deniedMcpServers
A Claude Code settings key, read out of the shipped bundle. It was in the build from v2.1.138 and was gone by v2.1.284.
Block specific MCP servers by URL, command, or name
Anthropic's own wording. Read off All settings, captured 2026-10-22.
In the changelogs
15Releases whose published page names deniedMcpServers.
-
v2.1.304
Denying remote-devices now withdraws MCP servers from running cloud sessions
Adding
remote-devicestodeniedMcpServersnow stops this machine offering MCP servers to cloud sessions already runningfound in this entry's text, named in this entry
-
v2.1.304
Claude Code remembers "not now" for sharing your MCP servers with cloud sessions
Choosing "not now" when asked to share this computer's MCP servers with cloud sessions is saved, so the same servers are not offered again
found in this entry's text
-
v2.1.301
MCP server filtering now explains which servers it kept and how to remove them
When MCP servers are filtered by policy, Claude Code now notes the ones it kept and says
deniedMcpServersin managed settings removes themfound in this entry's text
-
v2.1.285
Claude in Chrome can come from the remote session host instead of the built-in server
If the remote host supplies Claude in Chrome through
--mcp-config, Claude Code uses that and does not start its own Chrome serverfound in this entry's text
-
v2.1.283
Models denied in the catch-all managed policy now apply to every policy
deniedModelsin the catch-allmanaged.policiesentry is now combined with each specific policy's list instead of being replaced by itfound in this entry's text
-
v2.1.282
Admins can allow Claude in Chrome alongside a managed MCP configuration
A new device policy setting,
allowClaudeInChromeWithManagedMcp, lets Claude in Chrome run even whenmanaged-mcp.jsoncontrols MCP serversfound in this entry's text
-
v2.1.282
Claude in Chrome setup is no longer offered when a managed MCP config blocks it
Claude Code now skips the Claude in Chrome install offer when your organization's managed MCP config would block the Chrome connection
found in this entry's text
-
v2.1.282
Remote Control now says which policy blocks --chrome
When organization policy blocks
--chromein Remote Control, the error now gives the specific reason instead of a fixed messagefound in this entry's text
-
v2.1.273
--chrome flag for Remote Control now blocked by enterprise MCP policy
Remote Control's --chrome flag is now blocked when enterprise MCP policy denies the Chrome MCP server
found in this entry's text
-
v2.1.269
Eval mocks now interact with managed MCP policy (enterprise) explicitly
Eval mocks now explicitly check managed MCP server policy before starting
found in this entry's text
-
v2.1.257
MCP server env-var scrubbing for allow/deny display now covers a fallback env too
Env-var masking in allow and deny server displays now also covers a fallback env source.
found in this entry's text
-
v2.1.248
MCP server allow and deny lists get settings keys
You can allow or block specific MCP servers with allowedMcpServers and deniedMcpServers settings.
named in this entry, found in this entry's text
-
v2.1.242
Eval runs fail loudly when managed policy blocks the mock servers
Eval runs stop with a clear policy error when your org's MCP rules block the mock servers.
named in this entry, found in this entry's text
-
v2.1.219
MCP policy allow/deny entries now expand
${VAR}environment references, and unsafe URL expansions fail closedMCP allow and deny policy entries now expand ${VAR} references, skipping allowlist entries whose expansion looks unsafe.
named in this entry, found in this entry's text
-
v2.1.219
MCP allow/deny rules compare expanded env-var values
Your MCP allow and deny rules now match servers whose commands or URLs use environment variables.
named in this entry, found in this entry's text
First cited
4The earliest release whose published evidence quoted deniedMcpServers was v2.1.260, 3 Sep 2026. That is the oldest release this project wrote about it, so it is a floor on the name's age and not the release that introduced it. It is not a presence reading: which builds carried the name is the table below.
Presence across releases
2Build by build
149One row per release since the first build this name was read out of. Absent means the build was read and the name was not in it, never mined means no bundle for that release was ever archived, and a declared type or a default is only ever what that release's own bundle stated.
Read out of the published npm bundle release by release, and out of Anthropic's own documentation as this site captured it. Nothing on this page is a description anybody here wrote about what the settings key does. All settings keys.