{"version":"2.1.319","anchor":"connector-file-downloads-new-consent-prompt-and-download-pi","canonical_anchor":"connector-file-downloads-new-consent-prompt-and-download-pi","heading":"Claude Code can download files from claude.ai connectors after asking you","tier":"notice","area":"Connectors","scope":"individual","heads_up":false,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.319\/e\/connector-file-downloads-new-consent-prompt-and-download-pi","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.319","markdown":"### Claude Code can download files from claude.ai connectors after asking you\n\nConnector tool results can offer files, which Claude Code saves to a git-ignored folder only after you choose Download\n\n**Unclear.** It is not clear what decides whether connector download offers are picked up at all, so whether this works by default is unknown.\n\n**What**\n\nConnectors from claude.ai link Claude Code to outside services. They work through MCP (Model Context Protocol), the standard Claude Code uses for outside tools. A connector's tool result can now offer files to download. Claude Code asks \"Download \u2026 into \u2026?\" and gives you two choices, Download and Don't download.\n\nIf you choose Download, Claude Code:\n\n- Saves up to 10 files from one tool result, each up to 100 MB.\n\n- Puts them in a connector-downloads folder and writes a `.gitignore` containing `*` there, so git ignores everything in it.\n\n- Refuses to save if git already tracks files in that folder.\n\n- On macOS, marks the files with the quarantine attribute, and on Windows adds a Zone.Identifier. Both tell the system the file came from the internet.\n\n- Adds a banner when a saved file is read, saying its contents are data and not instructions.\n\nWhen a download is refused, Claude Code tells the model why. Reasons include an organization policy that does not allow connector downloads, not being signed in, a background run, and Remote Control being connected. Whether downloads are available depends on your account, on the organization policy `allow_connector_file_downloads`, and on checks made by the server. When you leave a worktree (a separate working copy of your project), the exit dialog now warns that removing the worktree also deletes files saved from connectors.\n\n**Why**\n\nThis lets connector data land on your disk, so the consent prompt and the safety checks around it matter. The git-ignore step keeps those files out of your commits, and the banner keeps the model from following instructions hidden inside a downloaded file.\n\n- Area: Connectors\n- Tier: You'll notice\n- Useful: 5\/5\n- Signal: 3\/5\n- Scope: individual\n- Heads-up: no"}