disableCommandPluginSources
A Claude Code settings key, read out of the shipped bundle. It was in the build from v2.1.229 and was gone by v2.1.284.
Block plugins that install by running a marketplace-declared command
Anthropic's own wording. Read off All settings, captured 2026-10-22.
In the changelogs
8Releases whose published page names disableCommandPluginSources.
-
v2.1.300
Plugin commands wait until your organization's settings are read
Plugin command sources and marketplace
headersHelpercommands no longer run in a tool server and wait until organization settings have loadedfound in this entry's text
-
v2.1.300
Cowork cloud keeps strict managed policy settings once they are set
In Cowork cloud, once certain managed policy settings are tightened, a later settings update can no longer loosen them
found in this entry's text
-
v2.1.288
Plugins are read again if their settings change while hooks are being set up
If settings that affect plugins change while Claude Code is loading them, it now reads the plugins again before choosing which hooks to run
found in this entry's text, named in this entry
-
v2.1.238
Managed settings can refuse plugin sources and marketplace updates
Admins can block plugins and marketplaces from unlisted sources, with refusals naming the policy.
named in this entry, found in this entry's text
-
v2.1.238
Plugin marketplaces and archives can mint HTTP headers from a command
Marketplaces and plugins can run a command to mint short-lived HTTP headers for fetching archives.
named in this entry, found in this entry's text
-
v2.1.229
Managed setting to block command-sourced plugins
A managed key blocks command-sourced plugins, falling back to your existing hook restriction.
named in this entry, found in this entry's text
-
v2.1.229
Marketplaces can ship a plugin built by running a local command
Marketplace plugins can be built by a local command, with a timeout and optional link mode.
named in this entry, found in this entry's text
-
v2.1.229
Plugins can be installed from a command that produces the plugin directory
Marketplaces can declare command plugin sources, and admins can block them with one setting.
named in this entry, found in this entry's text
First cited
2The earliest release whose published evidence quoted disableCommandPluginSources was v2.1.229, 12 Aug 2026. That is the oldest release this project wrote about it, so it is a floor on the name's age and not the release that introduced it. It is not a presence reading: which builds carried the name is the table below.
Presence across releases
2Build by build
68One row per release since the first build this name was read out of. Absent means the build was read and the name was not in it, never mined means no bundle for that release was ever archived, and a declared type or a default is only ever what that release's own bundle stated.
Read out of the published npm bundle release by release, and out of Anthropic's own documentation as this site captured it. Nothing on this page is a description anybody here wrote about what the settings key does. All settings keys.