. When you save any of these settings, Claude Science retries the failed setups automatically. See also [Troubleshooting corporate network errors](/docs/claude-science/corporate-networks.md#troubleshooting-corporate-network-errors).
5151* To retry the environments that failed, select **Retry builds**.
5252
5353If the notice reads "Analysis is unavailable" instead, no Python or R code can run until Claude Science restarts. Fix the cause the notice names, then quit and reopen Claude Science. Closing the window or browser tab leaves Claude Science running, so quit it this way:
from line 74
7474
7575## Updates
7676
77If Claude Science asks you to update, see [Update Claude Science](/docs/claude-science/update-claude-science).
77If Claude Science asks you to update, see [Update Claude Science](/docs/claude-science/update-claude-science.md).
7878
7979Claude Science shows updates and their errors in these places:
8080
from line 83
8383
8484### cannot reach the public release endpoint
8585
86Claude Science couldn't reach the update server. Check your internet connection, then select **Restart to update** on the "Update available" notice to try again, or run `claude-science update` again. On a corporate network, see [Network requirements](/docs/claude-science/network-requirements#app-connections) for the domains Claude Science connects to.
86Claude Science couldn't reach the update server. Check your internet connection, then select **Restart to update** on the "Update available" notice to try again, or run `claude-science update` again. On a corporate network, see [Network requirements](/docs/claude-science/network-requirements.md#app-connections) for the domains Claude Science connects to.
8787
8888### restart aborted
8989
90On the "Update available" notice, this means the new version was downloaded but didn't start. On a Mac or Linux, if the message says "restart aborted" and you started Claude Science from a terminal, follow [the terminal steps](/docs/claude-science/update-claude-science#from-a-terminal-or-on-a-server). Otherwise, if Claude Science is still running, it's the version you had, and you can try again: select **Check for updates** under **Settings > General > About**, then select **Restart to update** there. On Windows, if trying again fails, leave Claude Science open and follow [the Windows steps](/docs/claude-science/update-claude-science#if-the-update-still-fails). If Claude Science has stopped, start it again.
90On the "Update available" notice, this means the new version was downloaded but didn't start. On a Mac or Linux, if the message says "restart aborted" and you started Claude Science from a terminal, follow [the terminal steps](/docs/claude-science/update-claude-science.md#from-a-terminal-or-on-a-server). Otherwise, if Claude Science is still running, it's the version you had, and you can try again: select **Check for updates** under **Settings > General > About**, then select **Restart to update** there. On Windows, if trying again fails, leave Claude Science open and follow [the Windows steps](/docs/claude-science/update-claude-science.md#if-the-update-still-fails). If Claude Science has stopped, start it again.
9191
9292On Linux, an update to version 0.1.61 ends this way on a computer where bubblewrap or socat came from conda, Homebrew, or a folder in your home directory, because version 0.1.61 needs both installed for the whole system. Version 0.1.62 withdraws that requirement, so updating again now gets a version that starts. If Claude Science won't start at all, run `claude-science update` in a terminal, then start it again.
9393
from line 103
103103* If the window says to check your internet connection, check it, then select **Try again**.
104104* If you cancelled a request from macOS for an administrator's password, select **Try again**.
105105* Otherwise, such as when it says "Updates aren't available right now", wait a few minutes, then select **Try again**.
106* On a corporate network, ask your IT team to allow `storage.googleapis.com` (see [Proxy and certificates for updates in the Mac app window](/docs/claude-science/corporate-networks#proxy-and-certificates-for-updates-in-the-mac-app-window)).
106* On a corporate network, ask your IT team to allow `storage.googleapis.com` (see [Proxy and certificates for updates in the Mac app window](/docs/claude-science/corporate-networks.md#proxy-and-certificates-for-updates-in-the-mac-app-window)).
107107
claude-tag/admins/add-connections Changed · +43 / -43 lines
from line 8
88
99> [!TIP]
1010>
11> Claude starts delivering work before you connect anything. On Slack content alone, it can [catch a team up on a channel or thread](/docs/claude-tag/users/use-cases/catch-up), [triage a request channel](/docs/claude-tag/users/use-cases/triage-requests), [turn a discussion into a doc](/docs/claude-tag/users/use-cases/create-artifacts), and [track a project from channel history](/docs/claude-tag/users/use-cases/track-projects).
11> Claude starts delivering work before you connect anything. On Slack content alone, it can [catch a team up on a channel or thread](/docs/claude-tag/users/use-cases/catch-up.md), [triage a request channel](/docs/claude-tag/users/use-cases/triage-requests.md), [turn a discussion into a doc](/docs/claude-tag/users/use-cases/create-artifacts.md), and [track a project from channel history](/docs/claude-tag/users/use-cases/track-projects.md).
1212
13A connector gives Claude its own credential for one of your tools, like a Datadog API key or a warehouse service account, so Claude can act in that tool from Slack channels. This page is for the admins who add connectors and decide where they apply. To let Claude act as a member with that member's own claude.ai connectors, see [Personal connectors](/docs/claude-tag/concepts/personal-connectors) instead.
13A connector gives Claude its own credential for one of your tools, like a Datadog API key or a warehouse service account, so Claude can act in that tool from Slack channels. This page is for the admins who add connectors and decide where they apply. To let Claude act as a member with that member's own claude.ai connectors, see [Personal connectors](/docs/claude-tag/concepts/personal-connectors.md) instead.
1414
15Adding connectors and bundles requires the **Owner** role or the [**Claude Tag Admin** permission](/docs/claude-tag/admins/restrict-access#delegate-claude-tag-administration) in your Claude organization. You manage both in [**Organization settings > Claude Tag**](https://claude.ai/admin-settings/claude-tag), under **Claude's access**, which appears once the **Enable Claude Tag in Slack** switch is on.
15Adding connectors and bundles requires the **Owner** role or the [**Claude Tag Admin** permission](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) in your Claude organization. You manage both in [**Organization settings > Claude Tag**](https://claude.ai/admin-settings/claude-tag), under **Claude's access**, which appears once the **Enable Claude Tag in Slack** switch is on.
1616
17Connectors belong to the [agent identity](/docs/claude-tag/concepts/agent-identity), not to any person. Personal claude.ai connectors apply in one-to-one DMs. Claude can also [use a member's own connectors in a channel](/docs/claude-tag/concepts/personal-connectors) for that member's own tasks, after the member allows it.
17Connectors belong to the [agent identity](/docs/claude-tag/concepts/agent-identity.md), not to any person. Personal claude.ai connectors apply in one-to-one DMs. Claude can also [use a member's own connectors in a channel](/docs/claude-tag/concepts/personal-connectors.md) for that member's own tasks, after the member allows it.
1818
1919## Decide what to connect
2020
from line 24
2424
2525| Connect | Examples | Recommended access | What it adds |
2626| :- | :- | :- | :- |
27| Knowledge and docs | Google Drive, [Notion](/docs/claude-tag/admins/connections/notion), [Confluence](/docs/claude-tag/admins/connections/atlassian) | Read | Answers grounded in design docs, runbooks, and prior decisions |
28| Code | GitHub, [GitLab](/docs/claude-tag/admins/connections/gitlab) | Read and write | On GitHub, branches, pull requests, review, and CI follow-up through the [Claude GitHub App](/docs/claude-tag/admins/configure-github). On GitLab, issues, merge request comments, and pipeline checks through its API |
29| Data warehouse | BigQuery, [Snowflake](/docs/claude-tag/admins/connections/snowflake), Redshift | Read | Data questions answered with charts in the thread; recurring reports |
30| Monitoring | [Sentry](/docs/claude-tag/admins/connections/sentry), [Datadog](/docs/claude-tag/admins/connections/datadog), [PagerDuty](/docs/claude-tag/admins/connections/pagerduty) | Read | Logs, metrics, and errors for debugging and incident work |
31| Issue tracking | [Linear](/docs/claude-tag/admins/connections/linear), [Asana](/docs/claude-tag/admins/connections/asana), [Jira](/docs/claude-tag/admins/connections/atlassian) | Read and write | File tickets and post status updates where work lives |
32| Go-to-market | [HubSpot](/docs/claude-tag/admins/connections/hubspot), [Gong](/docs/claude-tag/admins/connections/gong), [Salesforce](/docs/claude-tag/admins/connections/salesforce) | Read | Pipeline and customer state for account questions |
27| Knowledge and docs | Google Drive, [Notion](/docs/claude-tag/admins/connections/notion.md), [Confluence](/docs/claude-tag/admins/connections/atlassian.md) | Read | Answers grounded in design docs, runbooks, and prior decisions |
28| Code | GitHub, [GitLab](/docs/claude-tag/admins/connections/gitlab.md) | Read and write | On GitHub, branches, pull requests, review, and CI follow-up through the [Claude GitHub App](/docs/claude-tag/admins/configure-github.md). On GitLab, issues, merge request comments, and pipeline checks through its API |
29| Data warehouse | BigQuery, [Snowflake](/docs/claude-tag/admins/connections/snowflake.md), Redshift | Read | Data questions answered with charts in the thread; recurring reports |
30| Monitoring | [Sentry](/docs/claude-tag/admins/connections/sentry.md), [Datadog](/docs/claude-tag/admins/connections/datadog.md), [PagerDuty](/docs/claude-tag/admins/connections/pagerduty.md) | Read | Logs, metrics, and errors for debugging and incident work |
31| Issue tracking | [Linear](/docs/claude-tag/admins/connections/linear.md), [Asana](/docs/claude-tag/admins/connections/asana.md), [Jira](/docs/claude-tag/admins/connections/atlassian.md) | Read and write | File tickets and post status updates where work lives |
32| Go-to-market | [HubSpot](/docs/claude-tag/admins/connections/hubspot.md), [Gong](/docs/claude-tag/admins/connections/gong.md), [Salesforce](/docs/claude-tag/admins/connections/salesforce.md) | Read | Pipeline and customer state for account questions |
3333
3434Per-service instructions, with the credential fields and allowed-websites values, are in the [connection guides](/docs/claude-tag/admins/connections/overview).
3535
from line 61
6161A connector has no setting for which pages, folders, or projects Claude can reach inside a tool. The connector's reach is whatever the connected account can access in that tool. To narrow Claude to a subset, narrow the account:
6262
6363* **Confluence or another wiki:** give the service account read access to only the spaces or pages Claude should see
64* **Google Drive:** share only the relevant folders with the dedicated Google account; see [Google Workspace](/docs/claude-tag/admins/connections/google)
64* **Google Drive:** share only the relevant folders with the dedicated Google account; see [Google Workspace](/docs/claude-tag/admins/connections/google.md)
6565* **Project or ticket trackers:** add the service account to only the projects it needs
6666
6767The host, path, and method restrictions on a credential control which API endpoints Claude can call, not which records those endpoints return. Use them alongside account-level scoping, not instead of it.
from line 84
8484
8585**2. Pick the service**
8686
87In the **Add a connector** dialog, search for the service and select it. A service Claude already holds a credential for shows **Connected**. For GitHub, see [Configure GitHub access](/docs/claude-tag/admins/configure-github). For a service that isn't listed, select **Custom connector** at the bottom of the list; see [Connect a service that isn't in the list](#connect-a-service-that-isn%E2%80%99t-in-the-list).
87In the **Add a connector** dialog, search for the service and select it. A service Claude already holds a credential for shows **Connected**. For GitHub, see [Configure GitHub access](/docs/claude-tag/admins/configure-github.md). For a service that isn't listed, select **Custom connector** at the bottom of the list; see [Connect a service that isn't in the list](#connect-a-service-that-isn%E2%80%99t-in-the-list).
8888
8989For a service that offers a sign-in as well as a key, such as Amplitude, the dialog then shows **How Claude authenticates**. Leave **Paste an API key** selected, or select the sign-in option, such as **Sign in to Amplitude as Claude**, and click **Continue to** *service*.
9090
from line 147
147147
148148### Claude Tag connectors vs personal claude.ai connectors
149149
150The **Add a connector** dialog lists services Claude can hold its own credential for, not the connectors your organization or its members have set up on claude.ai. A Claude Tag connector authenticates the agent, not a person; a connector on someone's personal claude.ai account doesn't appear there. For Google services, use a service-account key or sign in with an account made for Claude, both of which give the agent one credential with access to the data the channel needs. Personal connectors keep working in [DMs](/docs/claude-tag/concepts/agent-identity#direct-message-channels).
150The **Add a connector** dialog lists services Claude can hold its own credential for, not the connectors your organization or its members have set up on claude.ai. A Claude Tag connector authenticates the agent, not a person; a connector on someone's personal claude.ai account doesn't appear there. For Google services, use a service-account key or sign in with an account made for Claude, both of which give the agent one credential with access to the data the channel needs. Personal connectors keep working in [DMs](/docs/claude-tag/concepts/agent-identity.md#direct-message-channels).
151151
152152## Change an existing connector
153153
from line 208
208208
209209## Create a bundle
210210
211A [bundle](/docs/claude-tag/concepts/glossary#access-bundle) is a named set of connectors, repositories, domain entries, plugins, and instructions that Claude takes on wherever the bundle applies. Use one to give a group of channels the same access, and to add a connector to only some channels from the start.
211A [bundle](/docs/claude-tag/concepts/glossary.md#access-bundle) is a named set of connectors, repositories, domain entries, plugins, and instructions that Claude takes on wherever the bundle applies. Use one to give a group of channels the same access, and to add a connector to only some channels from the start.
212212
213213**1. Create the bundle**
214214
from line 222
222222
223223Under **Where it applies**, turn on the switch in the **Slack** row to apply the bundle in every workspace and channel, or in a workspace's row to apply it in that workspace. For a channel, click **Add place**, choose the channel under **Where**, and click **Add**. Then click **Save changes**. A bundle applies nowhere until you turn on a row or add a place.
224224
225To add an existing bundle from a workspace or channel instead, open that place's page from the **Channels** tab, click **Add** under **Claude's access**, and select **Bundle**. [Attach bundles to workspaces and channels](/docs/claude-tag/admins/attach-to-scope) covers channel rules and how bundles combine.
225To add an existing bundle from a workspace or channel instead, open that place's page from the **Channels** tab, click **Add** under **Claude's access**, and select **Bundle**. [Attach bundles to workspaces and channels](/docs/claude-tag/admins/attach-to-scope.md) covers channel rules and how bundles combine.
226226
227227Name a bundle after what it grants, since the name is what you'll read when deciding which bundles to add to a channel: `data-readonly`, `github-write`, `monitoring`, `gtm-tools`. A capability name stays meaningful when the same bundle serves several teams; a team name (`devprod-team`) works when one team's full access is the unit you'll reuse.
228228
229Use the bundle's **Instructions** section for guidance that should travel with its connectors; use [workspace or channel instructions](/docs/claude-tag/admins/attach-to-scope#add-custom-instructions) for guidance tied to a place.
229Use the bundle's **Instructions** section for guidance that should travel with its connectors; use [workspace or channel instructions](/docs/claude-tag/admins/attach-to-scope.md#add-custom-instructions) for guidance tied to a place.
230230
231231### Why create more than one bundle
232232
from line 234
234234
235235## Connect a service that isn't in the list
236236
237The **Add a connector** list covers common services, not the full set Claude can connect to. Any app with an API can be connected. In the **Add a connector** dialog, select **Custom connector** at the bottom of the list. See the [custom connector guide](/docs/claude-tag/admins/connections/custom) for the form fields, credential types, and how to add a custom MCP server.
237The **Add a connector** list covers common services, not the full set Claude can connect to. Any app with an API can be connected. In the **Add a connector** dialog, select **Custom connector** at the bottom of the list. See the [custom connector guide](/docs/claude-tag/admins/connections/custom.md) for the form fields, credential types, and how to add a custom MCP server.
238238
239239For a custom connector, choose the **Credential type** that matches how the service authenticates:
240240
from line 244
244244| Basic | HTTP Basic authentication. |
245245| Body parameter | A token the API expects in the request body or query string instead of a header. |
246246| AWS SigV4 | Signed requests to AWS service endpoints with an access key pair. |
247| GCP access token (with Service Account Key) | Google Cloud APIs via a service-account JSON key. Google Workspace services like Drive and Calendar also use this; see [the Google guide](/docs/claude-tag/admins/connections/google). |
247| GCP access token (with Service Account Key) | Google Cloud APIs via a service-account JSON key. Google Workspace services like Drive and Calendar also use this; see [the Google guide](/docs/claude-tag/admins/connections/google.md). |
248248| GCP IAP (with Service Account Key) | Google Cloud services behind Identity-Aware Proxy. |
249249| OAuth 2.0 JWT bearer | Server-to-server OAuth. |
250250| OAuth 2.0 client credentials | Server-to-server OAuth. Salesforce uses this. |
251| MCP Connector | Sign in once as an admin; the agent acts as that account. The picker offers a fixed set of providers plus the [remote MCP connectors](/docs/connectors/custom/add-unlisted) your organization has added on claude.ai. Other OAuth APIs can't be connected this way. |
251| MCP Connector | Sign in once as an admin; the agent acts as that account. The picker offers a fixed set of providers plus the [remote MCP connectors](/docs/connectors/custom/add-unlisted.md) your organization has added on claude.ai. Other OAuth APIs can't be connected this way. |
252252
253For GitHub repositories, use the Claude GitHub App at [Configure GitHub access](/docs/claude-tag/admins/configure-github) rather than a credential from this table.
253For GitHub repositories, use the Claude GitHub App at [Configure GitHub access](/docs/claude-tag/admins/configure-github.md) rather than a credential from this table.
254254
255Credentials are injected at the network boundary by Agent Proxy; the model and the sandbox are not given the key. A request to a host you haven't allowed is blocked, not sent. See [how Agent Proxy works](/docs/claude-tag/concepts/agent-identity#agent-proxy).
255Credentials are injected at the network boundary by Agent Proxy; the model and the sandbox are not given the key. A request to a host you haven't allowed is blocked, not sent. See [how Agent Proxy works](/docs/claude-tag/concepts/agent-identity.md#agent-proxy).
256256
257You can also add connectors from a channel's [Configure page](/docs/claude-tag/users/good-habits#configure-claude-for-a-channel). The option to add one appears there only for people who can manage Claude's setup for that channel or for the whole organization. [Channel managers](/docs/claude-tag/admins/restrict-access#delegate-channel-setup-to-channel-managers) can manage setup for their assigned channels. Other channel members see the channel's connectors on the Configure page but can't add one.
257You can also add connectors from a channel's [Configure page](/docs/claude-tag/users/good-habits.md#configure-claude-for-a-channel). The option to add one appears there only for people who can manage Claude's setup for that channel or for the whole organization. [Channel managers](/docs/claude-tag/admins/restrict-access.md#delegate-channel-setup-to-channel-managers) can manage setup for their assigned channels. Other channel members see the channel's connectors on the Configure page but can't add one.
258258
259259## Allow a host without a credential
260260
261Claude does channel work in an isolated [sandbox](/docs/claude-tag/concepts/agent-identity#channel-sessions). A network request is traffic that sandbox sends to a host, such as an API call, a `curl` fetch, or a package install. Before Claude can make one from a channel, the destination host has to be allowed by one of three settings, the allow layers:
261Claude does channel work in an isolated [sandbox](/docs/claude-tag/concepts/agent-identity.md#channel-sessions). A network request is traffic that sandbox sends to a host, such as an API call, a `curl` fetch, or a package install. Before Claude can make one from a channel, the destination host has to be allowed by one of three settings, the allow layers:
262262
263263* **A domain entry**: a hostname added to a bundle that applies to the channel. Requests to it pass with no credential attached; see [Add a domain](#add-a-domain).
264264* **A [connector](#add-a-connector)**: a credential that applies to the channel. Requests matching its [allowed websites](#set-allowed-websites) pass with that credential attached.
265* **The channel's [environment](/docs/claude-tag/concepts/glossary#environment)**: the compute configuration the channel's sessions run in, which carries its own network access setting, starting at the Trusted access level that covers common package registries. Requests to hosts it allows pass with no credential; see [Broad web access through the environment](#broad-web-access-through-the-environment).
265* **The channel's [environment](/docs/claude-tag/concepts/glossary.md#environment)**: the compute configuration the channel's sessions run in, which carries its own network access setting, starting at the Trusted access level that covers common package registries. Requests to hosts it allows pass with no credential; see [Broad web access through the environment](#broad-web-access-through-the-environment).
266266
267267A host that none of these allows stays unreachable, and when more than one bundle applies to a channel, the entries of all of them apply. Web search is governed by none of them, because searching happens on Anthropic's servers rather than in the sandbox; see [Web search vs. network requests](#web-search-vs-network-requests).
268268
from line 280
280280
281281You don't have to predict the full list up front. When a request is blocked, Claude says so in the thread and names the host, with wording like "blocked by the network egress proxy" (that is, by Agent Proxy); add that host here and retry. If the host is listed and Claude still reports it blocked, check these in order:
282282
283* **The bundle applies to the channel.** The bundle's **Where it applies** list must include the channel, its workspace, a channel group that matches it, or **Slack**; see [Attach bundles to workspaces and channels](/docs/claude-tag/admins/attach-to-scope).
283* **The bundle applies to the channel.** The bundle's **Where it applies** list must include the channel, its workspace, a channel group that matches it, or **Slack**; see [Attach bundles to workspaces and channels](/docs/claude-tag/admins/attach-to-scope.md).
284284* **The entry matches the exact host.** A wildcard like `*.example.com` doesn't cover `example.com` itself, and `www.example.com` and `example.com` are different hosts.
285285* **The request didn't move to another host.** If the page redirects, or loads from a CDN or a sign-in host, allow that host too; Claude names the host it was blocked on.
286286* **The port is listed.** Needed only when the service listens on something other than 443.
from line 293
293293
294294> [!NOTE]
295295>
296> [Agent Proxy](/docs/claude-tag/concepts/agent-identity#agent-proxy) carries only HTTP and HTTPS. A protocol that isn't HTTP, such as SSH, can't cross the proxy, so a domain entry doesn't make a host reachable over SSH.
296> [Agent Proxy](/docs/claude-tag/concepts/agent-identity.md#agent-proxy) carries only HTTP and HTTPS. A protocol that isn't HTTP, such as SSH, can't cross the proxy, so a domain entry doesn't make a host reachable over SSH.
297297
298298### Broad web access through the environment
299299
300Domain entries allow hosts one at a time. For a channel whose work needs more of the web, the environment setting grants broader access. An [environment](/docs/claude-tag/concepts/glossary#environment) is the sandboxed compute configuration the channel's sessions run in, and it carries its own network access setting.
300Domain entries allow hosts one at a time. For a channel whose work needs more of the web, the environment setting grants broader access. An [environment](/docs/claude-tag/concepts/glossary.md#environment) is the sandboxed compute configuration the channel's sessions run in, and it carries its own network access setting.
301301
302302A new environment's network access level is Trusted access, which allows a [documented set of package registries and developer hosts](https://code.claude.com/docs/en/cloud-environments#default-allowed-domains). A channel can already reach hosts like `pypi.org` and `registry.npmjs.org` with no domain entry.
303303
304To give a workspace or channel broader access, create an organization-shared environment with a more permissive level and set it on that place's page, under **Advanced > Sessions > Environment**, as described in [Configure the environment for a scope](/docs/claude-tag/admins/customize#configure-the-environment-for-a-scope). **Full access** allows any domain; see [Network access in the Claude Code docs](https://code.claude.com/docs/en/cloud-environments#network-access) for the other levels.
304To give a workspace or channel broader access, create an organization-shared environment with a more permissive level and set it on that place's page, under **Advanced > Sessions > Environment**, as described in [Configure the environment for a scope](/docs/claude-tag/admins/customize.md#configure-the-environment-for-a-scope). **Full access** allows any domain; see [Network access in the Claude Code docs](https://code.claude.com/docs/en/cloud-environments#network-access) for the other levels.
305305
306306### Allow all hosts
307307
from line 319
319319
320320Opening a page is not part of the search. A search returns content from the pages it matches, which Claude reads and cites; fetching a URL from the sandbox is a network request, and the host needs an allow layer. Claude can answer from a page that search surfaced yet report that it can't open the same link.
321321
322If the work needs Claude to open and read pages rather than answer from search results, allow those hosts through the settings above. [Web search vs. network requests](/docs/claude-tag/concepts/agent-identity#web-search-vs-network-requests) covers the session mechanics behind the split.
322If the work needs Claude to open and read pages rather than answer from search results, allow those hosts through the settings above. [Web search vs. network requests](/docs/claude-tag/concepts/agent-identity.md#web-search-vs-network-requests) covers the session mechanics behind the split.
323323
324324## Attach plugins
325325
from line 333
333333* **Wherever a bundle applies**: on the bundle's page, under **What's in it**, click **Add** and choose **Plugin**.
334334* **One workspace or channel**: on that place's page, under **Claude's access**, click **Add** and select **Plugin** or **Skill**, then pick the plugin or skill in the dialog and click **Add**. The dialog lists only the plugins and skills already on the **Skills and plugins** tab. For one that isn't on the tab yet, add it there and then limit it under **Assign access** on its page, or add a plugin to a bundle that applies to the place.
335335* **Along with a connector**: when a connect form shows a checkbox to include the service's plugin, leave it selected to add that plugin with the credential.
336* **By a channel member**: a member can ask Claude to add a plugin available to your organization, in the channel or from the channel's [Configure page](/docs/claude-tag/users/good-habits#configure-claude-for-a-channel), unless **Channel member edits** is set to **Block**; see [Restrict who can set channel instructions](/docs/claude-tag/admins/attach-to-scope#restrict-who-can-set-channel-instructions). Claude proposes the change and adds the plugin only after someone in that channel selects **Confirm**.
336* **By a channel member**: a member can ask Claude to add a plugin available to your organization, in the channel or from the channel's [Configure page](/docs/claude-tag/users/good-habits.md#configure-claude-for-a-channel), unless **Channel member edits** is set to **Block**; see [Restrict who can set channel instructions](/docs/claude-tag/admins/attach-to-scope.md#restrict-who-can-set-channel-instructions). Claude proposes the change and adds the plugin only after someone in that channel selects **Confirm**.
337337
338Anthropic provides plugins for common tools and processes, and you can add your own from a [skills repository](/docs/claude-tag/admins/skills-repo). To give Claude organization-wide skills, package them as a plugin. Adding a plugin to your organization's library on claude.ai makes it available to Claude, not active; it takes effect only where you add it in one of the ways above.
338Anthropic provides plugins for common tools and processes, and you can add your own from a [skills repository](/docs/claude-tag/admins/skills-repo.md). To give Claude organization-wide skills, package them as a plugin. Adding a plugin to your organization's library on claude.ai makes it available to Claude, not active; it takes effect only where you add it in one of the ways above.
339339
340Adding or removing plugins and skills applies to new threads only. A thread already running keeps the set it began with; start a fresh thread to pick up changes. See [What survives between replies](/docs/claude-tag/concepts/how-it-works#what-survives-between-replies).
340Adding or removing plugins and skills applies to new threads only. A thread already running keeps the set it began with; start a fresh thread to pick up changes. See [What survives between replies](/docs/claude-tag/concepts/how-it-works.md#what-survives-between-replies).
341341
342342Claude can't publish a new skill version from inside a thread; that update happens in admin settings.
343343
from line 357
357357
358358## Related resources
359359
360* [Set a spend limit](/docs/claude-tag/admins/set-spend-limit): fund usage so the connectors you just added can run
361* [Configure GitHub access](/docs/claude-tag/admins/configure-github): repository access, managed through the Claude GitHub App
362* [How agent identity works](/docs/claude-tag/concepts/agent-identity#agent-proxy): how the credentials you just added reach Claude without entering its sandbox
360* [Set a spend limit](/docs/claude-tag/admins/set-spend-limit.md): fund usage so the connectors you just added can run
361* [Configure GitHub access](/docs/claude-tag/admins/configure-github.md): repository access, managed through the Claude GitHub App
362* [How agent identity works](/docs/claude-tag/concepts/agent-identity.md#agent-proxy): how the credentials you just added reach Claude without entering its sandbox
363363
claude-tag/admins/attach-to-scope Changed · +29 / -29 lines
from line 8
88
99A bundle applies at one of three levels, called scopes, and each has its own page on the **Channels** tab under **Claude's access** at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag). The **Slack** page covers every connected workspace and channel, a workspace's page covers the channels in that workspace, and a channel's page covers one channel. Bundles inherit downward through those scopes, and when credentials overlap, Claude uses the one from the narrowest scope.
1010
11An Owner in your Claude organization, or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access#delegate-claude-tag-administration), can choose where a bundle applies. Attaching a bundle to channels by name needs an Owner.
11An Owner in your Claude organization, or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration), can choose where a bundle applies. Attaching a bundle to channels by name needs an Owner.
1212
13This page assumes you have already [paired a workspace](/docs/claude-tag/admins/setup-overview#pair-your-slack-workspace) and [created a bundle](/docs/claude-tag/admins/add-connections).
13This page assumes you have already [paired a workspace](/docs/claude-tag/admins/setup-overview#pair-your-slack-workspace) and [created a bundle](/docs/claude-tag/admins/add-connections.md).
1414
1515## How scopes inherit
1616
from line 26
2626
2727The same stacking applies in reverse. Removing a bundle from a channel removes only that channel's additions, and bundles on the workspace or on **Slack** still apply there.
2828
29Memory is also scoped, but differently: there is no organization-wide memory, each channel keeps its own notes, workspace notes saved from public channels are read across the workspace, and a private channel reads the workspace notes but writes only to its own store. See [What Claude Tag remembers](/docs/claude-tag/users/memory).
29Memory is also scoped, but differently: there is no organization-wide memory, each channel keeps its own notes, workspace notes saved from public channels are read across the workspace, and a private channel reads the workspace notes but writes only to its own store. See [What Claude Tag remembers](/docs/claude-tag/users/memory.md).
3030
31One-to-one DMs from members who have connected a Claude account run under the member's own claude.ai account. See [how DMs work in this model](/docs/claude-tag/concepts/agent-identity#direct-message-channels). A [DM from a member who hasn't connected a Claude account](/docs/claude-tag/admins/restrict-access#access-in-a-direct-message-from-a-member-without-a-claude-account) reaches bundles. A [group DM](/docs/claude-tag/admins/restrict-access#group-dms) gets the bundles on the workspace's page and on the **Slack** page.
31One-to-one DMs from members who have connected a Claude account run under the member's own claude.ai account. See [how DMs work in this model](/docs/claude-tag/concepts/agent-identity.md#direct-message-channels). A [DM from a member who hasn't connected a Claude account](/docs/claude-tag/admins/restrict-access.md#access-in-a-direct-message-from-a-member-without-a-claude-account) reaches bundles. A [group DM](/docs/claude-tag/admins/restrict-access.md#group-dms) gets the bundles on the workspace's page and on the **Slack** page.
3232
3333## Choose where a bundle applies
3434
from line 39
3939
4040To stop a bundle applying somewhere, open the bundle's page and turn off that place's switch under **Where it applies**. For a workspace or channel, you can instead choose **Remove from bundle** from its row menu. Then select **Save changes**. A workspace's or channel's page lists the bundles that reach it, and each links to the bundle's page, but the page itself doesn't remove them.
4141
42The change takes full effect in new threads only. A thread already running keeps the skills, plugins, and custom instructions it started with. A connector added after a thread started still works there if you ask Claude to use the service by name. Test with a new top-level thread after changing where a bundle applies. See [What survives between replies](/docs/claude-tag/concepts/how-it-works#what-survives-between-replies).
42The change takes full effect in new threads only. A thread already running keeps the skills, plugins, and custom instructions it started with. A connector added after a thread started still works there if you ask Claude to use the service by name. Test with a new top-level thread after changing where a bundle applies. See [What survives between replies](/docs/claude-tag/concepts/how-it-works.md#what-survives-between-replies).
4343
4444At the channel's top level, outside any thread, Claude works from a single long-lived channel session. After a configuration change, Claude replaces that session on the next channel message, so top-level replies pick up the change from then on.
4545
from line 55
5555
5656Sharing a channel changes which bundles apply there:
5757
58* **Shared across workspaces in your Enterprise Grid**: bundles on the channel or its workspace don't apply. See [Channels shared across workspaces in your Enterprise Grid](/docs/claude-tag/admins/restrict-access#channels-shared-across-workspaces-in-your-enterprise-grid) for what Claude does there instead.
59* **Shared with another company through Slack Connect**: once Claude is [turned on in the channel](/docs/claude-tag/admins/restrict-access#slack-connect-channels), bundles attached directly to the channel apply there, including ones you attached before the channel was shared. Claude can use their connectors for the other company's people in the channel too. [What access Claude has in a Slack Connect channel](/docs/claude-tag/admins/restrict-access#what-access-claude-has-in-a-slack-connect-channel) covers which bundles reach that channel and which don't.
58* **Shared across workspaces in your Enterprise Grid**: bundles on the channel or its workspace don't apply. See [Channels shared across workspaces in your Enterprise Grid](/docs/claude-tag/admins/restrict-access.md#channels-shared-across-workspaces-in-your-enterprise-grid) for what Claude does there instead.
59* **Shared with another company through Slack Connect**: once Claude is [turned on in the channel](/docs/claude-tag/admins/restrict-access.md#slack-connect-channels), bundles attached directly to the channel apply there, including ones you attached before the channel was shared. Claude can use their connectors for the other company's people in the channel too. [What access Claude has in a Slack Connect channel](/docs/claude-tag/admins/restrict-access.md#what-access-claude-has-in-a-slack-connect-channel) covers which bundles reach that channel and which don't.
6060
6161> [!WARNING]
6262>
from line 78
7878* **The Auto-join channels table**: on the **Advanced** tab of the **Slack** page or of a workspace's page, find **Auto-join channels** under **Channels**. Each row is one channel-name pattern. Select **Add bundle** on the pattern's row and pick the bundle. If the pattern isn't listed yet, add it with **Add pattern** first.
7979* **The bundle's page**: under **Where it applies**, select **Add place** and type a pattern, such as `inc-*`, under **Where**. Select the **Create channel group** option for that pattern, choose the workspace under **Applies to** if you have more than one, and select **Add**. The rule saves at once and covers that one workspace.
8080
81Whichever way you add it, the pattern is also an [auto-join pattern](/docs/claude-tag/admins/restrict-access#block-or-auto-join-channels-by-name), so Claude starts joining matching public channels when they're created or renamed. After adding or changing a rule, test with a new thread in a matching channel.
81Whichever way you add it, the pattern is also an [auto-join pattern](/docs/claude-tag/admins/restrict-access.md#block-or-auto-join-channels-by-name), so Claude starts joining matching public channels when they're created or renamed. After adding or changing a rule, test with a new thread in a matching channel.
8282
8383For example, if your incident channel names start with `inc-`, add a channel rule for `inc-*` with your incident-response bundle. Claude then joins each new public incident channel and has the bundle's access there.
8484
from line 89
8989* **Workspaces**: a rule for all workspaces, or on the **Slack** page, covers matching channels in every connected workspace. A rule on one workspace covers only that workspace's matching channels.
9090* **Channels Claude is already in**: the rule grants the bundle in every matching channel Claude is in under the scope, including channels it was invited to before the rule existed
9191* **Joining channels**: only the auto-join patterns, or an invite, add Claude to a channel. The rule itself doesn't.
92* **Blocked patterns**: a channel whose name matches a [blocked pattern](/docs/claude-tag/admins/restrict-access#block-or-auto-join-channels-by-name) stays off-limits even when a rule matches it
92* **Blocked patterns**: a channel whose name matches a [blocked pattern](/docs/claude-tag/admins/restrict-access.md#block-or-auto-join-channels-by-name) stays off-limits even when a rule matches it
9393
9494A rule's pattern has its own constraints:
9595
96* **Pattern syntax**: a rule's pattern follows the same syntax as the other [channel name patterns](/docs/claude-tag/admins/restrict-access#block-or-auto-join-channels-by-name), lowercase with `*` matching any run of characters and `?` matching exactly one
96* **Pattern syntax**: a rule's pattern follows the same syntax as the other [channel name patterns](/docs/claude-tag/admins/restrict-access.md#block-or-auto-join-channels-by-name), lowercase with `*` matching any run of characters and `?` matching exactly one
9797* **Number of rules**: each scope holds up to 50 channel rules, and a rule with more than one bundle counts once for each bundle
9898* **Organization patterns**: on a workspace's page, the **Auto-join channels** table also lists the organization's patterns, marked **Org-wide**. You can attach a bundle to an **Org-wide** pattern from the workspace's table, and that rule covers only the workspace's matching channels. You edit the pattern itself on the **Slack** page.
9999
100100> [!WARNING]
101101>
102> A channel rule grants its bundle in every matching channel Claude is in, now or in the future, and anyone who can rename a channel can move it into or out of a pattern. Keep elevated credentials out of broad patterns, and add a [blocked channel pattern](/docs/claude-tag/admins/restrict-access#block-or-auto-join-channels-by-name) for name shapes that should never carry access; a blocked channel stays off-limits whatever rules match it.
102> A channel rule grants its bundle in every matching channel Claude is in, now or in the future, and anyone who can rename a channel can move it into or out of a pattern. Keep elevated credentials out of broad patterns, and add a [blocked channel pattern](/docs/claude-tag/admins/restrict-access.md#block-or-auto-join-channels-by-name) for name shapes that should never carry access; a blocked channel stays off-limits whatever rules match it.
103103
104104### Where rule-attached bundles appear
105105
from line 109
109109
110110## Add a single connector, repository, plugin, or skill
111111
112To give a place one item without going through a bundle, open the **Slack** page or a workspace's or channel's page from the **Channels** tab, select **Add** under **Claude's access**, and choose **Connector**, **Repository**, **Plugin**, or **Skill**. The dialog opens on that kind's tab, and its **Connectors**, **Plugins**, **Skills**, and **Repositories** tabs switch between kinds. To let Claude reach a host without a credential in that place, choose **Domain** from the same menu, as [Add a domain](/docs/claude-tag/admins/add-connections#add-a-domain) describes.
112To give a place one item without going through a bundle, open the **Slack** page or a workspace's or channel's page from the **Channels** tab, select **Add** under **Claude's access**, and choose **Connector**, **Repository**, **Plugin**, or **Skill**. The dialog opens on that kind's tab, and its **Connectors**, **Plugins**, **Skills**, and **Repositories** tabs switch between kinds. To let Claude reach a host without a credential in that place, choose **Domain** from the same menu, as [Add a domain](/docs/claude-tag/admins/add-connections.md#add-a-domain) describes.
113113
114The dialog's **Connectors** tab lists the connectors already on the **Connectors** tab of **Claude's access**, and below them, under **Connect new**, services you can connect for that place; see [Add a connector](/docs/claude-tag/admins/add-connections#add-a-connection). A credential connected from a workspace's or channel's page applies only in that place, and one connected from the **Slack** page applies everywhere. The dialog's **Plugins** and **Skills** tabs list only the plugins and skills already on the **Skills and plugins** tab of **Claude's access**.
114The dialog's **Connectors** tab lists the connectors already on the **Connectors** tab of **Claude's access**, and below them, under **Connect new**, services you can connect for that place; see [Add a connector](/docs/claude-tag/admins/add-connections.md#add-a-connection). A credential connected from a workspace's or channel's page applies only in that place, and one connected from the **Slack** page applies everywhere. The dialog's **Plugins** and **Skills** tabs list only the plugins and skills already on the **Skills and plugins** tab of **Claude's access**.
115115
116116### Check or remove what a place has
117117
from line 121
121121
122122* **A plugin, skill, or domain whose row reads Added here**: use the row's menu
123123* **A connector**: the row has no menu. Select the row to open the connector's page, and change where it applies under **Assign access**.
124* **A repository**: the row has no menu. [Configure GitHub access](/docs/claude-tag/admins/configure-github) covers where a repository applies.
124* **A repository**: the row has no menu. [Configure GitHub access](/docs/claude-tag/admins/configure-github.md) covers where a repository applies.
125125
126126## Precedence when bundles overlap
127127
from line 153
153153
154154Channel members reach the same field for the channel scope through the **Configure** page, linked in the footer of any Claude reply in the channel, without going through admin settings. Both entry points write the same instructions, so a change from either place is visible in the other.
155155
156To let a central team write a channel's instructions from its own Slack channel, see [Manage a channel's instructions from another channel](/docs/claude-tag/admins/managed-by).
156To let a central team write a channel's instructions from its own Slack channel, see [Manage a channel's instructions from another channel](/docs/claude-tag/admins/managed-by.md).
157157
158158#### Instruction format
159159
160The field is plain text, inserted as written; there is no include or template syntax, and `{{include:...}}` is passed through literally. To give Claude a repository's `CLAUDE.md`, [grant the repository](/docs/claude-tag/admins/configure-github#grant-repository-access) and name it in the request; its `CLAUDE.md` loads after the clone completes.
160The field is plain text, inserted as written; there is no include or template syntax, and `{{include:...}}` is passed through literally. To give Claude a repository's `CLAUDE.md`, [grant the repository](/docs/claude-tag/admins/configure-github.md#grant-repository-access) and name it in the request; its `CLAUDE.md` loads after the clone completes.
161161
162162#### What Claude reads in a channel
163163
164What Claude reads in a channel is the concatenated custom instructions of its scope chain, the instructions of each bundle that applies there, the channel's [managed instructions](/docs/claude-tag/admins/managed-by#how-managed-instructions-load) if another channel manages it, and the `CLAUDE.md` of any repository it clones. Projects in claude.ai don't apply here; Claude doesn't read a Project's instructions or knowledge in Slack, and a channel can't be pointed at a Project.
164What Claude reads in a channel is the concatenated custom instructions of its scope chain, the instructions of each bundle that applies there, the channel's [managed instructions](/docs/claude-tag/admins/managed-by.md#how-managed-instructions-load) if another channel manages it, and the `CLAUDE.md` of any repository it clones. Projects in claude.ai don't apply here; Claude doesn't read a Project's instructions or knowledge in Slack, and a channel can't be pointed at a Project.
165165
166166#### When a new instruction applies
167167
from line 173
173173
174174| Layer | Who writes it | Where |
175175| :- | :- | :- |
176| Custom instructions | Owner for any scope; [Claude Tag admin](/docs/claude-tag/admins/restrict-access#delegate-claude-tag-administration) for workspace and channel scopes; channel members and [channel managers](/docs/claude-tag/admins/restrict-access#delegate-channel-setup-to-channel-managers) for the channel scope, unless members are [restricted](#restrict-who-can-set-channel-instructions) | The instructions field on a scope's page in admin settings, or the **Configure** link in any reply footer for the channel scope |
177| Bundle instructions | An Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access#delegate-claude-tag-administration) | The **Instructions** section of the bundle's page. They apply wherever the bundle applies |
178| Managed instructions | Full workspace members in one of the channel's [managing channels](/docs/claude-tag/admins/managed-by), which an Owner or a Claude Tag admin selects under **Managed by** on the channel's Configure page | By asking Claude in the managing channel and confirming the card it posts |
176| Custom instructions | Owner for any scope; [Claude Tag admin](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) for workspace and channel scopes; channel members and [channel managers](/docs/claude-tag/admins/restrict-access.md#delegate-channel-setup-to-channel-managers) for the channel scope, unless members are [restricted](#restrict-who-can-set-channel-instructions) | The instructions field on a scope's page in admin settings, or the **Configure** link in any reply footer for the channel scope |
177| Bundle instructions | An Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access.md#delegate-claude-tag-administration) | The **Instructions** section of the bundle's page. They apply wherever the bundle applies |
178| Managed instructions | Full workspace members in one of the channel's [managing channels](/docs/claude-tag/admins/managed-by.md), which an Owner or a Claude Tag admin selects under **Managed by** on the channel's Configure page | By asking Claude in the managing channel and confirming the card it posts |
179179| Channel memory | Anyone in the channel | By telling Claude to remember |
180180| Task prompt | The requester | The message itself |
181181
182Channel members can shape how Claude responds in their channel through memory, but they can't change which credentials or repositories it has; that's bundle configuration. See [who controls what](/docs/claude-tag/admins/customize) for the full split.
182Channel members can shape how Claude responds in their channel through memory, but they can't change which credentials or repositories it has; that's bundle configuration. See [who controls what](/docs/claude-tag/admins/customize.md) for the full split.
183183
184184Custom instructions are read ahead of the conversation and take priority in practice, but they're guidance, not an enforced guardrail. Don't rely on them to block actions; use access controls for that.
185185
from line 191
191191| :- | :- |
192192| **Inherit** | Follow the parent scope's setting |
193193| **Allow** | Members can edit channel instructions from the Configure link |
194| **Block** | Members can't change channel instructions, the channel's default model, or its [**Respond automatically**](/docs/claude-tag/users/when-claude-responds#turn-automatic-replies-on-or-off) setting |
194| **Block** | Members can't change channel instructions, the channel's default model, or its [**Respond automatically**](/docs/claude-tag/users/when-claude-responds.md#turn-automatic-replies-on-or-off) setting |
195195
196A chain of scopes that all inherit resolves to **Allow**. Set **Block** on a workspace's page or on the **Slack** page to lock channel instructions across every channel beneath it. A [channel manager](/docs/claude-tag/admins/restrict-access#delegate-channel-setup-to-channel-managers) can still edit instructions, change the default model, and switch the **Respond automatically** toggle from the Configure page in a channel assigned to them when **Block** is set.
196A chain of scopes that all inherit resolves to **Allow**. Set **Block** on a workspace's page or on the **Slack** page to lock channel instructions across every channel beneath it. A [channel manager](/docs/claude-tag/admins/restrict-access.md#delegate-channel-setup-to-channel-managers) can still edit instructions, change the default model, and switch the **Respond automatically** toggle from the Configure page in a channel assigned to them when **Block** is set.
197197
198198## Verify the bundle is live
199199
from line 204
204204
205205## Related resources
206206
207* [Getting started for users](/docs/claude-tag/users/getting-started): what your team does once the bundle is live
208* [Restrict where Claude Tag operates](/docs/claude-tag/admins/restrict-access): narrow where it responds
207* [Getting started for users](/docs/claude-tag/users/getting-started.md): what your team does once the bundle is live
208* [Restrict where Claude Tag operates](/docs/claude-tag/admins/restrict-access.md): narrow where it responds
209209
claude-tag/admins/attribute-costs Changed · +4 / -4 lines
from line 26
2626 --header "x-api-key: $ANALYTICS_API_KEY"
2727```
2828
29`products[]=claude-tag` limits the report to the work that bills to your organization's usage balance: Claude's work in Slack channels, and [DMs from members who haven't connected a Claude account](/docs/claude-tag/admins/restrict-access#direct-messages-from-members-without-a-claude-account). One-to-one DMs from members who have connected a Claude account bill to the sender's own seat and aren't reported under `claude-tag`, so this filter leaves them out.
29`products[]=claude-tag` limits the report to the work that bills to your organization's usage balance: Claude's work in Slack channels, and [DMs from members who haven't connected a Claude account](/docs/claude-tag/admins/restrict-access.md#direct-messages-from-members-without-a-claude-account). One-to-one DMs from members who have connected a Claude account bill to the sender's own seat and aren't reported under `claude-tag`, so this filter leaves them out.
3030
3131Each row's `claude_tag_user_id` is a Slack user ID such as `U0123ABCDEF`, not a claude.ai user ID. A row with a null `claude_tag_user_id` is channel spend with no attributed user, and [How costs map to users](#how-costs-map-to-users) lists those cases. For the full parameters, response schema, and data freshness, see the [cost report reference](https://platform.claude.com/docs/en/api/admin/analytics/cost/list), which also covers grouping by `slack_channel_id` and `claude_tag_category`.
3232
from line 38
3838* **Work Claude picks up on its own goes to a person in the thread where it did the work.** That person is the member whose message Claude acted on, if there is one. Otherwise it is whoever mentioned Claude into the thread, or, if no one did, the person who started the thread.
3939* **Scheduled routines go to the person who set the routine up.**
4040* **The null row collects spend with no attributable person.** Examples are:
41 * the [channel session's](/docs/claude-tag/concepts/how-it-works#lifecycle-of-a-request) own work
41 * the [channel session's](/docs/claude-tag/concepts/how-it-works.md#lifecycle-of-a-request) own work
4242 * work Claude started on its own in a thread started by Claude, another app, or a bot
4343 * a routine whose creator can't be identified
4444
4545Per-user rows therefore sum to less than your total channel spend.
4646
47Per-user attribution doesn't change billing. Channel work still bills to your organization's usage balance, not to any user's seat. See [Set a spend limit](/docs/claude-tag/admins/set-spend-limit) for the billing split.
47Per-user attribution doesn't change billing. Channel work still bills to your organization's usage balance, not to any user's seat. See [Set a spend limit](/docs/claude-tag/admins/set-spend-limit.md) for the billing split.
4848
4949## Related resources
5050
5151* [Get cost over time](https://platform.claude.com/docs/en/api/admin/analytics/cost/list): the cost report's parameters, response schema, and limits
5252* [Analytics APIs](https://platform.claude.com/docs/en/manage-claude/analytics-api): key setup, data freshness, and pagination
53* [Set a spend limit](/docs/claude-tag/admins/set-spend-limit): what bills to the organization's balance versus a user's seat
53* [Set a spend limit](/docs/claude-tag/admins/set-spend-limit.md): what bills to the organization's balance versus a user's seat
5454
claude-tag/admins/audit Changed · +6 / -6 lines
from line 25
2525| :- | :- |
2626| **Scheduled work** | The routines set up in channels across your organization, with a **Scope** filter and a per-row **⋮** menu with actions such as **View details**, **Pause** or **Resume**, and **Delete** |
2727| **Memory** | Each scope's memory files, where you can read what Claude has saved for that workspace or channel. Owners can also edit or delete entries there. |
28| **Network events** | An hourly JSON export of the outbound requests Claude made through [Agent Proxy](/docs/claude-tag/concepts/agent-identity#agent-proxy). Git and MCP traffic are not included. Select a date and hour to download. |
28| **Network events** | An hourly JSON export of the outbound requests Claude made through [Agent Proxy](/docs/claude-tag/concepts/agent-identity.md#agent-proxy). Git and MCP traffic are not included. Select a date and hour to download. |
2929
3030Each routine on the **Scheduled work** tab shows **Created by** (the member who set it up) in its **View details** dialog. There is no per-action log of every task and who asked; for that, use the trails below.
3131
3232## Trace an action to its source
3333
34In channels, Claude acts as itself unless a task uses a member's [personal connectors](/docs/claude-tag/concepts/personal-connectors), which run with that member's permissions and are recorded under their name. Each action Claude takes as itself carries the service-account identity:
34In channels, Claude acts as itself unless a task uses a member's [personal connectors](/docs/claude-tag/concepts/personal-connectors.md), which run with that member's permissions and are recorded under their name. Each action Claude takes as itself carries the service-account identity:
3535
3636* **In Slack**, it posts as the Claude app, and its work happens in threads anyone in the channel can read.
3737* **On code**, commits and pull requests show the Claude GitHub App as the author, and each one links back to the Slack thread it came from.
from line 49
4949
5050Claude lists the channel's scheduled jobs and watches, and anyone there can ask it to disable one.
5151
52Routines run with the channel's credentials, so the channel listing is also the permission picture. See [proactivity](/docs/claude-tag/users/proactivity#manage-standing-work).
52Routines run with the channel's credentials, so the channel listing is also the permission picture. See [proactivity](/docs/claude-tag/users/proactivity.md#manage-standing-work).
5353
5454## Related resources
5555
56* [How agent identity works](/docs/claude-tag/concepts/agent-identity): how attribution differs in channels and DMs
57* [Restrict where Claude Tag operates](/docs/claude-tag/admins/restrict-access): the controls when an audit turns something up
58* [Security and data handling](/docs/claude-tag/concepts/security-and-data): the model behind the trails
56* [How agent identity works](/docs/claude-tag/concepts/agent-identity.md): how attribution differs in channels and DMs
57* [Restrict where Claude Tag operates](/docs/claude-tag/admins/restrict-access.md): the controls when an audit turns something up
58* [Security and data handling](/docs/claude-tag/concepts/security-and-data.md): the model behind the trails
5959