{"version":"2.1.300","anchor":"desktop-managed-settings-denied-plugin-mcp-servers-and-mor","canonical_anchor":"desktop-managed-settings-denied-plugin-mcp-servers-and-mor","heading":"Admins can block plugin MCP servers by address, and Claude Code reads more managed settings","tier":"use","area":"Managed Settings","scope":"org","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.300\/e\/desktop-managed-settings-denied-plugin-mcp-servers-and-mor","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.300","markdown":"### Admins can block plugin MCP servers by address, and Claude Code reads more managed settings\n\nA new managed setting, deniedPluginMcpServers, blocks plugin MCP servers by address, and six more managed settings now list Claude Code as a reader\n\n**Unclear.** It is not confirmed that the Claude Code command-line tool itself enforces these settings, as opposed to them only being listed for it in the desktop settings schema.\n\n**What**\n\nManaged settings are settings an organization's administrator sets centrally for every user. Several of them changed.\n\nThere is a new managed setting, `deniedPluginMcpServers`. An MCP server is an outside service that gives Claude extra tools. This setting blocks remote MCP servers that come from plugins, matching them by web address pattern. A pattern starts with a scheme such as `https:\/\/`, or `*:\/\/` to match any scheme.\n\nThese existing settings were listed only for the desktop app and Microsoft 365. They now also list Claude Code as a reader:\n\n- `managedMcpServers`\n\n- `disabledBuiltinTools`\n\n- `allowedWorkspaceFolders`\n\n- `inferenceProvider`\n\n- `mcpToolTimeoutSec`\n\n- `otlpResourceAttributes`\n\nThe description of `processWrapper` was rewritten to cover SSH hosts (remote machines reached over a secure connection) and how credentials are handled. Example file patterns now start with `\/\/**\/`.\n\n**Why**\n\nAdministrators get a deny list for plugin MCP servers, and Claude Code sessions are now meant to follow more of the settings an organization already manages.\n\n- Area: Managed Settings\n- Tier: Use it now\n- Useful: 4\/5\n- Signal: 2\/5\n- Scope: org\n- Heads-up: no"}