One read of Claude Documentationclaude-docs-20261023T180724Z
267 pages moved out of 280 read.
Pages moved
267
significant first
Pages read
280
in this capture
Captured
18:07 UTC
Corpus hash
307a31a7094a
corpus-hash
What this read moved
126-150 of 267, page 6 of 11This capture is too large to show at once. Changes 126-150 of 267 are below, significant first; the rest are on the following screens.
connectors/google/drive Changed · +7 / -7 lines
from line 8
88
99> [!NOTE]
1010>
11> If you want Claude to search your email or calendar rather than your files, see [Gmail](/docs/connectors/google/gmail.md) or [Google Calendar](/docs/connectors/google/calendar.md).
11> If you want Claude to search your email or calendar rather than your files, see [Gmail](https://claude.com/docs/connectors/google/gmail.md) or [Google Calendar](https://claude.com/docs/connectors/google/calendar.md).
1212
1313## Connect Google Drive
1414
from line 28
2828
2929When the connection succeeds, the **Connect** button on the Google Drive connector changes to **Disconnect**.
3030
31On Team and Enterprise plans, Google Drive doesn't appear in your connector list until an Owner adds it for your organization. Each member then connects their own Google account. For the full walkthrough, including troubleshooting, see [Get started with connectors](/docs/connectors/getting-started.md).
31On Team and Enterprise plans, Google Drive doesn't appear in your connector list until an Owner adds it for your organization. Each member then connects their own Google account. For the full walkthrough, including troubleshooting, see [Get started with connectors](https://claude.com/docs/connectors/getting-started.md).
3232
3333## What Claude can read from Drive
3434
from line 119
119119
120120## Next steps
121121
122* [Gmail](/docs/connectors/google/gmail.md): search and analyze your emails
123* [Google Calendar](/docs/connectors/google/calendar.md): access your calendar information
124* [Get started with connectors](/docs/connectors/getting-started.md#manage-or-disconnect-a-connector): set tool permissions and manage any connector
125* [Add a connector from the directory](/docs/connectors/getting-started.md#add-a-connector-from-the-directory): find a connector for another service in the directory and connect it
126* [Connectors directory](/docs/connectors/directory.md): browse verified and community integrations
122* [Gmail](https://claude.com/docs/connectors/google/gmail.md): search and analyze your emails
123* [Google Calendar](https://claude.com/docs/connectors/google/calendar.md): access your calendar information
124* [Get started with connectors](https://claude.com/docs/connectors/getting-started.md#manage-or-disconnect-a-connector): set tool permissions and manage any connector
125* [Add a connector from the directory](https://claude.com/docs/connectors/getting-started.md#add-a-connector-from-the-directory): find a connector for another service in the directory and connect it
126* [Connectors directory](https://claude.com/docs/connectors/directory.md): browse verified and community integrations
127127
connectors/google/gmail Changed · +6 / -6 lines
from line 8
88
99> [!NOTE]
1010>
11> If your organization uses Outlook, see [Microsoft 365](/docs/connectors/microsoft/365.md) instead.
11> If your organization uses Outlook, see [Microsoft 365](https://claude.com/docs/connectors/microsoft/365.md) instead.
1212
1313## Connect Gmail
1414
from line 28
2828
2929When the connection succeeds, the **Connect** button on the Gmail connector changes to **Disconnect**.
3030
31On Team and Enterprise plans, Gmail doesn't appear in your connector list until an Owner or Primary Owner enables it for your organization. For the full walkthrough, including troubleshooting, see [Get started with connectors](/docs/connectors/getting-started.md).
31On Team and Enterprise plans, Gmail doesn't appear in your connector list until an Owner or Primary Owner enables it for your organization. For the full walkthrough, including troubleshooting, see [Get started with connectors](https://claude.com/docs/connectors/getting-started.md).
3232
3333## Try the connector
3434
from line 59
5959
6060## Next steps
6161
62* [Google Calendar](/docs/connectors/google/calendar.md): access your calendar information
63* [Google Drive](/docs/connectors/google/drive.md): search and read your Drive files
64* [Add a connector from the directory](/docs/connectors/getting-started.md#add-a-connector-from-the-directory): find a connector for another service in the directory and connect it
65* [Connectors directory](/docs/connectors/directory.md): browse verified and community integrations
62* [Google Calendar](https://claude.com/docs/connectors/google/calendar.md): access your calendar information
63* [Google Drive](https://claude.com/docs/connectors/google/drive.md): search and read your Drive files
64* [Add a connector from the directory](https://claude.com/docs/connectors/getting-started.md#add-a-connector-from-the-directory): find a connector for another service in the directory and connect it
65* [Connectors directory](https://claude.com/docs/connectors/directory.md): browse verified and community integrations
6666
connectors/mcp-tunnels/oauth Changed · +5 / -5 lines
from line 10
1010
1111> [!NOTE]
1212>
13> If your authorization server is reachable from the public internet and its metadata advertises public URLs, you don't need anything on this page. Add the connector as described in [Set up an MCP tunnel](/docs/connectors/mcp-tunnels/setup.md#add-tunneled-servers-as-connectors), and members sign in as they would for any other connector.
13> If your authorization server is reachable from the public internet and its metadata advertises public URLs, you don't need anything on this page. Add the connector as described in [Set up an MCP tunnel](https://claude.com/docs/connectors/mcp-tunnels/setup.md#add-tunneled-servers-as-connectors), and members sign in as they would for any other connector.
1414
1515## Understand how OAuth works through a tunnel
1616
from line 25
2525
2626## Route the authorization server through the tunnel
2727
28Add a route for the authorization server to the proxy configuration, next to the routes for your MCP servers, and apply it as described in [Add more servers later](/docs/connectors/mcp-tunnels/setup.md#add-more-servers-later).
28Add a route for the authorization server to the proxy configuration, next to the routes for your MCP servers, and apply it as described in [Add more servers later](https://claude.com/docs/connectors/mcp-tunnels/setup.md#add-more-servers-later).
2929
3030```yaml theme={null}
3131routes:
from line 49
4949
5050The paths after the hostname (`/authorize`, `/oauth/token`, and so on) are whatever your authorization server uses. Copy them from its metadata document, usually served at `/.well-known/oauth-authorization-server` or `/.well-known/openid-configuration`, and change only the scheme and host.
5151
52After you save the connector, connect it yourself from your own connector settings. Your browser should open your sign-in page, and after you approve access the connector should show as connected. If either step fails, see [Troubleshooting](/docs/connectors/mcp-tunnels/troubleshooting.md#sign-in-redirects-to-a-tunnel-address-that-does-not-load).
52After you save the connector, connect it yourself from your own connector settings. Your browser should open your sign-in page, and after you approve access the connector should show as connected. If either step fails, see [Troubleshooting](https://claude.com/docs/connectors/mcp-tunnels/troubleshooting.md#sign-in-redirects-to-a-tunnel-address-that-does-not-load).
5353
5454## Publish split metadata instead
5555
from line 80
8080
8181## Next steps
8282
83* [Add tunneled servers as connectors](/docs/connectors/mcp-tunnels/setup.md#add-tunneled-servers-as-connectors): where you add the connector and turn on **Tunnel OAuth configuration**
84* [Troubleshoot OAuth sign-in](/docs/connectors/mcp-tunnels/troubleshooting.md#oauth-sign-in): fix sign-in redirects that don't load and token exchanges that fail
83* [Add tunneled servers as connectors](https://claude.com/docs/connectors/mcp-tunnels/setup.md#add-tunneled-servers-as-connectors): where you add the connector and turn on **Tunnel OAuth configuration**
84* [Troubleshoot OAuth sign-in](https://claude.com/docs/connectors/mcp-tunnels/troubleshooting.md#oauth-sign-in): fix sign-in redirects that don't load and token exchanges that fail
8585
connectors/mcp-tunnels/overview Changed · +7 / -7 lines
from line 6
66>
77> MCP tunnels are in research preview and are available to organizations on the Claude Enterprise plan by request. To request access, [submit the MCP tunnels interest form](https://claude.com/form/mcp-tunnels) or contact your Anthropic account team. The preview is provided as-is, without uptime, support, or continuity commitments, and it depends on a third-party network provider (Cloudflare) that makes no availability commitment for the underlying transport. Anthropic may modify or discontinue MCP tunnels at any time.
88
9MCP tunnels connect Claude to [Model Context Protocol (MCP)](/docs/connectors/building/mcp.md) servers that run inside your private network. You run a small tunnel stack on a host in your network, the stack opens an outbound-only connection to Anthropic, and Claude sends MCP requests to your servers over that connection. Your firewall needs no inbound rules and your MCP servers need no public endpoint. Members of your organization use the tunneled servers as [custom connectors](/docs/connectors/custom/add-unlisted.md#add-a-connector-by-url) in Claude, the same way they use any other remote MCP server.
9MCP tunnels connect Claude to [Model Context Protocol (MCP)](https://claude.com/docs/connectors/building/mcp.md) servers that run inside your private network. You run a small tunnel stack on a host in your network, the stack opens an outbound-only connection to Anthropic, and Claude sends MCP requests to your servers over that connection. Your firewall needs no inbound rules and your MCP servers need no public endpoint. Members of your organization use the tunneled servers as [custom connectors](https://claude.com/docs/connectors/custom/add-unlisted.md#add-a-connector-by-url) in Claude, the same way they use any other remote MCP server.
1010
1111This section is for administrators of claude.ai organizations on the Enterprise plan and the infrastructure teams they work with. To use MCP tunnels with the Claude Console, Claude Managed Agents, or the Messages API, see [MCP tunnels in the Claude Platform docs](https://platform.claude.com/docs/en/agents-and-tools/mcp-tunnels/overview). A tunnel belongs to the organization that created it, so a tunnel created from a Console organization can't serve connectors in claude.ai, and a tunnel created from claude.ai can't serve the API.
1212
from line 14
1414
1515Use a tunnel when the MCP server your organization wants to reach from Claude is only reachable inside your network, and your security policy rules out giving it a public endpoint or allowlisting Anthropic's IP ranges at your edge. Internal knowledge bases, ticketing systems, and data services wrapped in an MCP server are typical candidates.
1616
17If the MCP server is already reachable from the internet, you don't need a tunnel. Add it as a [custom connector](/docs/connectors/custom/add-unlisted.md#add-a-connector-by-url) directly.
17If the MCP server is already reachable from the internet, you don't need a tunnel. Add it as a [custom connector](https://claude.com/docs/connectors/custom/add-unlisted.md#add-a-connector-by-url) directly.
1818
1919## Understand how tunnel traffic flows
2020
from line 63
6363
6464The proxy terminates inner TLS with a certificate signed by a certificate authority (CA) that the setup component generates inside your environment and registers with Anthropic. Only your deployment holds the private keys, so Cloudflare carries ciphertext and cannot read MCP requests or responses. Anthropic does not connect to a tunnel until a CA certificate is registered for it. Cloudflare does receive connection metadata: the egress IP address and a host fingerprint of the machine running cloudflared, connection timing and byte volume, and the `tunnel.anthropic.com` subdomain assigned to your tunnel. Cloudflare acts as a subprocessor for this research preview.
6565
66The tunnel carries traffic to your MCP servers but does not authenticate to them. Configure each MCP server to require OAuth as described in the [MCP authorization specification](https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization), and see [Authenticate to MCP servers behind a tunnel](/docs/connectors/mcp-tunnels/oauth.md) for how sign-in works when the authorization server is also inside your network.
66The tunnel carries traffic to your MCP servers but does not authenticate to them. Configure each MCP server to require OAuth as described in the [MCP authorization specification](https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization), and see [Authenticate to MCP servers behind a tunnel](https://claude.com/docs/connectors/mcp-tunnels/oauth.md) for how sign-in works when the authorization server is also inside your network.
6767
6868### Shared responsibility
6969
from line 78
7878
7979> [!WARNING]
8080>
81> An attacker who obtains your tunnel token and one of your TLS private keys could impersonate your proxy and read MCP request payloads, including OAuth tokens. Store both with your organization's secrets-management controls, restrict file permissions, and rotate them on a schedule and immediately after any suspected exposure. See [Rotate credentials](/docs/connectors/mcp-tunnels/setup.md#rotate-credentials).
81> An attacker who obtains your tunnel token and one of your TLS private keys could impersonate your proxy and read MCP request payloads, including OAuth tokens. Store both with your organization's secrets-management controls, restrict file permissions, and rotate them on a schedule and immediately after any suspected exposure. See [Rotate credentials](https://claude.com/docs/connectors/mcp-tunnels/setup.md#rotate-credentials).
8282
8383## Limits
8484
from line 89
8989
9090## Next steps
9191
92* [Set up an MCP tunnel](/docs/connectors/mcp-tunnels/setup.md): create the API key, deploy the tunnel stack with Helm or Docker Compose, and add your servers as connectors
93* [Authenticate through a tunnel](/docs/connectors/mcp-tunnels/oauth.md): make OAuth sign-in work when your authorization server is inside your network
94* [Troubleshooting](/docs/connectors/mcp-tunnels/troubleshooting.md): diagnose connection, certificate, routing, and sign-in failures
92* [Set up an MCP tunnel](https://claude.com/docs/connectors/mcp-tunnels/setup.md): create the API key, deploy the tunnel stack with Helm or Docker Compose, and add your servers as connectors
93* [Authenticate through a tunnel](https://claude.com/docs/connectors/mcp-tunnels/oauth.md): make OAuth sign-in work when your authorization server is inside your network
94* [Troubleshooting](https://claude.com/docs/connectors/mcp-tunnels/troubleshooting.md): diagnose connection, certificate, routing, and sign-in failures
9595* [Platform reference](https://platform.claude.com/docs/en/agents-and-tools/mcp-tunnels/reference): proxy configuration fields, certificate requirements, and the setup component
9696
connectors/mcp-tunnels/setup Changed · +8 / -8 lines
from line 6
66>
77> MCP tunnels are in research preview and are available to organizations on the Claude Enterprise plan by request. To request access, [submit the MCP tunnels interest form](https://claude.com/form/mcp-tunnels) or contact your Anthropic account team.
88
9This page covers the full setup of an MCP tunnel for a claude.ai Enterprise organization, from creating the API key that provisioning uses to members calling a tunneled MCP server from Claude. You need the Owner or Primary Owner role in claude.ai, and someone who can deploy containers to a Kubernetes cluster or a Docker host inside your network. Read [MCP tunnels](/docs/connectors/mcp-tunnels/overview) first if the tunnel stack, the tunnel domain, and routes are unfamiliar.
9This page covers the full setup of an MCP tunnel for a claude.ai Enterprise organization, from creating the API key that provisioning uses to members calling a tunneled MCP server from Claude. You need the Owner or Primary Owner role in claude.ai, and someone who can deploy containers to a Kubernetes cluster or a Docker host inside your network. Read [MCP tunnels](https://claude.com/docs/connectors/mcp-tunnels/overview) first if the tunnel stack, the tunnel domain, and routes are unfamiliar.
1010
1111## Create a Tunnels API key
1212
from line 63
6363 search: http://10.0.12.7:9000
6464```
6565
66With these routes, Claude reaches the servers at `docs.<your-tunnel-domain>` and `search.<your-tunnel-domain>`. If a route targets an address outside the RFC 1918 private ranges (some managed Kubernetes distributions allocate Service IPs elsewhere), add the range under `gateway.config.upstream.allowed_ips` as described in [Troubleshooting](/docs/connectors/mcp-tunnels/troubleshooting.md#proxy-logs-ip-validation-failed).
66With these routes, Claude reaches the servers at `docs.<your-tunnel-domain>` and `search.<your-tunnel-domain>`. If a route targets an address outside the RFC 1918 private ranges (some managed Kubernetes distributions allocate Service IPs elsewhere), add the range under `gateway.config.upstream.allowed_ips` as described in [Troubleshooting](https://claude.com/docs/connectors/mcp-tunnels/troubleshooting.md#proxy-logs-ip-validation-failed).
6767
6868**3. Review the rendered manifests**
6969
from line 94
9494 --set api.token="$API_TOKEN"
9595```
9696
97The setup component runs as a pre-install hook, so `helm install` blocks until the tunnel is created, the CA is registered, and the credentials are stored in the `mcp-tunnel` Secret. If the install fails with a hook error, see [Troubleshooting](/docs/connectors/mcp-tunnels/troubleshooting.md#helm-install-fails-with-a-hook-error).
97The setup component runs as a pre-install hook, so `helm install` blocks until the tunnel is created, the CA is registered, and the credentials are stored in the `mcp-tunnel` Secret. If the install fails with a hook error, see [Troubleshooting](https://claude.com/docs/connectors/mcp-tunnels/troubleshooting.md#helm-install-fails-with-a-hook-error).
9898
9999> [!WARNING]
100100>
from line 267
267267docker compose logs mcp-proxy | grep "route configured"
268268```
269269
270The containers take a few seconds to start, so rerun the commands if they come back empty. If cloudflared never registers, see [Troubleshooting](/docs/connectors/mcp-tunnels/troubleshooting.md#the-tunnel-stack-starts-but-cloudflared-never-connects). The end-to-end check happens from Claude, in the next section.
270The containers take a few seconds to start, so rerun the commands if they come back empty. If cloudflared never registers, see [Troubleshooting](https://claude.com/docs/connectors/mcp-tunnels/troubleshooting.md#the-tunnel-stack-starts-but-cloudflared-never-connects). The end-to-end check happens from Claude, in the next section.
271271
272272## Add tunneled servers as connectors
273273
from line 287
287287
288288**4. Configure authentication**
289289
290Configure authentication for the server. If its OAuth authorization server is also inside your network, turn on **Tunnel OAuth configuration** and follow [Authenticate to MCP servers behind a tunnel](/docs/connectors/mcp-tunnels/oauth.md).
290Configure authentication for the server. If its OAuth authorization server is also inside your network, turn on **Tunnel OAuth configuration** and follow [Authenticate to MCP servers behind a tunnel](https://claude.com/docs/connectors/mcp-tunnels/oauth.md).
291291
292292**5. Add the connector**
293293
294294Select **Add**.
295295
296Members then find the connector in their own connector settings and select **Connect** to sign in, as described in [Add a connector by URL](/docs/connectors/custom/add-unlisted.md#add-a-connector-by-url). To confirm the tunnel end to end, connect the server yourself and ask Claude to use one of its tools while you watch the proxy logs for the request.
296Members then find the connector in their own connector settings and select **Connect** to sign in, as described in [Add a connector by URL](https://claude.com/docs/connectors/custom/add-unlisted.md#add-a-connector-by-url). To confirm the tunnel end to end, connect the server yourself and ask Claude to use one of its tools while you watch the proxy logs for the request.
297297
298298### Add more servers later
299299
from line 464
464464
465465## Next steps
466466
467* [Authenticate to MCP servers behind a tunnel](/docs/connectors/mcp-tunnels/oauth.md): make OAuth sign-in work when your authorization server is inside your network
468* [Troubleshoot MCP tunnels](/docs/connectors/mcp-tunnels/troubleshooting.md): diagnose connection, certificate, routing, and sign-in failures
467* [Authenticate to MCP servers behind a tunnel](https://claude.com/docs/connectors/mcp-tunnels/oauth.md): make OAuth sign-in work when your authorization server is inside your network
468* [Troubleshoot MCP tunnels](https://claude.com/docs/connectors/mcp-tunnels/troubleshooting.md): diagnose connection, certificate, routing, and sign-in failures
469469* [MCP tunnels reference](https://platform.claude.com/docs/en/agents-and-tools/mcp-tunnels/reference): proxy configuration fields, certificate requirements, and the setup component
470470
connectors/mcp-tunnels/troubleshooting Changed · +9 / -9 lines
from line 6
66>
77> MCP tunnels are in research preview and are available to organizations on the Claude Enterprise plan by request. To request access, [submit the MCP tunnels interest form](https://claude.com/form/mcp-tunnels) or contact your Anthropic account team.
88
9A request through an [MCP tunnel](/docs/connectors/mcp-tunnels/overview) can fail at three points, and it helps to check them in order. First the outbound connection from cloudflared to the tunnel edge, then the inner TLS handshake between Anthropic and your proxy, then the proxy's routing to your MCP server. The cloudflared and proxy logs on your side show which point a request reached. If the proxy logs nothing at all for a request, it never arrived in your network.
9A request through an [MCP tunnel](https://claude.com/docs/connectors/mcp-tunnels/overview) can fail at three points, and it helps to check them in order. First the outbound connection from cloudflared to the tunnel edge, then the inner TLS handshake between Anthropic and your proxy, then the proxy's routing to your MCP server. The cloudflared and proxy logs on your side show which point a request reached. If the proxy logs nothing at all for a request, it never arrived in your network.
1010
1111```bash Helm theme={null}
1212kubectl -n mcp-tunnel logs deploy/mcp-tunnel -c cloudflared
from line 39
3939
4040### Setup fails with `Organization already has the maximum of 10 non-archived Tunnels`
4141
42Each organization can have at most 10 tunnels that are not archived, and every setup run with an empty `tunnel.id` (Helm) or no `--tunnel-id` (Docker Compose) creates a new one. Archive tunnels you no longer use, as described in [Remove a tunnel](/docs/connectors/mcp-tunnels/setup.md#remove-a-tunnel), then run setup again. To attach a new deployment to an existing tunnel instead of creating one, set `tunnel.id` in `values.yaml` or pass `--tunnel-id` to the setup command.
42Each organization can have at most 10 tunnels that are not archived, and every setup run with an empty `tunnel.id` (Helm) or no `--tunnel-id` (Docker Compose) creates a new one. Archive tunnels you no longer use, as described in [Remove a tunnel](https://claude.com/docs/connectors/mcp-tunnels/setup.md#remove-a-tunnel), then run setup again. To attach a new deployment to an existing tunnel instead of creating one, set `tunnel.id` in `values.yaml` or pass `--tunnel-id` to the setup command.
4343
4444### Helm install fails with a hook error
4545
from line 94
9494
9595### Proxy logs `tls handshake failed`
9696
97Anthropic rejected the certificate the proxy presented. Check that the server certificate has not passed its 90-day validity, that its Subject Alternative Name covers `*.<your-tunnel-domain>`, and that it was signed by the CA the setup component registered for this tunnel. On Docker Compose, also confirm the files in `data/` are readable by user ID `65532`. To renew an expired certificate, see [Rotate credentials](/docs/connectors/mcp-tunnels/setup.md#rotate-credentials).
97Anthropic rejected the certificate the proxy presented. Check that the server certificate has not passed its 90-day validity, that its Subject Alternative Name covers `*.<your-tunnel-domain>`, and that it was signed by the CA the setup component registered for this tunnel. On Docker Compose, also confirm the files in `data/` are readable by user ID `65532`. To renew an expired certificate, see [Rotate credentials](https://claude.com/docs/connectors/mcp-tunnels/setup.md#rotate-credentials).
9898
9999## Connectors and tools
100100
from line 104
104104
105105**1. Confirm the stack is connected**
106106
107Confirm the stack is connected, using the log checks in [Verify the connection](/docs/connectors/mcp-tunnels/setup.md#verify-the-connection).
107Confirm the stack is connected, using the log checks in [Verify the connection](https://claude.com/docs/connectors/mcp-tunnels/setup.md#verify-the-connection).
108108
109109**2. Confirm the tunnel's organization**
110110
from line 120
120120
121121## OAuth sign-in
122122
123See [Authenticate to MCP servers behind a tunnel](/docs/connectors/mcp-tunnels/oauth.md) for how the sign-in flow splits between the member's browser and Claude's servers.
123See [Authenticate to MCP servers behind a tunnel](https://claude.com/docs/connectors/mcp-tunnels/oauth.md) for how the sign-in flow splits between the member's browser and Claude's servers.
124124
125125### Sign-in redirects to a tunnel address that does not load
126126
127The authorization server's metadata advertises an authorization endpoint on the `tunnel.anthropic.com` hostname or an internal hostname, and the member's browser can't load it. Turn on **Tunnel OAuth configuration** for the connector and set **Authorization endpoint** to the sign-in URL members' browsers can reach, or publish split metadata from the authorization server. Both are described on the [OAuth page](/docs/connectors/mcp-tunnels/oauth.md#set-the-tunnel-oauth-configuration).
127The authorization server's metadata advertises an authorization endpoint on the `tunnel.anthropic.com` hostname or an internal hostname, and the member's browser can't load it. Turn on **Tunnel OAuth configuration** for the connector and set **Authorization endpoint** to the sign-in URL members' browsers can reach, or publish split metadata from the authorization server. Both are described on the [OAuth page](https://claude.com/docs/connectors/mcp-tunnels/oauth.md#set-the-tunnel-oauth-configuration).
128128
129129### Sign-in succeeds in the browser but the connector never connects
130130
from line 132
132132
133133### The Token endpoint field rejects the URL
134134
135**Token endpoint** and **Registration endpoint** accept an `https://` URL that is either under `tunnel.anthropic.com` or on the same origin (scheme, host, and port) as the **Authorization endpoint**. Any other URL is rejected, because Claude sends the token exchange and the client credentials to it. Add a route for your authorization server as shown in [Route the authorization server through the tunnel](/docs/connectors/mcp-tunnels/oauth.md#route-the-authorization-server-through-the-tunnel) and enter the resulting tunnel URL. The **Authorization endpoint** field has no such restriction, because browsers load it directly.
135**Token endpoint** and **Registration endpoint** accept an `https://` URL that is either under `tunnel.anthropic.com` or on the same origin (scheme, host, and port) as the **Authorization endpoint**. Any other URL is rejected, because Claude sends the token exchange and the client credentials to it. Add a route for your authorization server as shown in [Route the authorization server through the tunnel](https://claude.com/docs/connectors/mcp-tunnels/oauth.md#route-the-authorization-server-through-the-tunnel) and enter the resulting tunnel URL. The **Authorization endpoint** field has no such restriction, because browsers load it directly.
136136
137137### The Tunnel OAuth configuration toggle is missing
138138
from line 144
144144
145145## Related resources
146146
147* [Set up an MCP tunnel](/docs/connectors/mcp-tunnels/setup.md): the deployment, verification, and credential rotation steps
148* [Authenticate to MCP servers behind a tunnel](/docs/connectors/mcp-tunnels/oauth.md): the Tunnel OAuth configuration fields and the split-metadata alternative
147* [Set up an MCP tunnel](https://claude.com/docs/connectors/mcp-tunnels/setup.md): the deployment, verification, and credential rotation steps
148* [Authenticate to MCP servers behind a tunnel](https://claude.com/docs/connectors/mcp-tunnels/oauth.md): the Tunnel OAuth configuration fields and the split-metadata alternative
149149* [MCP tunnels reference](https://platform.claude.com/docs/en/agents-and-tools/mcp-tunnels/reference): proxy configuration fields, certificate requirements, and the setup component
150150
connectors/microsoft/365 Changed · +4 / -4 lines
from line 8
88
99> [!NOTE]
1010>
11> * If your organization runs Claude Desktop on third-party inference, see [Connect to Microsoft 365](/docs/third-party/claude-desktop/connectors-m365.md) instead
12> * If you're in a US government deployment, see [Set up the Microsoft 365 connector](/docs/government/connectors/microsoft-365.md) in the government section
11> * If your organization runs Claude Desktop on third-party inference, see [Connect to Microsoft 365](https://claude.com/docs/third-party/claude-desktop/connectors-m365.md) instead
12> * If you're in a US government deployment, see [Set up the Microsoft 365 connector](https://claude.com/docs/government/connectors/microsoft-365.md) in the government section
1313
1414## Review what Claude can do
1515
from line 178
178178
179179## Next steps
180180
181* [Add a connector from the directory](/docs/connectors/getting-started.md#add-a-connector-from-the-directory): find a connector for another service in the directory and connect it
182* [Connectors directory](/docs/connectors/directory.md): browse verified and community integrations
181* [Add a connector from the directory](https://claude.com/docs/connectors/getting-started.md#add-a-connector-from-the-directory): find a connector for another service in the directory and connect it
182* [Connectors directory](https://claude.com/docs/connectors/directory.md): browse verified and community integrations
183183
connectors/slack/index Changed · +4 / -4 lines
from line 8
88
99> [!NOTE]
1010>
11> This page covers the earlier per-user Claude in Slack app. The current product is [Claude Tag](/docs/claude-tag/overview.md), which gives your team one Claude identity set up by an admin. If your organization used the earlier app, see [Migrate from the earlier Claude in Slack](/docs/claude-tag/admins/migrate-from-earlier.md).
11> This page covers the earlier per-user Claude in Slack app. The current product is [Claude Tag](https://claude.com/docs/claude-tag/overview.md), which gives your team one Claude identity set up by an admin. If your organization used the earlier app, see [Migrate from the earlier Claude in Slack](https://claude.com/docs/claude-tag/admins/migrate-from-earlier.md).
1212
1313## Use the earlier Claude in Slack app
1414
from line 114
114114
115115## Next steps
116116
117* [Claude Tag](/docs/claude-tag/overview.md): the current product, which gives your team one Claude identity set up by an admin
118* [Add a connector from the directory](/docs/connectors/getting-started.md#add-a-connector-from-the-directory): find a connector for another service in the directory and connect it
119* [Connectors directory](/docs/connectors/directory.md): browse verified and community integrations
117* [Claude Tag](https://claude.com/docs/claude-tag/overview.md): the current product, which gives your team one Claude identity set up by an admin
118* [Add a connector from the directory](https://claude.com/docs/connectors/getting-started.md#add-a-connector-from-the-directory): find a connector for another service in the directory and connect it
119* [Connectors directory](https://claude.com/docs/connectors/directory.md): browse verified and community integrations
120120
connectors/verification Changed · +8 / -8 lines
from line 2
22
33> How Anthropic reviews connectors in the directory, what the Verified, Community, and Custom labels mean, and how to stay safe with third-party connectors.
44
5The [Connectors Directory](/docs/connectors/directory.md) lists connectors from Anthropic and from third-party developers, and each one shows how much Anthropic has reviewed it. Use this page to understand what those labels mean before you connect one.
5The [Connectors Directory](https://claude.com/docs/connectors/directory.md) lists connectors from Anthropic and from third-party developers, and each one shows how much Anthropic has reviewed it. Use this page to understand what those labels mean before you connect one.
66
77> [!NOTE]
88>
from line 26
2626
2727### Custom
2828
29You added a Custom connector yourself, and Anthropic hasn't reviewed it. [Custom connectors](/docs/connectors/custom/add-unlisted.md#add-a-connector-by-url) explains how to add one.
29You added a Custom connector yourself, and Anthropic hasn't reviewed it. [Custom connectors](https://claude.com/docs/connectors/custom/add-unlisted.md#add-a-connector-by-url) explains how to add one.
3030
3131## Directory listing versus custom connectors
3232
3333The directory is a catalog of connectors, and listing is optional. Connectors in the directory and custom connectors you add yourself use the same technology, so if you have a connector's URL, you can add it as a custom connector whether or not it's in the directory.
3434
35Listing a connector in the directory makes it discoverable by other people and gives it a review label: a checkmark if Anthropic has verified it, or **Community** if Anthropic has screened it but not reviewed it in depth. Listing doesn't change the tools the connector exposes. [Directory vs custom](/docs/connectors/building/directory-vs-custom.md) has a detailed comparison.
35Listing a connector in the directory makes it discoverable by other people and gives it a review label: a checkmark if Anthropic has verified it, or **Community** if Anthropic has screened it but not reviewed it in depth. Listing doesn't change the tools the connector exposes. [Directory vs custom](https://claude.com/docs/connectors/building/directory-vs-custom.md) has a detailed comparison.
3636
3737## Stay safe with third-party connectors
3838
from line 45
4545* Stay aware of prompt injection risks, even though Claude has built-in protections
4646* Monitor for unexpected changes in tool behavior
4747
48For more, see [security and privacy](/docs/connectors/custom/add-unlisted.md#security-and-privacy) for custom connectors.
48For more, see [security and privacy](https://claude.com/docs/connectors/custom/add-unlisted.md#security-and-privacy) for custom connectors.
4949
5050## List your own connector
5151
52If you build connectors and want yours in the directory, start with the [connector pre-submission checklist](/docs/connectors/building/review-criteria.md) and then [submit your connector](/docs/connectors/building/submission.md).
52If you build connectors and want yours in the directory, start with the [connector pre-submission checklist](https://claude.com/docs/connectors/building/review-criteria.md) and then [submit your connector](https://claude.com/docs/connectors/building/submission.md).
5353
5454When you submit a server, Anthropic scans it automatically for policy compliance and, by default, lists it in the directory as a Community connector. Anthropic may then escalate listings flagged as highly useful to Claude users to Verified review, which is higher touch and slower, and in which reviewers run a functional test of each tool. That escalation is assessed automatically. There's no separate application for the **Verified** label, and you don't need to take any action.
5555
5656## Related resources
5757
58* [Connectors Directory](/docs/connectors/directory.md): browse and connect Verified and Community connectors
59* [Custom connectors](/docs/connectors/custom/add-unlisted.md#add-a-connector-by-url): add a connector by URL, and the security and privacy guidance that applies
60* [Publish to the directory](/docs/directory/publish.md): the developer's overview of submitting a connector or plugin
58* [Connectors Directory](https://claude.com/docs/connectors/directory.md): browse and connect Verified and Community connectors
59* [Custom connectors](https://claude.com/docs/connectors/custom/add-unlisted.md#add-a-connector-by-url): add a connector by URL, and the security and privacy guidance that applies
60* [Publish to the directory](https://claude.com/docs/directory/publish.md): the developer's overview of submitting a connector or plugin
6161
cowork/guide/dispatch Changed · +3 / -3 lines
from line 39
3939| Task type | Runs in | Examples |
4040| - | - | - |
4141| Coding work | Code, against a workspace you've already set up | Fix a bug, open a pull request, run tests |
42| Knowledge work | Cowork, in the [project](/docs/cowork/guide/projects.md) you specify (or your default project) | Research, write a document, organize files |
42| Knowledge work | Cowork, in the [project](https://claude.com/docs/cowork/guide/projects.md) you specify (or your default project) | Research, write a document, organize files |
4343
4444When starting a task, you can tell the agent which Code workspace or Cowork project to use. If you don't, it lists what's available and chooses.
4545
from line 86
8686
8787## Related
8888
89* [Organize work with projects](/docs/cowork/guide/projects.md) for the project context Dispatch routes knowledge work into
90* [Cowork overview](/docs/cowork/overview.md) for how Dispatch fits alongside sessions and projects
89* [Organize work with projects](https://claude.com/docs/cowork/guide/projects.md) for the project context Dispatch routes knowledge work into
90* [Cowork overview](https://claude.com/docs/cowork/overview.md) for how Dispatch fits alongside sessions and projects
9191
cowork/guide/plugins Changed · +8 / -8 lines
from line 4
44
55A plugin is a package that extends what Claude can do in Cowork. Installing one can add skills, MCP connectors, subagents, commands, or hooks in a single step. Plugins come from the marketplace, from your organization, or from a file you upload.
66
7A plugin you install is saved to your account, so its skills and connectors are also available in chat and in Claude Code. [Plugins](/docs/plugins/overview.md) covers what each surface loads; this page covers the Cowork side.
7A plugin you install is saved to your account, so its skills and connectors are also available in chat and in Claude Code. [Plugins](https://claude.com/docs/plugins/overview.md) covers what each surface loads; this page covers the Cowork side.
88
99To get started, [install a plugin](#install-a-plugin) from **Customize**, or [add a Git repository as a marketplace](#use-a-git-repository-as-a-marketplace) to share plugins without publishing them.
1010
from line 46
4646
4747## Use a Git repository as a marketplace
4848
49A Git repository that contains plugin packages can serve as a marketplace, which lets you share plugins without publishing to the public catalog. For a marketplace you add yourself, repositories on GitHub, including GitHub Enterprise, are supported, and public repositories on GitLab and Bitbucket also work. To distribute plugins to everyone in a Team or Enterprise organization, an Owner syncs the repository from organization settings instead, as [Manage plugins for your organization](/docs/plugins/admin.md#add-your-own-plugins) describes.
49A Git repository that contains plugin packages can serve as a marketplace, which lets you share plugins without publishing to the public catalog. For a marketplace you add yourself, repositories on GitHub, including GitHub Enterprise, are supported, and public repositories on GitLab and Bitbucket also work. To distribute plugins to everyone in a Team or Enterprise organization, an Owner syncs the repository from organization settings instead, as [Manage plugins for your organization](https://claude.com/docs/plugins/admin.md#add-your-own-plugins) describes.
5050
5151**1. Add the repository**
5252
from line 61
6161
6262Select **Check for updates** on a marketplace to pull the latest plugins from its repository, or turn on **Sync automatically**.
6363
64For marketplaces your organization manages, see [Manage plugins for your organization](/docs/plugins/admin.md), or [MCP, plugins, skills, and hooks](/docs/cowork/3p/extensions.md) if your organization deploys Claude Desktop with its own model provider.
64For marketplaces your organization manages, see [Manage plugins for your organization](https://claude.com/docs/plugins/admin.md), or [MCP, plugins, skills, and hooks](https://claude.com/docs/cowork/3p/extensions.md) if your organization deploys Claude Desktop with its own model provider.
6565
6666## Limits
6767
from line 81
8181
8282On Team and Enterprise plans, administrators can require certain plugins for everyone in the organization. Required plugins install automatically and show **This plugin is required by your organization**; you can't remove them.
8383
84For how administrators provision plugins, see [Manage plugins for your organization](/docs/plugins/admin.md).
84For how administrators provision plugins, see [Manage plugins for your organization](https://claude.com/docs/plugins/admin.md).
8585
8686## Update and remove plugins
8787
from line 91
9191
9292## Next steps
9393
94* [Plugins](/docs/plugins/overview.md): how plugins work across Claude products
95* [Manage plugins for your organization](/docs/plugins/admin.md): administrator provisioning on Team and Enterprise plans
96* [Submit a plugin](/docs/plugins/submit.md): publish your own to the marketplace
97* [MCP, plugins, skills, and hooks](/docs/third-party/claude-desktop/extensions.md): for organizations that deploy Claude Desktop with their own model provider
94* [Plugins](https://claude.com/docs/plugins/overview.md): how plugins work across Claude products
95* [Manage plugins for your organization](https://claude.com/docs/plugins/admin.md): administrator provisioning on Team and Enterprise plans
96* [Submit a plugin](https://claude.com/docs/plugins/submit.md): publish your own to the marketplace
97* [MCP, plugins, skills, and hooks](https://claude.com/docs/third-party/claude-desktop/extensions.md): for organizations that deploy Claude Desktop with their own model provider
9898
cowork/guide/projects Changed · +4 / -4 lines
from line 45
4545
4646Select a project in the sidebar to start a new Cowork session with that project's folders mounted and instructions applied. Files Claude creates land in the project's folders; what Claude learns during the session is saved to the project's memory for next time.
4747
48[Dispatch](/docs/cowork/guide/dispatch.md) can also route background tasks into a project, so long-running work picks up the same folders, instructions, and memory.
48[Dispatch](https://claude.com/docs/cowork/guide/dispatch.md) can also route background tasks into a project, so long-running work picks up the same folders, instructions, and memory.
4949
5050When you drag files or folders into a project, individual files are copied into the project's first folder and folders are mounted as additional project folders. Claude reads individual files up to 50 MB.
5151
from line 69
6969
7070## Related
7171
72* [Run tasks in the background with Dispatch](/docs/cowork/guide/dispatch.md) to run work inside a project without watching each step
73* [Install plugins](/docs/cowork/guide/plugins.md) to extend what Claude can do in a project's sessions
74* [Cowork overview](/docs/cowork/overview.md) for how projects relate to sessions and Dispatch
72* [Run tasks in the background with Dispatch](https://claude.com/docs/cowork/guide/dispatch.md) to run work inside a project without watching each step
73* [Install plugins](https://claude.com/docs/cowork/guide/plugins.md) to extend what Claude can do in a project's sessions
74* [Cowork overview](https://claude.com/docs/cowork/overview.md) for how projects relate to sessions and Dispatch
7575
cowork/hipaa-setup Changed · +14 / -14 lines
from line 14
1414>
1515> The Claude Code extensions for VS Code and JetBrains aren't part of (local mode). They keep working with the HIPAA configuration applied, but your BAA doesn't cover them. See the [Implementation Guide](https://trust.anthropic.com/resources?s=l1wrssd9hsbi4gak0tp5a6\&name=%5Banthropic%5D-hipaa-ready-offering-implementation-guide) for the full list of Eligible Services.
1616
17This page is for the IT or security administrator who manages the macOS and Windows computers where members run [Cowork](/docs/cowork/overview.md) in Claude Desktop. Other readers start on a different page:
17This page is for the IT or security administrator who manages the macOS and Windows computers where members run [Cowork](https://claude.com/docs/cowork/overview.md) in Claude Desktop. Other readers start on a different page:
1818
1919* **The Primary Owner, who applies the HIPAA configuration**: see [Use Claude Code (local mode) and Cowork (local mode) on a HIPAA-ready Enterprise plan](https://support.claude.com/en/articles/17318731) for what your BAA covers and how to apply the configuration
2020* **Administrators who prepare computers for Claude Code in the terminal**: see [Set up Claude Code (local mode) for a HIPAA-ready organization](https://code.claude.com/docs/en/hipaa-setup)
21* **Administrators of a third-party deployment**: see [Legal and compliance](/docs/third-party/claude-desktop/legal.md). The HIPAA configuration doesn't apply to [Claude Desktop on third-party platforms](/docs/third-party/claude-desktop/overview.md)
21* **Administrators of a third-party deployment**: see [Legal and compliance](https://claude.com/docs/third-party/claude-desktop/legal.md). The HIPAA configuration doesn't apply to [Claude Desktop on third-party platforms](https://claude.com/docs/third-party/claude-desktop/overview.md)
2222
2323The table shows when to do each part of the setup:
2424
from line 48
4848On an older version, members see an **Update required** dialog that tells them to update Claude Desktop. The dialog's text names Code, but members see it in Cowork too. What the dialog offers depends on whether automatic updates are on:
4949
5050* **Automatic updates are on**: the dialog has an **Update now** button
51* **You turned off automatic updates** with the [`disableAutoUpdates`](/docs/third-party/claude-desktop/configuration#disableautoupdates) key: the dialog tells the member to ask their administrator. Deploy each new version with your device management tool. On macOS, and on Windows where Claude Desktop was installed from the `.msix` package, once the newer version is on the device the dialog has an **Update now** button instead.
51* **You turned off automatic updates** with the [`disableAutoUpdates`](https://claude.com/docs/third-party/claude-desktop/configuration#disableautoupdates) key: the dialog tells the member to ask their administrator. Deploy each new version with your device management tool. On macOS, and on Windows where Claude Desktop was installed from the `.msix` package, once the newer version is on the device the dialog has an **Update now** button instead.
5252
5353### Allow network access for Claude Desktop
5454
from line 62
6262
6363### Deploy the Claude Desktop policy
6464
65A Claude Desktop policy is a set of settings that your device management tool installs on each computer, as a configuration profile on macOS or as registry values on Windows. You can use one to restrict sign-in to your organization, turn off local MCP servers and desktop extensions, and keep session content out of [Cowork monitoring](/docs/cowork/monitoring.md) events.
65A Claude Desktop policy is a set of settings that your device management tool installs on each computer, as a configuration profile on macOS or as registry values on Windows. You can use one to restrict sign-in to your organization, turn off local MCP servers and desktop extensions, and keep session content out of [Cowork monitoring](https://claude.com/docs/cowork/monitoring.md) events.
6666
6767The policy in this section is a sample that we recommend as a starting point. Your organization is responsible for deciding what its own environment needs and for confirming that its configuration meets those needs.
6868
from line 97
9797"otlpContentCapture"="[]"
9898```
9999
100The sample writes every value as a string, including `false` and `[]`. [Value types](/docs/third-party/claude-desktop/configuration-format.md#value-types) lists the other encodings Claude Desktop accepts.
100The sample writes every value as a string, including `false` and `[]`. [Value types](https://claude.com/docs/third-party/claude-desktop/configuration-format.md#value-types) lists the other encodings Claude Desktop accepts.
101101
102102> [!NOTE]
103103>
from line 105
105105
106106#### What each Claude Desktop key does
107107
108The table shows what to set each key to and what Claude Desktop enforces for it. The key names link to the [configuration reference](/docs/third-party/claude-desktop/configuration.md), which describes third-party deployments. Some of its keys apply only to third-party deployments, such as `coworkEgressAllowedHosts` and `otlpEndpoint`.
108The table shows what to set each key to and what Claude Desktop enforces for it. The key names link to the [configuration reference](https://claude.com/docs/third-party/claude-desktop/configuration.md), which describes third-party deployments. Some of its keys apply only to third-party deployments, such as `coworkEgressAllowedHosts` and `otlpEndpoint`.
109109
110110| Key | Value | What Claude Desktop enforces |
111111| :- | :- | :- |
112112| `forceLoginOrgUUID` | Your organization ID, which an Owner can copy from [claude.ai admin settings](https://claude.ai/admin-settings/organization) | After a member of your organization signs in, Claude Desktop switches them to your organization. Anyone else sees a page that reads "This account is not approved by your enterprise admin" and can only log out |
113| [`isLocalDevMcpEnabled`](/docs/third-party/claude-desktop/configuration#islocaldevmcpenabled) | `false` | Members can't add local MCP servers to chat or Cowork. Local MCP servers that plugins provide stop loading too, including plugins your organization distributes. Claude Desktop also skips the setup that connects it to the Claude in Chrome extension |
114| [`isDesktopExtensionEnabled`](/docs/third-party/claude-desktop/configuration#isdesktopextensionenabled) | `false` | Installed desktop extensions stop loading, and members can't install new ones |
115| [`otlpContentCapture`](/docs/third-party/claude-desktop/configuration#otlpcontentcapture) | `[]` | Cowork monitoring events carry metadata only |
113| [`isLocalDevMcpEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#islocaldevmcpenabled) | `false` | Members can't add local MCP servers to chat or Cowork. Local MCP servers that plugins provide stop loading too, including plugins your organization distributes. Claude Desktop also skips the setup that connects it to the Claude in Chrome extension |
114| [`isDesktopExtensionEnabled`](https://claude.com/docs/third-party/claude-desktop/configuration#isdesktopextensionenabled) | `false` | Installed desktop extensions stop loading, and members can't install new ones |
115| [`otlpContentCapture`](https://claude.com/docs/third-party/claude-desktop/configuration#otlpcontentcapture) | `[]` | Cowork monitoring events carry metadata only |
116116
117117Cowork monitoring sends events to the OpenTelemetry collector that your organization sets up. When `otlpContentCapture` isn't set, those events can include prompt text, model responses, and tool inputs.
118118
from line 132
132132| `isLocalDevMcpEnabled` | Open **Settings** in Claude Desktop. The list of entries has no **Developer** entry |
133133| `isDesktopExtensionEnabled` | Open **Settings** in Claude Desktop. The list of entries has no **Extensions** entry |
134134| `forceLoginOrgUUID` | Sign in with an account that isn't in your organization. Claude Desktop shows "This account is not approved by your enterprise admin" |
135| `otlpContentCapture` | Run a Cowork task and read the events your [Cowork monitoring](/docs/cowork/monitoring.md) collector receives. They contain no prompt text, model responses, or tool inputs |
135| `otlpContentCapture` | Run a Cowork task and read the events your [Cowork monitoring](https://claude.com/docs/cowork/monitoring.md) collector receives. They contain no prompt text, model responses, or tool inputs |
136136
137137### Check which Claude Code managed settings apply in Cowork
138138
from line 168
168168
169169To restrict which hosts the VM reaches, you can ask an Owner to go to [**Organization settings > Capabilities**](https://claude.ai/admin-settings/capabilities) and turn off the **Allow network egress** toggle under **Code execution**. Turning the toggle off has these effects:
170170
171* **Cowork**: the VM reaches only `anthropic.com` and `claude.com` hosts, plus your OpenTelemetry collector if [Cowork monitoring](/docs/cowork/monitoring.md) is set up
171* **Cowork**: the VM reaches only `anthropic.com` and `claude.com` hosts, plus your OpenTelemetry collector if [Cowork monitoring](https://claude.com/docs/cowork/monitoring.md) is set up
172172* **Chat**: the toggle also applies to code execution in chat
173173* **[Web search](#turn-off-web-search-in-cowork) and connectors**: neither goes through the VM, so the toggle doesn't limit them
174174
from line 184
184184Web search in Cowork follows your organization's web search setting. Applying the HIPAA configuration doesn't change it. If web search is on and your organization's own policy forbids it, turn it off at one of these levels:
185185
186186* **For your whole organization, in chat and Cowork**: ask an Owner to go to [**Organization settings > Capabilities**](https://claude.ai/admin-settings/capabilities) and turn off the **Web search** toggle under **Data sources**
187* **For Cowork and the Code tab on managed computers**: add the [`disabledBuiltinTools`](/docs/third-party/claude-desktop/configuration#disabledbuiltintools) key to the [Claude Desktop policy](#deploy-the-claude-desktop-policy)
187* **For Cowork and the Code tab on managed computers**: add the [`disabledBuiltinTools`](https://claude.com/docs/third-party/claude-desktop/configuration#disabledbuiltintools) key to the [Claude Desktop policy](#deploy-the-claude-desktop-policy)
188188
189189The `disabledBuiltinTools` key takes a list of tool names, written as a string:
190190
from line 229
229229
230230**4. Check your monitoring events**
231231
232If your organization uses [Cowork monitoring](/docs/cowork/monitoring.md), run a Cowork task. Confirm that the events your collector receives contain no prompt text, model responses, or tool inputs.
232If your organization uses [Cowork monitoring](https://claude.com/docs/cowork/monitoring.md), run a Cowork task. Confirm that the events your collector receives contain no prompt text, model responses, or tool inputs.
233233
234234The [HIPAA feature availability table](https://support.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers) lists which Cowork features are off with the HIPAA configuration applied, and which ones an Owner can turn back on.
235235
from line 314
314314## Related resources
315315
316316* [Set up Claude Code (local mode) for a HIPAA-ready organization](https://code.claude.com/docs/en/hipaa-setup)
317* [Cowork monitoring](/docs/cowork/monitoring.md)
317* [Cowork monitoring](https://claude.com/docs/cowork/monitoring.md)
318318* [Claude Code managed settings](https://code.claude.com/docs/en/managed-settings)
319319
cowork/monitoring Changed · +9 / -9 lines
from line 34
3434
3535## Events
3636
37Cowork exports the following events to your OTel collector. The collector settings in [Setup](#setup) apply to every Cowork session that runs on a user's computer in Claude Desktop, including Cowork tasks that [Dispatch](/docs/cowork/guide/dispatch.md) starts. They don't apply to Code tab sessions, including Code sessions that Dispatch starts. Whether events include user prompt text, model response text, and tool inputs depends on the [`otlpContentCapture`](/docs/third-party/claude-desktop/configuration#otlpcontentcapture) managed configuration key on each user's device. When the key isn't set, current versions of Claude Desktop send metadata only, and [some older versions](#content-capture) on first-party deployments send content.
37Cowork exports the following events to your OTel collector. The collector settings in [Setup](#setup) apply to every Cowork session that runs on a user's computer in Claude Desktop, including Cowork tasks that [Dispatch](https://claude.com/docs/cowork/guide/dispatch.md) starts. They don't apply to Code tab sessions, including Code sessions that Dispatch starts. Whether events include user prompt text, model response text, and tool inputs depends on the [`otlpContentCapture`](https://claude.com/docs/third-party/claude-desktop/configuration#otlpcontentcapture) managed configuration key on each user's device. When the key isn't set, current versions of Claude Desktop send metadata only, and [some older versions](#content-capture) on first-party deployments send content.
3838
3939### Content capture
4040
4141Events can carry user prompt text, model response text, and tool inputs in addition to metadata. You set which of these the events carry with the `otlpContentCapture` managed configuration key on each user's device.
4242
43To set the key, deploy it with your device management tool to the [managed configuration location for each operating system](/docs/third-party/claude-desktop/configuration-format.md#how-keys-are-read). To export metadata only, set `otlpContentCapture` to an empty list, written as the two characters `[]`. Claude Desktop reads an empty string as if the key weren't set. The key takes effect when Claude Desktop restarts.
43To set the key, deploy it with your device management tool to the [managed configuration location for each operating system](https://claude.com/docs/third-party/claude-desktop/configuration-format.md#how-keys-are-read). To export metadata only, set `otlpContentCapture` to an empty list, written as the two characters `[]`. Claude Desktop reads an empty string as if the key weren't set. The key takes effect when Claude Desktop restarts.
4444
4545The table shows what events carry on current versions of Claude Desktop, for a Cowork session that runs on the user's computer.
4646
from line 47
4747| `otlpContentCapture` on the device | Content that events carry |
4848| - | - |
4949| Not set | No content. Events carry metadata only |
50| Set to a list of [categories](/docs/third-party/claude-desktop/telemetry.md#content-capture) | By default, the content in the listed categories, and model response text when `userPrompts` is listed |
50| Set to a list of [categories](https://claude.com/docs/third-party/claude-desktop/telemetry.md#content-capture) | By default, the content in the listed categories, and model response text when `userPrompts` is listed |
5151| Set to an empty list, `[]` | No content. Events carry metadata only |
5252
5353On first-party deployments, some older versions of Claude Desktop send user prompt text, model response text, and the [`toolDetails` content](#security-and-privacy) when the key isn't set. To make sure a device sends metadata only, set the key to `[]`, which works on every version that supports the key.
from line 64
6464
6565To trace all activity triggered by a single prompt, filter your events by a specific `prompt.id` value.
6666
67On third-party deployments, you can additionally enable OpenTelemetry trace export with the [`otlpTracesEnabled`](/docs/third-party/claude-desktop/telemetry#traces-beta) setting (beta). When it is enabled, events emitted while a prompt is processed also carry `trace_id` and `span_id`, linking them to the session's trace spans for end-to-end correlation in your observability backend.
67On third-party deployments, you can additionally enable OpenTelemetry trace export with the [`otlpTracesEnabled`](https://claude.com/docs/third-party/claude-desktop/telemetry#traces-beta) setting (beta). When it is enabled, events emitted while a prompt is processed also carry `trace_id` and `span_id`, linking them to the session's trace spans for end-to-end correlation in your observability backend.
6868
6969### Standard attributes
7070
from line 83
8383
8484> [!NOTE]
8585>
86> The account attributes — `organization.id`, `user.account_uuid`, `user.account_id`, and `user.email` — are populated from the user's Anthropic account, so they appear on first-party deployments only. On [third-party deployments](/docs/third-party/claude-desktop/overview.md) there is no Anthropic account and these attributes are absent; instead, the export carries the signed-in user's identity as the `enduser.id` resource attribute, described under [User attribution](/docs/third-party/claude-desktop/telemetry.md#user-attribution). The `process.owner` resource attribute (the operating-system login name) is standard OpenTelemetry process metadata and is present on all deployments.
86> The account attributes — `organization.id`, `user.account_uuid`, `user.account_id`, and `user.email` — are populated from the user's Anthropic account, so they appear on first-party deployments only. On [third-party deployments](https://claude.com/docs/third-party/claude-desktop/overview.md) there is no Anthropic account and these attributes are absent; instead, the export carries the signed-in user's identity as the `enduser.id` resource attribute, described under [User attribution](https://claude.com/docs/third-party/claude-desktop/telemetry.md#user-attribution). The `process.owner` resource attribute (the operating-system login name) is standard OpenTelemetry process metadata and is present on all deployments.
8787
8888### User prompt event
8989
from line 121
121121| `response_length` | Length of the response |
122122| `response` | Model response text. Includes text output only; thinking content is excluded. Truncated to 60 KB. When model response capture is disabled, the value is the literal string `<REDACTED>`. |
123123
124By default, model responses are captured when [`otlpContentCapture`](/docs/third-party/claude-desktop/telemetry#content-capture) includes `assistantResponses`, and also whenever user prompts are captured.
124By default, model responses are captured when [`otlpContentCapture`](https://claude.com/docs/third-party/claude-desktop/telemetry#content-capture) includes `assistantResponses`, and also whenever user prompts are captured.
125125
126126### Tool result event
127127
from line 243
243243| `host.arch` | Host architecture (e.g., `arm64`) |
244244| `os.type` | Operating system type (e.g., `darwin`) |
245245| `os.version` | Operating system version string |
246| `enduser.id` | The signed-in user's identity, on third-party deployments only. Controlled by the [`endUserAttribution`](/docs/third-party/claude-desktop/configuration#enduserattribution) setting; see [User attribution](/docs/third-party/claude-desktop/telemetry.md#user-attribution). |
246| `enduser.id` | The signed-in user's identity, on third-party deployments only. Controlled by the [`endUserAttribution`](https://claude.com/docs/third-party/claude-desktop/configuration#enduserattribution) setting; see [User attribution](https://claude.com/docs/third-party/claude-desktop/telemetry.md#user-attribution). |
247247| `process.owner` | Operating-system login name |
248248
249249## Security and privacy
250250
251251* Events are only exported when an admin configures the OTLP endpoint
252* The [`otlpContentCapture`](#content-capture) key on each device sets which content events carry. Each category you list in the key adds its content. The [full category list](/docs/third-party/claude-desktop/telemetry.md#content-capture) has two more than these three:
252* The [`otlpContentCapture`](#content-capture) key on each device sets which content events carry. Each category you list in the key adds its content. The [full category list](https://claude.com/docs/third-party/claude-desktop/telemetry.md#content-capture) has two more than these three:
253253 * `userPrompts`: user prompt text
254254 * `assistantResponses`: model response text
255255 * `toolDetails`: the arguments a tool was called with, in `tool_input` and `tool_parameters`, such as shell commands, file paths, URLs, and search patterns. It also covers the text of a failed tool's error message, in `error` on the [tool result event](#tool-result-event)
from line 257
257257* When `otlpContentCapture` isn't set, current versions of Claude Desktop send metadata only. To make sure a device sends metadata only, set the key to `[]`
258258* Metadata includes `workspace.host_paths`, the paths of the folders a user connects to a task. `otlpContentCapture` doesn't control this attribute, so events carry the paths even when the key is `[]`. If folder names can be sensitive, configure your telemetry backend to filter or redact it
259259* On first-party deployments, `user.email` is always included in event attributes, so configure your telemetry backend to filter or redact it if this is a concern
260* On third-party deployments, `user.email` is absent; the export identifies users with the `enduser.id` resource attribute, controlled by the [`endUserAttribution`](/docs/third-party/claude-desktop/configuration#enduserattribution) setting
260* On third-party deployments, `user.email` is absent; the export identifies users with the `enduser.id` resource attribute, controlled by the [`endUserAttribution`](https://claude.com/docs/third-party/claude-desktop/configuration#enduserattribution) setting
261261
cowork/overview Changed · +4 / -4 lines
from line 15
1515
1616Cowork supports the same extensibility features available across Claude products:
1717
18> **[Connectors](/docs/connectors/overview.md)**
18> **[Connectors](https://claude.com/docs/connectors/overview.md)**
1919>
2020> Connect Claude to your tools and data sources using MCP.
2121
22> **[Skills](/docs/skills/overview.md)**
22> **[Skills](https://claude.com/docs/skills/overview.md)**
2323>
2424> Teach Claude reusable workflows with custom instructions.
2525
26> **[Plugins](/docs/plugins/overview.md)**
26> **[Plugins](https://claude.com/docs/plugins/overview.md)**
2727>
2828> Bundle skills, connectors, and more into shareable packages.
2929
30> **[Monitoring](/docs/cowork/monitoring.md)**
30> **[Monitoring](https://claude.com/docs/cowork/monitoring.md)**
3131>
3232> Track usage and activity across your organization.
3333
directory/publish Changed · +20 / -20 lines
from line 10
1010
1111> [!NOTE]
1212>
13> * If you're still deciding what goes in your plugin, see [Decide what to include in your plugin](/docs/connectors/building/what-to-build.md)
14> * If you want to build a small example plugin and submit it, see [Build your first plugin](/docs/plugins/quickstart.md)
15> * If you want to share a plugin without a public listing, use [your own marketplace](https://code.claude.com/docs/en/plugins/publish) for Claude Code or [roll it out to your whole organization](/docs/plugins/org-rollout.md)
13> * If you're still deciding what goes in your plugin, see [Decide what to include in your plugin](https://claude.com/docs/connectors/building/what-to-build.md)
14> * If you want to build a small example plugin and submit it, see [Build your first plugin](https://claude.com/docs/plugins/quickstart.md)
15> * If you want to share a plugin without a public listing, use [your own marketplace](https://code.claude.com/docs/en/plugins/publish) for Claude Code or [roll it out to your whole organization](https://claude.com/docs/plugins/org-rollout.md)
1616> * If you came here from [Claude Marketplace](https://claude.com/marketplace), the website where you browse plugins, connectors, partner products, and service partners, you're in the right place: there's no separate Claude Marketplace submission, and you submit to the directory instead
1717
1818## Before you submit to the directory
from line 48
4848
4949Work through the checklist and submit pages for that kind:
5050
51* [Plugin pre-submission checklist](/docs/plugins/pre-submission-checklist.md), then [Submit a plugin](/docs/plugins/submit.md): for a plugin bundle
52* [Connector pre-submission checklist](/docs/connectors/building/review-criteria.md), then [Submit a connector](/docs/connectors/building/submission.md): for an MCP connector
51* [Plugin pre-submission checklist](https://claude.com/docs/plugins/pre-submission-checklist.md), then [Submit a plugin](https://claude.com/docs/plugins/submit.md): for a plugin bundle
52* [Connector pre-submission checklist](https://claude.com/docs/connectors/building/review-criteria.md), then [Submit a connector](https://claude.com/docs/connectors/building/submission.md): for an MCP connector
5353
5454## Submit your plugin, and your MCP server as a connector
5555
from line 69
6969
7070For your own product, make two submissions: the server as an MCP connector, then the plugin bundle whose skills teach Claude how to use it. Point the bundle's MCP server configuration at the same URL, so people who have both see one set of tools rather than two.
7171
72Desktop extension listings in the directory are deprecated, and the directory no longer accepts local MCP servers packaged as desktop extensions (MCPB). To distribute a local MCP server through the directory, include it in a plugin bundle. [Compare component support by app](/docs/plugins/platform-support.md#compare-component-support-by-app) shows where a plugin's local servers run.
72Desktop extension listings in the directory are deprecated, and the directory no longer accepts local MCP servers packaged as desktop extensions (MCPB). To distribute a local MCP server through the directory, include it in a plugin bundle. [Compare component support by app](https://claude.com/docs/plugins/platform-support.md#compare-component-support-by-app) shows where a plugin's local servers run.
7373
7474Skills aren't a submission type on their own. Put them in a bundle.
7575
from line 77
7777
7878Anthropic checks every submission before it's listed, and checks a plugin bundle again with each new version.
7979
80* **Plugin bundles**: every version gets automated validation and a security scan, and a person reviews a new listing before it goes live. The [plugin pre-submission checklist](/docs/plugins/pre-submission-checklist.md) lists what validation checks
81* **MCP connectors**: every submission is scanned automatically for policy compliance and, by default, listed as a Community connector. Anthropic may escalate a listing to Verified review, in which a reviewer tests each tool against the [connector pre-submission checklist](/docs/connectors/building/review-criteria.md)
80* **Plugin bundles**: every version gets automated validation and a security scan, and a person reviews a new listing before it goes live. The [plugin pre-submission checklist](https://claude.com/docs/plugins/pre-submission-checklist.md) lists what validation checks
81* **MCP connectors**: every submission is scanned automatically for policy compliance and, by default, listed as a Community connector. Anthropic may escalate a listing to Verified review, in which a reviewer tests each tool against the [connector pre-submission checklist](https://claude.com/docs/connectors/building/review-criteria.md)
8282
8383Every listing is subject to the [Anthropic Software Directory Terms](https://support.claude.com/en/articles/13145338-anthropic-software-directory-terms) and [Software Directory Policy](https://support.claude.com/en/articles/13145358-anthropic-software-directory-policy).
8484
85There's no separate application for the **Verified** label or for where in the directory a listing is placed. Anthropic decides both during review, and [Connector verification](/docs/connectors/verification.md#list-your-own-connector) explains how a listing becomes Verified and what each label means to people installing it.
85There's no separate application for the **Verified** label or for where in the directory a listing is placed. Anthropic decides both during review, and [Connector verification](https://claude.com/docs/connectors/verification.md#list-your-own-connector) explains how a listing becomes Verified and what each label means to people installing it.
8686
87Review time isn't fixed. Your submission's current state shows in the portal, and [Track your directory submission](/docs/directory/submission-status.md) explains what each status in the portal means and who acts next.
87Review time isn't fixed. Your submission's current state shows in the portal, and [Track your directory submission](https://claude.com/docs/directory/submission-status.md) explains what each status in the portal means and who acts next.
8888
8989## Move an earlier submission to the developer portal
9090
from line 97
9797The earlier Claude Console form for plugin submissions is no longer supported. To move a submission you made through it, open [**Plugin submissions**](https://platform.claude.com/plugins/submissions) in the Claude Console:
9898
9999* **A submission with a Withdraw button**: select **Withdraw**. Then submit the plugin again at [claude.ai/directory/manage](https://claude.ai/directory/manage) from a claude.ai account
100* **A submission with no Withdraw button**: email `[email protected]` to have it moved to the developer portal instead of starting a new submission there. If you already saved a draft in the developer portal for the same repository and folder, [delete the draft](/docs/plugins/submit.md#withdraw-or-delist-a-plugin) first
100* **A submission with no Withdraw button**: email `[email protected]` to have it moved to the developer portal instead of starting a new submission there. If you already saved a draft in the developer portal for the same repository and folder, [delete the draft](https://claude.com/docs/plugins/submit.md#withdraw-or-delist-a-plugin) first
101101
102102Until the Console submission is withdrawn or moved, the portal can refuse **Submit for review** for the same repository and folder with **Already submitted by another organization**.
103103
from line 105
105105
106106A directory listing gives you:
107107
108* **One listing across Claude's apps**: you submit once, and the listing appears in each app that [supports what your plugin contains](/docs/plugins/platform-support.md)
109* **One developer portal for the whole life of a listing**: at [claude.ai/directory/manage](https://claude.ai/directory/manage) you submit, follow each submission's status, publish new versions, see usage, and change or delist the listing. [Track your directory submission](/docs/directory/submission-status.md) explains each status
110* **Updates without resubmitting**: after the first submission, you keep the listing current by merging to the tracked branch as you normally release. The directory picks up each commit, scans it, and once it's published serves it to the people who have your plugin. [Update a published plugin](/docs/plugins/submit.md#update-a-published-plugin) covers the steps
111* **Usage figures**: a published plugin's **Usage** tab shows installs, versions, how often each skill and MCP server runs, and error rates. A listed connector has a dashboard with server health and usage by tool. [Track published plugin usage](/docs/connectors/building/after-publishing.md#track-published-plugin-usage) and [Manage your directory listing](/docs/connectors/building/managing-your-listing.md) cover each
108* **One listing across Claude's apps**: you submit once, and the listing appears in each app that [supports what your plugin contains](https://claude.com/docs/plugins/platform-support.md)
109* **One developer portal for the whole life of a listing**: at [claude.ai/directory/manage](https://claude.ai/directory/manage) you submit, follow each submission's status, publish new versions, see usage, and change or delist the listing. [Track your directory submission](https://claude.com/docs/directory/submission-status.md) explains each status
110* **Updates without resubmitting**: after the first submission, you keep the listing current by merging to the tracked branch as you normally release. The directory picks up each commit, scans it, and once it's published serves it to the people who have your plugin. [Update a published plugin](https://claude.com/docs/plugins/submit.md#update-a-published-plugin) covers the steps
111* **Usage figures**: a published plugin's **Usage** tab shows installs, versions, how often each skill and MCP server runs, and error rates. A listed connector has a dashboard with server health and usage by tool. [Track published plugin usage](https://claude.com/docs/connectors/building/after-publishing.md#track-published-plugin-usage) and [Manage your directory listing](https://claude.com/docs/connectors/building/managing-your-listing.md) cover each
112112
113113## Next steps
114114
115115These pages cover building and submitting a first plugin and, once a listing is published, maintaining it from the same portal:
116116
117* [Build your first plugin](/docs/plugins/quickstart.md): build a small example plugin and submit it to the directory
118* [Track your submission](/docs/directory/submission-status.md): check what your submission's status means and who acts next
119* [After publishing](/docs/connectors/building/after-publishing.md): update your server or plugin, and delist
120* [Track published plugin usage](/docs/connectors/building/after-publishing.md#track-published-plugin-usage): see installs, versions, runs, and error rates on the plugin's **Usage** tab
121* [Manage your directory listing](/docs/connectors/building/managing-your-listing.md): for an MCP connector, check health and usage metrics and edit the listing
117* [Build your first plugin](https://claude.com/docs/plugins/quickstart.md): build a small example plugin and submit it to the directory
118* [Track your submission](https://claude.com/docs/directory/submission-status.md): check what your submission's status means and who acts next
119* [After publishing](https://claude.com/docs/connectors/building/after-publishing.md): update your server or plugin, and delist
120* [Track published plugin usage](https://claude.com/docs/connectors/building/after-publishing.md#track-published-plugin-usage): see installs, versions, runs, and error rates on the plugin's **Usage** tab
121* [Manage your directory listing](https://claude.com/docs/connectors/building/managing-your-listing.md): for an MCP connector, check health and usage metrics and edit the listing
122122
directory/submission-status Changed · +10 / -10 lines
from line 8
88
99> [!NOTE]
1010>
11> If you haven't submitted yet, see [Publish to the directory](/docs/directory/publish.md).
11> If you haven't submitted yet, see [Publish to the directory](https://claude.com/docs/directory/publish.md).
1212
1313Find your status in the table for your submission's kind: [plugin bundle](#plugin-bundle-statuses) or [MCP connector](#mcp-connector-statuses). If nothing is waiting on you and you still need an answer, see [Contact Anthropic about a submission](#contact-anthropic-about-a-submission).
1414
from line 20
2020| :- | :- | :- |
2121| **Draft** | Nothing has been sent to Anthropic yet | You. Select **Continue submission**. |
2222| **Scanning** | You submitted, and the security scan is waiting to start or running. If a scan attempt fails on Anthropic's side or GitHub's, the directory retries it. | Anthropic. There's nothing to do on your side. |
23| **Needs changes** | The newest version didn't pass, or the scanner couldn't fetch or accept the plugin. The plugin's page names what to change. | You. [Fix a failed version](/docs/plugins/submit.md#fix-a-failed-version) covers pushing a fix and resubmitting. |
23| **Needs changes** | The newest version didn't pass, or the scanner couldn't fetch or accept the plugin. The plugin's page names what to change. | You. [Fix a failed version](https://claude.com/docs/plugins/submit.md#fix-a-failed-version) covers pushing a fix and resubmitting. |
2424| **In review** | An Anthropic reviewer is checking the listing. When the version was held, the card names the category it's held for. The reviewer's decision appears on the plugin's page. | Anthropic |
25| **Approved** | The version passed, and it isn't live yet. The card says who publishes it: an Anthropic reviewer, you, or the directory by itself. | Whoever the card names. [Publish a passing version](/docs/plugins/submit.md#publish-a-passing-version) explains the publish settings. |
25| **Approved** | The version passed, and it isn't live yet. The card says who publishes it: an Anthropic reviewer, you, or the directory by itself. | Whoever the card names. [Publish a passing version](https://claude.com/docs/plugins/submit.md#publish-a-passing-version) explains the publish settings. |
2626| **Published** | A version is live in the directory. The card also says what is happening with any newer version, such as being scanned, waiting with a reviewer, or not passing. A newer version that doesn't pass leaves the published one unaffected. | Nobody, unless the card names a newer version that needs changes |
2727| **Not live yet** | The submission is marked published, and nothing is listed yet. The directory team has to list it. | Anthropic |
2828| **Delisted** | The plugin isn't visible in the directory. Select **Relist plugin** to ask for it back. | You, if you want it listed again |
from line 34
3434
3535Open the connector from the developer portal's list of submissions. A card at the top of the connector's page shows the status, one sentence about it, and the next step when there is one.
3636
37A submission doesn't pass through every status in the table. Anthropic scans each connector submission automatically and, by default, lists it as a Community connector with no action from you. Some submissions also get a review from a person, and the statuses that mention a reviewer apply to those. [How Anthropic reviews directory submissions](/docs/directory/publish.md#prepare-for-review) describes both.
37A submission doesn't pass through every status in the table. Anthropic scans each connector submission automatically and, by default, lists it as a Community connector with no action from you. Some submissions also get a review from a person, and the statuses that mention a reviewer apply to those. [How Anthropic reviews directory submissions](https://claude.com/docs/directory/publish.md#prepare-for-review) describes both.
3838
3939| Status | What it means | Who acts next |
4040| :- | :- | :- |
from line 45
4545| **Approved** | The review team cleared the listing, and it isn't in the directory yet. It goes live when someone who can edit the listing publishes it. If you edit the listing before you publish, it returns to draft for another review. | You. Select **Publish**. |
4646| **Published** | The connector is live in the directory. If you submitted an edit, the card says whether that edit is in review, and the live listing stays until the edit is approved. | Nobody |
4747
48[Manage your directory listing](/docs/connectors/building/managing-your-listing.md) covers reviewer feedback, listing edits, and the health and usage metrics for a published connector.
48[Manage your directory listing](https://claude.com/docs/connectors/building/managing-your-listing.md) covers reviewer feedback, listing edits, and the health and usage metrics for a published connector.
4949
5050## Contact Anthropic about a submission
5151
from line 58
5858
5959## After your listing is published
6060
61A published listing appears in the directory that claude.ai, the Claude desktop and mobile apps, and Cowork share. [Plugin feature support across platforms](/docs/plugins/platform-support.md) lists which of a plugin's components load on each surface.
61A published listing appears in the directory that claude.ai, the Claude desktop and mobile apps, and Cowork share. [Plugin feature support across platforms](https://claude.com/docs/plugins/platform-support.md) lists which of a plugin's components load on each surface.
6262
63A published connector is listed with the **Community** label by default. There's no application for the **Verified** label. [Connector verification](/docs/connectors/verification.md#list-your-own-connector) explains how a listing becomes Verified and what each label means to people installing it.
63A published connector is listed with the **Community** label by default. There's no application for the **Verified** label. [Connector verification](https://claude.com/docs/connectors/verification.md#list-your-own-connector) explains how a listing becomes Verified and what each label means to people installing it.
6464
6565## Next steps
6666
67* [After publishing](/docs/connectors/building/after-publishing.md): update your server or plugin, and delist
68* [Submit your plugin](/docs/plugins/submit.md#after-you-submit-a-plugin): follow each new plugin version through the scan, review, and publishing
69* [Manage your directory listing](/docs/connectors/building/managing-your-listing.md): for a connector, read reviewer feedback, edit the listing, and check its metrics
67* [After publishing](https://claude.com/docs/connectors/building/after-publishing.md): update your server or plugin, and delist
68* [Submit your plugin](https://claude.com/docs/plugins/submit.md#after-you-submit-a-plugin): follow each new plugin version through the scan, review, and publishing
69* [Manage your directory listing](https://claude.com/docs/connectors/building/managing-your-listing.md): for a connector, read reviewer feedback, edit the listing, and check its metrics
7070
extend/overview Changed · +16 / -16 lines
from line 2
22
33> Choose how to customize Claude: MCP connectors give it access to your tools, skills teach it how you do a task, and plugins package both as one install.
44
5You can customize Claude with [MCP connectors](/docs/connectors/getting-started.md), [skills](/docs/skills/overview.md), and [plugins](/docs/plugins/overview.md). MCP connectors give Claude access to a tool or data source, and skills teach it how to do a task the way you or your team does it. Plugins package skills, MCP connectors, commands, and agents into one unit that you can install once and share with others.
5You can customize Claude with [MCP connectors](https://claude.com/docs/connectors/getting-started.md), [skills](https://claude.com/docs/skills/overview.md), and [plugins](https://claude.com/docs/plugins/overview.md). MCP connectors give Claude access to a tool or data source, and skills teach it how to do a task the way you or your team does it. Plugins package skills, MCP connectors, commands, and agents into one unit that you can install once and share with others.
66
7You add all three from the [**Customize**](https://claude.ai/customize) page in claude.ai or the Claude desktop app. [Plugin feature support across platforms](/docs/plugins/platform-support.md) lists which parts of a plugin work in chat, Cowork, and Claude Code.
7You add all three from the [**Customize**](https://claude.ai/customize) page in claude.ai or the Claude desktop app. [Plugin feature support across platforms](https://claude.com/docs/plugins/platform-support.md) lists which parts of a plugin work in chat, Cowork, and Claude Code.
88
99> [!NOTE]
1010>
11> If you want to make a connector or plugin for other people to install, see [Build for Claude](/docs/build/overview.md). Anyone on a paid Claude plan can submit one to Anthropic's directory for review without applying to a partner program first; on Team and Enterprise, an Owner submits it.
11> If you want to make a connector or plugin for other people to install, see [Build for Claude](https://claude.com/docs/build/overview.md). Anyone on a paid Claude plan can submit one to Anthropic's directory for review without applying to a partner program first; on Team and Enterprise, an Owner submits it.
1212
1313## Choose plugins, connectors, or skills
1414
1515Each card below leads to the setup page for one of the three. The last card is for Owners who manage plugins for a Team or Enterprise organization.
1616
17> **[Plugins](/docs/plugins/overview.md)**
17> **[Plugins](https://claude.com/docs/plugins/overview.md)**
1818>
1919> Add a set of connectors, skills, and commands with one install, such as everything for one tool, or your team's standard setup.
2020
21> **[MCP connectors](/docs/connectors/getting-started.md)**
21> **[MCP connectors](https://claude.com/docs/connectors/getting-started.md)**
2222>
2323> Give Claude access to a tool or data source, such as your files, calendar, issue tracker, or an internal API.
2424
25> **[Skills](/docs/skills/how-to.md)**
25> **[Skills](https://claude.com/docs/skills/how-to.md)**
2626>
2727> Have Claude do a task a particular way, such as your release-note format, your contract checklist, or your weekly report.
2828
29> **[Plugins for your organization](/docs/plugins/admin.md)**
29> **[Plugins for your organization](https://claude.com/docs/plugins/admin.md)**
3030>
3131> If you're an Owner on a Team or Enterprise plan, choose which plugins members can add, install some for everyone, and add your organization's own.
3232
3333## Compare connectors, skills, and plugins
3434
35* **[MCP connectors](/docs/connectors/getting-started.md)** connect Claude to an external service, such as your files, calendar, issue tracker, or an internal API, so Claude can read from it and act in it. Each one is a connection to an MCP server, which the service runs so Claude can reach it. In Claude's settings, connectors appear under **Connectors**
36* **[Skills](/docs/skills/overview.md)** are written instructions, optionally with scripts and reference files, that Claude loads when the task you give it calls for them. Use a skill when you want Claude to follow your process for a task
37* **[Plugins](/docs/plugins/overview.md)** are installable packages. One plugin can hold skills, MCP connectors, commands you run by name, and agents Claude delegates parts of a task to. You can add a skill or a connector on its own. Use a plugin when you want several of them installed and shared as one unit
35* **[MCP connectors](https://claude.com/docs/connectors/getting-started.md)** connect Claude to an external service, such as your files, calendar, issue tracker, or an internal API, so Claude can read from it and act in it. Each one is a connection to an MCP server, which the service runs so Claude can reach it. In Claude's settings, connectors appear under **Connectors**
36* **[Skills](https://claude.com/docs/skills/overview.md)** are written instructions, optionally with scripts and reference files, that Claude loads when the task you give it calls for them. Use a skill when you want Claude to follow your process for a task
37* **[Plugins](https://claude.com/docs/plugins/overview.md)** are installable packages. One plugin can hold skills, MCP connectors, commands you run by name, and agents Claude delegates parts of a task to. You can add a skill or a connector on its own. Use a plugin when you want several of them installed and shared as one unit
3838
3939When a plugin exists for a product you use, it bundles that product's connector with the skills that use it. After you add the plugin, you sign in to its connector from the plugin's page.
4040
from line 46
4646
4747Connectors, skills, and plugins you add in claude.ai or the desktop app are saved to your account, so you have them in chat on the web, desktop, and mobile wherever you sign in. Claude Code picks them up when you sign in there with the same account. A plugin on your account also loads in your Cowork tasks. Things you add from the Claude Code command line stay on that machine.
4848
49In chat, you can use a plugin's skills, commands, and connectors. Cowork and Claude Code also run its agents. [Plugin feature support across platforms](/docs/plugins/platform-support.md) lists each component by app.
49In chat, you can use a plugin's skills, commands, and connectors. Cowork and Claude Code also run its agents. [Plugin feature support across platforms](https://claude.com/docs/plugins/platform-support.md) lists each component by app.
5050
5151## Next steps
5252
53* [Add your first connector](/docs/connectors/getting-started.md): connect one from the directory and use it in a conversation
54* [Skills overview](/docs/skills/overview.md): turn on a skill Anthropic provides or add one of your own
55* [Plugins](/docs/plugins/overview.md): find a plugin and add it to your account
56* [Plugin feature support across platforms](/docs/plugins/platform-support.md): check whether a plugin's parts work where you use Claude
57* [Build for Claude](/docs/build/overview.md): build a plugin or MCP server for other people and list it in Anthropic's directory
53* [Add your first connector](https://claude.com/docs/connectors/getting-started.md): connect one from the directory and use it in a conversation
54* [Skills overview](https://claude.com/docs/skills/overview.md): turn on a skill Anthropic provides or add one of your own
55* [Plugins](https://claude.com/docs/plugins/overview.md): find a plugin and add it to your account
56* [Plugin feature support across platforms](https://claude.com/docs/plugins/platform-support.md): check whether a plugin's parts work where you use Claude
57* [Build for Claude](https://claude.com/docs/build/overview.md): build a plugin or MCP server for other people and list it in Anthropic's directory
5858
government/account/overview Changed · +4 / -4 lines
from line 34
3434>
3535> Who to ask: your organization's owner for a seat, a larger allowance, or a wrong organization or role. Your IT help desk for anything about the app on your computer. Your administrators can take it from there.
3636
37* The [**Account**](/docs/government/account/profile.md) tab shows who you are, including your name, email address, organization, role, and seat tier. Everything on this tab is read-only. Your name and email come from your agency's directory; your organization, role, and seat tier are set by your directory or by an administrator.
38* The [**Usage**](/docs/government/account/usage.md) tab shows how much of your personal allowance you have used in the current 5-hour and 7-day windows, and when each one next resets. If you have hit a limit and Claude is paused, this tab is marked with a pulsing indicator in the navigation so you can spot it at a glance.
39* The [**Sessions**](/docs/government/account/sessions.md) tab lists every browser and desktop application where you are currently signed in, with the option to sign any of them out remotely.
37* The [**Account**](https://claude.com/docs/government/account/profile.md) tab shows who you are, including your name, email address, organization, role, and seat tier. Everything on this tab is read-only. Your name and email come from your agency's directory; your organization, role, and seat tier are set by your directory or by an administrator.
38* The [**Usage**](https://claude.com/docs/government/account/usage.md) tab shows how much of your personal allowance you have used in the current 5-hour and 7-day windows, and when each one next resets. If you have hit a limit and Claude is paused, this tab is marked with a pulsing indicator in the navigation so you can spot it at a glance.
39* The [**Sessions**](https://claude.com/docs/government/account/sessions.md) tab lists every browser and desktop application where you are currently signed in, with the option to sign any of them out remotely.
4040
4141## The page footer
4242
from line 46
4646
4747## Things to know
4848
49* **Nothing here is editable.** Your name, email, organization, role, and seat tier are all set in your agency's directory or by an administrator, and they flow into Claude for Government automatically. If any of these details are wrong, the [Account](/docs/government/account/profile.md) page explains where each one comes from and who to contact.
49* **Nothing here is editable.** Your name, email, organization, role, and seat tier are all set in your agency's directory or by an administrator, and they flow into Claude for Government automatically. If any of these details are wrong, the [Account](https://claude.com/docs/government/account/profile.md) page explains where each one comes from and who to contact.
5050* **The three tabs are independent.** Looking at your usage or your sessions has no effect on the other tabs, and the Sign out button in the footer works from any of them.
5151* **The pulsing indicator on the Usage tab is the only alert in this portal.** It appears while either of your usage limits is full and disappears on its own once the limit resets.
5252
government/config/overview Changed · +9 / -9 lines
from line 4
44
55> **Who this is for:** Tenant administrators and organization owners who set product behavior for the people they manage.
66
7The **Config** page in the admin portal is where you set product behavior such as the session timeout, Claude Desktop banner, product availability, and telemetry for the people you manage. The same page appears at both the tenant and the organization level, with the same list of settings, and this page explains how the two levels fit together. For the settings themselves, see [Available settings](/docs/government/config/settings.md).
7The **Config** page in the admin portal is where you set product behavior such as the session timeout, Claude Desktop banner, product availability, and telemetry for the people you manage. The same page appears at both the tenant and the organization level, with the same list of settings, and this page explains how the two levels fit together. For the settings themselves, see [Available settings](https://claude.com/docs/government/config/settings.md).
88
99<video controls preload="metadata" playsInline src="https://mintcdn.com/claude-ai/gGFKuNSbKYs4JMmK/images/government/videos/admin-06-config-essentials.mp4?fit=max&auto=format&n=gGFKuNSbKYs4JMmK&q=85&s=8624805f501e6ca7e01e12e6e94602ab" aria-label="Video walkthrough: Config essentials" />
1010
from line 59
5959
6060## When changes take effect
6161
62Settings that govern the admin portal, such as whether organizations may manage seat tiers, apply immediately. Settings that govern the Claude applications themselves, such as the Claude Desktop banner, product availability, and telemetry endpoint, are delivered to each member's application the next time it refreshes its configuration, which happens when the application is launched, when the member signs in, and periodically while the application runs. You do not need to push anything. Most changes take effect when the member restarts the application. Claude Desktop prompts for that restart, and requires it once the [Restart deadline for configuration changes](/docs/government/config/settings.md#restart-deadline-for-configuration-changes) has passed. On Claude Desktop 2.2553.0 and later, a few settings take effect in a running application without a restart, such as the **Claude Desktop banner** and the [two switches that let members add plugins](/docs/government/config/settings.md#member-added-plugins-and-marketplaces).
62Settings that govern the admin portal, such as whether organizations may manage seat tiers, apply immediately. Settings that govern the Claude applications themselves, such as the Claude Desktop banner, product availability, and telemetry endpoint, are delivered to each member's application the next time it refreshes its configuration, which happens when the application is launched, when the member signs in, and periodically while the application runs. You do not need to push anything. Most changes take effect when the member restarts the application. Claude Desktop prompts for that restart, and requires it once the [Restart deadline for configuration changes](https://claude.com/docs/government/config/settings.md#restart-deadline-for-configuration-changes) has passed. On Claude Desktop 2.2553.0 and later, a few settings take effect in a running application without a restart, such as the **Claude Desktop banner** and the [two switches that let members add plugins](https://claude.com/docs/government/config/settings.md#member-added-plugins-and-marketplaces).
6363
6464Lowering the session idle timeout applies to new sign-ins only, and so does raising or removing the maximum session length. Lowering the maximum session length, or setting one for the first time, also reaches members who are already signed in, taking up to one idle timeout period to do so.
6565
from line 99
9999
100100## Group-specific settings
101101
102In addition to setting values for your whole tenant or organization, you can set values for the members of a directory group. A directory group is a group that your identity provider has pushed to Claude for Government over SCIM, as described on the [Identity and access](/docs/government/tenant-admin/identity-and-access.md) page.
102In addition to setting values for your whole tenant or organization, you can set values for the members of a directory group. A directory group is a group that your identity provider has pushed to Claude for Government over SCIM, as described on the [Identity and access](https://claude.com/docs/government/tenant-admin/identity-and-access.md) page.
103103
104104There are two kinds of group level:
105105
from line 108
108108
109109To edit settings for a group, open the scope bar above the settings list and choose the group's name from the dropdown. The page switches to show the same settings editor, now scoped to that group. Editing, saving, resetting, and locking all work the same way as at the other levels. Anything locked at a higher level still shows as **Managed** here and cannot be changed.
110110
111You can also add connectors for a group's members from the **Connectors** card while the page is scoped to the group. See [Who receives a connector](/docs/government/connectors/overview.md#who-receives-a-connector) for which members a group's connectors reach.
111You can also add connectors for a group's members from the **Connectors** card while the page is scoped to the group. See [Who receives a connector](https://claude.com/docs/government/connectors/overview.md#who-receives-a-connector) for which members a group's connectors reach.
112112
113113### When someone belongs to more than one group
114114
from line 116
116116
117117When a higher-priority group gains configuration for someone, it takes the place of the lower-priority group that applied to them before, and the lower-priority group's settings, including locked ones, stop applying to them. Removing a group's last setting, changing the priority order, or changing someone's group memberships in your identity provider can change which group applies to a person in the same way.
118118
119A tenant administrator sets the priority order on the [Identity and access](/docs/government/tenant-admin/identity-and-access.md#directory-groups) page. The same priority order is used wherever configuration is resolved for a person; seat-tier group mappings on the [Provisioning](/docs/government/org-admin/provisioning.md) page use a separate fixed order. At the organization level the priority order is shown for reference and cannot be reordered there.
119A tenant administrator sets the priority order on the [Identity and access](https://claude.com/docs/government/tenant-admin/identity-and-access.md#directory-groups) page. The same priority order is used wherever configuration is resolved for a person; seat-tier group mappings on the [Provisioning](https://claude.com/docs/government/org-admin/provisioning.md) page use a separate fixed order. At the organization level the priority order is shown for reference and cannot be reordered there.
120120
121121If no groups appear in the scope bar dropdown, none have been synced from the identity provider yet. Connect SCIM on the Identity and access page and push groups from your directory, and they will appear automatically.
122122
from line 128
128128
129129The Config page shows the same list of settings at both levels, and almost all of them can be set at either level. The genuine differences are:
130130
131* **Two settings can be set only by a tenant administrator.** [Let organizations manage their own seat tiers](/docs/government/config/settings.md#let-organizations-manage-their-own-seat-tiers) and [Compliance API](/docs/government/config/settings.md#compliance-api) appear on both pages, but are always read-only at the organization level.
131* **Two settings can be set only by a tenant administrator.** [Let organizations manage their own seat tiers](https://claude.com/docs/government/config/settings.md#let-organizations-manage-their-own-seat-tiers) and [Compliance API](https://claude.com/docs/government/config/settings.md#compliance-api) appear on both pages, but are always read-only at the organization level.
132132* **Preview impact appears only at the tenant level.** See [Previewing impact](#previewing-impact) above.
133133* **Group priority is set at the tenant level.** Organization owners see the priority order for reference but cannot change it.
134134* **Tenant administrators can open any organization's Config page** and act on that organization's behalf. Organization owners see only their own organization.
135* **Inherited connectors and plugins are labeled at the organization level.** Connectors and plugins the tenant has added appear on the organization page with an **Inherited from your tenant** badge; see [The Connectors card](/docs/government/connectors/overview.md#the-connectors-card).
135* **Inherited connectors and plugins are labeled at the organization level.** Connectors and plugins the tenant has added appear on the organization page with an **Inherited from your tenant** badge; see [The Connectors card](https://claude.com/docs/government/connectors/overview.md#the-connectors-card).
136136
137For more detail see [Config at the tenant level](/docs/government/tenant-admin/configuration.md) and [Config at the organization level](/docs/government/org-admin/configuration.md).
137For more detail see [Config at the tenant level](https://claude.com/docs/government/tenant-admin/configuration.md) and [Config at the organization level](https://claude.com/docs/government/org-admin/configuration.md).
138138
139139## Things to know
140140
141* Some settings can only be changed by tenant administrators (and not by organization owners at all), regardless of whether they are locked. These are noted in the [Available settings](/docs/government/config/settings.md) descriptions.
141* Some settings can only be changed by tenant administrators (and not by organization owners at all), regardless of whether they are locked. These are noted in the [Available settings](https://claude.com/docs/government/config/settings.md) descriptions.
142142* Resetting a setting removes only that level's value. Values set at other levels are unaffected and remain in effect once yours is gone.
143143
government/config/plugins-and-connectors Changed · +10 / -10 lines
from line 4
44
55> **Who this is for:** Tenant administrators and organization owners who deliver plugins and connectors to the members they manage.
66
7You add plugins on the **Plugins** card and connectors on the **Connectors** card of the **Config** page in the admin portal. The cards themselves are listed under [Integrations](/docs/government/config/settings.md#integrations) in Available settings, and this page covers the tasks around them, from choosing between a plugin and a connector to keeping plugins up to date. To distribute skills to members, bundle them in a plugin, as described under [Skills for administrators](/docs/government/desktop/skills.md#skills-for-administrators).
7You add plugins on the **Plugins** card and connectors on the **Connectors** card of the **Config** page in the admin portal. The cards themselves are listed under [Integrations](https://claude.com/docs/government/config/settings.md#integrations) in Available settings, and this page covers the tasks around them, from choosing between a plugin and a connector to keeping plugins up to date. To distribute skills to members, bundle them in a plugin, as described under [Skills for administrators](https://claude.com/docs/government/desktop/skills.md#skills-for-administrators).
88
99## Plugins versus connectors
1010
11A connector gives Claude access to another service, such as a search tool your agency runs, and the **Connectors** card is the way to deliver a connector to members. A plugin is a package that changes how Claude works. It can add skills, slash commands, and sub-agents, and it can carry hooks, which are scripts a plugin author includes to run automatically at defined points during a session, such as when a session starts. For adding a connector, see [Connectors](/docs/government/connectors/overview.md). For what a plugin can contain across Claude products, see the [Plugins overview](/docs/plugins/overview.md); the Claude for Government differences are covered below.
11A connector gives Claude access to another service, such as a search tool your agency runs, and the **Connectors** card is the way to deliver a connector to members. A plugin is a package that changes how Claude works. It can add skills, slash commands, and sub-agents, and it can carry hooks, which are scripts a plugin author includes to run automatically at defined points during a session, such as when a session starts. For adding a connector, see [Connectors](https://claude.com/docs/government/connectors/overview.md). For what a plugin can contain across Claude products, see the [Plugins overview](https://claude.com/docs/plugins/overview.md); the Claude for Government differences are covered below.
1212
13A plugin you upload on the **Plugins** card delivers its skills, slash commands, sub-agents, and hooks to members, and its hooks run on the member's machine. A plugin can also declare [MCP servers](/docs/connectors/getting-started.md) of its own, and [Plugins that run code](#plugins-that-run-code) describes how they behave. To deliver a connector to members, add it on the **Connectors** card.
13A plugin you upload on the **Plugins** card delivers its skills, slash commands, sub-agents, and hooks to members, and its hooks run on the member's machine. A plugin can also declare [MCP servers](https://claude.com/docs/connectors/getting-started.md) of its own, and [Plugins that run code](#plugins-that-run-code) describes how they behave. To deliver a connector to members, add it on the **Connectors** card.
1414
1515## Plugin archive formats
1616
from line 30
3030
3131Paths inside the zip must use forward slashes: File Explorer's **Compress to ZIP file**, 7-Zip, `tar.exe`, PowerShell 7, and Python's `zipfile` all write them, while Windows PowerShell 5.1's `Compress-Archive` can write backslash paths, which the upload rejects. A zip that wraps everything in one top folder, which is what zipping the plugin folder or downloading a repository as a ZIP produces, works, as long as the repository holds no other dot-prefixed files. The upload looks inside the wrapper. Apple's `__MACOSX/` folders are dropped quietly too. A plugin package can hold up to 50 MB of uncompressed content, whether you upload it on its own or inside a marketplace archive.
3232
33Inside `skills/`, each skill is one folder holding a `SKILL.md` whose frontmatter `name` matches the folder name, with any reference files beside it. A bare skill archive, such as a zip of just the skill folder or a `.skill` file from Claude Desktop, is not a plugin: add the manifest and move the folder under `skills/` to convert it. For the path from writing a skill to delivering it, see [Building and deploying your own skills](/docs/government/desktop/skills.md#building-and-deploying-your-own-skills).
33Inside `skills/`, each skill is one folder holding a `SKILL.md` whose frontmatter `name` matches the folder name, with any reference files beside it. A bare skill archive, such as a zip of just the skill folder or a `.skill` file from Claude Desktop, is not a plugin: add the manifest and move the folder under `skills/` to convert it. For the path from writing a skill to delivering it, see [Building and deploying your own skills](https://claude.com/docs/government/desktop/skills.md#building-and-deploying-your-own-skills).
3434
3535In a marketplace archive, each plugin sits in its own subdirectory, and the marketplace listing points at those subdirectories. A listing entry whose source is the archive root itself, `./`, is not supported and adds nothing, so for a repository laid out as a single plugin with its own marketplace file, remove the marketplace file and upload it as one plugin.
3636
from line 38
3838
3939## Plugins that run code
4040
41The upload preview marks any plugin that declares components that can run code on the member's machine, for example hooks or an [MCP server](/docs/connectors/getting-started.md), and you confirm that you trust such a package before it is added. For a marketplace archive, one confirmation covers every marked plugin in the batch. After you add it, the plugin's row on the **Plugins** card keeps a **Runs code** marker, so you can see at a glance which of the plugins you have added contain these components.
41The upload preview marks any plugin that declares components that can run code on the member's machine, for example hooks or an [MCP server](https://claude.com/docs/connectors/getting-started.md), and you confirm that you trust such a package before it is added. For a marketplace archive, one confirmation covers every marked plugin in the batch. After you add it, the plugin's row on the **Plugins** card keeps a **Runs code** marker, so you can see at a glance which of the plugins you have added contain these components.
4242
43The marker reflects what a plugin declares. In Claude for Government, a marked plugin's hooks run on the member's machine at defined points during a session. Claude Desktop can also run a local MCP server that the plugin declares on the member's machine, or connect to a remote one. If a plugin's remote MCP server does not connect, check [**Member-added connectors**](/docs/government/config/settings.md#member-added-connectors) and the **Blocked connectors** list on the **Connectors** card.
43The marker reflects what a plugin declares. In Claude for Government, a marked plugin's hooks run on the member's machine at defined points during a session. Claude Desktop can also run a local MCP server that the plugin declares on the member's machine, or connect to a remote one. If a plugin's remote MCP server does not connect, check [**Member-added connectors**](https://claude.com/docs/government/config/settings.md#member-added-connectors) and the **Blocked connectors** list on the **Connectors** card.
4444
4545Treat the marker as a prompt to review the package yourself. You are responsible for the plugins you distribute to members, so read each plugin's contents before you upload it.
4646
4747## Install behavior
4848
49Each plugin on the **Plugins** card has an install behavior that you set when you add it and can change later on its row. **Auto-install** installs the plugin on every member's Claude Desktop without the member doing anything. **Members choose** offers the plugin to members, who install it themselves from their organization's plugins in Claude Desktop, as described in [Plugins in Claude Desktop](/docs/government/desktop/plugins.md).
49Each plugin on the **Plugins** card has an install behavior that you set when you add it and can change later on its row. **Auto-install** installs the plugin on every member's Claude Desktop without the member doing anything. **Members choose** offers the plugin to members, who install it themselves from their organization's plugins in Claude Desktop, as described in [Plugins in Claude Desktop](https://claude.com/docs/government/desktop/plugins.md).
5050
5151You do not need to push anything for a plugin to reach members. Claude Desktop syncs your organization's plugin list when it starts and periodically while it runs, so an auto-installed plugin appears on its own, and a member who already has the application open receives it at the next sync. A member can remove a plugin you installed automatically, and it stays removed on the device where they removed it.
5252
53Two switches, **Let members add plugin marketplaces** and **Let members add their own plugins**, control whether members can also add plugins of their own in Claude Desktop, as described under [Integrations](/docs/government/config/settings.md#member-added-plugins-and-marketplaces) in Available settings. Both are off by default. Plugins that members add are separate from the ones you add and do not appear on the **Plugins** card.
53Two switches, **Let members add plugin marketplaces** and **Let members add their own plugins**, control whether members can also add plugins of their own in Claude Desktop, as described under [Integrations](https://claude.com/docs/government/config/settings.md#member-added-plugins-and-marketplaces) in Available settings. Both are off by default. Plugins that members add are separate from the ones you add and do not appear on the **Plugins** card.
5454
5555## Where plugins are added
5656
57Plugins are added at the tenant or organization level. Plugins the tenant adds flow to every organization and appear on each organization's **Plugins** card under **From levels above**. A tenant administrator can lock the plugin list, which makes it read-only for organizations, following the lock behavior in [How Config works](/docs/government/config/overview.md#locks). [Group levels](/docs/government/config/overview.md#group-specific-settings) inherit the plugins of their tenant or organization, so the **Plugins** card is read-only when you view a group.
57Plugins are added at the tenant or organization level. Plugins the tenant adds flow to every organization and appear on each organization's **Plugins** card under **From levels above**. A tenant administrator can lock the plugin list, which makes it read-only for organizations, following the lock behavior in [How Config works](https://claude.com/docs/government/config/overview.md#locks). [Group levels](https://claude.com/docs/government/config/overview.md#group-specific-settings) inherit the plugins of their tenant or organization, so the **Plugins** card is read-only when you view a group.
5858
5959## Update or remove a plugin
6060
from line 64
6464
6565## Connector tool policies for members
6666
67You add and edit connectors on the **Connectors** card, and for each one you choose the products that receive it and set a policy for each of its tools. See [Connectors](/docs/government/connectors/overview.md) for the three-step wizard.
67You add and edit connectors on the **Connectors** card, and for each one you choose the products that receive it and set a policy for each of its tools. See [Connectors](https://claude.com/docs/government/connectors/overview.md) for the three-step wizard.
6868
6969On Claude Desktop, that tool policy shapes what members experience. A tool you switch off is blocked, so Claude cannot use it. A tool you switch on is available and asks the member on every use, and members are not offered a lasting approval for it. A tool you do not list is left to the member to turn on or off, and its approval prompts follow the member's own choices, which can include lasting approval.
7070
government/config/settings Changed · +32 / -32 lines
from line 4
44
55> **Who this is for:** Tenant administrators and organization owners who set product behavior for the people they manage.
66
7Find each setting on the **Config** page in the admin portal under its category in that page's sidebar. Each setting can be set at both the tenant and organization level unless noted otherwise. To set a value for a directory group, see [Group-specific settings](/docs/government/config/overview.md#group-specific-settings). For how the levels combine, what locking does, when a change reaches members, and how to compare and preview, see [How Config works](/docs/government/config/overview.md).
7Find each setting on the **Config** page in the admin portal under its category in that page's sidebar. Each setting can be set at both the tenant and organization level unless noted otherwise. To set a value for a directory group, see [Group-specific settings](https://claude.com/docs/government/config/overview.md#group-specific-settings). For how the levels combine, what locking does, when a change reaches members, and how to compare and preview, see [How Config works](https://claude.com/docs/government/config/overview.md).
88
99Where **Applies to** gives a version, earlier versions ignore the setting. The **Config** page can show settings that are not listed here.
1010
from line 20
2020| **Advanced file analysis in Chat** | Lets Claude run code in a sandbox for data analysis in Chat. Only takes effect where **Shell commands** and **Chat in Claude Desktop** are both on. Without this setting, Claude cannot read Word, Excel, or PowerPoint files that members attach in Chat. | On | Claude Desktop |
2121| **Cowork in Claude Desktop** | Lets members give Claude longer tasks, such as research, analysis, and drafting documents, which it works through on its own in Claude Desktop. Without Cowork, members cannot continue their Cowork tasks. | On | Claude Desktop |
2222| **Code in Claude Desktop** | Lets members use Claude Code inside Claude Desktop to write and run code. Without Code, members cannot open their existing Code sessions. | On | Claude Desktop |
23| **Scheduled tasks** | Lets members set up [tasks that Claude runs on a schedule](/docs/third-party/claude-desktop/configuration.md#scheduledtasksenabled). Turning it off also turns off scheduling in Claude Code, such as `/loop`. | On | Claude Desktop 2.110.0 or later, Claude Code |
24| **Claude Code** | Makes the [Claude Code command-line tool](/docs/government/deploy-claude-code/configure.md) available. | Off | Claude Code |
25| **Claude for Microsoft 365** | Makes [Claude for Microsoft 365](/docs/government/deploy-microsoft-365/configure.md), the add-in for Excel, Word, and PowerPoint, available. | Off | Claude for Microsoft 365 |
23| **Scheduled tasks** | Lets members set up [tasks that Claude runs on a schedule](https://claude.com/docs/third-party/claude-desktop/configuration.md#scheduledtasksenabled). Turning it off also turns off scheduling in Claude Code, such as `/loop`. | On | Claude Desktop 2.110.0 or later, Claude Code |
24| **Claude Code** | Makes the [Claude Code command-line tool](https://claude.com/docs/government/deploy-claude-code/configure.md) available. | Off | Claude Code |
25| **Claude for Microsoft 365** | Makes [Claude for Microsoft 365](https://claude.com/docs/government/deploy-microsoft-365/configure.md), the add-in for Excel, Word, and PowerPoint, available. | Off | Claude for Microsoft 365 |
2626
27Turning off **Claude Desktop**, **Claude Code**, or **Claude for Microsoft 365** stops the members the setting applies to from using that application. An organization cannot turn on a product that the tenant has turned off. These switches turn applications off, not accounts, and are not a security boundary: to cut one member off from everything at once, deactivate their account (see [Deactivated users](/docs/government/org-admin/users.md#deactivated-users)).
27Turning off **Claude Desktop**, **Claude Code**, or **Claude for Microsoft 365** stops the members the setting applies to from using that application. An organization cannot turn on a product that the tenant has turned off. These switches turn applications off, not accounts, and are not a security boundary: to cut one member off from everything at once, deactivate their account (see [Deactivated users](https://claude.com/docs/government/org-admin/users.md#deactivated-users)).
2828
2929The **Claude Desktop home** row appears once your agency has access to it, and it then holds the Chat, Advanced file analysis, and Cowork switches. A choice other than **Separate settings** overrides those switches, unless a level above has locked one. If you choose **Off**, keep Code turned on, or Claude Desktop has nothing to open. Under **Separate settings**, if Chat, Cowork, and Code are all turned off, Claude Desktop keeps Cowork on.
3030
from line 37
3737| **Session idle timeout** | How long a member can stay inactive before being signed out, from 15 to 5,760 minutes (96 hours). Organizations and groups can only set a shorter timeout than the tenant. | 1,440 minutes (24 hours) | All products |
3838| **Maximum session length** | The longest a member can stay signed in, even while active, before they have to sign in again, from 60 to 525,600 minutes (365 days). Each level can set or shorten the maximum but not lengthen it past what the level above allows. | No maximum | All products |
3939| [**Allowed network hosts**](#allowed-network-hosts) | A list of hostnames that tools in Claude Desktop may reach, for example to install packages or fetch web pages. | **Claude connection only** | Claude Desktop |
40| **IPv6 in the sandbox** | Lets tools in the sandbox [reach IPv6-only hosts](/docs/third-party/claude-desktop/configuration.md#coworkvmipv6enabled) through the computer's own IPv6 connection. **Allowed network hosts** still applies. | Off | Claude Desktop 1.52386.0 or later on macOS and Windows |
40| **IPv6 in the sandbox** | Lets tools in the sandbox [reach IPv6-only hosts](https://claude.com/docs/third-party/claude-desktop/configuration.md#coworkvmipv6enabled) through the computer's own IPv6 connection. **Allowed network hosts** still applies. | Off | Claude Desktop 1.52386.0 or later on macOS and Windows |
4141| [**Allowed workspace folders**](#allowed-workspace-folders) | Which folders members can pick as a project folder in Claude Desktop. | **Any folder** | Claude Desktop |
42| **Block reads outside workspace folders** | Stops Claude's file tools in Code sessions in Claude Desktop from reading files outside the session's project folder and any folders listed in **Allowed workspace folders**. Its effect on the shell commands Claude runs [differs by operating system](/docs/third-party/claude-desktop/code.md#applied-as-managed-policy). | Off | Claude Desktop 1.46388.1 or later |
42| **Block reads outside workspace folders** | Stops Claude's file tools in Code sessions in Claude Desktop from reading files outside the session's project folder and any folders listed in **Allowed workspace folders**. Its effect on the shell commands Claude runs [differs by operating system](https://claude.com/docs/third-party/claude-desktop/code.md#applied-as-managed-policy). | Off | Claude Desktop 1.46388.1 or later |
4343| **Attach files to chat**, on the **Microsoft 365 features** card | Lets members attach files to chat by picking, dragging, or pasting them. | On | Claude for Microsoft 365 |
4444| **Accept all edits**, on the **Microsoft 365 features** card | Lets members switch to **Accept all edits**, where Claude makes most edits to the open file without asking. Turning it off also turns off **Skip all permissions**. | On | Claude for Microsoft 365 |
4545| **File access rules (Microsoft 365)** | Rules that block Claude on files with chosen Microsoft sensitivity labels, or block attaching them. A rule can **Block** matching files or **Allow only matching files**. If the add-in cannot read a file's label, the file counts as blocked for every feature that has a rule covering it. | None | Claude for Microsoft 365 |
4646| **Request headers (Claude for Microsoft 365)** | Extra headers Claude for Microsoft 365 sends with each request to Claude. Each member's add-in receives them. Headers are hidden after you save them. | None | Claude for Microsoft 365 |
4747
48**Maximum session length** always counts from when the member originally signed in, so a session that is already older than the new maximum ends when it [picks up the change](/docs/government/config/overview.md#when-changes-take-effect) and the member is prompted to sign in again. Your identity provider decides whether that sign-in asks the member to authenticate again or passes them straight through.
48**Maximum session length** always counts from when the member originally signed in, so a session that is already older than the new maximum ends when it [picks up the change](https://claude.com/docs/government/config/overview.md#when-changes-take-effect) and the member is prompted to sign in again. Your identity provider decides whether that sign-in asks the member to authenticate again or passes them straight through.
4949
5050### Allowed network hosts
5151
52The list covers [web fetch and shell commands](/docs/third-party/claude-desktop/configuration.md#coworkegressallowedhosts) in Chat and Cowork, and the [sandboxed shell commands](/docs/government/security/security-and-data-handling.md#code-in-claude-desktop) of Code sessions on macOS and Linux. Web search, connectors, and the app's own connections do not use this list.
52The list covers [web fetch and shell commands](https://claude.com/docs/third-party/claude-desktop/configuration.md#coworkegressallowedhosts) in Chat and Cowork, and the [sandboxed shell commands](https://claude.com/docs/government/security/security-and-data-handling.md#code-in-claude-desktop) of Code sessions on macOS and Linux. Web search, connectors, and the app's own connections do not use this list.
5353
5454Entries are hostnames or wildcard patterns such as `*.example.com`, and match by name, not by the address a name resolves to.
5555
5656### Allowed workspace folders
5757
58Check **Block all workspace folders** to allow none, in which case Claude can still work in Chat and Cowork in folders it creates inside its own sandbox. Subfolders of a listed folder are included. The setting does not stop the shell commands Claude runs in a Code session from reading files elsewhere on the device, and [Code in Claude Desktop](/docs/government/security/security-and-data-handling.md#code-in-claude-desktop) describes what confines those commands on each operating system.
58Check **Block all workspace folders** to allow none, in which case Claude can still work in Chat and Cowork in folders it creates inside its own sandbox. Subfolders of a listed folder are included. The setting does not stop the shell commands Claude runs in a Code session from reading files elsewhere on the device, and [Code in Claude Desktop](https://claude.com/docs/government/security/security-and-data-handling.md#code-in-claude-desktop) describes what confines those commands on each operating system.
5959
6060* **Windows and Mac**: a list with only Windows entries leaves Mac users with no allowed folder, so include a Mac path as well, or one that starts with `~`, which stands for each member's home folder on both Windows and Mac.
61* **Synced folders**: on Windows, `~/Documents` refers to the local Documents folder in the user profile, not one redirected to OneDrive. For that one, use [a variable](/docs/third-party/claude-desktop/configuration.md#allowedworkspacefolders) such as `%OneDriveCommercial%` or `%OneDrive%`. For Code sessions and other work that creates many files, consider listing a local folder that is not synced, such as `~/ClaudeWork`.
61* **Synced folders**: on Windows, `~/Documents` refers to the local Documents folder in the user profile, not one redirected to OneDrive. For that one, use [a variable](https://claude.com/docs/third-party/claude-desktop/configuration.md#allowedworkspacefolders) such as `%OneDriveCommercial%` or `%OneDrive%`. For Code sessions and other work that creates many files, consider listing a local folder that is not synced, such as `~/ClaudeWork`.
6262
6363## Claude Code
6464
65Claude for Government delivers these settings to the command-line tool after a member signs in, and in Claude Desktop 2.9939.2 or later they can also reach Code sessions. While Claude Code is in [early access](/docs/government/deploy-claude-code/configure.md), the section appears once your agency has access.
65Claude for Government delivers these settings to the command-line tool after a member signs in, and in Claude Desktop 2.9939.2 or later they can also reach Code sessions. While Claude Code is in [early access](https://claude.com/docs/government/deploy-claude-code/configure.md), the section appears once your agency has access.
6666
6767| Setting | What it does | Default | Applies to |
6868| - | - | - | - |
from line 74
7474| **Minimum Claude Code version** | Claude Code below this version does not start and tells the member to update. | No minimum | Claude Code |
7575| **Maximum Claude Code version** | Claude Code above this version does not start. | No maximum | Claude Code |
7676| **Opening from the browser** | Whether Claude Code sets itself up to open from links in web pages and editors, with a prompt filled in. | **Blocked** | Claude Code |
77| **Shell command sandbox** | Lets you turn off [Claude Code's sandbox](/docs/government/security/security-and-data-handling.md#code-in-claude-desktop) for workspaces where it cannot start, such as containers. | **Claude Code default**, which leaves that to Claude Code's own settings | Claude Code |
77| **Shell command sandbox** | Lets you turn off [Claude Code's sandbox](https://claude.com/docs/government/security/security-and-data-handling.md#code-in-claude-desktop) for workspaces where it cannot start, such as containers. | **Claude Code default**, which leaves that to Claude Code's own settings | Claude Code |
7878
7979Two switches under [Integrations](#integrations) narrow **Any source**: while **Let members add plugin marketplaces** is off, members install only from the **Approved plugin sources** list, and while **Let members add their own plugins** is off, they cannot add a source of their own from a file or folder on their machine.
8080
from line 97
9797| Setting | What it does | Default | Applies to |
9898| - | - | - | - |
9999| **Claude Desktop banner** | A persistent banner shown at the top of Claude Desktop. | Off | Claude Desktop |
100| **Show the Claude for Government Web import banner** | Shows a banner on Claude Desktop's home screen inviting members to [import their conversations and projects from Claude for Government Web](/docs/government/desktop/import.md). Members see the banner only in organizations where Anthropic has enabled the import. | Off | Claude Desktop 2.9939.2 or later |
100| **Show the Claude for Government Web import banner** | Shows a banner on Claude Desktop's home screen inviting members to [import their conversations and projects from Claude for Government Web](https://claude.com/docs/government/desktop/import.md). Members see the banner only in organizations where Anthropic has enabled the import. | Off | Claude Desktop 2.9939.2 or later |
101101
102102The system-use notification shown at sign-in is separate from the **Claude Desktop banner**. It is fixed text and cannot be edited.
103103
from line 107
107107
108108| Setting | What it does | Default | Applies to |
109109| - | - | - | - |
110| **Web search** | Lets Claude search the web. Turning it on asks you to acknowledge a short description of [how search works](/docs/government/security/security-and-data-handling.md#web-search-and-web-fetch). | Off | Claude Desktop, Claude Code |
110| **Web search** | Lets Claude search the web. Turning it on asks you to acknowledge a short description of [how search works](https://claude.com/docs/government/security/security-and-data-handling.md#web-search-and-web-fetch). | Off | Claude Desktop, Claude Code |
111111| **Require approval for each search** | Asks the member to approve every search before it runs. When this is off, each member chooses whether to approve each search or allow searches automatically. | On | Claude Desktop, Claude Code |
112| **Microsoft 365** | The Microsoft 365 connector, which is separate from the Claude for Microsoft 365 add-in, lets members reach [your agency's Microsoft 365 content](/docs/government/connectors/microsoft-365.md), including SharePoint, OneDrive, Outlook, and Teams, from Claude Desktop. Each member signs in with their own Microsoft account. | Off until you enter a **Tenant ID** and **Client ID** | Claude Desktop |
113| **Connectors** | [Connectors](/docs/government/connectors/overview.md) that let Claude reach your systems. Each is defined once and applied to the products you choose. | None | All products |
112| **Microsoft 365** | The Microsoft 365 connector, which is separate from the Claude for Microsoft 365 add-in, lets members reach [your agency's Microsoft 365 content](https://claude.com/docs/government/connectors/microsoft-365.md), including SharePoint, OneDrive, Outlook, and Teams, from Claude Desktop. Each member signs in with their own Microsoft account. | Off until you enter a **Tenant ID** and **Client ID** | Claude Desktop |
113| **Connectors** | [Connectors](https://claude.com/docs/government/connectors/overview.md) that let Claude reach your systems. Each is defined once and applied to the products you choose. | None | All products |
114114| **Member-added connectors**, on the **Connectors** card | Which other connectors members can use in Claude Code, beyond web search and the ones you add: **None**, **Only these**, or **Any connector**. | **None** | Claude Code, Claude Desktop 2.2553.0 or later |
115115| **Blocked connectors**, under **Any connector** | Connectors that Claude Code does not connect. Entries by server URL also block plugins' servers in Claude Desktop. An entry by **Server name** matches [the name a connector is given](https://code.claude.com/docs/en/managed-mcp#how-servername-entries-match), not the server it reaches. | None | Claude Code, Claude Desktop 2.16120.0 or later |
116| **Plugins** | [Plugin packages](/docs/government/config/plugins-and-connectors.md) you upload and deliver to members in Claude Desktop. | None | Claude Desktop |
116| **Plugins** | [Plugin packages](https://claude.com/docs/government/config/plugins-and-connectors.md) you upload and deliver to members in Claude Desktop. | None | Claude Desktop |
117117| **Let members add plugin marketplaces** | Lets members add plugin marketplaces and install plugins from them. While it is off, it also narrows [**Plugin sources**](#plugin-sources) in Claude Code. Marketplaces that members added earlier are hidden while it is off, which needs Claude Desktop 2.16120.0 or later. | Off | Claude Desktop, Claude Code |
118118| **Let members add their own plugins** | Lets members upload plugin files or have Claude create a plugin for them. While it is off, it also narrows [**Plugin sources**](#plugin-sources) in Claude Code. Plugins that members uploaded or created earlier stay installed. | Off | Claude Desktop, Claude Code |
119119| **Let members add their own connectors** | Lets members add connectors of their own in Claude Desktop, as local MCP servers under **Settings**, then **Developer**. While the switch is off, Claude Desktop ignores connectors that members already added under **Developer**. | Off | Claude Desktop |
120| **Let members create skills** | Lets members [create or upload skills](/docs/third-party/claude-desktop/configuration.md#skillcreationenabled) of their own. Skills that members already made keep working. | On | Claude Desktop, Claude for Microsoft 365 |
120| **Let members create skills** | Lets members [create or upload skills](https://claude.com/docs/third-party/claude-desktop/configuration.md#skillcreationenabled) of their own. Skills that members already made keep working. | On | Claude Desktop, Claude for Microsoft 365 |
121121| **Web fetch** | Lets Claude fetch web pages. See [**Allowed network hosts**](#allowed-network-hosts). | On | Claude Desktop, Claude Code |
122122| **Require approval for each fetch** | Asks the member to approve every page fetch before it runs. When this is off, fetches in Chat and Cowork run without asking, and Code sessions follow [Claude Code's usual permission rules](https://code.claude.com/docs/en/permissions). | Off | Claude Desktop, Claude Code |
123123| **Shell commands** | Lets Claude run shell commands during tasks. Turning this off also turns off **Advanced file analysis in Chat**. | On | Claude Desktop, Claude Code |
124| **Require approval for each command** | In Claude Desktop, asks the member to approve every shell command before it runs. When this is off, commands [can run without asking](/docs/government/security/security-and-data-handling.md#approvals-and-auto-mode). | Off | Claude Desktop, Claude Code |
125| **Terminal panel tools** | Lets Claude run commands in the Code tab's Terminal panel in Claude Desktop. These commands [run as the user outside of Claude's sandbox](/docs/government/security/security-and-data-handling.md#code-in-claude-desktop). Turning off **Shell commands** turns these tools off as well. | On | Claude Desktop |
124| **Require approval for each command** | In Claude Desktop, asks the member to approve every shell command before it runs. When this is off, commands [can run without asking](https://claude.com/docs/government/security/security-and-data-handling.md#approvals-and-auto-mode). | Off | Claude Desktop, Claude Code |
125| **Terminal panel tools** | Lets Claude run commands in the Code tab's Terminal panel in Claude Desktop. These commands [run as the user outside of Claude's sandbox](https://claude.com/docs/government/security/security-and-data-handling.md#code-in-claude-desktop). Turning off **Shell commands** turns these tools off as well. | On | Claude Desktop |
126126| **Bypass-permissions mode** | Whether members can use the mode that skips permission prompts: bypass-permissions mode in Claude Code, **Skip all permissions** in Claude for Microsoft 365. | **Blocked** | Claude Code, Claude for Microsoft 365 |
127| **Auto mode** | Whether members can switch to [Auto mode](https://code.claude.com/docs/en/permission-modes). [Approvals and Auto mode](/docs/government/security/security-and-data-handling.md#approvals-and-auto-mode) says which sessions start in it. | **Blocked** | Claude Code, Claude Desktop |
127| **Auto mode** | Whether members can switch to [Auto mode](https://code.claude.com/docs/en/permission-modes). [Approvals and Auto mode](https://claude.com/docs/government/security/security-and-data-handling.md#approvals-and-auto-mode) says which sessions start in it. | **Blocked** | Claude Code, Claude Desktop |
128128
129129* **Member-added connectors**: in Claude Desktop it also governs connectors delivered inside plugins. A plugin's connector can connect only under **Any connector** or when listed under **Only these**.
130130* **Member-added connectors**, **Bypass-permissions mode**, and **Auto mode**: these take effect once your agency has the [**Claude Code**](#claude-code) section. In Claude for Microsoft 365, **Bypass-permissions mode** instead takes effect once your agency has the [**Microsoft 365 features**](#microsoft-365-features) card.
from line 137
137137| - | - | - | - |
138138| [**Telemetry endpoint**](#telemetry-endpoint) | The base address of your [OpenTelemetry](https://opentelemetry.io/) collector, such as `https://otel-collector.example.gov:4318`. Each product adds its own paths and sends its telemetry directly from members' devices, so the collector must be reachable from their networks. | Empty, which turns telemetry off | All products |
139139| **Telemetry headers** | Headers each product sends with every telemetry request, such as an Authorization header carrying your collector's token. Each member's app receives these headers and sends its telemetry directly, so use a credential that can only send data to your collector. | None | All products |
140| **Telemetry content capture** | [Content](/docs/third-party/claude-desktop/telemetry.md#content-capture) each product adds to the telemetry it sends to your collector: **Prompts**, **Claude's responses**, **Tool inputs**, **Tool results**, and **Full requests and responses**. Captured content goes only to your collector and is never sent to Anthropic. | No content captured | All products |
141| **Application event level (Claude Desktop)** | How much of [Claude Desktop's own event log](/docs/third-party/claude-desktop/configuration.md#otlpdesktoploglevel) is sent to your collector, in addition to usage telemetry: **Off**, **Errors only**, **Warnings and errors**, **Informational**, or **Debug**. | **Errors only** | Claude Desktop |
140| **Telemetry content capture** | [Content](https://claude.com/docs/third-party/claude-desktop/telemetry.md#content-capture) each product adds to the telemetry it sends to your collector: **Prompts**, **Claude's responses**, **Tool inputs**, **Tool results**, and **Full requests and responses**. Captured content goes only to your collector and is never sent to Anthropic. | No content captured | All products |
141| **Application event level (Claude Desktop)** | How much of [Claude Desktop's own event log](https://claude.com/docs/third-party/claude-desktop/configuration.md#otlpdesktoploglevel) is sent to your collector, in addition to usage telemetry: **Off**, **Errors only**, **Warnings and errors**, **Informational**, or **Debug**. | **Errors only** | Claude Desktop |
142142| **Telemetry resource attributes** | Labels added to every telemetry record each product sends, such as your agency or environment name, so your collector can tell where each record comes from. | Not set | All products |
143| **Telemetry traces** (beta) | Adds [traces](/docs/third-party/claude-desktop/telemetry.md#traces-beta), so that the events of one request can be followed together. Traces carry message and tool content only for the categories selected in **Telemetry content capture**. | Off | All products; Claude Desktop 1.22209.0 or later |
144| **Block automatic updates** | Stops Claude Desktop from downloading and installing updates automatically. Turn this on only if your organization distributes Claude Desktop updates itself. For devices where no member is signed in, and for Linux, see [Automatic updates](/docs/government/deploy-desktop/configure.md#automatic-updates). | Off | Claude Desktop on macOS and Windows |
145| **Restart deadline for updates** | How long a member can put off restarting Claude Desktop to install a downloaded update, from 1 to 72 hours. | [Claude Desktop's default](/docs/third-party/claude-desktop/configuration.md#autoupdaterenforcementhours) | Claude Desktop |
146| **Restart deadline for configuration changes** | How long a member can put off restarting Claude Desktop after the app detects a configuration change, from 0 to 336 hours (14 days). | [Claude Desktop's default](/docs/third-party/claude-desktop/configuration.md#relaunchenforcementhours) | Claude Desktop |
143| **Telemetry traces** (beta) | Adds [traces](https://claude.com/docs/third-party/claude-desktop/telemetry.md#traces-beta), so that the events of one request can be followed together. Traces carry message and tool content only for the categories selected in **Telemetry content capture**. | Off | All products; Claude Desktop 1.22209.0 or later |
144| **Block automatic updates** | Stops Claude Desktop from downloading and installing updates automatically. Turn this on only if your organization distributes Claude Desktop updates itself. For devices where no member is signed in, and for Linux, see [Automatic updates](https://claude.com/docs/government/deploy-desktop/configure.md#automatic-updates). | Off | Claude Desktop on macOS and Windows |
145| **Restart deadline for updates** | How long a member can put off restarting Claude Desktop to install a downloaded update, from 1 to 72 hours. | [Claude Desktop's default](https://claude.com/docs/third-party/claude-desktop/configuration.md#autoupdaterenforcementhours) | Claude Desktop |
146| **Restart deadline for configuration changes** | How long a member can put off restarting Claude Desktop after the app detects a configuration change, from 0 to 336 hours (14 days). | [Claude Desktop's default](https://claude.com/docs/third-party/claude-desktop/configuration.md#relaunchenforcementhours) | Claude Desktop |
147147
148148* **Telemetry headers**: the headers you enter replace all of the saved ones when you save, so enter every header again when you add or change one.
149149* **Telemetry content capture**: **Tool results** adds tool output only while **Telemetry traces** is on. **Full requests and responses** can carry tool output with traces on or off.
from line 152
152152
153153### Telemetry endpoint
154154
155Once a member has signed in and the app has loaded their configuration from Claude for Government, it takes its telemetry settings from that configuration alone and ignores any set on the device itself. Claude Desktop keeps working when the collector refuses requests or cannot be reached, and members see no error. For what the collector must accept, and how to confirm that telemetry is arriving, see [Collector endpoint and headers](/docs/third-party/claude-desktop/telemetry.md#collector-endpoint-and-headers). For Claude for Microsoft 365, the collector must also accept [cross-origin requests from your Claude for Government host](/docs/government/deploy-microsoft-365/configure.md#before-you-begin).
155Once a member has signed in and the app has loaded their configuration from Claude for Government, it takes its telemetry settings from that configuration alone and ignores any set on the device itself. Claude Desktop keeps working when the collector refuses requests or cannot be reached, and members see no error. For what the collector must accept, and how to confirm that telemetry is arriving, see [Collector endpoint and headers](https://claude.com/docs/third-party/claude-desktop/telemetry.md#collector-endpoint-and-headers). For Claude for Microsoft 365, the collector must also accept [cross-origin requests from your Claude for Government host](https://claude.com/docs/government/deploy-microsoft-365/configure.md#before-you-begin).
156156
157Each record [identifies the member](/docs/third-party/claude-desktop/telemetry.md#user-attribution). See what [Claude Desktop](/docs/cowork/monitoring.md#events), [Claude for Microsoft 365](/docs/office-agents/opentelemetry.md#what-the-collector-receives), and [Claude Code](https://code.claude.com/docs/en/monitoring-usage) send.
157Each record [identifies the member](https://claude.com/docs/third-party/claude-desktop/telemetry.md#user-attribution). See what [Claude Desktop](https://claude.com/docs/cowork/monitoring.md#events), [Claude for Microsoft 365](https://claude.com/docs/office-agents/opentelemetry.md#what-the-collector-receives), and [Claude Code](https://code.claude.com/docs/en/monitoring-usage) send.
158158
159159## Admin Console
160160
from line 162
162162
163163| Setting | What it does | Default | Applies to |
164164| - | - | - | - |
165| **Let organizations manage their own seat tiers** | Lets organization owners create and edit self-managed seat tiers on the [Tiers](/docs/government/org-admin/seat-tiers.md) page, in addition to the Anthropic-managed ones. When it is off, the **Reset usage limits** action on the [Users](/docs/government/org-admin/users.md) page is also unavailable. | On | Admin Console |
166| **Compliance API** | Controls whether the [Compliance API](/docs/government/org-admin/compliance-api.md) is available. When this is off, requests are refused and existing keys stay listed so you can revoke them. | On | Admin Console |
165| **Let organizations manage their own seat tiers** | Lets organization owners create and edit self-managed seat tiers on the [Tiers](https://claude.com/docs/government/org-admin/seat-tiers.md) page, in addition to the Anthropic-managed ones. When it is off, the **Reset usage limits** action on the [Users](https://claude.com/docs/government/org-admin/users.md) page is also unavailable. | On | Admin Console |
166| **Compliance API** | Controls whether the [Compliance API](https://claude.com/docs/government/org-admin/compliance-api.md) is available. When this is off, requests are refused and existing keys stay listed so you can revoke them. | On | Admin Console |
167167| **Organization Analytics connector** | Makes the Organization Analytics connector available to organization owners in Claude Desktop. When this is off, requests to it are refused. | Off | Claude Desktop |
168168
government/connectors/microsoft-365 Changed · +5 / -5 lines
from line 8
88
99Because each member signs in individually, Claude can only reach content that the signed-in member can already open in Microsoft 365. Your existing Microsoft 365 permissions, sharing rules, and Conditional Access policies apply unchanged.
1010
11Setup has two parts. First, someone with administrator access in Microsoft Entra ID registers an application in your Microsoft tenant. Then you enter that application's details on the **Microsoft 365** card on the [Config](/docs/government/org-admin/configuration.md) page.
11Setup has two parts. First, someone with administrator access in Microsoft Entra ID registers an application in your Microsoft tenant. Then you enter that application's details on the **Microsoft 365** card on the [Config](https://claude.com/docs/government/org-admin/configuration.md) page.
1212
1313## Before you start
1414
1515You need someone with the **Cloud Application Administrator**, **Application Administrator**, or **Global Administrator** role in your Microsoft Entra tenant. That person registers the application and approves the Microsoft Graph permissions for your whole tenant. If that isn't you, send them the [Register an application in Microsoft Entra](#register-an-application-in-microsoft-entra) section below; you can fill in the Config page form once they send you the two IDs.
1616
17Open the [Config](/docs/government/org-admin/configuration.md) page in another tab and find the **Microsoft 365** card. You'll paste two values from Entra into it at the end.
17Open the [Config](https://claude.com/docs/government/org-admin/configuration.md) page in another tab and find the **Microsoft 365** card. You'll paste two values from Entra into it at the end.
1818
1919## Register an application in Microsoft Entra
2020
from line 90
9090| US Government GCC-High | `login.microsoftonline.us` | `graph.microsoft.us` |
9191| US Government DoD | `login.microsoftonline.us` | `dod-graph.microsoft.us` |
9292
93Downloads of OneDrive and SharePoint files also need access to your Microsoft tenant's SharePoint and OneDrive hosts. For Office documents, see the network hosts step of [Set up the local connector](/docs/third-party/claude-desktop/connectors-m365.md#set-up-the-local-connector) in the Claude Desktop documentation.
93Downloads of OneDrive and SharePoint files also need access to your Microsoft tenant's SharePoint and OneDrive hosts. For Office documents, see the network hosts step of [Set up the local connector](https://claude.com/docs/third-party/claude-desktop/connectors-m365.md#set-up-the-local-connector) in the Claude Desktop documentation.
9494
9595No outbound access to any Anthropic host is needed for the connector's Microsoft 365 calls.
9696
9797## Configure the connector on the Config page
9898
99On the [Config](/docs/government/org-admin/configuration.md) page, expand the **Microsoft 365** card and fill in the form.
99On the [Config](https://claude.com/docs/government/org-admin/configuration.md) page, expand the **Microsoft 365** card and fill in the form.
100100
101101| Field | What to enter |
102102| - | - |
from line 194
194194## Things to know
195195
196196* Read and write permissions are separate per Microsoft 365 service. You can approve read broadly while limiting write to specific services or none at all by selecting only the permissions you want under [Choose which Microsoft 365 permissions to allow](#choose-which-microsoft-365-permissions-to-allow).
197* The **Access** selection applies to everyone who receives this connector card. There is no separate per-group write toggle inside the card. To give different groups different permissions, set the card at the group scope on the Config page; see [Group-specific settings](/docs/government/config/overview.md#group-specific-settings).
197* The **Access** selection applies to everyone who receives this connector card. There is no separate per-group write toggle inside the card. To give different groups different permissions, set the card at the group scope on the Config page; see [Group-specific settings](https://claude.com/docs/government/config/overview.md#group-specific-settings).
198198
government/connectors/overview Changed · +3 / -3 lines
from line 34
3434
3535## The Connectors card
3636
37The **Connectors** card appears on your [tenant](/docs/government/tenant-admin/configuration.md) or [organization](/docs/government/org-admin/configuration.md) Config page alongside the built-in connector cards, and on the Config page for each [directory group](/docs/government/config/overview.md#group-specific-settings). It lists the connectors added at the level you are viewing and the connectors that level inherits, with each one's name, address, the products it applies to, and a summary of how many of its tools are allowed. Click **Add connector** to open the wizard, or click the edit icon next to a connector added at this level to change it.
37The **Connectors** card appears on your [tenant](https://claude.com/docs/government/tenant-admin/configuration.md) or [organization](https://claude.com/docs/government/org-admin/configuration.md) Config page alongside the built-in connector cards, and on the Config page for each [directory group](https://claude.com/docs/government/config/overview.md#group-specific-settings). It lists the connectors added at the level you are viewing and the connectors that level inherits, with each one's name, address, the products it applies to, and a summary of how many of its tools are allowed. Click **Add connector** to open the wizard, or click the edit icon next to a connector added at this level to change it.
3838
3939An inherited connector has a badge that says where it comes from, such as **Inherited from your tenant** or **Inherited from your organization**, in place of the edit and remove controls. To change an inherited connector for the members at your level, click **Add connector** and create one with the same name. The inherited connector's details and stored secret are not copied, so you enter the server address and authentication again. Your entry then replaces the inherited one in the list and takes priority over it, as described under [Who receives a connector](#who-receives-a-connector).
4040
from line 44
4444
4545* On the tenant Config page, it reaches the members of every organization in the tenant.
4646* On an organization's Config page, it reaches every member of that organization.
47* On the Config page for a [directory group](/docs/government/config/overview.md#group-specific-settings), it reaches that group's members: in every organization when you open the group from the tenant Config page (a tenant-wide group setting), or only in one organization when you open the group from that organization's Config page (an organization group setting).
47* On the Config page for a [directory group](https://claude.com/docs/government/config/overview.md#group-specific-settings), it reaches that group's members: in every organization when you open the group from the tenant Config page (a tenant-wide group setting), or only in one organization when you open the group from that organization's Config page (an organization group setting).
4848
4949In every case it is delivered only to the products you select, with the tool policy you set.
5050
5151When the same connector name is added at more than one level, each member receives only the entry from the most specific level that applies to them: the organization's group settings first, then the organization, then the tenant-wide group settings, then the tenant. That entry replaces the others as a whole, including its address, authentication, products, and tool policy. You cannot remove a connector inherited from a level above, but you can stop it from reaching the members at your level by adding one with the same name and selecting no products under **Apply to**.
5252
53A connector added for a group does not always reach every member of the group. Someone who belongs to more than one directory group receives group settings, connectors included, from only one of them: their [highest-priority group](/docs/government/config/overview.md#when-someone-belongs-to-more-than-one-group) that has any configuration. Adding a group's first connector or deleting its last one can therefore change which group, and so which group settings, apply to some members. The group's Config page shows a note when this could happen. To check which group applies to a particular member, use the person lookup described under [Comparing settings across levels](/docs/government/config/overview.md#comparing-settings-across-levels).
53A connector added for a group does not always reach every member of the group. Someone who belongs to more than one directory group receives group settings, connectors included, from only one of them: their [highest-priority group](https://claude.com/docs/government/config/overview.md#when-someone-belongs-to-more-than-one-group) that has any configuration. Adding a group's first connector or deleting its last one can therefore change which group, and so which group settings, apply to some members. The group's Config page shows a note when this could happen. To check which group applies to a particular member, use the person lookup described under [Comparing settings across levels](https://claude.com/docs/government/config/overview.md#comparing-settings-across-levels).
5454
5555## Adding a connector
5656
government/deploy-claude-code/configure Changed · +14 / -14 lines
from line 6
66
77In Claude for Government, Claude Code is in early access. To request access for your agency, contact your Anthropic representative.
88
9A fresh install of Claude Code asks the user to sign in with a claude.ai or Claude Console account. To connect it to Claude for Government instead, each device needs a small managed settings file that sends users to your agency's Claude for Government sign-in. Everything else that governs Claude Code is set on the [Config](/docs/government/config/settings.md) page in this portal and delivered to Claude Code after the user signs in.
9A fresh install of Claude Code asks the user to sign in with a claude.ai or Claude Console account. To connect it to Claude for Government instead, each device needs a small managed settings file that sends users to your agency's Claude for Government sign-in. Everything else that governs Claude Code is set on the [Config](https://claude.com/docs/government/config/settings.md) page in this portal and delivered to Claude Code after the user signs in.
1010
11This page covers the device side: the managed settings, where to put them on each operating system, how a user signs in, and how to confirm a device is set up. Claude Code built into Claude Desktop (the **Code** tab) is configured through Claude Desktop instead, as [Connect Claude Desktop to Claude for Government](/docs/government/deploy-desktop/configure.md) describes.
11This page covers the device side: the managed settings, where to put them on each operating system, how a user signs in, and how to confirm a device is set up. Claude Code built into Claude Desktop (the **Code** tab) is configured through Claude Desktop instead, as [Connect Claude Desktop to Claude for Government](https://claude.com/docs/government/deploy-desktop/configure.md) describes.
1212
1313## Before you begin
1414
15* **Claude Code is turned on for the organization.** A tenant administrator or organization owner turns on the **Claude Code** switch under [Product availability](/docs/government/config/settings.md#product-availability) on the **Config** page. It is off by default, and while it is off Claude Code exits right after the user signs in.
16* **User accounts exist.** Claude Code signs users in to the same accounts as this portal. Each user needs a [routing rule](/docs/government/tenant-admin/identity-and-access.md) that covers them and a [seat tier](/docs/government/org-admin/seat-tiers.md) with at least one model enabled.
15* **Claude Code is turned on for the organization.** A tenant administrator or organization owner turns on the **Claude Code** switch under [Product availability](https://claude.com/docs/government/config/settings.md#product-availability) on the **Config** page. It is off by default, and while it is off Claude Code exits right after the user signs in.
16* **User accounts exist.** Claude Code signs users in to the same accounts as this portal. Each user needs a [routing rule](https://claude.com/docs/government/tenant-admin/identity-and-access.md) that covers them and a [seat tier](https://claude.com/docs/government/org-admin/seat-tiers.md) with at least one model enabled.
1717* **Claude Code is current.** This setup requires Claude Code 2.1.267 or later (`claude --version`).
18* **Claude Desktop is current.** Update Claude Desktop to [the supported version](/docs/government/deploy-desktop/configure.md#before-you-begin) before turning on Claude Code for the terminal.
19* **Devices can reach Claude for Government.** Claude Code must reach the gateway address over HTTPS on port 443, and the user's browser must reach the Claude for Government host, its sign-in service, and your agency's identity provider, the same hosts that [Claude Desktop sign-in](/docs/government/deploy-desktop/configure.md#before-you-begin) needs.
18* **Claude Desktop is current.** Update Claude Desktop to [the supported version](https://claude.com/docs/government/deploy-desktop/configure.md#before-you-begin) before turning on Claude Code for the terminal.
19* **Devices can reach Claude for Government.** Claude Code must reach the gateway address over HTTPS on port 443, and the user's browser must reach the Claude for Government host, its sign-in service, and your agency's identity provider, the same hosts that [Claude Desktop sign-in](https://claude.com/docs/government/deploy-desktop/configure.md#before-you-begin) needs.
2020* **You can place a system-level file or policy.** The settings are enforced only from a system-level location: a file in a system directory, a macOS configuration profile, or a machine-level Windows registry policy. Values for the same keys in a user's own settings cannot override them. Deliver them through your device management system or by hand with administrator rights.
2121
2222## The managed settings
from line 28
2828| `forceLoginMethod` | `"gateway"` | Required. Replaces Claude Code's sign-in choices with a single **Cloud gateway** screen. |
2929| `forceLoginGatewayUrl` | The Claude for Government gateway address | Required. The address the **Cloud gateway** screen connects to. |
3030| `env` | The eight variables shown below | Required. Keeps Claude Code's telemetry to Anthropic and its pre-sign-in background connections off from the first launch, and sets its request headers, request body fields, and certificate checking as described below. |
31| `parentSettingsBehavior` | `"merge"` | Optional. Where these managed settings govern Code sessions in Claude Desktop, `"merge"` layers Claude Desktop's own restrictions, its sandbox included, under them, as [Interaction with Claude Code's own managed settings](/docs/third-party/claude-desktop/code.md#interaction-with-claude-code%E2%80%99s-own-managed-settings) describes. |
31| `parentSettingsBehavior` | `"merge"` | Optional. Where these managed settings govern Code sessions in Claude Desktop, `"merge"` layers Claude Desktop's own restrictions, its sandbox included, under them, as [Interaction with Claude Code's own managed settings](https://claude.com/docs/third-party/claude-desktop/code.md#interaction-with-claude-code%E2%80%99s-own-managed-settings) describes. |
3232
3333As a `managed-settings.json` file:
3434
from line 50
5050}
5151```
5252
53For an agency that reaches Claude for Government on a hostname of its own, your Anthropic representative provides the address, which replaces the whole value. Otherwise, replace `<claude-for-government-host>` with the domain name you use to access Claude for Government, the host in your Claude Desktop [`bootstrapUrl`](/docs/government/deploy-desktop/configure#the-managed-setting). The address contains no credentials.
53For an agency that reaches Claude for Government on a hostname of its own, your Anthropic representative provides the address, which replaces the whole value. Otherwise, replace `<claude-for-government-host>` with the domain name you use to access Claude for Government, the host in your Claude Desktop [`bootstrapUrl`](https://claude.com/docs/government/deploy-desktop/configure#the-managed-setting). The address contains no credentials.
5454
5555### Before sign-in
5656
from line 62
6262
6363### Optional: web proxy settings in the managed settings
6464
65If your devices use a web proxy that you manage, add `HTTPS_PROXY` and `HTTP_PROXY` (the proxy's address, for example `http://proxy.example.gov:8080`) and `NO_PROXY` (your bypass list, keeping `localhost`, `127.0.0.1`, and `::1`) to the same `env` block, each under both its uppercase and lowercase name. Claude Code then uses that proxy wherever the device connects from, in place of any other proxy setting on the device. If your devices connect directly, leave these variables out rather than setting them to empty strings, because an empty value switches off a proxy a user would otherwise use. On a device that also runs Claude Desktop, Claude Desktop applies the same proxy values to the sessions it runs, as [Interaction with Claude Code managed settings](/docs/third-party/claude-desktop/network-proxy.md#interaction-with-claude-code-managed-settings) describes.
65If your devices use a web proxy that you manage, add `HTTPS_PROXY` and `HTTP_PROXY` (the proxy's address, for example `http://proxy.example.gov:8080`) and `NO_PROXY` (your bypass list, keeping `localhost`, `127.0.0.1`, and `::1`) to the same `env` block, each under both its uppercase and lowercase name. Claude Code then uses that proxy wherever the device connects from, in place of any other proxy setting on the device. If your devices connect directly, leave these variables out rather than setting them to empty strings, because an empty value switches off a proxy a user would otherwise use. On a device that also runs Claude Desktop, Claude Desktop applies the same proxy values to the sessions it runs, as [Interaction with Claude Code managed settings](https://claude.com/docs/third-party/claude-desktop/network-proxy.md#interaction-with-claude-code-managed-settings) describes.
6666
6767## Deploy the settings
6868
from line 114
114114
115115**4. Return to the terminal**
116116
117If the terminal shows **Signed in to Cloud gateway as** followed by the user's email address, the user confirms with **Yes, continue**. The terminal then shows **Connected to Cloud gateway**, and Claude Code downloads the organization's settings and restarts to apply them. If those settings include items Claude Code asks users to approve, such as a [Telemetry endpoint](/docs/government/config/settings.md#telemetry-endpoint), it shows a **Managed settings require approval** prompt the first time and whenever those settings change; **No** exits Claude Code. Unattended runs such as `claude -p` apply the settings without prompting.
117If the terminal shows **Signed in to Cloud gateway as** followed by the user's email address, the user confirms with **Yes, continue**. The terminal then shows **Connected to Cloud gateway**, and Claude Code downloads the organization's settings and restarts to apply them. If those settings include items Claude Code asks users to approve, such as a [Telemetry endpoint](https://claude.com/docs/government/config/settings.md#telemetry-endpoint), it shows a **Managed settings require approval** prompt the first time and whenever those settings change; **No** exits Claude Code. Unattended runs such as `claude -p` apply the settings without prompting.
118118
119A sign-in lasts until the organization's [Session idle timeout](/docs/government/config/settings.md#session-idle-timeout) or [Maximum session length](/docs/government/config/settings.md#maximum-session-length) is reached, and at most 30 days. It also ends when the user's account is deactivated, when an administrator signs the user out, or when the user signs in to Claude Code on more devices than Claude for Government allows at once (six), which ends the sign-in closest to expiring (see [Sessions](/docs/government/account/sessions.md#how-long-sessions-last)). Claude Code then asks the user to sign in again, which they do with `/login`.
119A sign-in lasts until the organization's [Session idle timeout](https://claude.com/docs/government/config/settings.md#session-idle-timeout) or [Maximum session length](https://claude.com/docs/government/config/settings.md#maximum-session-length) is reached, and at most 30 days. It also ends when the user's account is deactivated, when an administrator signs the user out, or when the user signs in to Claude Code on more devices than Claude for Government allows at once (six), which ends the sign-in closest to expiring (see [Sessions](https://claude.com/docs/government/account/sessions.md#how-long-sessions-last)). Claude Code then asks the user to sign in again, which they do with `/login`.
120120
121121## Confirm it worked
122122
from line 136
136136
137137**4. Check that organization settings arrived**
138138
139Change one visible Claude Code setting on the [Config](/docs/government/config/settings.md#claude-code) page for a test organization, start a new Claude Code session as a member of it, and confirm the change took effect.
139Change one visible Claude Code setting on the [Config](https://claude.com/docs/government/config/settings.md#claude-code) page for a test organization, start a new Claude Code session as a member of it, and confirm the change took effect.
140140
141141## Troubleshooting
142142
from line 147
147147| Claude Code reports that it could not resolve the gateway host, or another connection error for the address shown | The address in `forceLoginGatewayUrl` is not exactly the gateway address described under [The managed settings](#the-managed-settings), or the device cannot reach it | Correct the address, or restore the device's route to the gateway over HTTPS on port 443, then restart Claude Code |
148148| `Unable to connect to Anthropic services` at first start, before any sign-in screen | The sign-in keys did not reach Claude Code from a system-level location, or Claude Code is out of date | Update Claude Code, or check the settings location, then start it again |
149149| `claude doctor`, run before sign-in on the standard installer, reports auto-updates as enabled | The `env` block did not reach Claude Code | Compare the deployed settings with the sample above, then restart Claude Code |
150| When it starts or right after sign-in, Claude Code exits with `Cloud gateway <address> refused managed settings for this account (403): Claude Code may not be enabled for your organization` | The **Claude Code** switch is off at a level that applies to the user (tenant, organization, or directory group) | Turn on the **Claude Code** switch under [Product availability](/docs/government/config/settings.md#product-availability) at that level (at the tenant level, **Reset to default** instead lets each organization's own switch decide), then have the user start Claude Code again. [**Compare config across levels**](/docs/government/config/overview.md#comparing-settings-across-levels) on the **Config** page shows which level turns it off for a user |
150| When it starts or right after sign-in, Claude Code exits with `Cloud gateway <address> refused managed settings for this account (403): Claude Code may not be enabled for your organization` | The **Claude Code** switch is off at a level that applies to the user (tenant, organization, or directory group) | Turn on the **Claude Code** switch under [Product availability](https://claude.com/docs/government/config/settings.md#product-availability) at that level (at the tenant level, **Reset to default** instead lets each organization's own switch decide), then have the user start Claude Code again. [**Compare config across levels**](https://claude.com/docs/government/config/overview.md#comparing-settings-across-levels) on the **Config** page shows which level turns it off for a user |
151151| When it starts or right after sign-in, Claude Code exits with `Couldn't load settings from Cloud gateway <address>` | Claude Code could not reach the gateway while loading the organization's settings | Confirm the device reaches the gateway over HTTPS on port 443, then have the user start Claude Code again. If it persists on a connected device, contact your Anthropic representative |
152152| In a session that was working, every request fails with a 403 error saying Claude Code is not turned on for the organization | The **Claude Code** switch was turned off while Claude Code was running | Turn the switch back on at the level that turned it off; the next request then succeeds |
153153| Before the user has signed in, Claude Code exits with `Administrator policy requires a Cloud gateway sign-in on this machine` | A credential from earlier use is present: `ANTHROPIC_API_KEY` or `ANTHROPIC_AUTH_TOKEN` in the environment, an `apiKeyHelper` in the user's settings, or a saved Claude Console key | Remove the variable or the `apiKeyHelper` entry, or have the user run `claude auth logout`, then start `claude` and sign in |
from line 163
163163* After sign-in, the organization's settings turn off the Claude Code settings that run a helper command (`apiKeyHelper`, `proxyAuthHelper`, `awsAuthRefresh`, `awsCredentialExport`, `gcpAuthRefresh`, `otelHeadersHelper`), wherever it is set. If your devices reach the network through a proxy that needs a helper command to authenticate, raise this with your Anthropic representative before you deploy.
164164* With Claude for Government, the command-line tool has no access to Claude Code features that [require a claude.ai account](https://code.claude.com/docs/en/feature-availability#features-that-require-a-claude-subscription), such as cloud sessions, Remote Control, and routines. [Fast mode](https://code.claude.com/docs/en/fast-mode) isn't available either.
165165* With these settings Claude Code does not check for or install updates in the background. Distribute new versions through your software deployment tooling, or have users run `claude update` (standard installer) or their package manager.
166* Code sessions inside Claude Desktop sign in through Claude Desktop, not through these settings, but the `env` block applies to them too. For the other settings that govern them on a device that also has these managed settings, see [Code in Claude Desktop](/docs/government/security/security-and-data-handling.md#code-in-claude-desktop).
166* Code sessions inside Claude Desktop sign in through Claude Desktop, not through these settings, but the `env` block applies to them too. For the other settings that govern them on a device that also has these managed settings, see [Code in Claude Desktop](https://claude.com/docs/government/security/security-and-data-handling.md#code-in-claude-desktop).
167167