{ "$schema": "http://json-schema.org/draft-07/schema#", "$id": "https://claude.com/docs/cowork/3p/schemas/bootstrap-config-v1.schema.json", "$ref": "#/definitions/BootstrapConfig", "definitions": { "BootstrapConfig": { "type": "object", "properties": { "$schemaVersion": { "description": "Marks the flat format. Optional: a response with no cluster key is read as flat regardless; set it to state the format explicitly.", "type": "number", "const": 1 }, "expiresAt": { "description": "Unix epoch (seconds or milliseconds) after which the client should re-fetch this document. Optional; when absent the client uses its default refresh interval.", "type": "number", "exclusiveMinimum": 0 }, "inferenceProvider": { "type": "string", "enum": [ "gateway", "anthropic", "bedrock", "mantle", "vertex", "foundry" ], "title": "Inference provider", "description": "Selects the inference backend. Setting this key activates third-party mode.", "x-flatKey": "inferenceProvider", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-valueAvailableInVersionOverride": [ { "value": "mantle", "availableInVersion": "1.13576.0" } ] }, "inferenceCredentialKind": { "type": "string", "enum": [ "static", "helper-script", "interactive", "vendor-profile", "workforce", "oauth" ], "title": "Credential kind", "description": "Selects the credential source. When set, only that source is used (no fallback).", "x-flatKey": "inferenceCredentialKind", "x-availableInVersion": "1.8555.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-deprecations": [ { "path": "inferenceCredentialKind: \"oauth\" (Vertex AI)", "use": "\"interactive\" — the same Google sign-in under its new name (in hosted or nested documents, switch once every desktop is on a release that knows the Vertex \"interactive\" kind)", "effect": "\"oauth\" will no longer be a Vertex AI credential kind: the value will be reported as invalid and ignored — the device will then derive the kind from the credential fields present (Google sign-in when an OAuth client id is set), and the hosted editor will refuse to save the configuration until the kind is changed", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" }, { "path": "inferenceCredentialKind: \"interactive\" together with inferenceVertexWorkforceAudience (Vertex AI)", "use": "\"workforce\" — or remove inferenceVertexWorkforceAudience if Google sign-in (\"interactive\") is what is meant", "effect": "the audience will no longer imply Workforce Identity: the kind will stay \"interactive\" (Google sign-in), which needs inferenceVertexOAuthClientId — without it the configuration will be reported as incomplete and inference will not start", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ], "x-deprecatedValues": [ { "value": "oauth", "use": "interactive", "provider": "vertex", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ], "x-valueAvailableInVersionOverride": [ { "value": "workforce", "availableInVersion": "1.15200.0" }, { "value": "oauth", "availableInVersion": "1.15200.0" } ] }, "inferenceGatewayBaseUrl": { "type": "string", "format": "uri", "title": "Gateway base URL", "description": "Full URL of the inference gateway endpoint.", "x-consentRequired": true, "x-flatKey": "inferenceGatewayBaseUrl", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-originPinned": "server-issued-credential" }, "inferenceStreamIdleTimeoutSec": { "type": "integer", "minimum": 300, "maximum": 1800, "title": "Stream idle timeout", "description": "Extra seconds to wait for model output on a streaming response that is sending only keep-alive pings. Gateway provider only. Default 300.", "x-flatKey": "inferenceStreamIdleTimeoutSec", "x-availableInVersion": "1.44121.1", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "inferenceCustomHeaders": { "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "string" }, "title": "Custom inference headers", "description": "Extra headers on every inference request — routing and tenant headers only (org IDs, Bedrock Guardrails). No credentials; use the credential helper for tokens.", "x-flatKey": "inferenceCustomHeaders", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.8089.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-legacyFlatKey": "inferenceGatewayHeaders", "x-deprecations": [ { "path": "inferenceGatewayHeaders", "use": "inferenceCustomHeaders", "effect": "no custom inference headers will be sent", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" }, { "path": "inferenceCustomHeaders as a \"Name=value,…\" string or a [\"Name: value\", …] list", "use": "a JSON object such as {\"Name\": \"value\"}", "effect": "a string or list value will be rejected as malformed and no custom inference headers will be sent", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ] }, "inferenceSessionLifetimeSec": { "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991, "title": "Sign-in session lifetime", "description": "How long a sign-in stays valid under your IdP’s session policy. Shows a re-authenticate banner before it expires.", "x-flatKey": "inferenceSessionLifetimeSec", "x-availableInVersion": "1.14271.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "inferenceGatewayApiKey": { "type": "string", "title": "Gateway API key", "description": "API key for the configured inference gateway.", "x-flatKey": "inferenceGatewayApiKey", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "inferenceGatewayAuthScheme": { "type": "string", "enum": [ "bearer", "x-api-key" ], "title": "Gateway auth scheme", "description": "How the gateway credential is sent on the wire (Authorization: Bearer vs x-api-key header).", "default": "bearer", "x-flatKey": "inferenceGatewayAuthScheme", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.3036.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-deprecations": [ { "path": "inferenceGatewayAuthScheme: \"sso\"", "use": "inferenceCredentialKind: \"interactive\"", "effect": "browser sign-in will no longer be inferred from it — the key will be reported as invalid and, unless inferenceCredentialKind or another credential field (an API key, inferenceGatewayOidc) says how to sign in, the gateway connection will have no credential and inference will not start", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" }, { "path": "inferenceGatewayAuthScheme: \"auto\"", "use": "\"bearer\" (or remove the key — bearer is the default)", "effect": "the value will be reported as invalid and ignored like any unrecognised scheme; the key will then take its default, \"bearer\", so the credential will still be sent as an Authorization: Bearer header", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ] }, "inferenceGatewayOidcAuthFlow": { "type": "string", "enum": [ "browser", "broker" ], "title": "Gateway sign-in flow", "description": "How the IdP sign-in runs: system browser (default) or the OS Microsoft Entra broker.", "x-flatKey": "inferenceGatewayOidcAuthFlow", "x-availableInVersion": "1.25927.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "inferenceGatewayOidc": { "type": "object", "properties": { "clientId": { "type": "string", "minLength": 1, "title": "Client ID", "description": "OAuth client ID of the desktop app registration at your identity provider (public client, PKCE).", "x-consentRequired": false }, "issuer": { "title": "Issuer URL", "description": "HTTPS issuer with OIDC discovery. Set this, or set the authorization and token URLs instead.", "x-consentRequired": false, "type": "string", "format": "uri" }, "authorizationUrl": { "title": "Authorization URL", "description": "HTTPS authorization endpoint. Used with the token URL when no issuer is set.", "x-consentRequired": false, "type": "string", "format": "uri" }, "tokenUrl": { "title": "Token URL", "description": "HTTPS token endpoint. Used with the authorization URL when no issuer is set.", "x-consentRequired": false, "type": "string", "format": "uri" }, "bearerTokenType": { "default": "id_token", "title": "Bearer token", "description": "Which token to send as the gateway bearer. Use access token for gateways that validate as an OAuth resource server.", "x-consentRequired": false, "type": "string", "enum": [ "id_token", "access_token" ] }, "scopes": { "title": "Scopes", "description": "Space-separated scopes. Required in access-token mode: set the gateway’s API scope. offline_access is appended automatically unless disabled below.", "x-consentRequired": false, "type": "string", "minLength": 1 }, "appendOfflineAccess": { "default": true, "title": "Append offline_access", "description": "Automatically append offline_access to scopes so the IdP returns a refresh token for silent refresh.", "x-consentRequired": false, "type": "boolean", "x-availableInVersionOverride": "1.11847.0" }, "resource": { "title": "Resource indicator (RFC 8707)", "description": "Absolute URL identifying the gateway as the access-token audience. Sent as the RFC 8707 resource parameter when set; leave unset for Microsoft Entra ID.", "x-consentRequired": false, "type": "string", "format": "uri", "x-availableInVersionOverride": "1.30096.1" }, "redirectPort": { "title": "Redirect port", "description": "Fixed loopback port for the sign-in redirect. Leave unset to use a free port each time.", "x-consentRequired": false, "type": "integer", "minimum": 1024, "maximum": 65535 }, "redirectHost": { "title": "Redirect host", "description": "Use localhost only if your IdP’s registered redirect URI specifies it.", "x-consentRequired": false, "type": "string", "enum": [ "127.0.0.1", "localhost" ], "x-availableInVersionOverride": "2.110.0" }, "additionalRedirectReferrerHosts": { "title": "Additional redirect referrer hosts", "description": "Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host.", "x-consentRequired": false, "type": "string", "x-availableInVersionOverride": "1.20186.0" } }, "required": [ "clientId" ], "title": "Gateway SSO IdP (OIDC)", "description": "External IdP for gateway sign-in. The user’s token from this issuer is sent to the gateway as the Bearer credential.", "x-flatKey": "inferenceGatewayOidc", "x-availableInVersion": "1.6889.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "inferenceCredentialHelper": { "type": "string", "title": "Helper script", "description": "Absolute path to an executable that prints the credential, optionally with per-request headers.", "x-flatKey": "inferenceCredentialHelper", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "inferenceCredentialHelperArgs": { "type": "array", "items": { "type": "string", "maxLength": 1024, "pattern": "^[^\"%\\x00-\\x1f]+$" }, "title": "Helper script arguments", "description": "Arguments passed to the helper script, one per entry, in order. Leave unset to run it with none.", "x-flatKey": "inferenceCredentialHelperArgs", "x-availableInVersion": "2.110.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "inferenceCredentialHelperTtlSec": { "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991, "title": "Helper script TTL", "description": "Helper output is cached for this many seconds; once it expires the helper re-runs without a relaunch (before the next turn when set above 120).", "default": 3600, "x-flatKey": "inferenceCredentialHelperTtlSec", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "inferenceCredentialHelperTimeoutSec": { "type": "integer", "exclusiveMinimum": 0, "maximum": 600, "title": "Credential helper timeout", "description": "Maximum wait for the helper executable to finish. Raise this if the helper opens a browser for interactive sign-in.", "default": 60, "x-flatKey": "inferenceCredentialHelperTimeoutSec", "x-availableInVersion": "1.8089.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "inferenceCredentialHelperSilentRefreshEnabled": { "type": "boolean", "title": "Re-run helper for silent refresh", "description": "On credential expiry, re-run the helper (CLAUDE_HELPER_CONTEXT=mid-session-refresh) to recover silently. Turn off if the helper can’t run non-interactively.", "default": true, "x-flatKey": "inferenceCredentialHelperSilentRefreshEnabled", "x-availableInVersion": "1.10628.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "inferenceAnthropicApiKey": { "type": "string", "title": "Claude API key", "description": "Leave blank to fetch a key via browser sign-in, or to supply the key via a credential helper.", "x-flatKey": "inferenceAnthropicApiKey", "x-availableInVersion": "1.8089.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "inferenceBedrockRegion": { "type": "string", "pattern": "^[a-z]{2,}(-[a-z]+)+-\\d{1,2}$", "title": "AWS region", "description": "AWS region for the Bedrock runtime endpoint.", "x-flatKey": "inferenceBedrockRegion", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "inferenceBedrockBaseUrl": { "type": "string", "format": "uri", "title": "Bedrock base URL", "description": "For VPC endpoints or gateway proxies. Host origin only.", "x-consentRequired": true, "x-flatKey": "inferenceBedrockBaseUrl", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-originPinned": "local-credential" }, "inferenceBedrockServiceTier": { "type": "string", "enum": [ "flex", "priority" ], "title": "Bedrock service tier", "description": "Sent as the X-Amzn-Bedrock-Service-Tier header. Leave unset for on-demand.", "x-flatKey": "inferenceBedrockServiceTier", "x-availableInVersion": "1.5186.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "inferenceBedrockBearerToken": { "type": "string", "title": "AWS bearer token", "description": "Static bearer token for inference. For providers that support profile or helper-script credentials, prefer those.", "x-flatKey": "inferenceBedrockBearerToken", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "inferenceBedrockSsoStartUrl": { "type": "string", "format": "uri", "title": "AWS SSO start URL", "description": "Enables in-app AWS sign-in (no AWS CLI needed). Set with the three SSO fields below.", "x-flatKey": "inferenceBedrockSsoStartUrl", "x-availableInVersion": "1.6259.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "inferenceBedrockSsoRegion": { "type": "string", "pattern": "^[a-z]{2,}(-[a-z]+)+-\\d{1,2}$", "title": "AWS SSO region", "description": "IAM Identity Center home region.", "x-flatKey": "inferenceBedrockSsoRegion", "x-availableInVersion": "1.6259.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "inferenceBedrockSsoAccountId": { "type": "string", "minLength": 1, "title": "AWS SSO account ID", "description": "12-digit AWS account ID assigned to users in IAM Identity Center.", "x-flatKey": "inferenceBedrockSsoAccountId", "x-availableInVersion": "1.6259.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "inferenceBedrockSsoRoleName": { "type": "string", "minLength": 1, "title": "AWS SSO role name", "description": "IAM Identity Center permission-set name granting bedrock:InvokeModel* on the account above.", "x-flatKey": "inferenceBedrockSsoRoleName", "x-availableInVersion": "1.6259.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "inferenceBedrockProfile": { "type": "string", "title": "AWS profile name", "description": "AWS named profile to use for Bedrock inference credentials.", "x-flatKey": "inferenceBedrockProfile", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "inferenceBedrockAwsDir": { "type": "string", "title": "AWS config directory", "description": "Folder with AWS config/credentials. Defaults to ~/.aws when no bearer token is set.", "x-flatKey": "inferenceBedrockAwsDir", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "inferenceBedrockAwsCliPath": { "type": "string", "title": "AWS CLI path", "description": "Absolute path to the aws executable. Leave unset to find it on PATH.", "x-flatKey": "inferenceBedrockAwsCliPath", "x-availableInVersion": "1.13576.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "inferenceVertexProjectId": { "type": "string", "pattern": "^[a-z0-9][a-z0-9.:-]*$", "title": "GCP project ID", "description": "Google Cloud project ID for Vertex AI inference.", "x-flatKey": "inferenceVertexProjectId", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "inferenceVertexRegion": { "type": "string", "pattern": "^([a-z]+-[a-z]+\\d{1,2}|global|eu|us)$", "title": "GCP region", "description": "GCP region where your Vertex AI Claude models are deployed.", "x-flatKey": "inferenceVertexRegion", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "inferenceVertexBaseUrl": { "type": "string", "format": "uri", "title": "Vertex AI base URL", "description": "PSC endpoint, if using one.", "x-consentRequired": true, "x-flatKey": "inferenceVertexBaseUrl", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-originPinned": "local-credential" }, "inferenceVertexOAuthClientId": { "type": "string", "minLength": 1, "title": "Vertex OAuth client ID", "description": "Desktop-app OAuth client ID. Enables Sign in with Google instead of a credentials file.", "x-flatKey": "inferenceVertexOAuthClientId", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "inferenceVertexOAuthClientSecret": { "type": "string", "minLength": 1, "title": "Vertex OAuth client secret", "description": "Secret for the Desktop-app OAuth client above. Google classifies installed-app client secrets as non-confidential, so this may be set from hosted config.", "x-flatKey": "inferenceVertexOAuthClientSecret", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "inferenceVertexOAuthScopes": { "type": "string", "minLength": 1, "title": "Vertex OAuth scopes", "description": "Override the Google OAuth scopes (space-separated). Leave blank for the default.", "x-flatKey": "inferenceVertexOAuthScopes", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "inferenceVertexOAuthLoginHint": { "type": "string", "minLength": 1, "title": "Vertex OAuth login hint", "description": "Pre-fill Google's account chooser and forward to your federated IdP. {username} expands to the OS login name.", "x-flatKey": "inferenceVertexOAuthLoginHint", "x-availableInVersion": "1.12603.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "inferenceVertexWorkforceAudience": { "type": "string", "minLength": 1, "title": "Workforce Identity audience", "description": "Workforce-pool provider audience. When set, sign-in uses your own IdP plus a GCP STS exchange instead of a Google identity.", "x-flatKey": "inferenceVertexWorkforceAudience", "x-availableInVersion": "1.10628.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "inferenceVertexWorkforceUserProject": { "type": "string", "pattern": "^[a-z0-9][a-z0-9.:-]*$", "title": "Workforce Identity billing project", "description": "GCP project for STS billing and quota. Defaults to the Vertex project ID above.", "x-flatKey": "inferenceVertexWorkforceUserProject", "x-availableInVersion": "1.10628.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "inferenceVertexWorkforceAuthFlow": { "type": "string", "enum": [ "browser", "broker" ], "title": "Workforce Identity sign-in flow", "description": "How the IdP sign-in runs: system browser (default) or the OS Microsoft Entra broker.", "x-flatKey": "inferenceVertexWorkforceAuthFlow", "x-availableInVersion": "1.25927.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "inferenceVertexWorkforceOidc": { "type": "object", "properties": { "clientId": { "type": "string", "minLength": 1, "title": "Client ID", "description": "OAuth client ID of the desktop app registration at your identity provider (public client, PKCE).", "x-consentRequired": false }, "issuer": { "title": "Issuer URL", "description": "HTTPS issuer with OIDC discovery. Set this, or set the authorization and token URLs instead.", "x-consentRequired": false, "type": "string", "format": "uri" }, "authorizationUrl": { "title": "Authorization URL", "description": "HTTPS authorization endpoint. Used with the token URL when no issuer is set.", "x-consentRequired": false, "type": "string", "format": "uri" }, "tokenUrl": { "title": "Token URL", "description": "HTTPS token endpoint. Used with the authorization URL when no issuer is set.", "x-consentRequired": false, "type": "string", "format": "uri" }, "scopes": { "title": "Scopes", "description": "Space-separated scopes. Defaults to openid profile email offline_access.", "x-consentRequired": false, "type": "string", "minLength": 1 }, "redirectPort": { "title": "Redirect port", "description": "Fixed loopback port for the sign-in redirect. Leave unset to use a free port each time.", "x-consentRequired": false, "type": "integer", "minimum": 1024, "maximum": 65535 }, "redirectHost": { "title": "Redirect host", "description": "Use localhost only if your IdP’s registered redirect URI specifies it.", "x-consentRequired": false, "type": "string", "enum": [ "127.0.0.1", "localhost" ], "x-availableInVersionOverride": "2.110.0" }, "omitOfflineAccess": { "title": "Omit offline_access", "description": "Only enable if your IdP rejects the offline_access scope on this client. Without it the app prompts for sign-in each time the token expires.", "x-consentRequired": false, "type": "boolean", "x-availableInVersionOverride": "1.17377.1" }, "additionalRedirectReferrerHosts": { "title": "Additional redirect referrer hosts", "description": "Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host.", "x-consentRequired": false, "type": "string", "x-availableInVersionOverride": "1.20186.0" } }, "required": [ "clientId" ], "title": "Workforce Identity IdP (OIDC)", "description": "Your organization’s OIDC IdP. The app runs an authorization-code-with-PKCE flow against this issuer and exchanges the returned ID token at GCP STS.", "x-flatKey": "inferenceVertexWorkforceOidc", "x-availableInVersion": "1.10628.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "inferenceVertexCredentialsFile": { "type": "string", "title": "GCP credentials file path", "description": "Absolute path to service-account JSON. Leave blank to fall back to ADC.", "x-flatKey": "inferenceVertexCredentialsFile", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "inferenceFoundryResource": { "type": "string", "pattern": "^[a-z0-9][a-z0-9-]{0,62}[a-z0-9]$", "title": "Azure AI Foundry resource name", "description": "Azure AI Foundry resource name used to construct the endpoint URL.", "x-flatKey": "inferenceFoundryResource", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "inferenceFoundryBaseUrl": { "type": "string", "format": "uri", "title": "Azure AI Foundry base URL", "description": "Full base URL for a gateway or proxy in front of Foundry, path included (replaces https://RESOURCE.services.ai.azure.com/anthropic).", "x-consentRequired": true, "x-flatKey": "inferenceFoundryBaseUrl", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "2.110.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-originPinned": "local-credential" }, "inferenceFoundryApiKey": { "type": "string", "title": "Azure AI Foundry API key", "description": "API key for Azure AI Foundry inference.", "x-flatKey": "inferenceFoundryApiKey", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "inferenceFoundryTenantId": { "type": "string", "minLength": 1, "title": "Entra ID tenant ID", "description": "Directory (tenant) ID of the Entra ID app registration that has the Cognitive Services scope.", "x-flatKey": "inferenceFoundryTenantId", "x-availableInVersion": "1.9255.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "inferenceFoundryClientId": { "type": "string", "minLength": 1, "title": "Entra ID client ID", "description": "Application (client) ID of the Entra ID app registration. Device-code sign-in requires the app to allow public client flows.", "x-flatKey": "inferenceFoundryClientId", "x-availableInVersion": "1.9255.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "inferenceFoundryAuthFlow": { "type": "string", "enum": [ "device-code", "browser", "broker" ], "title": "Entra ID sign-in flow", "description": "How Entra sign-in runs: device code (default), system browser, or the OS identity broker.", "x-flatKey": "inferenceFoundryAuthFlow", "x-availableInVersion": "1.19367.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-valueAvailableInVersionOverride": [ { "value": "broker", "availableInVersion": "1.24012.0" } ] }, "otlpEndpoint": { "type": "string", "format": "uri", "title": "OpenTelemetry collector endpoint", "description": "Where OpenTelemetry logs and metrics are sent. Leave blank to disable.", "x-flatKey": "otlpEndpoint", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "otlpProtocol": { "type": "string", "enum": [ "http/protobuf", "http/json", "grpc" ], "title": "OpenTelemetry exporter protocol", "description": "Transport protocol for the OpenTelemetry exporters.", "default": "http/protobuf", "x-flatKey": "otlpProtocol", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "otlpHeaders": { "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "string" }, "title": "OpenTelemetry exporter headers", "description": "Static collector headers — routing and tenant headers only. No credentials here; use Collector authentication or the headers helper script for tokens.", "x-flatKey": "otlpHeaders", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-deprecations": [ { "path": "otlpHeaders as a \"Name=value,…\" string or a [\"Name: value\", …] list", "use": "a JSON object such as {\"Name\": \"value\"}", "effect": "a string or list value will be rejected as malformed and no exporter headers will be sent", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ] }, "otlpAuthMode": { "type": "string", "enum": [ "none", "inference-credential" ], "title": "Collector authentication", "description": "inference-credential sends the user’s inference bearer token to the collector as Authorization: Bearer.", "x-flatKey": "otlpAuthMode", "x-availableInVersion": "1.30096.1", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "otlpHeadersHelper": { "type": "string", "minLength": 1, "title": "OpenTelemetry headers helper script", "description": "Absolute path to an executable that prints a JSON object of collector headers. Merged over the static headers and Collector authentication; the helper wins.", "x-flatKey": "otlpHeadersHelper", "x-availableInVersion": "1.30096.1", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "otlpResourceAttributes": { "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "string" }, "title": "OpenTelemetry resource attributes", "description": "Extra resource attributes to attach to every span/metric. A static enduser.id set here always wins over the runtime identity.", "x-flatKey": "otlpResourceAttributes", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.5354.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-deprecations": [ { "path": "otlpResourceAttributes as a \"Name=value,…\" string or a [\"Name: value\", …] list", "use": "a JSON object such as {\"Name\": \"value\"}", "effect": "a string or list value will be rejected as malformed and no custom resource attributes will be attached", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ] }, "otlpDesktopLogLevel": { "type": "string", "enum": [ "off", "error", "warn", "info", "debug" ], "title": "Desktop telemetry export level", "description": "Controls the Claude Desktop application’s events, separate from Cowork and Code sessions. Defaults to error.", "default": "error", "x-flatKey": "otlpDesktopLogLevel", "x-availableInVersion": "1.9255.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "otlpContentCapture": { "type": "array", "items": { "anyOf": [ { "type": "string", "enum": [ "userPrompts", "assistantResponses", "toolDetails", "toolContent", "rawApiBodies" ] }, { "type": "string" } ], "description": "Known values are listed; a client ignores a value it does not know, so a newer client's vocabulary is storable as is." }, "title": "Content capture categories", "description": "Content categories the desktop exporter sends unredacted to your collector. Leave empty to redact all content (default).", "x-flatKey": "otlpContentCapture", "x-availableInVersion": "1.15962.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "otlpTracesEnabled": { "type": "boolean", "title": "Export traces", "description": "Also export OpenTelemetry traces from Cowork tasks and Code sessions. Uses Claude Code’s session tracing.", "x-flatKey": "otlpTracesEnabled", "x-availableInVersion": "1.22209.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "inferenceMaxTokensPerWindow": { "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991, "title": "Max tokens per window", "description": "Per-user soft cap, counted client-side over the token cap window. Not a server-enforced quota.", "x-flatKey": "inferenceMaxTokensPerWindow", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "inferenceTokenWindowHours": { "type": "integer", "exclusiveMinimum": 0, "maximum": 720, "title": "Token cap window", "description": "Tumbling window length for the token cap. Max 720 hours (30 days).", "x-flatKey": "inferenceTokenWindowHours", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "coworkTabEnabled": { "type": "boolean", "title": "Allow Cowork", "description": "Enable Cowork. Claude works on longer tasks like research, analysis, and documents.", "default": true, "x-flatKey": "coworkTabEnabled", "x-availableInVersion": "1.9659.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "isClaudeCodeForDesktopEnabled": { "type": "boolean", "title": "Allow Code", "description": "Enable Code. Claude writes and runs code.", "default": true, "x-flatKey": "isClaudeCodeForDesktopEnabled", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "sshHostAllowlist": { "type": "array", "items": { "type": "string", "minLength": 1 }, "title": "SSH host allowlist", "description": "SSH hosts users may connect to for Code sessions. Empty or unset: off unless the device’s Claude Code managed-settings allowlist applies. * allows any host.", "x-flatKey": "sshHostAllowlist", "x-availableInVersion": "1.40609.0", "x-availability": "both", "x-deprecated": false, "x-beta": true, "x-consentRequired": false, "x-originPinned": false }, "sshClientPath": { "type": "string", "minLength": 1, "title": "SSH client program", "description": "Absolute path to the OpenSSH ssh program the app runs for SSH sessions. Unset: the first ssh on the user’s PATH.", "x-flatKey": "sshClientPath", "x-availableInVersion": "1.46388.1", "x-availability": "both", "x-deprecated": false, "x-beta": true, "x-consentRequired": true, "x-originPinned": false }, "sshTransport": { "type": "string", "enum": [ "auto", "system-openssh", "builtin" ], "title": "SSH connection engine", "description": "Which SSH engine carries Code sessions: the OpenSSH ssh program on the device, or the app’s built-in SSH library. Unset or auto: the build’s default.", "x-flatKey": "sshTransport", "x-availableInVersion": "1.52386.0", "x-availability": "both", "x-deprecated": false, "x-beta": true, "x-consentRequired": false, "x-originPinned": false }, "chatTabEnabled": { "type": "boolean", "title": "Allow Chat", "description": "Enable Chat. Quick questions and drafting.", "x-flatKey": "chatTabEnabled", "x-availableInVersion": "1.13576.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "chatAdvancedFileAnalysisEnabled": { "type": "boolean", "title": "Advanced file analysis", "description": "Allow Claude to run code in a local sandbox to analyze attached files it can’t read natively — like Excel and PowerPoint. Off by default.", "x-flatKey": "chatAdvancedFileAnalysisEnabled", "x-availableInVersion": "1.14271.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "chatSessionRetentionDays": { "type": "integer", "minimum": 1, "maximum": 3650, "title": "Chat retention period", "description": "Delete chats, with their files, after this many days without activity. Unset: kept until the user deletes them. Projects and memory stay.", "x-flatKey": "chatSessionRetentionDays", "x-availableInVersion": "1.52386.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "coworkSessionRetentionDays": { "type": "integer", "minimum": 1, "maximum": 3650, "title": "Cowork retention period", "description": "Delete Cowork tasks, with their uploads and outputs, after this many days without activity. Unset: kept until the user deletes them. Spaces and memory stay.", "x-flatKey": "coworkSessionRetentionDays", "x-availableInVersion": "1.52386.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "codeSessionRetentionDays": { "type": "integer", "minimum": 1, "maximum": 3650, "title": "Code retention period", "description": "Delete Code sessions, conversation included, after this many days without activity. Unset: kept until the user deletes them. Uncommitted work stays on disk.", "x-flatKey": "codeSessionRetentionDays", "x-availableInVersion": "1.52386.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "sessionRetentionHold": { "type": "boolean", "title": "Suspend session deletion", "description": "Suspend all automatic session deletion for these users (legal hold). While on, the retention periods above delete nothing.", "x-flatKey": "sessionRetentionHold", "x-availableInVersion": "1.52386.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "isDesktopExtensionEnabled": { "type": "boolean", "title": "Allow desktop extensions", "description": ".dxt and .mcpb installs.", "default": false, "x-flatKey": "isDesktopExtensionEnabled", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-legacyFlatKey": "isDxtEnabled", "x-deprecations": [ { "path": "isDxtEnabled", "use": "isDesktopExtensionEnabled", "effect": "the old name will be reported as unreadable and the key will read as false: desktop extensions will be disabled until the name is updated", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ] }, "isDesktopExtensionSignatureRequired": { "type": "boolean", "title": "Require signed extensions", "description": "Reject desktop extensions that are not signed by a trusted publisher.", "default": false, "x-flatKey": "isDesktopExtensionSignatureRequired", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-legacyFlatKey": "isDxtSignatureRequired", "x-deprecations": [ { "path": "isDxtSignatureRequired", "use": "isDesktopExtensionSignatureRequired", "effect": "the old name will be reported as unreadable and the key will read as true: only signed extensions will load until the name is updated", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ] }, "disableAutoUpdates": { "type": "boolean", "title": "Block auto-updates", "description": "Stop Claude Desktop from fetching updates entirely (no time limit). You’ll need to push new versions yourself.", "default": false, "x-flatKey": "disableAutoUpdates", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "autoUpdaterEnforcementHours": { "type": "integer", "exclusiveMinimum": 0, "maximum": 72, "title": "Auto-update enforcement window", "description": "Hours before a downloaded update force-installs. Only applies when auto-updates are enabled. Blank = 72-hour default.", "x-flatKey": "autoUpdaterEnforcementHours", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "updateViaUpdatesHost": { "type": "boolean", "title": "Check for updates on releases.claude.com", "description": "Read the update feed from releases.claude.com so api.anthropic.com can stay blocked.", "default": false, "x-flatKey": "updateViaUpdatesHost", "x-availableInVersion": "1.26832.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "disableFeatureDiscovery": { "type": "boolean", "title": "Hide feature announcements", "description": "Suppress unprompted feature-announcement UI: the post-update “What’s new” nudge and new-feature tips. Users can still open release notes themselves.", "default": false, "x-flatKey": "disableFeatureDiscovery", "x-availableInVersion": "1.21459.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "relaunchEnforcementHours": { "type": "integer", "minimum": 0, "maximum": 336, "title": "Configuration relaunch window", "description": "Hours a user may keep working on the old configuration after a managed-configuration change is detected. 0 = restart required at once. Blank = 24 hours.", "default": 24, "x-flatKey": "relaunchEnforcementHours", "x-availableInVersion": "1.40609.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "configRecheckIntervalMinutes": { "type": "integer", "minimum": 2, "maximum": 30, "title": "Configuration re-check interval", "description": "Minutes between the running app’s checks for a changed managed configuration. Blank = 10 minutes.", "default": 10, "x-flatKey": "configRecheckIntervalMinutes", "x-availableInVersion": "1.46388.1", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "modelDiscoveryEnabled": { "type": "boolean", "title": "Model discovery", "description": "Auto-populate the model picker from the provider at launch.", "x-flatKey": "modelDiscoveryEnabled", "x-availableInVersion": "1.8089.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "modelPrefer1mContext": { "type": "boolean", "title": "Default to 1M context", "description": "When a user has no saved selection, start the picker on the 1M-context variant of the default model if it offers one.", "x-flatKey": "modelPrefer1mContext", "x-availableInVersion": "1.28929.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "inferenceModels": { "minItems": 1, "type": "array", "items": { "anyOf": [ { "type": "string", "minLength": 1 }, { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "title": "Model ID", "description": "Model ID exactly as the provider expects it. The first entry is the default model.", "x-consentRequired": false }, "labelOverride": { "type": "string", "title": "Display name", "description": "Shown in the model picker. Leave blank to auto-format from the ID.", "x-consentRequired": false }, "supports1m": { "type": "boolean", "title": "Offer 1M-context variant", "description": "Adds a 1M-context variant of this model to the picker. Set only if the deployment accepts 1M-token context for it.", "x-consentRequired": false }, "prefer1m": { "type": "boolean", "title": "Default to 1M context", "description": "Make the 1M-context variant the default picker selection when this model is the default (first) entry. Users can still choose the standard variant.", "x-consentRequired": false, "x-availableInVersionOverride": "1.21459.0" }, "anthropicFamilyTier": { "type": "string", "enum": [ "sonnet", "opus", "haiku", "fable", "mythos" ], "title": "Tier alias", "description": "Which Claude tier this model stands in for. Pins the bare alias (e.g. ‘opus’) and, for opus/fable, the refusal fallback.", "x-consentRequired": false, "x-availableInVersionOverride": "1.13576.0" }, "isFamilyDefault": { "type": "boolean", "title": "Default for tier", "description": "When several models share a tier alias, marks this one as the model the alias resolves to. Otherwise the first listed wins.", "x-consentRequired": false, "x-availableInVersionOverride": "1.13576.0" }, "maxEffort": { "type": "string", "enum": [ "low", "medium", "high", "xhigh", "max" ], "title": "Max effort", "description": "Highest effort level offered for this model; higher levels are hidden and never requested by Claude Desktop. An unrecognized value caps the model at low.", "x-consentRequired": false, "x-availableInVersionOverride": "2.110.0" } }, "required": [ "name" ] } ] }, "title": "Model list", "description": "Override the auto-discovered model list. First entry is the default.", "x-flatKey": "inferenceModels", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "defaultModelEffort": { "type": "string", "enum": [ "low", "medium", "high", "xhigh", "max" ], "title": "Default model effort", "description": "Effort level the default model (the first listed model) starts at, instead of Anthropic’s recommended level: low, medium, high, xhigh or max.", "x-flatKey": "defaultModelEffort", "x-availableInVersion": "2.110.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "alwaysStartWithDefaultModel": { "type": "boolean", "title": "Always start with the default model", "description": "When true, each new conversation or task starts on the default model, and a person’s model and effort changes are no longer saved as their default.", "x-flatKey": "alwaysStartWithDefaultModel", "x-availableInVersion": "2.110.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "inferenceModelPricingEnabled": { "type": "boolean", "title": "Show estimated cost", "description": "Show an estimated cost on the Usage page at Anthropic list price; turn on to set a multiplier or per-model rates.", "x-flatKey": "inferenceModelPricingEnabled", "x-availableInVersion": "1.37937.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "inferenceModelPricingMultiplier": { "type": "number", "exclusiveMinimum": 0, "maximum": 1, "title": "Price multiplier", "description": "Scales every estimated cost (0.85 = 85% of the price); between 0 and 1.", "x-flatKey": "inferenceModelPricingMultiplier", "x-availableInVersion": "1.37937.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "inferenceModelPricing": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "title": "Model ID", "description": "A model ID from the list above, or any other ID or alias your provider serves. A built-in Claude ID also covers its dated and provider forms.", "x-consentRequired": false }, "inputPerMtok": { "type": "number", "minimum": 0, "maximum": 10000, "title": "Input", "description": "USD per million input tokens.", "x-consentRequired": false }, "outputPerMtok": { "type": "number", "minimum": 0, "maximum": 10000, "title": "Output", "description": "USD per million output tokens.", "x-consentRequired": false }, "cacheReadPerMtok": { "type": "number", "minimum": 0, "maximum": 10000, "title": "Cache read", "description": "USD per million prompt-cache read tokens.", "x-consentRequired": false }, "cacheWritePerMtok": { "type": "number", "minimum": 0, "maximum": 10000, "title": "Cache write", "description": "USD per million prompt-cache write tokens (5-minute and 1-hour writes alike).", "x-consentRequired": false } }, "required": [ "name", "inputPerMtok", "outputPerMtok", "cacheReadPerMtok", "cacheWritePerMtok" ] }, "title": "Model pricing", "description": "Per-model rates replacing Anthropic list price in the Usage page’s estimate.", "x-flatKey": "inferenceModelPricing", "x-availableInVersion": "1.37937.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "modelCatalogEnabled": { "type": "boolean", "title": "Model catalog metadata", "description": "Label and describe the model picker’s entries from the published Claude Code model catalog, instead of the app’s built-in table.", "x-flatKey": "modelCatalogEnabled", "x-availableInVersion": "2.110.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "modelCatalogUrl": { "type": "string", "format": "uri", "title": "Model catalog URL", "description": "Fetch the model catalog and its signature file from this URL (a mirror inside your network serving Anthropic’s published files) instead of downloads.claude.ai.", "x-consentRequired": false, "x-flatKey": "modelCatalogUrl", "x-availableInVersion": "2.110.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-originPinned": false }, "orgPluginSettings": { "type": "array", "items": { "anyOf": [ { "type": "object", "properties": { "serverName": { "type": "string", "minLength": 1, "title": "Server name", "description": "Name of the plugin-delivered MCP server this policy applies to.", "x-consentRequired": false, "x-availableInVersionOverride": "1.15200.0" }, "tools": { "type": "array", "items": { "anyOf": [ { "type": "object", "properties": { "toolName": { "type": "string", "minLength": 1, "title": "Tool", "description": "MCP tool name as the server reports it.", "x-consentRequired": false }, "permission": { "type": "string", "enum": [ "allow", "ask", "ask-session", "blocked" ], "title": "Permission", "description": "Approval state locked for this tool. Unlisted tools stay user-controlled.", "x-consentRequired": false, "x-deprecatedValues": [ { "value": "ask-session", "use": "ask", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ], "x-valueAvailableInVersionOverride": [ { "value": "ask-session", "availableInVersion": "1.21459.0" } ] } }, "required": [ "toolName", "permission" ] }, { "type": "null" } ] }, "title": "Tool policy", "description": "Per-tool approval locks for this server.", "x-consentRequired": false, "x-availableInVersionOverride": "1.15200.0" } }, "required": [ "serverName" ] }, { "type": "null" } ] }, "title": "Organization plugin settings", "description": "Admin policy applied to plugin-delivered MCP servers.", "x-flatKey": "orgPluginSettings", "x-availableInVersion": "1.8089.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-deprecations": [ { "path": "orgPluginSettings as a {\"mcpServers\": {…}} record", "use": "the array form [{\"serverName\": \"…\", \"tools\": [{\"toolName\": \"…\", \"permission\": \"…\"}]}] (read by desktop 1.15200.0 and later; older desktops ignore the array and enforce no tool blocks)", "effect": "the record will be rejected as malformed and the key will fail closed: every plugin-delivered MCP tool will be blocked until the value is rewritten", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" }, { "path": "orgPluginSettings[].tools[].permission: \"ask-session\"", "use": "\"ask\"", "effect": "that tool will be treated as \"blocked\", like any unrecognized permission", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ] }, "allowedPluginMarketplaces": { "type": "array", "items": { "anyOf": [ { "oneOf": [ { "type": "object", "properties": { "source": { "type": "string", "const": "github", "title": "Source", "description": "Where the marketplace is fetched from: a GitHub repository (set repo), any Git remote (set url), or a hosted marketplace.json file (set url).", "x-consentRequired": false }, "repo": { "type": "string", "pattern": "^[^\\s/]+\\/[^\\s/]+$", "title": "Repository", "description": "GitHub repository in owner/repo form. Case-insensitive.", "x-consentRequired": false }, "ref": { "title": "Ref", "description": "Commit SHA, branch, or tag. Leave empty to track the default branch; auto_install and required need a full 40-character commit SHA.", "x-consentRequired": false, "type": "string", "minLength": 1 }, "path": { "title": "Subpath", "description": "Folder within the repository that contains the marketplace, when it isn’t at the root.", "x-consentRequired": false, "type": "string", "minLength": 1 }, "expectedName": { "title": "Expected name", "description": "Rejects the marketplace if its manifest name differs.", "x-consentRequired": false, "type": "string", "pattern": "^[A-Za-z0-9](?:[A-Za-z0-9._-]{0,126}[A-Za-z0-9_-])?$" }, "installationPreference": { "title": "Installation", "description": "Whether users install plugins themselves or get them automatically.", "x-consentRequired": false, "type": "string", "enum": [ "available", "auto_install", "required" ] }, "credentialKind": { "title": "Auth", "description": "How fetches authenticate: anonymously, with the user’s git credentials, via a helper executable, or as the app does to its gateway or bootstrap server (url).", "x-consentRequired": false, "type": "string", "enum": [ "anonymous", "userGit", "credentialHelper" ] }, "credentialHelper": { "title": "Credential helper", "description": "Executable that prints an access token for this marketplace.", "x-consentRequired": true, "type": "string", "minLength": 1 } }, "required": [ "source", "repo" ] }, { "type": "object", "properties": { "source": { "type": "string", "const": "git", "title": "Source", "description": "Where the marketplace is fetched from: a GitHub repository (set repo), any Git remote (set url), or a hosted marketplace.json file (set url).", "x-consentRequired": false }, "url": { "title": "URL", "description": "HTTPS Git remote of the marketplace repository (git), or direct HTTPS URL of a hosted marketplace.json file (url).", "x-consentRequired": false, "type": "string", "format": "uri" }, "ref": { "title": "Ref", "description": "Commit SHA, branch, or tag. Leave empty to track the default branch; auto_install and required need a full 40-character commit SHA.", "x-consentRequired": false, "type": "string", "minLength": 1 }, "path": { "title": "Subpath", "description": "Folder within the repository that contains the marketplace, when it isn’t at the root.", "x-consentRequired": false, "type": "string", "minLength": 1 }, "expectedName": { "title": "Expected name", "description": "Rejects the marketplace if its manifest name differs.", "x-consentRequired": false, "type": "string", "pattern": "^[A-Za-z0-9](?:[A-Za-z0-9._-]{0,126}[A-Za-z0-9_-])?$" }, "installationPreference": { "title": "Installation", "description": "Whether users install plugins themselves or get them automatically.", "x-consentRequired": false, "type": "string", "enum": [ "available", "auto_install", "required" ] }, "credentialKind": { "title": "Auth", "description": "How fetches authenticate: anonymously, with the user’s git credentials, via a helper executable, or as the app does to its gateway or bootstrap server (url).", "x-consentRequired": false, "type": "string", "enum": [ "anonymous", "userGit", "credentialHelper" ] }, "credentialHelper": { "title": "Credential helper", "description": "Executable that prints an access token for this marketplace.", "x-consentRequired": true, "type": "string", "minLength": 1 } }, "required": [ "source", "url" ] }, { "type": "object", "properties": { "source": { "type": "string", "const": "url", "title": "Source", "description": "Where the marketplace is fetched from: a GitHub repository (set repo), any Git remote (set url), or a hosted marketplace.json file (set url).", "x-consentRequired": false, "x-valueAvailableInVersionOverride": [ { "value": "url", "availableInVersion": "1.32352.0" } ] }, "url": { "title": "URL", "description": "HTTPS Git remote of the marketplace repository (git), or direct HTTPS URL of a hosted marketplace.json file (url).", "x-consentRequired": false, "type": "string", "format": "uri" }, "manifestSha256": { "type": "string", "pattern": "^[0-9a-fA-F]{64}$", "title": "Manifest SHA-256", "description": "SHA-256 of the exact marketplace.json to accept. Without it auto_install and required act as available; a served manifest with any other digest is refused.", "x-consentRequired": false, "x-availableInVersionOverride": "1.32352.0" }, "expectedName": { "title": "Expected name", "description": "Rejects the marketplace if its manifest name differs.", "x-consentRequired": false, "type": "string", "pattern": "^[A-Za-z0-9](?:[A-Za-z0-9._-]{0,126}[A-Za-z0-9_-])?$" }, "installationPreference": { "title": "Installation", "description": "Whether users install plugins themselves or get them automatically.", "x-consentRequired": false, "type": "string", "enum": [ "available", "auto_install", "required" ] }, "credentialKind": { "type": "string", "enum": [ "anonymous", "userGit", "credentialHelper", "inferenceCredential" ], "title": "Auth", "description": "How fetches authenticate: anonymously, with the user’s git credentials, via a helper executable, or as the app does to its gateway or bootstrap server (url).", "x-consentRequired": false, "x-valueAvailableInVersionOverride": [ { "value": "inferenceCredential", "availableInVersion": "1.32352.0" } ] }, "credentialHelper": { "title": "Credential helper", "description": "Executable that prints an access token for this marketplace.", "x-consentRequired": true, "type": "string", "minLength": 1 } }, "required": [ "source", "url" ] } ] }, { "type": "null" } ] }, "title": "Plugin marketplaces", "description": "Git repositories or hosted marketplace.json URLs to surface as plugin marketplaces in the Directory’s Organization tab. The app re-fetches each periodically.", "x-flatKey": "allowedPluginMarketplaces", "x-availableInVersion": "1.17377.1", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "userPluginMarketplacesEnabled": { "type": "boolean", "title": "Allow user-added plugin marketplaces", "description": "Allow users to add plugin marketplaces themselves. When off, the add-marketplace surfaces are hidden and in-app adds are refused.", "x-flatKey": "userPluginMarketplacesEnabled", "x-availableInVersion": "1.37937.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "userPluginUploadsEnabled": { "type": "boolean", "title": "Allow user-added plugins", "description": "Allow users to add their own plugins. When off, every in-app option for adding one is hidden and uploads that still reach the app are refused.", "x-flatKey": "userPluginUploadsEnabled", "x-availableInVersion": "1.37937.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "deploymentOrganizationUuid": { "type": "string", "title": "Organization UUID", "description": "A UUID you generate. Tags telemetry so Anthropic support can locate your fleet’s events, and namespaces each user’s local data. Not used for auth.", "x-flatKey": "deploymentOrganizationUuid", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "disableEssentialTelemetry": { "type": "boolean", "title": "Block essential telemetry", "description": "Crash and performance reports to Anthropic.", "default": false, "x-flatKey": "disableEssentialTelemetry", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "disableNonessentialTelemetry": { "type": "boolean", "title": "Block nonessential telemetry", "description": "Product-usage analytics and diagnostic-report uploads. No message content.", "default": false, "x-flatKey": "disableNonessentialTelemetry", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "disableNonessentialServices": { "type": "boolean", "title": "Block nonessential services", "description": "Connector favicons and the artifact-preview and MCP Apps widget iframe origins. Artifacts will not render.", "default": false, "x-flatKey": "disableNonessentialServices", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "managedMcpServers": { "type": "array", "items": { "anyOf": [ { "anyOf": [ { "anyOf": [ { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "title": "Name", "description": "Unique name for this server. Shown to users and used to key tool policy and sign-in state.", "x-consentRequired": false }, "transport": { "not": {} }, "url": { "not": {} }, "command": { "not": {} }, "oauth": { "not": {} }, "headers": { "not": {} }, "headersHelper": { "not": {} }, "headersHelperTtlSec": { "not": {} }, "headersHelperRefreshBufferSec": { "not": {} }, "args": { "not": {} }, "env": { "not": {} }, "envHelper": { "not": {} }, "envHelperTtlSec": { "not": {} }, "startupTimeoutSec": { "not": {} }, "authorityHost": { "not": {} }, "server": { "type": "string", "const": "microsoft365", "title": "Server", "description": "Which bundled connector this entry turns on. Set instead of a transport; each built-in server has its own fields.", "x-consentRequired": false, "x-availableInVersionOverride": "1.19367.0" }, "tenantId": { "anyOf": [ { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$" }, { "enum": [ "common", "organizations", "consumers" ], "type": "string", "x-valueAvailableInVersionOverride": [ { "value": "common", "availableInVersion": "1.22209.0" }, { "value": "organizations", "availableInVersion": "1.22209.0" }, { "value": "consumers", "availableInVersion": "1.22209.0" } ] } ], "title": "Tenant ID", "description": "Your organization’s Microsoft Entra directory (tenant) ID.", "x-consentRequired": false, "x-availableInVersionOverride": "1.19367.0" }, "clientId": { "type": "string", "minLength": 1, "title": "Client ID", "description": "OAuth app client ID for this built-in server.", "x-consentRequired": false, "x-availableInVersionOverride": "1.19367.0" }, "azureCloud": { "title": "Azure cloud", "description": "Microsoft cloud for sign-in and Graph. Leave as global for commercial Microsoft 365; US Government clouds require your own app registration (Client ID).", "x-consentRequired": false, "type": "string", "enum": [ "global", "us-gov-high", "us-gov-dod" ], "x-availableInVersionOverride": "1.19367.0" }, "continuousAccessEvaluation": { "title": "Continuous Access Evaluation", "description": "Request CAE-capable Microsoft Graph tokens: long-lived (up to about 28 hours) but revocable within minutes. Set “disabled” to keep standard one-hour tokens.", "default": "enabled", "x-consentRequired": false, "type": "string", "enum": [ "enabled", "disabled" ], "x-availableInVersionOverride": "1.49585.0" }, "scope": { "title": "Access", "description": "What the server may request at sign-in. If blank, Desktop’s default read set is used.", "x-consentRequired": false, "type": "string", "x-availableInVersionOverride": "1.19367.0" }, "toolPolicy": { "title": "Tool policy", "description": "Lock the approval state for specific tools. Unlisted tools stay user-controlled.", "x-consentRequired": false, "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "string", "enum": [ "allow", "ask", "ask-session", "blocked" ], "x-deprecatedValues": [ { "value": "ask-session", "use": "ask", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ], "x-valueAvailableInVersionOverride": [ { "value": "ask-session", "availableInVersion": "1.21459.0" } ] } }, "scopes": { "not": {} } }, "required": [ "name", "server", "tenantId", "clientId" ] }, { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "title": "Name", "description": "Unique name for this server. Shown to users and used to key tool policy and sign-in state.", "x-consentRequired": false }, "transport": { "not": {} }, "url": { "not": {} }, "command": { "not": {} }, "oauth": { "not": {} }, "headers": { "title": "Headers", "description": "Static headers sent on every request — routing and tenant headers only. No credentials here; use the headers helper script for tokens and rotating values.", "x-consentRequired": false, "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "string" }, "x-availableInVersionOverride": "1.19367.0" }, "headersHelper": { "title": "Headers helper script", "description": "Script that prints the auth header as a JSON object to stdout. Runs before each request (cached for the TTL below).", "x-consentRequired": true, "type": "string", "minLength": 1, "x-availableInVersionOverride": "1.19367.0" }, "headersHelperTtlSec": { "title": "Helper cache TTL (sec)", "description": "How long the helper’s headers are reused before it runs again, in seconds. Defaults to 300.", "x-consentRequired": false, "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991, "x-availableInVersionOverride": "1.19367.0" }, "headersHelperRefreshBufferSec": { "title": "Helper refresh buffer (sec)", "description": "Seconds before the TTL expires at which the helper re-runs mid-session. Defaults to 60. Keep it larger than the helper’s typical runtime.", "x-consentRequired": false, "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991, "x-availableInVersionOverride": "1.21459.0" }, "args": { "not": {} }, "env": { "not": {} }, "envHelper": { "not": {} }, "envHelperTtlSec": { "not": {} }, "startupTimeoutSec": { "not": {} }, "server": { "type": "string", "const": "websearch", "title": "Server", "description": "Which bundled connector this entry turns on. Set instead of a transport; each built-in server has its own fields.", "x-consentRequired": false, "x-availableInVersionOverride": "1.19367.0" }, "provider": { "type": "string", "enum": [ "brave", "tavily", "exa", "custom" ], "title": "Search provider", "description": "Runs search from the desktop, for inference providers without native web search. Supply the provider’s API key through the headers helper script below.", "x-consentRequired": false, "x-availableInVersionOverride": "1.19367.0" }, "customUrl": { "title": "Custom URL", "description": "POST endpoint accepting {q} JSON and returning a results[] array. Only used when provider is Custom.", "x-consentRequired": false, "type": "string", "format": "uri", "x-availableInVersionOverride": "1.19367.0" }, "toolPolicy": { "title": "Tool policy", "description": "Lock the approval state for specific tools. Unlisted tools stay user-controlled.", "x-consentRequired": false, "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "string", "enum": [ "allow", "ask", "ask-session", "blocked" ], "x-deprecatedValues": [ { "value": "ask-session", "use": "ask", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ], "x-valueAvailableInVersionOverride": [ { "value": "ask-session", "availableInVersion": "1.21459.0" } ] } } }, "required": [ "name", "server", "provider" ] }, { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "title": "Name", "description": "Unique name for this server. Shown to users and used to key tool policy and sign-in state.", "x-consentRequired": false }, "transport": { "not": {} }, "url": { "not": {} }, "command": { "not": {} }, "oauth": { "not": {} }, "headers": { "not": {} }, "headersHelper": { "not": {} }, "headersHelperTtlSec": { "not": {} }, "headersHelperRefreshBufferSec": { "not": {} }, "args": { "not": {} }, "env": { "not": {} }, "envHelper": { "not": {} }, "envHelperTtlSec": { "not": {} }, "startupTimeoutSec": { "not": {} }, "server": { "type": "string", "const": "github", "title": "Server", "description": "Which bundled connector this entry turns on. Set instead of a transport; each built-in server has its own fields.", "x-consentRequired": false, "x-availableInVersionOverride": "1.25927.0" }, "clientId": { "type": "string", "title": "Client ID", "description": "GitHub OAuth app client ID (device flow must be enabled on the app).", "x-consentRequired": false, "x-availableInVersionOverride": "1.25927.0" }, "host": { "type": "string", "format": "uri", "title": "GitHub Enterprise Server URL", "description": "Leave blank for github.com. For GitHub Enterprise Server, your instance’s base URL.", "x-consentRequired": false, "x-availableInVersionOverride": "1.25927.0" }, "scope": { "type": "string", "title": "Access", "description": "Space-separated GitHub OAuth scopes. If blank, Desktop’s default read set is used. Ignored for GitHub Apps (permissions come from the app registration).", "x-consentRequired": false, "x-availableInVersionOverride": "1.25927.0" }, "toolsets": { "type": "string", "title": "Toolsets", "description": "Comma-separated github-mcp-server toolsets to enable. If blank, the bundled server’s default toolsets are used.", "x-consentRequired": false, "x-availableInVersionOverride": "1.25927.0" }, "readOnly": { "type": "boolean", "title": "Read-only", "description": "Offer only read tools — the server registers no write tools at all.", "x-consentRequired": false, "x-availableInVersionOverride": "1.25927.0" }, "toolPolicy": { "title": "Tool policy", "description": "Lock the approval state for specific tools. Unlisted tools stay user-controlled.", "x-consentRequired": false, "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "string", "enum": [ "allow", "ask", "ask-session", "blocked" ], "x-deprecatedValues": [ { "value": "ask-session", "use": "ask", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ], "x-valueAvailableInVersionOverride": [ { "value": "ask-session", "availableInVersion": "1.21459.0" } ] } }, "scopes": { "not": {} } }, "required": [ "name", "server", "clientId" ] } ] }, { "oneOf": [ { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "title": "Name", "description": "Unique name for this server. Shown to users and used to key tool policy and sign-in state.", "x-consentRequired": false }, "server": { "not": {} }, "transport": { "type": "string", "enum": [ "http", "sse" ], "title": "Transport", "description": "How the app connects: Streamable HTTP, legacy SSE, or a local command (stdio). policy-only connects to nothing; it only sets a plugin server’s tool policy.", "x-consentRequired": false }, "url": { "type": "string", "format": "uri", "title": "URL", "description": "HTTPS endpoint of the remote MCP server.", "x-consentRequired": false }, "oauth": { "anyOf": [ { "type": "boolean", "const": true }, { "type": "object", "properties": { "scope": { "title": "Scope", "description": "Space-separated scopes sent on the authorize request. Leave unset to use the scopes the server advertises. Required when Tenant ID is set.", "x-consentRequired": false, "type": "string", "minLength": 1 }, "appendOfflineAccess": { "title": "Request offline_access", "description": "Adds offline_access to the authorize request so the IdP returns a refresh token for silent renewal.", "x-consentRequired": false, "type": "boolean", "x-availableInVersionOverride": "1.13576.0" }, "scopes": { "not": {} }, "additionalRedirectReferrerHosts": { "title": "Additional redirect referrer hosts", "description": "Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host.", "x-consentRequired": false, "type": "string", "x-availableInVersionOverride": "1.24012.0" } } }, { "type": "object", "properties": { "clientId": { "type": "string", "minLength": 1 }, "clientSecret": { "title": "Client secret", "description": "Only for IdPs whose token endpoint requires a client secret (e.g. Box). Leave blank for PKCE-only public clients.", "x-consentRequired": false, "type": "string", "minLength": 1 }, "clientSecretHelper": { "title": "Client secret helper script", "description": "Executable that prints the client secret on stdout as a JSON object with a single clientSecret key; any other output is rejected. Overrides the inline value.", "x-consentRequired": true, "type": "string", "minLength": 1, "x-availableInVersionOverride": "1.19367.0" }, "authorizationServer": { "title": "Authorization server", "description": "Issuer URLs the OAuth sign-in may use, as a JSON array. Pre-filled by presets; ask your IdP admin if unsure.", "x-consentRequired": false, "minItems": 1, "type": "array", "items": { "type": "string", "format": "uri" } }, "authorizationUrl": { "title": "Authorization URL", "description": "Only for IdPs that don’t serve a .well-known discovery document. Set together with Token URL; requires Client ID.", "x-consentRequired": false, "type": "string", "format": "uri", "x-availableInVersionOverride": "1.24012.0" }, "tokenUrl": { "title": "Token URL", "description": "Only for IdPs that don’t serve a .well-known discovery document. Set together with Authorization URL; requires Client ID.", "x-consentRequired": false, "type": "string", "format": "uri", "x-availableInVersionOverride": "1.24012.0" }, "tenantId": { "title": "Tenant ID", "description": "Required for single-tenant Entra apps. Leave blank for multi-tenant or non-Microsoft IdPs.", "x-consentRequired": false, "anyOf": [ { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$" }, { "type": "string", "enum": [ "common", "organizations", "consumers" ] } ] }, "authFlow": { "title": "Sign-in flow", "description": "How Entra sign-in runs for this server: the system browser (default) or the OS identity broker.", "x-consentRequired": false, "type": "string", "enum": [ "browser", "broker" ], "x-availableInVersionOverride": "1.25927.0" }, "scope": { "title": "Scope", "description": "Space-separated scopes sent on the authorize request. Leave unset to use the scopes the server advertises. Required when Tenant ID is set.", "x-consentRequired": false, "type": "string", "minLength": 1 }, "appendOfflineAccess": { "title": "Request offline_access", "description": "Adds offline_access to the authorize request so the IdP returns a refresh token for silent renewal.", "x-consentRequired": false, "type": "boolean", "x-availableInVersionOverride": "1.13576.0" }, "callbackHost": { "title": "Callback host", "description": "Use localhost only if your IdP’s registered redirect URI specifies it.", "x-consentRequired": false, "type": "string", "enum": [ "127.0.0.1", "localhost" ] }, "callbackPort": { "title": "Callback port", "description": "Only set if your IdP requires an exact-match redirect port. Entra accepts any.", "x-consentRequired": false, "type": "integer", "minimum": 1024, "maximum": 65535 }, "additionalRedirectReferrerHosts": { "title": "Additional redirect referrer hosts", "description": "Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host.", "x-consentRequired": false, "type": "string", "x-availableInVersionOverride": "1.24012.0" }, "scopes": { "not": {} }, "mode": { "not": {} } }, "required": [ "clientId" ] }, { "oneOf": [ { "type": "object", "properties": { "mode": { "type": "string", "const": "dcr", "x-availableInVersionOverride": "1.15200.0" } }, "required": [ "mode" ] }, { "type": "object", "properties": { "mode": { "type": "string", "const": "byo", "x-availableInVersionOverride": "1.15200.0" }, "clientId": { "type": "string", "minLength": 1, "title": "Client ID", "description": "OAuth client ID from your IdP app registration. Leave unset to auto-register (dynamic client registration) and only narrow scopes.", "x-consentRequired": false }, "clientSecret": { "title": "Client secret", "description": "Only for IdPs whose token endpoint requires a client secret (e.g. Box). Leave blank for PKCE-only public clients.", "x-consentRequired": false, "type": "string", "minLength": 1 }, "clientSecretHelper": { "title": "Client secret helper script", "description": "Executable that prints the client secret on stdout as a JSON object with a single clientSecret key; any other output is rejected. Overrides the inline value.", "x-consentRequired": true, "type": "string", "minLength": 1, "x-availableInVersionOverride": "1.19367.0" }, "authorizationServer": { "title": "Authorization server", "description": "Issuer URLs the OAuth sign-in may use, as a JSON array. Pre-filled by presets; ask your IdP admin if unsure.", "x-consentRequired": false, "minItems": 1, "type": "array", "items": { "type": "string", "format": "uri" } }, "authorizationUrl": { "title": "Authorization URL", "description": "Only for IdPs that don’t serve a .well-known discovery document. Set together with Token URL; requires Client ID.", "x-consentRequired": false, "type": "string", "format": "uri", "x-availableInVersionOverride": "1.24012.0" }, "tokenUrl": { "title": "Token URL", "description": "Only for IdPs that don’t serve a .well-known discovery document. Set together with Authorization URL; requires Client ID.", "x-consentRequired": false, "type": "string", "format": "uri", "x-availableInVersionOverride": "1.24012.0" }, "tenantId": { "title": "Tenant ID", "description": "Required for single-tenant Entra apps. Leave blank for multi-tenant or non-Microsoft IdPs.", "x-consentRequired": false, "anyOf": [ { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$" }, { "type": "string", "enum": [ "common", "organizations", "consumers" ] } ] }, "authFlow": { "title": "Sign-in flow", "description": "How Entra sign-in runs for this server: the system browser (default) or the OS identity broker.", "x-consentRequired": false, "type": "string", "enum": [ "browser", "broker" ], "x-availableInVersionOverride": "1.25927.0" }, "scope": { "title": "Scope", "description": "Space-separated scopes sent on the authorize request. Leave unset to use the scopes the server advertises. Required when Tenant ID is set.", "x-consentRequired": false, "type": "string", "minLength": 1 }, "appendOfflineAccess": { "title": "Request offline_access", "description": "Adds offline_access to the authorize request so the IdP returns a refresh token for silent renewal.", "x-consentRequired": false, "type": "boolean", "x-availableInVersionOverride": "1.13576.0" }, "callbackHost": { "title": "Callback host", "description": "Use localhost only if your IdP’s registered redirect URI specifies it.", "x-consentRequired": false, "type": "string", "enum": [ "127.0.0.1", "localhost" ] }, "callbackPort": { "title": "Callback port", "description": "Only set if your IdP requires an exact-match redirect port. Entra accepts any.", "x-consentRequired": false, "type": "integer", "minimum": 1024, "maximum": 65535 }, "additionalRedirectReferrerHosts": { "title": "Additional redirect referrer hosts", "description": "Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host.", "x-consentRequired": false, "type": "string", "x-availableInVersionOverride": "1.24012.0" }, "scopes": { "not": {} } }, "required": [ "mode" ] }, { "type": "object", "properties": { "mode": { "type": "string", "const": "hosted", "x-availableInVersionOverride": "1.32885.1" }, "clientId": { "type": "string", "format": "uri", "title": "Client ID", "description": "Set by the Claude.ai control plane when it serves this configuration (the URL of Anthropic’s hosted client-metadata document); not authored.", "x-consentRequired": false, "x-availableInVersionOverride": "1.32885.1" }, "authorizationServer": { "minItems": 1, "type": "array", "items": { "type": "string", "format": "uri" }, "title": "Authorization server", "description": "The exact issuer string(s) the server’s OAuth authorization server advertises in its metadata, as a JSON array — matched exactly, including path and any trailing slash. Required: Anthropic signs the client identity only for an authorization server listed here.", "x-consentRequired": false, "x-availableInVersionOverride": "1.32885.1" }, "scope": { "title": "Scope", "description": "Space-separated scopes sent on the authorize request. Leave unset to use the scopes the server advertises. Required when Tenant ID is set.", "x-consentRequired": false, "type": "string", "minLength": 1 }, "scopes": { "not": {} } }, "required": [ "mode", "authorizationServer" ] } ] } ], "title": "OAuth", "description": "OAuth for a remote server: true to auto-register a client, a pre-registered client ID with tenant and scope, or mode “hosted” for an Anthropic-signed identity.", "x-consentRequired": false }, "headers": { "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "string" }, "title": "Headers", "description": "Static headers sent on every request — routing and tenant headers only. No credentials here; use the headers helper script for tokens and rotating values.", "x-consentRequired": false }, "headersHelper": { "type": "string", "minLength": 1, "title": "Headers helper script", "description": "Absolute path to an executable that prints a JSON object of HTTP headers on stdout. Merged over static headers; the helper wins on conflict.", "x-consentRequired": true, "x-availableInVersionOverride": "1.19367.0" }, "headersHelperTtlSec": { "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991, "title": "Helper cache TTL (sec)", "description": "How long the helper’s headers are reused before it runs again, in seconds. Defaults to 300.", "x-consentRequired": false, "x-availableInVersionOverride": "1.19367.0" }, "headersHelperRefreshBufferSec": { "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991, "title": "Helper refresh buffer (sec)", "description": "Seconds before the TTL expires at which the helper re-runs mid-session. Defaults to 60. Keep it larger than the helper’s typical runtime.", "x-consentRequired": false, "x-availableInVersionOverride": "1.21459.0" }, "toolPolicy": { "title": "Tool policy", "description": "Lock the approval state for specific tools. Unlisted tools stay user-controlled.", "x-consentRequired": false, "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "string", "enum": [ "allow", "ask", "ask-session", "blocked" ], "x-deprecatedValues": [ { "value": "ask-session", "use": "ask", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ], "x-valueAvailableInVersionOverride": [ { "value": "ask-session", "availableInVersion": "1.21459.0" } ] } } }, "required": [ "name", "transport", "url" ] }, { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "title": "Name", "description": "Unique name for this server. Shown to users and used to key tool policy and sign-in state.", "x-consentRequired": false }, "server": { "not": {} }, "transport": { "type": "string", "const": "stdio", "title": "Transport", "description": "How the app connects: Streamable HTTP, legacy SSE, or a local command (stdio). policy-only connects to nothing; it only sets a plugin server’s tool policy.", "x-consentRequired": false, "x-availableInVersionOverride": "1.19367.0" }, "command": { "type": "string", "minLength": 1, "title": "Command", "description": "Absolute path to the server executable, run on the user’s machine.", "x-consentRequired": true, "x-availableInVersionOverride": "1.19367.0" }, "args": { "type": "array", "items": { "type": "string" }, "title": "Arguments", "description": "Arguments passed to the command, one per entry.", "x-consentRequired": true, "x-availableInVersionOverride": "1.19367.0" }, "env": { "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "string" }, "title": "Environment variables", "description": "Environment variables set for the command.", "x-consentRequired": true, "x-availableInVersionOverride": "1.19367.0" }, "envHelper": { "type": "string", "minLength": 1, "title": "Environment helper script", "description": "Script that prints environment variables as a JSON object to stdout. Runs when the local server starts (cached for the TTL below).", "x-consentRequired": true, "x-availableInVersionOverride": "1.21459.0" }, "envHelperTtlSec": { "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991, "title": "Helper cache TTL (sec)", "description": "Maximum age of a cached helper result, in seconds (default 300). Applies when the server starts or restarts.", "default": 300, "x-consentRequired": false, "x-availableInVersionOverride": "1.21459.0" }, "startupTimeoutSec": { "type": "integer", "minimum": 5, "maximum": 600, "title": "Startup timeout", "description": "Maximum wait in seconds for the server to start and list its tools.", "default": 120, "x-consentRequired": false, "x-availableInVersionOverride": "1.19367.0" }, "toolPolicy": { "title": "Tool policy", "description": "Lock the approval state for specific tools. Unlisted tools stay user-controlled.", "x-consentRequired": false, "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "string", "enum": [ "allow", "ask", "ask-session", "blocked" ], "x-deprecatedValues": [ { "value": "ask-session", "use": "ask", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ], "x-valueAvailableInVersionOverride": [ { "value": "ask-session", "availableInVersion": "1.21459.0" } ] } } }, "required": [ "name", "transport", "command" ] }, { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "title": "Name", "description": "Unique name for this server. Shown to users and used to key tool policy and sign-in state.", "x-consentRequired": false }, "server": { "not": {} }, "transport": { "type": "string", "const": "policy-only", "title": "Transport", "description": "How the app connects: Streamable HTTP, legacy SSE, or a local command (stdio). policy-only connects to nothing; it only sets a plugin server’s tool policy.", "x-consentRequired": false, "x-availableInVersionOverride": "2.110.0" }, "url": { "not": {} }, "command": { "not": {} }, "oauth": { "not": {} }, "headers": { "not": {} }, "headersHelper": { "not": {} }, "headersHelperTtlSec": { "not": {} }, "headersHelperRefreshBufferSec": { "not": {} }, "args": { "not": {} }, "env": { "not": {} }, "envHelper": { "not": {} }, "envHelperTtlSec": { "not": {} }, "startupTimeoutSec": { "not": {} }, "toolPolicy": { "title": "Tool policy", "description": "Lock the approval state for specific tools. Unlisted tools stay user-controlled.", "x-consentRequired": false, "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "string", "enum": [ "allow", "ask", "ask-session", "blocked" ], "x-deprecatedValues": [ { "value": "ask-session", "use": "ask", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ], "x-valueAvailableInVersionOverride": [ { "value": "ask-session", "availableInVersion": "1.21459.0" } ] } } }, "required": [ "name", "transport" ] } ] } ] }, { "type": "null" } ] }, "title": "Managed MCP servers", "description": "Org-pushed MCP servers: remote (HTTP/SSE) or local (stdio command). May embed bearer tokens.", "x-flatKey": "managedMcpServers", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-deprecations": [ { "path": "managedMcpServers[].scopes", "use": "scope (one space-separated string, for example \"Mail.Read Calendars.Read\")", "effect": "the entry will be rejected as invalid and that connector will be unavailable until the entry is rewritten", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" }, { "path": "managedMcpServers[].toolPolicy: \"ask-session\"", "use": "\"ask\"", "effect": "the entry will be rejected as invalid and that connector will be unavailable until the entry is rewritten", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" }, { "path": "managedMcpServers[].transport: \"builtin\"", "effect": "the entry will be rejected as invalid and that connector will be unavailable until the entry is rewritten", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" }, { "path": "managedMcpServers[].authorityHost", "use": "azureCloud: \"us-gov-high\" for a GCC High tenant; otherwise nothing", "effect": "the entry will be rejected as invalid and that connector will be unavailable until the entry is rewritten — the Microsoft 365 connector will disappear rather than guess a cloud", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" }, { "path": "managedMcpServers[].source", "effect": "it will be treated as any unrecognised entry member — ignored by the desktop (the connector still loads; the app assigns each connector's provenance itself) and refused by a customer-run Apps Gateway serving the configuration", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" }, { "path": "managedMcpServers[].oauth as a number or string", "use": "true (automatic registration) or an oauth object", "effect": "it will be treated as any wrong-typed member: the entry will be rejected as invalid and that connector will be unavailable until the entry is rewritten", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" }, { "path": "managedMcpServers[].oauth.scopes (or oauth.scope as a list)", "use": "oauth.scope as one space-separated string, for example \"read write\"", "effect": "it will be treated as any wrong-typed member: the entry will be rejected as invalid and that connector will be unavailable until the entry is rewritten", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" }, { "path": "managedMcpServers[] entry without transport", "use": "transport: \"http\" (or \"sse\" / \"stdio\") on every entry that is not a built-in server", "effect": "the entry will be rejected as invalid and that connector will be unavailable until the entry is rewritten", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ] }, "mcpPersistentAlwaysAllowEnabled": { "type": "boolean", "title": "Allow persistent tool approvals", "description": "Offer the persistent “Always allow” approval options for MCP tools. Disable to keep tool approvals per-call or session-scoped only.", "default": true, "x-flatKey": "mcpPersistentAlwaysAllowEnabled", "x-availableInVersion": "1.24012.9", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "isLocalDevMcpEnabled": { "type": "boolean", "title": "Allow user-added MCP servers", "description": "Local stdio servers added via the Developer settings. Remote servers come from the managed list above or organization plugins.", "default": true, "x-flatKey": "isLocalDevMcpEnabled", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "mcpToolTimeoutSec": { "type": "integer", "minimum": 60, "maximum": 3600, "title": "MCP tool call timeout", "description": "Per-call timeout for MCP tool calls, in seconds. Default 180 (3 minutes).", "x-flatKey": "mcpToolTimeoutSec", "x-availableInVersion": "1.37937.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "disabledBuiltinTools": { "type": "array", "items": { "type": "string" }, "title": "Disabled built-in tools", "description": "Built-in tools, or argument-scoped permission rules such as Read(**/.env), denied in Cowork and Code.", "x-flatKey": "disabledBuiltinTools", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "disableBundledSkills": { "type": "boolean", "title": "Disable bundled skills and workflows", "description": "Disables Claude Code’s bundled skills and workflows (deep-research and similar). Use where WebFetch/WebSearch aren’t available.", "x-flatKey": "disableBundledSkills", "x-availableInVersion": "1.15962.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "skillCreationEnabled": { "type": "boolean", "title": "Allow user-created skills", "description": "Allow users to create and upload their own skills. When off, the creation and upload surfaces are hidden and the agent’s skill-creation tools are disabled.", "x-flatKey": "skillCreationEnabled", "x-availableInVersion": "1.25927.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "scheduledTasksEnabled": { "type": "boolean", "title": "Allow scheduled tasks", "description": "Allow scheduled tasks in Cowork and Code. When off, the Scheduled page is hidden, existing tasks stop running, and Claude cannot create new ones.", "x-flatKey": "scheduledTasksEnabled", "x-availableInVersion": "2.110.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "builtinToolPolicy": { "type": "object", "propertyNames": { "type": "string", "pattern": "^(?:(Bash|Read|Write|Edit|Glob|Grep|NotebookEdit|Task|TodoWrite|TaskCreate|TaskUpdate|TaskGet|TaskList|TaskStop|Skill|REPL|JavaScript|AskUserQuestion|ToolSearch|SendUserMessage)(?:\\((\\S[^\\r\\n]*)\\))?|(WebSearch|WebFetch))$" }, "additionalProperties": { "type": "string", "enum": [ "allow", "ask", "ask-session" ], "x-deprecatedValues": [ { "value": "ask-session", "use": "ask", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ], "x-valueAvailableInVersionOverride": [ { "value": "ask-session", "availableInVersion": "1.40609.0" } ] }, "title": "Built-in tool policy", "description": "Approval policy per built-in tool or argument-scoped rule such as Bash(curl *). “ask” requires user approval before each matching call; “allow” is the default.", "x-flatKey": "builtinToolPolicy", "x-availableInVersion": "1.8089.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-deprecations": [ { "path": "builtinToolPolicy: \"ask-session\"", "use": "\"ask\"", "effect": "the entry will be read as \"ask\" (approval on every call), like any unrecognized value", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ] }, "autoModeEnabled": { "type": "boolean", "title": "Allow Auto mode", "description": "Offer Auto mode in the Cowork and Code permission selectors. Claude decides which actions need approval.", "default": false, "x-flatKey": "autoModeEnabled", "x-availableInVersion": "1.10628.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "disableBypassPermissionsMode": { "type": "boolean", "title": "Disable bypass permissions mode", "description": "Remove the bypass permissions mode from Code sessions and Cowork tasks, so Claude always follows the permission policy. Off by default.", "x-flatKey": "disableBypassPermissionsMode", "x-availableInVersion": "1.46388.1", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "toolSearchEnabled": { "type": "boolean", "title": "Enable tool search", "description": "Load MCP tool schemas on demand (tool search) instead of inlining every schema into context.", "default": false, "x-flatKey": "toolSearchEnabled", "x-availableInVersion": "1.21459.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "skipWebFetchPreflight": { "type": "boolean", "title": "Skip WebFetch domain check", "description": "Skip Claude Code’s WebFetch domain lookup against api.anthropic.com in Code sessions. Off by default; turn on when that host is blocked.", "x-flatKey": "skipWebFetchPreflight", "x-availableInVersion": "1.37937.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "allowedWorkspaceFolders": { "type": "array", "items": { "anyOf": [ { "type": "string", "minLength": 1 }, { "type": "object", "properties": { "path": { "type": "string", "minLength": 1, "title": "Path", "description": "Absolute folder path. May start with ~ or one of the listed %VAR% tokens, expanded per user. Subfolders are included.", "x-consentRequired": false, "x-availableInVersionOverride": "1.14271.0" }, "isDefaultSelected": { "type": "boolean", "title": "Pre-select on new task", "description": "Shows as a folder chip on the new-task page and skips the trust prompt. Users can remove it.", "x-consentRequired": false, "x-availableInVersionOverride": "1.14271.0" }, "mode": { "type": "string", "enum": [ "rw", "ro" ], "title": "Access mode", "description": "Read-only folders can be viewed and searched but not modified in Cowork. In Code, applies to file tools only; Bash and SSH do not yet enforce read-only.", "x-consentRequired": false, "x-availableInVersionOverride": "1.26832.0" } }, "required": [ "path" ] } ] }, "title": "Allowed workspace folders", "description": "Folders where Claude may work. Applies to both Cowork and Code sessions. Leave unset for unrestricted access.", "x-flatKey": "allowedWorkspaceFolders", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "blockReadsOutsideWorkingDirectories": { "type": "boolean", "title": "Block reads outside working directories", "description": "Keep Claude from reading files outside a Code session’s working directories. File tools refuse such reads; sandboxed shell commands lose the home directory.", "x-flatKey": "blockReadsOutsideWorkingDirectories", "x-availableInVersion": "1.46388.1", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "coworkEgressAllowedHosts": { "type": "array", "items": { "type": "string", "minLength": 1 }, "title": "Allowed egress hosts", "description": "Hostnames the agent’s tools may reach from Cowork and Code sessions. Also surfaced under Egress Requirements.", "x-flatKey": "coworkEgressAllowedHosts", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "coworkVmIpv6Enabled": { "type": "boolean", "title": "Enable IPv6 in the workspace VM", "description": "Give the Cowork workspace VM an IPv6 address and route so the agent’s tools can reach IPv6-only hosts through the device. macOS and Windows; off by default.", "x-flatKey": "coworkVmIpv6Enabled", "x-availableInVersion": "1.52386.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "endUserAttribution": { "type": "boolean", "title": "End-user attribution", "description": "Show the signed-in user’s identity-provider identity in the sidebar and account menu, and emit it as the OpenTelemetry enduser.id resource attribute.", "x-flatKey": "endUserAttribution", "x-availableInVersion": "1.25927.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-legacyFlatKey": "enduserAttribution", "x-deprecations": [ { "path": "enduserAttribution", "use": "endUserAttribution", "effect": "the key will read as false (its fail-closed value): end-user attribution will stay off — no identity shown, no enduser.id emitted — whatever the old name said", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ] }, "userContentRendererUrl": { "type": "string", "format": "uri", "title": "Artifact preview iframe origin", "description": "HTTPS origin of the user-content-renderer deployment used for artifact and file previews. Defaults to the commercial host when unset.", "x-flatKey": "userContentRendererUrl", "x-availableInVersion": "1.24012.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "organizationInstructions": { "type": "string", "minLength": 1, "maxLength": 3000, "title": "Organization instructions", "description": "Appended to Claude’s system prompt in Chat, Cowork, and Code. Guidance the model follows, not an enforced control. Up to 3,000 characters.", "x-flatKey": "organizationInstructions", "x-availableInVersion": "1.37937.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "disableDeploymentModeChooser": { "type": "boolean", "title": "Disable Claude.ai sign-in", "description": "Users see only this provider at the login screen. The option to sign in to Claude.ai is hidden.", "default": false, "x-flatKey": "disableDeploymentModeChooser", "x-availableInVersion": "1.3834.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "disableDeepLinkRegistration": { "type": "boolean", "title": "Disable claude:// deep-link handling", "description": "Stop external apps and websites from opening Claude Desktop via claude:// links.", "default": false, "x-flatKey": "disableDeepLinkRegistration", "x-availableInVersion": "1.6889.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "microsoftAuthBroker": { "type": "string", "enum": [ "auto", "disabled", "required" ], "title": "Microsoft 365 native sign-in broker", "description": "“disabled” forces browser-based Microsoft 365 sign-in; “required” fails sign-in when the OS broker is unavailable, so the refresh token stays broker-held.", "default": "auto", "x-flatKey": "microsoftAuthBroker", "x-availableInVersion": "1.19367.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-valueAvailableInVersionOverride": [ { "value": "required", "availableInVersion": "1.49585.0" } ] }, "deploymentDisplayName": { "type": "string", "minLength": 1, "maxLength": 60, "title": "Deployment display name", "description": "Overrides the provider label shown in the sidebar footer, user-menu header, and connection-error banner.", "x-flatKey": "deploymentDisplayName", "x-availableInVersion": "1.24012.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "deploymentDisplaySubtitle": { "type": "string", "minLength": 1, "maxLength": 60, "title": "Deployment display subtitle", "description": "Optional detail shown after the deployment display name in the account-menu header.", "x-flatKey": "deploymentDisplaySubtitle", "x-availableInVersion": "1.24012.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "disableConfigDeprecationWarnings": { "type": "boolean", "title": "Hide configuration deprecation warnings", "description": "Don’t show users the in-app warning that this configuration uses a deprecated field. The final reminder in the 24 hours before the cut-off still appears.", "x-flatKey": "disableConfigDeprecationWarnings", "x-availableInVersion": "1.40609.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "claudeAiImport": { "type": "object", "properties": { "enabled": { "default": false, "title": "Enable import", "description": "Lets users import a Claude.ai data export and earlier Claude sessions on this computer from Settings → Import. Doesn’t affect a provisioned sign-in import.", "x-consentRequired": false, "type": "boolean", "x-availableInVersionOverride": "1.28929.0" }, "automatic3pImport": { "default": false, "title": "Automatically import earlier third-party sessions", "description": "Copy this computer’s earlier third-party sessions into the app once, in the background. Independent of `enabled`.", "x-consentRequired": false, "type": "boolean", "x-availableInVersionOverride": "1.40609.0" }, "exportEnabled": { "default": false, "title": "Enable session export", "description": "Lets users export this computer’s chats, Cowork tasks, and Code sessions as a zip another install can import. No effect unless `enabled` is true.", "x-consentRequired": false, "type": "boolean", "x-availableInVersionOverride": "1.32352.0" }, "bannerBehavior": { "title": "Import prompt banner", "description": "Prompt to import at the top of a new chat or task. `detect`: only when earlier Claude sessions are found on this computer. `show`: always. Hidden when unset.", "x-consentRequired": false, "type": "string", "enum": [ "off", "detect", "show" ], "x-availableInVersionOverride": "1.28929.0" } }, "title": "Claude.ai data import", "description": "Lets users import Claude.ai chats and projects, plus earlier Claude sessions on this computer, when `enabled` is true. `automatic3pImport` is a separate switch.", "x-flatKey": "claudeAiImport", "x-availableInVersion": "1.10628.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "banner": { "type": "object", "properties": { "enabled": { "type": "boolean", "title": "Show banner", "description": "Turns the banner on. When false or unset, the other banner fields are ignored.", "x-consentRequired": false }, "text": { "type": "string", "title": "Banner text", "description": "Single line, truncated on overflow. Maximum 200 characters.", "x-consentRequired": false }, "backgroundColor": { "type": "string", "title": "Background color", "description": "Six-digit hex (#RRGGBB). Applied exactly as configured; not theme-adapted.", "default": "#F5F5F5", "x-consentRequired": false }, "textColor": { "type": "string", "title": "Text color", "description": "Six-digit hex (#RRGGBB). Applied exactly as configured; not theme-adapted.", "default": "#000000", "x-consentRequired": false }, "linkUrl": { "type": "string", "title": "Link URL", "description": "Optional HTTPS URL. The banner text becomes a link when set.", "x-consentRequired": false } }, "title": "Organization banner", "description": "A persistent banner across the top of the app window after sign-in.", "x-flatKey": "banner", "x-availableInVersion": "1.7196.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false } }, "description": "Per-user bootstrap configuration response in the flat format (`$schemaVersion` 1): bootstrapable keys by their managed-configuration key names at top level. Structural reference for editor autocomplete — the client applies further validation that this schema does not express (https-only and non-loopback URLs, origin-pinning under gateway SSO). Unrecognised keys are ignored. A node marked `x-readers` is read by the clients it names (`desktop` = Claude Desktop, `m365` = the Claude add-in for Microsoft 365); an unmarked node is read by Claude Desktop only. The marker is per key; which providers a client supports is that client's own list. Each key node's `x-availableInVersion` is the first Claude Desktop release that reads the key; the app names its version as `Claude/` in the User-Agent of the request, so a server can leave out keys the requesting build does not read yet. Below a key, releases are stated by exception: a property node carries `x-availableInVersionOverride` only when it is first read by a later release than the node above it, and an `enum` or `const` node's `x-valueAvailableInVersionOverride` lists `{value, availableInVersion}` only for the values first read by a later release than the node. The release from which a location in a document is read is the newest one stated on the path from the root to it: the key's `x-availableInVersion`, any override on a property node along the way (array items, map values and union alternatives add no level of their own), the value's own entry, and — inside a union alternative (a managed MCP server, OAuth, marketplace or inference-provider variant) — the release stated on that alternative's discriminator property (`server`, `mode`, `transport`, `source`, `provider`, …): its override, or the entry for its value; the alternative's other properties and any key repeated inside it are read no earlier than that. A node with `x-legacyFlatKey` was renamed: builds older than its release may read the setting under that earlier name, whose acceptance dates are in `x-deprecations`." } } }