Home Docs Claude Documentation 5 Nov 2026

One change · claude-docs

Configuration reference changedthird-party/claude-desktop/configuration

Nearest release: v2.1.319, published 6 hours after upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.

Upstream edited this page at 5 Nov 2026 18:22 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 5 Nov 2026 18:37 UTC.

Upstream edited 5 Nov 2026 18:22 UTC

Recorded here 5 Nov 2026 18:37 UTC

Lines+142added

Lines−21removed

From line 69 where the diff opens

First seen 14 Aug 2026 this site's first read of the page

Recorded edits69to this page, all time

#### `disableDesktopLocalSessions` #### `sshConfigs` #### `disableWslSessions` #### `claudeCodeProcessWrapperEnabled`

The whole hunk

from line 69, old and new numbered

lines

from line 69

from line 98

from line 178

174178

175179> [accordion] More detail

176180>

177> The app opens in third-party mode unless the user chose to sign in to Claude.ai at the login screen. `disableDeploymentModeChooser` removes that choice.

181> The app opens in third-party mode unless the user chose to sign in to Claude.ai at the login screen. `deploymentMode` at `3p`, or `disableDeploymentModeChooser`, removes that choice.

178182>

179183> When this key is unset, the app opens in standard mode unless another key, such as `bootstrapUrl`, asks for third-party mode.

180184>

from line 321

317321

318322string

319323

320MDM only (You can set the key only in an MDM profile or the local configuration file. Claude Desktop ignores it in a bootstrap server's response.)

324MDM only (You can set the key only in an MDM profile or the local configuration file. Claude Desktop ignores it in a bootstrap server's response. Where a key's description says MDM profile only, the local configuration file does not count either.)

321325

322326Since 1.44121.1

323327

from line 347

343347

344348string

345349

346MDM only (You can set the key only in an MDM profile or the local configuration file. Claude Desktop ignores it in a bootstrap server's response.)

350MDM only (You can set the key only in an MDM profile or the local configuration file. Claude Desktop ignores it in a bootstrap server's response. Where a key's description says MDM profile only, the local configuration file does not count either.)

347351

348352Since 1.44121.1

349353

from line 1344

13401344

13411345***

13421346

1347#### `disableDesktopLocalSessions`

1348

1349booleanSince 2.42304.0

1350

1351**Disable local Code sessions.** Turn off Code sessions that run on the device, WSL included, so Code offers only remote environments such as SSH.

1352

1353[Guide for this setting](https://claude.com/docs/third-party/claude-desktop/ssh-remote-sessions.md)

1354

1355> [accordion] More detail

1356>

1357> Set `sshHostAllowlist` too. While it allows no host, Code has nowhere to start a session. SSH to `localhost` counts as local. Other names for this device are blocked only by leaving them out of `sshHostAllowlist`.

1358>

1359> Chat and Cowork still run on the device. A running session goes on until its process stops, and then cannot be resumed. Claude Code started from a terminal ignores this key. Code routines set to run on the device are held while the key is set.

1360>

1361> `false` does not undo a `true` in Claude Code's managed setting of the same name. Where a bootstrap server or the Admin Console delivers configuration, set this key there. Its configuration replaces the MDM profile's value, even if it leaves this key out.

1362

1363***

1364

13431365#### `sshHostAllowlist`

13441366

13451367string\[]

from line 1385

13631385

13641386***

13651387

1388#### `sshConfigs`

1389

1390object\[]

1391

1392Beta (The feature that the key configures is in beta.)

1393

1394Consent required (A value that a bootstrap server delivers applies only after the user approves it, unless machine-scoped device management set that server's address. The trustBootstrapDelivery key overrides that default. A value set in an MDM profile, the local configuration file or the Enterprise Admin Console needs no approval.)

1395

1396Since 2.42304.0

1397

1398**SSH connections.** SSH connections offered to everyone in Code’s environment menu. In Code, users can select them but not edit or remove them.

1399

1400[Guide for this setting](https://claude.com/docs/third-party/claude-desktop/ssh-remote-sessions.md)

1401

1402> [accordion] More detail

1403>

1404> Every connection is still checked against `sshHostAllowlist`. While that list allows no host, the SSH section is hidden.

1405>

1406> For a connection from this list, the app does not first ask the user to confirm the host. SSH's own host-key checks still apply, so a first connection to a host missing from the user's `known_hosts` may ask the user or fail. Users can still add connections of their own.

1407>

1408> While `disableDesktopLocalSessions` is on, new sessions default to the first SSH connection in the user's list, which can be one of these.

1409

1410> [accordion] Child attributes (5)

1411>

1412> **id** `string` *required*

1413>

1414> Identifier of your choice, unique in the list. A user’s entry with the same ID in Claude Code’s user settings replaces yours.

1415>

1416> **name** `string` *required*

1417>

1418> Shown in Code’s environment menu.

1419>

1420> **sshHost** `string` *required*

1421>

1422> host, user\@host, or a host alias from the user’s \~/.ssh/config.

1423>

1424> **sshPort** `integer`

1425>

1426> A number from 1 to 65535.

1427>

1428> **sshIdentityFile** `string`

1429>

1430> Path of a private key file on the user’s device.

1431

1432***

1433

13661434#### `sshClientPath`

13671435

13681436string

from line 1583

15151583>

15161584> > [accordion] More detail

15171585> >

1518> > Desktop checks this list inside the distro for a WSL session that starts under it. `~` also means the distro user's home. The session needs both bubblewrap and socat there to start. Shell commands can read the Windows drives under `/mnt`. To hide them, apart from listed `/mnt` folders, set `blockReadsOutsideWorkingDirectories`. Users can re-open them. Claude Code's server-managed settings, managed settings in the distro or a Windows policy with `wslInheritsWindowsSettings` replace Desktop's session settings. A session can then run with no sandbox, with or without those programs. Shell commands can read the drives and write outside the list after a prompt, or with none in bypass mode. If the one in force sets `parentSettingsBehavior` to `merge`, those settings stay, but it can undo them.

1586> > Desktop checks this list inside the distro for a WSL session that starts under it. `~` also means the distro user's home. The session needs both bubblewrap and socat there to start. Shell commands can read the Windows drives under `/mnt`. To hide them, apart from listed `/mnt` folders, set `blockReadsOutsideWorkingDirectories`. Users can re-open them. Claude Code's server-managed settings, managed settings in the distro or a Windows policy with `wslInheritsWindowsSettings` replace Desktop's session settings. A session can then run with no sandbox, with or without those programs. Shell commands can read the drives and write outside the list, with no prompt in Auto or bypass mode. If the one in force sets `parentSettingsBehavior` to `merge`, those settings stay, but it can undo them.

15191587>

15201588> **isDefaultSelected** `boolean`

15211589>

from line 1705

16371705> * It does not limit Claude Code in a terminal.

16381706> * Claude Code's own managed settings, where a session has any, take priority by default. Restrict marketplaces in those settings as well.

16391707>

1640> Applies only while the app runs in third-party mode. If users could otherwise sign in to Claude.ai on the device, also set `disableDeploymentModeChooser` so the app stays in third-party mode.

1708> Applies only while the app runs in third-party mode. If users could otherwise sign in to Claude.ai on the device, also set `deploymentMode` to `3p`, or `disableDeploymentModeChooser`.

16411709

16421710***

16431711

from line 1719

16511719>

16521720> Plugins that are already installed, or placed on disk outside the app, are not removed or blocked.

16531721>

1654> Applies only while the app runs in third-party mode. If users could otherwise sign in to Claude.ai on the device, also set `disableDeploymentModeChooser` so the app stays in third-party mode.

1722> Applies only while the app runs in third-party mode. If users could otherwise sign in to Claude.ai on the device, also set `deploymentMode` to `3p`, or `disableDeploymentModeChooser`.

16551723

16561724***

16571725

from line 1878

18101878

18111879***

18121880

1881#### `disableWslSessions`

1882

1883boolean

1884

1885MDM only (You can set the key only in an MDM profile or the local configuration file. Claude Desktop ignores it in a bootstrap server's response. Where a key's description says MDM profile only, the local configuration file does not count either.)

1886

1887Since 1.19367.0

1888

1889**Block WSL sessions.** Block Code sessions inside WSL, where Windows endpoint policy does not reach. Unset: blocked on managed devices.

1890

1891[Admin Console](#the-works-with-column): Not available.

1892

1893> [accordion] More detail

1894>

1895> MDM profile only. Only a machine-wide `false` (`HKLM`) allows WSL sessions on a device with any managed configuration.

1896>

1897> For a WSL session that starts under `allowedWorkspaceFolders`, Desktop checks it inside the distro, so `~` also means the distro user's home. The session needs both bubblewrap and socat there to start. Shell commands can read the Windows drives under `/mnt`. `blockReadsOutsideWorkingDirectories` hides them, apart from listed `/mnt` folders. Users can re-open them. Claude Code's server-managed settings, among others, can take away that read limit and the sandbox: see the list's Path help.

1898>

1899> This is an app-behavior key, like `disableAutoUpdates`. If your MDM profile holds nothing but such keys, the app reads them all from that profile alone, so put every one you use there.

1900

1901***

1902

1903#### `claudeCodeProcessWrapperEnabled`

1904

1905booleanSince 2.7032.0

1906

1907**Use Claude Code’s corporate launcher.** Start Claude Code through the launcher named in Claude Code’s managed settings (processWrapper).

1908

1909[Guide for this setting](https://claude.com/docs/third-party/claude-desktop/code.md#interaction-with-claude-code%E2%80%99s-own-managed-settings)

1910

1911> [accordion] More detail

1912>

1913> The launcher comes from the device's managed settings, not server-managed settings. SSH sessions to Linux or macOS hosts use the one in the host's managed-settings files.

1914>

1915> * **Credentials:** the app passes the launcher no inference credential. The launcher must supply one, such as `ANTHROPIC_AUTH_TOKEN`, or every reply fails.

1916> * **Not used:** on Windows for sessions on the device, in WSL, in Cowork, and for the connection test and title generation.

1917>

1918> To stop users bypassing the launcher, set this key in your MDM profile, with `disableDeploymentModeChooser` if that profile sets more than app-behavior keys.

1919>

1920> This is an app-behavior key, like `disableAutoUpdates`. If your MDM profile holds nothing but such keys, the app reads them all from that profile alone, so put every one you use there.

1921

1922***

1923

18131924#### `organizationInstructions`

18141925

18151926stringSince 1.37937.0

from line 1973

18621973

18631974enum

18641975

1865MDM only (You can set the key only in an MDM profile or the local configuration file. Claude Desktop ignores it in a bootstrap server's response.)

1976MDM only (You can set the key only in an MDM profile or the local configuration file. Claude Desktop ignores it in a bootstrap server's response. Where a key's description says MDM profile only, the local configuration file does not count either.)

18661977

18671978Since 4.16336.0

18681979

from line 1985

18741985

18751986> [accordion] More detail

18761987>

1877> Replaces `disableDeploymentModeChooser`, whose `true` means `3p`. `3p` or `1p` wins over that key. A bootstrap server's value is ignored. Earlier versions do not read this key.

1988> Replaces `disableDeploymentModeChooser`: use `3p` for its `true`. `3p` or `1p` wins over it. A bootstrap server can change it, not this key. Earlier versions do not read this key.

18781989>

18791990> * `3p`: keeps the app on the connection this configuration names, with no Claude.ai sign-in. With no connection, Claude.ai sign-in opens. To block Claude.ai sign-in, name a connection.

18801991> * `1p`: always Claude.ai sign-in, even where a connection is named. No Claude API account sign-in and no setup of the user's own.

from line 2003

18922003

18932004**Disable claude:// deep-link handling.** Stop external apps and websites from opening Claude Desktop via claude:// links.

18942005

2006> [accordion] More detail

2007>

2008> Cowork and Chat then offer no sign-in to a connector that a plugin brings. That sign-in returns to the app by a claude:// link.

2009

18952010***

18962011

18972012### Built-in browser

from line 2094

19792094>

19802095> **enabled** `boolean` (default: false)

19812096>

1982> Lets users import a Claude.ai data export and earlier Claude sessions on this device from Settings → Import.

2097> Lets users import a Claude.ai data export, earlier sessions here, or another device’s Claude Desktop export, in Settings → Import & export.

19832098>

2099> > [accordion] More detail

2100> >

2101> > The user confirms another device’s export is their own. Memory and some app preferences apply at once. Tasks, plugins, and skills arrive turned off. Local MCP servers start when the user adds them in a dialog. Each needs its setting on: `scheduledTasksEnabled`, `userPluginUploadsEnabled`, `skillCreationEnabled`, `isLocalDevMcpEnabled`.

2102>

19842103> **allowedOrganizationUuids** `string[]`

19852104>

19862105> When set, users import by sign-in only, and only from the Claude.ai organizations with these IDs.

from line 2127

20082127>

20092128> **exportEnabled** `boolean` (default: false)

20102129>

2011> Lets users export this device’s chats, Cowork tasks and Code sessions as a zip to import elsewhere. No effect unless Enable import is on.

2130> Lets users export their Claude data on this device as a zip file, to import on another device. No effect unless Enable import is on.

20122131>

20132132> > [accordion] More detail

20142133> >

2015> > Transcripts contain conversation content including tool outputs. Treat exported zips as sensitive data.

2134> > The zip contains sessions, projects and their files, memory, scheduled tasks, saved skills, uploaded plugins, some app preferences, and local MCP servers. Passwords or API keys in them are included. Sign-ins and the servers’ variable values are not. Treat it as sensitive data.

20162135>

20172136> **bannerBehavior** `enum`

20182137>

from line 2959

28402959>

28412960> The product-usage analytics come from the app and from Claude Code. Turning this on also stops Claude Code's error reports and its other nonessential requests to Anthropic.

28422961>

2843> Applies only while the app runs in third-party mode. If users could otherwise sign in to Claude.ai on the device, also set `disableDeploymentModeChooser` so the app stays in third-party mode.

2962> Applies only while the app runs in third-party mode. If users could otherwise sign in to Claude.ai on the device, also set `deploymentMode` to `3p`, or `disableDeploymentModeChooser`.

28442963

28452964***

28462965

from line 2967

28482967

28492968booleanDefault: falseSince 1.2581.0

28502969

2851**Block nonessential services.** Connector icons, hosted artifact previews, MCP Apps widgets and the Linux spellcheck dictionary. Widgets fall back to text.

2970**Block nonessential services.** Connector icons, hosted artifact previews, MCP Apps widgets and the Linux spellcheck dictionary. A blocked widget shows an error.

28522971

28532972> [accordion] More detail

28542973>

from line 3191

30723191> * **Unset:** after 72 hours the app restarts once the device has been idle for 10 minutes.

30733192> * **Any number, even 72:** the app restarts when the time is up, whether or not the user is active.

30743193>

3075> In both cases the restart waits while Claude is mid-task on the device.

3194> In both cases the restart waits while Claude is mid-task on the device, or while the update server gives no answer.

30763195>

3196> These hours do not delay an update. It usually installs sooner, after 10 minutes with no Claude window in use and no task running.

3197>

30773198> This is an app-behavior key, like `disableAutoUpdates`. If your MDM profile holds nothing but such keys, the app reads them all from that profile alone, so put every one you use there.

30783199

30793200***

from line 3740

36193740

36203741booleanDefault: true

36213742

3622MDM only (You can set the key only in an MDM profile or the local configuration file. Claude Desktop ignores it in a bootstrap server's response.)

3743MDM only (You can set the key only in an MDM profile or the local configuration file. Claude Desktop ignores it in a bootstrap server's response. Where a key's description says MDM profile only, the local configuration file does not count either.)

36233744

36243745Since 1.10628.0

36253746

from line 3754

36333754

36343755string

36353756

3636MDM only (You can set the key only in an MDM profile or the local configuration file. Claude Desktop ignores it in a bootstrap server's response.)

3757MDM only (You can set the key only in an MDM profile or the local configuration file. Claude Desktop ignores it in a bootstrap server's response. Where a key's description says MDM profile only, the local configuration file does not count either.)

36373758

36383759Since 1.10628.0

36393760

from line 3768

36473768

36483769object

36493770

3650MDM only (You can set the key only in an MDM profile or the local configuration file. Claude Desktop ignores it in a bootstrap server's response.)

3771MDM only (You can set the key only in an MDM profile or the local configuration file. Claude Desktop ignores it in a bootstrap server's response. Where a key's description says MDM profile only, the local configuration file does not count either.)

36513772

36523773Since 1.10628.0

36533774

from line 3830

37093830

37103831object: name → value

37113832

3712MDM only (You can set the key only in an MDM profile or the local configuration file. Claude Desktop ignores it in a bootstrap server's response.)

3833MDM only (You can set the key only in an MDM profile or the local configuration file. Claude Desktop ignores it in a bootstrap server's response. Where a key's description says MDM profile only, the local configuration file does not count either.)

37133834

37143835Since 1.32885.1

37153836

from line 3854

37333854

37343855string

37353856

3736MDM only (You can set the key only in an MDM profile or the local configuration file. Claude Desktop ignores it in a bootstrap server's response.)

3857MDM only (You can set the key only in an MDM profile or the local configuration file. Claude Desktop ignores it in a bootstrap server's response. Where a key's description says MDM profile only, the local configuration file does not count either.)

37373858

37383859Since 1.32885.1

37393860

from line 3876

37553876

37563877booleanDefault: false

37573878

3758MDM only (You can set the key only in an MDM profile or the local configuration file. Claude Desktop ignores it in a bootstrap server's response.)

3879MDM only (You can set the key only in an MDM profile or the local configuration file. Claude Desktop ignores it in a bootstrap server's response. Where a key's description says MDM profile only, the local configuration file does not count either.)

37593880

37603881Since 1.26832.0

37613882

from line 3893

37723893The labels under a key start with its type and, where one is recorded, its default, and end with the Claude Desktop version that added the key. Between those, a label appears only where the key differs from most keys.

37733894

37743895* **No MDM only or Admin Console only label**: You can set the key in an MDM profile or the local configuration file, or return it from a bootstrap server.

3775* **MDM only**: You can set the key only in an MDM profile or the local configuration file. Claude Desktop ignores it in a bootstrap server's response. [Read more](https://claude.com/docs/third-party/claude-desktop/bootstrap.md#response-schema).

3896* **MDM only**: You can set the key only in an MDM profile or the local configuration file. Claude Desktop ignores it in a bootstrap server's response. Where a key's description says MDM profile only, the local configuration file does not count either. [Read more](https://claude.com/docs/third-party/claude-desktop/bootstrap.md#response-schema).

37763897* **Admin Console only**: Only the Enterprise Admin Console can set the key. Claude Desktop ignores it in an MDM profile, in the local configuration file and in a bootstrap server's response. [Read more](https://claude.com/docs/third-party/claude-desktop/admin-console.md).

37773898* **Beta**: The feature that the key configures is in beta.

37783899* **Deprecated**: On third-party deployments Claude Desktop no longer reads the key and ignores any value set for it. Remove it from your configuration.

This page’s history 69 edits

5 Nov 2026 +142 −21 · this one
3 Nov 2026 +178 −82
30 Oct 2026 +814 −814
30 Oct 2026 +89 −413
30 Oct 2026 +7 −7
29 Oct 2026 +1 −0

The page’s own history →

Where it came from

The captureclaude-docs
Upstream pageclaude.com

Around it

Every changethe ledger
That day5 Nov 2026