Telemetry and egress changedthird-party/claude-desktop/telemetry
Nearest release: v2.1.281, published an hour before upstream edited the page. Shown because the two are within 24 hours of each other. Nothing here says the release caused the edit.
Upstream edited this page at 23 Sep 2026 18:09 UTC, give or take a minute or two: the time comes from Anthropic’s own sitemap rather than from a commit. This site recorded the change at 28 Sep 2026 22:07 UTC.
Upstream edited
Recorded here
Lines+92added
Lines−92removed
From line
14
where the diff opens
First seen
14 Aug 2026
this site's first read of the page
Recorded edits27to this page, all time
The whole hunk
from line 14, old and new numbered
/
from line 14
1414
1515Crash reports, error stack traces, and performance timings. Contains diagnostic metadata (app version, OS, error type, redacted stack frames) but **never prompt or response content**. Attributed to your organization via `deploymentOrganizationUuid` so Anthropic support can find issues you report.
1616
17| Setting | Default | Effect when `true` |
18| --------------------------- | ------- | ----------------------------------------- |
17| Setting | Default | Effect when `true` |
18| - | - | - |
1919| `disableEssentialTelemetry` | `false` | No crash or error data leaves the device. |
2020
2121On Claude Desktop 2.7032.0 and later, the [**Keep only your organization ID and restrictions on disk**](/docs/third-party/claude-desktop/admin-console#configuration-kept-on-devices) switch in the [Enterprise Admin Console](/docs/third-party/claude-desktop/admin-console) also stops the app's crash and performance reports, even while `disableEssentialTelemetry` is `false`.
from line 28
2828
2929Product-usage analytics: feature adoption, session counts, UI interactions. Used to understand how Claude Desktop is used in aggregate. Contains no prompt or response content. Also gates the **Send** button in Help → Generate Diagnostic Report; with this disabled, diagnostic bundles can only be saved locally.
3030
31| Setting | Default | Effect when `true` |
32| ------------------------------ | ------- | -------------------------------------- |
31| Setting | Default | Effect when `true` |
32| - | - | - |
3333| `disableNonessentialTelemetry` | `false` | No product analytics leave the device. |
3434
3535Leaving this enabled also adds `api.anthropic.com` to the [agent egress allowlist](#required-egress-paths) automatically, so Claude Code can deliver its usage telemetry from inside the sandbox. Allow that host at the perimeter too; it appears in the non-essential telemetry table below.
from line 38
3838
3939Cosmetic third-party fetches: favicons for connectors shown in the UI, the sandboxed iframe that renders interactive artifact previews, and the sandboxed iframes that render [MCP Apps](/docs/connectors/building/mcp-apps/getting-started), the interactive widgets connectors can display. Disabling these degrades the UI (generic icons, static artifact previews, and connector tool results shown as text instead of widgets) but doesn't affect functionality.
4040
41| Setting | Default | Effect when `true` |
42| ----------------------------- | ------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
41| Setting | Default | Effect when `true` |
42| - | - | - |
4343| `disableNonessentialServices` | `false` | Favicon, artifact-preview, and MCP App widget fetches are blocked. Connectors that return MCP Apps show the tool's text result instead of the widget. |
4444
4545### Auto-updates
from line 46
4646
4747Checks Anthropic's update feed and downloads new builds.
4848
49| Setting | Default | Effect when `true` |
50| -------------------- | ------- | ----------------------------------------------------------------------------------------- |
49| Setting | Default | Effect when `true` |
50| - | - | - |
5151| `disableAutoUpdates` | `false` | The app never checks for or downloads updates. Your IT team must redistribute new builds. |
5252
5353## Sending telemetry to your own collector
from line 97
9797
9898To include content in the export, set `otlpContentCapture` to an array of categories:
9999
100| Category | Captures |
101| -------------------- | --------------------------------------------------------------- |
102| `userPrompts` | User message text and conversation titles |
103| `assistantResponses` | Model response text |
104| `toolDetails` | Tool input arguments (for example, the web-search query string) |
105| `toolContent` | Tool output content |
106| `rawApiBodies` | Full inference request and response bodies |
100| Category | Captures |
101| - | - |
102| `userPrompts` | User message text and conversation titles |
103| `assistantResponses` | Model response text |
104| `toolDetails` | Tool input arguments (for example, the web-search query string) |
105| `toolContent` | Tool output content |
106| `rawApiBodies` | Full inference request and response bodies |
107107
108108On Claude Desktop version 1.17377 or later, enabling `userPrompts` also captures model responses, even if `assistantResponses` is not listed. On those versions, no `otlpContentCapture` configuration captures user prompts without model responses.
109109
from line 143
143143
144144### Always required
145145
146| Host | Purpose |
147| --------------------- | ----------------------------------------------------------------------------- |
148| `downloads.claude.ai` | VM workspace bundle and Claude CLI binary, fetched at session start |
146| Host | Purpose |
147| - | - |
148| `downloads.claude.ai` | VM workspace bundle and Claude CLI binary, fetched at session start |
149149| `downloads.claude.ai` | Claude Code model catalog (signed picker metadata), polled every 5–15 minutes |
150150
151151Without this host reachable, Chat conversations, Cowork tasks, and Code sessions cannot start on a device that has not yet downloaded these components. App updates often change one or both of these components, and the app then downloads the new versions from the same host. Devices installed with the [offline installer variant](/docs/third-party/claude-desktop/installation#offline-installation), which includes both components in the installer package, are not affected. The model catalog fetch is not needed to run the app: set [`modelCatalogEnabled`](/docs/third-party/claude-desktop/configuration#modelcatalogenabled) to `false` to turn it off, or [`modelCatalogUrl`](/docs/third-party/claude-desktop/configuration#modelcatalogurl) to fetch the catalog from a mirror inside your network. While the catalog is unreachable, sessions still start and the model picker keeps the names and effort options the app last fetched or shipped with.
from line 156
156156
157157<Tabs>
158158 <Tab title="Google Cloud's Agent Platform">
159 | Host | Purpose |
160 | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
159 | Host | Purpose |
160 | - | - |
161161 | `<region>-aiplatform.googleapis.com` | Model inference for single regions. The `global` region uses `aiplatform.googleapis.com`, and the `eu` / `us` multi-regions use `aiplatform.eu.rep.googleapis.com` / `aiplatform.us.rep.googleapis.com`. Replaced by the host of `inferenceVertexBaseUrl` if set. |
162 | `oauth2.googleapis.com` | Google auth token exchange |
163 | `sts.googleapis.com` | Google auth token exchange |
164 | `accounts.google.com` | Google auth token exchange |
165 | `iamcredentials.googleapis.com` | Google auth token exchange |
162 | `oauth2.googleapis.com` | Google auth token exchange |
163 | `sts.googleapis.com` | Google auth token exchange |
164 | `accounts.google.com` | Google auth token exchange |
165 | `iamcredentials.googleapis.com` | Google auth token exchange |
166166 </Tab>
167167
168168 <Tab title="Amazon Bedrock">
169 | Host | Purpose |
170 | -------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
171 | `bedrock-runtime.<region>.amazonaws.com` | Model inference. Replaced by the host of `inferenceBedrockBaseUrl` if set. |
172 | `bedrock.<region>.amazonaws.com` | Control plane (model discovery) |
173 | `sts.amazonaws.com`, `sts.<region>.amazonaws.com` | STS token exchange (profile auth only) |
169 | Host | Purpose |
170 | - | - |
171 | `bedrock-runtime.<region>.amazonaws.com` | Model inference. Replaced by the host of `inferenceBedrockBaseUrl` if set. |
172 | `bedrock.<region>.amazonaws.com` | Control plane (model discovery) |
173 | `sts.amazonaws.com`, `sts.<region>.amazonaws.com` | STS token exchange (profile auth only) |
174174 | `portal.sso.<sso-region>.amazonaws.com`, `oidc.<sso-region>.amazonaws.com` | IAM Identity Center sign-in and token refresh, for [in-app AWS sign-in](/docs/third-party/claude-desktop/bedrock#in-app-aws-sign-in) and for named profiles that use IAM Identity Center. `<sso-region>` is `inferenceBedrockSsoRegion` (or the profile's `sso_region`) and can differ from the inference region. |
175175
176176 With `inferenceBedrockBearerToken` set, the runtime and control-plane hosts are required.
from line 179
179179 </Tab>
180180
181181 <Tab title="Amazon Bedrock Mantle">
182 | Host | Purpose |
183 | --------------------------------- | -------------------------------------------------------------------------- |
182 | Host | Purpose |
183 | - | - |
184184 | `bedrock-mantle.<region>.api.aws` | Model inference. Replaced by the host of `inferenceBedrockBaseUrl` if set. |
185185 </Tab>
186186
187187 <Tab title="Microsoft Foundry">
188 | Host | Purpose |
189 | ---------------------------------- | -------------------------------------------------------------------------- |
188 | Host | Purpose |
189 | - | - |
190190 | `<resource>.services.ai.azure.com` | Model inference. Replaced by the host of `inferenceFoundryBaseUrl` if set. |
191 | `login.microsoftonline.com` | Entra ID auth (interactive sign-in only) |
191 | `login.microsoftonline.com` | Entra ID auth (interactive sign-in only) |
192192 </Tab>
193193
194194 <Tab title="Gateway">
195 | Host | Purpose |
196 | --------------------------------- | --------------- |
195 | Host | Purpose |
196 | - | - |
197197 | Host of `inferenceGatewayBaseUrl` | Model inference |
198198 </Tab>
199199
200200 <Tab title="Claude API">
201 | Host | Purpose |
202 | --------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ |
203 | `api.anthropic.com` | Model inference; token exchange and API-key creation during browser sign-in |
201 | Host | Purpose |
202 | - | - |
203 | `api.anthropic.com` | Model inference; token exchange and API-key creation during browser sign-in |
204204 | `platform.claude.com` | Browser sign-in page. Dialed only when no static key or credential helper is configured; the in-app Egress list includes it for every Claude API deployment. |
205205 </Tab>
206206</Tabs>
from line 207
207207
208208### Auto-updates (`disableAutoUpdates: false`)
209209
210| Host | Purpose |
211| --------------------- | ------------------------------------------------------------------ |
212| `claude.ai` | Update feed |
213| `api.anthropic.com` | Update feed (releases.claude.com when updateViaUpdatesHost is set) |
214| `downloads.claude.ai` | Update binaries |
210| Host | Purpose |
211| - | - |
212| `claude.ai` | Update feed |
213| `api.anthropic.com` | Update feed (releases.claude.com when updateViaUpdatesHost is set) |
214| `downloads.claude.ai` | Update binaries |
215215
216216With [`updateViaUpdatesHost`](/docs/third-party/claude-desktop/configuration#updateviaupdateshost) set to `true`, the app reads the update feed from `releases.claude.com` instead of `claude.ai` and `api.anthropic.com`, so those two hosts are no longer needed for updates. Update binaries still come from `downloads.claude.ai`.
217217
218218### Essential telemetry (`disableEssentialTelemetry: false`)
219219
220| Host | Purpose |
221| ---------------------------------- | ------------------------- |
222| `*.sentry.io` | Crash and error reporting |
223| `*.ingest.us.sentry.io` | Crash and error reporting |
224| `sentry.io` | Crash and error reporting |
225| `claude.ai` | Performance timing |
226| `browser-intake-datadoghq.com` | Performance timing |
227| `browser-intake-us3-datadoghq.com` | Performance timing |
228| `browser-intake-us5-datadoghq.com` | Performance timing |
229| `browser-intake-ap1-datadoghq.com` | Performance timing |
230| `browser-intake-ap2-datadoghq.com` | Performance timing |
231| `browser-intake-datadoghq.eu` | Performance timing |
232| `browser-intake-ddog-gov.com` | Performance timing |
220| Host | Purpose |
221| - | - |
222| `*.sentry.io` | Crash and error reporting |
223| `*.ingest.us.sentry.io` | Crash and error reporting |
224| `sentry.io` | Crash and error reporting |
225| `claude.ai` | Performance timing |
226| `browser-intake-datadoghq.com` | Performance timing |
227| `browser-intake-us3-datadoghq.com` | Performance timing |
228| `browser-intake-us5-datadoghq.com` | Performance timing |
229| `browser-intake-ap1-datadoghq.com` | Performance timing |
230| `browser-intake-ap2-datadoghq.com` | Performance timing |
231| `browser-intake-datadoghq.eu` | Performance timing |
232| `browser-intake-ddog-gov.com` | Performance timing |
233233
234234The `sentry.io` apex is listed alongside the wildcards because some firewalls don't match it under `*.sentry.io`, and `*.ingest.us.sentry.io` is listed separately for firewalls that match wildcards one label deep.
235235
236236### Non-essential telemetry (`disableNonessentialTelemetry: false`)
237237
238| Host | Purpose |
239| --------------------- | --------------------------------------------------------------- |
240| `a-cdn.anthropic.com` | Analytics SDK |
241| `a-api.anthropic.com` | Analytics events |
242| `claude.ai` | Analytics events |
243| `api.anthropic.com` | Claude Code usage telemetry, sent from inside the agent sandbox |
238| Host | Purpose |
239| - | - |
240| `a-cdn.anthropic.com` | Analytics SDK |
241| `a-api.anthropic.com` | Analytics events |
242| `claude.ai` | Analytics events |
243| `api.anthropic.com` | Claude Code usage telemetry, sent from inside the agent sandbox |
244244
245245### Non-essential services (`disableNonessentialServices: false`)
246246
247| Host | Purpose |
248| --------------------------- | -------------------------------------- |
249| `www.google.com` | Connector favicons |
250| `*.gstatic.com` | Connector favicons |
251| `www.claudeusercontent.com` | Artifact preview iframe |
252| `cdnjs.cloudflare.com` | Artifact preview asset CDNs |
253| `fonts.googleapis.com` | Artifact preview asset CDNs |
254| `cdn.jsdelivr.net` | Artifact preview asset CDNs |
255| `*.claudemcpcontent.com` | MCP App widget iframe |
256| `assets.claude.ai` | Fonts loaded by MCP App widget iframes |
247| Host | Purpose |
248| - | - |
249| `www.google.com` | Connector favicons |
250| `*.gstatic.com` | Connector favicons |
251| `www.claudeusercontent.com` | Artifact preview iframe |
252| `cdnjs.cloudflare.com` | Artifact preview asset CDNs |
253| `fonts.googleapis.com` | Artifact preview asset CDNs |
254| `cdn.jsdelivr.net` | Artifact preview asset CDNs |
255| `*.claudemcpcontent.com` | MCP App widget iframe |
256| `assets.claude.ai` | Fonts loaded by MCP App widget iframes |
257257
258258`*.claudemcpcontent.com` serves [MCP Apps](/docs/connectors/building/mcp-apps/getting-started), the interactive widgets connectors can render. Each widget loads in a sandboxed iframe on its own generated subdomain, so allowlist the wildcard.
259259
260260### Optional features
261261
262| Host | Required when |
263| ----------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
264| Host of `otlpEndpoint` | OpenTelemetry export is configured |
265| `github.com`, `objects.githubusercontent.com`, `pypi.org`, `files.pythonhosted.org` | Python-based desktop extensions are enabled |
266| Hosts of each entry in `managedMcpServers` (server URL, plus `oauth.authorizationServer` and `login.microsoftonline.com` if configured) | Managed MCP servers are configured |
267| Search provider host of a built-in `websearch` server (`api.search.brave.com`, `api.tavily.com`, `api.exa.ai`, or the host of your `customUrl`) | [Built-in web search](/docs/third-party/claude-desktop/web-tools#built-in-web-search) is configured |
268| Hosts in `coworkEgressAllowedHosts` | Sandbox web access is configured |
269| `api.anthropic.com` | [Code](/docs/third-party/claude-desktop/code) sessions can use Web Fetch and [`skipWebFetchPreflight`](/docs/third-party/claude-desktop/configuration#skipwebfetchpreflight) is not `true` (Claude Code's Web Fetch [domain check](/docs/third-party/claude-desktop/web-tools#web-fetch)) |
270| `claude.ai`, `api.anthropic.com`, `storage.googleapis.com` | [Import from claude.ai](/docs/third-party/claude-desktop/import) is enabled (`claudeAiImport` with `enabled` set to `true`). Used only while a user signs in to claude.ai and fetches an export in the import wizard; importing a downloaded export file needs none of them |
271| `releases.claude.com` | The [built-in browser](/docs/third-party/claude-desktop/browser) is turned on (`builtinBrowserEnabled` set to `true`), for its [site safety check](/docs/third-party/claude-desktop/browser#site-safety-check) |
272| `downloads.claude.ai` | [SSH remote sessions](/docs/third-party/claude-desktop/ssh-remote-sessions) are enabled (`sshHostAllowlist` set). With the offline installer, needed only for connections to hosts other than Linux x64 and arm64, because that installer bundles the remote components for those hosts (see [Host requirements](/docs/third-party/claude-desktop/ssh-remote-sessions#host-requirements)) |
262| Host | Required when |
263| - | - |
264| Host of `otlpEndpoint` | OpenTelemetry export is configured |
265| `github.com`, `objects.githubusercontent.com`, `pypi.org`, `files.pythonhosted.org` | Python-based desktop extensions are enabled |
266| Hosts of each entry in `managedMcpServers` (server URL, plus `oauth.authorizationServer` and `login.microsoftonline.com` if configured) | Managed MCP servers are configured |
267| Search provider host of a built-in `websearch` server (`api.search.brave.com`, `api.tavily.com`, `api.exa.ai`, or the host of your `customUrl`) | [Built-in web search](/docs/third-party/claude-desktop/web-tools#built-in-web-search) is configured |
268| Hosts in `coworkEgressAllowedHosts` | Sandbox web access is configured |
269| `api.anthropic.com` | [Code](/docs/third-party/claude-desktop/code) sessions can use Web Fetch and [`skipWebFetchPreflight`](/docs/third-party/claude-desktop/configuration#skipwebfetchpreflight) is not `true` (Claude Code's Web Fetch [domain check](/docs/third-party/claude-desktop/web-tools#web-fetch)) |
270| `claude.ai`, `api.anthropic.com`, `storage.googleapis.com` | [Import from claude.ai](/docs/third-party/claude-desktop/import) is enabled (`claudeAiImport` with `enabled` set to `true`). Used only while a user signs in to claude.ai and fetches an export in the import wizard; importing a downloaded export file needs none of them |
271| `releases.claude.com` | The [built-in browser](/docs/third-party/claude-desktop/browser) is turned on (`builtinBrowserEnabled` set to `true`), for its [site safety check](/docs/third-party/claude-desktop/browser#site-safety-check) |
272| `downloads.claude.ai` | [SSH remote sessions](/docs/third-party/claude-desktop/ssh-remote-sessions) are enabled (`sshHostAllowlist` set). With the offline installer, needed only for connections to hosts other than Linux x64 and arm64, because that installer bundles the remote components for those hosts (see [Host requirements](/docs/third-party/claude-desktop/ssh-remote-sessions#host-requirements)) |
273273
274274## Disabling all Anthropic-bound connections
275275
276276Each connection in the following table has a managed-configuration key that turns it off.
277277
278| Connection | What it carries | Key that turns it off |
279| --------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
280| Crash, error, and performance reporting | Diagnostic metadata, never prompt or response content. See [Essential telemetry](#essential-telemetry). | [`disableEssentialTelemetry`](/docs/third-party/claude-desktop/configuration#disableessentialtelemetry) set to `true` |
281| Product analytics and diagnostic-report uploads | Feature adoption, session counts, and UI interactions, plus Claude Code usage telemetry. No prompt or response content. See [Non-essential telemetry](#non-essential-telemetry). | [`disableNonessentialTelemetry`](/docs/third-party/claude-desktop/configuration#disablenonessentialtelemetry) set to `true` |
282| Connector favicons, artifact previews, and MCP App widgets | Icon fetches, and the sandboxed iframe pages that render previews and widgets. See [Non-essential services](#non-essential-services). | [`disableNonessentialServices`](/docs/third-party/claude-desktop/configuration#disablenonessentialservices) set to `true` |
283| Auto-updates | Requests to Anthropic's update feed, and downloads of new builds. See [Auto-updates](#auto-updates). | [`disableAutoUpdates`](/docs/third-party/claude-desktop/configuration#disableautoupdates) set to `true` |
284| Model catalog | The signed model catalog that labels the model picker, fetched from `downloads.claude.ai` at launch and then every 5 to 15 minutes, including on devices installed with the offline installer. A blocked catalog request affects nothing else. | [`modelCatalogEnabled`](/docs/third-party/claude-desktop/configuration#modelcatalogenabled) set to `false`, or [`modelCatalogUrl`](/docs/third-party/claude-desktop/configuration#modelcatalogurl) set to a mirror inside your network |
285| Web Fetch domain check in [Code](/docs/third-party/claude-desktop/code) sessions | The hostname of each page Claude Code fetches, sent to `api.anthropic.com` before the fetch. See [Web Fetch](/docs/third-party/claude-desktop/web-tools#web-fetch). | [`skipWebFetchPreflight`](/docs/third-party/claude-desktop/configuration#skipwebfetchpreflight) set to `true`, or `WebFetch` added to [`disabledBuiltinTools`](/docs/third-party/claude-desktop/configuration#disabledbuiltintools) |
278| Connection | What it carries | Key that turns it off |
279| - | - | - |
280| Crash, error, and performance reporting | Diagnostic metadata, never prompt or response content. See [Essential telemetry](#essential-telemetry). | [`disableEssentialTelemetry`](/docs/third-party/claude-desktop/configuration#disableessentialtelemetry) set to `true` |
281| Product analytics and diagnostic-report uploads | Feature adoption, session counts, and UI interactions, plus Claude Code usage telemetry. No prompt or response content. See [Non-essential telemetry](#non-essential-telemetry). | [`disableNonessentialTelemetry`](/docs/third-party/claude-desktop/configuration#disablenonessentialtelemetry) set to `true` |
282| Connector favicons, artifact previews, and MCP App widgets | Icon fetches, and the sandboxed iframe pages that render previews and widgets. See [Non-essential services](#non-essential-services). | [`disableNonessentialServices`](/docs/third-party/claude-desktop/configuration#disablenonessentialservices) set to `true` |
283| Auto-updates | Requests to Anthropic's update feed, and downloads of new builds. See [Auto-updates](#auto-updates). | [`disableAutoUpdates`](/docs/third-party/claude-desktop/configuration#disableautoupdates) set to `true` |
284| Model catalog | The signed model catalog that labels the model picker, fetched from `downloads.claude.ai` at launch and then every 5 to 15 minutes, including on devices installed with the offline installer. A blocked catalog request affects nothing else. | [`modelCatalogEnabled`](/docs/third-party/claude-desktop/configuration#modelcatalogenabled) set to `false`, or [`modelCatalogUrl`](/docs/third-party/claude-desktop/configuration#modelcatalogurl) set to a mirror inside your network |
285| Web Fetch domain check in [Code](/docs/third-party/claude-desktop/code) sessions | The hostname of each page Claude Code fetches, sent to `api.anthropic.com` before the fetch. See [Web Fetch](/docs/third-party/claude-desktop/web-tools#web-fetch). | [`skipWebFetchPreflight`](/docs/third-party/claude-desktop/configuration#skipwebfetchpreflight) set to `true`, or `WebFetch` added to [`disabledBuiltinTools`](/docs/third-party/claude-desktop/configuration#disabledbuiltintools) |
286286
287287With all six connections turned off, the only remaining Anthropic-operated egress is `downloads.claude.ai`, for the VM workspace bundle and Claude CLI binary at session start. The only other required egress is your inference provider. With the [offline installer variant](/docs/third-party/claude-desktop/installation#offline-installation), `downloads.claude.ai` is not needed either, and your inference provider is the only required egress.
288288
No line in this hunk matches that.