What
Claude Code includes a schema for Cowork 3P settings. A schema is the description of which settings exist and what shape they take. The allowedPluginMarketplaces setting in it now shows a warning when an entry is not pinned to one exact version:
- URL sources need a Manifest SHA-256.
- Other sources need a full 40-character commit SHA in Ref.
The warning reads: "Without one this marketplace is treated as available: it is listed, but this setting installs nothing."
Why
An administrator who expects a marketplace to install plugins automatically is now told when the entry will only list the marketplace instead.
Names in the bundleallowedPluginMarketplaces
Documented inclaude-docs/cowork/changelog
The entry above is what we published on the day. These lines were added later, as Anthropic's own pages caught up, and they sit beside the original rather than replacing it.
Confirmed since
Anthropic's documentation has since written up allowedPluginMarketplaces, on Configuration reference.
When on (default), users can add plugin marketplaces from the plugin browser. Set to `false` to restrict plugins to your organization's marketplaces: the add-marketplace surfaces are hidden, and the app refuses adds that still reach it (de…third-party/claude-desktop/configuration see the edit
One source agreesOne thing we can check says the same as this entry.
Anthropic's documentation agrees
Anthropic's documentation has since written up allowedPluginMarketplaces, on Configuration reference.