Desktop application changeddesktop
Nearest release: v2.1.311, published 14 hours after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 26 Oct 2026 05:12 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 26 Oct 2026 05:37 UTC.
Upstream edited
Recorded here
Lines+64added
Lines−0removed
From line
990
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits94to this page, all time
#### Check a remote machine's host key ### SSH host key verification failed #### Check the host key from a terminal ##### Check the keys that `ssh` already trusts ### SSH host key refused on Windows without an OpenSSH client
The whole hunk
from line 990, old and new numbered
/
from line 990
990990* **Shell**: the shell set for your account on the remote machine has to run commands sent over SSH, as Bash, Zsh, and `sh` do
991991* **Network**: Claude Code runs on the remote machine and makes its network requests from there, so the machine needs the [network access that Claude Code requires](https://code.claude.com/docs/en/network-config.md#network-access-requirements). If the machine can't download Claude Code, Desktop downloads it on your computer and uploads it. Claude Code's other requests still go out from the remote machine. On a Linux remote machine, if those requests need a proxy, [set it for SSH sessions](#set-a-proxy-or-a-ca-certificate-for-ssh-sessions).
992992
993#### Check a remote machine's host key
994
995A host key is the key that a remote machine presents to prove which machine it is, and a fingerprint is a short form of that key. When you trust a key, your computer saves it and connects to whatever presents it, without asking again. Check a key before you trust it, because something may be intercepting the connection.
996
997First find which machine the key belongs to, from where you see the fingerprint:
998
999* **Desktop asks `Connect to <host> for the first time?`, or you selected Review new key**: the machine that Desktop names, `<host>`
1000* **Desktop asks `Connect through <jump host> for the first time?`**: the jump host, which is the machine that your connection passes through, not the machine that you want to reach
1001* **`ssh` asks or warns in a terminal**: the machine that its message names, which may not be the one that you typed
1002
1003Get that machine's own fingerprint from the machine, not over the connection that you're checking:
1004
1005* **Someone else manages the machine**: ask them for its host key fingerprint
1006* **You manage it, and it runs Linux or macOS**: run `ssh-keygen -lf /etc/ssh/ssh_host_<type>_key.pub` on it, at its console or over a connection that you already trust. For `<type>`, use the key type that Desktop or `ssh` shows beside the fingerprint, in lowercase: `ed25519` for `ED25519` or `ssh-ed25519`.
1007
1008Then compare the machine's own fingerprint with the one that you were shown:
1009
1010* **They match**: trust the key. Select **Trust and connect** or **Trust new key** in Desktop, or answer `yes` in the terminal.
1011* **They differ, or you can't check**: don't connect. Select **Cancel** in Desktop, or answer `no` in the terminal. If someone else manages the machine, tell them which fingerprint you were shown.
1012
1013If a troubleshooting step sent you here, go back to that step after either result.
1014
9931015#### Set a proxy or a CA certificate for SSH sessions
9941016
9951017If a Linux remote machine reaches the internet through a proxy or needs a CA certificate, add the [proxy and CA variables](https://code.claude.com/docs/en/network-config.md) under `env` in `~/.claude/settings.json` there. Add them even if you already export them in `~/.profile`, `~/.bash_profile`, `~/.zprofile`, or `~/.zshrc` on that machine.
from line 2152
21302152### MCP servers not working on Windows
21312153
21322154If MCP server toggles don't respond or servers fail to connect on Windows, check that the server is properly configured in your settings, restart the app, verify the server process is running in Task Manager, and review server logs for connection errors.
2155
2156### SSH host key verification failed
2157
2158Each of these messages means that Desktop refused a [host key](#check-a-remote-machines-host-key):
2159
2160* `SSH host key verification failed` or `Host denied (verification failed)` under **View details** on a `Couldn't connect to <host>` card
2161* `Connection failed: Host key changed or not trusted` by the prompt box or after **Test connection**
2162* `<host>'s host key is not trusted` or `<host>'s host key has changed` on a disconnected session
2163
2164Desktop usually refuses a key because it differs from the one saved on your computer, or because no key is saved for that machine. A machine that was rebuilt or reinstalled usually presents a new key, and so does something that intercepts the connection. Check the key before you connect again, starting from what Desktop shows with the message:
2165
2166* **You're on Windows, and Desktop says `Connection failed: Host key changed or not trusted`**: first rule out a [missing OpenSSH client](#ssh-host-key-refused-on-windows-without-an-openssh-client)
2167* **Desktop tells you to set `UserKnownHostsFile`**: in `~/.ssh/config`, set it to `~/.ssh/known_hosts`, then [check the key from a terminal](#check-the-host-key-from-a-terminal)
2168* **You see a Review new key button**: select it, and [compare](#check-a-remote-machines-host-key) the fingerprint that Desktop shows with the machine's own. If they match, select **Trust new key** to replace the saved key. Otherwise select **Cancel**.
2169* **You see no Review new key button, Desktop shows `Couldn't show the new key`, or Desktop refuses the key again after Trust new key**: [check the key from a terminal](#check-the-host-key-from-a-terminal)
2170
2171#### Check the host key from a terminal
2172
2173Run `ssh <SSH host>` on your computer, with the **SSH host** value of your [SSH connection](#ssh-sessions) in Desktop. Add `-p <SSH port>` if the connection has an **SSH port** value. On Windows, use PowerShell, because Desktop doesn't connect with the `ssh` in Git Bash or WSL. If PowerShell finds no `ssh`, [install Microsoft's OpenSSH client](#ssh-host-key-refused-on-windows-without-an-openssh-client).
2174
2175Note which machine `ssh` names in its message, which can be a jump host and not `<SSH host>`, then follow the case that fits:
2176
2177* **`ssh` asks whether to continue connecting**: [compare](#check-a-remote-machines-host-key) the fingerprint that it shows with that machine's own. Answer `yes` only if they match.
2178* **`ssh` warns that the host key has changed**: [compare](#check-a-remote-machines-host-key) the warning's fingerprint with that machine's own. Only if they match, delete the line that `Offending <type> key in <file>:<line>` names and rerun `ssh`. If `ssh` warns again about another line, compare, delete and rerun as before.
2179* **`ssh` refuses a key that it doesn't know, without asking**: get that machine's `known_hosts` line from whoever manages it, not over the connection that you're checking. Add the line to your `known_hosts` file, with the name from `ssh`'s message as its host name, and rerun `ssh`.
2180* **`ssh` goes on to sign in without asking you about the host key**: don't type a password yet. [Check the keys that `ssh` already trusts](#check-the-keys-that-ssh-already-trusts).
2181
2182Once `ssh` accepts a key that you checked or added, retry in Desktop. If Desktop refuses the key again, see [Get Desktop's logs for an SSH problem](#get-desktops-logs-for-an-ssh-problem).
2183
2184##### Check the keys that `ssh` already trusts
2185
2186Rerun the same `ssh` command with `-v -S none` added. In its output, a `Server host key:` line shows a fingerprint, and the next `Host '<name>' is known` line names the machine that it belongs to. [Compare](#check-a-remote-machines-host-key) each fingerprint that you find with that machine's own.
2187
2188* **A jump host has no `Server host key:` line**: run `ssh -v -S none <jump host>` too, and compare that fingerprint in the same way.
2189* **A fingerprint doesn't match, or you can't check it**: don't connect again. Remove the saved key: under `Host '<name>' is known`, the line `Found key in <file>:<line>` names the file that holds it. Run `ssh-keygen -R "<name>" -f <file>`. If you keep host keys in more than one file, remove the key from each. If you can't change a file, tell whoever manages your computer.
2190* **Every fingerprint matches**: retry in Desktop. If Desktop refuses the key again, see [Get Desktop's logs for an SSH problem](#get-desktops-logs-for-an-ssh-problem).
2191
2192### SSH host key refused on Windows without an OpenSSH client
2193
2194On Windows without an OpenSSH client, Desktop refuses even a correct host key, with `Connection failed: Host key changed or not trusted`. It needs the client to look up saved keys. To see whether you have one, run `ssh` in PowerShell. If PowerShell doesn't recognize `ssh`, install [Microsoft's OpenSSH client](https://learn.microsoft.com/windows-server/administration/openssh/openssh_install_firstuse) and restart Desktop.
2195
2196Then connect again. If Desktop asks whether to connect for the first time, [check the machine's host key](#check-a-remote-machines-host-key) before you trust it. If Desktop still refuses the key, follow the other cases under [SSH host key verification failed](#ssh-host-key-verification-failed).
21332197
21342198### SSH connection fails after you log in
21352199
No line in this hunk matches that.