What
A new managed setting that blocks --plugin-dir, --plugin-url, --agents, and non-SDK --mcp-config CLI flags at startup, closing the CLI-flag bypass of strictKnownMarketplaces.
Details
- Only honored when set in managed settings (policy-controlled). Ignored in user, project, or local settings.
- When a blocked flag is used, Claude Code exits with: "X is disabled by your organization's managed settings (disableSideloadFlags). Plugins, custom agents, and MCP servers can only be loaded from sources your administrator has approved."
- Pair with
allowedMcpServersfor per-server MCP control; this setting does not gate other MCP entry points such asclaude mcp add, SDKsetMcpServers, or.mcp.json. - Does not block MCP servers configured through approved marketplace sources.
Evidence
New setting description (search for "disableSideloadFlags" or "rejects the --plugin-dir, --plugin-url, --agents")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.