Unclear It is not confirmed that the Claude Code command-line tool itself enforces these settings, as opposed to them only being listed for it in the desktop settings schema.
Managed settings are settings an organization's administrator sets centrally for every user. Several of them changed.
There is a new managed setting, deniedPluginMcpServers. An MCP server is an outside service that gives Claude extra tools. This setting blocks remote MCP servers that come from plugins, matching them by web address pattern. A pattern starts with a scheme such as https://, or *:// to match any scheme.
These existing settings were listed only for the desktop app and Microsoft 365. They now also list Claude Code as a reader:
managedMcpServersdisabledBuiltinToolsallowedWorkspaceFoldersinferenceProvidermcpToolTimeoutSecotlpResourceAttributes
The description of processWrapper was rewritten to cover SSH hosts (remote machines reached over a secure connection) and how credentials are handled. Example file patterns now start with //**/.
Administrators get a deny list for plugin MCP servers, and Claude Code sessions are now meant to follow more of the settings an organization already manages.
It is not confirmed that the Claude Code command-line tool itself enforces these settings, as opposed to them only being listed for it in…