Deploy managed settings changedmanaged-settings
Nearest release: v2.1.267, published 2 hours before this site recorded the change. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Recorded here
Lines+5added
Lines−0removed
From line
314
where the diff opens
First seen
21 Aug 2026
this site's first read of the page
Recorded edits59to this page, all time
The whole hunk
from line 314, old and new numbered
/
from line 314
314314| Field | Behavior when present but invalid |
315315| :---------------------------- | :----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
316316| `allowedMcpServers` | Enforced as an empty allowlist until the value is fixed, so no MCP servers that users add are admitted. Servers your organization delivers through [`managedMcpServers`](/docs/en/settings-reference#managedmcpservers) still load, and `managed-mcp.json` servers load per [How a server is evaluated](/docs/en/managed-mcp#how-a-server-is-evaluated). An individual invalid entry is stripped and the valid subset is enforced. |
317| `allowedHttpHookUrls` | Claude Code enforces an empty [allowlist](/docs/en/settings-reference#allowedhttphookurls) until you fix the value. If only an individual entry is invalid, it strips that entry and enforces the rest. |
318| `httpHookAllowedEnvVars` | Claude Code enforces an empty [allowlist](/docs/en/settings-reference#httphookallowedenvvars) until you fix the value. If only an individual entry is invalid, it strips that entry and enforces the rest. |
319| `allowedChannelPlugins` | Claude Code enforces an empty allowlist until you fix the value, so no channel plugin passed to `--channels` is admitted. If only an individual entry is invalid, it strips that entry and enforces the rest. |
317320| `allowManagedHooksOnly` | Treated as `true` until fixed: the [hook restrictions](/docs/en/settings-reference#allowmanagedhooksonly) apply and, unless `disableCommandPluginSources` is explicitly `false`, command-sourced plugins are disabled. |
318321| `allowManagedMcpServersOnly` | Treated as `true`. |
319322| `disableCommandPluginSources` | Treated as `true`, so command-sourced plugins stay disabled until the value is fixed. |
from line 326
323326| `crossSessionInbound` | Treated as `refuse`, the most restrictive value, so inbound [cross-session messages](/docs/en/cross-session-messaging#control-inbound-messages) are refused until the value is fixed. The developer sees [a warning](/docs/en/errors#crosssessioninbound-must-be-one-of-accept-hold-refuse). |
324327| `deniedMcpServers` | An individual invalid entry is stripped and the valid subset is enforced. A wholly invalid value is dropped with a warning, since denying every server would block servers the policy never named. |
325328| `sandbox.credentials` | A recoverable invalid entry is degraded to `mode: "deny"` with a warning; an unrecoverable one is stripped; valid entries stay enforced. See [invalid credential entries](/docs/en/settings-reference#invalid-credential-entries-in-managed-settings) |
329
330Before v2.1.267, Claude Code dropped `allowedHttpHookUrls`, `httpHookAllowedEnvVars`, or `allowedChannelPlugins` whole when the value or any one entry was invalid, and behaved as if the key weren't set.
326331
327332`requiredMinimumVersion` and `requiredMaximumVersion` fail open by design: an invalid value is dropped rather than enforced.
328333
No line in this hunk matches that.