Example settings files changedsettings-example
Nearest release: v2.1.307, published 3 hours before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 22 Oct 2026 00:03 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 30 Oct 2026 18:07 UTC.
Upstream edited
Recorded here
Lines+325added
Lines−325removed
From line
16
where the diff opens
First seen
21 Aug 2026
this site's first read of the page
Recorded edits16to this page, all time
The whole hunk
from line 16, old and new numbered
/
The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.
from line 16
1616
1717One developer's personal settings. It picks a model and effort, adjusts the terminal, and pre-approves a read-only command and one file read. Everything not listed keeps its default. A file like this goes in `~/.claude/settings.json`, where it applies to every project you open.
1818
19**Copyable settings file**
20
21Save this as `~/.claude/settings.json`. It's valid JSON with no comments, so you can paste it as is and delete the keys you don't want.
22
23```json ~/.claude/settings.json theme={null}
24{
25 "model": "claude-sonnet-5",
26 "modelSettings": {
27 "claude-sonnet-5": { "effortLevel": "xhigh" }
28 },
29 "editorMode": "vim",
30 "theme": "light-daltonized",
31 "statusLine": {
32 "type": "command",
33 "command": "jq -r '\"[\\(.model.display_name)] \\(.context_window.used_percentage // 0)% context\"'",
34 "padding": 2
35 },
36 "spinnerTipsEnabled": false,
37 "preferredNotifChannel": "terminal_bell",
38 "permissions": {
39 "allow": [
40 "Bash(git diff *)",
41 "Read(~/.zshrc)"
42 ]
43 },
44 "autoUpdatesChannel": "stable",
45 "cleanupPeriodDays": 20
46}
47```
48
49**What each key does**
50
51The same file with a comment above each key. Read it here; copy from the other tab, because Claude Code doesn't accept comments in a settings file.
52
53```jsonc ~/.claude/settings.json theme={null}
54{
55 // Start every session on Sonnet 5
56 "model": "claude-sonnet-5",
57 // Run Sonnet 5 above its default high level; /effort saves a level per model, and --effort sets one for a single session
58 "modelSettings": {
59 "claude-sonnet-5": { "effortLevel": "xhigh" }
60 },
61 // Vim keybindings in the prompt
62 "editorMode": "vim",
63 // The colorblind-friendly light theme
64 "theme": "light-daltonized",
65 // A status line below the prompt: model name and context used
66 "statusLine": {
67 "type": "command",
68 "command": "jq -r '\"[\\(.model.display_name)] \\(.context_window.used_percentage // 0)% context\"'",
69 "padding": 2
70 },
71 // Hide the tips that rotate under the spinner
72 "spinnerTipsEnabled": false,
73 // Ring the terminal bell for notifications, such as a finished task or a waiting permission prompt
74 "preferredNotifChannel": "terminal_bell",
75 // Let Claude Code run git diff and read your .zshrc without asking
76 "permissions": {
77 "allow": [
78 "Bash(git diff *)",
79 "Read(~/.zshrc)"
80 ]
81 },
82 // Take updates from the stable channel
83 "autoUpdatesChannel": "stable",
84 // Delete session transcripts and other local session data older than 20 days
85 "cleanupPeriodDays": 20
86}
87```
19> [tab] Copyable settings file
20>
21> Save this as `~/.claude/settings.json`. It's valid JSON with no comments, so you can paste it as is and delete the keys you don't want.
22>
23> ```json ~/.claude/settings.json theme={null}
24> {
25> "model": "claude-sonnet-5",
26> "modelSettings": {
27> "claude-sonnet-5": { "effortLevel": "xhigh" }
28> },
29> "editorMode": "vim",
30> "theme": "light-daltonized",
31> "statusLine": {
32> "type": "command",
33> "command": "jq -r '\"[\\(.model.display_name)] \\(.context_window.used_percentage // 0)% context\"'",
34> "padding": 2
35> },
36> "spinnerTipsEnabled": false,
37> "preferredNotifChannel": "terminal_bell",
38> "permissions": {
39> "allow": [
40> "Bash(git diff *)",
41> "Read(~/.zshrc)"
42> ]
43> },
44> "autoUpdatesChannel": "stable",
45> "cleanupPeriodDays": 20
46> }
47> ```
48
49> [tab] What each key does
50>
51> The same file with a comment above each key. Read it here; copy from the other tab, because Claude Code doesn't accept comments in a settings file.
52>
53> ```jsonc ~/.claude/settings.json theme={null}
54> {
55> // Start every session on Sonnet 5
56> "model": "claude-sonnet-5",
57> // Run Sonnet 5 above its default high level; /effort saves a level per model, and --effort sets one for a single session
58> "modelSettings": {
59> "claude-sonnet-5": { "effortLevel": "xhigh" }
60> },
61> // Vim keybindings in the prompt
62> "editorMode": "vim",
63> // The colorblind-friendly light theme
64> "theme": "light-daltonized",
65> // A status line below the prompt: model name and context used
66> "statusLine": {
67> "type": "command",
68> "command": "jq -r '\"[\\(.model.display_name)] \\(.context_window.used_percentage // 0)% context\"'",
69> "padding": 2
70> },
71> // Hide the tips that rotate under the spinner
72> "spinnerTipsEnabled": false,
73> // Ring the terminal bell for notifications, such as a finished task or a waiting permission prompt
74> "preferredNotifChannel": "terminal_bell",
75> // Let Claude Code run git diff and read your .zshrc without asking
76> "permissions": {
77> "allow": [
78> "Bash(git diff *)",
79> "Read(~/.zshrc)"
80> ]
81> },
82> // Take updates from the stable channel
83> "autoUpdatesChannel": "stable",
84> // Delete session transcripts and other local session data older than 20 days
85> "cleanupPeriodDays": 20
86> }
87> ```
8888
8989## A team's shared settings
9090
from line 96
9696* **The hook is a script in the repo.** This file's hook runs `.claude/hooks/block-rm.sh`; [How a hook resolves](https://code.claude.com/docs/en/hooks.md#how-a-hook-resolves) walks through writing it.
9797* **Rules match the command and path as written.** `Bash(git push *)` doesn't match [`git -C . push`](https://code.claude.com/docs/en/permissions#bash-rule-limits). `Read(./.env)` on its own stops the file tools and commands that name the file, such as `cat .env`, but not [`grep -r` run over the directory](https://code.claude.com/docs/en/permissions#read-and-edit); the `sandbox` block in this file closes that gap, because the sandbox [adds your `Read` deny paths](https://code.claude.com/docs/en/settings-reference#sandbox-filesystem-denyread) to what every sandboxed command can't read.
9898
99**Copyable settings file**
100
101Save this as `.claude/settings.json` at the top of the repository and commit it. It's valid JSON with no comments, so you can paste it as is and delete the keys you don't want.
102
103```json .claude/settings.json theme={null}
104{
105 "permissions": {
106 "allow": [
107 "Bash(npm run *)"
108 ],
109 "ask": [
110 "Bash(git push *)"
111 ],
112 "deny": [
113 "Read(./.env)",
114 "Read(./.env.*)",
115 "Read(./secrets/**)"
116 ]
117 },
118 "hooks": {
119 "PreToolUse": [
120 {
121 "matcher": "Bash",
122 "hooks": [
123 {
124 "type": "command",
125 "command": "${CLAUDE_PROJECT_DIR}/.claude/hooks/block-rm.sh"
126 }
127 ]
128 }
129 ]
130 },
131 "extraKnownMarketplaces": {
132 "acme-tools": {
133 "source": {
134 "source": "github",
135 "repo": "acme-corp/claude-plugins"
136 }
137 }
138 },
139 "enabledPlugins": {
140 "code-formatter@acme-tools": true
141 },
142 "sandbox": {
143 "enabled": true,
144 "filesystem": {
145 "allowWrite": [
146 "/tmp/build"
147 ]
148 },
149 "network": {
150 "allowedDomains": [
151 "registry.npmjs.org",
152 "*.example.com"
153 ]
154 }
155 },
156 "plansDirectory": "./plans"
157}
158```
159
160**What each key does**
161
162The same file with a comment above each key. Read it here; copy from the other tab, because Claude Code doesn't accept comments in a settings file.
163
164```jsonc .claude/settings.json theme={null}
165{
166 "permissions": {
167 // Run npm scripts without asking
168 "allow": [
169 "Bash(npm run *)"
170 ],
171 // Confirm before git push commands
172 "ask": [
173 "Bash(git push *)"
174 ],
175 // Deny reads of env files and the secrets folder by the file tools and file-reading commands
176 "deny": [
177 "Read(./.env)",
178 "Read(./.env.*)",
179 "Read(./secrets/**)"
180 ]
181 },
182 // Before every Bash command, run a script in the repo that can block it
183 "hooks": {
184 "PreToolUse": [
185 {
186 "matcher": "Bash",
187 "hooks": [
188 {
189 "type": "command",
190 "command": "${CLAUDE_PROJECT_DIR}/.claude/hooks/block-rm.sh"
191 }
192 ]
193 }
194 ]
195 },
196 // Register the team's plugin marketplace on every clone
197 "extraKnownMarketplaces": {
198 "acme-tools": {
199 "source": {
200 "source": "github",
201 "repo": "acme-corp/claude-plugins"
202 }
203 }
204 },
205 // Enable one plugin from that marketplace; a plugin from an external source such as a GitHub repository still needs each person to install it once
206 "enabledPlugins": {
207 "code-formatter@acme-tools": true
208 },
209 // Sandbox commands: writable build dir; npm and example.com pre-allowed
210 "sandbox": {
211 "enabled": true,
212 "filesystem": {
213 "allowWrite": [
214 "/tmp/build"
215 ]
216 },
217 "network": {
218 "allowedDomains": [
219 "registry.npmjs.org",
220 "*.example.com"
221 ]
222 }
223 },
224 // Keep plan files inside the repo
225 "plansDirectory": "./plans"
226}
227```
99> [tab] Copyable settings file
100>
101> Save this as `.claude/settings.json` at the top of the repository and commit it. It's valid JSON with no comments, so you can paste it as is and delete the keys you don't want.
102>
103> ```json .claude/settings.json theme={null}
104> {
105> "permissions": {
106> "allow": [
107> "Bash(npm run *)"
108> ],
109> "ask": [
110> "Bash(git push *)"
111> ],
112> "deny": [
113> "Read(./.env)",
114> "Read(./.env.*)",
115> "Read(./secrets/**)"
116> ]
117> },
118> "hooks": {
119> "PreToolUse": [
120> {
121> "matcher": "Bash",
122> "hooks": [
123> {
124> "type": "command",
125> "command": "${CLAUDE_PROJECT_DIR}/.claude/hooks/block-rm.sh"
126> }
127> ]
128> }
129> ]
130> },
131> "extraKnownMarketplaces": {
132> "acme-tools": {
133> "source": {
134> "source": "github",
135> "repo": "acme-corp/claude-plugins"
136> }
137> }
138> },
139> "enabledPlugins": {
140> "code-formatter@acme-tools": true
141> },
142> "sandbox": {
143> "enabled": true,
144> "filesystem": {
145> "allowWrite": [
146> "/tmp/build"
147> ]
148> },
149> "network": {
150> "allowedDomains": [
151> "registry.npmjs.org",
152> "*.example.com"
153> ]
154> }
155> },
156> "plansDirectory": "./plans"
157> }
158> ```
159
160> [tab] What each key does
161>
162> The same file with a comment above each key. Read it here; copy from the other tab, because Claude Code doesn't accept comments in a settings file.
163>
164> ```jsonc .claude/settings.json theme={null}
165> {
166> "permissions": {
167> // Run npm scripts without asking
168> "allow": [
169> "Bash(npm run *)"
170> ],
171> // Confirm before git push commands
172> "ask": [
173> "Bash(git push *)"
174> ],
175> // Deny reads of env files and the secrets folder by the file tools and file-reading commands
176> "deny": [
177> "Read(./.env)",
178> "Read(./.env.*)",
179> "Read(./secrets/**)"
180> ]
181> },
182> // Before every Bash command, run a script in the repo that can block it
183> "hooks": {
184> "PreToolUse": [
185> {
186> "matcher": "Bash",
187> "hooks": [
188> {
189> "type": "command",
190> "command": "${CLAUDE_PROJECT_DIR}/.claude/hooks/block-rm.sh"
191> }
192> ]
193> }
194> ]
195> },
196> // Register the team's plugin marketplace on every clone
197> "extraKnownMarketplaces": {
198> "acme-tools": {
199> "source": {
200> "source": "github",
201> "repo": "acme-corp/claude-plugins"
202> }
203> }
204> },
205> // Enable one plugin from that marketplace; a plugin from an external source such as a GitHub repository still needs each person to install it once
206> "enabledPlugins": {
207> "code-formatter@acme-tools": true
208> },
209> // Sandbox commands: writable build dir; npm and example.com pre-allowed
210> "sandbox": {
211> "enabled": true,
212> "filesystem": {
213> "allowWrite": [
214> "/tmp/build"
215> ]
216> },
217> "network": {
218> "allowedDomains": [
219> "registry.npmjs.org",
220> "*.example.com"
221> ]
222> }
223> },
224> // Keep plan files inside the repo
225> "plansDirectory": "./plans"
226> }
227> ```
228228
229229## An organization's managed settings
230230
from line 243
243243
244244Administrators deploy a file like this as `managed-settings.json`, or the same JSON through MDM or [server-managed settings](https://code.claude.com/docs/en/server-managed-settings.md). One deployed file applies to every machine or account it reaches. To give a group different values, deploy a different file or profile to that group, since [server-managed settings don't support per-group policy yet](https://code.claude.com/docs/en/server-managed-settings.md#current-limitations).
245245
246**Copyable settings file**
247
248Deploy this as `managed-settings.json`, or the same JSON through MDM or the claude.ai console. It's valid JSON with no comments; replace the example organization UUID, server URL, and marketplace with your own and delete the keys you don't want.
249
250```json managed-settings.json theme={null}
251{
252 "forceLoginMethod": "claudeai",
253 "forceLoginOrgUUID": [
254 "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
255 ],
256 "availableModels": [
257 "opus",
258 "sonnet"
259 ],
260 "enforceAvailableModels": true,
261 "permissions": {
262 "deny": [
263 "Bash(curl *)",
264 "Read(./.env)",
265 "Read(./secrets/**)"
266 ],
267 "disableBypassPermissionsMode": "disable"
268 },
269 "allowManagedPermissionRulesOnly": true,
270 "allowedMcpServers": [
271 {
272 "serverUrl": "https://api.githubcopilot.com/*"
273 }
274 ],
275 "allowManagedMcpServersOnly": true,
276 "strictKnownMarketplaces": [
277 {
278 "source": "github",
279 "repo": "acme-corp/approved-plugins"
280 }
281 ],
282 "sandbox": {
283 "enabled": true,
284 "failIfUnavailable": true,
285 "allowUnsandboxedCommands": false,
286 "network": {
287 "allowedDomains": [
288 "registry.npmjs.org",
289 "github.com"
290 ],
291 "allowManagedDomainsOnly": true
292 }
293 },
294 "requiredMinimumVersion": "2.1.150",
295 "cleanupPeriodDays": 7,
296 "companyAnnouncements": [
297 "Welcome to Acme Corp! Review our code guidelines at docs.example.com"
298 ]
299}
300```
301
302**What each key does**
303
304The same file with a comment above each key. Read it here; copy from the other tab, because Claude Code doesn't accept comments in a settings file.
305
306```jsonc managed-settings.json theme={null}
307{
308 // Only claude.ai logins, and only in this organization
309 "forceLoginMethod": "claudeai",
310 "forceLoginOrgUUID": [
311 "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
312 ],
313 // Only Opus and Sonnet models; with enforceAvailableModels, the Default option obeys the list too
314 "availableModels": [
315 "opus",
316 "sonnet"
317 ],
318 "enforceAvailableModels": true,
319 "permissions": {
320 // Deny curl commands and reads of the project's .env file and secrets folder on every machine
321 "deny": [
322 "Bash(curl *)",
323 "Read(./.env)",
324 "Read(./secrets/**)"
325 ],
326 // Remove the bypass-permissions mode from every session
327 "disableBypassPermissionsMode": "disable"
328 },
329 // Ignore permission rules from user, project, and local settings
330 "allowManagedPermissionRulesOnly": true,
331 // Only the GitHub MCP server, matched by URL rather than by name, since a user can
332 // name any server "github". User-added servers that don't match don't load, including
333 // every stdio server when the list has only URL entries. The allowManagedMcpServersOnly
334 // key below makes this managed list the only allowlist that applies
335 "allowedMcpServers": [
336 {
337 "serverUrl": "https://api.githubcopilot.com/*"
338 }
339 ],
340 "allowManagedMcpServersOnly": true,
341 // Plugins can come only from this marketplace
342 "strictKnownMarketplaces": [
343 {
344 "source": "github",
345 "repo": "acme-corp/approved-plugins"
346 }
347 ],
348 // Sandbox every command Claude runs, refuse to start if the sandbox can't be
349 // set up, and never let a blocked command retry outside the sandbox; network
350 // limited to npm and GitHub, and users can't add domains
351 "sandbox": {
352 "enabled": true,
353 "failIfUnavailable": true,
354 "allowUnsandboxedCommands": false,
355 "network": {
356 "allowedDomains": [
357 "registry.npmjs.org",
358 "github.com"
359 ],
360 "allowManagedDomainsOnly": true
361 }
362 },
363 // Refuse to start on versions older than 2.1.150
364 "requiredMinimumVersion": "2.1.150",
365 // Delete session transcripts and other local session data after 7 days
366 "cleanupPeriodDays": 7,
367 // A message every user sees at startup
368 "companyAnnouncements": [
369 "Welcome to Acme Corp! Review our code guidelines at docs.example.com"
370 ]
371}
372```
246> [tab] Copyable settings file
247>
248> Deploy this as `managed-settings.json`, or the same JSON through MDM or the claude.ai console. It's valid JSON with no comments; replace the example organization UUID, server URL, and marketplace with your own and delete the keys you don't want.
249>
250> ```json managed-settings.json theme={null}
251> {
252> "forceLoginMethod": "claudeai",
253> "forceLoginOrgUUID": [
254> "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
255> ],
256> "availableModels": [
257> "opus",
258> "sonnet"
259> ],
260> "enforceAvailableModels": true,
261> "permissions": {
262> "deny": [
263> "Bash(curl *)",
264> "Read(./.env)",
265> "Read(./secrets/**)"
266> ],
267> "disableBypassPermissionsMode": "disable"
268> },
269> "allowManagedPermissionRulesOnly": true,
270> "allowedMcpServers": [
271> {
272> "serverUrl": "https://api.githubcopilot.com/*"
273> }
274> ],
275> "allowManagedMcpServersOnly": true,
276> "strictKnownMarketplaces": [
277> {
278> "source": "github",
279> "repo": "acme-corp/approved-plugins"
280> }
281> ],
282> "sandbox": {
283> "enabled": true,
284> "failIfUnavailable": true,
285> "allowUnsandboxedCommands": false,
286> "network": {
287> "allowedDomains": [
288> "registry.npmjs.org",
289> "github.com"
290> ],
291> "allowManagedDomainsOnly": true
292> }
293> },
294> "requiredMinimumVersion": "2.1.150",
295> "cleanupPeriodDays": 7,
296> "companyAnnouncements": [
297> "Welcome to Acme Corp! Review our code guidelines at docs.example.com"
298> ]
299> }
300> ```
301
302> [tab] What each key does
303>
304> The same file with a comment above each key. Read it here; copy from the other tab, because Claude Code doesn't accept comments in a settings file.
305>
306> ```jsonc managed-settings.json theme={null}
307> {
308> // Only claude.ai logins, and only in this organization
309> "forceLoginMethod": "claudeai",
310> "forceLoginOrgUUID": [
311> "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
312> ],
313> // Only Opus and Sonnet models; with enforceAvailableModels, the Default option obeys the list too
314> "availableModels": [
315> "opus",
316> "sonnet"
317> ],
318> "enforceAvailableModels": true,
319> "permissions": {
320> // Deny curl commands and reads of the project's .env file and secrets folder on every machine
321> "deny": [
322> "Bash(curl *)",
323> "Read(./.env)",
324> "Read(./secrets/**)"
325> ],
326> // Remove the bypass-permissions mode from every session
327> "disableBypassPermissionsMode": "disable"
328> },
329> // Ignore permission rules from user, project, and local settings
330> "allowManagedPermissionRulesOnly": true,
331> // Only the GitHub MCP server, matched by URL rather than by name, since a user can
332> // name any server "github". User-added servers that don't match don't load, including
333> // every stdio server when the list has only URL entries. The allowManagedMcpServersOnly
334> // key below makes this managed list the only allowlist that applies
335> "allowedMcpServers": [
336> {
337> "serverUrl": "https://api.githubcopilot.com/*"
338> }
339> ],
340> "allowManagedMcpServersOnly": true,
341> // Plugins can come only from this marketplace
342> "strictKnownMarketplaces": [
343> {
344> "source": "github",
345> "repo": "acme-corp/approved-plugins"
346> }
347> ],
348> // Sandbox every command Claude runs, refuse to start if the sandbox can't be
349> // set up, and never let a blocked command retry outside the sandbox; network
350> // limited to npm and GitHub, and users can't add domains
351> "sandbox": {
352> "enabled": true,
353> "failIfUnavailable": true,
354> "allowUnsandboxedCommands": false,
355> "network": {
356> "allowedDomains": [
357> "registry.npmjs.org",
358> "github.com"
359> ],
360> "allowManagedDomainsOnly": true
361> }
362> },
363> // Refuse to start on versions older than 2.1.150
364> "requiredMinimumVersion": "2.1.150",
365> // Delete session transcripts and other local session data after 7 days
366> "cleanupPeriodDays": 7,
367> // A message every user sees at startup
368> "companyAnnouncements": [
369> "Welcome to Acme Corp! Review our code guidelines at docs.example.com"
370> ]
371> }
372> ```
373373
No line in this hunk matches that.