Claude Desktop

com.anthropic.claudefordesktop

Claude Desktop enterprise configuration settings

macOS

Configuration Keys (160)

Showing 160 of 160 keys

Key	Type	Description	Default	Range
`PFC_SegmentedControl_0`string required	string	—	Default: —	Range: —
`disableAutoUpdates`boolean Block auto-updates	boolean	Disable automatic updates for Claude Desktop.	Default: false	Range: —
`autoUpdaterEnforcementHours`integer Auto-update enforcement window	integer	Hours before forcefully restarting Claude to apply a prepared update. Must be between 1 and 72 hours.	Default: 72	Range: 1 – 72
`installedUpdateEnforcementEnabled`boolean Restart to apply installed updates	boolean	With auto-updates blocked, Claude restarts by itself for a newer version installed while it was open.	Default: —	Range: —
`installedUpdateEnforcementHours`integer Installed-update enforcement window	integer	Hours before Claude restarts for a newer version installed while it was open. Unset: 72 hours, then when idle. A number skips the idle wait.	Default: —	Range: 1 – 72
`updateViaUpdatesHost`boolean Check for updates on releases.claude.com	boolean	Read the update feed from releases.claude.com so api.anthropic.com can stay blocked. Defaults to false.	Default: false	Range: —
`releaseChannel`string Release channel	string	Stable: devices take each release as it rolls out. Staggered: devices update less often, usually a week or more behind.	Default: "stable"	Range: Stable (stable), Staggered (staggered)
`relaunchEnforcementHours`integer Configuration relaunch window	integer	Hours a user may keep working on the old configuration after a managed-configuration change is detected. 0 = restart required at once. Blank = 24 hours. Defaults to 24. Range: 0-336.	Default: 24	Range: 0 – 336
`configRecheckIntervalMinutes`integer Configuration re-check interval	integer	Minutes between the running app's checks for a changed managed configuration. Blank = 10 minutes. Defaults to 10. Range: 2-30.	Default: 10	Range: 2 – 30
`forceLoginOrgUUID`array Force login organization UUIDs	array	Require login to belong to a specific organization. Accepts a single UUID string, which also pre-selects that organization during login, or an array of UUIDs where any listed organization is accepted without pre-selection. Login fails if the authenticated account does not belong to a listed organization. Also honored by Claude Desktop in third-party (3P) mode, where it limits which Enterprise Admin Console organization a user can move the device to.	Default: —	Range: —
string Organization UUID	string	—	Default: —	Range: —
`deploymentOrganizationUuid`string Organization UUID	string	A UUID you generate. Tags telemetry so Anthropic support can locate your fleet's events, and namespaces each user's local data. Not used for auth.	Default: —	Range: —
`disableDeploymentModeChooser`boolean Disable Claude.ai sign-in	boolean	Users see only this provider at the login screen. The option to sign in to Claude.ai is hidden. Defaults to false.	Default: false	Range: —
`disableDeepLinkRegistration`boolean Disable claude:// deep-link handling	boolean	Stop external apps and websites from opening Claude Desktop via claude:// links. Defaults to false.	Default: false	Range: —
`endUserAttribution`boolean End-user attribution	boolean	Show the signed-in user's identity-provider identity in the sidebar and account menu, and emit it as the OpenTelemetry enduser.id resource attribute.	Default: false	Range: —
`deploymentDisplayName`string Deployment display name	string	Overrides the provider label shown in the sidebar footer, user-menu header, and connection-error banner.	Default: —	Range: —
`deploymentDisplaySubtitle`string Deployment display subtitle	string	Optional detail shown after the deployment display name in the account-menu header.	Default: —	Range: —
`disableConfigDeprecationWarnings`boolean Hide configuration deprecation warnings	boolean	Don't show users the in-app warning that this configuration uses a deprecated field. The final reminder in the 24 hours before the cut-off still appears.	Default: false	Range: —
`banner`dict Organization banner	dict	A persistent banner across the top of the app window after sign-in.	Default: —	Range: —
`enabled`boolean Enabled	boolean	Turns the banner on or off.	Default: false	Range: —
`text`string Text	string	Text shown in the banner.	Default: —	Range: —
`backgroundColor`string Background color	string	Banner background color, as a hex code.	Default: —	Range: —
`textColor`string Text color	string	Banner text color, as a hex code.	Default: —	Range: —
`linkUrl`string Link URL	string	URL the banner links to when clicked.	Default: —	Range: —
`disableFeatureDiscovery`boolean Hide feature announcements	boolean	Suppress unprompted feature-announcement UI: the post-update “What's new” nudge and new-feature tips. Users can still open release notes themselves. Defaults to false.	Default: false	Range: —
`claudeAiImport`dict Claude.ai data import	dict	Lets users import Claude.ai chats and projects, plus earlier Claude sessions on this computer, when enabled is true. automatic3pImport is a separate switch.	Default: —	Range: —
`enabled`boolean Enabled	boolean	Turns history import on. The banner and import actions stay off until this is true.	Default: false	Range: —
`exportEnabled`boolean Export enabled	boolean	Lets users export Claude.ai chats and projects. automatic3pImport is a separate switch.	Default: false	Range: —
`bannerBehavior`string Banner behavior	string	When the import banner appears.	Default: "off"	Range: Off (off), Detect (detect), Show (show)
`inferenceProvider`string Inference provider	string	Selects the inference backend. Setting this key switches Claude Desktop into third-party (3P) mode.	Default: —	Range: Gateway (gateway), Claude API (Anthropic) (anthropic), Amazon Bedrock (bedrock), Mantle (mantle), Google Vertex AI (vertex), Azure AI Foundry (foundry)
`inferenceCredentialKind`string Credential kind	string	Selects the credential source. When set, only that source is used, with no fallback.	Default: —	Range: Static (static), Helper script (helper-script), Interactive sign-in (interactive), Vendor profile (vendor-profile), Workforce Identity (workforce), External identity provider (external-idp)
`inferenceSessionLifetimeSec`integer Sign-in session lifetime	integer	How long a sign-in stays valid under your identity provider's session policy. A re-authenticate banner appears before it expires.	Default: —	Range: 1 – —
`userContentRendererUrl`string Artifact preview iframe origin	string	HTTPS origin of the user-content-renderer deployment used for artifact and file previews. Uses the commercial host when unset.	Default: —	Range: —
`inferenceCustomHeaders`dict Custom inference headers	dict	Extra headers sent on every inference and model-discovery request. Routing and tenant headers only; do not put credentials here (use the credential helper instead).	Default: —	Range: —
`{{key}}`string Header name	string	—	Default: —	Range: —
`{{value}}`string Header value	string	—	Default: —	Range: —
`inferenceCredentialHelper`string Helper script	string	Absolute path to an executable that prints the credential (a bare token, or JSON with token and headers). When set, static credential keys are ignored. When delivered by a bootstrap server, applies only after user consent unless trustBootstrapDelivery or machine-scoped MDM covers the bootstrap URL.	Default: —	Range: —
`inferenceCredentialHelperWindows`string Helper script (Windows)	string	Absolute path of the credential helper executable on Windows devices, used there instead of the credential helper script. macOS and Linux devices ignore it; set it when one configuration serves both Windows and Mac devices. When delivered by a bootstrap server, applies only after user consent unless trustBootstrapDelivery or machine-scoped MDM covers the bootstrap URL.	Default: —	Range: —
`inferenceCredentialHelperArgs`array Helper script arguments	array	Arguments passed to the credential helper script, one per entry, in order. Entries may not be empty or contain double quotes, percent signs or control characters. When delivered by a bootstrap server, applies only after user consent unless trustBootstrapDelivery or machine-scoped MDM covers the bootstrap URL.	Default: —	Range: —
string Argument	string	—	Default: —	Range: —
`inferenceCredentialHelperTtlSec`integer Helper script TTL	integer	How long the helper output is cached before the helper runs again, without a relaunch. When delivered by a bootstrap server, applies only after user consent unless trustBootstrapDelivery or machine-scoped MDM covers the bootstrap URL.	Default: 3600	Range: 1 – —
`inferenceCredentialHelperTimeoutSec`integer Credential helper timeout	integer	Maximum wait for the helper executable to finish. Raise this if the helper opens a browser for interactive sign-in. When delivered by a bootstrap server, applies only after user consent unless trustBootstrapDelivery or machine-scoped MDM covers the bootstrap URL.	Default: 60	Range: 1 – 600
`inferenceCredentialHelperSilentRefreshEnabled`boolean Re-run helper for silent refresh	boolean	When the credential expires mid-session, re-run the helper to recover silently. Turn off if the helper cannot run non-interactively. When delivered by a bootstrap server, applies only after user consent unless trustBootstrapDelivery or machine-scoped MDM covers the bootstrap URL.	Default: true	Range: —
`inferenceAnthropicApiKey`string Claude API key	string	Claude API key. Leave blank to sign in with the browser or to supply the key through a credential helper.	Default: —	Range: —
`inferenceStreamIdleTimeoutSec`integer Stream idle timeout	integer	Extra time to wait for model output on a streaming response that is sending only keep-alive pings. Gateway provider only.	Default: 300	Range: 300 – 1800
`inferenceGatewayBaseUrl`string Gateway base URL	string	Full URL of the inference gateway endpoint. When delivered by a bootstrap server, applies only after user consent unless trustBootstrapDelivery or machine-scoped MDM covers the bootstrap URL. Depends on: inferenceProvider ∈ [gateway]	Default: —	Range: —
`inferenceGatewayApiKey`string Gateway API key	string	API key for the configured inference gateway.	Default: —	Range: —
`inferenceGatewayAuthScheme`string Gateway auth scheme	string	How the gateway credential is sent on the wire: Authorization: Bearer or an x-api-key header.	Default: "bearer"	Range: Authorization: Bearer (bearer), x-api-key header (x-api-key)
`inferenceIdpAuthFlow`string Identity provider sign-in flow	string	How the identity-provider sign-in runs: system browser (default) or the OS Microsoft Entra broker (Company Portal on macOS).	Default: —	Range: System browser (browser), OS identity broker (Microsoft Entra) (broker)
`inferenceIdpOidc`dict Identity provider (OIDC)	dict	Your organization's OpenID Connect identity provider, used with credential kind external-idp. The user's token is sent as the bearer credential to the gateway or the Bedrock proxy. When delivered by a bootstrap server, applies only after user consent unless trustBootstrapDelivery or machine-scoped MDM covers the bootstrap URL.	Default: —	Range: —
`clientId`string Client ID required	string	OAuth client ID of the desktop app registration at your identity provider (public client, PKCE).	Default: —	Range: —
`issuer`string Issuer URL	string	HTTPS issuer that supports OIDC discovery. Set this, or set the authorization and token URLs instead.	Default: —	Range: —
`authorizationUrl`string Authorization URL	string	HTTPS authorization endpoint. Used together with the token URL when no issuer is set.	Default: —	Range: —
`tokenUrl`string Token URL	string	HTTPS token endpoint. Used together with the authorization URL when no issuer is set.	Default: —	Range: —
`bearerTokenType`string Bearer token	string	Which token is sent as the bearer credential. Use access_token for a gateway or proxy that validates tokens as an OAuth resource server.	Default: "id_token"	Range: ID token (id_token), Access token (access_token)
`scopes`string Scopes	string	Space-separated scopes. Required in access-token mode, where it must name the gateway or proxy API scope.	Default: —	Range: —
`appendOfflineAccess`boolean Append offline_access	boolean	Append offline_access to the scopes so the identity provider returns a refresh token for silent refresh.	Default: true	Range: —
`resource`string Resource indicator (RFC 8707)	string	Access-token audience of the gateway or proxy (an HTTPS URL or an AD FS relying-party identifier). Leave unset for Microsoft Entra ID.	Default: —	Range: —
`redirectPort`integer Redirect port	integer	Fixed loopback port for the sign-in redirect. Leave unset to use a free port each time.	Default: —	Range: 1024 – 65535
`redirectHost`string Redirect host	string	Host named in the sign-in redirect URI. Use localhost only if your identity provider's registered redirect URI requires it.	Default: "127.0.0.1"	Range: 127.0.0.1 (127.0.0.1), localhost (localhost)
`additionalRedirectReferrerHosts`string Additional redirect referrer hosts	string	Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the identity provider completes sign-in from a different host.	Default: —	Range: —
`inferenceGatewayOidcAuthFlow`string Gateway sign-in flow	string	Deprecated by Anthropic; the original spelling keeps working with no end date set. Use Identity Provider Sign-in Flow (inferenceIdpAuthFlow) instead. How the gateway IdP sign-in runs: system browser (default) or the OS Microsoft Entra broker.	Default: —	Range: System browser (browser), OS identity broker (Microsoft Entra) (broker)
`inferenceGatewayOidc`dict Gateway SSO IdP (OIDC)	dict	Deprecated by Anthropic; the original spelling keeps working with no end date set. Use Identity Provider (inferenceIdpOidc) with credential kind external-idp instead. External OIDC identity provider for gateway sign-in; the token is sent to the gateway as the bearer credential. When delivered by a bootstrap server, applies only after user consent unless trustBootstrapDelivery or machine-scoped MDM covers the bootstrap URL.	Default: —	Range: —
`clientId`string Client ID required	string	OAuth client ID of the desktop app registration at your identity provider (public client, PKCE).	Default: —	Range: —
`issuer`string Issuer URL	string	HTTPS issuer that supports OIDC discovery. Set this, or set the authorization and token URLs instead.	Default: —	Range: —
`authorizationUrl`string Authorization URL	string	HTTPS authorization endpoint. Used together with the token URL when no issuer is set.	Default: —	Range: —
`tokenUrl`string Token URL	string	HTTPS token endpoint. Used together with the authorization URL when no issuer is set.	Default: —	Range: —
`bearerTokenType`string Bearer token	string	Which token is sent as the bearer credential. Use access_token for a gateway or proxy that validates tokens as an OAuth resource server.	Default: "id_token"	Range: ID token (id_token), Access token (access_token)
`scopes`string Scopes	string	Space-separated scopes. Required in access-token mode, where it must name the gateway or proxy API scope.	Default: —	Range: —
`appendOfflineAccess`boolean Append offline_access	boolean	Append offline_access to the scopes so the identity provider returns a refresh token for silent refresh.	Default: true	Range: —
`resource`string Resource indicator (RFC 8707)	string	Access-token audience of the gateway or proxy (an HTTPS URL or an AD FS relying-party identifier). Leave unset for Microsoft Entra ID.	Default: —	Range: —
`redirectPort`integer Redirect port	integer	Fixed loopback port for the sign-in redirect. Leave unset to use a free port each time.	Default: —	Range: 1024 – 65535
`redirectHost`string Redirect host	string	Host named in the sign-in redirect URI. Use localhost only if your identity provider's registered redirect URI requires it.	Default: "127.0.0.1"	Range: 127.0.0.1 (127.0.0.1), localhost (localhost)
`additionalRedirectReferrerHosts`string Additional redirect referrer hosts	string	Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the identity provider completes sign-in from a different host.	Default: —	Range: —
`inferenceBedrockRegion`string AWS region	string	AWS region for the Bedrock runtime endpoint. Depends on: inferenceProvider ∈ [bedrock, mantle]	Default: —	Range: —
`inferenceBedrockBaseUrl`string Bedrock base URL	string	For VPC endpoints or gateway proxies. HTTPS scheme and host only, no path. When delivered by a bootstrap server, applies only after user consent unless trustBootstrapDelivery or machine-scoped MDM covers the bootstrap URL.	Default: —	Range: —
`inferenceBedrockServiceTier`string Bedrock service tier	string	Sent as the X-Amzn-Bedrock-Service-Tier header. Leave unset for on-demand.	Default: —	Range: Flex (flex), Priority (priority)
`inferenceBedrockBearerToken`string AWS bearer token	string	Static bearer token for Bedrock inference. Prefer profile or helper-script credentials where possible.	Default: —	Range: —
`inferenceBedrockSsoStartUrl`string AWS SSO start URL	string	Enables in-app AWS IAM Identity Center sign-in (no AWS CLI needed). Set together with the SSO region, account ID and role name. When delivered by a bootstrap server, applies only after user consent unless trustBootstrapDelivery or machine-scoped MDM covers the bootstrap URL.	Default: —	Range: —
`inferenceBedrockSsoRegion`string AWS SSO region	string	IAM Identity Center home region. When delivered by a bootstrap server, applies only after user consent unless trustBootstrapDelivery or machine-scoped MDM covers the bootstrap URL.	Default: —	Range: —
`inferenceBedrockSsoAccountId`string AWS SSO account ID	string	12-digit AWS account ID assigned to users in IAM Identity Center. When delivered by a bootstrap server, applies only after user consent unless trustBootstrapDelivery or machine-scoped MDM covers the bootstrap URL.	Default: —	Range: —
`inferenceBedrockSsoRoleName`string AWS SSO role name	string	IAM Identity Center permission-set name granting bedrock:InvokeModel* on the account above. When delivered by a bootstrap server, applies only after user consent unless trustBootstrapDelivery or machine-scoped MDM covers the bootstrap URL.	Default: —	Range: —
`inferenceBedrockProfile`string AWS profile name	string	AWS named profile to use for Bedrock inference credentials. When delivered by a bootstrap server, applies only after user consent unless trustBootstrapDelivery or machine-scoped MDM covers the bootstrap URL.	Default: —	Range: —
`inferenceBedrockAwsDir`string AWS config directory	string	Folder with AWS config and credentials files. Defaults to ~/.aws when no bearer token is set. When delivered by a bootstrap server, applies only after user consent unless trustBootstrapDelivery or machine-scoped MDM covers the bootstrap URL.	Default: —	Range: —
`inferenceBedrockAwsCliPath`string AWS CLI path	string	Absolute path to the aws executable. Leave unset to find it on PATH. When delivered by a bootstrap server, applies only after user consent unless trustBootstrapDelivery or machine-scoped MDM covers the bootstrap URL.	Default: —	Range: —
`inferenceVertexProjectId`string GCP project ID	string	Google Cloud project ID for Vertex AI inference. When delivered by a bootstrap server, applies only after user consent unless trustBootstrapDelivery or machine-scoped MDM covers the bootstrap URL. Depends on: inferenceProvider ∈ [vertex]	Default: —	Range: —
`inferenceVertexRegion`string GCP region	string	GCP region where your Vertex AI Claude models are deployed. Depends on: inferenceProvider ∈ [vertex]	Default: —	Range: —
`inferenceVertexBaseUrl`string Vertex AI base URL	string	Private Service Connect endpoint, if you use one. When delivered by a bootstrap server, applies only after user consent unless trustBootstrapDelivery or machine-scoped MDM covers the bootstrap URL.	Default: —	Range: —
`inferenceVertexOAuthClientId`string Vertex OAuth client ID	string	Desktop-app OAuth client ID. Enables Sign in with Google instead of a credentials file. When delivered by a bootstrap server, applies only after user consent unless trustBootstrapDelivery or machine-scoped MDM covers the bootstrap URL.	Default: —	Range: —
`inferenceVertexOAuthClientSecret`string Vertex OAuth client secret	string	Secret for the desktop-app OAuth client above. Google treats installed-app client secrets as non-confidential.	Default: —	Range: —
`inferenceVertexOAuthScopes`string Vertex OAuth scopes	string	Override the Google OAuth scopes (space-separated). Leave blank for the default.	Default: —	Range: —
`inferenceVertexOAuthLoginHint`string Vertex OAuth login hint	string	Pre-fills Google's account chooser and is forwarded to your federated IdP. {username} expands to the OS login name.	Default: —	Range: —
`inferenceVertexWorkforceAudience`string Workforce Identity audience	string	Workforce-pool provider audience. When set, sign-in uses your own IdP plus a GCP STS token exchange instead of a Google identity. When delivered by a bootstrap server, applies only after user consent unless trustBootstrapDelivery or machine-scoped MDM covers the bootstrap URL.	Default: —	Range: —
`inferenceVertexWorkforceUserProject`string Workforce Identity billing project	string	GCP project used for STS billing and quota. Defaults to the Vertex project ID. When delivered by a bootstrap server, applies only after user consent unless trustBootstrapDelivery or machine-scoped MDM covers the bootstrap URL.	Default: —	Range: —
`inferenceVertexWorkforceAuthFlow`string Workforce Identity sign-in flow	string	How the Workforce Identity IdP sign-in runs: system browser (default) or the OS Microsoft Entra broker.	Default: —	Range: System browser (browser), OS identity broker (Microsoft Entra) (broker)
`inferenceVertexWorkforceOidc`dict Workforce Identity IdP (OIDC)	dict	Your organization's OIDC identity provider. The app runs an authorization-code-with-PKCE sign-in against it and exchanges the ID token at GCP STS. When delivered by a bootstrap server, applies only after user consent unless trustBootstrapDelivery or machine-scoped MDM covers the bootstrap URL.	Default: —	Range: —
`clientId`string Client ID required	string	OAuth client ID of the desktop app registration at your identity provider (public client, PKCE).	Default: —	Range: —
`issuer`string Issuer URL	string	HTTPS issuer that supports OIDC discovery. Set this, or set the authorization and token URLs instead.	Default: —	Range: —
`authorizationUrl`string Authorization URL	string	HTTPS authorization endpoint. Used together with the token URL when no issuer is set.	Default: —	Range: —
`tokenUrl`string Token URL	string	HTTPS token endpoint. Used together with the authorization URL when no issuer is set.	Default: —	Range: —
`scopes`string Scopes	string	Space-separated scopes. Defaults to openid profile email offline_access.	Default: —	Range: —
`redirectPort`integer Redirect port	integer	Fixed loopback port for the sign-in redirect. Leave unset to use a free port each time.	Default: —	Range: 1024 – 65535
`redirectHost`string Redirect host	string	Host named in the sign-in redirect URI. Use localhost only if your identity provider's registered redirect URI requires it.	Default: "127.0.0.1"	Range: 127.0.0.1 (127.0.0.1), localhost (localhost)
`omitOfflineAccess`boolean Omit offline_access	boolean	Enable only if your identity provider rejects offline_access on this client. Users then sign in again each time the token expires.	Default: false	Range: —
`additionalRedirectReferrerHosts`string Additional redirect referrer hosts	string	Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the identity provider completes sign-in from a different host.	Default: —	Range: —
`inferenceVertexCredentialsFile`string GCP credentials file path	string	Absolute path to a service-account JSON file. Leave blank to fall back to Application Default Credentials. When delivered by a bootstrap server, applies only after user consent unless trustBootstrapDelivery or machine-scoped MDM covers the bootstrap URL.	Default: —	Range: —
`inferenceFoundryResource`string Azure AI Foundry resource name	string	Azure AI Foundry resource name used to construct the endpoint URL. Still required when a Foundry base URL is set. When delivered by a bootstrap server, applies only after user consent unless trustBootstrapDelivery or machine-scoped MDM covers the bootstrap URL. Depends on: inferenceProvider ∈ [foundry]	Default: —	Range: —
`inferenceFoundryBaseUrl`string Azure AI Foundry base URL	string	Full base URL, path included, for a gateway or proxy in front of Foundry (replaces https://RESOURCE.services.ai.azure.com/anthropic). When delivered by a bootstrap server, applies only after user consent unless trustBootstrapDelivery or machine-scoped MDM covers the bootstrap URL.	Default: —	Range: —
`inferenceFoundryApiKey`string Azure AI Foundry API key	string	API key for Azure AI Foundry inference.	Default: —	Range: —
`inferenceFoundryTenantId`string Entra ID tenant ID	string	Directory (tenant) ID of the Entra ID app registration that has the Cognitive Services scope. When delivered by a bootstrap server, applies only after user consent unless trustBootstrapDelivery or machine-scoped MDM covers the bootstrap URL.	Default: —	Range: —
`inferenceFoundryClientId`string Entra ID client ID	string	Application (client) ID of the Entra ID app registration. Device-code sign-in requires the registration to allow public client flows. When delivered by a bootstrap server, applies only after user consent unless trustBootstrapDelivery or machine-scoped MDM covers the bootstrap URL.	Default: —	Range: —
`inferenceFoundryAuthFlow`string Entra ID sign-in flow	string	How Entra sign-in runs: device code (default), system browser, or the OS identity broker (Company Portal on macOS).	Default: "device-code"	Range: Device code (device-code), System browser (browser), OS identity broker (broker)
`bootstrapEnabled`boolean Use bootstrap config	boolean	Fetch and apply the bootstrap config URL at launch. Turn off to keep the URL saved but skip the fetch. MDM only: ignored in a bootstrap server response.	Default: true	Range: —
`bootstrapUrl`string Bootstrap config URL	string	HTTPS endpoint that returns a per-user JSON configuration. Values from the response override local settings and become read-only. Embedded credentials are refused. MDM only: ignored in a bootstrap server response.	Default: —	Range: —
`bootstrapOidc`dict Bootstrap OIDC parameters	dict	When set, the bootstrap request sends a bearer token from a browser sign-in (authorization code with PKCE) at this identity provider. Omit to use device-code mode against the bootstrap server. MDM only: ignored in a bootstrap server response.	Default: —	Range: —
`clientId`string Client ID required	string	OAuth client ID of the desktop app registration at your identity provider (public client, PKCE).	Default: —	Range: —
`issuer`string Issuer URL	string	HTTPS issuer that supports OIDC discovery. Set this, or set the authorization and token URLs instead.	Default: —	Range: —
`authorizationUrl`string Authorization URL	string	HTTPS authorization endpoint. Used together with the token URL when no issuer is set.	Default: —	Range: —
`tokenUrl`string Token URL	string	HTTPS token endpoint. Used together with the authorization URL when no issuer is set.	Default: —	Range: —
`scopes`string Scopes	string	Space-separated scopes. The token's audience must match what your bootstrap server validates.	Default: —	Range: —
`redirectPort`integer Redirect port	integer	Fixed loopback port for the sign-in redirect. Leave unset to use a free port each time.	Default: —	Range: 1024 – 65535
`redirectHost`string Redirect host	string	Host named in the sign-in redirect URI. Use localhost only if your identity provider's registered redirect URI requires it.	Default: "127.0.0.1"	Range: 127.0.0.1 (127.0.0.1), localhost (localhost)
`additionalRedirectReferrerHosts`string Additional redirect referrer hosts	string	Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the identity provider completes sign-in from a different host.	Default: —	Range: —
`bootstrapHeaders`dict Bootstrap request headers	dict	HTTP headers sent on every bootstrap config fetch, for example a service-account credential or a tenant header. Use instead of embedding user:password in the URL. MDM only: ignored in a bootstrap server response.	Default: —	Range: —
`{{key}}`string Header name	string	—	Default: —	Range: —
`{{value}}`string Header value	string	—	Default: —	Range: —
`bootstrapHeadersHelper`string Bootstrap headers helper script	string	Absolute path to an executable that prints a JSON object of bootstrap request headers. Merged over the static headers; the helper wins on conflict. MDM only: ignored in a bootstrap server response.	Default: —	Range: —
`trustBootstrapDelivery`boolean Trust bootstrap-delivered settings	boolean	Skip the per-user consent prompt for sign-in targets, inference endpoints, helper scripts and connectors that the bootstrap server delivers. MDM only: ignored in a bootstrap server response.	Default: false	Range: —
`inferenceModels`array Model list	array	Overrides the auto-discovered model list. Use the provider's exact model IDs. The first entry is the default model.	Default: —	Range: —
`inferenceModelsItem`dict Model	dict	—	Default: —	Range: —
`name`string Model ID required	string	Model ID exactly as the provider expects it.	Default: —	Range: —
`labelOverride`string Display name	string	Shown in the model picker. Leave blank to format the name from the ID.	Default: —	Range: —
`supports1m`boolean Offer 1M-context variant	boolean	Adds a 1M-context variant of this model to the picker. Set only if your deployment accepts 1M-token context for it.	Default: —	Range: —
`prefer1m`boolean Only show the 1M option	boolean	Shows one option for this model and requests 1M from the provider. No effect unless the entry offers 1M.	Default: —	Range: —
`anthropicFamilyTier`string Tier alias	string	The Claude tier this model stands in for, so a bare tier alias such as 'opus' resolves to it.	Default: —	Range: Sonnet (sonnet), Opus (opus), Haiku (haiku), Fable (fable), Mythos (mythos)
`isFamilyDefault`boolean Default for tier	boolean	When several models share a tier alias, marks this one as the model the alias resolves to. Otherwise the first listed wins.	Default: —	Range: —
`behavesAs`string Claude model behind this ID	string	For IDs the app cannot identify (such as a gateway alias): the Claude model this ID routes to, so it gets that model's effort levels and limits.	Default: —	Range: —
`maxEffort`string Max effort	string	Highest effort level offered for this model; higher levels are hidden and never requested. An unrecognized value caps the model at low.	Default: —	Range: Low (low), Medium (medium), High (high), Extra high (xhigh), Max (max)
`modelDiscoveryEnabled`boolean Model discovery	boolean	Populate the model picker from the provider's model-list endpoint at launch. When off, the model list is required and must use full model IDs.	Default: —	Range: —
`modelPrefer1mContext`boolean Use 1M wherever it’s available	boolean	Every model that offers a 1M-token context window shows a single option in the picker and requests 1M from the provider.	Default: —	Range: —
`defaultModelEffort`string Default model effort	string	Effort level the default model (the first listed model) starts at, instead of Anthropic's recommended level.	Default: —	Range: Low (low), Medium (medium), High (high), Extra high (xhigh), Max (max)
`alwaysStartWithDefaultModel`boolean Always start with the default model	boolean	New conversations and tasks start on the default model and effort level, not each person's last choice. Users can still change both for the current one.	Default: —	Range: —
`effortLevel`string Effort level	string	Sets the default effort level for Claude Code sessions in Claude Desktop, applied fresh at the start of each session. Does not apply to Cowork sessions. Unset by default. Applies to standard deployments (users sign in with Claude.ai); Claude Desktop in third-party (3P) mode ignores this key. In 3P mode, use Default Model Effort (defaultModelEffort) instead.	Default: —	Range: Low (low), Medium (medium), High (high), Extra high (xhigh), Max (max)
`modelCatalogEnabled`boolean Model catalog metadata	boolean	Fetch Anthropic's signed model catalog for model picker names, descriptions and effort options. When off, the app uses only its bundled copy.	Default: true	Range: —
`modelCatalogUrl`string Model catalog URL	string	Fetch the model catalog and its signature file from this mirror inside your network instead of downloads.claude.ai. HTTPS required; redirects are not followed.	Default: —	Range: —
`inferenceModelPricingEnabled`boolean Show estimated cost	boolean	Show an estimated cost on the Usage page, at Anthropic list price unless a multiplier or per-model rates are set. Required for the two pricing keys below to apply.	Default: false	Range: —
`inferenceModelPricingMultiplier`real Price multiplier	real	Scales every estimated cost (0.85 = 85% of the price). Applies only while Show Estimated Cost is on.	Default: —	Range: 0 – 1
`inferenceModelPricing`array Model pricing	array	Per-model rates (USD per million tokens) replacing Anthropic list price in the Usage page's estimate. Applies only while Show Estimated Cost is on.	Default: —	Range: —
`inferenceModelPricingItem`dict Model rate	dict	—	Default: —	Range: —
`name`string Model ID required	string	A model ID or provider alias. A built-in Claude ID also covers its dated and provider forms.	Default: —	Range: —
`inputPerMtok`real Input required	real	USD per million input tokens.	Default: —	Range: 0 – 10000
`outputPerMtok`real Output required	real	USD per million output tokens.	Default: —	Range: 0 – 10000
`cacheReadPerMtok`real Cache read required	real	USD per million prompt-cache read tokens.	Default: —	Range: 0 – 10000
`cacheWritePerMtok`real Cache write required	real	USD per million prompt-cache write tokens (5-minute and 1-hour writes alike).	Default: —	Range: 0 – 10000
`inferenceMaxTokensPerWindow`integer Max tokens per window	integer	Per-user soft cap, counted client-side over the token cap window. Not a server-enforced quota. Requires inferenceTokenWindowHours to also be set — without a window length the cap is inert and no limit is enforced.	Default: —	Range: —
`inferenceTokenWindowHours`integer Token cap window	integer	Tumbling window length for the token cap. Max 720 hours (30 days). Range: 1-720. Required when inferenceMaxTokensPerWindow is set — the cap only takes effect once both are configured.	Default: —	Range: 1 – 720
`inferenceTokenWarningPercent`integer Token limit warning	integer	Warn users once they have used this percentage of their token limit. At 100, the only warning comes at the limit. Has no effect unless Max Tokens per Window and Token Cap Window are both set. Unset: 75.	Default: 75	Range: 1 – 100
`desktopHome`string Desktop home	string	standard turns on Unified Claude (Chat and Cowork in one view); off turns Chat and Cowork off. Replaces Allow Chat, Advanced File Analysis and Allow Cowork. Values are case-sensitive; an unrecognized value is read as off.	Default: —	Range: Standard (Unified Claude) (standard), Off (off)
`chatTabEnabled`boolean Allow Chat	boolean	Enable Chat. Quick questions and drafting.	Default: true	Range: —
`chatAdvancedFileAnalysisEnabled`boolean Advanced file analysis	boolean	Allow Claude to run code in a local sandbox to analyze attached files it can't read natively — like Excel and PowerPoint. Off by default.	Default: false	Range: —
`coworkTabEnabled`boolean Allow Cowork	boolean	Enable Cowork. Claude works on longer tasks like research, analysis, and documents. Defaults to true.	Default: true	Range: —
`secureVmFeaturesEnabled`boolean Enable secure VM features	boolean	Enable Cowork access in Claude Desktop. Applies to standard deployments (users sign in with Claude.ai); Claude Desktop in third-party (3P) mode ignores this key. In 3P mode, use Allow Cowork (coworkTabEnabled) or Desktop Home (desktopHome) instead.	Default: true	Range: —
`isClaudeCodeForDesktopEnabled`boolean Allow Code	boolean	Enable Claude code access in desktop.	Default: true	Range: —
`autoModeEnabled`boolean Allow Auto mode	boolean	Controls Auto mode. Unset: offered in the Code tab. true: also offered in Cowork. false: removed from both tabs.	Default: —	Range: —
`disableBypassPermissionsMode`boolean Disable bypass permissions mode	boolean	Remove the bypass permissions mode from Code sessions and Cowork tasks, so Claude always follows the permission policy. Off by default.	Default: false	Range: —
`sshHostAllowlist`array SSH host allowlist	array	SSH hosts allowed for Code sessions: exact hostnames, . wildcards, or for any host. Unset: off unless Claude Code managed settings on the device list hosts. An empty list: off.	Default: —	Range: —
string Host	string	—	Default: —	Range: —
`sshClientPath`string SSH client program	string	Absolute path to the OpenSSH ssh program (7.6 or newer) the app runs for SSH sessions. Unset: the first ssh on the user's PATH.	Default: —	Range: —
`sshTransport`string SSH connection engine	string	Which SSH engine carries Code sessions: the OpenSSH ssh program on the device or the app's built-in SSH library. Unset or auto: the build's default.	Default: —	Range: Auto (auto), System OpenSSH (system-openssh), Built-in library (builtin)
`disableBundledSkills`boolean Disable bundled skills and workflows	boolean	Turns off the skills and workflows that ship with Claude Desktop.	Default: false	Range: —
`skillCreationEnabled`boolean Allow user-created skills	boolean	When off, the options to create and upload skills are hidden and Claude does not offer to create or update skills.	Default: —	Range: —
`skillScanningEnabled`boolean Scan user-created skills	boolean	Scan skills that users create.	Default: —	Range: —
`scheduledTasksEnabled`boolean Allow scheduled tasks	boolean	Allow users to create and run scheduled tasks.	Default: —	Range: —
`keepAwakeEnabled`boolean Allow keep awake	boolean	Allow Claude Desktop to keep the computer awake while it works.	Default: —	Range: —
`developerModeEnabled`boolean Allow Developer Mode	boolean	When false, the Enable Developer Mode menu item and the Developer menu do not appear.	Default: —	Range: —
`quickEntryDefaultShortcut`string Default Quick Entry shortcut	string	Default keyboard shortcut for Quick Entry.	Default: —	Range: —
`quickEntryScreenshotsEnabled`boolean Allow screenshots of the screen and other apps	boolean	Allow Quick Entry to capture screenshots of the screen and other apps.	Default: —	Range: —
`quickEntryFileSharingEnabled`boolean Allow sharing files open in other apps	boolean	Allow Quick Entry to share files that are open in other apps.	Default: —	Range: —
`projectsEnabled`boolean Allow projects	boolean	Set to false to hide projects in Chat and Cowork. Projects are not deleted and reappear when the setting is turned back on.	Default: —	Range: —
`sessionStatusLine`string Status line	string	Absolute path to a program whose output Claude Desktop shows as one line of text above the message box in Cowork, Chat and Code. On macOS, the program and every folder above it must be writable only by root.	Default: —	Range: —
`builtinToolPolicy`dict Built-in tool policy	dict	Maps built-in tool names (or argument-scoped permission rules such as Bash(curl *)) to allow or ask. Applies to Cowork, Chat and Code. To block a tool, use Disabled Built-in Tools.	Default: —	Range: —
`{{key}}`string Tool or rule	string	—	Default: —	Range: —
`{{value}}`string Policy	string	—	Default: —	Range: Allow (allow), Ask (ask)
`disabledBuiltinTools`array Disabled built-in tools	array	Removes the listed built-in tools from the available set in Claude Desktop. Known tools: Task, Bash, Glob, Grep, Read, Edit, Write, NotebookEdit, WebFetch, TodoWrite, WebSearch, Skill, REPL, JavaScript, AskUserQuestion. ToolSearch and SendUserMessage are also available under specific conditions.	Default: —	Range: —
`disabledBuiltinToolsItem`string Tool	string	Name of a built-in tool to disable.	Default: —	Range: —
`toolSearchEnabled`boolean Enable tool search	boolean	Load tool definitions on demand through tool search instead of all at once.	Default: —	Range: —
`organizationInstructions`string Organization instructions	string	Instructions from your organization that are added to Claude's context.	Default: —	Range: —
`builtinBrowserEnabled`boolean Allow the built-in browser	boolean	Claude Desktop on third-party inference deployments. Enable the built-in browser in Cowork and Code sessions. False disables the browser pane; Code retains its localhost-only dev-server preview. Defaults to false. When bootstrapUrl is set, configure this key in the served configuration.	Default: false	Range: —
`builtinBrowserDefaultDomainPolicy`string Default site policy in the built-in browser	string	Claude Desktop on third-party inference deployments. Default policy for sites Claude may open, read, or act on when the built-in browser is enabled. Allowed domains are exceptions under block; blocked domains are exceptions under allow. Users can still view sites denied to Claude. Defaults to allow.	Default: "allow"	Range: Allow sites by default (allow), Block sites by default (block)
`builtinBrowserAllowedDomains`array Allowed sites in the built-in browser	array	Claude Desktop on third-party inference deployments. Sites Claude may open, read, or act on when builtinBrowserDefaultDomainPolicy is block; ignored under allow. Empty or unset allows no external sites for Claude. Users can still view other sites. Bare * and public-suffix wildcards are ignored.	Default: —	Range: —
string Domain	string	A hostname or supported hostname wildcard. A plain hostname also matches its www form, but no other subdomain.	Default: —	Range: —
`builtinBrowserBlockedDomains`array Blocked sites in the built-in browser	array	Claude Desktop on third-party inference deployments. Sites Claude may not open, read, or act on when builtinBrowserDefaultDomainPolicy is allow; ignored under block. Empty or unset adds no blocked sites. Users can still view blocked sites. * blocks every external site for Claude; localhost dev servers are unaffected.	Default: —	Range: —
string Domain	string	A hostname or supported hostname wildcard. A plain hostname also matches its www form, but no other subdomain.	Default: —	Range: —
`requireCoworkFullVmSandbox`boolean Require full VM sandbox	boolean	Required the full VM sandbox for Cowork. Deprecated by Anthropic.	Default: —	Range: —
`allowedWorkspaceFolders`array Allowed workspace folders	array	Folders where Claude may work. Applies to both Cowork and Code sessions. Leave unset for unrestricted access. Paths can reference ~ and these environment variables, expanded per user: %OneDrive%, %OneDriveCommercial%, %OneDriveConsumer%, %APPDATA%, %LOCALAPPDATA%, %USERNAME%, %XDG_DOCUMENTS_DIR%. The set is fixed; an entry that references any other %VAR%, or one that is unset on the device, is ignored.	Default: —	Range: —
`AllowedWorkspaceFolderItem`dict	dict	—	Default: —	Range: —
`path`string Path	string	Absolute folder path. May start with ~ or one of the listed %VAR% tokens, expanded per user. Subfolders are included.	Default: —	Range: —
`isDefaultSelected`boolean Select default	boolean	Shows as a folder chip on the new-task page and skips the trust prompt. Users can remove it.	Default: false	Range: —
`mode`string Mode	string	Read-only folders can be viewed and searched but not modified in Cowork. In local Code sessions, read-only applies to file tools only; over SSH it also applies to Bash in its sandbox. One of: rw, ro.	Default: —	Range: Read/write (rw), Read only (ro)
`blockReadsOutsideWorkingDirectories`boolean Block reads outside working directories	boolean	Keep Claude from reading files outside a Code session's working directories. File tools refuse such reads; sandboxed shell commands lose the home directory.	Default: false	Range: —
`coworkEgressAllowedHosts`array Allowed egress hosts	array	Hosts agent tools may reach in Cowork and Chat (and, in part, Code): exact hostnames, . wildcards, optional :port, or for all. Does not cover web search, inference or MCP traffic. Unset: web fetch is refused.	Default: —	Range: —
string Host	string	—	Default: —	Range: —
`skipWebFetchPreflight`boolean Skip WebFetch domain check	boolean	Skip the domain safety check that runs before WebFetch requests.	Default: —	Range: —
`egressProxyUrl`string Proxy server URL	string	Sends the app's and the agent's traffic through this HTTP(S) proxy instead of the operating system's proxy settings. SOCKS proxies and embedded credentials are rejected. Read at launch. MDM only: ignored in a bootstrap server response.	Default: —	Range: —
`egressProxyPacUrl`string Proxy auto-config (PAC) URL	string	URL of a PAC file that decides the proxy per request. Wins over the proxy server URL when both are set. MDM only: ignored in a bootstrap server response.	Default: —	Range: —
`coworkVmIpv6Enabled`boolean Enable IPv6 in the workspace VM	boolean	Gives the Cowork workspace VM an IPv6 address and route so the agent's tools can reach IPv6-only hosts through the device. Reachability only; the egress allowlist still applies.	Default: false	Range: —
`managedMcpServers`array Managed MCP servers	array	Distributes remote MCP (Model Context Protocol) servers to users. Each entry requires a unique name and an HTTPS URL. Optional fields include transport, headers, OAuth, and tool-level policies. Used in Claude Cowork deployments on third-party platforms (Bedrock, Vertex AI, Azure AI Foundry, LLM gateways).	Default: —	Range: —
`managedMcpServersItem`dict Managed MCP server	dict	—	Default: —	Range: —
`name`string Name required	string	Unique name identifying this MCP server.	Default: —	Range: —
`url`string URL required	string	HTTPS URL of the remote MCP server.	Default: —	Range: —
`transport`string Transport	string	Transport protocol used to reach the MCP server.	Default: "http"	Range: HTTP (http), SSE (sse)
`headers`dict Headers	dict	Static request headers used to authenticate to the MCP server (for example, Authorization). Mutually exclusive with the OAuth field.	Default: —	Range: —
`{{key}}`string Header name	string	—	Default: —	Range: —
`{{value}}`string Header value	string	—	Default: —	Range: —
`oauth`boolean OAuth	boolean	When true, Claude Desktop runs a PKCE OAuth flow at first use to acquire user credentials. Mutually exclusive with the Headers field.	Default: false	Range: —
`toolPolicy`dict Tool policy	dict	Maps tool names exposed by the MCP server to a policy. Allowed values per tool: allow, ask, blocked. The "ask" policy prompts the user to confirm before the tool runs.	Default: —	Range: —
`{{key}}`string Tool name	string	—	Default: —	Range: —
`{{value}}`string Policy	string	—	Default: —	Range: Allow (allow), Ask (ask), Block (blocked)
`toolTimeoutSec`integer Tool call timeout	integer	How long a tool call to this server may run, in place of the MCP Tool Call Timeout (mcpToolTimeoutSec) for this server.	Default: —	Range: 5 – 3600
`isLocalDevMcpEnabled`boolean Allow local MCP servers	boolean	Enable or disable local Model Context Protocol (MCP) servers.	Default: true	Range: —
`mcpPersistentAlwaysAllowEnabled`boolean Allow persistent tool approvals	boolean	Offer the persistent “Always allow” approval options for MCP tools. Disable to keep tool approvals per-call or session-scoped only. Defaults to true.	Default: true	Range: —
`mcpScheduledTaskApprovalLifetimeDays`integer Scheduled-task tool approval lifetime	integer	How long tool approvals granted for scheduled tasks stay valid.	Default: —	Range: —
`mcpToolTimeoutSec`integer MCP tool call timeout	integer	Per-call timeout for MCP tool calls, in seconds. Default 180 (3 minutes). Range: 60-3600.	Default: 180	Range: 60 – 3600
`allowedPluginMcpServers`array Allowed plugin MCP servers	array	MCP servers that plugins may provide, matched by server URL.	Default: —	Range: —
`allowedPluginMcpServersItem`dict Server	dict	—	Default: —	Range: —
`serverUrl`string Server URL required	string	URL of the plugin-provided MCP server.	Default: —	Range: —
`deniedPluginMcpServers`array Blocked plugin MCP servers	array	MCP servers that plugins may not provide, matched by server URL.	Default: —	Range: —
`deniedPluginMcpServersItem`dict Server	dict	—	Default: —	Range: —
`serverUrl`string Server URL required	string	URL of the plugin-provided MCP server.	Default: —	Range: —
`microsoftAuthBroker`string Microsoft 365 native sign-in broker	string	How Microsoft 365 sign-in runs. auto: use the native OS broker (Company Portal SSO extension on macOS) when available, otherwise the browser. disabled: always use browser sign-in. required (1.49585.0 or later): sign-in fails when the broker is unavailable instead of falling back to the browser; earlier releases treat required as disabled. Defaults to auto.	Default: "auto"	Range: Auto (auto), Disabled (disabled), Required (required)
`microsoftAuthDefaultAccount`string Microsoft 365 sign-in with the Windows account	string	Whether Microsoft 365 sign-in uses the Windows account by default. One of: enabled, disabled. Defaults to disabled.	Default: "disabled"	Range: Enabled (enabled), Disabled (disabled)
`isDesktopExtensionEnabled`boolean Allow desktop extensions	boolean	Allow Claude Desktop to load desktop extensions (.dxt and .mcpb files). When unset, the default depends on the deployment: on for standard deployments where users sign in with Claude.ai, off in third-party (3P) mode (since 1.19367.0).	Default: —	Range: —
`isDesktopExtensionDirectoryEnabled`boolean Allow extension directory	boolean	Enable or disable access to the extension directory. Applies to standard deployments (users sign in with Claude.ai); Claude Desktop in third-party (3P) mode ignores this key.	Default: true	Range: —
`isDesktopExtensionSignatureRequired`boolean Require signed extensions	boolean	When true, Claude Desktop rejects extensions that aren't signed by a trusted publisher.	Default: false	Range: —
`allowedPluginMarketplaces`array Plugin marketplaces	array	Git repositories or hosted marketplace.json files shown as plugin marketplaces in the Directory's Organization tab.	Default: —	Range: —
`allowedPluginMarketplacesItem`dict Marketplace	dict	—	Default: —	Range: —
`source`string Source required	string	github: a GitHub repository (set Repository). git: a Git remote (set URL). url: a hosted marketplace.json file (set URL).	Default: —	Range: GitHub repository (github), Git remote (git), Hosted marketplace.json (url)
`repo`string Repository	string	GitHub repository in owner/repo form (github source).	Default: —	Range: —
`url`string URL	string	HTTPS Git remote (git source) or direct HTTPS URL of a hosted marketplace.json (url source).	Default: —	Range: —
`ref`string Ref	string	Commit SHA, branch or tag (github and git sources). Leave empty to track the default branch; auto_install and required need a full 40-character commit SHA.	Default: —	Range: —
`path`string Subpath	string	Folder within the repository that contains the marketplace, when it isn't at the root (github and git sources).	Default: —	Range: —
`manifestSha256`string Manifest SHA-256	string	SHA-256 of the exact marketplace.json to accept (url source). Without it, auto_install and required act as available.	Default: —	Range: —
`expectedName`string Expected name	string	Rejects the marketplace if its manifest name differs.	Default: —	Range: —
`installationPreference`string Installation	string	Whether users install plugins themselves or get them automatically.	Default: —	Range: Available (available), Auto-install (auto_install), Required (required)
`credentialKind`string Auth	string	Credential sent with a fetch: nothing, the user's Git credential, a helper script's output, or the gateway or bootstrap credential (url source only).	Default: —	Range: Anonymous (anonymous), User Git credential (userGit), Credential helper (credentialHelper), Inference credential (inferenceCredential)
`credentialHelper`string Credential helper	string	Executable that prints the access token to send.	Default: —	Range: —
`orgPluginSettings`array Organization plugin settings	array	Locks tool permissions on the MCP servers that plugins provide. Unlisted tools stay user-controlled.	Default: —	Range: —
`orgPluginSettingsItem`dict Server	dict	—	Default: —	Range: —
`serverName`string Server name required	string	Name of the plugin-delivered MCP server this policy applies to.	Default: —	Range: —
`tools`array Tool policy	array	Per-tool approval locks for this server.	Default: —	Range: —
`toolsItem`dict Tool	dict	—	Default: —	Range: —
`toolName`string Tool required	string	MCP tool name as the server reports it.	Default: —	Range: —
`permission`string Permission required	string	Approval state locked for this tool.	Default: —	Range: Allow (allow), Ask (ask), Block (blocked)
`userPluginMarketplacesEnabled`boolean Allow user-added plugin marketplaces	boolean	Let users add plugin marketplaces. When off, marketplaces your organization did not provision are hidden and their plugins are not loaded.	Default: —	Range: —
`userPluginUploadsEnabled`boolean Allow user-added plugins	boolean	Allow users to add their own plugins. When off, every option for adding one is hidden and uploads are refused.	Default: —	Range: —
`disableEssentialTelemetry`boolean Block essential telemetry	boolean	Crash and performance reports to Anthropic. Defaults to false.	Default: false	Range: —
`disableNonessentialTelemetry`boolean Block nonessential telemetry	boolean	Product-usage analytics and diagnostic-report uploads. No message content. Defaults to false.	Default: false	Range: —
`disableNonessentialServices`boolean Block nonessential services	boolean	Connector favicons and the artifact-preview and MCP Apps widget iframe origins. Artifacts will not render. Defaults to false.	Default: false	Range: —
`otlpEndpoint`string OTLP endpoint	string	Where OpenTelemetry logs and metrics are sent. Leave blank to disable.	Default: —	Range: —
`otlpProtocol`string OTLP protocol	string	grpc or http/protobuf. One of: http/protobuf, http/json, grpc. Defaults to http/protobuf.	Default: "http/protobuf"	Range: http/protobuf, http/json, grpc
`otlpHeaders`string OTLP headers	string	Static collector headers — routing and tenant headers only. No credentials here; use Collector authentication or the headers helper script for tokens.	Default: —	Range: —
`otlpAuthMode`string Collector authentication	string	inference-credential sends the user's inference bearer token to the collector as Authorization: Bearer. One of: none, inference-credential.	Default: —	Range: None (none), Inference credential (inference-credential)
`otlpHeadersHelper`string OTLP headers helper script	string	Absolute path to an executable that prints a JSON object of collector headers. Merged over the static headers and Collector authentication; the helper wins.	Default: —	Range: —
`otlpResourceAttributes`string Resource attributes	string	Extra resource attributes to attach to every span/metric. A static enduser.id set here always wins over the runtime identity.	Default: —	Range: —
`otlpDesktopLogLevel`string Desktop telemetry export level	string	Controls the Claude Desktop application's events, separate from Cowork and Code sessions. Defaults to error. One of: off, error, warn, info, debug. Defaults to error.	Default: "error"	Range: Off (off), Error (error), Warn (warn), Info (info), Debug (debug)
`otlpContentCapture`array Content capture	array	Content categories the desktop exporter sends unredacted to your collector. Leave empty to redact all content (default). One of: userPrompts, assistantResponses, toolDetails, toolContent, rawApiBodies.	Default: —	Range: —
`otlpContentCaptureItem`string Content capture category	string	Name of a content capture category to enable a class of raw content in OpenTelemetry events sent to your collector (this data never reaches Anthropic)	Default: —	Range: —
`otlpTracesEnabled`boolean Export traces	boolean	Also export OpenTelemetry traces from Cowork tasks and Code sessions. Uses Claude Code's session tracing.	Default: false	Range: —
`otlpAttrMaxChars`integer Telemetry attribute length limit	integer	Maximum length, in characters, of captured content such as a raw API body. Unset: 61,440 in Cowork tasks and Code sessions.	Default: —	Range: 256 – 15000000
`chatSessionRetentionDays`integer Chat retention period	integer	Delete chats, with their files, after this many days without activity. Unset: no deletion. Projects and memory are kept.	Default: —	Range: 1 – 3650
`coworkSessionRetentionDays`integer Cowork retention period	integer	Delete Cowork tasks, with their uploads and outputs, after this many days without activity. Unset: no deletion.	Default: —	Range: 1 – 3650
`codeSessionRetentionDays`integer Code retention period	integer	Delete Code sessions, conversation included, after this many days without activity. Unset: no deletion. Uncommitted work stays on disk.	Default: —	Range: 1 – 3650
`sessionRetentionHold`boolean Suspend session deletion	boolean	Suspends the Chat, Cowork and Code retention periods (legal hold).	Default: —	Range: —