{"name":"allow_cidrs","slug":"allow-cidrs","family":"setting","title":"Settings keys","noun":"settings key","description":"Self-hosted gateway now warns once if a client connects from a public IP with no allowlist set","description_source":"entry","described_by":{"version":"2.1.268","anchor":"gateway-warns-once-when-a-client-connects-from-a-non-private"},"presence":{"first_seen":"2.1.287","removed_in":"2.1.307","in_current_build":false,"newest_mined":"2.1.308","builds":15,"mined_builds":149,"first_cited":{"version":"2.1.268","released_at":"2026-09-10 18:41:11","spans":1}},"aliases":[],"entries":[{"version":"2.1.268","anchor":"gateway-warns-once-when-a-client-connects-from-a-non-private","heading":"Gateway warns once when a client connects from a non-private IP with no allowlist configured","line":"Self-hosted gateway now warns once if a client connects from a public IP with no allowlist set","released_at":"2026-09-10 18:41:11","reason":"found in this entry's text"},{"version":"2.1.268","anchor":"new-gateway-config-warning-for-empty-access-controlallow-ci","heading":"New gateway config warning for empty access_control.allow_cidrs","line":"The gateway now warns if access_control.allow_cidrs is left empty and any client address can connect","released_at":"2026-09-10 18:41:11","reason":"found in this entry's text"}],"entries_total":2,"docs":[{"source":"claude-code","path":"claude-apps-gateway","title":"Claude apps gateway for Amazon Bedrock, Claude Platform on AWS, Google Cloud, and Microsoft Foundry","documented":false},{"source":"claude-code","path":"claude-apps-gateway-config","title":"Claude apps gateway configuration","documented":false},{"source":"claude-code","path":"claude-apps-gateway-deploy","title":"Claude apps gateway deployment and operations","documented":false}],"docs_total":3,"gates":[],"related":[{"name":"allowAllClaudeAiMcps","slug":"allowallclaudeaimcps","description":"Load the [claude.ai connectors](\/docs\/en\/mcp) Claude Code fetches itself alongside a deployed [`managed-mcp.json`](\/docs\/en\/managed-mcp#exclusive-control-with-managed-mcp-json)"},{"name":"allowAllUnixSockets","slug":"allowallunixsockets","description":"The `allowAllUnixSockets` sandbox setting is now described as also unblocking VM sockets (AF_VSOCK) on Linux"},{"name":"allowClaudeInChromeWithManagedMcp","slug":"allowclaudeinchromewithmanagedmcp","description":"Let the built-in [Claude in Chrome](\/docs\/en\/chrome) server run alongside a deployed [`managed-mcp.json`](\/docs\/en\/managed-mcp#exclusive-control-with-managed-mcp-json)"},{"name":"allowed_email_domains","slug":"allowed-email-domains","description":null},{"name":"allowedChannelPlugins","slug":"allowedchannelplugins","description":"Replace the default allowlist of [channel plugins](\/docs\/en\/channels#restrict-which-channel-plugins-can-run) that can push messages"},{"name":"allowedDomains","slug":"alloweddomains","description":"Set strictAllowlist to have the sandbox flat-out deny hosts outside your allowed domains instead of prompting."},{"name":"allowedEnvVars","slug":"allowedenvvars","description":"A variable whose value looks like a credential is now refused when interpolating into HTTP hook headers."},{"name":"allowedHttpHookUrls","slug":"allowedhttphookurls","description":"Limit which URLs [HTTP hooks](\/docs\/en\/hooks) can target"},{"name":"allowedMarketplaces","slug":"allowedmarketplaces","description":"Managed settings accept `allowedMarketplaces` for the marketplace allowlist; older clients still need the canonical key."},{"name":"allowedMcpServers","slug":"allowedmcpservers","description":"Allowlist which [MCP servers](\/docs\/en\/mcp) users can add"}],"url":"https:\/\/changelogs.core-directive.com\/reference\/setting\/allow-cidrs","family_url":"https:\/\/changelogs.core-directive.com\/reference\/setting.json"}