A malformed disableSideloadFlags setting now blocks sideload flags by default instead of being ignored
disableSideloadFlags is a managed setting that blocks CLI flags used to sideload extra content, such as --plugin-dir/--plugin-url, and MCP configuration loaded from outside approved sources. If this setting is present in configuration but its value doesn't parse correctly, Claude Code now treats it as true (blocking those flags) rather than falling back to a default that might allow them.
This makes a broken disableSideloadFlags value fail closed: a configuration mistake results in sideloading being blocked until it's fixed, not silently permitted.
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
| `disableSideloadFlags` | Treated as `true` until the value is fixed, with the effects listed for [`disableSideloadFlags`](/docs/en/settings-reference#disablesideloadflags). |managed-settings see the edit
Anthropic's documentation has since written up disableSideloadFlags, on Deploy managed settings.
Fixed plugin reload previews keeping every previewed copy of a plugin archive unpacked until exit, and overwriting the cached --plugin-url…