disableSideloadFlags
A Claude Code settings key, read out of the shipped bundle. It was in the build from v2.1.193 and was gone by v2.1.284.
Reject the CLI flags that sideload plugins, subagents, and MCP servers
Anthropic's own wording. Read off All settings, captured 2026-10-22.
In the changelogs
8Releases whose published page names disableSideloadFlags.
-
v2.1.301
Programs driving Claude Code can add plugins during a session
Programs built on the SDK can now load more plugins into a running session through the plugin reload request, without a restart
found in this entry's text
-
v2.1.282
Invalid managed settings now fall back to their strict value in one consistent way
Bad values in managed settings now fall back to the strict choice by one shared rule, and one bad
enabledPluginsentry no longer voids the restfound in this entry's text
-
v2.1.281
Self-hosted runner: clearer failure messages when a session process cannot start
Self-hosted runners now explain why a session failed to start, including launches blocked by
disableSideloadFlagsfound in this entry's text
-
v2.1.281
Sideload-flag error text factored into a constant
The
disableSideloadFlagserror message is now built from a shared constant; its wording is unchangedfound in this entry's text, named in this entry
-
v2.1.277
New disableSideloadFlags settings key hardened against malformed values
A malformed disableSideloadFlags setting now blocks sideload flags by default instead of being ignored
found in this entry's text, named in this entry
-
v2.1.239
Administrators can forbid server-delivered MCP servers with
disableSideloadFlagsAdmins can set disableSideloadFlags to block --mcp-config and refuse MCP servers pushed in from outside your config.
named in this entry, found in this entry's text
-
v2.1.239
More specific explanations when an --mcp-config is ignored
Skipped --mcp-config servers now name managed settings or a Remote Control child as the reason.
found in this entry's text
-
v2.1.193
disableSideloadFlagsEnterprise Settingfound in this entry's text
First cited
7The earliest release whose published evidence quoted disableSideloadFlags was v2.1.193, 25 Jun 2026. That is the oldest release this project wrote about it, so it is a floor on the name's age and not the release that introduced it. It is not a presence reading: which builds carried the name is the table below.
1 further span in the ledger name it. The list above is the earliest first and stops at 6.
Presence across releases
2Build by build
103One row per release since the first build this name was read out of. Absent means the build was read and the name was not in it, never mined means no bundle for that release was ever archived, and a declared type or a default is only ever what that release's own bundle stated.
Read out of the published npm bundle release by release, and out of Anthropic's own documentation as this site captured it. Nothing on this page is a description anybody here wrote about what the settings key does. All settings keys.