allowedMcpServers
A Claude Code settings key, read out of the shipped bundle. It was in the build from v2.1.138 and was gone by v2.1.284.
Allowlist which MCP servers users can add
Anthropic's own wording. Read off All settings, captured 2026-10-22.
In the changelogs
27Releases whose published page names allowedMcpServers.
-
v2.1.305
allowedMcpServersdescription narrows which managed entries are exemptThe
allowedMcpServerssetting now says managed-mcp.json entries are exempt unless ${VAR} appears in their command, args, url or header valuesfound in this entry's text, named in this entry
-
v2.1.288
Sensitive settings from the launch folder can now be dropped before they apply
Unless a launch-folder policy allows them, settings such as enabledPlugins and modelOverrides from the launch folder are now removed
found in this entry's text
-
v2.1.285
Managed settings docs: allowedProviders is replaced, not merged
The settings description now says allowedProviders, like the other restriction allowlists, is taken whole from the helper and not merged
found in this entry's text, named in this entry
-
v2.1.282
An empty
strictKnownMarketplaceslist now counts as a restrictionSetting
strictKnownMarketplacesto an empty list is now treated as a restriction in force, like other managed allowlistsfound in this entry's text
-
v2.1.282
Marketplace restrictions now carry over to Claude Code processes started by another
blockedMarketplacesandstrictKnownMarketplacesfrom managed settings now pass to child Claude Code processesfound in this entry's text
-
v2.1.282
strictKnownMarketplaces is now an admin-only managed setting
strictKnownMarketplaces now joins allowedMcpServers and availableModels as a setting only the admin policy can set, and failed policy loads are tracked
found in this entry's text
-
v2.1.273
Enterprise MCP-server-allowlist policy can now be inherited from lower-priority settings sources
MCP server allowlist policies can now be inherited from lower-priority settings sources, with new diagnostics
found in this entry's text, named in this entry
-
v2.1.273
MCP server allow/deny-list computation refactored into named helpers
Internal code for computing which MCP servers are allowed or blocked was reorganized into separate functions
found in this entry's text
-
v2.1.273
MCP server allowlist can now be sourced from admin tiers even without an explicit slot override
MCP server allowlist can now fall back to an org admin tier's setting when local settings don't override it
found in this entry's text, named in this entry
-
v2.1.269
Fixed a bug in MCP server enumeration that ignored the caller's arguments
Fixed a bug where the list of enabled MCP servers ignored the caller's actual allowlist and managed-server settings
found in this entry's text
-
v2.1.269
Eval mocks now interact with managed MCP policy (enterprise) explicitly
Eval mocks now explicitly check managed MCP server policy before starting
found in this entry's text
-
v2.1.268
CLAUDE_CODE_REMOTE auto-trusts built-in Slack/Teams bot MCP endpoints
Under CLAUDE_CODE_REMOTE, built-in Slack/Teams bot MCP servers now bypass the allowedMcpServers allowlist
found in this entry's text, named in this entry
-
v2.1.267
New "sec-default" hooks module locks plugins out of classic hooks/prompt/settings/tool policy for managed orgs
A new sec-default hooks module blocks plugins from bypassing policy settings and MCP server allowlists on managed and Team/Enterprise accounts
found in this entry's text
-
v2.1.259
MCP allowedMcpServers check bypassed for non-plugin, non-env-expanded project scope
Project-scoped MCP servers that aren't from a plugin or env expansion now skip the allowlist check entirely.
found in this entry's text, named in this entry
-
v2.1.257
MCP server env-var scrubbing for allow/deny display now covers a fallback env too
Env-var masking in allow and deny server displays now also covers a fallback env source.
found in this entry's text
-
v2.1.257
managedSettings 'merge' mode composition rules made explicit and expanded
Managed settings merge mode now documents which fields the helper replaces wholesale rather than merging.
found in this entry's text, named in this entry
-
v2.1.248
MCP server allow and deny lists get settings keys
You can allow or block specific MCP servers with allowedMcpServers and deniedMcpServers settings.
named in this entry, found in this entry's text
-
v2.1.248
MCP errors sent to Remote Control clients are filtered to a fixed list
In bridge mode, unknown MCP errors are collapsed to "connection failed" for remote clients.
found in this entry's text
-
v2.1.242
Eval runs fail loudly when managed policy blocks the mock servers
Eval runs stop with a clear policy error when your org's MCP rules block the mock servers.
named in this entry, found in this entry's text
-
v2.1.242
Managed settings can now merge across sources instead of the top one winning
Admins can set managedSourcesBehavior to merge managed settings sources instead of only the top one.
found in this entry's text
-
v2.1.223
Managed-settings tier merge no longer falls through for two keys
Two admin-managed settings now come only from the top policy tier, so lower tiers can't sneak values in.
named in this entry, found in this entry's text
-
v2.1.221
New MCP policy-predicate telemetry for allowedMcpServers matching
Claude now tracks whether your allowed-MCP-server rules could actually be evaluated.
named in this entry, found in this entry's text
-
v2.1.219
MCP policy allow/deny entries now expand
${VAR}environment references, and unsafe URL expansions fail closedMCP allow and deny policy entries now expand ${VAR} references, skipping allowlist entries whose expansion looks unsafe.
named in this entry, found in this entry's text
-
v2.1.219
MCP allow/deny rules compare expanded env-var values
Your MCP allow and deny rules now match servers whose commands or URLs use environment variables.
named in this entry, found in this entry's text
-
v2.1.193
disableSideloadFlagsEnterprise Settingfound in this entry's text
-
v2.1.166
Managed settings validation errors reported to stderr
found in this entry's text
-
v2.1.85
MCP Server Policy Documentation
found in this entry's text
First cited
5The earliest release whose published evidence quoted allowedMcpServers was v2.1.248, 27 Aug 2026. That is the oldest release this project wrote about it, so it is a floor on the name's age and not the release that introduced it. It is not a presence reading: which builds carried the name is the table below.
Presence across releases
2Build by build
149One row per release since the first build this name was read out of. Absent means the build was read and the name was not in it, never mined means no bundle for that release was ever archived, and a declared type or a default is only ever what that release's own bundle stated.
Read out of the published npm bundle release by release, and out of Anthropic's own documentation as this site captured it. Nothing on this page is a description anybody here wrote about what the settings key does. All settings keys.