One read of Claude Documentationclaude-docs-20261030T180712Z
71 pages moved out of 281 read.
Pages moved
71
significant first
Pages read
281
in this capture
Captured
18:07 UTC
Corpus hash
610846466448
sitemap-lastmod
What this read moved
1-25 of 71, page 1 of 3This capture is too large to show at once. Changes 1-25 of 71 are below, significant first; the rest are on the following screens.
build/overview Changed · +5 / -5 lines
from line 13
1313
1414## Choose a starting page
1515
16> **[Build a plugin](https://claude.com/docs/plugins/build.md)**
16> [card] [Build a plugin](https://claude.com/docs/plugins/build.md)
1717>
1818> Lay out the plugin folder and manifest, write the skills, reference your MCP server, and test the plugin in Claude.
1919
20> **[Write skills](https://claude.com/docs/skills/how-to.md)**
20> [card] [Write skills](https://claude.com/docs/skills/how-to.md)
2121>
2222> Teach Claude your workflows: the SKILL.md frontmatter, the instructions, reference files, and scripts.
2323
24> **[Build an MCP server](https://claude.com/docs/connectors/building/index.md)**
24> [card] [Build an MCP server](https://claude.com/docs/connectors/building/index.md)
2525>
2626> Give the plugin access to your product or data: implement the server, set up authentication for Claude's clients, and test it.
2727
28> **[Add interactive UI](https://claude.com/docs/connectors/building/mcp-apps/getting-started.md)**
28> [card] [Add interactive UI](https://claude.com/docs/connectors/building/mcp-apps/getting-started.md)
2929>
3030> Have your MCP server show interactive components in the conversation with MCP Apps. Optional.
3131
32> **[Submit your plugin or MCP server](https://claude.com/docs/directory/publish.md)**
32> [card] [Submit your plugin or MCP server](https://claude.com/docs/directory/publish.md)
3333>
3434> List it in Anthropic's directory so anyone can add it: who can submit, what review involves, and the developer portal steps. Submit your MCP server as a connector too, even when your plugin references it.
3535
claude-science/command-line-settings Changed · +3 / -3 lines
from line 96
9696
9797## See also
9898
99> **[Run on a remote Linux server](https://claude.com/docs/claude-science/run-on-remote-linux-server.md)**
99> [card] [Run on a remote Linux server](https://claude.com/docs/claude-science/run-on-remote-linux-server.md)
100100>
101101> Install Claude Science on a server and use it from your own browser through an SSH tunnel.
102102
103> **[Configuration file reference](https://claude.com/docs/claude-science/configuration-file-reference.md)**
103> [card] [Configuration file reference](https://claude.com/docs/claude-science/configuration-file-reference.md)
104104>
105105> Find the `config.toml` file and set its network-related keys.
106106
107> **[Remote compute clusters](https://claude.com/docs/claude-science/remote-compute-clusters.md)**
107> [card] [Remote compute clusters](https://claude.com/docs/claude-science/remote-compute-clusters.md)
108108>
109109> Connect an SSH host and run jobs on it.
110110
claude-science/get-started Changed · +105 / -105 lines
from line 2
22
33> Install Claude Science on macOS, Windows, or Linux, sign in with your Claude account, and run your first analysis.
44
5Install Claude Science on your computer, sign in with your Claude account, and run your first analysis. You need a Claude Pro, Max, Team, or Enterprise plan. The [Claude Team plan for scientists](https://claude.com/programs/team-plan-for-scientists) has Claude Science on by default. On other Team and Enterprise plans, an Owner must [turn Claude Science on](https://claude.com/docs/claude-science/enable-claude-science.md) first. For what each plan includes and how usage works, see [Plans and usage](https://claude.com/docs/claude-science/overview.md#plans-and-usage).
5Install Claude Science on your computer, sign in with your Claude account, and run your first analysis. You need a Claude Pro, Max, Ultra, Team, or Enterprise plan. The [Claude Team plan for scientists](https://claude.com/programs/team-plan-for-scientists) has Claude Science on by default. On other Team and Enterprise plans, an Owner must [turn Claude Science on](https://claude.com/docs/claude-science/enable-claude-science.md) first. For what each plan includes and how usage works, see [Plans and usage](https://claude.com/docs/claude-science/overview.md#plans-and-usage).
66
77## Install
88
9**macOS**
9> [tab] macOS
10>
11> Download the installer from [claude.com/product/claude-science](https://claude.com/product/claude-science) and double-click to install. On first launch, the app sets up its runtime and starter Python and R environments, which takes a few minutes, then opens a new tab in your default browser. If no browser tab appears, click **Claude Science** in the Dock.
12>
13> **Updates.** Installing an update from inside Claude Science can switch it from a browser tab to its own window. See [Claude Science in its own window on macOS](https://claude.com/docs/claude-science/mac-app-window.md).
14>
15> * **If it opens in a browser tab**: Claude Science checks for updates in the background and shows **Update available** when one is ready. Choose **Restart to update** to install it.
16> * **If it opens in its own window**: Claude Science downloads updates by itself and installs them when you quit. To check for an update right away, choose **Claude Science > Check for App Updates…** in the menu bar.
1017
11Download the installer from [claude.com/product/claude-science](https://claude.com/product/claude-science) and double-click to install. On first launch, the app sets up its runtime and starter Python and R environments, which takes a few minutes, then opens a new tab in your default browser. If no browser tab appears, click **Claude Science** in the Dock.
18> [tab] Windows
19>
20> Download the installer from [claude.com/product/claude-science](https://claude.com/product/claude-science) and open it. It installs Claude Science for your user account, adds **Claude Science** to the Start menu and the desktop, and opens the app in its own window. The installer is signed by Anthropic, PBC. On first launch, Claude Science sets up the sandbox and downloads its app window engine (about 150 MB) from `downloads.claude.ai` before the window appears, so the first start takes longer than later ones, and a notice shows progress. The starter Python and R environments keep setting up in the background for several minutes after the window opens.
21>
22> **One-time Windows permission.** If Claude Science asks for one-time permission from Windows so that cells can run git and Command Prompt scripts and PowerShell can change folders, **Yes** lets Windows ask for approval (an administrator's password if you aren't one) and **No** leaves those features off. Python and R cells work either way, and the **Ask Windows now** button under **Settings** > **Permissions** grants the permission later.
23>
24> **Notification-area icon.** Closing the window leaves Claude Science running, with an icon in the notification area of the taskbar. Click the icon to reopen the window, or choose **Quit Claude Science** from the icon's menu to stop the app.
25>
26> **Updates.** Claude Science checks for updates in the background and shows **Update available** when one is ready; choose **Restart to update** to install it. Administrators who distribute the app themselves can turn the background check off with `auto_update = false` under `[update]` in `config.toml` (see [Manage Claude Science on devices](https://claude.com/docs/claude-science/manage-on-devices.md#deploy-configuration-with-device-management)). To update Claude Science yourself instead, open a newer installer, which upgrades the installed copy in place and keeps your data.
27>
28> **Uninstall.** To remove the app, follow the Windows steps in [Uninstall Claude Science](#uninstall-claude-science).
29>
30> **Corporate networks.** Claude Science follows the proxy configured in Windows proxy settings and trusts corporate root certificates installed for the whole computer, so most managed PCs need no Claude Science configuration. See [Use Claude Science on a corporate network](https://claude.com/docs/claude-science/corporate-networks.md).
31>
32> **Differences on Windows:**
33>
34> * Claude runs shell commands with PowerShell. Command Prompt scripts, git inside cells, and folder changes in PowerShell need the one-time Windows permission.
35> * Only folders on local NTFS or ReFS drives can be granted, not network shares, mapped network drives, FAT or exFAT drives (many USB sticks and memory cards), or a whole drive such as `D:\`. Copy such files to a local folder or attach them in the chat.
36> * [Custom connectors](https://claude.com/docs/claude-science/custom-connectors.md) that run a local command start with `npx`, `node`, `python`, or the full path of a program. Connectors launched through `npm` or a `.cmd`, `.bat`, or `.ps1` file aren't supported.
37> * The **Model endpoints** section of **Settings** > **Compute** (NVIDIA BioNeMo NIM) isn't available.
38>
39> **Linux version under WSL.** To use Claude Science from a Linux environment on your Windows computer, run the Linux command-line version under Windows Subsystem for Linux (WSL 2, not WSL 1) with Ubuntu 24.04 or later. The Windows app itself doesn't need WSL. Inside the Ubuntu terminal, follow the install steps in the Linux tab, then start Claude Science with `claude-science serve --port 8765 --no-browser` and open the printed link, which starts with `http://127.0.0.1:8765`, in a Windows browser. Projects you create there stay in WSL, and the Windows app keeps its own.
40>
41> If Claude Science under WSL shows one of these errors or problems, use the matching fix:
42>
43> * `daemon already running`: Claude Science is already running. Run `claude-science url` to print a fresh link, and open it in a Windows browser.
44> * `port 8765 is already in use`: another program, or another copy of Claude Science, has that port. Start with a different one, for example `--port 8080`.
45> * The link stops working: check that Claude Science is still running with `claude-science status`. If it's still running, run `claude-science url` for a fresh link and open it in a Windows browser. Claude Science stops when WSL shuts down, for example after `wsl --shutdown`. Start it again by running `claude-science serve --port 8765 --no-browser` in the Ubuntu terminal.
46> * An SSH host can't be added: under WSL, Claude Science reads the SSH settings in Ubuntu's `~/.ssh`, not the ones in Windows. Copy the host's entry from `C:\Users\<you>\.ssh\config`, and its key file, into Ubuntu's `~/.ssh` folder, then run `chmod 600` on them.
47> * `The database is on /mnt/*`: Claude Science's data folder is on a Windows drive, which it can't use under WSL. Move the folder into your Ubuntu home folder, such as the default `~/.claude-science`, and if you set `data_dir` or `--data-dir`, point it there. If you use a folder other than the default, choose a new, empty one, because Claude Science can delete files in that folder that it didn't create.
1248
13**Updates.** Installing an update from inside Claude Science can switch it from a browser tab to its own window. See [Claude Science in its own window on macOS](https://claude.com/docs/claude-science/mac-app-window.md).
49> [tab] Linux
50>
51> Install the sandbox dependencies, then run the installer. The sandbox needs bubblewrap 0.8.0 or later and socat, and installing them for the whole system takes administrator (root or `sudo`) access. Claude Science runs them from system folders such as `/usr/bin` and `/usr/local/bin` and doesn't search your PATH. If you don't have administrator access, ask your system administrator to install them, or [approve a copy of your own](https://claude.com/docs/claude-science/run-on-remote-linux-server.md#approve-your-own-copy-of-bubblewrap-or-socat), such as one from conda.
52>
53> * Ubuntu or Debian: `sudo apt-get update && sudo apt-get install -y curl bubblewrap socat`
54> * Fedora or RHEL: `sudo dnf install -y curl bubblewrap socat`
55> * Arch: `sudo pacman -S curl bubblewrap socat`
56>
57> Ubuntu 24.04's repositories carry a new enough bubblewrap and Ubuntu 22.04's don't; on any distribution, confirm with `/usr/bin/bwrap --version` that the installed version is 0.8.0 or later before you start Claude Science.
58>
59> ```bash theme={null}
60> curl -fsSL https://claude.ai/install-claude-science.sh | bash
61> ```
62>
63> ```bash theme={null}
64> claude-science serve
65> ```
66>
67> First launch prints a local URL right away, then continues setting up its starter Python and R environments. To run Claude Science on a remote server and use it from your computer, see [Run on a remote Linux server](https://claude.com/docs/claude-science/run-on-remote-linux-server.md).
1468
15* **If it opens in a browser tab**: Claude Science checks for updates in the background and shows **Update available** when one is ready. Choose **Restart to update** to install it.
16* **If it opens in its own window**: Claude Science downloads updates by itself and installs them when you quit. To check for an update right away, choose **Claude Science > Check for App Updates…** in the menu bar.
17
18**Windows**
19
20Download the installer from [claude.com/product/claude-science](https://claude.com/product/claude-science) and open it. It installs Claude Science for your user account, adds **Claude Science** to the Start menu and the desktop, and opens the app in its own window. The installer is signed by Anthropic, PBC. On first launch, Claude Science sets up the sandbox and downloads its app window engine (about 150 MB) from `downloads.claude.ai` before the window appears, so the first start takes longer than later ones, and a notice shows progress. The starter Python and R environments keep setting up in the background for several minutes after the window opens.
21
22**One-time Windows permission.** If Claude Science asks for one-time permission from Windows so that cells can run git and Command Prompt scripts and PowerShell can change folders, **Yes** lets Windows ask for approval (an administrator's password if you aren't one) and **No** leaves those features off. Python and R cells work either way, and the **Ask Windows now** button under **Settings** > **Permissions** grants the permission later.
23
24**Notification-area icon.** Closing the window leaves Claude Science running, with an icon in the notification area of the taskbar. Click the icon to reopen the window, or choose **Quit Claude Science** from the icon's menu to stop the app.
25
26**Updates.** Claude Science checks for updates in the background and shows **Update available** when one is ready; choose **Restart to update** to install it. Administrators who distribute the app themselves can turn the background check off with `auto_update = false` under `[update]` in `config.toml` (see [Manage Claude Science on devices](https://claude.com/docs/claude-science/manage-on-devices.md#deploy-configuration-with-device-management)). To update Claude Science yourself instead, open a newer installer, which upgrades the installed copy in place and keeps your data.
27
28**Uninstall.** To remove the app, follow the Windows steps in [Uninstall Claude Science](#uninstall-claude-science).
29
30**Corporate networks.** Claude Science follows the proxy configured in Windows proxy settings and trusts corporate root certificates installed for the whole computer, so most managed PCs need no Claude Science configuration. See [Use Claude Science on a corporate network](https://claude.com/docs/claude-science/corporate-networks.md).
31
32**Differences on Windows:**
33
34* Claude runs shell commands with PowerShell. Command Prompt scripts, git inside cells, and folder changes in PowerShell need the one-time Windows permission.
35* Only folders on local NTFS or ReFS drives can be granted, not network shares, mapped network drives, FAT or exFAT drives (many USB sticks and memory cards), or a whole drive such as `D:\`. Copy such files to a local folder or attach them in the chat.
36* [Custom connectors](https://claude.com/docs/claude-science/custom-connectors.md) that run a local command start with `npx`, `node`, `python`, or the full path of a program. Connectors launched through `npm` or a `.cmd`, `.bat`, or `.ps1` file aren't supported.
37* The **Model endpoints** section of **Settings** > **Compute** (NVIDIA BioNeMo NIM) isn't available.
38
39**Linux version under WSL.** To use Claude Science from a Linux environment on your Windows computer, run the Linux command-line version under Windows Subsystem for Linux (WSL 2, not WSL 1) with Ubuntu 24.04 or later. The Windows app itself doesn't need WSL. Inside the Ubuntu terminal, follow the install steps in the Linux tab, then start Claude Science with `claude-science serve --port 8765 --no-browser` and open the printed link, which starts with `http://127.0.0.1:8765`, in a Windows browser. Projects you create there stay in WSL, and the Windows app keeps its own.
40
41If Claude Science under WSL shows one of these errors or problems, use the matching fix:
42
43* `daemon already running`: Claude Science is already running. Run `claude-science url` to print a fresh link, and open it in a Windows browser.
44* `port 8765 is already in use`: another program, or another copy of Claude Science, has that port. Start with a different one, for example `--port 8080`.
45* The link stops working: check that Claude Science is still running with `claude-science status`. If it's still running, run `claude-science url` for a fresh link and open it in a Windows browser. Claude Science stops when WSL shuts down, for example after `wsl --shutdown`. Start it again by running `claude-science serve --port 8765 --no-browser` in the Ubuntu terminal.
46* An SSH host can't be added: under WSL, Claude Science reads the SSH settings in Ubuntu's `~/.ssh`, not the ones in Windows. Copy the host's entry from `C:\Users\<you>\.ssh\config`, and its key file, into Ubuntu's `~/.ssh` folder, then run `chmod 600` on them.
47* `The database is on /mnt/*`: Claude Science's data folder is on a Windows drive, which it can't use under WSL. Move the folder into your Ubuntu home folder, such as the default `~/.claude-science`, and if you set `data_dir` or `--data-dir`, point it there. If you use a folder other than the default, choose a new, empty one, because Claude Science can delete files in that folder that it didn't create.
48
49**Linux**
50
51Install the sandbox dependencies, then run the installer. The sandbox needs bubblewrap 0.8.0 or later and socat, and installing them for the whole system takes administrator (root or `sudo`) access. Claude Science runs them from system folders such as `/usr/bin` and `/usr/local/bin` and doesn't search your PATH. If you don't have administrator access, ask your system administrator to install them, or [approve a copy of your own](https://claude.com/docs/claude-science/run-on-remote-linux-server.md#approve-your-own-copy-of-bubblewrap-or-socat), such as one from conda.
52
53* Ubuntu or Debian: `sudo apt-get update && sudo apt-get install -y curl bubblewrap socat`
54* Fedora or RHEL: `sudo dnf install -y curl bubblewrap socat`
55* Arch: `sudo pacman -S curl bubblewrap socat`
56
57Ubuntu 24.04's repositories carry a new enough bubblewrap and Ubuntu 22.04's don't; on any distribution, confirm with `/usr/bin/bwrap --version` that the installed version is 0.8.0 or later before you start Claude Science.
58
59```bash theme={null}
60curl -fsSL https://claude.ai/install-claude-science.sh | bash
61```
62
63```bash theme={null}
64claude-science serve
65```
66
67First launch prints a local URL right away, then continues setting up its starter Python and R environments. To run Claude Science on a remote server and use it from your computer, see [Run on a remote Linux server](https://claude.com/docs/claude-science/run-on-remote-linux-server.md).
68
6969To update Claude Science later, or when it asks you to update, see [Update Claude Science](https://claude.com/docs/claude-science/update-claude-science.md).
7070
7171> [!NOTE]
from line 111
111111>
112112> Files in the folders you granted Claude access to aren't affected unless they're inside the folder that **Data location** shows.
113113
114**macOS**
114> [tab] macOS
115>
116> **1. Quit Claude Science**
117>
118> In the Dock, Control-click the **Claude Science** icon and choose **Quit**. If you started Claude Science from Terminal with `claude-science serve`, also run `claude-science stop`.
119>
120> **2. Move the application to the Trash**
121>
122> In Finder, open the **Applications** folder and move **Claude Science** to the Trash. If **Claude Science** isn't there, look in the **Applications** folder inside your home folder.
123>
124> **3. Remove the Terminal command**
125>
126> The app also adds a `claude-science` command for Terminal. Remove it with `rm ~/.local/bin/claude-science`.
127>
128> To remove your data as well, delete the `~/.claude-science` folder. If Claude Science opened in its own window, also delete `~/Library/Application Support/Claude Science`, which holds that window's own settings and stored data.
115129
116**1. Quit Claude Science**
130> [tab] Windows
131>
132> **1. Quit Claude Science**
133>
134> Right-click the Claude Science icon in the notification area of the taskbar and choose **Quit Claude Science**. The uninstaller doesn't run while the app is running.
135>
136> **2. Uninstall the app**
137>
138> In Windows **Settings**, go to **Apps > Installed apps** and uninstall **Claude Science**, or run `claude-science uninstall` in a terminal.
139>
140> To remove the app and your data together, use `claude-science uninstall --purge` instead. It deletes the whole folder your data location points to, including anything you stored there yourself, so move those files out first.
141>
142> When your data location isn't `%USERPROFILE%\.claude-science`, `--purge` leaves that folder in place. It still holds your environments and your sign-in, and it can also hold projects from before that location was set. To remove those too, delete `%USERPROFILE%\.claude-science` yourself.
117143
118In the Dock, Control-click the **Claude Science** icon and choose **Quit**. If you started Claude Science from Terminal with `claude-science serve`, also run `claude-science stop`.
119
120**2. Move the application to the Trash**
121
122In Finder, open the **Applications** folder and move **Claude Science** to the Trash. If **Claude Science** isn't there, look in the **Applications** folder inside your home folder.
123
124**3. Remove the Terminal command**
125
126The app also adds a `claude-science` command for Terminal. Remove it with `rm ~/.local/bin/claude-science`.
127
128To remove your data as well, delete the `~/.claude-science` folder. If Claude Science opened in its own window, also delete `~/Library/Application Support/Claude Science`, which holds that window's own settings and stored data.
129
130**Windows**
131
132**1. Quit Claude Science**
133
134Right-click the Claude Science icon in the notification area of the taskbar and choose **Quit Claude Science**. The uninstaller doesn't run while the app is running.
135
136**2. Uninstall the app**
137
138In Windows **Settings**, go to **Apps > Installed apps** and uninstall **Claude Science**, or run `claude-science uninstall` in a terminal.
139
140To remove the app and your data together, use `claude-science uninstall --purge` instead. It deletes the whole folder your data location points to, including anything you stored there yourself, so move those files out first.
141
142When your data location isn't `%USERPROFILE%\.claude-science`, `--purge` leaves that folder in place. It still holds your environments and your sign-in, and it can also hold projects from before that location was set. To remove those too, delete `%USERPROFILE%\.claude-science` yourself.
143
144**Linux**
145
146For the Linux version under Windows Subsystem for Linux (WSL), run these commands in the Ubuntu terminal.
147
148**1. Stop Claude Science**
149
150```bash theme={null}
151claude-science stop
152```
153
154**2. Delete the command**
155
156```bash theme={null}
157rm ~/.local/bin/claude-science
158```
159
160If you installed it somewhere else, `command -v claude-science` shows where.
161
162To remove your data as well, delete the `~/.claude-science` folder.
144> [tab] Linux
145>
146> For the Linux version under Windows Subsystem for Linux (WSL), run these commands in the Ubuntu terminal.
147>
148> **1. Stop Claude Science**
149>
150> ```bash theme={null}
151> claude-science stop
152> ```
153>
154> **2. Delete the command**
155>
156> ```bash theme={null}
157> rm ~/.local/bin/claude-science
158> ```
159>
160> If you installed it somewhere else, `command -v claude-science` shows where.
161>
162> To remove your data as well, delete the `~/.claude-science` folder.
163163
164164To reinstall, follow [Install](#install) again. Installing doesn't replace an existing data folder.
165165
claude-science/overview Changed · +3 / -3 lines
from line 26
2626
2727## Requirements
2828
29* A Claude account on a Pro, Max, Team, or Enterprise plan. The [Claude Team plan for scientists](https://claude.com/programs/team-plan-for-scientists) has Claude Science on by default. On other Team and Enterprise plans, an Owner must [enable Claude Science for the organization](https://claude.com/docs/claude-science/enable-claude-science.md) first.
29* A Claude account on a Pro, Max, Ultra, Team, or Enterprise plan. The [Claude Team plan for scientists](https://claude.com/programs/team-plan-for-scientists) has Claude Science on by default. On other Team and Enterprise plans, an Owner must [enable Claude Science for the organization](https://claude.com/docs/claude-science/enable-claude-science.md) first.
3030* A country or region where Anthropic offers claude.ai. See [Supported countries and regions](https://www.anthropic.com/supported-countries).
3131* macOS 13 or later (Apple silicon or Intel), Windows 11 (x64), or Linux x64 on a glibc-based distribution.
3232* About 5 GB of free disk space for the runtime and starter environments.
from line 34
3434
3535## Plans and usage
3636
37Claude Science is included in Pro, Max, Team, and Enterprise plans, with nothing separate to buy. Team and Enterprise Owners control whether Claude Science is available to their members through [an admin setting](https://claude.com/docs/claude-science/enable-claude-science.md). Claude Science isn't available on the Free plan. Scientists at academic and nonprofit research institutions can also get it through the discounted [Claude Team plan for scientists](https://claude.com/programs/team-plan-for-scientists).
37Claude Science is included in Pro, Max, Ultra, Team, and Enterprise plans, with nothing separate to buy. Team and Enterprise Owners control whether Claude Science is available to their members through [an admin setting](https://claude.com/docs/claude-science/enable-claude-science.md). Claude Science isn't available on the Free plan. Scientists at academic and nonprofit research institutions can also get it through the discounted [Claude Team plan for scientists](https://claude.com/programs/team-plan-for-scientists).
3838
3939Your Claude Science usage counts toward the same usage limits as the rest of your Claude plan, including Claude Code and Cowork. In Claude Science, **Settings > Usage** shows how much you've used and when each limit resets.
4040
4141You pay more than your plan's price only in these cases:
4242
43* **Usage credits and extra usage.** On Pro and Max plans, you can turn on usage credits in your claude.ai settings to keep working past your limits. You can then turn off usage credits or change your monthly spend limit under **Settings > Usage** in Claude Science. Team plans call the same option extra usage, and your admin turns it on. In Claude Science it appears as **Usage credits**, but only Pro and Max plans can change it there. On Team and Enterprise plans, your admin sets spend limits. Some models need usage credits on some plans, and [Claude pricing](https://claude.com/pricing) lists which models each plan includes.
43* **Usage credits and extra usage.** On Pro, Max, and Ultra plans, you can turn on usage credits in your claude.ai settings to keep working past your limits. You can then turn off usage credits or change your monthly spend limit under **Settings > Usage** in Claude Science. Team plans call the same option extra usage, and your admin turns it on. In Claude Science it appears as **Usage credits**, but only Pro, Max, and Ultra plans can change it there. On Team and Enterprise plans, your admin sets spend limits. Some models need usage credits on some plans, and [Claude pricing](https://claude.com/pricing) lists which models each plan includes.
4444* **Usage-based Enterprise plans.** Instead of fixed usage limits, your organization pays for usage on top of the seat price, within the spend limits your admin sets.
4545* **Services you connect with your own account.** Services such as [Modal](https://claude.com/docs/claude-science/compute-providers.md) bill you directly. Anthropic doesn't bill for them.
4646
claude-tag/admins/setup-overview Changed · +4 / -4 lines
from line 19
1919
2020When you've launched, [give Claude access to your tools](#give-claude-access-to-your-tools) and [verify your setup](#verify-your-setup).
2121
22> **Before you start: check that you have what setup needs**
22> [accordion] Before you start: check that you have what setup needs
2323>
2424> | Prerequisite | Why you need it | If you don't have it |
2525> | :- | :- | :- |
26> | A **Team or Enterprise plan** on claude.ai | Claude Tag is available on Team and Enterprise plans, on Anthropic's first-party service. It isn't available on individual plans (Free, Pro, or Max), or for third-party deployments. | Start a Team or Enterprise plan at [claude.com/pricing](https://claude.com/pricing) |
26> | A **Team or Enterprise plan** on claude.ai | Claude Tag is available on Team and Enterprise plans, on Anthropic's first-party service. It isn't available on individual plans (Free, Pro, Max, or Ultra), or for third-party deployments. | Start a Team or Enterprise plan at [claude.com/pricing](https://claude.com/pricing) |
2727> | A Claude organization **without Zero Data Retention (ZDR), customer-managed encryption (CMEK), or the HIPAA configuration for Claude Code (local mode) and Cowork (local mode)** | Claude Tag stores channel memory and session transcripts, which ZDR doesn't permit. A CMEK policy and the HIPAA configuration don't allow Claude Tag either. | Claude Tag isn't available to organizations with any of these. See [Healthcare organizations](https://claude.com/docs/claude-tag/admins/healthcare.md#plan-and-organization-requirements) |
2828> | **Routines** enabled for your Claude organization | Until it is, Claude answers every mention and DM with a reply that it's unavailable and does no work. | An admin turns on [**Admin settings > Capabilities > Remote sessions > Routines**](https://claude.ai/admin-settings/capabilities) |
2929> | **Owner** role in the Claude organization you're setting up | Setup pairs a workspace and turns Claude Tag on, and only an Owner can do either. Roles are per organization, so being an Owner elsewhere doesn't carry over. | Ask an Owner to run setup, or have one promote you at [`claude.ai/admin-settings/members`](https://claude.ai/admin-settings/members) |
from line 81
8181
8282After launch, people can tag Claude in any channel it has joined. To keep Claude to certain channels, see [Limit Claude Tag to specific channels](https://claude.com/docs/claude-tag/admins/restrict-access.md#limit-claude-tag-to-specific-channels).
8383
84> **If you're not the Slack workspace admin**
84> [accordion] If you're not the Slack workspace admin
8585>
8686> Only a Slack workspace admin can run `@Claude connect`, and in most workspaces only an admin can install the app. If that's not you, send the Slack admin the message below and have them return the pairing code:
8787>
from line 89
8989> Please install the Claude app (https://claude.com/claude-for-slack) in [workspace]. When that's done, let me know a time that works for the next part: in any channel, run /invite @Claude, then post "@Claude connect" with no other text and send me the code it returns. Pick a channel that belongs to just [workspace]. The code expires 15 minutes after Claude posts it, so I'll redeem it right away. What it can access: https://claude.com/docs/claude-tag/admins/for-slack-admins
9090> ```
9191
92> **If your Slack is on Enterprise Grid**
92> [accordion] If your Slack is on Enterprise Grid
9393>
9494> When a Slack Org Owner or Org Admin sends `@Claude connect`, the reply includes two codes. One begins `workspace_` and pairs only the workspace the admin sent the command in, and one begins `enterprise_` and pairs the whole Grid. Paste the `enterprise_` code. See [Pair an Enterprise Grid](https://claude.com/docs/claude-tag/admins/workspaces.md#pair-an-enterprise-grid).
9595
claude-tag/overview Changed · +5 / -5 lines
from line 31
3131
3232## Plans that include Claude Tag
3333
34Claude Tag is available on Team and Enterprise plans, on Anthropic's first-party service. It isn't available on individual plans (Free, Pro, or Max), or for third-party deployments. To use it, your organization pairs its Slack workspace with its Claude organization; see [the setup overview](https://claude.com/docs/claude-tag/admins/setup-overview) for the full prerequisites.
34Claude Tag is available on Team and Enterprise plans, on Anthropic's first-party service. It isn't available on individual plans (Free, Pro, Max, or Ultra), or for third-party deployments. To use it, your organization pairs its Slack workspace with its Claude organization; see [the setup overview](https://claude.com/docs/claude-tag/admins/setup-overview) for the full prerequisites.
3535
3636If you're choosing between Claude products for Slack-shaped work, [how Claude Tag differs from Cowork and Claude Code](https://claude.com/docs/claude-tag/concepts/how-it-works.md#how-claude-tag-differs-from-cowork-and-claude-code) compares them directly: team work in shared channels is Claude Tag; personal work on your own files is Cowork or Claude Code.
3737
from line 146
146146
147147## Where to start with Claude Tag
148148
149> **[Set up Claude Tag](https://claude.com/docs/claude-tag/admins/setup-overview)**
149> [card] [Set up Claude Tag](https://claude.com/docs/claude-tag/admins/setup-overview)
150150>
151151> Admins: pair your Slack workspace and launch
152152
153> **[Hand Claude Tag your first task](https://claude.com/docs/claude-tag/users/getting-started.md)**
153> [card] [Hand Claude Tag your first task](https://claude.com/docs/claude-tag/users/getting-started.md)
154154>
155155> It's already in your channel: send your first message
156156
157> **[How Claude Tag works](https://claude.com/docs/claude-tag/concepts/how-it-works.md)**
157> [card] [How Claude Tag works](https://claude.com/docs/claude-tag/concepts/how-it-works.md)
158158>
159159> The session model, what it can read, and how memory follows places
160160
161> **[Use case library](https://claude.com/docs/claude-tag/users/use-cases.md)**
161> [card] [Use case library](https://claude.com/docs/claude-tag/users/use-cases.md)
162162>
163163> Prompts to paste, by team and connection
164164
claude-tag/users/use-cases/answer-data-questions Changed · +3 / -3 lines
from line 52
5252
5353## Related resources
5454
55> **[Watch monitors and alerts](https://claude.com/docs/claude-tag/users/use-cases/watch-monitors.md)**
55> [card] [Watch monitors and alerts](https://claude.com/docs/claude-tag/users/use-cases/watch-monitors.md)
5656>
5757> When the question is about systems, not metrics
5858
59> **[Set up routines](https://claude.com/docs/claude-tag/users/proactivity.md)**
59> [card] [Set up routines](https://claude.com/docs/claude-tag/users/proactivity.md)
6060>
6161> Recurring reports
6262
63> **[Self-service data analytics](https://claude.com/blog/self-service-data-analytics-in-slack-how-anthropic-deploys-claude-tag-for-ad-hoc-questions)**
63> [card] [Self-service data analytics](https://claude.com/blog/self-service-data-analytics-in-slack-how-anthropic-deploys-claude-tag-for-ad-hoc-questions)
6464>
6565> How Anthropic answers ad-hoc data questions in Slack with Claude
6666
claude-tag/users/use-cases/watch-monitors Changed · +4 / -4 lines
from line 56
5656
5757## Related resources
5858
59> **[Fix bugs](https://claude.com/docs/claude-tag/users/use-cases/fix-bugs.md)**
59> [card] [Fix bugs](https://claude.com/docs/claude-tag/users/use-cases/fix-bugs.md)
6060>
6161> When the investigation should end in a pull request
6262
63> **[Set up routines](https://claude.com/docs/claude-tag/users/proactivity.md)**
63> [card] [Set up routines](https://claude.com/docs/claude-tag/users/proactivity.md)
6464>
6565> Schedules and event triggers
6666
67> **[Claude on call](https://claude.com/blog/ai-ci-cd-on-call)**
67> [card] [Claude on call](https://claude.com/blog/ai-ci-cd-on-call)
6868>
6969> How Anthropic runs Claude as first responder for CI/CD failures
7070
71> **[On-call kit](https://github.com/anthropics/oncall-kit)**
71> [card] [On-call kit](https://github.com/anthropics/oncall-kit)
7272>
7373> Reference playbooks, templates, and guided setup for an on-call channel
7474
connectors/custom/add-unlisted Changed · +2 / -2 lines
### On a Free, Pro, Max, or Ultra plan ### On a Free, Pro, or Max plan
from line 20
2020
2121| You have | Use | Works in |
2222| - | - | - |
23| The URL of a remote MCP server | [Add a connector by URL](#add-a-connector-by-url) | Free, Pro, Max, Team, and Enterprise plans |
23| The URL of a remote MCP server | [Add a connector by URL](#add-a-connector-by-url) | Free, Pro, Max, Ultra, Team, and Enterprise plans |
2424| A desktop extension | [Install a local connector in the desktop app](#install-a-local-connector-in-the-desktop-app) | The Claude desktop app, signed in to claude.ai |
2525
2626## Add a connector by URL
from line 75
7575
7676Click **Connect** to authenticate.
7777
78### On a Free, Pro, or Max plan
78### On a Free, Pro, Max, or Ultra plan
7979
8080You add custom connectors to your own account. On the Free plan, you can add one custom connector.
8181
connectors/github/index Changed · +56 / -56 lines
from line 14
1414
1515You can add repository content to a single conversation, or to a [project](https://support.claude.com/en/articles/9517075-what-are-projects), a workspace in Claude where a set of chats share the same background documents. Choose the tab below for where you want the content available.
1616
17**In a chat**
17> [tab] In a chat
18>
19> In a chat, the **Add from GitHub** option appears only after your GitHub account is connected to Claude. To connect your GitHub account, follow these steps:
20>
21> 1. Go to [**Customize > Connectors**](https://claude.ai/customize/connectors).
22> 2. Select **GitHub Integration**.
23> 3. Select **Connect**.
24>
25> After your GitHub account is connected, add a repository to a chat:
26>
27> **1. Open the add menu**
28>
29> In the conversation, select **+** at the lower left of the message box.
30>
31> **2. Choose GitHub**
32>
33> Select **Add from GitHub**.
34>
35> **3. Pick a repository**
36>
37> Search the repositories you have access to, or paste a repository URL.
38>
39> **4. Add the repository**
40>
41> Select **Add repository**. Claude adds the repository's URL to your message.
42>
43> **5. Send your message**
44>
45> Send your question.
1846
19In a chat, the **Add from GitHub** option appears only after your GitHub account is connected to Claude. To connect your GitHub account, follow these steps:
20
211. Go to [**Customize > Connectors**](https://claude.ai/customize/connectors).
222. Select **GitHub Integration**.
233. Select **Connect**.
24
25After your GitHub account is connected, add a repository to a chat:
26
27**1. Open the add menu**
28
29In the conversation, select **+** at the lower left of the message box.
30
31**2. Choose GitHub**
32
33Select **Add from GitHub**.
34
35**3. Pick a repository**
36
37Search the repositories you have access to, or paste a repository URL.
38
39**4. Add the repository**
40
41Select **Add repository**. Claude adds the repository's URL to your message.
42
43**5. Send your message**
44
45Send your question.
46
47**In a project**
48
49You can add repository content only to a private project, one you haven't shared with other people. In a shared project, the **GitHub** option is dimmed and shows **Only accessible from private projects**.
50
51If your GitHub account isn't connected to Claude yet, selecting **GitHub** sends you to GitHub to sign in before you continue.
52
53**1. Open project knowledge**
54
55Open the project and, in its project knowledge section, select **+**.
56
57**2. Choose GitHub**
58
59Select **GitHub**.
60
61**3. Pick a repository**
62
63Search the repositories you have access to, or paste a repository URL.
64
65**4. Select files and folders**
66
67Use the file browser to select the files and folders you want Claude to read.
68
69**5. Add the files**
70
71Select **Add files**.
72
73The selected content is added to the project's knowledge.
47> [tab] In a project
48>
49> You can add repository content only to a private project, one you haven't shared with other people. In a shared project, the **GitHub** option is dimmed and shows **Only accessible from private projects**.
50>
51> If your GitHub account isn't connected to Claude yet, selecting **GitHub** sends you to GitHub to sign in before you continue.
52>
53> **1. Open project knowledge**
54>
55> Open the project and, in its project knowledge section, select **+**.
56>
57> **2. Choose GitHub**
58>
59> Select **GitHub**.
60>
61> **3. Pick a repository**
62>
63> Search the repositories you have access to, or paste a repository URL.
64>
65> **4. Select files and folders**
66>
67> Use the file browser to select the files and folders you want Claude to read.
68>
69> **5. Add the files**
70>
71> Select **Add files**.
72>
73> The selected content is added to the project's knowledge.
7474
7575## Grant Claude access to a private repository
7676
connectors/google/drive Changed · +34 / -34 lines
from line 53
5353
5454Besides letting Claude search on its own, you can pick specific Drive files yourself. A file you pick is attached to the conversation, or added to a [project](https://support.claude.com/en/articles/9517075-what-are-projects)'s knowledge so every chat in that project can use it. The picker lists your Google Docs, Sheets, and Slides.
5555
56**In a chat**
56> [tab] In a chat
57>
58> **1. Open the add menu**
59>
60> In the conversation, select **+** at the lower left of the message box.
61>
62> **2. Choose Google Drive**
63>
64> Select **Add from Google Drive**.
65>
66> **3. Pick a file**
67>
68> Search for the file by name, or select it from the list.
69>
70> **4. Send your message**
71>
72> Write your question and send it. Claude reads the file's current content from Drive each time you send a message, so later edits in Drive reach Claude too.
5773
58**1. Open the add menu**
59
60In the conversation, select **+** at the lower left of the message box.
61
62**2. Choose Google Drive**
63
64Select **Add from Google Drive**.
65
66**3. Pick a file**
67
68Search for the file by name, or select it from the list.
69
70**4. Send your message**
71
72Write your question and send it. Claude reads the file's current content from Drive each time you send a message, so later edits in Drive reach Claude too.
73
74**In a project**
75
76You can add Drive files only to a private project, one you haven't shared with other people. In a shared project, the **Google Drive** option is dimmed and shows **Only accessible from private projects**. To add a file to a private project's knowledge:
77
78**1. Open the add menu**
79
80Open the project and, in its knowledge section, select **Add files**.
81
82**2. Choose Google Drive**
83
84Select **Google Drive**.
85
86**3. Pick a file**
87
88Search for the file, paste its Google Drive URL, or select it from the list.
89
90The file appears in the project's knowledge and is available to Claude in every chat in that project. Its content refreshes from Drive periodically when you open the project.
74> [tab] In a project
75>
76> You can add Drive files only to a private project, one you haven't shared with other people. In a shared project, the **Google Drive** option is dimmed and shows **Only accessible from private projects**. To add a file to a private project's knowledge:
77>
78> **1. Open the add menu**
79>
80> Open the project and, in its knowledge section, select **Add files**.
81>
82> **2. Choose Google Drive**
83>
84> Select **Google Drive**.
85>
86> **3. Pick a file**
87>
88> Search for the file, paste its Google Drive URL, or select it from the list.
89>
90> The file appears in the project's knowledge and is available to Claude in every chat in that project. Its content refreshes from Drive periodically when you open the project.
9191
9292Claude receives a text version of each file you add this way:
9393
connectors/mcp-tunnels/setup Changed · +280 / -280 lines
The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.
from line 34
3434
3535Both the Helm and Docker Compose paths need at least one route. A route maps a subdomain of your tunnel domain to the internal URL of an MCP server, in the form `scheme://host:port` with no path. The examples use `docs` pointing at `http://docs-mcp.example.corp:8080`. Replace them with your own servers.
3636
37**Helm**
38
39**1. Fetch the default values**
40
41```bash theme={null}
42helm show values \
43 oci://us-docker.pkg.dev/anthropic-public-registry/charts/mcp-tunnel \
44 --version 2.1.0 > values.yaml
45```
46
47The file includes comments explaining each field.
48
49**2. Configure routes**
50
51Edit `values.yaml` and add a `routes` entry under `gateway.config` for each MCP server. Leave `tunnel.id` empty so the setup component creates the tunnel during install.
52
53```yaml values.yaml theme={null}
54tunnel:
55 id: ""
56 # Increment to rotate the tunnel token on a later upgrade.
57 tokenVersion: "1"
58
59gateway:
60 config:
61 routes:
62 docs: http://docs-mcp.example.corp:8080
63 search: http://10.0.12.7:9000
64```
65
66With these routes, Claude reaches the servers at `docs.<your-tunnel-domain>` and `search.<your-tunnel-domain>`. If a route targets an address outside the RFC 1918 private ranges (some managed Kubernetes distributions allocate Service IPs elsewhere), add the range under `gateway.config.upstream.allowed_ips` as described in [Troubleshooting](https://claude.com/docs/connectors/mcp-tunnels/troubleshooting.md#proxy-logs-ip-validation-failed).
67
68**3. Review the rendered manifests**
69
70Render the chart with a placeholder key and review the output according to your organization's practices for third-party manifests. Rendering makes no API calls.
71
72```bash theme={null}
73helm template mcp-tunnel \
74 oci://us-docker.pkg.dev/anthropic-public-registry/charts/mcp-tunnel \
75 --version 2.1.0 \
76 -n mcp-tunnel \
77 -f values.yaml \
78 --set api.token=placeholder > rendered.yaml
79```
80
81**4. Install**
82
83Read the Tunnels API key into an environment variable so it stays out of your shell history and values file, then install into a dedicated namespace.
84
85```bash theme={null}
86# Paste the Tunnels API key (input is hidden)
87read -rs API_TOKEN && export API_TOKEN
88
89helm install mcp-tunnel \
90 oci://us-docker.pkg.dev/anthropic-public-registry/charts/mcp-tunnel \
91 --version 2.1.0 \
92 --namespace mcp-tunnel --create-namespace \
93 -f values.yaml \
94 --set api.token="$API_TOKEN"
95```
96
97The setup component runs as a pre-install hook, so `helm install` blocks until the tunnel is created, the CA is registered, and the credentials are stored in the `mcp-tunnel` Secret. If the install fails with a hook error, see [Troubleshooting](https://claude.com/docs/connectors/mcp-tunnels/troubleshooting.md#helm-install-fails-with-a-hook-error).
98
99> [!WARNING]
100>
101> Revoke the Tunnels API key in **Organization settings > Tunnels > Tunnels API** as soon as the install completes. Helm records `--set` values in its release history Secrets, and Kubernetes Secrets are not encrypted at rest by default, so the key remains recoverable from the cluster until you revoke it.
102
103**5. Read the tunnel domain**
104
105You need the tunnel domain to add connectors later.
106
107```bash theme={null}
108kubectl -n mcp-tunnel get secret mcp-tunnel \
109 -o jsonpath='{.data.tunnel-domain}' | base64 -d
110```
111
112The value looks like `abc123.tunnel.anthropic.com`.
113
114To restrict the pod's egress at the network level, set `networkPolicy.enabled: true` in `values.yaml` and list your MCP servers under `networkPolicy.mcpServers`. The policy already allows cloudflared to reach the tunnel edge. Your cluster's network plugin must support NetworkPolicy.
115
116For later configuration changes such as routes or replica count, edit `values.yaml` and run `helm upgrade` with the same `--version` and `-f values.yaml`, without the API key. Keep a complete `values.yaml` rather than relying on `--reuse-values`, because Helm's deep merge can silently keep a route you deleted.
117
118**Docker Compose**
119
120**1. Prepare the deployment directory**
121
122```bash theme={null}
123mkdir -p mcp-tunnel/{config,data}
124cd mcp-tunnel
125sudo chown 65532:65532 data
126```
127
128The containers run as the non-root user ID `65532` and need write access to `data/`.
129
130**2. Write docker-compose.yaml**
131
132The compose file pins images by digest, runs every container as non-root with a read-only filesystem, drops all Linux capabilities, and disables privilege escalation.
133
134```bash theme={null}
135cat > docker-compose.yaml <<'EOF'
136services:
137 # One-time provisioning. Run with: docker compose run --rm setup
138 setup:
139 image: us-docker.pkg.dev/anthropic-public-registry/images/mcp-proxy@sha256:d243d30642d39857a0579e465cb3b9bf3ae7c1141e83143bb6856777a31467a5
140 entrypoint: ["/setup"]
141 command:
142 - init
143 - --api-url=https://api.anthropic.com
144 - --output=dir:/data
145 - --token-version=1
146 environment:
147 - API_TOKEN
148 volumes:
149 - ./data:/data
150 user: "65532:65532"
151 read_only: true
152 security_opt:
153 - no-new-privileges:true
154 cap_drop:
155 - ALL
156 profiles: ["setup"]
157
158 cloudflared:
159 image: cloudflare/cloudflared@sha256:0e56c13c7058fcef9c4f0e7d83372f82330548dbf8f8b366f3d8b506526d93b2
160 command: tunnel --no-autoupdate run --url http://localhost:8080
161 environment:
162 - TUNNEL_TOKEN
163 # Share the proxy's network namespace so localhost:8080 reaches it.
164 network_mode: "service:mcp-proxy"
165 restart: unless-stopped
166 user: "65532:65532"
167 read_only: true
168 security_opt:
169 - no-new-privileges:true
170 cap_drop:
171 - ALL
172 stop_grace_period: 30s
173 logging:
174 options:
175 max-size: "10m"
176 max-file: "3"
177
178 mcp-proxy:
179 image: us-docker.pkg.dev/anthropic-public-registry/images/mcp-proxy@sha256:d243d30642d39857a0579e465cb3b9bf3ae7c1141e83143bb6856777a31467a5
180 volumes:
181 - ./config/mcp-proxy.yaml:/etc/mcp-gateway/config.yaml:ro
182 - ./data:/data:ro
183 restart: unless-stopped
184 user: "65532:65532"
185 read_only: true
186 security_opt:
187 - no-new-privileges:true
188 cap_drop:
189 - ALL
190 # Match shutdown_timeout in the proxy config
191 stop_grace_period: 30s
192 logging:
193 options:
194 max-size: "10m"
195 max-file: "3"
196EOF
197```
198
199**3. Provision the tunnel**
200
201Read the Tunnels API key into an environment variable, then run the setup component. It creates the tunnel, generates the CA and server certificate, registers the CA with Anthropic, fetches the tunnel token, and writes everything to `data/`.
202
203```bash theme={null}
204# Paste the Tunnels API key (input is hidden)
205read -rs API_TOKEN && export API_TOKEN
206
207docker compose run --rm setup
208```
209
210Read the tunnel domain and keep it for later steps.
211
212```bash theme={null}
213export TUNNEL_DOMAIN=$(sudo cat data/tunnel-domain)
214echo "$TUNNEL_DOMAIN"
215```
216
217> [!WARNING]
218>
219> Revoke the Tunnels API key in **Organization settings > Tunnels > Tunnels API** before continuing, and run `unset API_TOKEN`. The stack does not need the key at runtime.
220
221**4. Write the proxy config**
222
223`tunnel_domain` is required so the proxy can strip the domain from incoming hostnames and look up the remaining subdomain in `routes`. `routes` is a map, not a list.
224
225```bash theme={null}
226cat > config/mcp-proxy.yaml <<EOF
227listen_addr: ":8080"
228log_level: info
229shutdown_timeout: 30s
230tunnel_domain: ${TUNNEL_DOMAIN}
231tls:
232 cert_file: /data/tls.crt
233 key_file: /data/tls.key
234routes:
235 docs: http://docs-mcp.example.corp:8080
236 search: http://10.0.12.7:9000
237upstream:
238 allowed_ips:
239 - 10.0.0.0/8
240EOF
241```
242
243`upstream.allowed_ips` is the proxy's protection against server-side request forgery. Use the narrowest ranges that cover your MCP servers. Setting it replaces the RFC 1918 default rather than extending it.
244
245**5. Start the stack**
246
247```bash theme={null}
248export TUNNEL_TOKEN=$(sudo cat data/tunnel-token)
249docker compose up -d
250```
251
252The compose file reads `TUNNEL_TOKEN` from the host environment with no default, so repeat the export in every fresh shell and after a reboot. For a multi-host deployment, copy the `mcp-tunnel/` directory to each host and start it the same way. The same tunnel token and certificates work across all replicas.
253
254The `data/` directory now holds the tunnel ID, tunnel domain, tunnel token, CA key pair, and server key pair. Protect it with your organization's file-permission, encryption-at-rest, and secrets-management controls, and consider moving `ca.key` and `tunnel-token` to secure storage.
37> [tab] Helm
38>
39> **1. Fetch the default values**
40>
41> ```bash theme={null}
42> helm show values \
43> oci://us-docker.pkg.dev/anthropic-public-registry/charts/mcp-tunnel \
44> --version 2.1.0 > values.yaml
45> ```
46>
47> The file includes comments explaining each field.
48>
49> **2. Configure routes**
50>
51> Edit `values.yaml` and add a `routes` entry under `gateway.config` for each MCP server. Leave `tunnel.id` empty so the setup component creates the tunnel during install.
52>
53> ```yaml values.yaml theme={null}
54> tunnel:
55> id: ""
56> # Increment to rotate the tunnel token on a later upgrade.
57> tokenVersion: "1"
58>
59> gateway:
60> config:
61> routes:
62> docs: http://docs-mcp.example.corp:8080
63> search: http://10.0.12.7:9000
64> ```
65>
66> With these routes, Claude reaches the servers at `docs.<your-tunnel-domain>` and `search.<your-tunnel-domain>`. If a route targets an address outside the RFC 1918 private ranges (some managed Kubernetes distributions allocate Service IPs elsewhere), add the range under `gateway.config.upstream.allowed_ips` as described in [Troubleshooting](https://claude.com/docs/connectors/mcp-tunnels/troubleshooting.md#proxy-logs-ip-validation-failed).
67>
68> **3. Review the rendered manifests**
69>
70> Render the chart with a placeholder key and review the output according to your organization's practices for third-party manifests. Rendering makes no API calls.
71>
72> ```bash theme={null}
73> helm template mcp-tunnel \
74> oci://us-docker.pkg.dev/anthropic-public-registry/charts/mcp-tunnel \
75> --version 2.1.0 \
76> -n mcp-tunnel \
77> -f values.yaml \
78> --set api.token=placeholder > rendered.yaml
79> ```
80>
81> **4. Install**
82>
83> Read the Tunnels API key into an environment variable so it stays out of your shell history and values file, then install into a dedicated namespace.
84>
85> ```bash theme={null}
86> # Paste the Tunnels API key (input is hidden)
87> read -rs API_TOKEN && export API_TOKEN
88>
89> helm install mcp-tunnel \
90> oci://us-docker.pkg.dev/anthropic-public-registry/charts/mcp-tunnel \
91> --version 2.1.0 \
92> --namespace mcp-tunnel --create-namespace \
93> -f values.yaml \
94> --set api.token="$API_TOKEN"
95> ```
96>
97> The setup component runs as a pre-install hook, so `helm install` blocks until the tunnel is created, the CA is registered, and the credentials are stored in the `mcp-tunnel` Secret. If the install fails with a hook error, see [Troubleshooting](https://claude.com/docs/connectors/mcp-tunnels/troubleshooting.md#helm-install-fails-with-a-hook-error).
98>
99> > [!WARNING]
100> >
101> > Revoke the Tunnels API key in **Organization settings > Tunnels > Tunnels API** as soon as the install completes. Helm records `--set` values in its release history Secrets, and Kubernetes Secrets are not encrypted at rest by default, so the key remains recoverable from the cluster until you revoke it.
102>
103> **5. Read the tunnel domain**
104>
105> You need the tunnel domain to add connectors later.
106>
107> ```bash theme={null}
108> kubectl -n mcp-tunnel get secret mcp-tunnel \
109> -o jsonpath='{.data.tunnel-domain}' | base64 -d
110> ```
111>
112> The value looks like `abc123.tunnel.anthropic.com`.
113>
114> To restrict the pod's egress at the network level, set `networkPolicy.enabled: true` in `values.yaml` and list your MCP servers under `networkPolicy.mcpServers`. The policy already allows cloudflared to reach the tunnel edge. Your cluster's network plugin must support NetworkPolicy.
115>
116> For later configuration changes such as routes or replica count, edit `values.yaml` and run `helm upgrade` with the same `--version` and `-f values.yaml`, without the API key. Keep a complete `values.yaml` rather than relying on `--reuse-values`, because Helm's deep merge can silently keep a route you deleted.
117
118> [tab] Docker Compose
119>
120> **1. Prepare the deployment directory**
121>
122> ```bash theme={null}
123> mkdir -p mcp-tunnel/{config,data}
124> cd mcp-tunnel
125> sudo chown 65532:65532 data
126> ```
127>
128> The containers run as the non-root user ID `65532` and need write access to `data/`.
129>
130> **2. Write docker-compose.yaml**
131>
132> The compose file pins images by digest, runs every container as non-root with a read-only filesystem, drops all Linux capabilities, and disables privilege escalation.
133>
134> ```bash theme={null}
135> cat > docker-compose.yaml <<'EOF'
136> services:
137> # One-time provisioning. Run with: docker compose run --rm setup
138> setup:
139> image: us-docker.pkg.dev/anthropic-public-registry/images/mcp-proxy@sha256:d243d30642d39857a0579e465cb3b9bf3ae7c1141e83143bb6856777a31467a5
140> entrypoint: ["/setup"]
141> command:
142> - init
143> - --api-url=https://api.anthropic.com
144> - --output=dir:/data
145> - --token-version=1
146> environment:
147> - API_TOKEN
148> volumes:
149> - ./data:/data
150> user: "65532:65532"
151> read_only: true
152> security_opt:
153> - no-new-privileges:true
154> cap_drop:
155> - ALL
156> profiles: ["setup"]
157>
158> cloudflared:
159> image: cloudflare/cloudflared@sha256:0e56c13c7058fcef9c4f0e7d83372f82330548dbf8f8b366f3d8b506526d93b2
160> command: tunnel --no-autoupdate run --url http://localhost:8080
161> environment:
162> - TUNNEL_TOKEN
163> # Share the proxy's network namespace so localhost:8080 reaches it.
164> network_mode: "service:mcp-proxy"
165> restart: unless-stopped
166> user: "65532:65532"
167> read_only: true
168> security_opt:
169> - no-new-privileges:true
170> cap_drop:
171> - ALL
172> stop_grace_period: 30s
173> logging:
174> options:
175> max-size: "10m"
176> max-file: "3"
177>
178> mcp-proxy:
179> image: us-docker.pkg.dev/anthropic-public-registry/images/mcp-proxy@sha256:d243d30642d39857a0579e465cb3b9bf3ae7c1141e83143bb6856777a31467a5
180> volumes:
181> - ./config/mcp-proxy.yaml:/etc/mcp-gateway/config.yaml:ro
182> - ./data:/data:ro
183> restart: unless-stopped
184> user: "65532:65532"
185> read_only: true
186> security_opt:
187> - no-new-privileges:true
188> cap_drop:
189> - ALL
190> # Match shutdown_timeout in the proxy config
191> stop_grace_period: 30s
192> logging:
193> options:
194> max-size: "10m"
195> max-file: "3"
196> EOF
197> ```
198>
199> **3. Provision the tunnel**
200>
201> Read the Tunnels API key into an environment variable, then run the setup component. It creates the tunnel, generates the CA and server certificate, registers the CA with Anthropic, fetches the tunnel token, and writes everything to `data/`.
202>
203> ```bash theme={null}
204> # Paste the Tunnels API key (input is hidden)
205> read -rs API_TOKEN && export API_TOKEN
206>
207> docker compose run --rm setup
208> ```
209>
210> Read the tunnel domain and keep it for later steps.
211>
212> ```bash theme={null}
213> export TUNNEL_DOMAIN=$(sudo cat data/tunnel-domain)
214> echo "$TUNNEL_DOMAIN"
215> ```
216>
217> > [!WARNING]
218> >
219> > Revoke the Tunnels API key in **Organization settings > Tunnels > Tunnels API** before continuing, and run `unset API_TOKEN`. The stack does not need the key at runtime.
220>
221> **4. Write the proxy config**
222>
223> `tunnel_domain` is required so the proxy can strip the domain from incoming hostnames and look up the remaining subdomain in `routes`. `routes` is a map, not a list.
224>
225> ```bash theme={null}
226> cat > config/mcp-proxy.yaml <<EOF
227> listen_addr: ":8080"
228> log_level: info
229> shutdown_timeout: 30s
230> tunnel_domain: ${TUNNEL_DOMAIN}
231> tls:
232> cert_file: /data/tls.crt
233> key_file: /data/tls.key
234> routes:
235> docs: http://docs-mcp.example.corp:8080
236> search: http://10.0.12.7:9000
237> upstream:
238> allowed_ips:
239> - 10.0.0.0/8
240> EOF
241> ```
242>
243> `upstream.allowed_ips` is the proxy's protection against server-side request forgery. Use the narrowest ranges that cover your MCP servers. Setting it replaces the RFC 1918 default rather than extending it.
244>
245> **5. Start the stack**
246>
247> ```bash theme={null}
248> export TUNNEL_TOKEN=$(sudo cat data/tunnel-token)
249> docker compose up -d
250> ```
251>
252> The compose file reads `TUNNEL_TOKEN` from the host environment with no default, so repeat the export in every fresh shell and after a reboot. For a multi-host deployment, copy the `mcp-tunnel/` directory to each host and start it the same way. The same tunnel token and certificates work across all replicas.
253>
254> The `data/` directory now holds the tunnel ID, tunnel domain, tunnel token, CA key pair, and server key pair. Protect it with your organization's file-permission, encryption-at-rest, and secrets-management controls, and consider moving `ca.key` and `tunnel-token` to secure storage.
255255
256256## Verify the connection
257257
from line 337
337337
338338The tunnel token authenticates cloudflared's outbound connection. Rotate it on your regular schedule and immediately if you suspect exposure. Rotation does not sever connections that are already established, so you can rotate, restart cloudflared with the new value, and let the old connections drain.
339339
340**Helm**
341
342**1. Increment the token version**
343
344Increment `tunnel.tokenVersion` in `values.yaml`.
345
346**2. Create a Tunnels API key**
347
348Create a fresh Tunnels API key.
349
350**3. Upgrade**
351
352Upgrade. The setup component re-runs, rotates the token, and updates the Secret.
353
354```bash theme={null}
355read -rs API_TOKEN && export API_TOKEN
356
357helm upgrade mcp-tunnel \
358 oci://us-docker.pkg.dev/anthropic-public-registry/charts/mcp-tunnel \
359 --version 2.1.0 \
360 -n mcp-tunnel \
361 -f values.yaml \
362 --set api.token="$API_TOKEN" \
363 --set setup.force=true
364```
365
366Revoke the API key once the upgrade completes.
367
368**Docker Compose**
369
370**1. Increment the token version**
371
372Edit `docker-compose.yaml` and increment the `--token-version` value in the `setup` service (for example from `1` to `2`), so the new value persists for future runs.
373
374**2. Create a Tunnels API key**
375
376Create a fresh Tunnels API key.
377
378**3. Re-run setup**
379
380Re-run setup, then restart cloudflared with the new token:
381
382```bash theme={null}
383read -rs API_TOKEN && export API_TOKEN
384docker compose run --rm setup
385
386export TUNNEL_TOKEN=$(sudo cat data/tunnel-token)
387docker compose up -d cloudflared
388```
389
390Revoke the API key and run `unset API_TOKEN` once rotation completes. For a multi-host deployment, setup writes the new token only to the `data/` directory on the host where it ran, so copy the updated `data/` directory (at minimum `data/tunnel-token`) to every other host that runs a replica. Then repeat the last two commands on each of those hosts so every replica restarts with the new token.
340> [tab] Helm
341>
342> **1. Increment the token version**
343>
344> Increment `tunnel.tokenVersion` in `values.yaml`.
345>
346> **2. Create a Tunnels API key**
347>
348> Create a fresh Tunnels API key.
349>
350> **3. Upgrade**
351>
352> Upgrade. The setup component re-runs, rotates the token, and updates the Secret.
353>
354> ```bash theme={null}
355> read -rs API_TOKEN && export API_TOKEN
356>
357> helm upgrade mcp-tunnel \
358> oci://us-docker.pkg.dev/anthropic-public-registry/charts/mcp-tunnel \
359> --version 2.1.0 \
360> -n mcp-tunnel \
361> -f values.yaml \
362> --set api.token="$API_TOKEN" \
363> --set setup.force=true
364> ```
365>
366> Revoke the API key once the upgrade completes.
367
368> [tab] Docker Compose
369>
370> **1. Increment the token version**
371>
372> Edit `docker-compose.yaml` and increment the `--token-version` value in the `setup` service (for example from `1` to `2`), so the new value persists for future runs.
373>
374> **2. Create a Tunnels API key**
375>
376> Create a fresh Tunnels API key.
377>
378> **3. Re-run setup**
379>
380> Re-run setup, then restart cloudflared with the new token:
381>
382> ```bash theme={null}
383> read -rs API_TOKEN && export API_TOKEN
384> docker compose run --rm setup
385>
386> export TUNNEL_TOKEN=$(sudo cat data/tunnel-token)
387> docker compose up -d cloudflared
388> ```
389>
390> Revoke the API key and run `unset API_TOKEN` once rotation completes. For a multi-host deployment, setup writes the new token only to the `data/` directory on the host where it ran, so copy the updated `data/` directory (at minimum `data/tunnel-token`) to every other host that runs a replica. Then repeat the last two commands on each of those hosts so every replica restarts with the new token.
391391
392392### Renew the server certificate
393393
394394The server certificate the proxy presents is valid for 90 days, and you are responsible for renewing it before it expires. Renewal is local. It signs a new certificate with the CA already stored in your deployment, makes no API calls, and needs no API key. The proxy reloads the certificate file automatically, so no restart is required.
395395
396**Helm**
397
398The chart deploys a CronJob that runs daily and renews the certificate once it is within 30 days of expiry. Monitor the CronJob and the certificate's expiry date to confirm renewal completes.
399
400**Docker Compose**
401
402Run the renewal from the deployment directory. With `--renew-before=720h` the command does nothing while more than 30 days of validity remain, so it is safe to run on a schedule such as a daily cron entry.
403
404```bash theme={null}
405docker compose run --rm setup renew-cert --output=dir:/data --renew-before=720h
406```
396> [tab] Helm
397>
398> The chart deploys a CronJob that runs daily and renews the certificate once it is within 30 days of expiry. Monitor the CronJob and the certificate's expiry date to confirm renewal completes.
399
400> [tab] Docker Compose
401>
402> Run the renewal from the deployment directory. With `--renew-before=720h` the command does nothing while more than 30 days of validity remain, so it is safe to run on a schedule such as a daily cron entry.
403>
404> ```bash theme={null}
405> docker compose run --rm setup renew-cert --output=dir:/data --renew-before=720h
406> ```
407407
408408## Remove a tunnel
409409
410410
connectors/microsoft/365 Changed · +5 / -5 lines
from line 2
22
33> Connect SharePoint, OneDrive, Outlook, and Teams to Claude so it can search, analyze, and act on your Microsoft 365 information
44
5The Microsoft 365 connector lets Claude search, analyze, and act on information across SharePoint, OneDrive, Outlook, and Teams, using the access your own Microsoft 365 account already has. It's available on every Claude plan: Free, Pro, Max, Team, and Enterprise. It requires a work or school Microsoft account, and a Microsoft Entra Global Administrator must grant tenant consent for your Microsoft organization.
5The Microsoft 365 connector lets Claude search, analyze, and act on information across SharePoint, OneDrive, Outlook, and Teams, using the access your own Microsoft 365 account already has. It's available on every Claude plan: Free, Pro, Max, Ultra, Team, and Enterprise. It requires a work or school Microsoft account, and a Microsoft Entra Global Administrator must grant tenant consent for your Microsoft organization.
66
77By the end of this page you have the connector set up for your organization and your own account connected, and you have asked Claude a first question that draws on Microsoft 365.
88
from line 26
2626
2727What you do first depends on your Claude plan:
2828
29* **Free, Pro, and Max**: there's no organization-level step in Claude. Skip to [Connect your account](#connect-your-account). A Microsoft Entra Global Administrator still needs to grant tenant consent for your Microsoft organization
29* **Free, Pro, Max, and Ultra**: there's no organization-level step in Claude. Skip to [Connect your account](#connect-your-account). A Microsoft Entra Global Administrator still needs to grant tenant consent for your Microsoft organization
3030* **Team and Enterprise**: a Claude Owner or Primary Owner [adds the connector for the organization](#add-the-connector-for-your-organization) first, and then each member connects their account
3131
3232### Prerequisites
from line 149
149149
150150If something isn't working, start with the case that matches what you see.
151151
152> **Authentication failures**
152> [accordion] Authentication failures
153153>
154154> If sign-in fails, work through these checks:
155155>
from line 158
158158> * Review your organization's third-party app policies
159159> * Try a different browser, or clear cookies and cache and sign in again
160160
161> **Documents not found**
161> [accordion] Documents not found
162162>
163163> If Claude can't find a document you know exists:
164164>
from line 167
167167> * Wait and retry for recently uploaded documents, which can take time to index
168168> * Name the specific SharePoint site, or search by the exact filename
169169
170> **Incomplete search results**
170> [accordion] Incomplete search results
171171>
172172> If results are partial or miss what you expected:
173173>
connectors/slack/index Changed · +32 / -32 lines
from line 24
2424
2525A Slack admin adds the app to the workspace first, and then each person connects their own Claude account.
2626
27**Slack admins**
27> [tab] Slack admins
28>
29> **1. Find the app**
30>
31> Open the Claude app's listing in the Slack App Marketplace.
32>
33> **2. Add the app to Slack**
34>
35> Select **Add to Slack**, then review and approve the app for your organization.
36>
37> **3. Choose where to deploy**
38>
39> Deploy the app org-wide or to specific workspaces.
40>
41> To add the app to more workspaces later, open your Slack management workspace, go to **Integrations > Installed apps > Add to more workspaces**, and turn on each workspace that should have it.
2842
29**1. Find the app**
30
31Open the Claude app's listing in the Slack App Marketplace.
32
33**2. Add the app to Slack**
34
35Select **Add to Slack**, then review and approve the app for your organization.
36
37**3. Choose where to deploy**
38
39Deploy the app org-wide or to specific workspaces.
40
41To add the app to more workspaces later, open your Slack management workspace, go to **Integrations > Installed apps > Add to more workspaces**, and turn on each workspace that should have it.
42
43**Individual users**
44
45**1. Find Claude**
46
47Find **Claude** in your Slack apps list or in the Slack App Marketplace.
48
49**2. Connect your account**
50
51Select **Connect Account**, select your Claude organization, and then select **Authorize** to grant access.
52
53**3. Start a conversation**
54
55Return to Slack and select **+ New Chat**, or mention @Claude in a channel or thread.
56
57If your company's Slack requires admin approval and you aren't an admin, you see a **Request to install** prompt instead. Ask a Slack admin to approve the app, then connect.
58
59To pin Claude to your Slack header, open the app's three-dot menu in Slack and select **Add this app to header**.
43> [tab] Individual users
44>
45> **1. Find Claude**
46>
47> Find **Claude** in your Slack apps list or in the Slack App Marketplace.
48>
49> **2. Connect your account**
50>
51> Select **Connect Account**, select your Claude organization, and then select **Authorize** to grant access.
52>
53> **3. Start a conversation**
54>
55> Return to Slack and select **+ New Chat**, or mention @Claude in a channel or thread.
56>
57> If your company's Slack requires admin approval and you aren't an admin, you see a **Request to install** prompt instead. Ask a Slack admin to approve the app, then connect.
58>
59> To pin Claude to your Slack header, open the app's three-dot menu in Slack and select **Add this app to header**.
6060
6161## Search Slack with the connector
6262
cowork/hipaa-setup Changed · +44 / -44 lines
from line 68
6868
6969The following sample sets four keys that you could add to the Claude Desktop policy your organization deploys. If your organization doesn't deploy one yet, [Enterprise configuration](https://support.claude.com/en/articles/12622667-enterprise-configuration) explains how to deliver a policy with your device management tool.
7070
71**macOS**
71> [tab] macOS
72>
73> Add these keys to a configuration profile for the `com.anthropic.claudefordesktop` preference domain:
74>
75> ```xml theme={null}
76> <key>forceLoginOrgUUID</key>
77> <string>xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx</string>
78> <key>isLocalDevMcpEnabled</key>
79> <string>false</string>
80> <key>isDesktopExtensionEnabled</key>
81> <string>false</string>
82> <key>otlpContentCapture</key>
83> <string>[]</string>
84> ```
7285
73Add these keys to a configuration profile for the `com.anthropic.claudefordesktop` preference domain:
86> [tab] Windows
87>
88> Write these values under `HKLM\SOFTWARE\Policies\Claude`:
89>
90> ```reg theme={null}
91> Windows Registry Editor Version 5.00
92>
93> [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Claude]
94> "forceLoginOrgUUID"="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
95> "isLocalDevMcpEnabled"="false"
96> "isDesktopExtensionEnabled"="false"
97> "otlpContentCapture"="[]"
98> ```
7499
75```xml theme={null}
76<key>forceLoginOrgUUID</key>
77<string>xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx</string>
78<key>isLocalDevMcpEnabled</key>
79<string>false</string>
80<key>isDesktopExtensionEnabled</key>
81<string>false</string>
82<key>otlpContentCapture</key>
83<string>[]</string>
84```
85
86**Windows**
87
88Write these values under `HKLM\SOFTWARE\Policies\Claude`:
89
90```reg theme={null}
91Windows Registry Editor Version 5.00
92
93[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Claude]
94"forceLoginOrgUUID"="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
95"isLocalDevMcpEnabled"="false"
96"isDesktopExtensionEnabled"="false"
97"otlpContentCapture"="[]"
98```
99
100100The sample writes every value as a string, including `false` and `[]`. [Value types](https://claude.com/docs/third-party/claude-desktop/configuration-format.md#value-types) lists the other encodings Claude Desktop accepts.
101101
102102> [!NOTE]
from line 188
188188
189189The `disabledBuiltinTools` key takes a list of tool names, written as a string:
190190
191**macOS**
191> [tab] macOS
192>
193> Add the key to the profile for the `com.anthropic.claudefordesktop` preference domain:
194>
195> ```xml theme={null}
196> <key>disabledBuiltinTools</key>
197> <string>["WebSearch"]</string>
198> ```
192199
193Add the key to the profile for the `com.anthropic.claudefordesktop` preference domain:
194
195```xml theme={null}
196<key>disabledBuiltinTools</key>
197<string>["WebSearch"]</string>
198```
199
200**Windows**
201
202Add the value under `HKLM\SOFTWARE\Policies\Claude`:
203
204```reg theme={null}
205"disabledBuiltinTools"="[\"WebSearch\"]"
206```
200> [tab] Windows
201>
202> Add the value under `HKLM\SOFTWARE\Policies\Claude`:
203>
204> ```reg theme={null}
205> "disabledBuiltinTools"="[\"WebSearch\"]"
206> ```
207207
208208After a member restarts Claude Desktop, Claude can't search the web in Cowork tasks or Code tab sessions on that computer.
209209
cowork/overview Changed · +4 / -4 lines
from line 15
1515
1616Cowork supports the same extensibility features available across Claude products:
1717
18> **[Connectors](https://claude.com/docs/connectors/overview.md)**
18> [card] [Connectors](https://claude.com/docs/connectors/overview.md)
1919>
2020> Connect Claude to your tools and data sources using MCP.
2121
22> **[Skills](https://claude.com/docs/skills/overview.md)**
22> [card] [Skills](https://claude.com/docs/skills/overview.md)
2323>
2424> Teach Claude reusable workflows with custom instructions.
2525
26> **[Plugins](https://claude.com/docs/plugins/overview.md)**
26> [card] [Plugins](https://claude.com/docs/plugins/overview.md)
2727>
2828> Bundle skills, connectors, and more into shareable packages.
2929
30> **[Monitoring](https://claude.com/docs/cowork/monitoring.md)**
30> [card] [Monitoring](https://claude.com/docs/cowork/monitoring.md)
3131>
3232> Track usage and activity across your organization.
3333
extend/overview Changed · +4 / -4 lines
from line 14
1414
1515Each card below leads to the setup page for one of the three. The last card is for Owners who manage plugins for a Team or Enterprise organization.
1616
17> **[Plugins](https://claude.com/docs/plugins/overview.md)**
17> [card] [Plugins](https://claude.com/docs/plugins/overview.md)
1818>
1919> Add a set of connectors, skills, and commands with one install, such as everything for one tool, or your team's standard setup.
2020
21> **[MCP connectors](https://claude.com/docs/connectors/getting-started.md)**
21> [card] [MCP connectors](https://claude.com/docs/connectors/getting-started.md)
2222>
2323> Give Claude access to a tool or data source, such as your files, calendar, issue tracker, or an internal API.
2424
25> **[Skills](https://claude.com/docs/skills/how-to.md)**
25> [card] [Skills](https://claude.com/docs/skills/how-to.md)
2626>
2727> Have Claude do a task a particular way, such as your release-note format, your contract checklist, or your weekly report.
2828
29> **[Plugins for your organization](https://claude.com/docs/plugins/admin.md)**
29> [card] [Plugins for your organization](https://claude.com/docs/plugins/admin.md)
3030>
3131> If you're an Owner on a Team or Enterprise plan, choose which plugins members can add, install some for everyone, and add your organization's own.
3232
government/deploy-desktop/configure Changed · +3 / -3 lines
from line 75
7575
7676Video: Pilot Claude Desktop on one machine (1 min 34 s). Narrated with an AI-generated voice, with on-screen captions.
7777
78> **Transcript**
78> [accordion] Transcript
7979>
8080> A fresh install connects to claude.ai. One setting, the bootstrap address on your Claude for Government host, points it at Claude for Government. Everything else arrives at sign-in.
8181>
from line 141
141141
142142Video: Deploy to your fleet (1 min 31 s). Narrated with an AI-generated voice, with on-screen captions.
143143
144> **Transcript**
144> [accordion] Transcript
145145>
146146> Push two values as device policy, the bootstrap address and the setting that hides the claude.ai sign-in option. On macOS they live in a configuration profile, on Windows in machine policy. Deliver them before the app, and note they carry no secrets.
147147>
from line 251
251251
252252Video: Verify a managed device and spot common failures (1 min 40 s). Narrated with an AI-generated voice, with on-screen captions.
253253
254> **Transcript**
254> [accordion] Transcript
255255>
256256> On a managed device, the sign-in screen offers only Sign in with your organization, and the configuration window is read-only. Under Help, Troubleshooting, Generate Diagnostic Report saves a report that shows what the app read.
257257>
government/desktop/video-walkthroughs Changed · +5 / -5 lines
from line 18
1818
1919Video: Signing in for the first time (1 min 32 s). Narrated with an AI-generated voice, with on-screen captions.
2020
21> **Transcript**
21> [accordion] Transcript
2222>
2323> Claude Desktop is installed and connected for you by your agency. You sign in with your work account. No separate Claude account is needed.
2424>
from line 48
4848
4949Video: Bringing your chats and projects over from Claude for Government Web (2 min 12 s). Narrated with an AI-generated voice, with on-screen captions.
5050
51> **Transcript**
51> [accordion] Transcript
5252>
5353> If you used Claude for Government Web, you can copy your chats and projects into Claude Desktop. First, sign in to the web app in your browser with the same work email you use in Claude Desktop.
5454>
from line 78
7878
7979Video: Chat, Cowork, and Code: which one to use (2 min 26 s). Narrated with an AI-generated voice, with on-screen captions.
8080
81> **Transcript**
81> [accordion] Transcript
8282>
8383> Claude Desktop gives you three ways to work: Chat, Cowork, and Code. On Home, you pick Chat or Cowork in the message box. Code sits beside Home.
8484>
from line 112
112112
113113Video: Connectors, plugins, and skills from your agency (2 min 6 s). Narrated with an AI-generated voice, with on-screen captions.
114114
115> **Transcript**
115> [accordion] Transcript
116116>
117117> Open Customize in the sidebar for your skills, connectors, and plugins. A connector lets Claude reach another service. The ones you can use come from your organization: here, Microsoft 365 and Web Search.
118118>
from line 140
140140
141141Video: Your account, usage limits, and getting help (1 min 57 s). Narrated with an AI-generated voice, with on-screen captions.
142142
143> **Transcript**
143> [accordion] Transcript
144144>
145145> Your account pages are in the web portal. In a browser, open your agency's Claude for Government address and sign in. Account shows your email, organization, role, and seat tier, all read-only.
146146>
government/security/security-and-data-handling Changed · +33 / -33 lines
from line 14
1414
1515In Cowork, and for the file-analysis steps in Chat, the Claude Desktop application runs shell commands and model-written code inside a dedicated local virtual machine. In Claude for Government, this sandbox is always the execution path for the code and shell commands that Claude runs in Chat and Cowork. Code sessions run on the workstation itself rather than in the virtual machine, as described under [Code in Claude Desktop](#code-in-claude-desktop). For the detailed threat model and isolation design, request the security architecture overview through the [Anthropic Trust Center](https://trust.anthropic.com).
1616
17> **What does the sandbox isolate, and what runs outside it?**
17> [accordion] What does the sandbox isolate, and what runs outside it?
1818>
1919> The sandbox virtual machine runs the shell commands and model-written code of Cowork sessions and of the file-analysis steps in Chat. The agent loop, built-in file tools, web fetch, and the connector client run in the Claude Desktop application on the user's device and are governed by separate controls: per-action approval prompts, administrator-set per-tool policies, and the network egress allowlist applied when each tool runs. Code sessions also run outside the virtual machine, as described under [Code in Claude Desktop](#code-in-claude-desktop). For a deeper description of the layered controls inside and outside the virtual machine, see the security architecture overview available through the [Anthropic Trust Center](https://trust.anthropic.com).
2020
21> **What can shell commands in the sandbox reach?**
21> [accordion] What can shell commands in the sandbox reach?
2222>
2323> Shell commands that Claude runs in the sandbox work on the folders the user has attached, a scratch area, and read-only reference material bundled by the application (such as skill and plugin directories). Shell commands cannot work on the rest of the user's files. In Cowork, Claude can ask the user to add a specific folder during the session, and the user approves or declines that request; see [Approvals and Auto mode](#approvals-and-auto-mode). Administrators can restrict which local folders users may attach with **Allowed workspace folders** on the [Config](https://claude.com/docs/government/config/settings.md#allowed-workspace-folders) page. The desktop client then refuses folders outside that list in the workspace picker, in requests Claude makes during a session, and in Claude's file tools. In Cowork, Claude's file tools may read and write in the listed folders. See [Desktop and filesystem access](https://claude.com/docs/third-party/claude-desktop/local-access.md) for how folder scoping is enforced.
2424
25> **How are attached folders made available to the sandbox?**
25> [accordion] How are attached folders made available to the sandbox?
2626>
2727> When a user attaches a local folder to a Cowork session, the entire folder is made available to that session's sandbox as a filesystem mount, so changes Claude makes are written directly to the folder on disk. A mapped network drive on Windows is an exception: Claude's host-side file tools can read, write, and search it, but shell commands in the sandbox can reach it only if the drive was mapped and reachable when the sandbox started (see [Network drives on Windows](https://claude.com/docs/third-party/claude-desktop/local-access.md#network-drives-on-windows)). Files the user attaches individually to a conversation are copied or hard-linked into a per-conversation uploads directory and mounted read-only; where the filesystem hard-links, edits to the original file while the conversation is open can be visible to it. The allowed-folders setting is a policy control enforced by the desktop application. See [Desktop and filesystem access](https://claude.com/docs/third-party/claude-desktop/local-access.md).
2828
29> **Which file types need the sandbox in Chat?**
29> [accordion] Which file types need the sandbox in Chat?
3030>
3131> Some attachment types, such as Excel and PowerPoint, need a conversion step that runs inside the sandbox. Enabling **Advanced file analysis in Chat** under **Product availability** on the [Config](https://claude.com/docs/government/config/settings.md#product-availability) page lets Claude run code against attachments in a sandbox, including that conversion. You do not need to make Cowork available to get this capability. See [Chat in Claude Desktop](https://claude.com/docs/third-party/claude-desktop/chat.md) for how Chat handles file attachments.
3232
from line 65
6565
6666The desktop application follows the operating system's proxy settings, and a single allowlist controls outbound network access from Claude's tools. You manage the allowlist with the **Allowed network hosts** setting on the [Config](https://claude.com/docs/government/config/settings.md#allowed-network-hosts) page.
6767
68> **What does the egress allowlist control?**
68> [accordion] What does the egress allowlist control?
6969>
7070> The allowlist governs outbound network access from the shell commands and package installs of Cowork sessions, which run in the sandbox virtual machine, from the sandboxed shell commands of Code sessions on macOS and Linux (see [Code in Claude Desktop](#code-in-claude-desktop)), and from the host-side web fetch tool. It does not govern web search (which routes through the Claude for Government service) or connector traffic (covered under [Connectors](#connectors) below). When the list is empty or unset, the only hosts reachable from those tools are the Claude for Government service address and, if you have set a **Telemetry endpoint** on the [Config](https://claude.com/docs/government/config/settings.md#telemetry-endpoint) page, that collector's host, which the application adds to the allowlist automatically. Package installs and page fetches to any other host fail. The list accepts exact hostnames, wildcard patterns such as `*.example.com`, or `*` to allow all outbound traffic. See [Web search and web fetch](https://claude.com/docs/third-party/claude-desktop/web-tools.md) for the full allowlist semantics.
7171
72> **Which domains does Claude Desktop need to reach?**
72> [accordion] Which domains does Claude Desktop need to reach?
7373>
7474> For configuration and model inference, the application reaches the Claude for Government service hostname provided to your agency during onboarding. Sign-in happens in the user's default browser, which must reach that same hostname, the Claude for Government sign-in service (a separate host that your Anthropic representative provides), and your agency's identity provider. See the network prerequisites in [Connect Claude Desktop to Claude for Government](https://claude.com/docs/government/deploy-desktop/configure.md#before-you-begin). Claude for Government does not publish IP addresses for its service and sign-in hosts, so allow both by hostname on port 443. The [IP addresses](https://platform.claude.com/docs/en/api/ip-addresses) page in the Claude API documentation covers the Claude API, not the Claude for Government hosts. Anthropic-bound telemetry endpoints are not contacted in Claude for Government. Allow `downloads.claude.ai` for the agent helper that runs Chat, Cowork, and Code sessions and for the sandbox virtual machine image, which the app fetches at session start when it does not already have them (not required if your agency uses the offline installer variant that bundles both). The app also reaches the hosts listed under Non-essential services in [Required egress paths](https://claude.com/docs/third-party/claude-desktop/telemetry.md#required-egress-paths). If traffic is blocked, the app will run without icons, previews, and widgets. For automatic application updates, the required hosts depend on how your agency distributes the client; see the network-requirements table in [Telemetry and egress](https://claude.com/docs/third-party/claude-desktop/telemetry.md) and confirm the update hosts for your deployment before finalizing your allowlist.
7575
76> **Can administrators control when Claude Desktop updates?**
76> [accordion] Can administrators control when Claude Desktop updates?
7777>
7878> Yes. An agency that distributes Claude Desktop updates itself, for example to keep devices on an assessed version until the next one is approved, turns on **Block automatic updates** on the [Config](https://claude.com/docs/government/config/settings.md#block-automatic-updates) page and also blocks automatic updates in each device's managed configuration, as described under [Automatic updates](https://claude.com/docs/government/deploy-desktop/configure.md#automatic-updates). With both in place, the application neither downloads nor installs updates on its own. An agency that leaves automatic updates on can use **Restart deadline for updates** on the [Config](https://claude.com/docs/government/config/settings.md#restart-deadline-for-updates) page to set how long members may postpone the restart that installs a downloaded update.
7979
80> **Does Claude for Government depend on claude.ai or anthropic.com?**
80> [accordion] Does Claude for Government depend on claude.ai or anthropic.com?
8181>
8282> Sign-in, configuration, and model inference do not. Configuration and model inference go through the dedicated Claude for Government service hostname, and sign-in goes through that hostname, the separate Claude for Government sign-in service, and your agency's identity provider, none of which are under either domain. Blocking `*.claude.ai` and `*.anthropic.com` leaves sign-in and inference working. Blocking `*.claude.ai` also blocks `downloads.claude.ai`, which prevents Chat conversations, Cowork tasks, and Code sessions from starting on devices installed with the standard installer unless the app has already downloaded the components they need from that host. App updates often change one or both of those components, and the sandbox virtual machine that runs shell commands in Cowork and Advanced file analysis in Chat then cannot start until the app has downloaded the new versions from that host. Devices installed with the offline installer variant, which includes those components, are not affected. Automatic application updates use hosts under these domains, so an agency that blocks these domains distributes updates itself, as described under [Automatic updates](https://claude.com/docs/government/deploy-desktop/configure.md#automatic-updates).
8383
84> **Does blocking claude.ai affect Claude for Government?**
84> [accordion] Does blocking claude.ai affect Claude for Government?
8585>
8686> Blocking `claude.ai` does not affect sign-in or inference; neither uses any host under that domain. A personal Claude account cannot sign in to Claude for Government, and a Claude for Government account cannot sign in to `claude.ai`, so there is no shared sign-in surface to restrict. If you allow automatic application updates, keep the update hosts listed in the network-requirements table reachable.
8787
88> **Is web fetch always checked against the allowlist?**
88> [accordion] Is web fetch always checked against the allowlist?
8989>
9090> Yes. Every web page fetch is checked against your egress allowlist before the request is made, and redirects are re-checked against the allowlist on each hop. See [Web search and web fetch](https://claude.com/docs/third-party/claude-desktop/web-tools.md). Do not rely on this allowlist alone to restrict access to your private network; see **Allowed network hosts** on the [Config](https://claude.com/docs/government/config/settings.md#allowed-network-hosts) page.
9191
92> **Can all traffic route through a single proxy?**
92> [accordion] Can all traffic route through a single proxy?
9393>
9494> Yes, with a caveat for Linux. The desktop application follows the operating system's proxy settings, including PAC URLs, and so does the Cowork sandbox on macOS and Windows. On Linux, no proxy settings reach the Cowork sandbox, and its commands connect directly. See [Network proxy](https://claude.com/docs/third-party/claude-desktop/network-proxy.md#traffic-that-bypasses-the-app-proxy) for the traffic that bypasses the proxy.
9595>
from line 99
9999
100100By default, Claude for Government prompts the user for connector actions, for each web search, and, in Cowork, when Claude asks to add another folder to the session. In Chat and Cowork, Claude's file tools do not write outside the attached folders, the session's working folder, [memory](https://claude.com/docs/third-party/claude-desktop/data-storage.md#memory), and the folders listed in [**Allowed workspace folders**](https://claude.com/docs/government/config/settings.md#allowed-workspace-folders). In Cowork, shell commands run without a prompt because they run inside the sandbox virtual machine. Web page fetches run without a prompt in both Chat and Cowork and are checked against the [egress allowlist](#network-egress-required-domains-and-proxies). Administrators can require a prompt on every shell command or fetch with the **Require approval for each command** and **Require approval for each fetch** sub-settings on the [Config](https://claude.com/docs/government/config/settings.md#tool-and-connector-cards) page. In Chat on Claude Desktop versions earlier than 2.110.0, every shell command prompts regardless. By default, members cannot switch to Auto mode. When an administrator sets the **Auto mode** setting to **Allowed** on the [Config](https://claude.com/docs/government/config/settings.md#bypass-permissions-mode-and-auto-mode) page, Claude Desktop offers it in Cowork and in Code sessions, and members can switch the Claude Code command-line tool to it. New Code sessions in Claude Desktop 2.9939.2 or later and new interactive sessions in the Claude Code command-line tool 2.1.283 or later then start in it on models that support Auto mode, unless another mode is chosen. Cowork does not offer a bypass-permissions mode.
101101
102> **Can write and send actions be gated behind approval?**
102> [accordion] Can write and send actions be gated behind approval?
103103>
104104> Yes. Connector actions prompt the user by default. For each connector an administrator adds, the administrator can switch individual tools on or off under **Tool policy**. A tool that is on stays available and each user approves every use. A tool that is off is blocked. Users cannot loosen these settings.
105105>
106106> Tools that are not listed in a connector's **Tool policy**, including tools the server adds later, stay under each user's control. The Microsoft 365 connector always asks for approval before write actions such as sending mail, changing calendar events, or posting Teams messages, and no Claude for Government setting removes that prompt. The **Microsoft 365** card has no per-tool setting, and the connector's read tools follow each user's own approval choices. On the built-in **Web search**, **Web fetch**, and **Shell commands** cards of the Config page, administrators can require approval for every use or turn the tool off. See [Tool and connector cards](https://claude.com/docs/government/config/settings.md#tool-and-connector-cards) and [Connectors](https://claude.com/docs/government/connectors/overview.md) for the available settings.
107107
108> **Can Auto mode be disabled when a sensitive connector is attached?**
108> [accordion] Can Auto mode be disabled when a sensitive connector is attached?
109109>
110110> Not for one connector alone. Auto mode is available only while an administrator has the **Auto mode** setting at **Allowed** on the [Config](https://claude.com/docs/government/config/settings.md#bypass-permissions-mode-and-auto-mode) page, as described above, and setting it back to **Blocked** withdraws it again. To limit a sensitive connector while Auto mode is allowed, switch the connector's tools off under **Tool policy** on the [Config](https://claude.com/docs/government/config/settings.md#tool-and-connector-cards) page.
111111
112> **Can individual shell commands be allowlisted enterprise-wide?**
112> [accordion] Can individual shell commands be allowlisted enterprise-wide?
113113>
114114> Not in Chat or Cowork. Administrators can turn the built-in **Web search**, **Web fetch**, and **Shell commands** tools on or off, or require approval on every use, but cannot allowlist individual commands within those tools. In Chat, an approval for a shell command covers that one command, with no standing approval. For analyses that take many steps, Cowork runs shell commands in the sandbox without prompting; you make Cowork available to members under **Product availability** on the [Config](https://claude.com/docs/government/config/settings.md#product-availability) page. In Code sessions, the [Claude Code](https://claude.com/docs/government/config/settings.md#claude-code) section has no list of allowed commands. Permission rules in a Claude Code managed-settings file on the device can allow individual commands, but they apply in Code sessions only where your organization's Claude Code settings don't reach them, as [Code in Claude Desktop](#code-in-claude-desktop) describes.
115115
116> **Can users suppress approval prompts with an Always allow choice?**
116> [accordion] Can users suppress approval prompts with an Always allow choice?
117117>
118118> For most tools, users who see an approval prompt can choose **Always allow**, which suppresses that prompt for them going forward. Administrators can remove that option on the Config page. Turning on the **Require approval for each search**, **Require approval for each fetch**, or **Require approval for each command** sub-setting on the **Web search**, **Web fetch**, or **Shell commands** card forces a fresh prompt on every use of that tool. A connector tool that an administrator has switched on under **Tool policy** also prompts on each use, without an **Always allow** choice. The Microsoft 365 connector's read tools keep each user's own choice, and its write actions never offer **Always allow**. The create-artifact prompt is an exception: it offers no standing approval. See [Tool and connector cards](https://claude.com/docs/government/config/settings.md#tool-and-connector-cards) and [Connectors](https://claude.com/docs/government/connectors/overview.md) for the available settings.
119119
from line 121
121121
122122In Claude for Government, connectors fall into three main categories: built-in tools (Web search, Web fetch, Shell commands, and Terminal panel tools), the built-in Microsoft 365 connector, and connectors an administrator adds on the Connectors card of the [Config](https://claude.com/docs/government/config/settings.md#tool-and-connector-cards) page.
123123
124> **Where do connectors run, and where are tokens stored?**
124> [accordion] Where do connectors run, and where are tokens stored?
125125>
126126> Connectors are called from the desktop application, outside the sandbox. The built-in Microsoft 365 connector and administrator-added connectors call their endpoints directly from the user's device, through the system proxy where one is configured. OAuth tokens for both are stored encrypted on each user's device using operating system encryption (macOS Keychain on Mac, DPAPI on Windows). For administrator-added connectors, the bearer header entered on the Config page is delivered to each user's desktop.
127127>
from line 129
129129>
130130> A user-added plugin's skills, slash commands, sub-agents, and hooks run on that user's machine, and any connector it declares does not become available as an organization connector. Hook commands and local MCP servers run as programs under the user's own account, outside both the [sandbox virtual machine](#sandbox-and-isolation) and the [Code session sandbox](#code-in-claude-desktop). See [Connectors](https://claude.com/docs/government/connectors/overview.md) and the Plugins card under [Tool and connector cards](https://claude.com/docs/government/config/settings.md#tool-and-connector-cards).
131131
132> **Do connectors follow the sandbox egress allowlist?**
132> [accordion] Do connectors follow the sandbox egress allowlist?
133133>
134134> No. The built-in Microsoft 365 connector calls Microsoft Graph directly from the user's device; see the [Microsoft 365 connector](https://claude.com/docs/government/connectors/microsoft-365.md) page. Administrator-added connectors connect directly from the user's device to the address configured for that connector. Both pass through the system proxy where one is configured. Web search is a built-in tool rather than a connector and routes through the Claude for Government service; see [Web search and web fetch](#web-search-and-web-fetch) below.
135135
136> **Can artifacts be blocked from calling connectors?**
136> [accordion] Can artifacts be blocked from calling connectors?
137137>
138138> Artifacts follow the same tool settings as Claude's direct connector calls: a connector tool that an administrator has switched off is refused, and a tool that requires approval on every use never runs from an artifact without the user's approval of that call. There is no single switch to disable artifact-to-connector calls while keeping connectors available to Claude directly.
139139
from line 141
141141
142142In Claude for Government, Anthropic-bound error and usage telemetry is always disabled. The OpenTelemetry export to your own collector is a separate setting and sends data only to the endpoint you configure.
143143
144> **Is there an inline DLP or inspection point?**
144> [accordion] Is there an inline DLP or inspection point?
145145>
146146> No. Claude for Government does not include an inline content-inspection or DLP gate. The available inspection points are your own network proxy, which sees the traffic routed through it, and the desktop's OpenTelemetry export, which sends tool-call metadata (tool name, connector, outcome, duration, and approval status) to your collector for after-the-fact review. You set the OpenTelemetry endpoint with **Telemetry endpoint** on the [Config](https://claude.com/docs/government/config/settings.md#telemetry-endpoint) page. The **Telemetry content capture** setting on the [Config](https://claude.com/docs/government/config/settings.md#telemetry-content-capture) page adds prompt, response, and tool content to the export for the categories you select, and nothing is selected by default. See [Telemetry and egress](https://claude.com/docs/third-party/claude-desktop/telemetry.md).
147147
148> **What is logged for connector actions and outbound requests?**
148> [accordion] What is logged for connector actions and outbound requests?
149149>
150150> Chat and Cowork sessions write a local audit log to the user's disk recording tool invocations, permission decisions, and file operations; that log never leaves the device. The desktop can also export OpenTelemetry events to a collector you specify: tool name, connector, outcome, duration, and approval status are sent. Prompt text, Claude's responses, and tool inputs and results are included only for the categories you select in the **Telemetry content capture** setting on the [Config](https://claude.com/docs/government/config/settings.md#telemetry-content-capture) page. See [Telemetry and egress](https://claude.com/docs/third-party/claude-desktop/telemetry.md) for what the export can include. Server-side, the [Compliance API](https://claude.com/docs/government/org-admin/compliance-api.md) records identity and configuration events but never tool calls or conversation content.
151151
from line 153
153153
154154In Claude for Government, conversation content stays on the user's device. If you select content categories in the **Telemetry content capture** setting on the [Config](https://claude.com/docs/government/config/settings.md#telemetry-content-capture) page, Claude Desktop also sends the selected prompt, response, and tool content to your own OpenTelemetry collector, and never to Anthropic. Model requests are proxied through the Claude for Government service to the model endpoint inside the FedRAMP High boundary, and the service records only per-request metadata, not content.
155155
156> **Can Anthropic view conversations?**
156> [accordion] Can Anthropic view conversations?
157157>
158158> No. Chat transcripts are stored on the user's workstation, and the Claude for Government service does not log request or response bodies. Inference requests pass through the service to the model endpoint but are not retained. If you select content categories in the **Telemetry content capture** setting on the [Config](https://claude.com/docs/government/config/settings.md#telemetry-content-capture) page, Claude Desktop also sends the selected content to your own OpenTelemetry collector, and never to Anthropic. See [User identity and local data](https://claude.com/docs/third-party/claude-desktop/data-storage.md) for where conversation content is stored.
159159
160> **Where on the device is conversation content stored?**
160> [accordion] Where on the device is conversation content stored?
161161>
162162> Conversation content lives under the owner-only application data directory (`%LOCALAPPDATA%\Claude-3p` on Windows, `~/Library/Application Support/Claude-3p` on macOS, `~/.config/Claude-3p` on Linux). Code session transcripts live in Claude Code's own folder in the user's home directory (`~/.claude/projects`). The application does not encrypt these files itself, so encryption at rest depends on the workstation's full-disk encryption, such as BitLocker, FileVault, or LUKS. The operating system encryption that protects connector credentials, described under [Connectors](#connectors), does not apply to conversation content. User-visible outputs such as artifacts are written separately to the user files directory (default `~/Claude`). See [User identity and local data](https://claude.com/docs/third-party/claude-desktop/data-storage.md) for the full list of what each location holds.
163163
164> **Is local history kept separate for each organization?**
164> [accordion] Is local history kept separate for each organization?
165165>
166166> No. Claude Desktop keeps conversation history in the application data directory of the operating system account in use on the device, and it does not divide that history by the Claude for Government organization or tenant the user signs in to. A user who is moved to another organization, or who signs in to a second tenant from the same operating system account, sees the same conversations and projects as before. Each operating system account's application data directory is written with owner-only permissions, so other accounts on the device cannot read it, and [Removing data](https://claude.com/docs/third-party/claude-desktop/data-storage.md#removing-data) describes how to clear it. In the folder layout that [User identity and local data](https://claude.com/docs/third-party/claude-desktop/data-storage.md) describes, Claude for Government uses a single fixed organization ID. The Claude Desktop [configuration reference](https://claude.com/docs/third-party/claude-desktop/configuration.md#deploymentorganizationuuid) lists a `deploymentOrganizationUuid` key that separates local data by organization in other deployments. That key does not apply to Claude for Government, so leave it out of your [configuration profile](https://claude.com/docs/government/deploy-desktop/configure.md#deploy-to-your-fleet).
167167
168> **Where are files added to a project stored, and are they indexed?**
168> [accordion] Where are files added to a project stored, and are they indexed?
169169>
170170> A project in Claude for Government is stored in the application data directory on the user's own device, together with any instructions, links, and folder references the user adds to it. Files added to a project stay on the user's local disk; there is no service-side project store, and files are not vectorized or indexed. Claude reads them directly from disk on demand with its file tools. A new Cowork session in the project does not reuse what an earlier session read, so Claude reads the files it needs again. The project's [memory](https://claude.com/docs/third-party/claude-desktop/data-storage.md#memory) carries short notes between sessions, such as preferences and decisions, not the contents of the files. Content Claude reads from those files is handled like the rest of the conversation: inference requests pass through the Claude for Government service to the model endpoint but are not retained. See [Desktop and filesystem access](https://claude.com/docs/third-party/claude-desktop/local-access.md).
171171
172> **Can the local data location be changed for backup or sync?**
172> [accordion] Can the local data location be changed for backup or sync?
173173>
174174> No. The location is fixed to the per-user application data directory, and the application avoids the roaming profile because the sandbox image cache can be large. Chat history exists only on the device that created it, so back up the application data directory through your endpoint management tools if you need to preserve it. Artifacts and project folders are separate locations on the same device; see the question above. See [User identity and local data](https://claude.com/docs/third-party/claude-desktop/data-storage.md) for the folder layout.
175175
176176### Web search and web fetch
177177
178> **How does web search reach the internet?**
178> [accordion] How does web search reach the internet?
179179>
180180> Web search is operated by Anthropic inside the Claude for Government FedRAMP High boundary, and the search provider's API is the one case where traffic egresses that boundary. Before search is enabled, an administrator must acknowledge a disclosure covering this data flow when enabling the **Web search** card on the [Config](https://claude.com/docs/government/config/settings.md#tool-and-connector-cards) page. By default, users approve each query before it is sent, and Claude transforms it into a generic, de-identified search request and shows the user the exact text. Anthropic has a zero-data-retention agreement with the search provider. The [Web search and web fetch](https://claude.com/docs/third-party/claude-desktop/web-tools.md) page covers how web search is configured in other Claude Desktop deployments; the Claude for Government search path described here is specific to this deployment.
181181
182> **How do administrators enable web search?**
182> [accordion] How do administrators enable web search?
183183>
184184> Web search is built in and does not require obtaining a separate connector. An organization owner opens the [Config](https://claude.com/docs/government/config/settings.md#tool-and-connector-cards) page, finds the **Web search** card, turns it on, and acknowledges the data-flow notice. The **Require approval for each search** setting is on by default.
185185
186> **Why does Chat's web fetch fail with an empty allowlist?**
186> [accordion] Why does Chat's web fetch fail with an empty allowlist?
187187>
188188> Chat includes a web fetch tool, and every fetch is checked against the same egress allowlist that governs Cowork. With the allowlist empty or unset, a fetch to anything other than the Claude for Government service address (or, when configured, the **Telemetry endpoint** collector host) returns an error. Add hosts to **Allowed network hosts** on the [Config](https://claude.com/docs/government/config/settings.md#allowed-network-hosts) page to let Chat fetch from them, or turn off the **Web fetch** card on the same page if you prefer Claude not to see the tool. See [Web search and web fetch](https://claude.com/docs/third-party/claude-desktop/web-tools.md).
189189
190190### Chat and Cowork differences
191191
192> **Are projects available in both Chat and Cowork?**
192> [accordion] Are projects available in both Chat and Cowork?
193193>
194194> Yes. Chat and Cowork share one list of projects, and users can start a Chat conversation or a Cowork session inside a project. A project in Claude for Government is stored only on the user's device. There is no service-side project store, and projects are not shared between users. Cowork sessions in a project use the same execution model as the rest of Cowork. Chat conversations in a project can read the project's [memory](https://claude.com/docs/third-party/claude-desktop/data-storage.md#memory). See [Data storage and retention](#data-storage-and-retention) for where project contents are stored.
195195
196> **Are artifacts available in Chat?**
196> [accordion] Are artifacts available in Chat?
197197>
198198> Yes. Artifacts are available in both Chat and Cowork. Claude creates an artifact by calling a tool when the output suits an interactive view, and the artifact opens in a side panel next to the conversation. Artifacts do not depend on the sandbox, so they remain available in Chat even when **Advanced file analysis** is disabled.
199199
200> **Where do files that Claude creates go?**
200> [accordion] Where do files that Claude creates go?
201201>
202202> In Chat and Cowork, Claude creates files on the user's device in places such as these:
203203>
from line 213
213213
214214The answers below cover the standalone Claude Code command-line tool when it signs in through Claude for Government, as [Connect Claude Code to Claude for Government](https://claude.com/docs/government/deploy-claude-code/configure.md) describes. The Claude Desktop answers above cover Code sessions inside Claude Desktop.
215215
216> **Which domains does Claude Code need to reach?**
216> [accordion] Which domains does Claude Code need to reach?
217217>
218218> The Claude for Government gateway address in the managed settings from [Connect Claude Code to Claude for Government](https://claude.com/docs/government/deploy-claude-code/configure.md#the-managed-settings), over HTTPS on port 443, for sign-in, organization settings, and model inference. Sign-in finishes in the user's browser, which needs the Claude for Government host, its sign-in service, and your agency's identity provider, as for Claude Desktop. Claude Code also reaches, from the user's device, the address of each connector an administrator applies to **Claude Code** on the **Connectors** card, and that connector's sign-in service when it uses OAuth. The managed settings from [Connect Claude Code to Claude for Government](https://claude.com/docs/government/deploy-claude-code/configure.md#before-sign-in) turn off Claude Code's background connections before sign-in (release notes, update checks, and the official plugin marketplace).
219219
220> **Does Claude Code send telemetry to Anthropic?**
220> [accordion] Does Claude Code send telemetry to Anthropic?
221221>
222222> No. The managed settings in [Connect Claude Code to Claude for Government](https://claude.com/docs/government/deploy-claude-code/configure.md#the-managed-settings) turn off Claude Code's usage telemetry and error reporting to Anthropic from the first launch, and the organization's settings keep them off after sign-in.
223223
government/video-walkthroughs Changed · +10 / -10 lines
from line 18
1818
1919Video: Finding your way around (2 min 23 s). Narrated with an AI-generated voice, with on-screen captions.
2020
21> **Transcript**
21> [accordion] Transcript
2222>
2323> Your tenant is your agency's deployment and holds its organizations. Each user belongs to one, run by Owners and Primary Owners. Tenant administrators manage the tenant.
2424>
from line 62
6262
6363Video: Verify your domain and connect single sign-on (2 min 24 s). Narrated with an AI-generated voice, with on-screen captions.
6464
65> **Transcript**
65> [accordion] Transcript
6666>
6767> Before your members can sign in, your tenant needs a verified email domain and a connection to your identity provider.
6868>
from line 98
9898
9999Video: Organizations, seats, and routing rules (2 min 14 s). Narrated with an AI-generated voice, with on-screen captions.
100100
101> **Transcript**
101> [accordion] Transcript
102102>
103103> Routing rules decide which organization each person lands in. Organizations hold users, seats, and settings, and their seats come from a billing account.
104104>
from line 130
130130
131131Video: Directory sync (SCIM) and group mappings (2 min 3 s). Narrated with an AI-generated voice, with on-screen captions.
132132
133> **Transcript**
133> [accordion] Transcript
134134>
135135> Directory sync is optional, and without it accounts are created at first sign-in. With it, your identity provider pushes users and groups, provisioning rules place them in organizations, and each organization maps groups to seat tiers and roles.
136136>
from line 160
160160
161161Video: Organization owners: users, seat tiers, and Readiness (1 min 48 s). Narrated with an AI-generated voice, with on-screen captions.
162162
163> **Transcript**
163> [accordion] Transcript
164164>
165165> In an organization, a member's role decides what they can manage, and their seat tier decides which models they can use and how much. Readiness shows what still blocks your members.
166166>
from line 186
186186
187187Video: Config essentials (2 min 23 s). Narrated with an AI-generated voice, with on-screen captions.
188188
189> **Transcript**
189> [accordion] Transcript
190190>
191191> Config sets product behavior for the people you manage. The tenant and each organization share the same page, and each level starts from the one above it.
192192>
from line 214
214214
215215Video: Connectors and plugins (2 min 8 s). Narrated with an AI-generated voice, with on-screen captions.
216216
217> **Transcript**
217> [accordion] Transcript
218218>
219219> A connector lets Claude reach another service, such as Microsoft 365 or a system of your own. A plugin packages skills and commands for Claude Desktop.
220220>
from line 242
242242
243243Video: Pilot Claude Desktop on one machine (1 min 34 s). Narrated with an AI-generated voice, with on-screen captions.
244244
245> **Transcript**
245> [accordion] Transcript
246246>
247247> A fresh install connects to claude.ai. One setting, the bootstrap address on your Claude for Government host, points it at Claude for Government. Everything else arrives at sign-in.
248248>
from line 268
268268
269269Video: Deploy to your fleet (1 min 31 s). Narrated with an AI-generated voice, with on-screen captions.
270270
271> **Transcript**
271> [accordion] Transcript
272272>
273273> Push two values as device policy, the bootstrap address and the setting that hides the claude.ai sign-in option. On macOS they live in a configuration profile, on Windows in machine policy. Deliver them before the app, and note they carry no secrets.
274274>
from line 290
290290
291291Video: Verify a managed device and spot common failures (1 min 40 s). Narrated with an AI-generated voice, with on-screen captions.
292292
293> **Transcript**
293> [accordion] Transcript
294294>
295295> On a managed device, the sign-in screen offers only Sign in with your organization, and the configuration window is read-only. Under Help, Troubleshooting, Generate Diagnostic Report saves a report that shows what the app read.
296296>
third-party/claude-desktop/bootstrap Changed · +7 / -7 lines
from line 355
355355| `$schemaVersion` | `integer` | Wire-format marker: `2` for the nested format (bootstrap-config-v2, what the app's own JSON export writes), `1` for the flat format (bootstrap-config-v1). Optional: the client infers the format from the document shape; set it to state the format explicitly. |
356356| `expiresAt` | `number` | Unix epoch (seconds or milliseconds) after which the client should re-fetch this document. Optional; when absent the client uses its default refresh interval. |
357357
358> **\$schemaVersion details**
358> [accordion] \$schemaVersion details
359359>
360360> Omitted → the client infers the version from the document shape (any cluster key present → 2, otherwise 1).
361361
362> **expiresAt details**
362> [accordion] expiresAt details
363363>
364364> Omitted → cache for 1 hour. A number ≥ 10¹² is read as Unix epoch **milliseconds**; below that, **seconds**.
365365>
from line 409
409409
410410**Bootstrap OIDC parameters.** Your organization’s OpenID Connect identity provider. The user’s token from a browser sign-in is sent as Bearer to the bootstrap server.
411411
412> **More detail**
412> [accordion] More detail
413413>
414414> When unset, the bootstrap sign-in uses a device code on the bootstrap server's own origin.
415415>
416416> In an MDM profile, write this key as one JSON string. Separate values such as `bootstrapOidc.clientId` do not work: the app silently uses the device-code sign-in instead.
417417
418> **Child attributes (8)**
418> [accordion] Child attributes (8)
419419>
420420> **clientId** `string` *required*
421421>
from line 451
451451>
452452> Space-separated hostnames also accepted as the referrer of the sign-in callback, besides the authorization URL’s host.
453453>
454> > **More detail**
454> > [accordion] More detail
455455> >
456456> > If a callback is rejected for a referrer mismatch, the app log names the rejected host. Add that hostname here.
457457
from line 467
467467
468468**Bootstrap request headers.** HTTP headers sent on every bootstrap config fetch. Use this instead of embedding user:pass@ in the URL.
469469
470> **More detail**
470> [accordion] More detail
471471>
472472> If `bootstrapOidc` is unset, the app treats these headers as sufficient authentication and requires no per-user sign-in for the bootstrap fetch.
473473>
from line 487
487487
488488**Bootstrap headers helper script.** Absolute path to an executable that prints a JSON object of bootstrap request headers. Merged over the static headers; the helper wins.
489489
490> **More detail**
490> [accordion] More detail
491491>
492492> Example output: `{"Authorization": "Bearer …"}`. The app runs the helper script with no arguments and reuses its output for a few minutes.
493493>
third-party/claude-desktop/configuration Changed · +814 / -814 lines
The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.
from line 171
171171
172172One of: `gateway`, `anthropic`, `bedrock`, `mantle`, `vertex`, `foundry`
173173
174> **More detail**
174> [accordion] More detail
175175>
176176> The app opens in third-party mode unless the user chose to sign in to Claude.ai at the login screen. `disableDeploymentModeChooser` removes that choice.
177177>
from line 219
219219
220220**Custom inference headers.** Extra headers sent with every model request. Routing and tenant headers only: do not put credentials here.
221221
222> **More detail**
222> [accordion] More detail
223223>
224224> This key is stored and distributed as plain configuration. For tokens, and for values that differ per user or session, have `inferenceCredentialHelper` print JSON with a `headers` field. On a conflict, the helper script's header takes priority.
225225
from line 235
235235
236236**Helper script.** Absolute path to an executable that prints the credential, optionally with per-request headers.
237237
238> **More detail**
238> [accordion] More detail
239239>
240240> The helper script must exit with code `0`. Its standard output must hold only one of these, with no banners, prompts or log lines:
241241>
from line 268
268268
269269**Helper script arguments.** Arguments passed to the helper script, one per entry, in order. Leave unset to run it with none.
270270
271> **More detail**
271> [accordion] More detail
272272>
273273> Do not put secrets in arguments: the diagnostic report and other processes on the device can see them.
274274>
from line 326
326326
327327[Admin Console](#the-works-with-column): Not available.
328328
329> **More detail**
329> [accordion] More detail
330330>
331331> This sets a route. It is not a network access control. If the proxy is unreachable, requests fail instead of connecting directly.
332332>
from line 352
352352
353353[Admin Console](#the-works-with-column): Not available.
354354
355> **More detail**
355> [accordion] More detail
356356>
357357> If the PAC file cannot be downloaded, the app connects directly. On macOS and Windows, the Cowork workspace VM gets its own copy at each start. If that download fails, the VM connects directly until it next starts, with no warning. Block direct connections on your network if that is unacceptable.
358358>
from line 370
370370
371371**Enable IPv6 in the workspace VM.** Give the Cowork workspace VM an IPv6 address so Claude’s tools can reach IPv6-only hosts through the device. macOS and Windows only.
372372
373> **More detail**
373> [accordion] More detail
374374>
375375> IPv6 works in the VM only where the device's own IPv6 works.
376376>
from line 434
434434>
435435> * Use inferenceIdpAuthFlow together with inferenceIdpOidc once every desktop in the fleet is on a release that reads them. The original spelling will keep working; no end date has been set.
436436
437> **More detail**
437> [accordion] More detail
438438>
439439> * **`browser`:** register the redirect URI `http://127.0.0.1:<port>/callback` with your identity provider (for Entra, `http://127.0.0.1/callback`).
440440> * **`broker`:** uses Web Account Manager on Windows or Company Portal on macOS, and does not work on Linux. It can satisfy Conditional Access policies that require a compliant or managed device, or token protection.
from line 461
461461
462462[Guide for this setting](https://claude.com/docs/third-party/claude-desktop/gateway.md#single-sign-on-with-your-identity-provider)
463463
464> **More detail**
464> [accordion] More detail
465465>
466466> Used with `inferenceCredentialKind` set to `interactive`. Leave it unset for a gateway that runs its own sign-in and serves `<baseUrl>/.well-known/oauth-authorization-server`.
467467>
from line 469
469469>
470470> Register the redirect URI given under `inferenceGatewayOidcAuthFlow`.
471471
472> **Child attributes (11)**
472> [accordion] Child attributes (11)
473473>
474474> **clientId** `string` *required*
475475>
from line 493
493493>
494494> One of: `id_token` (default), `access_token`
495495>
496> > **More detail**
496> > [accordion] More detail
497497> >
498498> > An ID token's audience (`aud`) is `clientId`. An access token's audience must be your gateway or proxy.
499499> >
from line 503
503503>
504504> Space-separated scopes. Access-token mode needs the gateway or proxy API scope, and adds offline\_access unless Append offline\_access is off.
505505>
506> > **More detail**
506> > [accordion] More detail
507507> >
508508> > In ID-token mode, `offline_access` is not added to scopes that you set. Include it yourself, or users sign in again each time the token expires.
509509>
from line 511
511511>
512512> In access-token mode, add offline\_access to scopes so the identity provider returns a refresh token for silent refresh.
513513>
514> > **More detail**
514> > [accordion] More detail
515515> >
516516> > Turn off only if your authorization server rejects `offline_access` as an unknown scope. Then add the server’s own refresh-token scope to `scopes`.
517517>
from line 519
519519>
520520> Access-token audience of the gateway or proxy: an https URL or an AD FS relying-party identifier. Leave unset for Entra ID.
521521>
522> > **More detail**
522> > [accordion] More detail
523523> >
524524> > Use it only with `bearerTokenType` set to `access_token`, and only if your identity provider supports RFC 8707. Changing it signs users in again.
525525> >
from line 539
539539>
540540> Space-separated hostnames also accepted as the referrer of the sign-in callback, besides the authorization URL’s host.
541541>
542> > **More detail**
542> > [accordion] More detail
543543> >
544544> > If a callback is rejected for a referrer mismatch, the app log names the rejected host. Add that hostname here.
545545
from line 553
553553
554554One of: `browser`, `broker`
555555
556> **More detail**
556> [accordion] More detail
557557>
558558> * **`browser`:** register the redirect URI `http://127.0.0.1:<port>/callback` with your identity provider (for Entra, `http://127.0.0.1/callback`).
559559> * **`broker`:** uses Web Account Manager on Windows or Company Portal on macOS, and does not work on Linux. It can satisfy Conditional Access policies that require a compliant or managed device, or token protection.
from line 572
572572
573573**Identity provider (OIDC).** Your organization’s OpenID Connect identity provider. The user’s token is sent as the Bearer credential to the gateway or the Bedrock proxy.
574574
575> **More detail**
575> [accordion] More detail
576576>
577577> Used when `inferenceCredentialKind` is `external-idp`. Register the redirect URI given under `inferenceIdpAuthFlow` with your identity provider.
578578>
from line 580
580580>
581581> On Bedrock, set `inferenceBedrockBaseUrl` to a proxy that checks the token, because Amazon Bedrock itself does not accept it. Also list your models in `inferenceModels`.
582582
583> **Child attributes (11)**
583> [accordion] Child attributes (11)
584584>
585585> **clientId** `string` *required*
586586>
from line 604
604604>
605605> One of: `id_token` (default), `access_token`
606606>
607> > **More detail**
607> > [accordion] More detail
608608> >
609609> > An ID token's audience (`aud`) is `clientId`. An access token's audience must be your gateway or proxy.
610610> >
from line 614
614614>
615615> Space-separated scopes. Access-token mode needs the gateway or proxy API scope, and adds offline\_access unless Append offline\_access is off.
616616>
617> > **More detail**
617> > [accordion] More detail
618618> >
619619> > In ID-token mode, `offline_access` is not added to scopes that you set. Include it yourself, or users sign in again each time the token expires.
620620>
from line 622
622622>
623623> In access-token mode, add offline\_access to scopes so the identity provider returns a refresh token for silent refresh.
624624>
625> > **More detail**
625> > [accordion] More detail
626626> >
627627> > Turn off only if your authorization server rejects `offline_access` as an unknown scope. Then add the server’s own refresh-token scope to `scopes`.
628628>
from line 630
630630>
631631> Access-token audience of the gateway or proxy: an https URL or an AD FS relying-party identifier. Leave unset for Entra ID.
632632>
633> > **More detail**
633> > [accordion] More detail
634634> >
635635> > Use it only with `bearerTokenType` set to `access_token`, and only if your identity provider supports RFC 8707. Changing it signs users in again.
636636> >
from line 650
650650>
651651> Space-separated hostnames also accepted as the referrer of the sign-in callback, besides the authorization URL’s host.
652652>
653> > **More detail**
653> > [accordion] More detail
654654> >
655655> > If a callback is rejected for a referrer mismatch, the app log names the rejected host. Add that hostname here.
656656
from line 662
662662
663663**Stream idle timeout.** Extra seconds to wait for model output on a streaming response that is sending only keep-alive pings. Gateway provider only. Default 300.
664664
665> **More detail**
665> [accordion] More detail
666666>
667667> With pings arriving (SSE `ping` events or `:` comment lines), sessions accept at least about five minutes of them, then wait this many seconds more. With no pings, a silent response still fails after about 5 minutes whatever this value, so make the gateway send them.
668668>
from line 914
914914
915915One of: `browser`, `broker`
916916
917> **More detail**
917> [accordion] More detail
918918>
919919> * **`browser`:** register the redirect URI `http://127.0.0.1:<port>/callback` with your identity provider (for Entra, `http://127.0.0.1/callback`).
920920> * **`broker`:** uses Web Account Manager on Windows or Company Portal on macOS, and does not work on Linux. It can satisfy Conditional Access policies that require a compliant or managed device, or token protection.
from line 933
933933
934934**Workforce Identity IdP (OIDC).** Your organization’s OpenID Connect identity provider. Users sign in there, and the app exchanges their ID token at GCP STS.
935935
936> **Child attributes (9)**
936> [accordion] Child attributes (9)
937937>
938938> **clientId** `string` *required*
939939>
from line 973
973973>
974974> Space-separated hostnames also accepted as the referrer of the sign-in callback, besides the authorization URL’s host.
975975>
976> > **More detail**
976> > [accordion] More detail
977977> >
978978> > If a callback is rejected for a referrer mismatch, the app log names the rejected host. Add that hostname here.
979979
from line 1017
10171017
10181018**Azure AI Foundry base URL.** Full base URL for a gateway or proxy in front of Foundry, path included (replaces [https://RESOURCE.services.ai.azure.com/anthropic](https://RESOURCE.services.ai.azure.com/anthropic)).
10191019
1020> **More detail**
1020> [accordion] More detail
10211021>
10221022> Point it only at a gateway or proxy that you run. Requests carry the credential that the app would send to Foundry: the user's Entra ID token, the API key or the helper script's output.
10231023>
from line 1067
10671067
10681068One of: `device-code`, `browser`, `broker`
10691069
1070> **More detail**
1070> [accordion] More detail
10711071>
10721072> * **`device-code`:** shows a code to enter at microsoft.com/devicelogin. The app registration must have **Allow public client flows** enabled.
10731073> * **`browser`:** register `http://127.0.0.1/callback` under **Mobile and desktop applications**. It works with **Allow public client flows** disabled. Conditional Access policies that block device-code sign-in do not affect it.
from line 1083
10831083
10841084**Model discovery.** Auto-populate the model picker from the provider at launch.
10851085
1086> **More detail**
1086> [accordion] More detail
10871087>
10881088> Turn this off if your network cannot reach your inference provider's model-list endpoint.
10891089>
from line 1098
10981098
10991099**Use 1M wherever it’s available.** Every model that offers 1M context shows only its 1M option in the model picker.
11001100
1101> **More detail**
1101> [accordion] More detail
11021102>
11031103> A listed model offers 1M when its `inferenceModels` entry sets `supports1m`. Without a list, a model offers 1M when your gateway's model list marks it.
11041104
from line 1110
11101110
11111111**Model list.** Override the auto-discovered model list. First entry is the default.
11121112
1113> **More detail**
1113> [accordion] More detail
11141114>
11151115> Each entry is a model ID string or an object:
11161116>
from line 1131
11311131>
11321132> For Auto mode on a gateway, also list `claude-sonnet-5`. Its safety classifier calls that ID by default (see `autoModeEnabled`).
11331133
1134> **Child attributes (8)**
1134> [accordion] Child attributes (8)
11351135>
11361136> **name** `string` *required*
11371137>
from line 1163
11631163>
11641164> The Claude model behind an ID that the app cannot identify, such as a gateway alias. The ID gets that model’s effort levels and limits.
11651165>
1166> > **More detail**
1166> > [accordion] More detail
11671167> >
11681168> > Enter a Claude model ID such as `claude-sonnet-5`. Region prefixes, dates and upper case are fine. A family name without `claude-`, such as `sonnet-5`, is ignored. The model picker also ignores a model that Claude Desktop does not know.
11691169> >
from line 1185
11851185
11861186One of: `low`, `medium`, `high`, `xhigh`, `max`
11871187
1188> **More detail**
1188> [accordion] More detail
11891189>
11901190> * A user's own effort choice for that model still applies, unless `alwaysStartWithDefaultModel` is on.
11911191> * A level that the model does not offer becomes the nearest lower level, or its lowest if none is lower.
from line 1209
12091209
12101210**Show estimated cost.** Show an estimated cost on the Usage page, at Anthropic list price unless you set a multiplier or per-model rates.
12111211
1212> **More detail**
1212> [accordion] More detail
12131213>
12141214> The estimate is in USD. `inferenceModelPricingMultiplier` and `inferenceModelPricing` adjust it, and are ignored while this is off.
12151215>
from line 1233
12331233
12341234**Model pricing.** Per-model rates replacing Anthropic list price in the Usage page’s estimate.
12351235
1236> **Child attributes (5)**
1236> [accordion] Child attributes (5)
12371237>
12381238> **name** `string` *required*
12391239>
from line 1265
12651265
12661266[Admin Console](#the-works-with-column): Not available.
12671267
1268> **More detail**
1268> [accordion] More detail
12691269>
12701270> On unless set to `false`. The app fetches Anthropic's signed catalog from `downloads.claude.ai`, or from `modelCatalogUrl` if that is set. The catalog never changes which models are offered, their order or the default model.
12711271>
from line 1281
12811281
12821282[Admin Console](#the-works-with-column): Not available.
12831283
1284> **More detail**
1284> [accordion] More detail
12851285>
12861286> Mirror two Anthropic files unchanged: `https://downloads.claude.ai/model-catalog/v1/catalog.json` and its signature file. The app looks for the signature at this URL with `.raw-sig.json` added to the path.
12871287>
from line 1325
13251325
13261326[Guide for this setting](https://claude.com/docs/third-party/claude-desktop/ssh-remote-sessions.md)
13271327
1328> **More detail**
1328> [accordion] More detail
13291329>
13301330> The app forwards the session's inference credential to the SSH host, plus your collector endpoint and auth headers when `otlpEndpoint` is set. List only hosts you trust with those.
13311331>
from line 1350
13501350
13511351[Guide for this setting](https://claude.com/docs/third-party/claude-desktop/ssh-remote-sessions.md)
13521352
1353> **More detail**
1353> [accordion] More detail
13541354>
13551355> The app never runs another `ssh` in its place. If the program is missing, too old or cannot run, SSH sessions fail. So deliver this key only to devices that have the program.
13561356>
from line 1374
13741374
13751375[Guide for this setting](https://claude.com/docs/third-party/claude-desktop/ssh-remote-sessions.md)
13761376
1377> **More detail**
1377> [accordion] More detail
13781378>
13791379> With `system-openssh`, your OpenSSH client's own Kerberos, certificate and `ssh_config` support applies. See `sshClientPath` for which program runs.
13801380>
from line 1401
14011401
14021402One of: `standard`, `off`
14031403
1404> **More detail**
1404> [accordion] More detail
14051405>
14061406> `standard` turns on Unified Claude. `off` turns Chat and Cowork off, which leaves only Code, or nothing where Code is off. `isClaudeCodeForDesktopEnabled` still decides Code.
14071407>
from line 1417
14171417
14181418**Advanced file analysis.** Allow Claude to run code in a local sandbox to analyze attached files it can’t read natively — like Excel and PowerPoint.
14191419
1420> **More detail**
1420> [accordion] More detail
14211421>
14221422> Of the user's files, the sandbox can read only those attached to the conversation and folders added to the chat's project through the app (read-only).
14231423>
from line 1437
14371437
14381438[Guide for this setting](https://claude.com/docs/third-party/claude-desktop/web-tools.md#web-fetch)
14391439
1440> **More detail**
1440> [accordion] More detail
14411441>
14421442> Does not cover web search, model requests or MCP servers.
14431443>
from line 1455
14551455
14561456**Allowed workspace folders.** Folders that Claude can use in chat projects, Cowork and Code. Code’s shell commands are only partly limited. Unset: all folders.
14571457
1458> **More detail**
1458> [accordion] More detail
14591459>
14601460> Claude can read and write in every listed folder unless its `mode` is `ro`. An empty list allows none.
14611461>
from line 1464
14641464>
14651465> Do not list a home folder: it holds SSH keys and shell start-up files.
14661466
1467> **Child attributes (3)**
1467> [accordion] Child attributes (3)
14681468>
14691469> **path** `string` *required*
14701470>
from line 1480
14801480>
14811481> One of: `rw`, `ro`
14821482>
1483> > **More detail**
1483> > [accordion] More detail
14841484> >
14851485> > * **Code on the device:** Claude's file tools cannot change the folder. Shell commands still can.
14861486> > * **Code over SSH:** the same, but shell commands are partly limited where Claude Code's sandbox runs on the host. Nothing is enforced on Windows hosts.
from line 1495
14951495
14961496**Block reads outside working directories.** Keep Claude’s file tools from reading outside a Code session’s working directories. Shell commands are only partly limited.
14971497
1498> **More detail**
1498> [accordion] More detail
14991499>
15001500> * **File tools** refuse most reads outside the session folder and any `allowedWorkspaceFolders`, in every permission mode.
15011501> * **Shell commands:** where Claude Code's sandbox runs (see `allowedWorkspaceFolders`), most reads in the home folder and other user folders are refused. Elsewhere such reads ask for approval.
from line 1513
15131513
15141514**Allow Auto mode.** Offer Auto mode, where Claude decides which actions need approval. Unset: in Code only. True adds Cowork.
15151515
1516> **More detail**
1516> [accordion] More detail
15171517>
15181518> Unless it is `false`, new Code sessions normally start in Auto mode.
15191519>
from line 1543
15431543
15441544**Allow user-created skills.** Let users create and upload their own skills, and let Claude save skills. Skill files added outside the app are not blocked.
15451545
1546> **More detail**
1546> [accordion] More detail
15471547>
15481548> Skills already on the device stay usable. Plugins from your organization and bundled skills are not affected. To turn off bundled skills, use `disableBundledSkills`.
15491549
from line 1561
15611561
15621562[Guide for this setting](https://claude.com/docs/third-party/claude-desktop/skill-scanning.md)
15631563
1564> **More detail**
1564> [accordion] More detail
15651565>
15661566> How well the scan catches unsafe skills depends on your model. A skill judged possibly unsafe becomes usable, with a caution. Scan tokens count toward the user's usage and token limit.
15671567>
from line 1583
15831583
15841584**Allow user-added plugin marketplaces.** Let users add plugin marketplaces. When off, the app hides the ones your organization did not add and normally does not load their plugins.
15851585
1586> **More detail**
1586> [accordion] More detail
15871587>
15881588> Nothing is deleted: turning it back on restores the hidden marketplaces.
15891589>
from line 1600
16001600
16011601**Allow user-added plugins.** Allow users to add their own plugins. When off, the app hides every option for adding one and refuses uploads.
16021602
1603> **More detail**
1603> [accordion] More detail
16041604>
16051605> Plugins that are already installed, or placed on disk outside the app, are not removed or blocked.
16061606>
from line 1614
16141614
16151615**Allow scheduled tasks.** Allow scheduled tasks in Cowork and Code. When off, scheduling is hidden, existing tasks stop running and Claude cannot create new ones.
16161616
1617> **More detail**
1617> [accordion] More detail
16181618>
16191619> Existing tasks are kept, not deleted, and run again when this is turned back on. While off, sessions also start without Claude Code's own scheduling tools, such as the `/loop` command.
16201620
from line 1626
16261626
16271627**Allow projects.** Let users group chats and Cowork tasks into projects. When off, projects are hidden, not deleted.
16281628
1629> **More detail**
1629> [accordion] More detail
16301630>
16311631> Turning this off only hides projects. Their tasks and chats stay in the list, ungrouped. Their data stays on the user's device, and they come back when you turn it on again.
16321632>
from line 1648
16481648
16491649**Allow Developer Mode.** Let users turn on Developer Mode. When off, the app’s developer tools and the option to install an unpacked extension are unavailable.
16501650
1651> **More detail**
1651> [accordion] More detail
16521652>
16531653> Unpacked extensions that are already installed keep working. An extension folder copied by hand into the app's extensions folder is not blocked. Packaged (`.mcpb`) extensions follow `isDesktopExtensionEnabled`, not this key.
16541654
from line 1660
16601660
16611661**Default Quick Entry shortcut.** Set the shortcut that opens Quick Entry, such as Ctrl+Alt+K, for users who haven’t set their own in Settings. Use “off” for no shortcut.
16621662
1663> **More detail**
1663> [accordion] More detail
16641664>
16651665> Unset keeps the built-in shortcut: double-tap Option on macOS, `Ctrl+Alt+Space` elsewhere.
16661666>
from line 1678
16781678
16791679**Allow screenshots of the screen and other apps.** Let users screenshot their screen or other apps’ windows in Quick Entry on macOS. When off, it never asks for Screen Recording access.
16801680
1681> **More detail**
1681> [accordion] More detail
16821682>
16831683> When off, another app's window that a user mentions with @ in a chat also comes without its picture.
16841684>
from line 1692
16921692
16931693**Allow sharing files open in other apps.** Let users attach the file open in another app’s window in Quick Entry on macOS. When off, it never asks for Accessibility access.
16941694
1695> **More detail**
1695> [accordion] More detail
16961696>
16971697> Off applies even where the Accessibility permission is already granted. Another app's window that a user mentions with @ in a chat then also comes without its file. Not covered: Claude's other uses of that permission, and files that users attach themselves.
16981698
from line 1704
17041704
17051705**Skip WebFetch domain check.** Skip Claude Code’s WebFetch domain lookup against api.anthropic.com in Code sessions. Off by default; turn on when that host is blocked.
17061706
1707> **More detail**
1707> [accordion] More detail
17081708>
17091709> Before fetching a page, Claude Code's WebFetch tool asks `api.anthropic.com` whether the domain is on Anthropic's content blocklist.
17101710>
from line 1719
17191719
17201720**Built-in tool policy.** Approval per tool or rule such as Bash(curl \*). “ask” prompts the user before each matching call. To block, use Disabled built-in tools.
17211721
1722> **More detail**
1722> [accordion] More detail
17231723>
17241724> Entries use the same tool names and rules as `disabledBuiltinTools`, with the same limits. Command rules are not a security boundary, and `Bash(…)` rules do not cover `PowerShell`.
17251725>
from line 1737
17371737
17381738**Disabled built-in tools.** Built-in tools, or rules such as Read(//etc/\*\*), blocked in Cowork and Code. Shell commands do not fully follow file-path rules.
17391739
1740> **More detail**
1740> [accordion] More detail
17411741>
17421742> An entry is a [tool name](https://code.claude.com/docs/en/tools-reference) such as `Bash`, or a [permission rule](https://code.claude.com/docs/en/permissions#permission-rule-syntax) such as `Edit(//etc/**)`.
17431743>
from line 1755
17551755
17561756[Guide for this setting](https://claude.com/docs/third-party/claude-desktop/gateway.md#mcp-tool-search)
17571757
1758> **More detail**
1758> [accordion] More detail
17591759>
17601760> Your gateway or provider must accept what tool search adds, such as `tool-search-tool-2025-10-19` in the `anthropic-beta` header. Otherwise requests fail with HTTP 400. On Foundry or a custom base URL, requests also carry Claude Code's other experimental betas.
17611761>
from line 1769
17691769
17701770**Organization instructions.** Appended to Claude’s system prompt in Chat, Cowork, and Code. Guidance the model follows, not an enforced control. Up to 3,000 characters.
17711771
1772> **More detail**
1772> [accordion] More detail
17731773>
17741774> Claude is told that they take priority over a user's personal preferences.
17751775>
from line 1801
18011801
18021802[Admin Console](#the-works-with-column): Not available.
18031803
1804> **More detail**
1804> [accordion] More detail
18051805>
18061806> In an MDM profile, this key also keeps that profile in charge. Without it, a user can sign in to Claude.ai with an organization that configures Claude Desktop in the Admin Console. The device then mostly follows that organization's configuration, at later launches too.
18071807>
from line 1829
18291829
18301830[Admin Console](#the-works-with-column): Set automatically.
18311831
1832> **More detail**
1832> [accordion] More detail
18331833>
18341834> The app checks the addresses of public sites that open or are framed in the browser (query removed) against Anthropic's site safety list on `releases.claude.com`.
18351835>
from line 1849
18491849
18501850[Admin Console](#the-works-with-column): Set automatically.
18511851
1852> **More detail**
1852> [accordion] More detail
18531853>
18541854> A `coworkEgressAllowedHosts` list other than `*` applies on top of either value: Claude cannot open sites outside it.
18551855>
from line 1865
18651865
18661866[Admin Console](#the-works-with-column): Set automatically.
18671867
1868> **More detail**
1868> [accordion] More detail
18691869>
18701870> Entries use the same format as `coworkEgressAllowedHosts`, except:
18711871>
from line 1884
18841884
18851885[Admin Console](#the-works-with-column): Set automatically.
18861886
1887> **More detail**
1887> [accordion] More detail
18881888>
18891889> Entries use the same format as `coworkEgressAllowedHosts`. `*` blocks every external site. `example.com` also covers `www.example.com`, but no other subdomain. An entry outside that format matches nothing.
18901890>
from line 1900
19001900
19011901**Claude.ai data import.** Lets users import Claude.ai chats and projects, and earlier Claude sessions on this device.
19021902
1903> **Child attributes (5)**
1903> [accordion] Child attributes (5)
19041904>
19051905> **enabled** `boolean` (default: false)
19061906>
from line 1910
19101910>
19111911> When set, users import by sign-in only, and only from the Claude.ai organizations with these IDs.
19121912>
1913> > **More detail**
1913> > [accordion] More detail
19141914> >
19151915> > * The list narrows `enabled`. It turns nothing on by itself and does not affect `automatic3pImport`.
19161916> > * An empty list, or one that cannot be read, allows no organization, so no import is offered. A null or empty string counts as unset.
from line 1920
19201920>
19211921> Copy this computer’s earlier third-party sessions into the app once, in the background. Independent of `enabled`.
19221922>
1923> > **More detail**
1923> > [accordion] More detail
19241924> >
19251925> > Unset is off, except in Admin Console organizations, where it is on unless an admin turns it off. Without the Admin Console, also set `deploymentOrganizationUuid`. Only sessions stored before you set it are copied.
19261926> >
from line 1935
19351935>
19361936> Lets users export this device’s chats, Cowork tasks and Code sessions as a zip to import elsewhere. No effect unless Enable import is on.
19371937>
1938> > **More detail**
1938> > [accordion] More detail
19391939> >
19401940> > Transcripts contain conversation content including tool outputs. Treat exported zips as sensitive data.
19411941>
from line 1957
19571957
19581958**Managed MCP servers.** Org-pushed MCP servers: remote (HTTP/SSE) or local (stdio command).
19591959
1960> **More detail**
1960> [accordion] More detail
19611961>
19621962> Values of an entry's `toolPolicy`, per tool name:
19631963>
from line 1967
19671967>
19681968> A name can contain `*`, as in `read_*`. When several wildcards match, the strictest applies. An exact name normally takes priority over a wildcard. To block by default, use `"*": "blocked"` plus exact `allow` entries.
19691969
1970> **Child attributes**
1970> [accordion] Child attributes
19711971>
19721972> **name** `string` *required*
19731973>
19741974> Must be unique. A rename resets each user’s on/off choice, tool permissions and device sign-in, and can break a plugin server’s match.
19751975>
1976> > **More detail**
1976> > [accordion] More detail
19771977> >
19781978> > After a rename:
19791979> >
from line 1988
19881988>
19891989> Lock the approval state for specific tools. Unlisted tools stay user-controlled.
19901990>
1991> > **More detail**
1991> > [accordion] More detail
19921992> >
19931993> > Also applies to an installed plugin's server that matches this entry by URL, or else by name (letter case is ignored).
19941994> >
from line 1996
19961996> > * For a server that only a plugin runs, use an entry with `transport: "policy-only"`.
19971997> > * Claude Code runs or connects to some plugin servers itself. For those: Claude Code's own managed settings, where a session has any, take priority by default.
19981998>
1999> **microsoft365**
2000>
2001> Applies when `server` is `microsoft365`. The in-app configuration window calls it **Microsoft 365**.
2002>
2003> **server** `string` *required*
2004>
2005> Which bundled connector this entry turns on. Set instead of a transport; each built-in server has its own fields.
2006>
2007> Must be: `microsoft365`
2008>
2009> **tenantId** `string` *required*
2010>
2011> Your organization’s Microsoft Entra directory (tenant) ID.
2012>
2013> **clientId** `string` *required*
2014>
2015> OAuth app client ID for this built-in server.
2016>
2017> **azureCloud** `enum`
2018>
2019> Microsoft cloud for sign-in and Graph. Use global for commercial Microsoft 365. US Government clouds need your own app registration.
2020>
2021> One of: `global`, `us-gov-high`, `us-gov-dod`
2022>
2023> **continuousAccessEvaluation** `enum` (default: enabled)
2024>
2025> Requests Microsoft Graph tokens that last up to about 28 hours but can be revoked within minutes. “disabled” keeps one-hour tokens.
2026>
2027> One of: `enabled` (default), `disabled`
2028>
2029> > **More detail**
2030> >
2031> > With a Conditional Access policy on IP named locations or Global Secure Access compliant networks, a token presented from outside that network is cut off. Tenants without such a policy get no network-based replay protection.
2032> >
2033> > After a change, users sign in again.
2034>
2035> **scope** `string`
2036>
2037> What the server may request at sign-in. If blank, Desktop’s default read set is used.
2038>
2039> **websearch**
2040>
2041> Applies when `server` is `websearch`. The in-app configuration window calls it **Web search**.
2042>
2043> **headers** `object: name → value`
2044>
2045> Static headers sent on every request: routing and tenant headers only. No credentials here: use the headers helper script for those.
2046>
2047> **headersHelper** `string`
2048>
2049> Consent required (A value that a bootstrap server or a self-hosted session host delivers applies only after the user approves it, unless machine-scoped device management set that server's address. For a bootstrap server, the trustBootstrapDelivery key overrides that default. A value set in an MDM profile, the local configuration file or the Enterprise Admin Console needs no approval.)
2050>
2051> Script that prints the auth header as a JSON object to stdout. Runs before each request (cached for the TTL below).
2052>
2053> > **More detail**
2054> >
2055> > The helper script normally runs with `CLAUDE_CODE_MCP_SERVER_NAME` set to this entry's `name`, so one script can serve several servers. Put the variable in double quotes, compare it with the names you expect, and do not pass it to another command.
2056>
2057> **headersHelperArgs** `string[]`
2058>
2059> Consent required (A value that a bootstrap server or a self-hosted session host delivers applies only after the user approves it, unless machine-scoped device management set that server's address. For a bootstrap server, the trustBootstrapDelivery key overrides that default. A value set in an MDM profile, the local configuration file or the Enterprise Admin Console needs no approval.)
2060>
2061> Arguments passed to the headers helper script, one per entry, in order. Leave unset to run it with none.
2062>
2063> > **More detail**
2064> >
2065> > * On every platform, an argument cannot be empty or contain a double quote, a percent sign or a control character.
2066> > * Do not put secrets in arguments. They are visible in the app log and to other processes on the device.
2067> > * Have the script fail when a needed argument is missing. An app version that does not know this setting passes none.
2068>
2069> **headersHelperTtlSec** `integer`
2070>
2071> How long the helper’s headers are reused before it runs again, in seconds. Defaults to 300.
2072>
2073> **headersHelperRefreshBufferSec** `integer`
2074>
2075> Seconds before the TTL expires at which the helper re-runs mid-session. Defaults to 60. Keep it larger than the helper’s typical runtime.
2076>
2077> **server** `string` *required*
2078>
2079> Which bundled connector this entry turns on. Set instead of a transport; each built-in server has its own fields.
2080>
2081> Must be: `websearch`
2082>
2083> **provider** `enum` *required*
2084>
2085> Runs web search from the user’s device, for inference providers without built-in search. Supply the API key with the headers helper script.
2086>
2087> One of: `brave`, `tavily`, `exa`, `custom`
2088>
2089> > **More detail**
2090> >
2091> > Not needed on the Anthropic API or Vertex, where the model's built-in web search is available.
2092> >
2093> > Every search provider except `custom` needs an auth header. The API key is a credential, so have `headersHelper` print the header rather than storing it in `headers`:
2094> >
2095> > * **Brave:** `X-Subscription-Token`
2096> > * **Exa:** `x-api-key`
2097> > * **Tavily:** `Authorization` (Bearer …)
2098>
2099> **platformOverrides** `object`
2100>
2101> On that operating system, each setting here replaces the entry’s own. A setting left out keeps the entry’s.
2102>
2103> > **More detail**
2104> >
2105> > A value written here replaces the entry's value whole: lists and maps are not merged.
2106> >
2107> > * A local (`stdio`) entry can repeat `command`, `args`, `env`, `envHelper` and `envHelperArgs`. It always needs its own `command` too.
2108> > * A remote or web search entry can repeat `headersHelper` and `headersHelperArgs`. If it gives `headersHelper` here, it needs its own too.
2109> > * A mistake under any operating system drops the server on all of them.
2110> > * An older version ignores this setting and runs the entry's own values. Until all devices are updated, put the Windows values in the entry itself.
2111>
2112> > **Child attributes (3)**
2113> >
2114> > **platformOverrides.win32** `object: name → value`
2115> >
2116> > On Windows, these replace the entry’s own settings. A setting left out keeps the entry’s.
2117> >
2118> > **platformOverrides.darwin** `object: name → value`
2119> >
2120> > On macOS, these replace the entry’s own settings. A setting left out keeps the entry’s.
2121> >
2122> > **platformOverrides.linux** `object: name → value`
2123> >
2124> > On Linux, these replace the entry’s own settings. A setting left out keeps the entry’s.
2125>
2126> **customUrl** `string`
2127>
2128> POST endpoint accepting \{q} JSON and returning a results\[] array. Only used when provider is Custom.
2129>
2130> **github**
2131>
2132> Applies when `server` is `github`. The in-app configuration window calls it **GitHub**.
2133>
2134> **server** `string` *required*
2135>
2136> Which bundled connector this entry turns on. Set instead of a transport; each built-in server has its own fields.
2137>
2138> Must be: `github`
2139>
2140> **clientId** `string` *required*
2141>
2142> GitHub OAuth app client ID (device flow must be enabled on the app).
2143>
2144> **host** `string`
2145>
2146> Leave blank for github.com. For GitHub Enterprise Server, your instance’s base URL.
2147>
2148> **scope** `string`
2149>
2150> Space-separated GitHub OAuth scopes. Unset: Desktop’s default scopes. Ignored for GitHub Apps: their registration sets the permissions.
2151>
2152> **toolsets** `string`
2153>
2154> Comma-separated github-mcp-server toolsets to enable. If blank, the bundled server’s default toolsets are used.
2155>
2156> > **More detail**
2157> >
2158> > Every tool that can change something asks before each call unless `toolPolicy` says otherwise.
2159> >
2160> > These tools cannot be set looser than `ask`, and `allow` is treated as `ask`: `merge_pull_request`, `push_files`, `create_or_update_file`, `delete_file`, `actions_run_trigger`, `pull_request_review_write`, `delete_repository`. Where no prompt can be shown, their calls are refused.
2161>
2162> **readOnly** `boolean`
2163>
2164> Offer only read tools — the server registers no write tools at all.
2165>
2166> **http / sse**
2167>
2168> Applies when `transport` is `http` or `sse`. The in-app configuration window calls it **Streamable HTTP** or **SSE (legacy)**.
2169>
2170> **transport** `enum` *required*
2171>
2172> How the app connects: HTTP, legacy SSE or a local command (stdio). policy-only connects to nothing: it sets a plugin server’s tool policy.
2173>
2174> One of: `http`, `sse`
2175>
2176> **url** `string` *required*
2177>
2178> HTTPS endpoint of the remote MCP server. Use the server’s final address: HTTP redirects are not followed.
2179>
2180> **oauth** `object`
2181>
2182> OAuth sign-in for a remote server: register a client automatically, use your own client ID, or use an Anthropic-hosted client identity.
2183>
2184> [Guide for this setting](https://claude.com/docs/third-party/claude-desktop/mcp-sign-in.md)
2185>
2186> > **More detail**
2187> >
2188> > Choose **Bring your own client** when the provider requires an OAuth client that you register, and set `clientId`. Add `clientSecret` and `authorizationServer` only when the provider also requires the secret.
2189>
2190> > **Child attributes**
2191> >
2192> > **dcr**
2193> >
2194> > Applies when `oauth.mode` is `dcr`. The in-app configuration window calls it **Auto-register (dynamic client registration)**. No other fields apply.
2195> >
2196> > Write `"oauth": true`. `{"mode": "dcr"}` means the same and takes no other member. To register automatically with scopes of your choice, write an object that sets any of `scope`, `appendOfflineAccess` and `additionalRedirectReferrerHosts` and nothing else, as Bring your own client describes.
2197> >
2198> > **byo**
2199> >
2200> > Applies when `oauth.mode` is `byo`. The in-app configuration window calls it **Bring your own client**.
2201> >
2202> > `mode` can be left out. Without `clientId` the object may set only `scope`, `appendOfflineAccess` and `additionalRedirectReferrerHosts`, and the app registers a client automatically; with any other member listed here and no `clientId`, the app drops the entry.
2203> >
2204> > **oauth.clientId** `string`
2205> >
2206> > OAuth client ID from your identity provider’s app registration. Unset: auto-register (dynamic client registration).
2207> >
2208> > **oauth.clientSecret** `string`
2209> >
2210> > Only if the provider requires one. The Admin Console stores only a Google Desktop-app secret (GOCSPX-…). For others use the helper script.
2211> >
2212> > **oauth.clientSecretHelper** `string`
1999> > [tab] microsoft365
2000> >
2001> > Applies when `server` is `microsoft365`. The in-app configuration window calls it **Microsoft 365**.
2002> >
2003> > **server** `string` *required*
2004> >
2005> > Which bundled connector this entry turns on. Set instead of a transport; each built-in server has its own fields.
2006> >
2007> > Must be: `microsoft365`
2008> >
2009> > **tenantId** `string` *required*
2010> >
2011> > Your organization’s Microsoft Entra directory (tenant) ID.
2012> >
2013> > **clientId** `string` *required*
2014> >
2015> > OAuth app client ID for this built-in server.
2016> >
2017> > **azureCloud** `enum`
2018> >
2019> > Microsoft cloud for sign-in and Graph. Use global for commercial Microsoft 365. US Government clouds need your own app registration.
2020> >
2021> > One of: `global`, `us-gov-high`, `us-gov-dod`
2022> >
2023> > **continuousAccessEvaluation** `enum` (default: enabled)
2024> >
2025> > Requests Microsoft Graph tokens that last up to about 28 hours but can be revoked within minutes. “disabled” keeps one-hour tokens.
2026> >
2027> > One of: `enabled` (default), `disabled`
2028> >
2029> > > [accordion] More detail
2030> > >
2031> > > With a Conditional Access policy on IP named locations or Global Secure Access compliant networks, a token presented from outside that network is cut off. Tenants without such a policy get no network-based replay protection.
2032> > >
2033> > > After a change, users sign in again.
2034> >
2035> > **scope** `string`
2036> >
2037> > What the server may request at sign-in. If blank, Desktop’s default read set is used.
2038>
2039> > [tab] websearch
2040> >
2041> > Applies when `server` is `websearch`. The in-app configuration window calls it **Web search**.
2042> >
2043> > **headers** `object: name → value`
2044> >
2045> > Static headers sent on every request: routing and tenant headers only. No credentials here: use the headers helper script for those.
2046> >
2047> > **headersHelper** `string`
22132048> >
22142049> > Consent required (A value that a bootstrap server or a self-hosted session host delivers applies only after the user approves it, unless machine-scoped device management set that server's address. For a bootstrap server, the trustBootstrapDelivery key overrides that default. A value set in an MDM profile, the local configuration file or the Enterprise Admin Console needs no approval.)
22152050> >
2216> > Script that prints the client secret as a JSON object with a single clientSecret key. Takes priority over Client secret.
2217> >
2218> > > **More detail**
2219> > >
2220> > > * Its standard output must be exactly `{"clientSecret": "…"}`, with no other keys or lines. Any other output stops the server from connecting.
2221> > > * It must exit with code `0` within 30 seconds.
2222> > > * It runs with no arguments each time the server connects and each time its sign-in is renewed in the background. Choose a script that does not prompt the user.
2051> > Script that prints the auth header as a JSON object to stdout. Runs before each request (cached for the TTL below).
2052> >
2053> > > [accordion] More detail
22232054> > >
22242055> > > The helper script normally runs with `CLAUDE_CODE_MCP_SERVER_NAME` set to this entry's `name`, so one script can serve several servers. Put the variable in double quotes, compare it with the names you expect, and do not pass it to another command.
22252056> >
2226> > **oauth.authorizationServer** `string[]`
2227> >
2228> > Issuer URLs the OAuth sign-in may use, as a JSON array. Pre-filled by presets; ask your IdP admin if unsure.
2229> >
2230> > **oauth.authorizationUrl** `string`
2231> >
2232> > Only for IdPs that don’t serve a .well-known discovery document. Set together with Token URL; requires Client ID.
2233> >
2234> > **oauth.tokenUrl** `string`
2235> >
2236> > Only for IdPs that don’t serve a .well-known discovery document. Set together with Authorization URL; requires Client ID.
2237> >
2238> > **oauth.tenantId** `string`
2239> >
2240> > Required for single-tenant Entra apps. Leave blank for multi-tenant or non-Microsoft IdPs.
2241> >
2242> > > **More detail**
2243> > >
2244> > > For a GCC High or DoD tenant, leave this unset and set `authorizationServer` to `https://login.microsoftonline.us/<tenant-id>/v2.0`.
2245> >
2246> > **oauth.authFlow** `enum`
2247> >
2248> > How Entra sign-in runs for this server: the system browser (default) or the OS identity broker.
2249> >
2250> > One of: `browser`, `broker`
2251> >
2252> > > **More detail**
2253> > >
2254> > > `broker` signs in through the OS identity broker: Web Account Manager on Windows, the Company Portal SSO extension on macOS. It can satisfy Conditional Access policies that require a compliant or managed device, or token protection.
2255> > >
2256> > > * It requires `tenantId`, `clientId` and `scope`, and an Entra-registered device.
2257> > > * The app registration must list the [broker redirect URIs](https://claude.com/docs/third-party/claude-desktop/entra-broker.md).
2258> > > * `broker` is not supported on Linux. Where the broker is not available, sign-in falls back to the system browser.
2259> >
2260> > **oauth.scope** `string`
2261> >
2262> > Space-separated scopes to request. Unset: the scopes the server advertises. Required if Tenant ID is set or the resource parameter omitted.
2263> >
2264> > **oauth.appendOfflineAccess** `boolean`
2265> >
2266> > Adds offline\_access to the authorize request so the IdP returns a refresh token for silent renewal.
2267> >
2268> > > **More detail**
2269> > >
2270> > > Leave off if `scope` already includes `offline_access` or the server rejects it.
2271> > >
2272> > > If you set `authorizationUrl` and `tokenUrl`, this switch does not work on its own. Add `offline_access` to `scope` instead.
2273> >
2274> > **oauth.omitResource** `boolean`
2275> >
2276> > Sends no OAuth resource parameter. Use only if your identity provider rejects it. Requires Client ID, Scope and one sign-in server.
2277> >
2278> > > **More detail**
2279> > >
2280> > > By default, sign-in sends the URL that this server publishes as the OAuth `resource` parameter, which ties the token to this server. Microsoft Entra ID rejects it with `AADSTS9010010` when the URL is not an Application ID URI in your tenant.
2281> > >
2282> > > * **Requires:** `clientId`, a `scope` with an API scope, and exactly one of `tenantId`, a single `authorizationServer`, or `authorizationUrl` with `tokenUrl`. Otherwise the entry is not loaded.
2283> > > * **Risk:** `scope` alone now says which API the token is for, so check that it names this server's app. A scope for another app is accepted, and this server then receives a token meant for that app.
2284> > > * **Entra ID:** write the scope in full, as in `api://<app-id>/<scope>`.
2285> >
2286> > **oauth.callbackHost** `enum`
2287> >
2288> > Use localhost only if your IdP’s registered redirect URI specifies it.
2289> >
2290> > One of: `127.0.0.1`, `localhost`
2291> >
2292> > **oauth.callbackPort** `integer`
2293> >
2294> > Only set if your IdP requires an exact-match redirect port. Entra accepts any.
2295> >
2296> > **oauth.additionalRedirectReferrerHosts** `string`
2297> >
2298> > Space-separated hostnames also accepted as the referrer of the sign-in callback, besides the authorization URL’s host.
2299> >
2300> > > **More detail**
2301> > >
2302> > > If a callback is rejected for a referrer mismatch, the app log names the rejected host. Add that hostname here.
2303> >
2304> > **hosted**
2305> >
2306> > Applies when `oauth.mode` is `hosted`. The in-app configuration window calls it **Anthropic-hosted client identity (requires Claude.ai sign-in)**.
2307> >
2308> > Always write `"mode": "hosted"`. Without it the object is read as Bring your own client, which needs `clientId` beside `authorizationServer`, so the app drops the entry.
2309> >
2310> > **oauth.clientId** `string`
2311> >
2312> > Filled in by Claude.ai: the URL of Anthropic’s hosted client-metadata document. Do not set it.
2313> >
2314> > **oauth.authorizationServer** `string[]` *required*
2315> >
2316> > The exact issuer string(s) that the server’s authorization server advertises, as a JSON array. Anthropic signs the identity only for these.
2317> >
2318> > **oauth.scope** `string`
2319> >
2320> > Space-separated scopes to request. Unset: the scopes the server advertises. Required if Tenant ID is set or the resource parameter omitted.
2321>
2322> **headers** `object: name → value`
2323>
2324> Static headers sent on every request: routing and tenant headers only. No credentials here: use the headers helper script for those.
2325>
2326> **headersHelper** `string`
2327>
2328> Consent required (A value that a bootstrap server or a self-hosted session host delivers applies only after the user approves it, unless machine-scoped device management set that server's address. For a bootstrap server, the trustBootstrapDelivery key overrides that default. A value set in an MDM profile, the local configuration file or the Enterprise Admin Console needs no approval.)
2329>
2330> Absolute path to an executable that prints a JSON object of HTTP headers on stdout. Merged over static headers; the helper wins on conflict.
2331>
2332> > **More detail**
2333> >
2334> > The helper script normally runs with `CLAUDE_CODE_MCP_SERVER_NAME` set to this entry's `name`, so one script can serve several servers. Put the variable in double quotes, compare it with the names you expect, and do not pass it to another command.
2335>
2336> **headersHelperArgs** `string[]`
2337>
2338> Consent required (A value that a bootstrap server or a self-hosted session host delivers applies only after the user approves it, unless machine-scoped device management set that server's address. For a bootstrap server, the trustBootstrapDelivery key overrides that default. A value set in an MDM profile, the local configuration file or the Enterprise Admin Console needs no approval.)
2339>
2340> Arguments passed to the headers helper script, one per entry, in order. Leave unset to run it with none.
2341>
2342> > **More detail**
2343> >
2344> > * On every platform, an argument cannot be empty or contain a double quote, a percent sign or a control character.
2345> > * Do not put secrets in arguments. They are visible in the app log and to other processes on the device.
2346> > * Have the script fail when a needed argument is missing. An app version that does not know this setting passes none.
2347>
2348> **headersHelperTtlSec** `integer`
2349>
2350> How long the helper’s headers are reused before it runs again, in seconds. Defaults to 300.
2351>
2352> **headersHelperRefreshBufferSec** `integer`
2353>
2354> Seconds before the TTL expires at which the helper re-runs mid-session. Defaults to 60. Keep it larger than the helper’s typical runtime.
2355>
2356> **platformOverrides** `object`
2357>
2358> On that operating system, each setting here replaces the entry’s own. A setting left out keeps the entry’s.
2359>
2360> > **More detail**
2361> >
2362> > A value written here replaces the entry's value whole: lists and maps are not merged.
2363> >
2364> > * A local (`stdio`) entry can repeat `command`, `args`, `env`, `envHelper` and `envHelperArgs`. It always needs its own `command` too.
2365> > * A remote or web search entry can repeat `headersHelper` and `headersHelperArgs`. If it gives `headersHelper` here, it needs its own too.
2366> > * A mistake under any operating system drops the server on all of them.
2367> > * An older version ignores this setting and runs the entry's own values. Until all devices are updated, put the Windows values in the entry itself.
2368>
2369> > **Child attributes (3)**
2370> >
2371> > **platformOverrides.win32** `object: name → value`
2372> >
2373> > On Windows, these replace the entry’s own settings. A setting left out keeps the entry’s.
2374> >
2375> > **platformOverrides.darwin** `object: name → value`
2376> >
2377> > On macOS, these replace the entry’s own settings. A setting left out keeps the entry’s.
2378> >
2379> > **platformOverrides.linux** `object: name → value`
2380> >
2381> > On Linux, these replace the entry’s own settings. A setting left out keeps the entry’s.
2382>
2383> **toolTimeoutSec** `integer`
2384>
2385> Maximum time in seconds that Claude waits for one tool call to this server. Leave empty to use the MCP tool call timeout.
2386>
2387> > **More detail**
2388> >
2389> > For Claude's calls to this server it takes the place of `mcpToolTimeoutSec`. Use a whole number from 5 to 3600: any other value is ignored.
2390> >
2391> > * Progress messages from the server do not extend the limit.
2392> > * Time that a user spends on a sign-in or consent step during the call counts toward the limit. On a server that asks for sign-in, set a generous value.
2393>
2394> **icon** `string`
2395>
2396> Icon shown for this connector: a PNG or JPEG image as a base64 data: URI, at most 4,096 characters.
2397>
2398> > **More detail**
2399> >
2400> > A PNG of 48 by 48 pixels or smaller works well. Keep icons small: Windows Group Policy holds the whole `managedMcpServers` list in one value of at most 65,535 characters.
2401>
2402> **defaultState** `enum`
2403>
2404> Whether this connector starts on or off for each person.
2405>
2406> One of: `on`, `off`
2407>
2408> > **More detail**
2409> >
2410> > Unset means `on`.
2411> >
2412> > * This is a starting point, not a restriction: each user can turn the connector on. To withhold a connector, remove it or block its tools with `toolPolicy`.
2413> > * Adding `off` to a connector already in use turns it off for all users who have not switched it on themselves, scheduled tasks included.
2414> > * This setting does not apply to a plugin's server that matches this entry.
2415>
2416> **stdio**
2417>
2418> Applies when `transport` is `stdio`. The in-app configuration window calls it **Local command (stdio)**.
2419>
2420> **transport** `string` *required*
2421>
2422> How the app connects: HTTP, legacy SSE or a local command (stdio). policy-only connects to nothing: it sets a plugin server’s tool policy.
2423>
2424> Must be: `stdio`
2425>
2426> **command** `string` *required*
2427>
2428> Consent required (A value that a bootstrap server or a self-hosted session host delivers applies only after the user approves it, unless machine-scoped device management set that server's address. For a bootstrap server, the trustBootstrapDelivery key overrides that default. A value set in an MDM profile, the local configuration file or the Enterprise Admin Console needs no approval.)
2429>
2430> Absolute path to the server executable, run on the user’s machine.
2431>
2432> **args** `string[]`
2433>
2434> Consent required (A value that a bootstrap server or a self-hosted session host delivers applies only after the user approves it, unless machine-scoped device management set that server's address. For a bootstrap server, the trustBootstrapDelivery key overrides that default. A value set in an MDM profile, the local configuration file or the Enterprise Admin Console needs no approval.)
2435>
2436> Arguments passed to the command, one per entry.
2437>
2438> **env** `object: name → value`
2439>
2440> Consent required (A value that a bootstrap server or a self-hosted session host delivers applies only after the user approves it, unless machine-scoped device management set that server's address. For a bootstrap server, the trustBootstrapDelivery key overrides that default. A value set in an MDM profile, the local configuration file or the Enterprise Admin Console needs no approval.)
2441>
2442> Environment variables set for the command.
2443>
2444> **envHelper** `string`
2445>
2446> Consent required (A value that a bootstrap server or a self-hosted session host delivers applies only after the user approves it, unless machine-scoped device management set that server's address. For a bootstrap server, the trustBootstrapDelivery key overrides that default. A value set in an MDM profile, the local configuration file or the Enterprise Admin Console needs no approval.)
2447>
2448> Script that prints environment variables as a JSON object to stdout. Runs when the local server starts (cached for the TTL below).
2449>
2450> > **More detail**
2451> >
2452> > * Its values take priority over `env`.
2453> > * If the script fails, the server does not start.
2454> > * A script with nothing to set must print `{}`. Empty output counts as a failure.
2455> > * The helper script normally runs with `CLAUDE_CODE_MCP_SERVER_NAME` set to this entry's `name`, so one script can serve several servers. Put the variable in double quotes, compare it with the names you expect, and do not pass it to another command.
2456>
2457> **envHelperArgs** `string[]`
2458>
2459> Consent required (A value that a bootstrap server or a self-hosted session host delivers applies only after the user approves it, unless machine-scoped device management set that server's address. For a bootstrap server, the trustBootstrapDelivery key overrides that default. A value set in an MDM profile, the local configuration file or the Enterprise Admin Console needs no approval.)
2460>
2461> Arguments passed to the environment helper script, one per entry, in order. Leave unset to run it with none.
2462>
2463> > **More detail**
2464> >
2465> > * On every platform, an argument cannot be empty or contain a double quote, a percent sign or a control character.
2466> > * Do not put secrets in arguments. They are visible in the app log and to other processes on the device.
2467> > * Have the script fail when a needed argument is missing. An app version that does not know this setting passes none.
2468>
2469> **envHelperTtlSec** `integer` (default: 300)
2470>
2471> Maximum age of a cached helper result, in seconds (default 300). Applies when the server starts or restarts.
2472>
2473> > **More detail**
2474> >
2475> > Set this at or below your token lifetime. Otherwise a server that crashes because its token expired can restart with the same cached values until this time is up.
2476>
2477> **startupTimeoutSec** `integer` (default: 120)
2478>
2479> Maximum wait in seconds for the server to start and list its tools.
2480>
2481> **platformOverrides** `object`
2482>
2483> On that operating system, each setting here replaces the entry’s own. A setting left out keeps the entry’s.
2484>
2485> > **More detail**
2486> >
2487> > A value written here replaces the entry's value whole: lists and maps are not merged.
2488> >
2489> > * A local (`stdio`) entry can repeat `command`, `args`, `env`, `envHelper` and `envHelperArgs`. It always needs its own `command` too.
2490> > * A remote or web search entry can repeat `headersHelper` and `headersHelperArgs`. If it gives `headersHelper` here, it needs its own too.
2491> > * A mistake under any operating system drops the server on all of them.
2492> > * An older version ignores this setting and runs the entry's own values. Until all devices are updated, put the Windows values in the entry itself.
2493>
2494> > **Child attributes (3)**
2495> >
2496> > **platformOverrides.win32** `object: name → value`
2497> >
2498> > On Windows, these replace the entry’s own settings. A setting left out keeps the entry’s.
2499> >
2500> > **platformOverrides.darwin** `object: name → value`
2501> >
2502> > On macOS, these replace the entry’s own settings. A setting left out keeps the entry’s.
2503> >
2504> > **platformOverrides.linux** `object: name → value`
2505> >
2506> > On Linux, these replace the entry’s own settings. A setting left out keeps the entry’s.
2507>
2508> **toolTimeoutSec** `integer`
2509>
2510> Maximum time in seconds that Claude waits for one tool call to this server. Leave empty to use the MCP tool call timeout.
2511>
2512> > **More detail**
2513> >
2514> > For Claude's calls to this server it takes the place of `mcpToolTimeoutSec`. Use a whole number from 5 to 3600: any other value is ignored.
2515> >
2516> > * Progress messages from the server do not extend the limit.
2517> > * Time that a user spends on a sign-in or consent step during the call counts toward the limit. On a server that asks for sign-in, set a generous value.
2518>
2519> **icon** `string`
2520>
2521> Icon shown for this connector: a PNG or JPEG image as a base64 data: URI, at most 4,096 characters.
2522>
2523> > **More detail**
2524> >
2525> > A PNG of 48 by 48 pixels or smaller works well. Keep icons small: Windows Group Policy holds the whole `managedMcpServers` list in one value of at most 65,535 characters.
2526>
2527> **policy-only**
2528>
2529> Applies when `transport` is `policy-only`. The in-app configuration window calls it **Tool permissions only (plugin server)**.
2530>
2531> **transport** `string` *required*
2532>
2533> How the app connects: HTTP, legacy SSE or a local command (stdio). policy-only connects to nothing: it sets a plugin server’s tool policy.
2534>
2535> Must be: `policy-only`
2536>
2537> > **More detail**
2538> >
2539> > For a `policy-only` entry:
2540> >
2541> > * Set `name` to the server's name as the plugin declares it (letter case is ignored), and `toolPolicy` to the permissions. A name that matches no installed plugin server does nothing.
2542> > * It takes priority over `orgPluginSettings` for that server. With no `toolPolicy`, the server is left unrestricted.
2543> > * An older version drops the entry and applies `orgPluginSettings` instead. Until all devices are updated, keep the same permissions there, and do not deploy a list made only of `policy-only` entries.
2057> > **headersHelperArgs** `string[]`
2058> >
2059> > Consent required (A value that a bootstrap server or a self-hosted session host delivers applies only after the user approves it, unless machine-scoped device management set that server's address. For a bootstrap server, the trustBootstrapDelivery key overrides that default. A value set in an MDM profile, the local configuration file or the Enterprise Admin Console needs no approval.)
2060> >
2061> > Arguments passed to the headers helper script, one per entry, in order. Leave unset to run it with none.
2062> >
2063> > > [accordion] More detail
2064> > >
2065> > > * On every platform, an argument cannot be empty or contain a double quote, a percent sign or a control character.
2066> > > * Do not put secrets in arguments. They are visible in the app log and to other processes on the device.
2067> > > * Have the script fail when a needed argument is missing. An app version that does not know this setting passes none.
2068> >
2069> > **headersHelperTtlSec** `integer`
2070> >
2071> > How long the helper’s headers are reused before it runs again, in seconds. Defaults to 300.
2072> >
2073> > **headersHelperRefreshBufferSec** `integer`
2074> >
2075> > Seconds before the TTL expires at which the helper re-runs mid-session. Defaults to 60. Keep it larger than the helper’s typical runtime.
2076> >
2077> > **server** `string` *required*
2078> >
2079> > Which bundled connector this entry turns on. Set instead of a transport; each built-in server has its own fields.
2080> >
2081> > Must be: `websearch`
2082> >
2083> > **provider** `enum` *required*
2084> >
2085> > Runs web search from the user’s device, for inference providers without built-in search. Supply the API key with the headers helper script.
2086> >
2087> > One of: `brave`, `tavily`, `exa`, `custom`
2088> >
2089> > > [accordion] More detail
2090> > >
2091> > > Not needed on the Anthropic API or Vertex, where the model's built-in web search is available.
2092> > >
2093> > > Every search provider except `custom` needs an auth header. The API key is a credential, so have `headersHelper` print the header rather than storing it in `headers`:
2094> > >
2095> > > * **Brave:** `X-Subscription-Token`
2096> > > * **Exa:** `x-api-key`
2097> > > * **Tavily:** `Authorization` (Bearer …)
2098> >
2099> > **platformOverrides** `object`
2100> >
2101> > On that operating system, each setting here replaces the entry’s own. A setting left out keeps the entry’s.
2102> >
2103> > > [accordion] More detail
2104> > >
2105> > > A value written here replaces the entry's value whole: lists and maps are not merged.
2106> > >
2107> > > * A local (`stdio`) entry can repeat `command`, `args`, `env`, `envHelper` and `envHelperArgs`. It always needs its own `command` too.
2108> > > * A remote or web search entry can repeat `headersHelper` and `headersHelperArgs`. If it gives `headersHelper` here, it needs its own too.
2109> > > * A mistake under any operating system drops the server on all of them.
2110> > > * An older version ignores this setting and runs the entry's own values. Until all devices are updated, put the Windows values in the entry itself.
2111> >
2112> > > [accordion] Child attributes (3)
2113> > >
2114> > > **platformOverrides.win32** `object: name → value`
2115> > >
2116> > > On Windows, these replace the entry’s own settings. A setting left out keeps the entry’s.
2117> > >
2118> > > **platformOverrides.darwin** `object: name → value`
2119> > >
2120> > > On macOS, these replace the entry’s own settings. A setting left out keeps the entry’s.
2121> > >
2122> > > **platformOverrides.linux** `object: name → value`
2123> > >
2124> > > On Linux, these replace the entry’s own settings. A setting left out keeps the entry’s.
2125> >
2126> > **customUrl** `string`
2127> >
2128> > POST endpoint accepting \{q} JSON and returning a results\[] array. Only used when provider is Custom.
2129>
2130> > [tab] github
2131> >
2132> > Applies when `server` is `github`. The in-app configuration window calls it **GitHub**.
2133> >
2134> > **server** `string` *required*
2135> >
2136> > Which bundled connector this entry turns on. Set instead of a transport; each built-in server has its own fields.
2137> >
2138> > Must be: `github`
2139> >
2140> > **clientId** `string` *required*
2141> >
2142> > GitHub OAuth app client ID (device flow must be enabled on the app).
2143> >
2144> > **host** `string`
2145> >
2146> > Leave blank for github.com. For GitHub Enterprise Server, your instance’s base URL.
2147> >
2148> > **scope** `string`
2149> >
2150> > Space-separated GitHub OAuth scopes. Unset: Desktop’s default scopes. Ignored for GitHub Apps: their registration sets the permissions.
2151> >
2152> > **toolsets** `string`
2153> >
2154> > Comma-separated github-mcp-server toolsets to enable. If blank, the bundled server’s default toolsets are used.
2155> >
2156> > > [accordion] More detail
2157> > >
2158> > > Every tool that can change something asks before each call unless `toolPolicy` says otherwise.
2159> > >
2160> > > These tools cannot be set looser than `ask`, and `allow` is treated as `ask`: `merge_pull_request`, `push_files`, `create_or_update_file`, `delete_file`, `actions_run_trigger`, `pull_request_review_write`, `delete_repository`. Where no prompt can be shown, their calls are refused.
2161> >
2162> > **readOnly** `boolean`
2163> >
2164> > Offer only read tools — the server registers no write tools at all.
2165>
2166> > [tab] http / sse
2167> >
2168> > Applies when `transport` is `http` or `sse`. The in-app configuration window calls it **Streamable HTTP** or **SSE (legacy)**.
2169> >
2170> > **transport** `enum` *required*
2171> >
2172> > How the app connects: HTTP, legacy SSE or a local command (stdio). policy-only connects to nothing: it sets a plugin server’s tool policy.
2173> >
2174> > One of: `http`, `sse`
2175> >
2176> > **url** `string` *required*
2177> >
2178> > HTTPS endpoint of the remote MCP server. Use the server’s final address: HTTP redirects are not followed.
2179> >
2180> > **oauth** `object`
2181> >
2182> > OAuth sign-in for a remote server: register a client automatically, use your own client ID, or use an Anthropic-hosted client identity.
2183> >
2184> > [Guide for this setting](https://claude.com/docs/third-party/claude-desktop/mcp-sign-in.md)
2185> >
2186> > > [accordion] More detail
2187> > >
2188> > > Choose **Bring your own client** when the provider requires an OAuth client that you register, and set `clientId`. Add `clientSecret` and `authorizationServer` only when the provider also requires the secret.
2189> >
2190> > > [accordion] Child attributes
2191> > >
2192> > > > [tab] dcr
2193> > > >
2194> > > > Applies when `oauth.mode` is `dcr`. The in-app configuration window calls it **Auto-register (dynamic client registration)**. No other fields apply.
2195> > > >
2196> > > > Write `"oauth": true`. `{"mode": "dcr"}` means the same and takes no other member. To register automatically with scopes of your choice, write an object that sets any of `scope`, `appendOfflineAccess` and `additionalRedirectReferrerHosts` and nothing else, as Bring your own client describes.
2197> > >
2198> > > > [tab] byo
2199> > > >
2200> > > > Applies when `oauth.mode` is `byo`. The in-app configuration window calls it **Bring your own client**.
2201> > > >
2202> > > > `mode` can be left out. Without `clientId` the object may set only `scope`, `appendOfflineAccess` and `additionalRedirectReferrerHosts`, and the app registers a client automatically; with any other member listed here and no `clientId`, the app drops the entry.
2203> > > >
2204> > > > **oauth.clientId** `string`
2205> > > >
2206> > > > OAuth client ID from your identity provider’s app registration. Unset: auto-register (dynamic client registration).
2207> > > >
2208> > > > **oauth.clientSecret** `string`
2209> > > >
2210> > > > Only if the provider requires one. The Admin Console stores only a Google Desktop-app secret (GOCSPX-…). For others use the helper script.
2211> > > >
2212> > > > **oauth.clientSecretHelper** `string`
2213> > > >
2214> > > > Consent required (A value that a bootstrap server or a self-hosted session host delivers applies only after the user approves it, unless machine-scoped device management set that server's address. For a bootstrap server, the trustBootstrapDelivery key overrides that default. A value set in an MDM profile, the local configuration file or the Enterprise Admin Console needs no approval.)
2215> > > >
2216> > > > Script that prints the client secret as a JSON object with a single clientSecret key. Takes priority over Client secret.
2217> > > >
2218> > > > > [accordion] More detail
2219> > > > >
2220> > > > > * Its standard output must be exactly `{"clientSecret": "…"}`, with no other keys or lines. Any other output stops the server from connecting.
2221> > > > > * It must exit with code `0` within 30 seconds.
2222> > > > > * It runs with no arguments each time the server connects and each time its sign-in is renewed in the background. Choose a script that does not prompt the user.
2223> > > > >
2224> > > > > The helper script normally runs with `CLAUDE_CODE_MCP_SERVER_NAME` set to this entry's `name`, so one script can serve several servers. Put the variable in double quotes, compare it with the names you expect, and do not pass it to another command.
2225> > > >
2226> > > > **oauth.authorizationServer** `string[]`
2227> > > >
2228> > > > Issuer URLs the OAuth sign-in may use, as a JSON array. Pre-filled by presets; ask your IdP admin if unsure.
2229> > > >
2230> > > > **oauth.authorizationUrl** `string`
2231> > > >
2232> > > > Only for IdPs that don’t serve a .well-known discovery document. Set together with Token URL; requires Client ID.
2233> > > >
2234> > > > **oauth.tokenUrl** `string`
2235> > > >
2236> > > > Only for IdPs that don’t serve a .well-known discovery document. Set together with Authorization URL; requires Client ID.
2237> > > >
2238> > > > **oauth.tenantId** `string`
2239> > > >
2240> > > > Required for single-tenant Entra apps. Leave blank for multi-tenant or non-Microsoft IdPs.
2241> > > >
2242> > > > > [accordion] More detail
2243> > > > >
2244> > > > > For a GCC High or DoD tenant, leave this unset and set `authorizationServer` to `https://login.microsoftonline.us/<tenant-id>/v2.0`.
2245> > > >
2246> > > > **oauth.authFlow** `enum`
2247> > > >
2248> > > > How Entra sign-in runs for this server: the system browser (default) or the OS identity broker.
2249> > > >
2250> > > > One of: `browser`, `broker`
2251> > > >
2252> > > > > [accordion] More detail
2253> > > > >
2254> > > > > `broker` signs in through the OS identity broker: Web Account Manager on Windows, the Company Portal SSO extension on macOS. It can satisfy Conditional Access policies that require a compliant or managed device, or token protection.
2255> > > > >
2256> > > > > * It requires `tenantId`, `clientId` and `scope`, and an Entra-registered device.
2257> > > > > * The app registration must list the [broker redirect URIs](https://claude.com/docs/third-party/claude-desktop/entra-broker.md).
2258> > > > > * `broker` is not supported on Linux. Where the broker is not available, sign-in falls back to the system browser.
2259> > > >
2260> > > > **oauth.scope** `string`
2261> > > >
2262> > > > Space-separated scopes to request. Unset: the scopes the server advertises. Required if Tenant ID is set or the resource parameter omitted.
2263> > > >
2264> > > > **oauth.appendOfflineAccess** `boolean`
2265> > > >
2266> > > > Adds offline\_access to the authorize request so the IdP returns a refresh token for silent renewal.
2267> > > >
2268> > > > > [accordion] More detail
2269> > > > >
2270> > > > > Leave off if `scope` already includes `offline_access` or the server rejects it.
2271> > > > >
2272> > > > > If you set `authorizationUrl` and `tokenUrl`, this switch does not work on its own. Add `offline_access` to `scope` instead.
2273> > > >
2274> > > > **oauth.omitResource** `boolean`
2275> > > >
2276> > > > Sends no OAuth resource parameter. Use only if your identity provider rejects it. Requires Client ID, Scope and one sign-in server.
2277> > > >
2278> > > > > [accordion] More detail
2279> > > > >
2280> > > > > By default, sign-in sends the URL that this server publishes as the OAuth `resource` parameter, which ties the token to this server. Microsoft Entra ID rejects it with `AADSTS9010010` when the URL is not an Application ID URI in your tenant.
2281> > > > >
2282> > > > > * **Requires:** `clientId`, a `scope` with an API scope, and exactly one of `tenantId`, a single `authorizationServer`, or `authorizationUrl` with `tokenUrl`. Otherwise the entry is not loaded.
2283> > > > > * **Risk:** `scope` alone now says which API the token is for, so check that it names this server's app. A scope for another app is accepted, and this server then receives a token meant for that app.
2284> > > > > * **Entra ID:** write the scope in full, as in `api://<app-id>/<scope>`.
2285> > > >
2286> > > > **oauth.callbackHost** `enum`
2287> > > >
2288> > > > Use localhost only if your IdP’s registered redirect URI specifies it.
2289> > > >
2290> > > > One of: `127.0.0.1`, `localhost`
2291> > > >
2292> > > > **oauth.callbackPort** `integer`
2293> > > >
2294> > > > Only set if your IdP requires an exact-match redirect port. Entra accepts any.
2295> > > >
2296> > > > **oauth.additionalRedirectReferrerHosts** `string`
2297> > > >
2298> > > > Space-separated hostnames also accepted as the referrer of the sign-in callback, besides the authorization URL’s host.
2299> > > >
2300> > > > > [accordion] More detail
2301> > > > >
2302> > > > > If a callback is rejected for a referrer mismatch, the app log names the rejected host. Add that hostname here.
2303> > >
2304> > > > [tab] hosted
2305> > > >
2306> > > > Applies when `oauth.mode` is `hosted`. The in-app configuration window calls it **Anthropic-hosted client identity (requires Claude.ai sign-in)**.
2307> > > >
2308> > > > Always write `"mode": "hosted"`. Without it the object is read as Bring your own client, which needs `clientId` beside `authorizationServer`, so the app drops the entry.
2309> > > >
2310> > > > **oauth.clientId** `string`
2311> > > >
2312> > > > Filled in by Claude.ai: the URL of Anthropic’s hosted client-metadata document. Do not set it.
2313> > > >
2314> > > > **oauth.authorizationServer** `string[]` *required*
2315> > > >
2316> > > > The exact issuer string(s) that the server’s authorization server advertises, as a JSON array. Anthropic signs the identity only for these.
2317> > > >
2318> > > > **oauth.scope** `string`
2319> > > >
2320> > > > Space-separated scopes to request. Unset: the scopes the server advertises. Required if Tenant ID is set or the resource parameter omitted.
2321> >
2322> > **headers** `object: name → value`
2323> >
2324> > Static headers sent on every request: routing and tenant headers only. No credentials here: use the headers helper script for those.
2325> >
2326> > **headersHelper** `string`
2327> >
2328> > Consent required (A value that a bootstrap server or a self-hosted session host delivers applies only after the user approves it, unless machine-scoped device management set that server's address. For a bootstrap server, the trustBootstrapDelivery key overrides that default. A value set in an MDM profile, the local configuration file or the Enterprise Admin Console needs no approval.)
2329> >
2330> > Absolute path to an executable that prints a JSON object of HTTP headers on stdout. Merged over static headers; the helper wins on conflict.
2331> >
2332> > > [accordion] More detail
2333> > >
2334> > > The helper script normally runs with `CLAUDE_CODE_MCP_SERVER_NAME` set to this entry's `name`, so one script can serve several servers. Put the variable in double quotes, compare it with the names you expect, and do not pass it to another command.
2335> >
2336> > **headersHelperArgs** `string[]`
2337> >
2338> > Consent required (A value that a bootstrap server or a self-hosted session host delivers applies only after the user approves it, unless machine-scoped device management set that server's address. For a bootstrap server, the trustBootstrapDelivery key overrides that default. A value set in an MDM profile, the local configuration file or the Enterprise Admin Console needs no approval.)
2339> >
2340> > Arguments passed to the headers helper script, one per entry, in order. Leave unset to run it with none.
2341> >
2342> > > [accordion] More detail
2343> > >
2344> > > * On every platform, an argument cannot be empty or contain a double quote, a percent sign or a control character.
2345> > > * Do not put secrets in arguments. They are visible in the app log and to other processes on the device.
2346> > > * Have the script fail when a needed argument is missing. An app version that does not know this setting passes none.
2347> >
2348> > **headersHelperTtlSec** `integer`
2349> >
2350> > How long the helper’s headers are reused before it runs again, in seconds. Defaults to 300.
2351> >
2352> > **headersHelperRefreshBufferSec** `integer`
2353> >
2354> > Seconds before the TTL expires at which the helper re-runs mid-session. Defaults to 60. Keep it larger than the helper’s typical runtime.
2355> >
2356> > **platformOverrides** `object`
2357> >
2358> > On that operating system, each setting here replaces the entry’s own. A setting left out keeps the entry’s.
2359> >
2360> > > [accordion] More detail
2361> > >
2362> > > A value written here replaces the entry's value whole: lists and maps are not merged.
2363> > >
2364> > > * A local (`stdio`) entry can repeat `command`, `args`, `env`, `envHelper` and `envHelperArgs`. It always needs its own `command` too.
2365> > > * A remote or web search entry can repeat `headersHelper` and `headersHelperArgs`. If it gives `headersHelper` here, it needs its own too.
2366> > > * A mistake under any operating system drops the server on all of them.
2367> > > * An older version ignores this setting and runs the entry's own values. Until all devices are updated, put the Windows values in the entry itself.
2368> >
2369> > > [accordion] Child attributes (3)
2370> > >
2371> > > **platformOverrides.win32** `object: name → value`
2372> > >
2373> > > On Windows, these replace the entry’s own settings. A setting left out keeps the entry’s.
2374> > >
2375> > > **platformOverrides.darwin** `object: name → value`
2376> > >
2377> > > On macOS, these replace the entry’s own settings. A setting left out keeps the entry’s.
2378> > >
2379> > > **platformOverrides.linux** `object: name → value`
2380> > >
2381> > > On Linux, these replace the entry’s own settings. A setting left out keeps the entry’s.
2382> >
2383> > **toolTimeoutSec** `integer`
2384> >
2385> > Maximum time in seconds that Claude waits for one tool call to this server. Leave empty to use the MCP tool call timeout.
2386> >
2387> > > [accordion] More detail
2388> > >
2389> > > For Claude's calls to this server it takes the place of `mcpToolTimeoutSec`. Use a whole number from 5 to 3600: any other value is ignored.
2390> > >
2391> > > * Progress messages from the server do not extend the limit.
2392> > > * Time that a user spends on a sign-in or consent step during the call counts toward the limit. On a server that asks for sign-in, set a generous value.
2393> >
2394> > **icon** `string`
2395> >
2396> > Icon shown for this connector: a PNG or JPEG image as a base64 data: URI, at most 4,096 characters.
2397> >
2398> > > [accordion] More detail
2399> > >
2400> > > A PNG of 48 by 48 pixels or smaller works well. Keep icons small: Windows Group Policy holds the whole `managedMcpServers` list in one value of at most 65,535 characters.
2401> >
2402> > **defaultState** `enum`
2403> >
2404> > Whether this connector starts on or off for each person.
2405> >
2406> > One of: `on`, `off`
2407> >
2408> > > [accordion] More detail
2409> > >
2410> > > Unset means `on`.
2411> > >
2412> > > * This is a starting point, not a restriction: each user can turn the connector on. To withhold a connector, remove it or block its tools with `toolPolicy`.
2413> > > * Adding `off` to a connector already in use turns it off for all users who have not switched it on themselves, scheduled tasks included.
2414> > > * This setting does not apply to a plugin's server that matches this entry.
2415>
2416> > [tab] stdio
2417> >
2418> > Applies when `transport` is `stdio`. The in-app configuration window calls it **Local command (stdio)**.
2419> >
2420> > **transport** `string` *required*
2421> >
2422> > How the app connects: HTTP, legacy SSE or a local command (stdio). policy-only connects to nothing: it sets a plugin server’s tool policy.
2423> >
2424> > Must be: `stdio`
2425> >
2426> > **command** `string` *required*
2427> >
2428> > Consent required (A value that a bootstrap server or a self-hosted session host delivers applies only after the user approves it, unless machine-scoped device management set that server's address. For a bootstrap server, the trustBootstrapDelivery key overrides that default. A value set in an MDM profile, the local configuration file or the Enterprise Admin Console needs no approval.)
2429> >
2430> > Absolute path to the server executable, run on the user’s machine.
2431> >
2432> > **args** `string[]`
2433> >
2434> > Consent required (A value that a bootstrap server or a self-hosted session host delivers applies only after the user approves it, unless machine-scoped device management set that server's address. For a bootstrap server, the trustBootstrapDelivery key overrides that default. A value set in an MDM profile, the local configuration file or the Enterprise Admin Console needs no approval.)
2435> >
2436> > Arguments passed to the command, one per entry.
2437> >
2438> > **env** `object: name → value`
2439> >
2440> > Consent required (A value that a bootstrap server or a self-hosted session host delivers applies only after the user approves it, unless machine-scoped device management set that server's address. For a bootstrap server, the trustBootstrapDelivery key overrides that default. A value set in an MDM profile, the local configuration file or the Enterprise Admin Console needs no approval.)
2441> >
2442> > Environment variables set for the command.
2443> >
2444> > **envHelper** `string`
2445> >
2446> > Consent required (A value that a bootstrap server or a self-hosted session host delivers applies only after the user approves it, unless machine-scoped device management set that server's address. For a bootstrap server, the trustBootstrapDelivery key overrides that default. A value set in an MDM profile, the local configuration file or the Enterprise Admin Console needs no approval.)
2447> >
2448> > Script that prints environment variables as a JSON object to stdout. Runs when the local server starts (cached for the TTL below).
2449> >
2450> > > [accordion] More detail
2451> > >
2452> > > * Its values take priority over `env`.
2453> > > * If the script fails, the server does not start.
2454> > > * A script with nothing to set must print `{}`. Empty output counts as a failure.
2455> > > * The helper script normally runs with `CLAUDE_CODE_MCP_SERVER_NAME` set to this entry's `name`, so one script can serve several servers. Put the variable in double quotes, compare it with the names you expect, and do not pass it to another command.
2456> >
2457> > **envHelperArgs** `string[]`
2458> >
2459> > Consent required (A value that a bootstrap server or a self-hosted session host delivers applies only after the user approves it, unless machine-scoped device management set that server's address. For a bootstrap server, the trustBootstrapDelivery key overrides that default. A value set in an MDM profile, the local configuration file or the Enterprise Admin Console needs no approval.)
2460> >
2461> > Arguments passed to the environment helper script, one per entry, in order. Leave unset to run it with none.
2462> >
2463> > > [accordion] More detail
2464> > >
2465> > > * On every platform, an argument cannot be empty or contain a double quote, a percent sign or a control character.
2466> > > * Do not put secrets in arguments. They are visible in the app log and to other processes on the device.
2467> > > * Have the script fail when a needed argument is missing. An app version that does not know this setting passes none.
2468> >
2469> > **envHelperTtlSec** `integer` (default: 300)
2470> >
2471> > Maximum age of a cached helper result, in seconds (default 300). Applies when the server starts or restarts.
2472> >
2473> > > [accordion] More detail
2474> > >
2475> > > Set this at or below your token lifetime. Otherwise a server that crashes because its token expired can restart with the same cached values until this time is up.
2476> >
2477> > **startupTimeoutSec** `integer` (default: 120)
2478> >
2479> > Maximum wait in seconds for the server to start and list its tools.
2480> >
2481> > **platformOverrides** `object`
2482> >
2483> > On that operating system, each setting here replaces the entry’s own. A setting left out keeps the entry’s.
2484> >
2485> > > [accordion] More detail
2486> > >
2487> > > A value written here replaces the entry's value whole: lists and maps are not merged.
2488> > >
2489> > > * A local (`stdio`) entry can repeat `command`, `args`, `env`, `envHelper` and `envHelperArgs`. It always needs its own `command` too.
2490> > > * A remote or web search entry can repeat `headersHelper` and `headersHelperArgs`. If it gives `headersHelper` here, it needs its own too.
2491> > > * A mistake under any operating system drops the server on all of them.
2492> > > * An older version ignores this setting and runs the entry's own values. Until all devices are updated, put the Windows values in the entry itself.
2493> >
2494> > > [accordion] Child attributes (3)
2495> > >
2496> > > **platformOverrides.win32** `object: name → value`
2497> > >
2498> > > On Windows, these replace the entry’s own settings. A setting left out keeps the entry’s.
2499> > >
2500> > > **platformOverrides.darwin** `object: name → value`
2501> > >
2502> > > On macOS, these replace the entry’s own settings. A setting left out keeps the entry’s.
2503> > >
2504> > > **platformOverrides.linux** `object: name → value`
2505> > >
2506> > > On Linux, these replace the entry’s own settings. A setting left out keeps the entry’s.
2507> >
2508> > **toolTimeoutSec** `integer`
2509> >
2510> > Maximum time in seconds that Claude waits for one tool call to this server. Leave empty to use the MCP tool call timeout.
2511> >
2512> > > [accordion] More detail
2513> > >
2514> > > For Claude's calls to this server it takes the place of `mcpToolTimeoutSec`. Use a whole number from 5 to 3600: any other value is ignored.
2515> > >
2516> > > * Progress messages from the server do not extend the limit.
2517> > > * Time that a user spends on a sign-in or consent step during the call counts toward the limit. On a server that asks for sign-in, set a generous value.
2518> >
2519> > **icon** `string`
2520> >
2521> > Icon shown for this connector: a PNG or JPEG image as a base64 data: URI, at most 4,096 characters.
2522> >
2523> > > [accordion] More detail
2524> > >
2525> > > A PNG of 48 by 48 pixels or smaller works well. Keep icons small: Windows Group Policy holds the whole `managedMcpServers` list in one value of at most 65,535 characters.
2526>
2527> > [tab] policy-only
2528> >
2529> > Applies when `transport` is `policy-only`. The in-app configuration window calls it **Tool permissions only (plugin server)**.
2530> >
2531> > **transport** `string` *required*
2532> >
2533> > How the app connects: HTTP, legacy SSE or a local command (stdio). policy-only connects to nothing: it sets a plugin server’s tool policy.
2534> >
2535> > Must be: `policy-only`
2536> >
2537> > > [accordion] More detail
2538> > >
2539> > > For a `policy-only` entry:
2540> > >
2541> > > * Set `name` to the server's name as the plugin declares it (letter case is ignored), and `toolPolicy` to the permissions. A name that matches no installed plugin server does nothing.
2542> > > * It takes priority over `orgPluginSettings` for that server. With no `toolPolicy`, the server is left unrestricted.
2543> > > * An older version drops the entry and applies `orgPluginSettings` instead. Until all devices are updated, keep the same permissions there, and do not deploy a list made only of `policy-only` entries.
25442544
25452545***
25462546
from line 2550
25502550
25512551**Allow persistent tool approvals.** Offer the persistent “Always allow” approval options for MCP tools. Disable to keep tool approvals per-call or session-scoped only.
25522552
2553> **More detail**
2553> [accordion] More detail
25542554>
25552555> When off, persistent approvals that users saved earlier in Chat and Cowork stop applying. Scheduled tasks also stop offering and reusing them, unless `mcpScheduledTaskApprovalLifetimeDays` is 1 or more.
25562556>
from line 2564
25642564
25652565**Scheduled-task tool approval lifetime.** Days a scheduled task can reuse a persistent MCP tool approval before it asks again. 0 turns reuse off. Unset: no limit.
25662566
2567> **More detail**
2567> [accordion] More detail
25682568>
25692569> * If `mcpPersistentAlwaysAllowEnabled` is off, a limit of 1 or more brings the persistent option back for scheduled tasks only.
25702570> * In Code, any allow rule in a user's or a project's Claude Code settings keeps allowing the tool, even at `0`, until it is removed. Earlier approvals were usually saved as such rules.
from line 2578
25782578
25792579**Allow local MCP servers.** Lets users run local (stdio) MCP servers added in Developer settings. On third-party deployments, off also stops plugins’ local servers.
25802580
2581> **More detail**
2581> [accordion] More detail
25822582>
25832583> On third-party deployments, `false` covers `.mcpb` bundles and plugins from every marketplace, your organization's included. Plugins in the org-plugins directory on the device are not affected. In Code, it also stops the local servers that a user or a project configures for Claude Code.
25842584>
from line 2594
25942594
25952595**Allowed plugin MCP servers.** Remote MCP servers that user-installed and marketplace plugins can connect, as URL patterns. Empty list: none. Unset: no limit.
25962596
2597> **More detail**
2597> [accordion] More detail
25982598>
25992599> * **Entries:** `{"serverUrl": "https://*.example.com/*"}`. No other entry form is read.
26002600> * **Once set:** no entry allows a plugin's local (`stdio`) server, and servers that a user or a project configures for Claude Code are not connected.
from line 2602
26022602>
26032603> Claude Code's own managed settings, where a session has any, take priority by default.
26042604
2605> **Child attributes (1)**
2605> [accordion] Child attributes (1)
26062606>
26072607> **serverUrl** `string` *required*
26082608>
from line 2616
26162616
26172617**Blocked plugin MCP servers.** URL patterns of remote MCP servers that plugins cannot connect, even if the Allowed plugin MCP servers list allows them.
26182618
2619> **More detail**
2619> [accordion] More detail
26202620>
26212621> An entry matches an address, not a server. The same server under another host name or IP address, or behind a plugin's local server, is not matched. To keep a plugin's servers out whatever address they use, set `allowedPluginMcpServers`.
26222622>
from line 2626
26262626>
26272627> Claude Code's own managed settings, where a session has any, take priority by default.
26282628
2629> **Child attributes (1)**
2629> [accordion] Child attributes (1)
26302630>
26312631> **serverUrl** `string` *required*
26322632>
from line 2640
26402640
26412641**MCP tool call timeout.** Per-call timeout for MCP tool calls, in seconds. Unset: 180 in Chat and Cowork.
26422642
2643> **More detail**
2643> [accordion] More detail
26442644>
26452645> * **Unset:** Chat and Cowork use 180 seconds, and the app sets no timeout in Code. Calls to user-added local servers are also limited to 60 seconds.
26462646> * **Set:** the value applies in Code too.
from line 2659
26592659
26602660One of: `auto` (default), `disabled`, `required`
26612661
2662> **More detail**
2662> [accordion] More detail
26632663>
26642664> The OS identity broker is Web Account Manager on Windows and the Company Portal SSO extension on macOS. Linux has no broker, so `required` is not supported there.
26652665>
from line 2677
26772677
26782678One of: `enabled`, `disabled` (default)
26792679
2680> **More detail**
2680> [accordion] More detail
26812681>
26822682> It needs both of these:
26832683>
from line 2698
26982698
26992699**Allow desktop extensions.** Let Claude Desktop load desktop extensions (.dxt and .mcpb files). Unset: on where users sign in with Claude.ai.
27002700
2701> **More detail**
2701> [accordion] More detail
27022702>
27032703> In a third-party deployment, turning this on loads extensions that are already installed. Users cannot install new ones.
27042704
from line 2722
27222722
27232723[Admin Console](#the-works-with-column): Set automatically.
27242724
2725> **More detail**
2725> [accordion] More detail
27262726>
27272727> If unset, the app uses the organization of your Anthropic sign-in, where the connection has one. Otherwise, local data is stored under a placeholder UUID shared with other unconfigured deployments. Telemetry is then tagged with a value the app derives from your connection settings, or with that placeholder.
27282728>
from line 2738
27382738
27392739[Guide for this setting](https://claude.com/docs/third-party/claude-desktop/telemetry.md#essential-telemetry)
27402740
2741> **More detail**
2741> [accordion] More detail
27422742>
27432743> Reports include **crash stacks**, **startup failure reasons**, **version/OS metadata**, and **crash dumps** (each an unfiltered copy of part of the app's memory). They carry a random install ID and an organization ID, which the app picks if you set none (see `deploymentOrganizationUuid`).
27442744>
from line 2761
27612761
27622762[Guide for this setting](https://claude.com/docs/third-party/claude-desktop/telemetry.md#non-essential-telemetry)
27632763
2764> **More detail**
2764> [accordion] More detail
27652765>
27662766> Applies only while the app runs in third-party mode. If users could otherwise sign in to Claude.ai on the device, also set `disableDeploymentModeChooser` so the app stays in third-party mode.
27672767
from line 2773
27732773
27742774**Block nonessential services.** Connector icons, hosted artifact previews, MCP Apps widgets and the Linux spellcheck dictionary. Widgets fall back to text.
27752775
2776> **More detail**
2776> [accordion] More detail
27772777>
27782778> With this on:
27792779>
from line 2803
28032803
28042804One of: `http/protobuf` (default), `http/json`, `grpc`
28052805
2806> **More detail**
2806> [accordion] More detail
28072807>
28082808> With `grpc`, some exports still go over HTTP to the same endpoint, such as the app's own events.
28092809>
from line 2827
28272827
28282828One of: `none`, `inference-credential`
28292829
2830> **More detail**
2830> [accordion] More detail
28312831>
28322832> The credential can also make model requests as the user. For a collector you do not operate, use `otlpHeadersHelper` with a credential that can only send telemetry.
28332833>
from line 2845
28452845
28462846**OTLP headers helper script.** Full path to a helper script that prints collector headers as JSON. They take priority over OTLP headers and Collector authentication.
28472847
2848> **More detail**
2848> [accordion] More detail
28492849>
28502850> The app runs it with no arguments. Sample output: `{"Authorization": "Bearer …"}`.
28512851>
from line 2861
28612861
28622862**Resource attributes.** Extra attributes to attach to every span, metric and log. An enduser.id set here takes priority over the signed-in user’s identity.
28632863
2864> **More detail**
2864> [accordion] More detail
28652865>
28662866> `process.owner` (the OS login name) is always sent to your collector. Set it here to replace the value.
28672867
from line 2885
28852885
28862886Any of: `userPrompts`, `assistantResponses`, `toolDetails`, `toolContent`, `rawApiBodies`
28872887
2888> **More detail**
2888> [accordion] More detail
28892889>
28902890> This data never reaches Anthropic.
28912891>
from line 2907
29072907
29082908**Export traces.** Also export OpenTelemetry traces from Cowork tasks and Code sessions. Uses Claude Code’s session tracing.
29092909
2910> **More detail**
2910> [accordion] More detail
29112911>
29122912> Has no effect without `otlpEndpoint`. With it set, this key alone decides whether Cowork tasks and Code sessions export traces. Unset or `false` keeps traces off even if a user's or a project's Claude Code settings, or managed settings, turn tracing on.
29132913
from line 2919
29192919
29202920**Telemetry attribute length limit.** Maximum length, in characters, of captured content such as a raw API body. Unset: 61,440 in Cowork tasks and Code sessions.
29212921
2922> **More detail**
2922> [accordion] More detail
29232923>
29242924> In Cowork tasks and Code sessions it applies to model responses, tool content and raw API bodies, not to user prompts.
29252925>
from line 2939
29392939
29402940**Block auto-updates.** Stop Claude Desktop from fetching updates entirely (no time limit). You’ll need to push new versions yourself.
29412941
2942> **More detail**
2942> [accordion] More detail
29432943>
29442944> When you install a newer version while Claude is open, the app shows a restart notice in the sidebar. To have Claude restart by itself if nobody restarts it, use `installedUpdateEnforcementEnabled`.
29452945>
from line 2955
29552955
29562956**Restart to apply installed updates.** With auto-updates blocked, Claude restarts by itself for a newer version installed while it was open. On Windows it may stay closed.
29572957
2958> **More detail**
2958> [accordion] More detail
29592959>
29602960> `installedUpdateEnforcementHours` sets how long the app waits.
29612961>
from line 2972
29722972
29732973**Installed-update enforcement window.** Hours before Claude restarts for a newer version installed while it was open. Unset: 72 hours, then when idle. A number skips the idle wait.
29742974
2975> **More detail**
2975> [accordion] More detail
29762976>
29772977> Applies only while `disableAutoUpdates` is on and the restart is on (see `installedUpdateEnforcementEnabled`).
29782978>
from line 2990
29902990
29912991**Auto-update enforcement window.** Hours before a downloaded update force-installs. Only applies when auto-updates are enabled. Blank = 72-hour default.
29922992
2993> **More detail**
2993> [accordion] More detail
29942994>
29952995> * **Unset:** after 72 hours the app restarts once the device has been idle for 10 minutes.
29962996> * **Any number, even 72:** the app restarts when the time is up, whether or not the user is active.
from line 3007
30073007
30083008**Check for updates on releases.claude.com.** Read the update feed from releases.claude.com so api.anthropic.com can stay blocked.
30093009
3010> **More detail**
3010> [accordion] More detail
30113011>
30123012> The installer still downloads from `downloads.claude.ai`, so keep that host open.
30133013>
from line 3025
30253025
30263026One of: `stable` (default), `staggered`
30273027
3028> **More detail**
3028> [accordion] More detail
30293029>
30303030> `staggered` usually updates on Thursdays and is typically 7 to 14 days behind `stable`.
30313031>
from line 3046
30463046
30473047**Configuration relaunch window.** Hours users can keep working after a configuration change that needs a restart. 0: restart required at once. Unset: 24 hours.
30483048
3049> **More detail**
3049> [accordion] More detail
30503050>
30513051> When the time is up, a restart dialog blocks the app. The app then restarts by itself after 2 minutes with no activity and no running task.
30523052>
from line 3062
30623062
30633063**Configuration re-check interval.** Minutes between the running app’s checks for a changed managed configuration. Blank = 10 minutes.
30643064
3065> **More detail**
3065> [accordion] More detail
30663066>
30673067> A change that needs a restart starts the `relaunchEnforcementHours` countdown.
30683068>
from line 3080
30803080
30813081**Keep only your organization ID and restrictions on disk.** Between launches, keep on disk only your organization ID and restrictions, not its name or anything you have allowed.
30823082
3083> **More detail**
3083> [accordion] More detail
30843084>
30853085> While this is on, the app's crash reporting does not start on these devices. Error stack traces and performance timings still leave these devices unless `disableEssentialTelemetry` is on.
30863086>
from line 3100
31003100
31013101**Chat retention period.** Delete chats, with their files, after this many days without activity. Unset: no deletion. Projects and memory stay.
31023102
3103> **More detail**
3103> [accordion] More detail
31043104>
31053105> Applies only while the app runs in third-party mode. Deletion can start shortly after the app gets this configuration. Pinned sessions are not exempt. Opening an old chat or Cowork task without continuing it does not reliably keep it.
31063106>
from line 3122
31223122
31233123**Cowork retention period.** Delete Cowork tasks, with their uploads and outputs, after this many days without activity. Unset: no deletion. Spaces and memory stay.
31243124
3125> **More detail**
3125> [accordion] More detail
31263126>
31273127> Applies only while the app runs in third-party mode. Deletion can start shortly after the app gets this configuration. Pinned sessions are not exempt. Opening an old chat or Cowork task without continuing it does not reliably keep it.
31283128>
from line 3144
31443144
31453145**Code retention period.** Delete Code sessions, conversation included, after this many days without activity. Unset: no deletion. Uncommitted work stays on disk.
31463146
3147> **More detail**
3147> [accordion] More detail
31483148>
31493149> Applies only while the app runs in third-party mode. Deletion can start shortly after the app gets this configuration. Pinned sessions are not exempt. Opening an old chat or Cowork task without continuing it does not reliably keep it.
31503150>
from line 3166
31663166
31673167**Suspend session deletion.** Suspend the chat, Cowork and Code retention periods (legal hold). Claude Code’s own transcript cleanup (cleanupPeriodDays) still runs.
31683168
3169> **More detail**
3169> [accordion] More detail
31703170>
31713171> Meant to be set per user or group.
31723172>
from line 3185
31853185
31863186**Max tokens per window.** Caps each user’s input and output tokens per window. Cached tokens do not count, so it does not cap your bill. Unset: no limit.
31873187
3188> **More detail**
3188> [accordion] More detail
31893189>
31903190> Has no effect unless `inferenceTokenWindowHours` is also set. A user with two devices can have a separate count on each.
31913191
from line 3197
31973197
31983198**Token cap window.** Length of each token cap window, in hours. The count resets to zero when a window ends.
31993199
3200> **More detail**
3200> [accordion] More detail
32013201>
32023202> Used with `inferenceMaxTokensPerWindow`. Each user's window starts the first time they use the app after their previous window ends. So 24 hours does not mean midnight to midnight.
32033203
from line 3209
32093209
32103210**Token limit warning.** Warn users once they have used this percent of their token limit. Unset: 75. At 100, the only warning comes at the limit.
32113211
3212> **More detail**
3212> [accordion] More detail
32133213>
32143214> Has no effect unless `inferenceMaxTokensPerWindow` and `inferenceTokenWindowHours` are both set.
32153215>
from line 3225
32253225
32263226**End-user attribution.** Show the signed-in user’s identity in the app, add it to Claude’s system prompt, and send it to your OpenTelemetry collector as enduser.id.
32273227
3228> **More detail**
3228> [accordion] More detail
32293229>
32303230> The identity comes from the user's sign-in, or is the OS login name when sign-in gives none. A static `enduser.id` in `otlpResourceAttributes` takes priority in telemetry, and is sent even when this setting is off.
32313231>
from line 3267
32673267
32683268**Organization banner.** A persistent banner across the top of the app window after sign-in.
32693269
3270> **Child attributes (5)**
3270> [accordion] Child attributes (5)
32713271>
32723272> **enabled** `boolean`
32733273>
from line 3301
33013301
33023302**Status line.** Claude runs this program and shows the first line it prints above the message box in Cowork, Chat and Code. Off unless set.
33033303
3304> **More detail**
3304> [accordion] More detail
33053305>
33063306> * **Runs:** on the user's device, as the signed-in user, when a session opens, a turn ends, the app regains focus or the model changes.
33073307> * **Input:** one JSON line on standard input: `{"session_id": "…", "model": {"id": "…", "display_name": "…"}}`. Fields with no value are left out.
33083308> * **Output:** Claude shows the first non-empty line, up to 200 characters. ANSI codes 31 to 36 and 91 to 96 set the color.
33093309> * **Limits:** 10 seconds and 64 KiB of output. Past either, Claude stops the program.
33103310
3311> **Child attributes (1)**
3311> [accordion] Child attributes (1)
33123312>
33133313> **command** `string` *required*
33143314>
33153315> Full local path to the program or executable script.
33163316>
3317> > **More detail**
3317> > [accordion] More detail
33183318> >
33193319> > Users must not be able to change the file.
33203320> >
from line 3345
33453345
33463346**Plugin marketplaces.** Git repositories or hosted marketplace.json files shown as plugin marketplaces in the Directory’s Organization tab.
33473347
3348> **Child attributes**
3348> [accordion] Child attributes
33493349>
33503350> **expectedName** `string`
33513351>
33523352> Rejects the marketplace if its manifest name differs.
33533353>
3354> > **More detail**
3354> > [accordion] More detail
33553355> >
33563356> > Also use it to move a marketplace. A change to an entry's `url`, `repo` or `path` (not `ref`) counts as removing the marketplace, which uninstalls the plugins that users installed from it.
33573357> >
from line 3363
33633363>
33643364> One of: `available`, `auto_install`, `required`
33653365>
3366> > **More detail**
3366> > [accordion] More detail
33673367> >
33683368> > * `available` (default): users install from the Directory's Organization tab.
33693369> > * `auto_install`: installs once per pin. A plugin that a user removes stays removed until the pin changes.
from line 3377
33773377>
33783378> Executable that prints the access token to send.
33793379>
3380> > **More detail**
3380> > [accordion] More detail
33813381> >
33823382> > The helper script prints a token. It is sent as the Git password for user `x-access-token`, which GitHub, GitLab and Azure DevOps accept. For `url` sources it is sent as `Authorization: Bearer`.
33833383> >
33843384> > [Marketplace credentials](https://claude.com/docs/third-party/claude-desktop/extensions.md#marketplace-credentials) lists other forms, for hosts that need a username or for custom HTTP headers.
33853385>
3386> **github**
3387>
3388> Applies when `source` is `github`. The in-app configuration window calls it **GitHub**.
3389>
3390> **source** `string` *required*
3391>
3392> Where the marketplace comes from: a GitHub repository (set repo), a Git remote (set url) or a hosted marketplace.json file (set url).
3393>
3394> Must be: `github`
3395>
3396> **repo** `string` *required*
3397>
3398> GitHub repository in owner/repo form. Case-insensitive.
3399>
3400> **ref** `string`
3401>
3402> Commit SHA, branch, or tag. Leave empty to track the default branch; auto\_install and required need a full 40-character commit SHA.
3403>
3404> **path** `string`
3405>
3406> Folder within the repository that contains the marketplace, when it isn’t at the root.
3407>
3408> **credentialKind** `enum`
3409>
3410> Sent with a fetch: nothing (unset), the user’s Git credential, a helper script’s output, or the gateway or bootstrap credential (url only).
3411>
3412> One of: `anonymous`, `userGit`, `credentialHelper`
3413>
3414> **git**
3415>
3416> Applies when `source` is `git`. The in-app configuration window calls it **Git URL**.
3417>
3418> **source** `string` *required*
3419>
3420> Where the marketplace comes from: a GitHub repository (set repo), a Git remote (set url) or a hosted marketplace.json file (set url).
3421>
3422> Must be: `git`
3423>
3424> **url** `string` *required*
3425>
3426> HTTPS Git remote of the marketplace repository (git), or direct HTTPS URL of a hosted marketplace.json file (url).
3427>
3428> > **More detail**
3429> >
3430> > For a `url` source, `marketplace.json` lists each plugin as an `archive`: a zip `url` plus its `sha256`. [Host the marketplace over HTTPS](https://claude.com/docs/third-party/claude-desktop/extensions.md#host-the-marketplace-over-https-instead-of-git) has an example.
3431> >
3432> > * Archives must be on the same origin as the manifest. Open that host on your firewall. A credential is sent only to it.
3433> > * With `credentialKind` set to `inferenceCredential`, the manifest must be on your gateway's or bootstrap server's origin.
3434>
3435> **ref** `string`
3436>
3437> Commit SHA, branch, or tag. Leave empty to track the default branch; auto\_install and required need a full 40-character commit SHA.
3438>
3439> **path** `string`
3440>
3441> Folder within the repository that contains the marketplace, when it isn’t at the root.
3442>
3443> **credentialKind** `enum`
3444>
3445> Sent with a fetch: nothing (unset), the user’s Git credential, a helper script’s output, or the gateway or bootstrap credential (url only).
3446>
3447> One of: `anonymous`, `userGit`, `credentialHelper`
3448>
3449> **url**
3450>
3451> Applies when `source` is `url`. The in-app configuration window calls it **Marketplace URL**.
3452>
3453> **source** `string` *required*
3454>
3455> Where the marketplace comes from: a GitHub repository (set repo), a Git remote (set url) or a hosted marketplace.json file (set url).
3456>
3457> Must be: `url`
3458>
3459> **url** `string` *required*
3460>
3461> HTTPS Git remote of the marketplace repository (git), or direct HTTPS URL of a hosted marketplace.json file (url).
3462>
3463> > **More detail**
3464> >
3465> > For a `url` source, `marketplace.json` lists each plugin as an `archive`: a zip `url` plus its `sha256`. [Host the marketplace over HTTPS](https://claude.com/docs/third-party/claude-desktop/extensions.md#host-the-marketplace-over-https-instead-of-git) has an example.
3466> >
3467> > * Archives must be on the same origin as the manifest. Open that host on your firewall. A credential is sent only to it.
3468> > * With `credentialKind` set to `inferenceCredential`, the manifest must be on your gateway's or bootstrap server's origin.
3469>
3470> **manifestSha256** `string`
3471>
3472> SHA-256 of the marketplace.json to accept (url sources). Any other file is refused. Without it, auto\_install and required act as available.
3473>
3474> **credentialKind** `enum`
3475>
3476> Sent with a fetch: nothing (unset), the user’s Git credential, a helper script’s output, or the gateway or bootstrap credential (url only).
3477>
3478> One of: `anonymous`, `userGit`, `credentialHelper`, `inferenceCredential`
3386> > [tab] github
3387> >
3388> > Applies when `source` is `github`. The in-app configuration window calls it **GitHub**.
3389> >
3390> > **source** `string` *required*
3391> >
3392> > Where the marketplace comes from: a GitHub repository (set repo), a Git remote (set url) or a hosted marketplace.json file (set url).
3393> >
3394> > Must be: `github`
3395> >
3396> > **repo** `string` *required*
3397> >
3398> > GitHub repository in owner/repo form. Case-insensitive.
3399> >
3400> > **ref** `string`
3401> >
3402> > Commit SHA, branch, or tag. Leave empty to track the default branch; auto\_install and required need a full 40-character commit SHA.
3403> >
3404> > **path** `string`
3405> >
3406> > Folder within the repository that contains the marketplace, when it isn’t at the root.
3407> >
3408> > **credentialKind** `enum`
3409> >
3410> > Sent with a fetch: nothing (unset), the user’s Git credential, a helper script’s output, or the gateway or bootstrap credential (url only).
3411> >
3412> > One of: `anonymous`, `userGit`, `credentialHelper`
3413>
3414> > [tab] git
3415> >
3416> > Applies when `source` is `git`. The in-app configuration window calls it **Git URL**.
3417> >
3418> > **source** `string` *required*
3419> >
3420> > Where the marketplace comes from: a GitHub repository (set repo), a Git remote (set url) or a hosted marketplace.json file (set url).
3421> >
3422> > Must be: `git`
3423> >
3424> > **url** `string` *required*
3425> >
3426> > HTTPS Git remote of the marketplace repository (git), or direct HTTPS URL of a hosted marketplace.json file (url).
3427> >
3428> > > [accordion] More detail
3429> > >
3430> > > For a `url` source, `marketplace.json` lists each plugin as an `archive`: a zip `url` plus its `sha256`. [Host the marketplace over HTTPS](https://claude.com/docs/third-party/claude-desktop/extensions.md#host-the-marketplace-over-https-instead-of-git) has an example.
3431> > >
3432> > > * Archives must be on the same origin as the manifest. Open that host on your firewall. A credential is sent only to it.
3433> > > * With `credentialKind` set to `inferenceCredential`, the manifest must be on your gateway's or bootstrap server's origin.
3434> >
3435> > **ref** `string`
3436> >
3437> > Commit SHA, branch, or tag. Leave empty to track the default branch; auto\_install and required need a full 40-character commit SHA.
3438> >
3439> > **path** `string`
3440> >
3441> > Folder within the repository that contains the marketplace, when it isn’t at the root.
3442> >
3443> > **credentialKind** `enum`
3444> >
3445> > Sent with a fetch: nothing (unset), the user’s Git credential, a helper script’s output, or the gateway or bootstrap credential (url only).
3446> >
3447> > One of: `anonymous`, `userGit`, `credentialHelper`
3448>
3449> > [tab] url
3450> >
3451> > Applies when `source` is `url`. The in-app configuration window calls it **Marketplace URL**.
3452> >
3453> > **source** `string` *required*
3454> >
3455> > Where the marketplace comes from: a GitHub repository (set repo), a Git remote (set url) or a hosted marketplace.json file (set url).
3456> >
3457> > Must be: `url`
3458> >
3459> > **url** `string` *required*
3460> >
3461> > HTTPS Git remote of the marketplace repository (git), or direct HTTPS URL of a hosted marketplace.json file (url).
3462> >
3463> > > [accordion] More detail
3464> > >
3465> > > For a `url` source, `marketplace.json` lists each plugin as an `archive`: a zip `url` plus its `sha256`. [Host the marketplace over HTTPS](https://claude.com/docs/third-party/claude-desktop/extensions.md#host-the-marketplace-over-https-instead-of-git) has an example.
3466> > >
3467> > > * Archives must be on the same origin as the manifest. Open that host on your firewall. A credential is sent only to it.
3468> > > * With `credentialKind` set to `inferenceCredential`, the manifest must be on your gateway's or bootstrap server's origin.
3469> >
3470> > **manifestSha256** `string`
3471> >
3472> > SHA-256 of the marketplace.json to accept (url sources). Any other file is refused. Without it, auto\_install and required act as available.
3473> >
3474> > **credentialKind** `enum`
3475> >
3476> > Sent with a fetch: nothing (unset), the user’s Git credential, a helper script’s output, or the gateway or bootstrap credential (url only).
3477> >
3478> > One of: `anonymous`, `userGit`, `credentialHelper`, `inferenceCredential`
34793479
34803480***
34813481
from line 3485
34853485
34863486**Organization plugin settings.** Locks tool permissions on the MCP servers that plugins provide.
34873487
3488> **More detail**
3488> [accordion] More detail
34893489>
34903490> * If a `managedMcpServers` entry is for the same server (same URL, otherwise same name), the entry here is ignored. Put the locks in that entry's `toolPolicy`.
34913491> * Update all devices first: an older version ignores this list and enforces no locks.
34923492> * Claude Code's own managed settings, where a session has any, take priority by default.
34933493
3494> **Child attributes (2)**
3494> [accordion] Child attributes (2)
34953495>
34963496> **serverName** `string` *required*
34973497>
from line 3501
35013501>
35023502> Per-tool approval locks for this server.
35033503>
3504> > **Child attributes (2)**
3504> > [accordion] Child attributes (2)
35053505> >
35063506> > **tools.toolName** `string` *required*
35073507> >
from line 3561
35613561
35623562[Admin Console](#the-works-with-column): Not available.
35633563
3564> **More detail**
3564> [accordion] More detail
35653565>
35663566> When unset, the bootstrap sign-in uses a device code on the bootstrap server's own origin.
35673567>
35683568> In an MDM profile, write this key as one JSON string. Separate values such as `bootstrapOidc.clientId` do not work: the app silently uses the device-code sign-in instead.
35693569
3570> **Child attributes (8)**
3570> [accordion] Child attributes (8)
35713571>
35723572> **clientId** `string` *required*
35733573>
from line 3603
36033603>
36043604> Space-separated hostnames also accepted as the referrer of the sign-in callback, besides the authorization URL’s host.
36053605>
3606> > **More detail**
3606> > [accordion] More detail
36073607> >
36083608> > If a callback is rejected for a referrer mismatch, the app log names the rejected host. Add that hostname here.
36093609
from line 3623
36233623
36243624[Admin Console](#the-works-with-column): Not available.
36253625
3626> **More detail**
3626> [accordion] More detail
36273627>
36283628> If `bootstrapOidc` is unset, the app treats these headers as sufficient authentication and requires no per-user sign-in for the bootstrap fetch.
36293629>
from line 3647
36473647
36483648[Admin Console](#the-works-with-column): Not available.
36493649
3650> **More detail**
3650> [accordion] More detail
36513651>
36523652> Example output: `{"Authorization": "Bearer …"}`. The app runs the helper script with no arguments and reuses its output for a few minutes.
36533653>
from line 3710
37103710
37113711The profiles below are illustrative examples rather than built-in presets, and the labels are descriptive only. Use them as starting points and adjust for your environment. Layer the inference-provider keys for your cloud on top of whichever profile you choose.
37123712
3713**Standard**
3714
3715Recommended for most enterprise deployments. Telemetry and auto-updates stay on so Anthropic can diagnose issues and ship fixes; users can extend Claude Desktop with their own connectors.
3716
3717| Key | Value |
3718| - | - |
3719| [`deploymentOrganizationUuid`](#deploymentorganizationuuid) | `<your-org-uuid>` |
3720| [`autoUpdaterEnforcementHours`](#autoupdaterenforcementhours) | `24` |
3721| [`isDesktopExtensionSignatureRequired`](#isdesktopextensionsignaturerequired) | `true` |
3722| [`otlpEndpoint`](#otlpendpoint) | `<your-collector>` |
3723
3724**Restricted**
3725
3726For regulated environments that need to control what users can connect Claude Desktop to, while keeping Anthropic supportability.
3727
3728| Key | Value |
3729| - | - |
3730| [`deploymentOrganizationUuid`](#deploymentorganizationuuid) | `<your-org-uuid>` |
3731| [`disableDeploymentModeChooser`](#disabledeploymentmodechooser) | `true` |
3732| [`disableNonessentialTelemetry`](#disablenonessentialtelemetry) | `true` |
3733| [`disableNonessentialServices`](#disablenonessentialservices) | `true` |
3734| [`isLocalDevMcpEnabled`](#islocaldevmcpenabled) | `false` |
3735| [`isDesktopExtensionEnabled`](#isdesktopextensionenabled) | `false` |
3736| [`allowedWorkspaceFolders`](#allowedworkspacefolders) | `[{"path":"~/Documents/Claude"}]` |
3737| [`coworkEgressAllowedHosts`](#coworkegressallowedhosts) | `["*.example.corp"]` |
3738| [`otlpEndpoint`](#otlpendpoint) | `<your-collector>` |
3739
3740**Locked down**
3741
3742For air-gapped or maximally restricted environments. **The app's own traffic goes only to your inference endpoint and OTLP collector**, plus `downloads.claude.ai` for the VM bundle and Claude CLI binary at session start unless you deploy the [offline installer](https://claude.com/docs/third-party/claude-desktop/installation.md#offline-installation). Code sessions on Windows, and on Linux without Claude Code's sandbox dependencies, [run shell commands unsandboxed](https://claude.com/docs/third-party/claude-desktop/code.md#applied-as-managed-policy), so those commands can reach any host your network allows. To prevent that, [turn off Code](https://claude.com/docs/third-party/claude-desktop/code.md#disabling-code) on those devices. With this profile, Anthropic receives no telemetry or logs from the app and does not deliver updates, so your team owns log collection and update distribution. On Microsoft Foundry, the Claude models behind your inference endpoint run in an Anthropic-operated service, so conversation content still reaches Anthropic-operated infrastructure under this profile, as described under [Data handling by provider](https://claude.com/docs/third-party/claude-desktop/overview.md#data-handling-by-provider).
3743
3744| Key | Value |
3745| - | - |
3746| [`disableDeploymentModeChooser`](#disabledeploymentmodechooser) | `true` |
3747| [`disableEssentialTelemetry`](#disableessentialtelemetry) | `true` |
3748| [`disableNonessentialTelemetry`](#disablenonessentialtelemetry) | `true` |
3749| [`disableNonessentialServices`](#disablenonessentialservices) | `true` |
3750| [`disableAutoUpdates`](#disableautoupdates) | `true` |
3751| [`modelCatalogEnabled`](#modelcatalogenabled) | `false` |
3752| [`isLocalDevMcpEnabled`](#islocaldevmcpenabled) | `false` |
3753| [`isDesktopExtensionEnabled`](#isdesktopextensionenabled) | `false` |
3754| [`skillCreationEnabled`](#skillcreationenabled) | `false` |
3755| [`userPluginMarketplacesEnabled`](#userpluginmarketplacesenabled) | `false` |
3756| [`userPluginUploadsEnabled`](#userpluginuploadsenabled) | `false` |
3757| [`scheduledTasksEnabled`](#scheduledtasksenabled) | `false` |
3758| [`disabledBuiltinTools`](#disabledbuiltintools) | `["WebSearch","WebFetch"]` |
3759| [`coworkEgressAllowedHosts`](#coworkegressallowedhosts) | `[]` |
3760| [`allowedWorkspaceFolders`](#allowedworkspacefolders) | `[{"path":"~/Documents/Claude"}]` |
3761| [`otlpEndpoint`](#otlpendpoint) | `<your-collector>` |
3713> [tab] Standard
3714>
3715> Recommended for most enterprise deployments. Telemetry and auto-updates stay on so Anthropic can diagnose issues and ship fixes; users can extend Claude Desktop with their own connectors.
3716>
3717> | Key | Value |
3718> | - | - |
3719> | [`deploymentOrganizationUuid`](#deploymentorganizationuuid) | `<your-org-uuid>` |
3720> | [`autoUpdaterEnforcementHours`](#autoupdaterenforcementhours) | `24` |
3721> | [`isDesktopExtensionSignatureRequired`](#isdesktopextensionsignaturerequired) | `true` |
3722> | [`otlpEndpoint`](#otlpendpoint) | `<your-collector>` |
3723
3724> [tab] Restricted
3725>
3726> For regulated environments that need to control what users can connect Claude Desktop to, while keeping Anthropic supportability.
3727>
3728> | Key | Value |
3729> | - | - |
3730> | [`deploymentOrganizationUuid`](#deploymentorganizationuuid) | `<your-org-uuid>` |
3731> | [`disableDeploymentModeChooser`](#disabledeploymentmodechooser) | `true` |
3732> | [`disableNonessentialTelemetry`](#disablenonessentialtelemetry) | `true` |
3733> | [`disableNonessentialServices`](#disablenonessentialservices) | `true` |
3734> | [`isLocalDevMcpEnabled`](#islocaldevmcpenabled) | `false` |
3735> | [`isDesktopExtensionEnabled`](#isdesktopextensionenabled) | `false` |
3736> | [`allowedWorkspaceFolders`](#allowedworkspacefolders) | `[{"path":"~/Documents/Claude"}]` |
3737> | [`coworkEgressAllowedHosts`](#coworkegressallowedhosts) | `["*.example.corp"]` |
3738> | [`otlpEndpoint`](#otlpendpoint) | `<your-collector>` |
3739
3740> [tab] Locked down
3741>
3742> For air-gapped or maximally restricted environments. **The app's own traffic goes only to your inference endpoint and OTLP collector**, plus `downloads.claude.ai` for the VM bundle and Claude CLI binary at session start unless you deploy the [offline installer](https://claude.com/docs/third-party/claude-desktop/installation.md#offline-installation). Code sessions on Windows, and on Linux without Claude Code's sandbox dependencies, [run shell commands unsandboxed](https://claude.com/docs/third-party/claude-desktop/code.md#applied-as-managed-policy), so those commands can reach any host your network allows. To prevent that, [turn off Code](https://claude.com/docs/third-party/claude-desktop/code.md#disabling-code) on those devices. With this profile, Anthropic receives no telemetry or logs from the app and does not deliver updates, so your team owns log collection and update distribution. On Microsoft Foundry, the Claude models behind your inference endpoint run in an Anthropic-operated service, so conversation content still reaches Anthropic-operated infrastructure under this profile, as described under [Data handling by provider](https://claude.com/docs/third-party/claude-desktop/overview.md#data-handling-by-provider).
3743>
3744> | Key | Value |
3745> | - | - |
3746> | [`disableDeploymentModeChooser`](#disabledeploymentmodechooser) | `true` |
3747> | [`disableEssentialTelemetry`](#disableessentialtelemetry) | `true` |
3748> | [`disableNonessentialTelemetry`](#disablenonessentialtelemetry) | `true` |
3749> | [`disableNonessentialServices`](#disablenonessentialservices) | `true` |
3750> | [`disableAutoUpdates`](#disableautoupdates) | `true` |
3751> | [`modelCatalogEnabled`](#modelcatalogenabled) | `false` |
3752> | [`isLocalDevMcpEnabled`](#islocaldevmcpenabled) | `false` |
3753> | [`isDesktopExtensionEnabled`](#isdesktopextensionenabled) | `false` |
3754> | [`skillCreationEnabled`](#skillcreationenabled) | `false` |
3755> | [`userPluginMarketplacesEnabled`](#userpluginmarketplacesenabled) | `false` |
3756> | [`userPluginUploadsEnabled`](#userpluginuploadsenabled) | `false` |
3757> | [`scheduledTasksEnabled`](#scheduledtasksenabled) | `false` |
3758> | [`disabledBuiltinTools`](#disabledbuiltintools) | `["WebSearch","WebFetch"]` |
3759> | [`coworkEgressAllowedHosts`](#coworkegressallowedhosts) | `[]` |
3760> | [`allowedWorkspaceFolders`](#allowedworkspacefolders) | `[{"path":"~/Documents/Claude"}]` |
3761> | [`otlpEndpoint`](#otlpendpoint) | `<your-collector>` |
37623762
37633763### Tool permissions for managed MCP servers
37643764
37653765
third-party/claude-desktop/extensions Changed · +6 / -6 lines
from line 128
128128
129129Google Workspace and Microsoft 365 each have a dedicated setup path:
130130
131> **[Google Workspace](https://developers.google.com/workspace/guides/configure-mcp-servers)**
131> [card] [Google Workspace](https://developers.google.com/workspace/guides/configure-mcp-servers)
132132>
133133> Gmail, Calendar, Drive, Docs, and more via Google's own Workspace MCP servers. See [Google's setup guide](https://developers.google.com/workspace/guides/configure-mcp-servers) to get started.
134134
135> **[Microsoft 365](https://claude.com/docs/third-party/claude-desktop/connectors-m365.md)**
135> [card] [Microsoft 365](https://claude.com/docs/third-party/claude-desktop/connectors-m365.md)
136136>
137137> Outlook, OneDrive, SharePoint, and Teams. Requires registering an app in your Entra tenant. The remote connector also needs an Anthropic allowlist step.
138138
from line 548
548548
549549## Related topics
550550
551> **[Code](https://claude.com/docs/third-party/claude-desktop/code.md)**
551> [card] [Code](https://claude.com/docs/third-party/claude-desktop/code.md)
552552>
553553> How extensions and managed settings reach the embedded Claude Code engine.
554554
555> **[MCP in Claude Code](https://code.claude.com/docs/en/mcp)**
555> [card] [MCP in Claude Code](https://code.claude.com/docs/en/mcp)
556556>
557557> Configure MCP servers for the standalone Claude Code CLI.
558558
559> **[Claude Code plugins](https://code.claude.com/docs/en/plugins)**
559> [card] [Claude Code plugins](https://code.claude.com/docs/en/plugins)
560560>
561561> Plugin structure, marketplaces, and management for Claude Code.
562562
563> **[Managed MCP in Claude Code](https://code.claude.com/docs/en/managed-mcp)**
563> [card] [Managed MCP in Claude Code](https://code.claude.com/docs/en/managed-mcp)
564564>
565565> Restrict which MCP servers Claude Code users can add.
566566
third-party/claude-desktop/feature-matrix Changed · +7 / -7 lines
from line 25
2525
2626Claude Desktop on 3P is administered from the web-based [admin console](https://claude.com/docs/third-party/claude-desktop/admin-console.md), and can also be configured through [MDM](https://claude.com/docs/third-party/claude-desktop/mdm.md) or a [bootstrap server](https://claude.com/docs/third-party/claude-desktop/bootstrap.md).
2727
28> **Everyday work**
28> [card] Everyday work
2929>
3030> * [Chat](https://claude.com/docs/third-party/claude-desktop/chat.md)
3131> * [Cowork](https://claude.com/docs/third-party/claude-desktop/configuration.md#coworktabenabled)
from line 38
3838> * Global languages
3939> * [Automatically approve in Cowork](https://claude.com/docs/third-party/claude-desktop/configuration.md#automodeenabled)
4040
41> **Web and browser**
41> [card] Web and browser
4242>
4343> * [Built-in browser](https://claude.com/docs/third-party/claude-desktop/browser.md#built-in-browser)
4444> * [Web search](https://claude.com/docs/third-party/claude-desktop/web-tools.md#web-search)
4545> * [Claude in Chrome](https://claude.com/docs/third-party/claude-desktop/browser.md#claude-in-chrome)
4646
47> **Connectors and extensions**
47> [card] Connectors and extensions
4848>
4949> * [Microsoft 365](https://claude.com/docs/third-party/claude-desktop/connectors-m365.md) and [GitHub](https://claude.com/docs/third-party/claude-desktop/connectors-github.md) connectors
5050> * [Local MCP](https://claude.com/docs/third-party/claude-desktop/extensions.md#user-extensions)
from line 52
5252> * [Skills, plugins, and hooks](https://claude.com/docs/third-party/claude-desktop/extensions.md)
5353> * [Plugin marketplaces](https://claude.com/docs/third-party/claude-desktop/extensions.md#plugin-marketplaces-admin)
5454
55> **Code**
55> [card] Code
5656>
5757> * [Code](https://claude.com/docs/third-party/claude-desktop/code.md)
5858> * [Auto mode in Code](https://claude.com/docs/third-party/claude-desktop/configuration.md#automodeenabled)
5959> * [SSH remote Code sessions](https://claude.com/docs/third-party/claude-desktop/ssh-remote-sessions.md)
6060
61> **Administration**
61> [card] Administration
6262>
6363> * [Admin console](https://claude.com/docs/third-party/claude-desktop/admin-console.md)
6464> * [Endpoint or gateway configuration](https://claude.com/docs/third-party/claude-desktop/configuration.md#connection)
from line 72
7272> * [User management via UI](https://claude.com/docs/third-party/claude-desktop/admin-console.md#connect-your-identity-provider)
7373> * [RBAC](https://claude.com/docs/third-party/claude-desktop/admin-console.md#per-group-permission-policies)
7474
75> **Monitoring and retention**
75> [card] Monitoring and retention
7676>
7777> * [OpenTelemetry export](https://claude.com/docs/third-party/claude-desktop/telemetry.md#sending-telemetry-to-your-own-collector)
7878> * [Turning off telemetry](https://claude.com/docs/third-party/claude-desktop/telemetry.md#telemetry-categories)
from line 80
8080
8181## Good to know about Claude Desktop on 3P
8282
83> **Notes on setup, limits, monitoring, and data handling**
83> [accordion] Notes on setup, limits, monitoring, and data handling
8484>
8585> | Topic | What to know |
8686> | - | - |