strictKnownMarketplaces
A Claude Code settings key, read out of the shipped bundle. It was in the build from v2.1.138 and was gone by v2.1.284.
Allowlist the marketplace sources users can add and install from
Anthropic's own wording. Read off All settings, captured 2026-10-22.
In the changelogs
26Releases whose published page names strictKnownMarketplaces.
-
v2.1.302
Marketplace allowlist values are now normalized before use
Claude Code now tidies
strictKnownMarketplacesvalues from managed settings before using them, and reworded the start of the connection-lost errorfound in this entry's text, named in this entry
-
v2.1.295
Plugin settings summary now includes a separate seat layer
The summary of plugin and marketplace settings now includes a seat section with its own plugin and marketplace values
found in this entry's text, named in this entry
-
v2.1.295
New check on plugin settings loaded from machine-level files
Claude Code now checks plugin-related settings that come from settings files users cannot write to
found in this entry's text
-
v2.1.287
Plugin directory search grows into a full marketplace with admin controls
Claude Code can now load Anthropic's public plugin directory as a marketplace, open it with
/plugin search, and let admins allow or block itfound in this entry's text
-
v2.1.284
Managed-rules lockdown keeps plugin tool permissions only from admin-backed sources
Under
allowManagedPermissionRulesOnly, only plugins from admin-backed sources keep their allowed-tools grants; other plugins' grants are ignoredfound in this entry's text
-
v2.1.282
An empty
strictKnownMarketplaceslist now counts as a restrictionSetting
strictKnownMarketplacesto an empty list is now treated as a restriction in force, like other managed allowlistsfound in this entry's text, named in this entry
-
v2.1.282
Marketplace restrictions now carry over to Claude Code processes started by another
blockedMarketplacesandstrictKnownMarketplacesfrom managed settings now pass to child Claude Code processesfound in this entry's text
-
v2.1.282
strictKnownMarketplaces is now an admin-only managed setting
strictKnownMarketplaces now joins allowedMcpServers and availableModels as a setting only the admin policy can set, and failed policy loads are tracked
found in this entry's text, named in this entry
-
v2.1.282
An empty marketplace allowlist now counts as a plugin policy change
Claude Code now tells an unset strictKnownMarketplaces or blockedMarketplaces apart from an empty one when checking plugin policy
found in this entry's text, named in this entry
-
v2.1.277
New enterprise validation for marketplace-restriction settings
Marketplace allow/block settings are now checked for enforceability, with unsafe entries handled differently by list
found in this entry's text, named in this entry
-
v2.1.277
New client-side settings validation flags dead entries in policy-array settings
Claude Code now flags invalid entries in the strictKnownMarketplaces and blockedMarketplaces settings
found in this entry's text, named in this entry
-
v2.1.277
New settings validation for strictKnownMarketplaces and blockedMarketplaces
Invalid strictKnownMarketplaces or blockedMarketplaces settings now fail safe instead of being silently misapplied
found in this entry's text, named in this entry
-
v2.1.275
npm marketplace/plugin source schema gains registry URL validation and richer docs
npm-based plugin marketplaces now validate registry URLs and support scoped allow/block policies
found in this entry's text
-
v2.1.242
Managed settings can now merge across sources instead of the top one winning
Admins can set managedSourcesBehavior to merge managed settings sources instead of only the top one.
found in this entry's text
-
v2.1.242
Blocked skills-directory plugins say which policy to change
A blocked skills-directory plugin names the two managed policies your admin would need to change.
named in this entry, found in this entry's text
-
v2.1.232
allowedMarketplacesworks as an alias forstrictKnownMarketplacesManaged settings accept
allowedMarketplacesfor the marketplace allowlist; older clients still need the canonical key.named in this entry, found in this entry's text
-
v2.1.232
Two new spellings for the marketplace settings keys
You can now write
additionalMarketplacesandallowedMarketplacesas aliases for the older marketplace settings keys.named in this entry, found in this entry's text
-
v2.1.223
Marketplace policy entries support owner wildcards and GitHub SSH aliases
Marketplace block and allow lists now match repos written differently, and accept owner-wide wildcards.
named in this entry, found in this entry's text
-
v2.1.223
Marketplace policy lists accept an owner wildcard
You can block or allow every repo under one owner with a single
owner/*marketplace entry.named in this entry, found in this entry's text
-
v2.1.223
Marketplace host policy folds ssh.github.com to github.com
Org marketplace rules naming github.com now also match plugins cloned over GitHub's SSH alias host.
named in this entry, found in this entry's text
-
v2.1.193
disableSideloadFlagsEnterprise Settingfound in this entry's text
-
v2.1.140
Strict Known Marketplaces Policy
found in this entry's text
-
v2.1.69
pathPatternfor Marketplace Restrictionsfound in this entry's text
-
v2.1.64
pathPatternfor Marketplace Source Matchingfound in this entry's text
-
v2.1.10
Host Pattern Matching for Enterprise Marketplace Sources
found in this entry's text
-
v2.0.55
Enterprise Marketplace Policy Controls
found in this entry's text
First cited
9The earliest release whose published evidence quoted strictKnownMarketplaces was v2.1.140, 12 May 2026. That is the oldest release this project wrote about it, so it is a floor on the name's age and not the release that introduced it. It is not a presence reading: which builds carried the name is the table below.
3 further spans in the ledger name it. The list above is the earliest first and stops at 6.
Presence across releases
2Build by build
149One row per release since the first build this name was read out of. Absent means the build was read and the name was not in it, never mined means no bundle for that release was ever archived, and a declared type or a default is only ever what that release's own bundle stated.
Read out of the published npm bundle release by release, and out of Anthropic's own documentation as this site captured it. Nothing on this page is a description anybody here wrote about what the settings key does. All settings keys.