Example settings files changedsettings-example
Nearest release: v2.1.287, published 7 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 2 Oct 2026 00:28 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 20 Oct 2026 18:37 UTC.
Upstream edited
Recorded here
Lines+320added
Lines−330removed
From line
16
where the diff opens
First seen
21 Aug 2026
this site's first read of the page
Recorded edits13to this page, all time
## A team's shared settings ## An organization's managed settings
The whole hunk
from line 16, old and new numbered
/
The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.
from line 16
1616
1717One developer's personal settings. It picks a model and effort, adjusts the terminal, and pre-approves a read-only command and one file read. Everything not listed keeps its default. A file like this goes in `~/.claude/settings.json`, where it applies to every project you open.
1818
19<Tabs>
20 <Tab title="Copyable settings file">
21 Save this as `~/.claude/settings.json`. It's valid JSON with no comments, so you can paste it as is and delete the keys you don't want.
22
23 ```json ~/.claude/settings.json theme={null}
24 {
25 "model": "claude-sonnet-5",
26 "modelSettings": {
27 "claude-sonnet-5": { "effortLevel": "xhigh" }
28 },
29 "editorMode": "vim",
30 "theme": "light-daltonized",
31 "statusLine": {
32 "type": "command",
33 "command": "jq -r '\"[\\(.model.display_name)] \\(.context_window.used_percentage // 0)% context\"'",
34 "padding": 2
35 },
36 "spinnerTipsEnabled": false,
37 "preferredNotifChannel": "terminal_bell",
38 "permissions": {
39 "allow": [
40 "Bash(git diff *)",
41 "Read(~/.zshrc)"
42 ]
43 },
44 "autoUpdatesChannel": "stable",
45 "cleanupPeriodDays": 20
46 }
47 ```
48 </Tab>
49
50 <Tab title="What each key does">
51 The same file with a comment above each key. Read it here; copy from the other tab, because Claude Code doesn't accept comments in a settings file.
52
53 ```jsonc ~/.claude/settings.json theme={null}
54 {
55 // Start every session on Sonnet 5
56 "model": "claude-sonnet-5",
57 // Run Sonnet 5 above its default high level; /effort saves a level per model, and --effort sets one for a single session
58 "modelSettings": {
59 "claude-sonnet-5": { "effortLevel": "xhigh" }
60 },
61 // Vim keybindings in the prompt
62 "editorMode": "vim",
63 // The colorblind-friendly light theme
64 "theme": "light-daltonized",
65 // A status line below the prompt: model name and context used
66 "statusLine": {
67 "type": "command",
68 "command": "jq -r '\"[\\(.model.display_name)] \\(.context_window.used_percentage // 0)% context\"'",
69 "padding": 2
70 },
71 // Hide the tips that rotate under the spinner
72 "spinnerTipsEnabled": false,
73 // Ring the terminal bell for notifications, such as a finished task or a waiting permission prompt
74 "preferredNotifChannel": "terminal_bell",
75 // Let Claude Code run git diff and read your .zshrc without asking
76 "permissions": {
77 "allow": [
78 "Bash(git diff *)",
79 "Read(~/.zshrc)"
80 ]
81 },
82 // Take updates from the stable channel
83 "autoUpdatesChannel": "stable",
84 // Delete session transcripts and other local session data older than 20 days
85 "cleanupPeriodDays": 20
86 }
87 ```
88 </Tab>
89</Tabs>
90
91<h2 id="a-teams-shared-settings">
92 A team's shared settings
93</h2>
19**Copyable settings file**
20
21Save this as `~/.claude/settings.json`. It's valid JSON with no comments, so you can paste it as is and delete the keys you don't want.
22
23```json ~/.claude/settings.json theme={null}
24{
25 "model": "claude-sonnet-5",
26 "modelSettings": {
27 "claude-sonnet-5": { "effortLevel": "xhigh" }
28 },
29 "editorMode": "vim",
30 "theme": "light-daltonized",
31 "statusLine": {
32 "type": "command",
33 "command": "jq -r '\"[\\(.model.display_name)] \\(.context_window.used_percentage // 0)% context\"'",
34 "padding": 2
35 },
36 "spinnerTipsEnabled": false,
37 "preferredNotifChannel": "terminal_bell",
38 "permissions": {
39 "allow": [
40 "Bash(git diff *)",
41 "Read(~/.zshrc)"
42 ]
43 },
44 "autoUpdatesChannel": "stable",
45 "cleanupPeriodDays": 20
46}
47```
48
49**What each key does**
50
51The same file with a comment above each key. Read it here; copy from the other tab, because Claude Code doesn't accept comments in a settings file.
52
53```jsonc ~/.claude/settings.json theme={null}
54{
55 // Start every session on Sonnet 5
56 "model": "claude-sonnet-5",
57 // Run Sonnet 5 above its default high level; /effort saves a level per model, and --effort sets one for a single session
58 "modelSettings": {
59 "claude-sonnet-5": { "effortLevel": "xhigh" }
60 },
61 // Vim keybindings in the prompt
62 "editorMode": "vim",
63 // The colorblind-friendly light theme
64 "theme": "light-daltonized",
65 // A status line below the prompt: model name and context used
66 "statusLine": {
67 "type": "command",
68 "command": "jq -r '\"[\\(.model.display_name)] \\(.context_window.used_percentage // 0)% context\"'",
69 "padding": 2
70 },
71 // Hide the tips that rotate under the spinner
72 "spinnerTipsEnabled": false,
73 // Ring the terminal bell for notifications, such as a finished task or a waiting permission prompt
74 "preferredNotifChannel": "terminal_bell",
75 // Let Claude Code run git diff and read your .zshrc without asking
76 "permissions": {
77 "allow": [
78 "Bash(git diff *)",
79 "Read(~/.zshrc)"
80 ]
81 },
82 // Take updates from the stable channel
83 "autoUpdatesChannel": "stable",
84 // Delete session transcripts and other local session data older than 20 days
85 "cleanupPeriodDays": 20
86}
87```
88
89## A team's shared settings
9490
9591One team's shared settings, committed to the repository so everyone who clones it gets the same permissions, hooks, and plugin marketplace. Save a file like this at `.claude/settings.json` at the top of the repository. What to know before you commit one:
9692
from line 96
10096* **The hook is a script in the repo.** This file's hook runs `.claude/hooks/block-rm.sh`; [How a hook resolves](/docs/en/hooks#how-a-hook-resolves) walks through writing it.
10197* **Rules match the command and path as written.** `Bash(git push *)` doesn't match [`git -C . push`](/docs/en/permissions#bash-rule-limits). `Read(./.env)` on its own stops the file tools and commands that name the file, such as `cat .env`, but not [`grep -r` run over the directory](/docs/en/permissions#read-and-edit); the `sandbox` block in this file closes that gap, because the sandbox [adds your `Read` deny paths](/docs/en/settings-reference#sandbox-filesystem-denyread) to what every sandboxed command can't read.
10298
103<Tabs>
104 <Tab title="Copyable settings file">
105 Save this as `.claude/settings.json` at the top of the repository and commit it. It's valid JSON with no comments, so you can paste it as is and delete the keys you don't want.
106
107 ```json .claude/settings.json theme={null}
108 {
109 "permissions": {
110 "allow": [
111 "Bash(npm run *)"
112 ],
113 "ask": [
114 "Bash(git push *)"
115 ],
116 "deny": [
117 "Read(./.env)",
118 "Read(./.env.*)",
119 "Read(./secrets/**)"
120 ]
121 },
122 "hooks": {
123 "PreToolUse": [
99**Copyable settings file**
100
101Save this as `.claude/settings.json` at the top of the repository and commit it. It's valid JSON with no comments, so you can paste it as is and delete the keys you don't want.
102
103```json .claude/settings.json theme={null}
104{
105 "permissions": {
106 "allow": [
107 "Bash(npm run *)"
108 ],
109 "ask": [
110 "Bash(git push *)"
111 ],
112 "deny": [
113 "Read(./.env)",
114 "Read(./.env.*)",
115 "Read(./secrets/**)"
116 ]
117 },
118 "hooks": {
119 "PreToolUse": [
120 {
121 "matcher": "Bash",
122 "hooks": [
124123 {
125 "matcher": "Bash",
126 "hooks": [
127 {
128 "type": "command",
129 "command": "${CLAUDE_PROJECT_DIR}/.claude/hooks/block-rm.sh"
130 }
131 ]
124 "type": "command",
125 "command": "${CLAUDE_PROJECT_DIR}/.claude/hooks/block-rm.sh"
132126 }
133127 ]
134 },
135 "extraKnownMarketplaces": {
136 "acme-tools": {
137 "source": {
138 "source": "github",
139 "repo": "acme-corp/claude-plugins"
140 }
141 }
142 },
143 "enabledPlugins": {
144 "code-formatter@acme-tools": true
145 },
146 "sandbox": {
147 "enabled": true,
148 "filesystem": {
149 "allowWrite": [
150 "/tmp/build"
151 ]
152 },
153 "network": {
154 "allowedDomains": [
155 "registry.npmjs.org",
156 "*.example.com"
157 ]
158 }
159 },
160 "plansDirectory": "./plans"
161 }
162 ```
163 </Tab>
164
165 <Tab title="What each key does">
166 The same file with a comment above each key. Read it here; copy from the other tab, because Claude Code doesn't accept comments in a settings file.
167
168 ```jsonc .claude/settings.json theme={null}
169 {
170 "permissions": {
171 // Run npm scripts without asking
172 "allow": [
173 "Bash(npm run *)"
174 ],
175 // Confirm before git push commands
176 "ask": [
177 "Bash(git push *)"
178 ],
179 // Deny reads of env files and the secrets folder by the file tools and file-reading commands
180 "deny": [
181 "Read(./.env)",
182 "Read(./.env.*)",
183 "Read(./secrets/**)"
184 ]
185 },
186 // Before every Bash command, run a script in the repo that can block it
187 "hooks": {
188 "PreToolUse": [
128 }
129 ]
130 },
131 "extraKnownMarketplaces": {
132 "acme-tools": {
133 "source": {
134 "source": "github",
135 "repo": "acme-corp/claude-plugins"
136 }
137 }
138 },
139 "enabledPlugins": {
140 "code-formatter@acme-tools": true
141 },
142 "sandbox": {
143 "enabled": true,
144 "filesystem": {
145 "allowWrite": [
146 "/tmp/build"
147 ]
148 },
149 "network": {
150 "allowedDomains": [
151 "registry.npmjs.org",
152 "*.example.com"
153 ]
154 }
155 },
156 "plansDirectory": "./plans"
157}
158```
159
160**What each key does**
161
162The same file with a comment above each key. Read it here; copy from the other tab, because Claude Code doesn't accept comments in a settings file.
163
164```jsonc .claude/settings.json theme={null}
165{
166 "permissions": {
167 // Run npm scripts without asking
168 "allow": [
169 "Bash(npm run *)"
170 ],
171 // Confirm before git push commands
172 "ask": [
173 "Bash(git push *)"
174 ],
175 // Deny reads of env files and the secrets folder by the file tools and file-reading commands
176 "deny": [
177 "Read(./.env)",
178 "Read(./.env.*)",
179 "Read(./secrets/**)"
180 ]
181 },
182 // Before every Bash command, run a script in the repo that can block it
183 "hooks": {
184 "PreToolUse": [
185 {
186 "matcher": "Bash",
187 "hooks": [
189188 {
190 "matcher": "Bash",
191 "hooks": [
192 {
193 "type": "command",
194 "command": "${CLAUDE_PROJECT_DIR}/.claude/hooks/block-rm.sh"
195 }
196 ]
189 "type": "command",
190 "command": "${CLAUDE_PROJECT_DIR}/.claude/hooks/block-rm.sh"
197191 }
198192 ]
199 },
200 // Register the team's plugin marketplace on every clone
201 "extraKnownMarketplaces": {
202 "acme-tools": {
203 "source": {
204 "source": "github",
205 "repo": "acme-corp/claude-plugins"
206 }
207 }
208 },
209 // Enable one plugin from that marketplace; a plugin from an external source such as a GitHub repository still needs each person to install it once
210 "enabledPlugins": {
211 "code-formatter@acme-tools": true
212 },
213 // Sandbox commands: writable build dir; npm and example.com pre-allowed
214 "sandbox": {
215 "enabled": true,
216 "filesystem": {
217 "allowWrite": [
218 "/tmp/build"
219 ]
220 },
221 "network": {
222 "allowedDomains": [
223 "registry.npmjs.org",
224 "*.example.com"
225 ]
226 }
227 },
228 // Keep plan files inside the repo
229 "plansDirectory": "./plans"
230 }
231 ```
232 </Tab>
233</Tabs>
234
235<h2 id="an-organizations-managed-settings">
236 An organization's managed settings
237</h2>
193 }
194 ]
195 },
196 // Register the team's plugin marketplace on every clone
197 "extraKnownMarketplaces": {
198 "acme-tools": {
199 "source": {
200 "source": "github",
201 "repo": "acme-corp/claude-plugins"
202 }
203 }
204 },
205 // Enable one plugin from that marketplace; a plugin from an external source such as a GitHub repository still needs each person to install it once
206 "enabledPlugins": {
207 "code-formatter@acme-tools": true
208 },
209 // Sandbox commands: writable build dir; npm and example.com pre-allowed
210 "sandbox": {
211 "enabled": true,
212 "filesystem": {
213 "allowWrite": [
214 "/tmp/build"
215 ]
216 },
217 "network": {
218 "allowedDomains": [
219 "registry.npmjs.org",
220 "*.example.com"
221 ]
222 }
223 },
224 // Keep plan files inside the repo
225 "plansDirectory": "./plans"
226}
227```
228
229## An organization's managed settings
238230
239231A `managed-settings.json` file that shows the shape of the managed keys, with one plausible value for each. It isn't a recommended policy: pick the keys that match your own requirements and set your own values. The example sets these keys:
240232
from line 243
251243
252244Administrators deploy a file like this as `managed-settings.json`, or the same JSON through MDM or [server-managed settings](/docs/en/server-managed-settings). One deployed file applies to every machine or account it reaches. To give a group different values, deploy a different file or profile to that group, since [server-managed settings don't support per-group policy yet](/docs/en/server-managed-settings#current-limitations).
253245
254<Tabs>
255 <Tab title="Copyable settings file">
256 Deploy this as `managed-settings.json`, or the same JSON through MDM or the claude.ai console. It's valid JSON with no comments; replace the example organization UUID, server URL, and marketplace with your own and delete the keys you don't want.
257
258 ```json managed-settings.json theme={null}
246**Copyable settings file**
247
248Deploy this as `managed-settings.json`, or the same JSON through MDM or the claude.ai console. It's valid JSON with no comments; replace the example organization UUID, server URL, and marketplace with your own and delete the keys you don't want.
249
250```json managed-settings.json theme={null}
251{
252 "forceLoginMethod": "claudeai",
253 "forceLoginOrgUUID": [
254 "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
255 ],
256 "availableModels": [
257 "opus",
258 "sonnet"
259 ],
260 "enforceAvailableModels": true,
261 "permissions": {
262 "deny": [
263 "Bash(curl *)",
264 "Read(./.env)",
265 "Read(./secrets/**)"
266 ],
267 "disableBypassPermissionsMode": "disable"
268 },
269 "allowManagedPermissionRulesOnly": true,
270 "allowedMcpServers": [
259271 {
260 "forceLoginMethod": "claudeai",
261 "forceLoginOrgUUID": [
262 "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
272 "serverUrl": "https://api.githubcopilot.com/*"
273 }
274 ],
275 "allowManagedMcpServersOnly": true,
276 "strictKnownMarketplaces": [
277 {
278 "source": "github",
279 "repo": "acme-corp/approved-plugins"
280 }
281 ],
282 "sandbox": {
283 "enabled": true,
284 "failIfUnavailable": true,
285 "allowUnsandboxedCommands": false,
286 "network": {
287 "allowedDomains": [
288 "registry.npmjs.org",
289 "github.com"
263290 ],
264 "availableModels": [
265 "opus",
266 "sonnet"
291 "allowManagedDomainsOnly": true
292 }
293 },
294 "requiredMinimumVersion": "2.1.150",
295 "cleanupPeriodDays": 7,
296 "companyAnnouncements": [
297 "Welcome to Acme Corp! Review our code guidelines at docs.example.com"
298 ]
299}
300```
301
302**What each key does**
303
304The same file with a comment above each key. Read it here; copy from the other tab, because Claude Code doesn't accept comments in a settings file.
305
306```jsonc managed-settings.json theme={null}
307{
308 // Only claude.ai logins, and only in this organization
309 "forceLoginMethod": "claudeai",
310 "forceLoginOrgUUID": [
311 "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
312 ],
313 // Only Opus and Sonnet models; with enforceAvailableModels, the Default option obeys the list too
314 "availableModels": [
315 "opus",
316 "sonnet"
317 ],
318 "enforceAvailableModels": true,
319 "permissions": {
320 // Deny curl commands and reads of the project's .env file and secrets folder on every machine
321 "deny": [
322 "Bash(curl *)",
323 "Read(./.env)",
324 "Read(./secrets/**)"
325 ],
326 // Remove the bypass-permissions mode from every session
327 "disableBypassPermissionsMode": "disable"
328 },
329 // Ignore permission rules from user, project, and local settings
330 "allowManagedPermissionRulesOnly": true,
331 // Only the GitHub MCP server, matched by URL rather than by name, since a user can
332 // name any server "github". User-added servers that don't match don't load, including
333 // every stdio server when the list has only URL entries. The allowManagedMcpServersOnly
334 // key below makes this managed list the only allowlist that applies
335 "allowedMcpServers": [
336 {
337 "serverUrl": "https://api.githubcopilot.com/*"
338 }
339 ],
340 "allowManagedMcpServersOnly": true,
341 // Plugins can come only from this marketplace
342 "strictKnownMarketplaces": [
343 {
344 "source": "github",
345 "repo": "acme-corp/approved-plugins"
346 }
347 ],
348 // Sandbox every command Claude runs, refuse to start if the sandbox can't be
349 // set up, and never let a blocked command retry outside the sandbox; network
350 // limited to npm and GitHub, and users can't add domains
351 "sandbox": {
352 "enabled": true,
353 "failIfUnavailable": true,
354 "allowUnsandboxedCommands": false,
355 "network": {
356 "allowedDomains": [
357 "registry.npmjs.org",
358 "github.com"
267359 ],
268 "enforceAvailableModels": true,
269 "permissions": {
270 "deny": [
271 "Bash(curl *)",
272 "Read(./.env)",
273 "Read(./secrets/**)"
274 ],
275 "disableBypassPermissionsMode": "disable"
276 },
277 "allowManagedPermissionRulesOnly": true,
278 "allowedMcpServers": [
279 {
280 "serverUrl": "https://api.githubcopilot.com/*"
281 }
282 ],
283 "allowManagedMcpServersOnly": true,
284 "strictKnownMarketplaces": [
285 {
286 "source": "github",
287 "repo": "acme-corp/approved-plugins"
288 }
289 ],
290 "sandbox": {
291 "enabled": true,
292 "failIfUnavailable": true,
293 "allowUnsandboxedCommands": false,
294 "network": {
295 "allowedDomains": [
296 "registry.npmjs.org",
297 "github.com"
298 ],
299 "allowManagedDomainsOnly": true
300 }
301 },
302 "requiredMinimumVersion": "2.1.150",
303 "cleanupPeriodDays": 7,
304 "companyAnnouncements": [
305 "Welcome to Acme Corp! Review our code guidelines at docs.example.com"
306 ]
307 }
308 ```
309 </Tab>
310
311 <Tab title="What each key does">
312 The same file with a comment above each key. Read it here; copy from the other tab, because Claude Code doesn't accept comments in a settings file.
313
314 ```jsonc managed-settings.json theme={null}
315 {
316 // Only claude.ai logins, and only in this organization
317 "forceLoginMethod": "claudeai",
318 "forceLoginOrgUUID": [
319 "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
320 ],
321 // Only Opus and Sonnet models; with enforceAvailableModels, the Default option obeys the list too
322 "availableModels": [
323 "opus",
324 "sonnet"
325 ],
326 "enforceAvailableModels": true,
327 "permissions": {
328 // Deny curl commands and reads of the project's .env file and secrets folder on every machine
329 "deny": [
330 "Bash(curl *)",
331 "Read(./.env)",
332 "Read(./secrets/**)"
333 ],
334 // Remove the bypass-permissions mode from every session
335 "disableBypassPermissionsMode": "disable"
336 },
337 // Ignore permission rules from user, project, and local settings
338 "allowManagedPermissionRulesOnly": true,
339 // Only the GitHub MCP server, matched by URL rather than by name, since a user can
340 // name any server "github". User-added servers that don't match don't load, including
341 // every stdio server when the list has only URL entries. The allowManagedMcpServersOnly
342 // key below makes this managed list the only allowlist that applies
343 "allowedMcpServers": [
344 {
345 "serverUrl": "https://api.githubcopilot.com/*"
346 }
347 ],
348 "allowManagedMcpServersOnly": true,
349 // Plugins can come only from this marketplace
350 "strictKnownMarketplaces": [
351 {
352 "source": "github",
353 "repo": "acme-corp/approved-plugins"
354 }
355 ],
356 // Sandbox every command Claude runs, refuse to start if the sandbox can't be
357 // set up, and never let a blocked command retry outside the sandbox; network
358 // limited to npm and GitHub, and users can't add domains
359 "sandbox": {
360 "enabled": true,
361 "failIfUnavailable": true,
362 "allowUnsandboxedCommands": false,
363 "network": {
364 "allowedDomains": [
365 "registry.npmjs.org",
366 "github.com"
367 ],
368 "allowManagedDomainsOnly": true
369 }
370 },
371 // Refuse to start on versions older than 2.1.150
372 "requiredMinimumVersion": "2.1.150",
373 // Delete session transcripts and other local session data after 7 days
374 "cleanupPeriodDays": 7,
375 // A message every user sees at startup
376 "companyAnnouncements": [
377 "Welcome to Acme Corp! Review our code guidelines at docs.example.com"
378 ]
379 }
380 ```
381 </Tab>
382</Tabs>
360 "allowManagedDomainsOnly": true
361 }
362 },
363 // Refuse to start on versions older than 2.1.150
364 "requiredMinimumVersion": "2.1.150",
365 // Delete session transcripts and other local session data after 7 days
366 "cleanupPeriodDays": 7,
367 // A message every user sees at startup
368 "companyAnnouncements": [
369 "Welcome to Acme Corp! Review our code guidelines at docs.example.com"
370 ]
371}
372```
383373
No line in this hunk matches that.