What
- Entries in the
strictKnownMarketplacesandblockedMarketplacessettings are now checked for whether they can actually be enforced: regex patterns must compile, GitHub-source entries with an owner wildcard must be written exactly as<owner>/*, wildcard sources are only allowed in GitHub form, and refs can't contain*. - An invalid
strictKnownMarketplacesvalue falls back to an empty allowlist, meaning no marketplaces are admitted until the setting is fixed. An invalidblockedMarketplacesentry is kept rather than dropped (with a warning), since removing it would loosen restrictions instead of tightening them. - On managed-settings tiers, each invalid entry now gets an explicit message: an unenforceable
blockedMarketplacesentry is kept but inert ("it can never match, so it blocks nothing"), while an unenforceablestrictKnownMarketplacesentry is silently stripped. In user, project, or local settings files, an invalid entry in either key is simply inert.
Why This stops administrators from unknowingly relying on marketplace restrictions that look active but can never actually match anything, and makes clear whether a broken rule is being kept for safety or dropped.
Names in the bundlestrictKnownMarketplacesblockedMarketplaces
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Added since
A small documentation edit on Deploy managed settings touched a line naming blockedMarketplaces after this was published.
Wherever the session runs, claude.ai applies the admin console's [`strictKnownMarketplaces`](/docs/en/settings-reference#strictknownmarketplaces) and [`blockedMarketplaces`](/docs/en/settings-reference#blockedmarketplaces) lists itself whe…managed-settings see the edit
Added since
A small documentation edit on Deploy managed settings touched a line naming strictKnownMarketplaces after this was published.
Wherever the session runs, claude.ai applies the admin console's [`strictKnownMarketplaces`](/docs/en/settings-reference#strictknownmarketplaces) and [`blockedMarketplaces`](/docs/en/settings-reference#blockedmarketplaces) lists itself whe…managed-settings see the edit
Confirmed since
Anthropic's documentation has since written up blockedMarketplaces, on Deploy managed settings.
| `blockedMarketplaces` | An individual invalid entry is stripped and the valid subset is enforced. An entry that parses but can never match, such as a `hostPattern` regex that doesn't compile, is kept with a warning. It blocks nothing unt…managed-settings see the edit
Confirmed since
Anthropic's documentation has since written up strictKnownMarketplaces, on Deploy managed settings.
| `strictKnownMarketplaces` | Enforced as an empty allowlist until the value is fixed, so no [marketplace source](/docs/en/plugin-marketplaces#managed-marketplace-restrictions) is admitted. An individual entry that is invalid or can't be e…managed-settings see the edit
Two sources agreeTwo things we can check say the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up strictKnownMarketplaces, on Deploy managed settings.
Anthropic's release notes agree
Fixed one malformed strictKnownMarketplaces or blockedMarketplaces entry silently disabling the whole enterprise marketplace policy