From 2ef4fd741c0464837f3185499227101c72172cbe Mon Sep 17 00:00:00 2001 From: "claude[bot]" <41898282+claude[bot]@users.noreply.github.com> Date: Tue, 20 Oct 2026 19:43:57 +0000 Subject: [PATCH] docs: Claude Code v2.1.304 - upstream MDX-to-markdown re-render (prompt library lost 93%), User profiles guide, Desktop 3P Admin Console GA Co-Authored-By: claude-yolo[bot] --- content/.metadata.json | 3534 +-- content/claude-code-manifest.json | 1 - content/claude/build/overview.md | 54 +- .../claude/claude-science/admin-controls.md | 6 +- content/claude/claude-science/artifacts.md | 6 +- content/claude/claude-science/changelog.md | 513 +- .../claude/claude-science/cloud-storage.md | 12 +- .../claude-science/command-line-settings.md | 44 +- content/claude/claude-science/comments.md | 6 +- .../claude-science/compute-providers.md | 6 +- .../claude-science/connectors-and-skills.md | 2 +- .../claude/claude-science/core-concepts.md | 6 +- .../claude-science/corporate-networks.md | 44 +- .../claude-science/custom-connectors.md | 6 +- .../claude/claude-science/example-gallery.md | 22 +- .../example-gallery/bio-drift.md | 8 +- .../example-gallery/chem-titration.md | 8 +- .../claude-science/example-gallery/clin-km.md | 8 +- .../example-gallery/cs-pagerank-tiny.md | 8 +- .../example-gallery/eng-beam.md | 8 +- .../claude-science/example-gallery/mat-xrd.md | 8 +- .../example-gallery/math-ulam.md | 8 +- .../example-gallery/phys-doubleslit.md | 8 +- .../example-gallery/soc-schelling-small.md | 8 +- content/claude/claude-science/get-started.md | 190 +- .../claude-science/literature-access.md | 6 +- .../claude/claude-science/mac-app-window.md | 6 +- content/claude/claude-science/overview.md | 6 +- .../claude-science/remote-compute-clusters.md | 6 +- .../run-on-remote-linux-server.md | 12 +- .../claude-science/tools-and-environments.md | 6 +- .../claude/claude-science/troubleshooting.md | 5 + .../claude-tag/admins/add-connections.md | 126 +- .../claude-tag/admins/attach-to-scope.md | 20 +- .../claude-tag/admins/attribute-costs.md | 6 +- content/claude/claude-tag/admins/audit.md | 6 +- .../claude-tag/admins/configure-github.md | 90 +- .../claude-tag/admins/configure-gitlab.md | 36 +- .../admins/connections/amplitude.md | 76 +- .../claude-tag/admins/connections/asana.md | 6 +- .../admins/connections/atlassian.md | 40 +- .../claude-tag/admins/connections/bigquery.md | 6 +- .../claude-tag/admins/connections/custom.md | 26 +- .../claude-tag/admins/connections/datadog.md | 6 +- .../claude-tag/admins/connections/gitlab.md | 24 +- .../claude-tag/admins/connections/gong.md | 6 +- .../claude-tag/admins/connections/google.md | 10 +- .../claude-tag/admins/connections/hubspot.md | 6 +- .../claude-tag/admins/connections/linear.md | 6 +- .../claude-tag/admins/connections/notion.md | 6 +- .../claude-tag/admins/connections/overview.md | 10 +- .../admins/connections/pagerduty.md | 6 +- .../admins/connections/salesforce.md | 6 +- .../claude-tag/admins/connections/sentry.md | 6 +- .../admins/connections/snowflake.md | 6 +- .../claude-tag/admins/connections/stripe.md | 6 +- .../claude-tag/admins/connections/vercel.md | 6 +- content/claude/claude-tag/admins/customize.md | 32 +- .../federated-access/authorization-server.md | 40 +- .../claude-tag/admins/federated-access/aws.md | 106 +- .../federated-access/connect-a-gateway.md | 42 +- .../claude-tag/admins/federated-access/gcp.md | 62 +- .../admins/federated-access/limits.md | 6 +- .../admins/federated-access/overview.md | 10 +- .../federated-access/token-reference.md | 10 +- .../federated-access/troubleshooting.md | 10 +- .../claude-tag/admins/for-slack-admins.md | 6 +- .../claude/claude-tag/admins/healthcare.md | 38 +- .../claude/claude-tag/admins/managed-by.md | 96 +- .../claude-tag/admins/migrate-from-earlier.md | 48 +- .../claude-tag/admins/network-requirements.md | 14 +- .../claude-tag/admins/restrict-access.md | 110 +- .../claude-tag/admins/set-spend-limit.md | 20 +- .../claude/claude-tag/admins/setup-oncall.md | 6 +- .../claude-tag/admins/setup-overview.md | 176 +- .../claude/claude-tag/admins/skills-repo.md | 34 +- .../claude-tag/admins/troubleshooting.md | 28 +- .../claude/claude-tag/admins/workspaces.md | 80 +- .../claude-tag/concepts/agent-identity.md | 52 +- .../claude-tag/concepts/data-lifecycle.md | 6 +- .../concepts/for-claude-code-users.md | 6 +- .../claude/claude-tag/concepts/glossary.md | 10 +- .../claude-tag/concepts/how-it-works.md | 96 +- .../concepts/personal-connectors.md | 6 +- .../claude-tag/concepts/security-and-data.md | 14 +- .../claude-tag/concepts/settings-map.md | 6 +- content/claude/claude-tag/overview.md | 243 +- content/claude/claude-tag/users/commands.md | 6 +- .../claude-tag/users/getting-started.md | 10 +- .../claude/claude-tag/users/good-habits.md | 14 +- content/claude/claude-tag/users/group-dms.md | 28 +- content/claude/claude-tag/users/memory.md | 6 +- content/claude/claude-tag/users/models.md | 6 +- .../claude/claude-tag/users/proactivity.md | 6 +- .../claude/claude-tag/users/prompt-library.md | 6 +- .../claude-tag/users/troubleshooting.md | 12 +- content/claude/claude-tag/users/use-cases.md | 10 +- .../users/use-cases/answer-data-questions.md | 26 +- .../claude-tag/users/use-cases/catch-up.md | 20 +- .../users/use-cases/create-artifacts.md | 20 +- .../users/use-cases/find-answers.md | 20 +- .../claude-tag/users/use-cases/fix-bugs.md | 20 +- .../users/use-cases/marketing-team.md | 20 +- .../users/use-cases/pull-deal-state.md | 20 +- .../users/use-cases/review-documents.md | 20 +- .../users/use-cases/track-projects.md | 20 +- .../users/use-cases/triage-requests.md | 46 +- .../users/use-cases/watch-monitors.md | 32 +- .../users/use-cases/work-with-github.md | 32 +- .../users/use-cases/your-own-channel.md | 20 +- .../claude-tag/users/when-claude-responds.md | 12 +- content/claude/connectors/building.md | 16 +- .../connectors/building/after-publishing.md | 6 +- .../connectors/building/authentication.md | 20 +- .../building/directory-vs-custom.md | 12 +- .../building/enterprise-managed-auth.md | 120 +- .../building/lazy-authentication.md | 114 +- .../building/managing-your-listing.md | 12 +- .../building/mcp-apps/design-guidelines.md | 56 +- .../building/mcp-apps/external-links.md | 6 +- .../building/mcp-apps/getting-started.md | 150 +- .../building/mcp-apps/quickstart.md | 486 +- .../building/mcp-apps/transparent-theming.md | 84 +- .../building/mcp-apps/troubleshooting.md | 88 +- content/claude/connectors/building/mcpb.md | 66 +- .../claude/connectors/building/quickstart.md | 248 +- .../connectors/building/review-criteria.md | 6 +- .../claude/connectors/building/submission.md | 76 +- content/claude/connectors/building/testing.md | 6 +- .../connectors/building/troubleshooting.md | 90 +- .../connectors/building/what-to-build.md | 12 +- .../claude/connectors/custom/add-unlisted.md | 178 +- content/claude/connectors/directory.md | 26 +- content/claude/connectors/getting-started.md | 78 +- content/claude/connectors/github.md | 96 +- content/claude/connectors/google/calendar.md | 26 +- content/claude/connectors/google/drive.md | 102 +- content/claude/connectors/google/gmail.md | 26 +- .../claude/connectors/mcp-tunnels/oauth.md | 12 +- .../claude/connectors/mcp-tunnels/overview.md | 12 +- .../claude/connectors/mcp-tunnels/setup.md | 808 +- .../connectors/mcp-tunnels/troubleshooting.md | 56 +- content/claude/connectors/microsoft/365.md | 154 +- content/claude/connectors/slack.md | 88 +- content/claude/connectors/verification.md | 6 +- content/claude/cowork/changelog.md | 3445 +-- content/claude/cowork/guide/dispatch.md | 60 +- content/claude/cowork/guide/plugins.md | 56 +- content/claude/cowork/guide/projects.md | 32 +- content/claude/cowork/hipaa-setup.md | 154 +- content/claude/cowork/monitoring.md | 24 +- content/claude/cowork/overview.md | 32 +- content/claude/directory/publish.md | 36 +- content/claude/directory/submission-status.md | 6 +- content/claude/extend/overview.md | 36 +- content/claude/government/account/overview.md | 40 +- content/claude/government/account/profile.md | 12 +- content/claude/government/account/sessions.md | 12 +- content/claude/government/account/usage.md | 18 +- content/claude/government/changelog.md | 258 +- content/claude/government/config/overview.md | 56 +- content/claude/government/config/settings.md | 90 +- .../government/connectors/microsoft-365.md | 92 +- .../claude/government/connectors/overview.md | 44 +- .../deploy-claude-code/configure.md | 74 +- .../government/deploy-desktop/configure.md | 190 +- .../deploy-microsoft-365/configure.md | 108 +- content/claude/government/desktop/import.md | 126 +- content/claude/government/desktop/models.md | 6 +- content/claude/government/desktop/plugins.md | 46 +- .../government/desktop/video-walkthroughs.md | 236 +- .../claude/government/org-admin/analytics.md | 12 +- .../claude/government/org-admin/billing.md | 18 +- .../government/org-admin/compliance-api.md | 12 +- .../claude/government/org-admin/overview.md | 64 +- .../government/org-admin/provisioning.md | 18 +- .../claude/government/org-admin/seat-tiers.md | 12 +- content/claude/government/org-admin/seats.md | 18 +- content/claude/government/org-admin/users.md | 18 +- content/claude/government/overview.md | 74 +- .../security/security-and-data-handling.md | 256 +- .../claude/government/tenant-admin/admins.md | 6 +- .../claude/government/tenant-admin/credits.md | 12 +- .../tenant-admin/identity-and-access.md | 154 +- .../government/tenant-admin/organizations.md | 12 +- .../government/tenant-admin/overview.md | 6 +- .../claude/government/tenant-admin/seats.md | 6 +- .../government/tenant-admin/setup-wizard.md | 60 +- .../tenant-admin/tenant-restrictions.md | 12 +- .../claude/government/video-walkthroughs.md | 472 +- .../office-agents/connectors-and-skills.md | 28 +- content/claude/office-agents/data-storage.md | 20 +- content/claude/office-agents/dictation.md | 56 +- .../office-agents/enterprise-readiness.md | 14 +- content/claude/office-agents/excel.md | 104 +- content/claude/office-agents/fsi-plugins.md | 72 +- content/claude/office-agents/outlook.md | 242 +- content/claude/office-agents/performance.md | 216 +- content/claude/office-agents/powerpoint.md | 166 +- .../office-agents/third-party-platforms.md | 236 +- content/claude/office-agents/word.md | 182 +- .../claude/office-agents/work-across-apps.md | 50 +- content/claude/plugins/admin.md | 194 +- content/claude/plugins/build.md | 575 +- content/claude/plugins/create-with-claude.md | 92 +- content/claude/plugins/org-rollout.md | 62 +- content/claude/plugins/org-sync.md | 72 +- content/claude/plugins/overview.md | 10 +- content/claude/plugins/platform-support.md | 12 +- .../plugins/pre-submission-checklist.md | 46 +- content/claude/plugins/quickstart.md | 198 +- content/claude/plugins/share.md | 22 +- content/claude/plugins/submit.md | 88 +- content/claude/skills/how-to.md | 579 +- content/claude/skills/overview.md | 28 +- .../claude-desktop/admin-console.md | 184 +- .../third-party/claude-desktop/bedrock.md | 118 +- .../third-party/claude-desktop/bootstrap.md | 256 +- .../claude-desktop/built-in-connectors.md | 6 +- .../claude/third-party/claude-desktop/chat.md | 38 +- .../third-party/claude-desktop/claude-api.md | 16 +- .../claude/third-party/claude-desktop/code.md | 16 +- .../claude-desktop/configuration-changelog.md | 2394 +- .../claude-desktop/configuration.md | 2119 +- .../claude-desktop/connectors-box.md | 118 +- .../claude-desktop/connectors-github.md | 98 +- .../claude-desktop/connectors-google-cloud.md | 96 +- .../claude-desktop/connectors-m365.md | 364 +- .../claude-desktop/connectors-salesforce.md | 134 +- .../claude-desktop/credential-helper.md | 6 +- .../claude-desktop/data-storage.md | 14 +- .../third-party/claude-desktop/extensions.md | 102 +- .../claude-desktop/feature-matrix.md | 160 +- .../third-party/claude-desktop/foundry.md | 94 +- .../third-party/claude-desktop/gateway.md | 258 +- .../third-party/claude-desktop/import.md | 98 +- .../claude-desktop/in-app-configuration.md | 4 +- .../claude-desktop/installation.md | 13 + .../claude-desktop/local-access.md | 6 +- .../third-party/claude-desktop/mantle.md | 32 +- .../claude/third-party/claude-desktop/mdm.md | 110 +- .../move-to-claude-enterprise.md | 77 +- .../claude-desktop/network-proxy.md | 18 +- .../third-party/claude-desktop/overview.md | 32 +- .../claude-desktop/ssh-remote-sessions.md | 32 +- .../third-party/claude-desktop/telemetry.md | 128 +- .../claude-desktop/unified-claude.md | 6 +- .../third-party/claude-desktop/vertex.md | 144 +- .../third-party/claude-desktop/web-tools.md | 28 +- content/en/agents-and-tools/mcp-connector.md | 8 +- .../mcp-tunnels/deploy-compose.md | 10 +- .../mcp-tunnels/deploy-helm.md | 16 +- .../mcp-tunnels/quickstart.md | 8 +- content/en/api/rate-limits.md | 2 +- .../claude-in-amazon-bedrock.md | 8 +- .../claude-in-microsoft-foundry.md | 8 +- .../claude-on-amazon-bedrock-legacy.md | 8 +- .../build-with-claude/claude-on-vertex-ai.md | 8 +- .../claude-platform-on-aws.md | 8 +- .../en/cli-sdks-libraries/cli/quickstart.md | 2 +- content/en/cli-sdks-libraries/sdks/go.md | 2 +- content/en/cli-sdks-libraries/sdks/java.md | 4 +- content/en/docs/claude-code/admin-setup.md | 10 +- content/en/docs/claude-code/advisor.md | 6 +- .../docs/claude-code/agent-sdk/agent-loop.md | 360 +- .../agent-sdk/claude-code-features.md | 362 +- .../claude-code/agent-sdk/configuration.md | 266 +- .../claude-code/agent-sdk/cost-tracking.md | 272 +- .../claude-code/agent-sdk/custom-tools.md | 1218 +- .../agent-sdk/file-checkpointing.md | 994 +- .../en/docs/claude-code/agent-sdk/hooks.md | 1020 +- .../en/docs/claude-code/agent-sdk/hosting.md | 244 +- content/en/docs/claude-code/agent-sdk/mcp.md | 1134 +- .../claude-code/agent-sdk/migration-guide.md | 126 +- .../agent-sdk/modifying-system-prompts.md | 496 +- .../claude-code/agent-sdk/observability.md | 264 +- .../en/docs/claude-code/agent-sdk/overview.md | 6 +- .../docs/claude-code/agent-sdk/permissions.md | 302 +- .../en/docs/claude-code/agent-sdk/plugins.md | 368 +- .../en/docs/claude-code/agent-sdk/python.md | 120 +- .../docs/claude-code/agent-sdk/quickstart.md | 460 +- .../agent-sdk/secure-deployment.md | 48 +- .../claude-code/agent-sdk/session-storage.md | 262 +- .../en/docs/claude-code/agent-sdk/sessions.md | 400 +- .../en/docs/claude-code/agent-sdk/skills.md | 500 +- .../claude-code/agent-sdk/slash-commands.md | 500 +- .../claude-code/agent-sdk/streaming-output.md | 428 +- .../agent-sdk/streaming-vs-single-mode.md | 396 +- .../agent-sdk/structured-outputs.md | 770 +- .../docs/claude-code/agent-sdk/subagents.md | 978 +- .../claude-code/agent-sdk/todo-tracking.md | 570 +- .../docs/claude-code/agent-sdk/tool-search.md | 170 +- .../claude-code/agent-sdk/troubleshooting.md | 7 +- .../agent-sdk/typescript-v2-preview.md | 16 +- .../docs/claude-code/agent-sdk/typescript.md | 142 +- .../docs/claude-code/agent-sdk/user-input.md | 1090 +- content/en/docs/claude-code/agent-teams.md | 30 +- content/en/docs/claude-code/agent-view.md | 193 +- content/en/docs/claude-code/agents.md | 6 +- content/en/docs/claude-code/amazon-bedrock.md | 117 +- content/en/docs/claude-code/analytics.md | 56 +- content/en/docs/claude-code/artifacts.md | 16 +- content/en/docs/claude-code/authentication.md | 118 +- .../en/docs/claude-code/auto-mode-config.md | 62 +- content/en/docs/claude-code/best-practices.md | 250 +- content/en/docs/claude-code/champion-kit.md | 40 +- content/en/docs/claude-code/changelog.md | 22054 ++++++++-------- .../en/docs/claude-code/channels-reference.md | 468 +- content/en/docs/claude-code/channels.md | 340 +- content/en/docs/claude-code/checkpointing.md | 16 +- content/en/docs/claude-code/chrome.md | 59 +- .../claude-code/claude-apps-gateway-config.md | 154 +- .../claude-code/claude-apps-gateway-deploy.md | 30 +- .../claude-code/claude-apps-gateway-on-aws.md | 768 +- .../claude-code/claude-apps-gateway-on-gcp.md | 456 +- .../claude-apps-gateway-spend-limits.md | 6 +- .../docs/claude-code/claude-apps-gateway.md | 364 +- .../claude-code/claude-code-on-the-web.md | 70 +- .../en/docs/claude-code/claude-directory.md | 1448 +- .../claude-code/claude-platform-on-aws.md | 194 +- .../en/docs/claude-code/claude-projects.md | 110 +- .../en/docs/claude-code/claude-security.md | 48 +- content/en/docs/claude-code/cli-reference.md | 4 +- .../en/docs/claude-code/cloud-environments.md | 608 +- .../docs/claude-code/code-review-customize.md | 12 +- .../en/docs/claude-code/code-review-local.md | 46 +- .../claude-code/code-review-pull-requests.md | 75 +- .../en/docs/claude-code/code-review-setup.md | 60 +- content/en/docs/claude-code/code-review.md | 56 +- content/en/docs/claude-code/commands.md | 13 +- .../en/docs/claude-code/common-workflows.md | 612 +- .../en/docs/claude-code/communications-kit.md | 174 +- content/en/docs/claude-code/computer-use.md | 46 +- content/en/docs/claude-code/context-window.md | 1571 -- .../en/docs/claude-code/corporate-launcher.md | 94 +- content/en/docs/claude-code/costs.md | 118 +- .../claude-code/cross-session-messaging.md | 26 +- content/en/docs/claude-code/data-usage.md | 14 +- .../en/docs/claude-code/debug-your-config.md | 104 +- content/en/docs/claude-code/deep-links.md | 52 +- .../en/docs/claude-code/desktop-changelog.md | 668 +- .../docs/claude-code/desktop-ios-simulator.md | 38 +- content/en/docs/claude-code/desktop-linux.md | 68 +- .../en/docs/claude-code/desktop-quickstart.md | 108 +- .../claude-code/desktop-scheduled-tasks.md | 76 +- content/en/docs/claude-code/desktop-wsl.md | 22 +- content/en/docs/claude-code/desktop.md | 668 +- content/en/docs/claude-code/devcontainer.md | 114 +- .../en/docs/claude-code/discover-plugins.md | 184 +- content/en/docs/claude-code/env-vars.md | 109 +- content/en/docs/claude-code/errors.md | 610 +- content/en/docs/claude-code/fast-mode.md | 28 +- .../docs/claude-code/feature-availability.md | 139 +- .../en/docs/claude-code/features-overview.md | 330 +- content/en/docs/claude-code/fullscreen.md | 16 +- content/en/docs/claude-code/gateways.md | 4 +- .../github-actions-cloud-providers.md | 516 +- content/en/docs/claude-code/github-actions.md | 54 +- .../claude-code/github-enterprise-server.md | 44 +- content/en/docs/claude-code/gitlab-ci-cd.md | 118 +- content/en/docs/claude-code/goal.md | 18 +- .../en/docs/claude-code/google-vertex-ai.md | 125 +- content/en/docs/claude-code/headless.md | 66 +- content/en/docs/claude-code/hipaa-setup.md | 58 +- content/en/docs/claude-code/hooks-guide.md | 462 +- content/en/docs/claude-code/hooks.md | 922 +- .../docs/claude-code/how-claude-code-works.md | 22 +- content/en/docs/claude-code/iam.md | 118 +- .../en/docs/claude-code/interactive-mode.md | 101 +- content/en/docs/claude-code/jetbrains.md | 70 +- content/en/docs/claude-code/keybindings.md | 5 +- .../en/docs/claude-code/large-codebases.md | 12 +- .../docs/claude-code/llm-gateway-connect.md | 382 +- .../docs/claude-code/llm-gateway-protocol.md | 15 +- .../docs/claude-code/llm-gateway-rollout.md | 160 +- content/en/docs/claude-code/llm-gateway.md | 10 +- content/en/docs/claude-code/managed-mcp.md | 208 +- .../en/docs/claude-code/managed-settings.md | 108 +- content/en/docs/claude-code/mcp-quickstart.md | 406 +- content/en/docs/claude-code/mcp.md | 612 +- content/en/docs/claude-code/memory.md | 72 +- .../en/docs/claude-code/microsoft-foundry.md | 93 +- content/en/docs/claude-code/mobile.md | 32 +- content/en/docs/claude-code/model-config.md | 66 +- .../en/docs/claude-code/monitoring-usage.md | 82 +- content/en/docs/claude-code/network-config.md | 36 +- content/en/docs/claude-code/output-styles.md | 70 +- content/en/docs/claude-code/overview.md | 306 +- .../en/docs/claude-code/permission-modes.md | 354 +- content/en/docs/claude-code/permissions.md | 102 +- .../docs/claude-code/plugin-dependencies.md | 20 +- content/en/docs/claude-code/plugin-evals.md | 160 +- content/en/docs/claude-code/plugin-hints.md | 66 +- .../docs/claude-code/plugin-marketplaces.md | 142 +- .../en/docs/claude-code/plugin-relevance.md | 12 +- .../en/docs/claude-code/plugins-reference.md | 12 +- content/en/docs/claude-code/plugins.md | 34 +- .../plugins/anthropic-marketplaces.md | 12 +- .../en/docs/claude-code/plugins/cli-hints.md | 66 +- .../docs/claude-code/plugins/cli-reference.md | 48 +- .../claude-code/plugins/code-intelligence.md | 76 +- .../en/docs/claude-code/plugins/components.md | 719 +- .../claude-code/plugins/create-marketplace.md | 142 +- content/en/docs/claude-code/plugins/create.md | 298 +- .../docs/claude-code/plugins/dependencies.md | 20 +- .../claude-code/plugins/host-marketplace.md | 20 +- .../en/docs/claude-code/plugins/install.md | 184 +- .../en/docs/claude-code/plugins/loading.md | 20 +- .../claude-code/plugins/manifest-reference.md | 12 +- .../plugins/marketplace-reference.md | 18 +- .../en/docs/claude-code/plugins/measure.md | 16 +- .../en/docs/claude-code/plugins/mods/admin.md | 16 +- .../en/docs/claude-code/plugins/mods/api.md | 14 +- .../docs/claude-code/plugins/mods/create.md | 330 +- .../docs/claude-code/plugins/mods/events.md | 50 +- .../docs/claude-code/plugins/mods/gallery.md | 204 +- .../claude-code/plugins/mods/interface.md | 506 +- .../docs/claude-code/plugins/mods/overview.md | 24 +- .../claude-code/plugins/mods/reference.md | 38 +- .../en/docs/claude-code/plugins/mods/test.md | 8 +- .../claude-code/plugins/mods/troubleshoot.md | 8 +- content/en/docs/claude-code/plugins/org.md | 52 +- .../en/docs/claude-code/plugins/overview.md | 34 +- .../en/docs/claude-code/plugins/publish.md | 90 +- .../en/docs/claude-code/plugins/relevance.md | 12 +- .../en/docs/claude-code/plugins/security.md | 52 +- .../claude-code/plugins/troubleshooting.md | 472 +- content/en/docs/claude-code/prompt-caching.md | 22 +- content/en/docs/claude-code/prompt-library.md | 1543 -- content/en/docs/claude-code/quickstart.md | 174 +- content/en/docs/claude-code/remote-control.md | 273 +- content/en/docs/claude-code/routines.md | 222 +- .../docs/claude-code/sandbox-environments.md | 22 +- content/en/docs/claude-code/sandboxing.md | 198 +- .../en/docs/claude-code/scheduled-tasks.md | 32 +- .../en/docs/claude-code/security-guidance.md | 6 - content/en/docs/claude-code/security.md | 16 +- .../self-hosted-environments-configuration.md | 112 +- .../self-hosted-environments-deploy.md | 78 +- .../self-hosted-environments-identity.md | 206 +- .../self-hosted-environments-quickstart.md | 80 +- .../self-hosted-environments-reference.md | 6 +- .../self-hosted-environments-testing.md | 6 +- .../claude-code/self-hosted-environments.md | 14 +- .../claude-code/server-managed-settings.md | 108 +- content/en/docs/claude-code/sessions.md | 6 +- .../en/docs/claude-code/settings-example.md | 618 +- .../en/docs/claude-code/settings-reference.md | 695 +- content/en/docs/claude-code/settings.md | 470 +- content/en/docs/claude-code/setup.md | 598 +- content/en/docs/claude-code/skills.md | 151 +- content/en/docs/claude-code/slack.md | 126 +- content/en/docs/claude-code/slash-commands.md | 151 +- content/en/docs/claude-code/statusline.md | 1480 +- content/en/docs/claude-code/sub-agents.md | 334 +- .../en/docs/claude-code/terminal-config.md | 284 +- .../claude-code/third-party-integrations.md | 82 +- .../en/docs/claude-code/tools-reference.md | 24 +- .../docs/claude-code/troubleshoot-install.md | 549 +- .../en/docs/claude-code/troubleshooting.md | 90 +- content/en/docs/claude-code/ultrareview.md | 12 +- .../en/docs/claude-code/voice-dictation.md | 80 +- content/en/docs/claude-code/vs-code.md | 216 +- content/en/docs/claude-code/web-quickstart.md | 160 +- .../docs/claude-code/web-scheduled-tasks.md | 222 +- .../en/docs/claude-code/whats-new/2026-w13.md | 212 +- .../en/docs/claude-code/whats-new/2026-w14.md | 170 +- .../en/docs/claude-code/whats-new/2026-w15.md | 125 +- .../en/docs/claude-code/whats-new/2026-w16.md | 142 +- .../en/docs/claude-code/whats-new/2026-w17.md | 117 +- .../en/docs/claude-code/whats-new/2026-w18.md | 121 +- .../en/docs/claude-code/whats-new/2026-w19.md | 75 +- .../en/docs/claude-code/whats-new/2026-w20.md | 136 +- .../en/docs/claude-code/whats-new/2026-w21.md | 63 +- .../en/docs/claude-code/whats-new/2026-w22.md | 125 +- .../en/docs/claude-code/whats-new/2026-w23.md | 152 +- .../en/docs/claude-code/whats-new/2026-w24.md | 119 +- .../en/docs/claude-code/whats-new/2026-w25.md | 108 +- .../en/docs/claude-code/whats-new/2026-w26.md | 88 +- .../en/docs/claude-code/whats-new/2026-w27.md | 148 +- .../en/docs/claude-code/whats-new/2026-w28.md | 81 +- .../en/docs/claude-code/whats-new/2026-w29.md | 94 +- .../en/docs/claude-code/whats-new/2026-w30.md | 130 +- .../en/docs/claude-code/whats-new/2026-w32.md | 114 +- .../en/docs/claude-code/whats-new/2026-w33.md | 86 +- .../en/docs/claude-code/whats-new/2026-w34.md | 108 +- .../en/docs/claude-code/whats-new/2026-w35.md | 99 +- .../en/docs/claude-code/whats-new/2026-w36.md | 111 +- .../en/docs/claude-code/whats-new/2026-w37.md | 91 +- .../en/docs/claude-code/whats-new/index.md | 240 +- content/en/docs/claude-code/workflows.md | 50 +- content/en/docs/claude-code/worktrees.md | 42 +- .../docs/claude-code/zero-data-retention.md | 12 +- content/en/get-started.md | 4 +- .../manage-claude/api-and-data-retention.md | 1 + .../claude-code-analytics-api.md | 14 +- content/en/manage-claude/cmek-aws-kms.md | 68 +- .../en/manage-claude/cmek-azure-key-vault.md | 10 +- .../cmek-claude-platform-on-aws.md | 16 +- .../en/manage-claude/cmek-google-cloud-kms.md | 2 +- content/en/manage-claude/compliance-api.md | 2 +- .../inference-hooks-configuration.md | 2 +- .../manage-claude/inference-hooks-endpoint.md | 2 +- content/en/manage-claude/inference-hooks.md | 4 +- content/en/manage-claude/opentelemetry/sdk.md | 4 +- content/en/manage-claude/rate-limits-api.md | 6 +- .../user-profiles-verification-portal.md | 201 + content/en/manage-claude/user-profiles.md | 650 + content/en/manage-claude/workspaces.md | 2 +- content/en/managed-agents/quickstart.md | 4 +- .../self-hosted-sandboxes-workers.md | 2 +- .../managed-agents/self-hosted-sandboxes.md | 2 +- content/en/release-notes/overview.md | 4 + .../github/anthropic-sdk-python/CHANGELOG.md | 20 + content/github/anthropic-sdk-python/api.md | 86 +- .../src/anthropic/lib/google_cloud/README.md | 11 +- .../anthropic-sdk-typescript/CHANGELOG.md | 29 + .../github/anthropic-sdk-typescript/CLAUDE.md | 2 +- .../github/anthropic-sdk-typescript/api.md | 87 +- .../anthropic-sdk-typescript/helpers.md | 19 +- .../packages/aws-sdk/CHANGELOG.md | 7 + .../packages/bedrock-sdk/CHANGELOG.md | 7 + .../packages/google-cloud-sdk/CHANGELOG.md | 6 + .../packages/google-cloud-sdk/README.md | 4 +- .../packages/vertex-sdk/CHANGELOG.md | 6 + .../.claude-plugin/marketplace.json | 4 +- content/mcp/community/antitrust.md | 14 +- content/mcp/community/charter-template.md | 6 +- content/mcp/community/contributing.md | 388 +- content/mcp/community/contributor-ladder.md | 24 +- .../enterprise-managed-authorization.md | 14 +- content/mcp/community/sdk-tiers.md | 20 +- content/mcp/community/sep-guidelines.md | 16 +- .../mcp/community/working-interest-groups.md | 42 +- content/mcp/development/roadmap.md | 10 +- .../docs/2024-11-05/develop/build-client.md | 3874 ++- .../docs/2024-11-05/develop/build-server.md | 4712 ++-- .../develop/build-with-agent-skills.md | 24 +- .../develop/clients/client-best-practices.md | 4 +- .../develop/connect-local-servers.md | 398 +- .../develop/connect-remote-servers.md | 104 +- .../docs/2024-11-05/getting-started/intro.md | 46 +- .../mcp/docs/2024-11-05/learn/architecture.md | 482 +- .../docs/2024-11-05/learn/server-concepts.md | 6 +- .../mcp/docs/2024-11-05/learn/versioning.md | 10 +- content/mcp/docs/2024-11-05/sdk.md | 34 +- .../mcp/docs/2024-11-05/tools/debugging.md | 92 +- .../mcp/docs/2024-11-05/tools/inspector.md | 84 +- .../tutorials/security/authorization.md | 1462 +- .../security/security_best_practices.md | 8 +- .../docs/2025-03-26/develop/build-client.md | 3874 ++- .../docs/2025-03-26/develop/build-server.md | 4712 ++-- .../develop/build-with-agent-skills.md | 24 +- .../develop/clients/client-best-practices.md | 4 +- .../develop/connect-local-servers.md | 398 +- .../develop/connect-remote-servers.md | 104 +- .../docs/2025-03-26/getting-started/intro.md | 46 +- .../mcp/docs/2025-03-26/learn/architecture.md | 482 +- .../docs/2025-03-26/learn/server-concepts.md | 6 +- .../mcp/docs/2025-03-26/learn/versioning.md | 10 +- content/mcp/docs/2025-03-26/sdk.md | 34 +- .../mcp/docs/2025-03-26/tools/debugging.md | 92 +- .../mcp/docs/2025-03-26/tools/inspector.md | 84 +- .../tutorials/security/authorization.md | 1462 +- .../security/security_best_practices.md | 8 +- .../docs/2025-06-18/develop/build-client.md | 3874 ++- .../docs/2025-06-18/develop/build-server.md | 4712 ++-- .../develop/build-with-agent-skills.md | 24 +- .../develop/clients/client-best-practices.md | 4 +- .../develop/connect-local-servers.md | 398 +- .../develop/connect-remote-servers.md | 104 +- .../docs/2025-06-18/getting-started/intro.md | 46 +- .../mcp/docs/2025-06-18/learn/architecture.md | 482 +- .../docs/2025-06-18/learn/server-concepts.md | 6 +- .../mcp/docs/2025-06-18/learn/versioning.md | 10 +- content/mcp/docs/2025-06-18/sdk.md | 34 +- .../mcp/docs/2025-06-18/tools/debugging.md | 92 +- .../mcp/docs/2025-06-18/tools/inspector.md | 84 +- .../tutorials/security/authorization.md | 1462 +- .../security/security_best_practices.md | 8 +- .../docs/2025-11-25/develop/build-client.md | 3886 ++- .../docs/2025-11-25/develop/build-server.md | 4712 ++-- .../develop/build-with-agent-skills.md | 24 +- .../develop/clients/client-best-practices.md | 4 +- .../develop/connect-local-servers.md | 398 +- .../develop/connect-remote-servers.md | 104 +- .../docs/2025-11-25/getting-started/intro.md | 46 +- .../mcp/docs/2025-11-25/learn/architecture.md | 482 +- .../docs/2025-11-25/learn/server-concepts.md | 6 +- .../mcp/docs/2025-11-25/learn/versioning.md | 10 +- content/mcp/docs/2025-11-25/sdk.md | 34 +- .../mcp/docs/2025-11-25/tools/debugging.md | 92 +- .../mcp/docs/2025-11-25/tools/inspector.md | 84 +- .../tutorials/security/authorization.md | 1462 +- .../security/security_best_practices.md | 8 +- .../docs/2026-07-28/develop/build-client.md | 3870 ++- .../docs/2026-07-28/develop/build-server.md | 4750 ++-- .../develop/build-with-agent-skills.md | 24 +- .../develop/clients/client-best-practices.md | 4 +- .../develop/connect-local-servers.md | 398 +- .../develop/connect-remote-servers.md | 114 +- .../docs/2026-07-28/getting-started/intro.md | 46 +- .../mcp/docs/2026-07-28/learn/architecture.md | 654 +- .../docs/2026-07-28/learn/client-concepts.md | 22 +- .../docs/2026-07-28/learn/server-concepts.md | 6 +- .../mcp/docs/2026-07-28/learn/versioning.md | 10 +- content/mcp/docs/2026-07-28/sdk.md | 34 +- .../mcp/docs/2026-07-28/tools/debugging.md | 102 +- .../mcp/docs/2026-07-28/tools/inspector.md | 230 +- .../tools/inspector/authorization.md | 134 +- .../docs/2026-07-28/tools/inspector/cli.md | 50 +- .../tools/inspector/configuration.md | 110 +- .../tools/inspector/protocol-eras.md | 152 +- .../2026-07-28/tools/inspector/recipes.md | 302 +- .../2026-07-28/tools/inspector/security.md | 32 +- .../docs/2026-07-28/tools/inspector/tui.md | 16 +- .../docs/2026-07-28/tools/inspector/web.md | 32 +- .../tutorials/security/authorization.md | 1604 +- .../security/local-server-security.md | 86 +- .../security/security_best_practices.md | 52 +- .../mcp/docs/draft/develop/build-client.md | 3870 ++- .../mcp/docs/draft/develop/build-server.md | 4752 ++-- .../draft/develop/build-with-agent-skills.md | 24 +- .../develop/clients/client-best-practices.md | 4 +- .../draft/develop/connect-local-servers.md | 398 +- .../draft/develop/connect-remote-servers.md | 114 +- .../mcp/docs/draft/getting-started/intro.md | 46 +- content/mcp/docs/draft/learn/architecture.md | 654 +- .../mcp/docs/draft/learn/client-concepts.md | 22 +- .../mcp/docs/draft/learn/server-concepts.md | 6 +- content/mcp/docs/draft/learn/versioning.md | 10 +- content/mcp/docs/draft/sdk.md | 34 +- content/mcp/docs/draft/tools/debugging.md | 102 +- content/mcp/docs/draft/tools/inspector.md | 230 +- .../draft/tools/inspector/authorization.md | 134 +- content/mcp/docs/draft/tools/inspector/cli.md | 50 +- .../draft/tools/inspector/configuration.md | 110 +- .../draft/tools/inspector/protocol-eras.md | 152 +- .../mcp/docs/draft/tools/inspector/recipes.md | 302 +- .../docs/draft/tools/inspector/security.md | 32 +- content/mcp/docs/draft/tools/inspector/tui.md | 16 +- content/mcp/docs/draft/tools/inspector/web.md | 32 +- .../draft/tutorials/security/authorization.md | 1516 +- .../security/local-server-security.md | 86 +- .../security/security_best_practices.md | 52 +- content/mcp/extensions/apps/build.md | 406 +- content/mcp/extensions/apps/overview.md | 16 +- .../auth/enterprise-managed-authorization.md | 40 +- .../auth/oauth-client-credentials.md | 574 +- content/mcp/extensions/auth/overview.md | 28 +- content/mcp/extensions/client-matrix.md | 40 +- content/mcp/extensions/overview.md | 32 +- content/mcp/extensions/skills/overview.md | 30 +- content/mcp/extensions/tasks/overview.md | 188 +- content/mcp/registry/about.md | 8 +- content/mcp/registry/authentication.md | 340 +- content/mcp/registry/faq.md | 12 +- content/mcp/registry/github-actions.md | 268 +- content/mcp/registry/moderation-policy.md | 6 +- content/mcp/registry/package-types.md | 6 +- content/mcp/registry/quickstart.md | 28 +- content/mcp/registry/registry-aggregators.md | 12 +- content/mcp/registry/remote-servers.md | 6 +- content/mcp/registry/terms-of-service.md | 6 +- content/mcp/registry/versioning.md | 18 +- content/mcp/seps.md | 108 +- ...security-requirements-for-local-server-.md | 28 +- ...fault-values-for-all-primitive-types-in.md | 28 +- ...icitation-for-secure-out-of-band-intera.md | 28 +- ...th-client-credentials-flow-in-authoriza.md | 28 +- ...orking-groups-and-interest-groups-in-mc.md | 28 +- ...idation-errors-as-tool-execution-errors.md | 28 +- ...quest-payload-from-rpc-methods-definiti.md | 28 +- ...-enum-schema-improvements-and-standards.md | 28 +- content/mcp/seps/1577--sampling-with-tools.md | 28 +- ...son-schema-2020-12-as-default-dialect-f.md | 28 +- content/mcp/seps/1686-tasks.md | 28 +- ...-sse-polling-via-server-side-disconnect.md | 28 +- content/mcp/seps/1730-sdks-tiering-system.md | 28 +- .../mcp/seps/1850-pr-based-sep-workflow.md | 28 +- ...pps-interactive-user-interfaces-for-mcp.md | 28 +- ...085-governance-succession-and-amendment.md | 28 +- content/mcp/seps/2106-json-schema-2020-12.md | 28 +- content/mcp/seps/2127-mcp-server-cards.md | 28 +- content/mcp/seps/2133-extensions.md | 28 +- content/mcp/seps/2148-contributor-ladder.md | 28 +- .../2149-working-group-charter-template.md | 28 +- .../mcp/seps/2164-resource-not-found-error.md | 28 +- .../seps/2207-oidc-refresh-token-guidance.md | 28 +- content/mcp/seps/2243-http-standardization.md | 28 +- ...s-to-be-associated-with-Client-requests.md | 28 +- content/mcp/seps/2322-MRTR.md | 58 +- .../2468-recommend-issuer-claim-for-auth.md | 28 +- ...nformance-tests-required-for-final-seps.md | 28 +- content/mcp/seps/2549-TTL-for-list-results.md | 28 +- content/mcp/seps/2567-sessionless-mcp.md | 28 +- content/mcp/seps/2575-stateless-mcp.md | 28 +- ...77-deprecate-roots-sampling-and-logging.md | 28 +- ...-spec-feature-lifecycle-and-deprecation.md | 28 +- content/mcp/seps/2640-skills-extension.md | 28 +- content/mcp/seps/2663-tasks-extension.md | 28 +- content/mcp/seps/414-request-meta.md | 28 +- .../932-model-context-protocol-governance.md | 28 +- ...tional-metadata-for-implementations-res.md | 32 +- ...-20-protected-resource-metadata-with-rf.md | 28 +- .../seps/986-specify-format-for-tool-names.md | 28 +- ...rprise-idp-policy-controls-during-mcp-o.md | 31 +- ...based-client-registration-using-oauth-c.md | 28 +- ...hared-communication-practicesguidelines.md | 28 +- content/mcp/specification/2024-11-05.md | 12 +- content/mcp/specification/2024-11-05/basic.md | 14 +- .../2024-11-05/client/sampling.md | 20 +- .../mcp/specification/2024-11-05/server.md | 8 +- .../2024-11-05/server/prompts.md | 2 +- .../2024-11-05/server/resources.md | 2 +- .../specification/2024-11-05/server/tools.md | 22 +- content/mcp/specification/2025-03-26.md | 12 +- .../2025-03-26/basic/transports.md | 12 +- .../2025-03-26/client/sampling.md | 20 +- .../mcp/specification/2025-03-26/server.md | 8 +- .../2025-03-26/server/prompts.md | 2 +- .../2025-03-26/server/resources.md | 2 +- .../specification/2025-03-26/server/tools.md | 30 +- content/mcp/specification/2025-06-18.md | 14 +- .../specification/2025-06-18/architecture.md | 2 - content/mcp/specification/2025-06-18/basic.md | 2 - .../2025-06-18/basic/authorization.md | 2 - .../2025-06-18/basic/lifecycle.md | 12 +- .../2025-06-18/basic/transports.md | 14 +- .../basic/utilities/cancellation.md | 2 - .../2025-06-18/basic/utilities/ping.md | 2 - .../2025-06-18/basic/utilities/progress.md | 2 - .../mcp/specification/2025-06-18/changelog.md | 2 - .../2025-06-18/client/elicitation.md | 30 +- .../specification/2025-06-18/client/roots.md | 2 - .../2025-06-18/client/sampling.md | 22 +- .../mcp/specification/2025-06-18/schema.md | 1168 +- .../mcp/specification/2025-06-18/server.md | 8 +- .../2025-06-18/server/prompts.md | 14 +- .../2025-06-18/server/resources.md | 4 +- .../specification/2025-06-18/server/tools.md | 62 +- .../2025-06-18/server/utilities/completion.md | 2 - .../2025-06-18/server/utilities/logging.md | 2 - .../2025-06-18/server/utilities/pagination.md | 2 - content/mcp/specification/2025-11-25.md | 14 +- .../specification/2025-11-25/architecture.md | 2 - content/mcp/specification/2025-11-25/basic.md | 2 - .../2025-11-25/basic/authorization.md | 2 - .../2025-11-25/basic/lifecycle.md | 12 +- .../2025-11-25/basic/transports.md | 14 +- .../basic/utilities/cancellation.md | 2 - .../2025-11-25/basic/utilities/ping.md | 2 - .../2025-11-25/basic/utilities/progress.md | 2 - .../2025-11-25/basic/utilities/tasks.md | 74 +- .../mcp/specification/2025-11-25/changelog.md | 2 - .../2025-11-25/client/elicitation.md | 88 +- .../specification/2025-11-25/client/roots.md | 2 - .../2025-11-25/client/sampling.md | 36 +- .../mcp/specification/2025-11-25/schema.md | 1835 +- .../mcp/specification/2025-11-25/server.md | 8 +- .../2025-11-25/server/prompts.md | 14 +- .../2025-11-25/server/resources.md | 4 +- .../specification/2025-11-25/server/tools.md | 62 +- .../2025-11-25/server/utilities/completion.md | 2 - .../2025-11-25/server/utilities/logging.md | 2 - .../2025-11-25/server/utilities/pagination.md | 2 - content/mcp/specification/2026-07-28.md | 14 +- .../specification/2026-07-28/architecture.md | 2 - content/mcp/specification/2026-07-28/basic.md | 36 +- .../2026-07-28/basic/authorization.md | 2 - .../authorization-server-discovery.md | 2 - .../authorization/client-registration.md | 14 +- .../authorization/security-considerations.md | 2 - .../2026-07-28/basic/patterns.md | 2 - .../2026-07-28/basic/patterns/cancellation.md | 2 - .../2026-07-28/basic/patterns/mrtr.md | 48 +- .../2026-07-28/basic/patterns/progress.md | 2 - .../basic/patterns/subscriptions.md | 2 - .../2026-07-28/basic/transports.md | 2 - .../2026-07-28/basic/transports/stdio.md | 2 - .../basic/transports/streamable-http.md | 132 +- .../2026-07-28/basic/versioning.md | 2 - .../mcp/specification/2026-07-28/changelog.md | 2 - .../2026-07-28/client/elicitation.md | 88 +- .../specification/2026-07-28/client/roots.md | 24 +- .../2026-07-28/client/sampling.md | 66 +- .../specification/2026-07-28/deprecated.md | 2 - .../mcp/specification/2026-07-28/schema.md | 2471 +- .../mcp/specification/2026-07-28/server.md | 8 +- .../2026-07-28/server/discover.md | 14 +- .../2026-07-28/server/prompts.md | 30 +- .../2026-07-28/server/resources.md | 20 +- .../specification/2026-07-28/server/tools.md | 114 +- .../2026-07-28/server/utilities/caching.md | 18 +- .../2026-07-28/server/utilities/completion.md | 18 +- .../2026-07-28/server/utilities/logging.md | 26 +- .../2026-07-28/server/utilities/pagination.md | 18 +- content/mcp/specification/draft.md | 14 +- .../mcp/specification/draft/architecture.md | 2 - content/mcp/specification/draft/basic.md | 36 +- .../draft/basic/authorization.md | 2 - .../authorization-server-discovery.md | 2 - .../authorization/client-registration.md | 14 +- .../authorization/security-considerations.md | 2 - .../mcp/specification/draft/basic/patterns.md | 2 - .../draft/basic/patterns/cancellation.md | 2 - .../draft/basic/patterns/mrtr.md | 48 +- .../draft/basic/patterns/progress.md | 2 - .../draft/basic/patterns/subscriptions.md | 2 - .../specification/draft/basic/transports.md | 2 - .../draft/basic/transports/stdio.md | 2 - .../draft/basic/transports/streamable-http.md | 132 +- .../specification/draft/basic/versioning.md | 2 - .../specification/draft/client/elicitation.md | 88 +- .../mcp/specification/draft/client/roots.md | 24 +- .../specification/draft/client/sampling.md | 66 +- content/mcp/specification/draft/deprecated.md | 2 - content/mcp/specification/draft/schema.md | 2471 +- content/mcp/specification/draft/server.md | 8 +- .../specification/draft/server/discover.md | 14 +- .../mcp/specification/draft/server/prompts.md | 30 +- .../specification/draft/server/resources.md | 20 +- .../mcp/specification/draft/server/tools.md | 114 +- .../draft/server/utilities/caching.md | 18 +- .../draft/server/utilities/completion.md | 18 +- .../draft/server/utilities/logging.md | 26 +- .../draft/server/utilities/pagination.md | 18 +- ...0166901-use-google-workspace-connectors.md | 6 +- ...how-do-i-log-out-of-all-active-sessions.md | 2 +- ...k-settings-on-team-and-enterprise-plans.md | 2 +- .../10593882-share-and-unshare-chats.md | 6 +- ...ith-local-mcp-servers-on-claude-desktop.md | 2 +- content/support/11101966-use-voice-mode.md | 8 +- ...the-claude-lti-in-canvas-by-instructure.md | 2 +- ...and-memory-to-build-on-previous-context.md | 10 +- ...being-asked-to-verify-my-payment-method.md | 2 +- .../11869629-use-claude-with-android-apps.md | 2 +- ...or-team-and-seat-based-enterprise-plans.md | 10 +- ...12173-get-started-with-claude-in-chrome.md | 2 +- ...11783-create-and-edit-files-with-claude.md | 6 +- .../support/12260368-use-incognito-chats.md | 2 +- .../support/12293051-use-claude-in-xcode.md | 2 +- ...age-usage-credits-for-paid-claude-plans.md | 2 +- ...6728-troubleshoot-claude-error-messages.md | 2 +- .../support/12512180-use-skills-in-claude.md | 2 +- ...d-using-the-desktop-extension-allowlist.md | 8 +- .../12618689-use-claude-code-in-the-cloud.md | 6 +- ...-quick-entry-with-claude-desktop-on-mac.md | 2 +- ...analytics-for-team-and-enterprise-plans.md | 24 +- ...2446-claude-in-chrome-permissions-guide.md | 4 +- .../12997503-team-plan-billing-faqs.md | 2 +- .../13132885-set-up-single-sign-on-sso.md | 8 +- ...3133195-set-up-jit-or-scim-provisioning.md | 6 +- ...1-configuring-session-security-settings.md | 6 +- .../13189465-log-in-to-your-claude-account.md | 2 +- .../13325567-account-management-faqs.md | 2 +- ...13345190-get-started-with-claude-cowork.md | 2 +- ...tomize-your-console-appearance-settings.md | 9 + ...13371040-log-in-to-your-console-account.md | 2 +- ...64-invite-members-to-the-claude-console.md | 33 + ...13641943-visual-and-interactive-content.md | 6 +- .../support/13837440-use-plugins-in-claude.md | 4 +- ...manage-custom-roles-on-enterprise-plans.md | 34 +- ...e-based-permissions-on-enterprise-plans.md | 14 +- ...gn-tasks-from-anywhere-in-claude-cowork.md | 4 +- ...ur-tasks-with-projects-in-claude-cowork.md | 12 +- ...3555-set-up-code-review-for-claude-code.md | 2 +- ...sync-works-for-enterprise-organizations.md | 4 +- .../14604842-cyber-verification-program.md | 2 +- ...t-a-default-model-for-your-organization.md | 2 +- ...nage-model-access-for-your-organization.md | 8 +- ...1-get-started-with-1password-for-claude.md | 2 +- ...rstanding-your-pro-or-max-plan-invoices.md | 2 +- ...16893491-get-started-with-smart-reports.md | 14 +- ...claude-in-google-docs-sheets-and-slides.md | 4 +- ...ooled-group-budgets-on-enterprise-plans.md | 2 +- .../17203415-set-up-claude-for-intune.md | 22 +- ...from-standalone-claude-design-to-claude.md | 22 +- ...rience-for-your-enterprise-organization.md | 4 +- .../8114491-get-started-with-claude.md | 2 +- ...8230524-delete-or-rename-a-conversation.md | 16 +- .../support/8325618-paid-plan-billing-faqs.md | 2 +- ...27-customizing-your-appearance-settings.md | 6 +- ...nt-to-a-team-or-enterprise-organization.md | 2 +- ...77-how-can-i-create-and-manage-projects.md | 6 +- ...ractices-keep-your-keys-safe-and-secure.md | 124 + ...manage-workspaces-in-the-claude-console.md | 177 + 887 files changed, 88249 insertions(+), 97426 deletions(-) create mode 100644 content/en/manage-claude/user-profiles-verification-portal.md create mode 100644 content/en/manage-claude/user-profiles.md create mode 100644 content/support/13346458-customize-your-console-appearance-settings.md create mode 100644 content/support/13443764-invite-members-to-the-claude-console.md create mode 100644 content/support/9767949-api-key-best-practices-keep-your-keys-safe-and-secure.md create mode 100644 content/support/9796807-create-and-manage-workspaces-in-the-claude-console.md diff --git a/content/.metadata.json b/content/.metadata.json index 92cbded8de..50090cafa5 100644 --- a/content/.metadata.json +++ b/content/.metadata.json @@ -1,7 +1,7 @@ { "metadata": { "version": "2.0", - "fetch_date": "2026-10-20T15:25:20.147282Z", + "fetch_date": "2026-10-20T19:41:29.203244Z", "section": "all" }, "items": [ @@ -30,7 +30,7 @@ "url": "https://platform.claude.com/docs/en/get-started", "status": "success", "path": "en/get-started.md", - "sha256": "cd14085efdac0296a2673423d75c5ecdd17465dc1df5ce5bc96217cbecdec210", + "sha256": "d1deb6a8014eec20a7486affd5bf0ee4a41a8bd9a0447b3d3e6d7298be41ef82", "size": 19486 }, { @@ -548,7 +548,7 @@ "url": "https://platform.claude.com/docs/en/agents-and-tools/mcp-connector", "status": "success", "path": "en/agents-and-tools/mcp-connector.md", - "sha256": "2208c789f092fd8a8e7dbdc63b154e6e0afdba41dd6d5410bc40345b20ef44ee", + "sha256": "c7ce4c3fcedbb58d1609e2a0cae35f5d70db51df070226cc8eeacf683686e708", "size": 73460 }, { @@ -569,7 +569,7 @@ "url": "https://platform.claude.com/docs/en/agents-and-tools/mcp-tunnels/quickstart", "status": "success", "path": "en/agents-and-tools/mcp-tunnels/quickstart.md", - "sha256": "5ff5a8d91a53ffdd7d6001223304dbc4a6a09b063030a373da5d47be5bf849ab", + "sha256": "9ec8b89e700af70117536aa9c06b61510d68631070932629242b6abde8447408", "size": 11765 }, { @@ -583,14 +583,14 @@ "url": "https://platform.claude.com/docs/en/agents-and-tools/mcp-tunnels/deploy-helm", "status": "success", "path": "en/agents-and-tools/mcp-tunnels/deploy-helm.md", - "sha256": "bf2a2d8b3441cb1e6a4164ffb4b825c2af0b514322041b3fb6902ffcccbe32da", + "sha256": "a2e66ce4c5e74595913dbd6128978f496943bcf074a4de9877e11ed1bda6d099", "size": 24644 }, { "url": "https://platform.claude.com/docs/en/agents-and-tools/mcp-tunnels/deploy-compose", "status": "success", "path": "en/agents-and-tools/mcp-tunnels/deploy-compose.md", - "sha256": "8ac03500de52410e653c69c516a81cf5cf2506025eecc26148966fa94079c42a", + "sha256": "899b651af5663e1c971da22569334992f2c1be031962ac9c32360c8d308020bf", "size": 22931 }, { @@ -618,35 +618,35 @@ "url": "https://platform.claude.com/docs/en/build-with-claude/claude-in-amazon-bedrock", "status": "success", "path": "en/build-with-claude/claude-in-amazon-bedrock.md", - "sha256": "6e7baa46848766e0798e667d1bd4c77846fa35e5ee7cf29fbf362e14b32867c6", + "sha256": "48e34583aa3186886022d3fb3cd09eefff71f876d72984770db0c850e7a2c291", "size": 23203 }, { "url": "https://platform.claude.com/docs/en/build-with-claude/claude-on-amazon-bedrock-legacy", "status": "success", "path": "en/build-with-claude/claude-on-amazon-bedrock-legacy.md", - "sha256": "9f90efb2df6090a4b7665e47b4ff3adb05052e58eecea520c743f047da76b423", + "sha256": "957bb6fa7d61889e54f8d0c8ad6aba0948bee13987fbf52d487be0f6ee16e130", "size": 41690 }, { "url": "https://platform.claude.com/docs/en/build-with-claude/claude-platform-on-aws", "status": "success", "path": "en/build-with-claude/claude-platform-on-aws.md", - "sha256": "1318f4972d5d2366399afe17c0bc680d9d443ed5a1314737733941f9bcb0da46", + "sha256": "e091731c14bf3e9aa4f4697f4aadfd2501b76650bb00da92f72f50bb414e677d", "size": 101491 }, { "url": "https://platform.claude.com/docs/en/build-with-claude/claude-on-vertex-ai", "status": "success", "path": "en/build-with-claude/claude-on-vertex-ai.md", - "sha256": "711ad1ed62a9ea3cb92fd7d5e1a966a2a77ecaf2b7a6203299a605d5118c65e4", + "sha256": "64369239253b89cccb5d4ea80c31299750f96149abbae54a24ea8b3e2cd6bf04", "size": 35194 }, { "url": "https://platform.claude.com/docs/en/build-with-claude/claude-in-microsoft-foundry", "status": "success", "path": "en/build-with-claude/claude-in-microsoft-foundry.md", - "sha256": "6e663ef09d1e4af2293ac6fe2fb3e1a48b263a7d8b1df5ccef4a17d1e2a5ab41", + "sha256": "b13e65158d6e1bf0889f5f0ffcec33c84415fc1c9e5a5fdeb4bc912835516af4", "size": 39362 }, { @@ -660,7 +660,7 @@ "url": "https://platform.claude.com/docs/en/managed-agents/quickstart", "status": "success", "path": "en/managed-agents/quickstart.md", - "sha256": "24d021bd58cf093deeeaae8b9ac0a9088f6b8739349bc691b44765bab767921a", + "sha256": "cfb6d00ee88220de01f7e9c43c787dc43bdde03c8a30af33659b07b80de37b68", "size": 34661 }, { @@ -744,14 +744,14 @@ "url": "https://platform.claude.com/docs/en/managed-agents/self-hosted-sandboxes", "status": "success", "path": "en/managed-agents/self-hosted-sandboxes.md", - "sha256": "868efebbf28cc8632f84c9edb8818327ba6076991983db23c88104e3a94a8f75", + "sha256": "613bb81d7340993003435e9d77bfeb108aa79263ca5a8059cf4c1df4a259c55a", "size": 22845 }, { "url": "https://platform.claude.com/docs/en/managed-agents/self-hosted-sandboxes-workers", "status": "success", "path": "en/managed-agents/self-hosted-sandboxes-workers.md", - "sha256": "38cf0c17d9b53f0e7cd28542fccafa1888487c7aba16296affd4d954b2cab234", + "sha256": "2d10ee04f30f754e6b87f08e90f2b0ff28a957ca0027ba473b3fb6ed437d1daa", "size": 38476 }, { @@ -961,8 +961,8 @@ "url": "https://platform.claude.com/docs/en/manage-claude/workspaces", "status": "success", "path": "en/manage-claude/workspaces.md", - "sha256": "ad65090dc1cdf23fb3b8e9ebe51fedaadcef41f8ed95760bf5dd7e31c2abe265", - "size": 45548 + "sha256": "2c2f12d048237824bf427210be8f0e95ba68be5ba5bcea802bc9410ab0a4633e", + "size": 45554 }, { "url": "https://platform.claude.com/docs/en/manage-claude/admin-api-keys", @@ -1059,8 +1059,8 @@ "url": "https://platform.claude.com/docs/en/manage-claude/rate-limits-api", "status": "success", "path": "en/manage-claude/rate-limits-api.md", - "sha256": "29ef8023fff2261dc3e45fdfc5d710bfae11f84515bc91eb024422f946297006", - "size": 38351 + "sha256": "6f6b3c4364f8259eb08e0d498352def60c07f6c074ad41d7af9f80c93ef9d227", + "size": 38414 }, { "url": "https://platform.claude.com/docs/en/manage-claude/analytics-api", @@ -1073,8 +1073,8 @@ "url": "https://platform.claude.com/docs/en/manage-claude/claude-code-analytics-api", "status": "success", "path": "en/manage-claude/claude-code-analytics-api.md", - "sha256": "6dd6ac3541cd2e03c2eeeb0fb50b2131ceb0ac96d1f29aee566dfef286eb2666", - "size": 13158 + "sha256": "46681f8615a45eb862992a60a0041ed31ddf2e0dcdadc066ac919556a7cffbb4", + "size": 14075 }, { "url": "https://platform.claude.com/docs/en/manage-claude/spend-limits-api", @@ -1094,7 +1094,7 @@ "url": "https://platform.claude.com/docs/en/manage-claude/opentelemetry/sdk", "status": "success", "path": "en/manage-claude/opentelemetry/sdk.md", - "sha256": "48f9d2cfa96747bdfd7518ac87d747be70d7757bbc86c5c28375df9093c05c82", + "sha256": "92b5a5fbdf4ee12a89af6ef30088b0de9ee180e9064c0f4f1309ecb9fe753131", "size": 32008 }, { @@ -1115,8 +1115,8 @@ "url": "https://platform.claude.com/docs/en/manage-claude/api-and-data-retention", "status": "success", "path": "en/manage-claude/api-and-data-retention.md", - "sha256": "b850752c447970458a1c0d63c21d2792923faddf55d4135db98049cc599e9309", - "size": 60001 + "sha256": "766c1c0acaa0ed9d704f732b6e86bcd512455e20624ebd1e2aa08e14427fcd16", + "size": 60878 }, { "url": "https://platform.claude.com/docs/en/manage-claude/access-transparency", @@ -1143,57 +1143,57 @@ "url": "https://platform.claude.com/docs/en/manage-claude/cmek-google-cloud-kms", "status": "success", "path": "en/manage-claude/cmek-google-cloud-kms.md", - "sha256": "3d3c42f748db8c43d2160fa0fe88067bab3a79d2a45d131aff93e3a742040ee5", - "size": 28205 + "sha256": "74b1980af64039cf32440efcb9c414a1cd3dad2fa34c54de31839a0dcb492ee4", + "size": 28201 }, { "url": "https://platform.claude.com/docs/en/manage-claude/cmek-azure-key-vault", "status": "success", "path": "en/manage-claude/cmek-azure-key-vault.md", - "sha256": "867c268753d41fbe68fed2afb4b281967e0eebfbf57af8f113d2a1980102dc35", - "size": 30057 + "sha256": "76862795881b50820bfa8820f9865272acebd51106d6b615711e71a3765be725", + "size": 30077 }, { "url": "https://platform.claude.com/docs/en/manage-claude/cmek-aws-kms", "status": "success", "path": "en/manage-claude/cmek-aws-kms.md", - "sha256": "04ccbbe2ecd42c1e97f0213ff6008d54aea56d1d0826d4191aba51aa0bfce643", - "size": 28493 + "sha256": "5553fd96ed751fe1a4348086f9f485aa7bd77793a79c9d9368c26a81458988a6", + "size": 28316 }, { "url": "https://platform.claude.com/docs/en/manage-claude/cmek-claude-platform-on-aws", "status": "success", "path": "en/manage-claude/cmek-claude-platform-on-aws.md", - "sha256": "59fded7793b8189e0724ee0fec24b0f892d70cf1ff45be10625702e3dfc5ef92", - "size": 12324 + "sha256": "396c4afd70ff455ebdeae5c97794620c176c80ae924ec8dea1d3df288cc5a58a", + "size": 12320 }, { "url": "https://platform.claude.com/docs/en/manage-claude/inference-hooks", "status": "success", "path": "en/manage-claude/inference-hooks.md", - "sha256": "23ab1eae12b4c305187e9800e9bbb124728f6f59e8554945c39ca798bb26a0e5", - "size": 12932 + "sha256": "027a8c26271676879cb87ab3f32660cc4bc517b91ad3d676dcc6b23b7ac6eb97", + "size": 12746 }, { "url": "https://platform.claude.com/docs/en/manage-claude/inference-hooks-configuration", "status": "success", "path": "en/manage-claude/inference-hooks-configuration.md", - "sha256": "67e4c55e449fb82a44b4b6b3cd52309306ca1e7c0d8c65a35e6c1e0fa64dc0e8", - "size": 22797 + "sha256": "56a75c1d356642191e0026fdee5918896c2faaefa1521936850ab27c9d27e857", + "size": 22790 }, { "url": "https://platform.claude.com/docs/en/manage-claude/inference-hooks-endpoint", "status": "success", "path": "en/manage-claude/inference-hooks-endpoint.md", - "sha256": "f2edca0242bbe9d9fd231744a177dff3a06705e795e609678509c664b33f8a94", - "size": 52918 + "sha256": "b9ae24570ba6f0df43491b96a18c5752d373d270f8c28962ebedffd44a92ba12", + "size": 52842 }, { "url": "https://platform.claude.com/docs/en/manage-claude/compliance-api", "status": "success", "path": "en/manage-claude/compliance-api.md", - "sha256": "5dd9e15377a898d3a336879358e69ec7c8756dc042ef477a9667433b45bfb7ea", - "size": 10168 + "sha256": "325206be4422164ba5077faeaca4ad3212d84d970734aa7f99840a91e6c987b8", + "size": 10161 }, { "url": "https://platform.claude.com/docs/en/manage-claude/compliance-api-access", @@ -1822,7 +1822,7 @@ "url": "https://platform.claude.com/docs/en/cli-sdks-libraries/cli/quickstart", "status": "success", "path": "en/cli-sdks-libraries/cli/quickstart.md", - "sha256": "a9e3be23d13d58015d46e309e459d173c88289bd7a840db4346e62b68b73fe1d", + "sha256": "612476e1d5e846fba873f2d1432925ce424cfb3a754776ccd7ce8b671ca005fe", "size": 5341 }, { @@ -1892,14 +1892,14 @@ "url": "https://platform.claude.com/docs/en/cli-sdks-libraries/sdks/go", "status": "success", "path": "en/cli-sdks-libraries/sdks/go.md", - "sha256": "ef5da11bc4557b634f5c4e47557b7ab009c486464e4064970bb2c0c16de40f0e", - "size": 26781 + "sha256": "a48d6d19a4932f9697c1afa2bedae4c5d738108b0475f1c0b1404e36b48a635d", + "size": 26763 }, { "url": "https://platform.claude.com/docs/en/cli-sdks-libraries/sdks/java", "status": "success", "path": "en/cli-sdks-libraries/sdks/java.md", - "sha256": "778b69b061f8b93b092275f88303b25f54aef77156d2aefef4407a34effbccd2", + "sha256": "064a7442e2289e17950618a31e01cea7f99940cbc02a363de8fca9c0988bc203", "size": 47969 }, { @@ -1962,8 +1962,8 @@ "url": "https://platform.claude.com/docs/en/api/rate-limits", "status": "success", "path": "en/api/rate-limits.md", - "sha256": "b39bbd63ff34df9071cddd13acbaac71016bd533481e6f617b09fee8ee5aff7f", - "size": 36050 + "sha256": "00194eb8ec221f26de4c135941be011edfa77e565dc3ef0b00bd385affe39827", + "size": 36056 }, { "url": "https://platform.claude.com/docs/en/api/service-tiers", @@ -2018,8 +2018,8 @@ "url": "https://platform.claude.com/docs/en/release-notes/overview", "status": "success", "path": "en/release-notes/overview.md", - "sha256": "801e14d636678798437907149d6ce7945016c851f3dfe9cd6ccc005c2c20d229", - "size": 127201 + "sha256": "3fbb221d699bf95b8d9f30822dcc20a2d192a16ad04f41961f6955cb1d0e8f4d", + "size": 127364 }, { "url": "https://platform.claude.com/docs/en/api/completions", @@ -5500,96 +5500,110 @@ "sha256": "04bcfe3edf6b244798d0e36315580b410f4bfae3c3c2f10867bcb05b17ef3f8b", "size": 27300 }, + { + "url": "https://platform.claude.com/docs/en/manage-claude/user-profiles", + "status": "success", + "path": "en/manage-claude/user-profiles.md", + "sha256": "1f1cb2a55e47954c760a49a5ab93fdf1f98fb375da5ebb4af5707c2b09ba40f6", + "size": 30826 + }, + { + "url": "https://platform.claude.com/docs/en/manage-claude/user-profiles-verification-portal", + "status": "success", + "path": "en/manage-claude/user-profiles-verification-portal.md", + "sha256": "3c07d93661b1dae94fbd53faad8d012654b2e49cd6023e792adeae5ed16eac8e", + "size": 10845 + }, { "url": "https://code.claude.com/docs/en/overview", "status": "success", "path": "en/docs/claude-code/overview.md", - "sha256": "0d4015b91bbf139fd302fa92a66704694a080c7970ded26026696b57dafbf562", - "size": 16572 + "sha256": "a706f34a6386e51e31389479df863314bad27052f3eef6cbf8ffa577bec17d85", + "size": 15452 }, { "url": "https://code.claude.com/docs/en/quickstart", "status": "success", "path": "en/docs/claude-code/quickstart.md", - "sha256": "41e9970c2a237b86765c3a95e326c6c78000f878cc782d3f2dacae48151067fa", - "size": 12546 + "sha256": "d2ce90134a531be973fcb8ca803988842e141b9837b6bbc7bf417cb359d6e8a8", + "size": 12138 }, { "url": "https://code.claude.com/docs/en/changelog", "status": "success", "path": "en/docs/claude-code/changelog.md", - "sha256": "5ad51209d6fd39b4e0bbe3a791092b57de90a5ec254d7cc4b4c82169aa86d7c9", - "size": 1126573 + "sha256": "d549f14da57ff2f07b52b94f2e3cf7a9a5b90c2a06f89a7d2e01740c195083cd", + "size": 1070406 }, { "url": "https://code.claude.com/docs/en/how-claude-code-works", "status": "success", "path": "en/docs/claude-code/how-claude-code-works.md", - "sha256": "7afb973162be7140d93d3941eb1dab438a5119e00ddeb2684c56541cc3a16ed1", - "size": 19654 + "sha256": "c3cfd24cbd4f08f42bb1c38207a64b6db1b0ffb9e277062c87da9e2c00770388", + "size": 18484 }, { "url": "https://code.claude.com/docs/en/features-overview", "status": "success", "path": "en/docs/claude-code/features-overview.md", - "sha256": "55baae6766d04686f88dd4640975957bc666b94907b02d50581fac4cc908f017", - "size": 28568 + "sha256": "f58a1fe2df7ddf2bf6030cdd6d84270d010dbccef1d3a787017d493f615f7e85", + "size": 26858 }, { "url": "https://code.claude.com/docs/en/claude-directory", "status": "success", "path": "en/docs/claude-code/claude-directory.md", - "sha256": "78d69a57cb13b8bd1657e2f08b564e51307911b942b494805c5d01b1818ed7e0", - "size": 92528 + "sha256": "cc7c1b1f2c77de338090828186f569df3b7bf6b089c01df8a4d78fa412eabff2", + "size": 28378 }, { "url": "https://code.claude.com/docs/en/context-window", "status": "success", "path": "en/docs/claude-code/context-window.md", - "sha256": "604b515b1c7da113051f5adc1423931b8d9ddd658b2eba85c339abcab24eb772", - "size": 60130 + "sha256": "168ad687a36f4c4fd7c8531efe37be728f600b417a23119c4b37439a66b2bbf8", + "size": 8411 }, { "url": "https://code.claude.com/docs/en/prompt-caching", "status": "success", "path": "en/docs/claude-code/prompt-caching.md", - "sha256": "bf0e42060b519be1966b3cf3ea6540685fa416c16ef21063a8f76c3d46791f2d", - "size": 42697 + "sha256": "f57c7968d628e2e114a8e95365cd7f6c89429c46654779fe65165c999080c1da", + "size": 41910 }, { "url": "https://code.claude.com/docs/en/memory", "status": "success", "path": "en/docs/claude-code/memory.md", - "sha256": "485f8fff5acec2f72bccf4ec4e0f835fd54c6cf0cf00052a7d4af2dd16d3e50e", - "size": 51243 + "sha256": "880f8371930be20fa8679619c84e2c0da2086d1b5fcd29d48ac7b27c07595a7a", + "size": 51105 }, { "url": "https://code.claude.com/docs/en/sessions", "status": "success", "path": "en/docs/claude-code/sessions.md", - "sha256": "93fa5884dbfa5ee530fcd0bf8035faeaf718a7c09dac1ba7b43c9fedd1105132", - "size": 31470 + "sha256": "6939e201a8768acd00e326210f3a35a4f61c0d23eaaabf7546458aff92abae1b", + "size": 31381 }, { "url": "https://code.claude.com/docs/en/common-workflows", "status": "success", "path": "en/docs/claude-code/common-workflows.md", - "sha256": "01cb490473952efefb2fec1d9fb9930e1c5c850f123511e1dae63512cec6c8b2", - "size": 18563 + "sha256": "e86258b835af468848af32976cbfe0123aeb635216d9502da323cc2b18953b54", + "size": 17106 }, { "url": "https://code.claude.com/docs/en/prompt-library", "status": "success", "path": "en/docs/claude-code/prompt-library.md", - "sha256": "4cb8c142ce146d497a3a829fccf4ea50fe14d12c2a73557733c6713a4f71f2d7", - "size": 65861 + "sha256": "eaa70e6de18a9f9c78aea5671778ac25e86d5b5f3efb9fb7b19eaee254645bca", + "size": 4554 }, { "url": "https://code.claude.com/docs/en/best-practices", "status": "success", "path": "en/docs/claude-code/best-practices.md", - "sha256": "b98fde020aa0e3c9d5ee3f338063369456d8b436a5c5696dfbc8641761e44fb1", - "size": 36616 + "sha256": "e3b99b377961bdd071ec6390904dcb319c9d3d3a8f627230642eeb84ad753d2e", + "size": 36231 }, { "url": "https://code.claude.com/docs/en/platforms", @@ -5602,169 +5616,169 @@ "url": "https://code.claude.com/docs/en/remote-control", "status": "success", "path": "en/docs/claude-code/remote-control.md", - "sha256": "42b31331cfde88481d642a6cf8af995597484758dd54cda76a43dfd11093bbf0", - "size": 58097 + "sha256": "06f521ea3203f924d26f249821d90152a9a6adae083855240c3f2f56f0dc6488", + "size": 58086 }, { "url": "https://code.claude.com/docs/en/claude-projects", "status": "success", "path": "en/docs/claude-code/claude-projects.md", - "sha256": "129723c935cc7b5334aaed857f2d1bfdda74cffc1c920ba77af08103ba885033", - "size": 61650 + "sha256": "7e6d57f513c3db5c9160505af6a97699fcae85a96bfd8ffed25fa6e8234b3710", + "size": 60476 }, { "url": "https://code.claude.com/docs/en/mobile", "status": "success", "path": "en/docs/claude-code/mobile.md", - "sha256": "f609f816f5627da08af264044e36521cad33ae19dcb6b85ee2778c71dd2faa0c", - "size": 8474 + "sha256": "40ea3d9e072ea792b5f535e2e790a789e89b9bc22bc780e1fa8ec31f6656eaf5", + "size": 8371 }, { "url": "https://code.claude.com/docs/en/chrome", "status": "success", "path": "en/docs/claude-code/chrome.md", - "sha256": "d2e02e7056580e53357a6940b821c4e04e6135b2248d861fd8d91a052b7cc671", - "size": 22909 + "sha256": "b5d861245a0e1b05c0b06d4b6abc9e6e66dbea5f79609c3b0791231269618f44", + "size": 23346 }, { "url": "https://code.claude.com/docs/en/computer-use", "status": "success", "path": "en/docs/claude-code/computer-use.md", - "sha256": "de3cc4cf15744a48add0e568373b7ea26a9bf51cd8b143a68c084c2977e1163c", - "size": 11980 + "sha256": "2626707eed4301442ebcb157b71887b357d072ed57aaddafb3173ef401174b29", + "size": 11857 }, { "url": "https://code.claude.com/docs/en/vs-code", "status": "success", "path": "en/docs/claude-code/vs-code.md", - "sha256": "8168fafb49343ebe23d475d4049baf60e21f30a5022bfe20d76b27e59c2a6765", - "size": 86593 + "sha256": "195dc53458b97c3655553d45f0d1cee1086949b1aec889a120dc532cb3c6f748", + "size": 85497 }, { "url": "https://code.claude.com/docs/en/jetbrains", "status": "success", "path": "en/docs/claude-code/jetbrains.md", - "sha256": "9a46390fef17bd6158ed594090f08dd6368b7f748adaeb1c27d068a20e97384c", - "size": 12650 + "sha256": "e4213a1aa511ecdb9079ec2b6e21888d592de511009dbfbee9806b832ec98470", + "size": 12391 }, { "url": "https://code.claude.com/docs/en/slack", "status": "success", "path": "en/docs/claude-code/slack.md", - "sha256": "907f714fd4dcfd36ceafb20c2f8b7d1ce1dac1ebf45085ab112e8dead8385cdc", - "size": 16220 + "sha256": "f3d51dc7565ea6f318d22d2ab6856e942138461f8d43ba0d1616363d2c25dbf8", + "size": 15674 }, { "url": "https://code.claude.com/docs/en/web-quickstart", "status": "success", "path": "en/docs/claude-code/web-quickstart.md", - "sha256": "2c806b2a906a47b9dec9793fc54908204ebc7fc3a348674442dc16ceb7d3ed97", - "size": 24435 + "sha256": "cc44e87a0baaa5d4c47f013a8e2dc2f06d15e05fee1b9b4c7beac23893b4aeed", + "size": 23856 }, { "url": "https://code.claude.com/docs/en/claude-code-on-the-web", "status": "success", "path": "en/docs/claude-code/claude-code-on-the-web.md", - "sha256": "ae86b9fcfa6efe1082e60662de6a8bff60b3614237293a130133c13dc6ae352e", - "size": 41138 + "sha256": "1c9322f250aaeddac5d8e4f6c000620cf893773f7a30ea9a2dca05b2c2e8eb3c", + "size": 41791 }, { "url": "https://code.claude.com/docs/en/routines", "status": "success", "path": "en/docs/claude-code/routines.md", - "sha256": "e4369e748142fc2f810cede0a4a8e7feb38fe3764a12ceccba32df9d2e863b92", - "size": 40898 + "sha256": "206c4ab09968481c30f021fb4a521378c01de36a1caeeea561390b8f3ee11ae9", + "size": 39893 }, { "url": "https://code.claude.com/docs/en/desktop-quickstart", "status": "success", "path": "en/docs/claude-code/desktop-quickstart.md", - "sha256": "5800b5ec832b6299e2d899ba591225455fac990e455fd88cad478670b82e9b84", - "size": 11317 + "sha256": "b7fbe58373e4b153a566ad86ecb2f2bbbdeea53db87259c44239519368a3833d", + "size": 10921 }, { "url": "https://code.claude.com/docs/en/desktop", "status": "success", "path": "en/docs/claude-code/desktop.md", - "sha256": "c7bf4f1cdf3b7c16d3b4c092887779602582642e1cebe0fa54387c44d880d32c", - "size": 166053 + "sha256": "2bb49a13cfba31e66f7496fd5b8f305b59a4b2f074a7b9a36608b12a203c419e", + "size": 163615 }, { "url": "https://code.claude.com/docs/en/desktop-linux", "status": "success", "path": "en/docs/claude-code/desktop-linux.md", - "sha256": "4682e01653f2dd4de5b8266f8c9a2308b52d1e94d8d23648b0391d9593dd7fec", - "size": 12875 + "sha256": "3685489da50e3d8a0d91864acab70f16d675fe06d3be81abdeeecd74a808ab0b", + "size": 12644 }, { "url": "https://code.claude.com/docs/en/desktop-wsl", "status": "success", "path": "en/docs/claude-code/desktop-wsl.md", - "sha256": "304f6816364c84f68233423e3626e44d1ee8f895afcea4f0a49d89c898e65f8c", - "size": 4147 + "sha256": "231c832ba9fa47a009e5e436d1c8304877b6f11dcdae0ba9e8d5bfebe7fb3dc3", + "size": 4011 }, { "url": "https://code.claude.com/docs/en/desktop-scheduled-tasks", "status": "success", "path": "en/docs/claude-code/desktop-scheduled-tasks.md", - "sha256": "4964fbeb81c917b7dfc17c16f8ba21673e3d7e21035909d6be3930a3ce497537", - "size": 12470 + "sha256": "b786dc6c1e511e660ffd933533d30febc19e31676a6f29e956ded2a58f758849", + "size": 12234 }, { "url": "https://code.claude.com/docs/en/desktop-ios-simulator", "status": "success", "path": "en/docs/claude-code/desktop-ios-simulator.md", - "sha256": "86689bba520207a5d3f5a40c149a78e18a12c0be6728425772e2f7875428c21c", - "size": 12113 + "sha256": "0353443592f6a1898241d93cf6da4690de885feb6760cf3f92aa72dc870c7264", + "size": 12009 }, { "url": "https://code.claude.com/docs/en/code-review-local", "status": "success", "path": "en/docs/claude-code/code-review-local.md", - "sha256": "957d41ef28b22797358ca0ba3e9a363d552934257522c41c30318285530e5931", - "size": 13929 + "sha256": "c2d7c2607fa497cecdae3ce3be1ee4e77e7e33db454dfa9dec08d872cc567f6d", + "size": 13809 }, { "url": "https://code.claude.com/docs/en/ultrareview", "status": "success", "path": "en/docs/claude-code/ultrareview.md", - "sha256": "d02944d665975514e2818b7035bbd4e18c16cdee0d4f605b2998df9f5d665b77", - "size": 18257 + "sha256": "d3485b1b541ee6352e0274024950111bee31463463e31a2aac4e30625d0c06e6", + "size": 18252 }, { "url": "https://code.claude.com/docs/en/github-enterprise-server", "status": "success", "path": "en/docs/claude-code/github-enterprise-server.md", - "sha256": "5ca20cdd6250b08d354cb9daab756248ea699fbdaeff36853ed37bdc9d095502", - "size": 20088 + "sha256": "fb2bb152ad480efbb319b7347d2886fbe0d4ddf5a2833812d3f96a4b376a4ef6", + "size": 19947 }, { "url": "https://code.claude.com/docs/en/code-review", "status": "success", "path": "en/docs/claude-code/code-review.md", - "sha256": "e27d0098417de60dc9792fdc86087415970e88a8fdfca60c6b9b3207d39bc5d6", - "size": 10831 + "sha256": "b78401cd71f69d635c76542937eb06f781da54b2ad624b14dae348edc67e2415", + "size": 9623 }, { "url": "https://code.claude.com/docs/en/code-review-setup", "status": "success", "path": "en/docs/claude-code/code-review-setup.md", - "sha256": "911be118208244c5674069cd74ec7c9e375bfd11cd088b35aea52d837de18b1c", - "size": 14017 + "sha256": "838ddecc56d1aaa24b18e078f2ec41299cf375a038a0bf2d74147820a31564e5", + "size": 13818 }, { "url": "https://code.claude.com/docs/en/code-review-customize", "status": "success", "path": "en/docs/claude-code/code-review-customize.md", - "sha256": "934b5d7ed1a1dd671af0e7cce0d19385fac5736d77c1f80d775d235f776bb629", - "size": 8585 + "sha256": "06b2ca9daec82d123f94c6cea85e28ccc35fea22d84a4fb345846fc8bfad81a4", + "size": 8579 }, { "url": "https://code.claude.com/docs/en/code-review-pull-requests", "status": "success", "path": "en/docs/claude-code/code-review-pull-requests.md", - "sha256": "563c0cebf2a21f68005b2f2801a26bd512e40fb0ba974ca00d7417ea21d717cc", - "size": 11518 + "sha256": "c639a3a6735a43f0ca28aac144136fd9a9d9d7a9cb22ef60ccc0b63588e9ffce", + "size": 12708 }, { "url": "https://code.claude.com/docs/en/code-review-costs", @@ -5784,694 +5798,694 @@ "url": "https://code.claude.com/docs/en/security-guidance", "status": "success", "path": "en/docs/claude-code/security-guidance.md", - "sha256": "a871226d3fc43e18a57b93523f03a32c1690c276b0d5b1723b3cc0de2c6e517c", - "size": 18502 + "sha256": "11b06b52a8e1cf41a14351e4e461629b72c0ca43913663c45717f456de9e9290", + "size": 18379 }, { "url": "https://code.claude.com/docs/en/claude-security", "status": "success", "path": "en/docs/claude-code/claude-security.md", - "sha256": "20ccb6d1f4575ff3f04a2ee903356ac00924c851e605679248b6c05e6077dcd2", - "size": 15375 + "sha256": "dafc91878eada5bf710de6c7bba43d84adcc6fecb3bafb92a6756d7c549e6121", + "size": 15220 }, { "url": "https://code.claude.com/docs/en/github-actions", "status": "success", "path": "en/docs/claude-code/github-actions.md", - "sha256": "87b99aefc0a9f4389a3293fdf7c5dfd35491bebc6fec70869a80557070a31ae7", - "size": 29088 + "sha256": "a359c8979cf7318200ada78b8c65b70b12e00c517f29044cf14ede62697c5c32", + "size": 28963 }, { "url": "https://code.claude.com/docs/en/github-actions-cloud-providers", "status": "success", "path": "en/docs/claude-code/github-actions-cloud-providers.md", - "sha256": "743ebb1e4097116f2cef5788cbf3c731ff9b010fcfcb0fcb1f1b61c6d376c068", - "size": 18479 + "sha256": "b522c6ef56f4c32f5fa08189408bd768278ba028408befab0de8bb3f54edce3c", + "size": 16792 }, { "url": "https://code.claude.com/docs/en/gitlab-ci-cd", "status": "success", "path": "en/docs/claude-code/gitlab-ci-cd.md", - "sha256": "c0786bbeeb973c89bce40e46742e35aeea084fcda0340368c19e63d915b85e83", - "size": 18835 + "sha256": "893810cac2e0755f9634a5d18aa3fb9e014e059e8e383f8d97ce30677b30243a", + "size": 18627 }, { "url": "https://code.claude.com/docs/en/agents", "status": "success", "path": "en/docs/claude-code/agents.md", - "sha256": "60ccc15449906c0b8d418eb1f4b691ae0b8834aa8bb021a5df147b6a061b676f", - "size": 8313 + "sha256": "5cd5c68ed28458ff9fc842b5f86837e0c1c140b6d6e5e7806f93245211a654c3", + "size": 8310 }, { "url": "https://code.claude.com/docs/en/sub-agents", "status": "success", "path": "en/docs/claude-code/sub-agents.md", - "sha256": "1134dc801713cd2ce65bd66c0784d280827635aa8a0ea0ff96d4fcd214fa0b28", - "size": 109510 + "sha256": "d1dc2ff1f9e9a96bfc70f3edcab2bafdc6d7653b053e43e79adc9caa8597d723", + "size": 108779 }, { "url": "https://code.claude.com/docs/en/agent-view", "status": "success", "path": "en/docs/claude-code/agent-view.md", - "sha256": "5d0e5212195e9559bd78466a52dc342dd304d11db23b173a92d7fa25a8c4e35e", - "size": 137992 + "sha256": "647f8e61b911077d9609e6bf38deab7743e3cc25462689dccd0c894f4ff3c4a7", + "size": 138922 }, { "url": "https://code.claude.com/docs/en/agent-teams", "status": "success", "path": "en/docs/claude-code/agent-teams.md", - "sha256": "13cabc09f8a99aa0f990290f28acdf57f80f7842bc4afedc5e18d21559979dd8", - "size": 40303 + "sha256": "621c83a9cc20e43300019bb872ae17be0a9f3048ab5dc60c9b9ba227864e760c", + "size": 39455 }, { "url": "https://code.claude.com/docs/en/cross-session-messaging", "status": "success", "path": "en/docs/claude-code/cross-session-messaging.md", - "sha256": "7b359027749ff27d84019a388145bf78edce1dc424aaa9a50896c6c88e4b1edd", - "size": 34299 + "sha256": "4c1e76b5d79c0837f6b15b555034ee5f9f27a726f3341b07550308fd4dd02fe9", + "size": 34750 }, { "url": "https://code.claude.com/docs/en/workflows", "status": "success", "path": "en/docs/claude-code/workflows.md", - "sha256": "82faec20e51fde0346ae200139238467f5f88459f3a853fd29e1185df9de70fa", - "size": 41430 + "sha256": "c4510ddec3d4fae2564d128d987d35425d1a8c1091f55eaa3938772c555823bc", + "size": 41282 }, { "url": "https://code.claude.com/docs/en/worktrees", "status": "success", "path": "en/docs/claude-code/worktrees.md", - "sha256": "fc74c1ba9751cfa7b3d8ab13f48749e476a9f491b78c884f9a8d6115b6d265aa", - "size": 40145 + "sha256": "f12badeb51cb74cc6ff959cb0cbe0c63f6f8e01a3f5a5c27d4e33300f343fc66", + "size": 40492 }, { "url": "https://code.claude.com/docs/en/mcp-quickstart", "status": "success", "path": "en/docs/claude-code/mcp-quickstart.md", - "sha256": "dd96c348f2010e09b40ce1b3fb5858467b513ab900e24d51f7932144d93e8953", - "size": 25274 + "sha256": "0a821c8ade8965fc581b40d79344399d731c866e0bfc9545160511124239b102", + "size": 24742 }, { "url": "https://code.claude.com/docs/en/mcp", "status": "success", "path": "en/docs/claude-code/mcp.md", - "sha256": "6415c1e5e233c26ef465a5e684fb26fd3806026b438ee35731a59c583e73f6f8", - "size": 122889 + "sha256": "3a93df9b555274bc92ef495b65e127ff07c128bd044606a70880e9bf948a2d60", + "size": 121474 }, { "url": "https://code.claude.com/docs/en/skills", "status": "success", "path": "en/docs/claude-code/skills.md", - "sha256": "1ac8eb3ec96177a5b960a381dcbf7e14ff5dacd45fa888e647e55bf4acd6f645", - "size": 110002 + "sha256": "96dd113a8aeb5ba5c0371368a26eb55781a840eab78a833b3e6b755178f37813", + "size": 109811 }, { "url": "https://code.claude.com/docs/en/artifacts", "status": "success", "path": "en/docs/claude-code/artifacts.md", - "sha256": "3007e8816370103148f08e51d223353e98a7019d9a699b143bc36d1d580f3abd", - "size": 41232 + "sha256": "03fddd0f918633deb42e155773534fd9a91ea5e7810bf2c74ecde1466897c321", + "size": 41128 }, { "url": "https://code.claude.com/docs/en/hooks-guide", "status": "success", "path": "en/docs/claude-code/hooks-guide.md", - "sha256": "7db5f1cbe05e0819db7d40c58d3a8b3a963e35bbd8c50d1c612fc5bfc1ff3439", - "size": 63237 + "sha256": "4e5e392dbd5b6869bda53e7622488b8cc7a9cad61b76bdb629c5b34a59f32571", + "size": 62010 }, { "url": "https://code.claude.com/docs/en/channels", "status": "success", "path": "en/docs/claude-code/channels.md", - "sha256": "b61fd503e65778ec2cc38fe686590833b7c08becfdb4bd93cd86e9110e444d05", - "size": 23849 + "sha256": "f1a6382911f5238c2f5e47293c4e647eb1b59d39b47f4c94b6e8739ae00bc0d9", + "size": 22364 }, { "url": "https://code.claude.com/docs/en/scheduled-tasks", "status": "success", "path": "en/docs/claude-code/scheduled-tasks.md", - "sha256": "cb0fbb3ba3cf72a9e92e15332dc18133c0c8a5896741600ab431c911600ecd5e", - "size": 17763 + "sha256": "4794c737b6c5b54795528abc7a9f2982a68c3875d7963a992e1cfa57c4ed399c", + "size": 17599 }, { "url": "https://code.claude.com/docs/en/goal", "status": "success", "path": "en/docs/claude-code/goal.md", - "sha256": "d8335c9d52ad47aa7a4266e134aaab99424ae3e1d500657d2e6187fb81961de7", - "size": 14921 + "sha256": "e33f7273e3875996a146945df5b0d1e1f9ad9c82bde9ecd0175ae457169a8654", + "size": 14910 }, { "url": "https://code.claude.com/docs/en/headless", "status": "success", "path": "en/docs/claude-code/headless.md", - "sha256": "09f383c4402f9f9fdb52f84c86ec91ca6d4770721e36430b2070c829fb4994c9", - "size": 34620 + "sha256": "c607c7dac616fd2c55ad0e6d80ddbb4b3452f7ebe312e32f8befa348c8e0a681", + "size": 34831 }, { "url": "https://code.claude.com/docs/en/deep-links", "status": "success", "path": "en/docs/claude-code/deep-links.md", - "sha256": "d038e60fdd2ffd7bd5695ffb8d9d933f837a3468ce5ec1f4167c241db660ad59", - "size": 13961 + "sha256": "29028b2b724e92210f15796fcb83befc2b850485bba9b8b530fbe6a4de8252ae", + "size": 13810 }, { "url": "https://code.claude.com/docs/en/large-codebases", "status": "success", "path": "en/docs/claude-code/large-codebases.md", - "sha256": "2a3939c22b945516c7666fc062c7be24e8d609bf34329f71ca5fd1d5bf432bab", - "size": 34352 + "sha256": "1323646a0198e7167aca34e724e9a3ba950c1196ca3661031127c5a2c317da10", + "size": 34347 }, { "url": "https://code.claude.com/docs/en/troubleshoot-install", "status": "success", "path": "en/docs/claude-code/troubleshoot-install.md", - "sha256": "7182fe84b548df18d417df2ec1384883847678a63135c9f8438a10c699c8c99f", - "size": 75719 + "sha256": "f6c782928b00e0c5f048099fc5c81b47e077fa5618ab66e0d6819cdd971cd06a", + "size": 75739 }, { "url": "https://code.claude.com/docs/en/troubleshooting", "status": "success", "path": "en/docs/claude-code/troubleshooting.md", - "sha256": "34218f1c7c1cba8bdabba116f9fa0cfaa8c20ba591882e3e497dde4d49b5a2aa", - "size": 14873 + "sha256": "0e41121536559aa9840204793b7fd47d9bbabd9d839865f764da1b8a5751cbe5", + "size": 15666 }, { "url": "https://code.claude.com/docs/en/debug-your-config", "status": "success", "path": "en/docs/claude-code/debug-your-config.md", - "sha256": "4331fb8b977d02f6e97da128f7da6ddb824b2714653b39fc0969d72f3b3959e1", - "size": 17314 + "sha256": "2b046f4e1efc45bd48b0815dccb593e9e9b4f4d6d621337a0a1bf5e93ca7ef5f", + "size": 16927 }, { "url": "https://code.claude.com/docs/en/errors", "status": "success", "path": "en/docs/claude-code/errors.md", - "sha256": "6355ce8033faaf9691f03aaacf52fab5961007d9fec92c665747ea905c7ac14b", - "size": 518769 + "sha256": "076a17315b05f18371819d44cab7216aede3c303e340a070db40e3a1e81d2ece", + "size": 521032 }, { "url": "https://code.claude.com/docs/en/plugins/overview", "status": "success", "path": "en/docs/claude-code/plugins/overview.md", - "sha256": "a33630ffe4a2432e4204fa0a512cffda4a037cf1441fb964a2104517589c8654", - "size": 14924 + "sha256": "3d758b5da01f42cf2201c4f4d38a7ac24dbf76e7f31d03cf77632e4d720535cf", + "size": 13310 }, { "url": "https://code.claude.com/docs/en/plugins/install", "status": "success", "path": "en/docs/claude-code/plugins/install.md", - "sha256": "698096ded7da7addf11ad7894179736ff96bab43eb51370698efb0fcdaca7294", - "size": 32228 + "sha256": "2af08db4214c45b94d140ebb6ae7407f85ee7cc92059095605cc5934a6f8bb51", + "size": 31337 }, { "url": "https://code.claude.com/docs/en/plugins/anthropic-marketplaces", "status": "success", "path": "en/docs/claude-code/plugins/anthropic-marketplaces.md", - "sha256": "0c5af63bba6c84c30284ff089a227baeb832337edb867282bf0a701cb15eef96", - "size": 8566 + "sha256": "3b577214de65b91023c482a965a266f0dae96bdc0f3fa09d914f552d4f341008", + "size": 8564 }, { "url": "https://code.claude.com/docs/en/plugins/code-intelligence", "status": "success", "path": "en/docs/claude-code/plugins/code-intelligence.md", - "sha256": "54d9c2715a4be046254d140d4f3fdc00be190e7b719be9ebbf8e751c1cf80054", - "size": 11722 + "sha256": "4dfd4be36034a650c1bf936782f4a37841d86a5426818068e14c2808f8f57cc9", + "size": 11533 }, { "url": "https://code.claude.com/docs/en/plugins/security", "status": "success", "path": "en/docs/claude-code/plugins/security.md", - "sha256": "00692b78a21589e73a1740279aa8168429b86c930520860d31573bc4021e2949", - "size": 13840 + "sha256": "cbcf25a811289a23444289148b2cbea1c5c33156a5dcde9e0e097e78ca2223cd", + "size": 13906 }, { "url": "https://code.claude.com/docs/en/plugins/create", "status": "success", "path": "en/docs/claude-code/plugins/create.md", - "sha256": "6b5c435d8f053dbec7634b7b0c72f71c9ae1b2f8f80af86aa76f49c093081ca4", - "size": 25730 + "sha256": "3d40f9bb2df522bf90f064f192da73d2cc442f16b41359867d15b28f0655185a", + "size": 24676 }, { "url": "https://code.claude.com/docs/en/plugins/components", "status": "success", "path": "en/docs/claude-code/plugins/components.md", - "sha256": "735298101629f7e87d311b277b08abea995a975172f88446ba52726f52c25e10", - "size": 54973 + "sha256": "3be7db1d5245931f0729452008879cbfe777acf328b0c93b84766b4962721908", + "size": 38083 }, { "url": "https://code.claude.com/docs/en/plugins/dependencies", "status": "success", "path": "en/docs/claude-code/plugins/dependencies.md", - "sha256": "a29a982a1fddb4dbaa361f5c996d4b444fceee116b86bf33720d92e5137ae97e", - "size": 17256 + "sha256": "429195438ab959715ee4d09e29b98163372f93e33fcc14d9efc87bcebfc0c3e2", + "size": 17135 }, { "url": "https://code.claude.com/docs/en/plugin-evals", "status": "success", "path": "en/docs/claude-code/plugin-evals.md", - "sha256": "c3c71f1c70be562641b20a72951e47ba678a2940fbaa8322e99a7f408917af42", - "size": 64289 + "sha256": "bff80df7f835b7e6e8b8c057a7563e8f048bb1d58e1d6f79d85d56d2f780e142", + "size": 63281 }, { "url": "https://code.claude.com/docs/en/plugins/publish", "status": "success", "path": "en/docs/claude-code/plugins/publish.md", - "sha256": "9d4dc32f6cd4f29aff651686d8ef32900a67e70ceae45f20ebf0311ddda80a02", - "size": 16372 + "sha256": "4fbb2bdf4e8b76eccfbe77a69ce02563c7dbbe4fbe11c57c3649a77534676cad", + "size": 16040 }, { "url": "https://code.claude.com/docs/en/plugins/measure", "status": "success", "path": "en/docs/claude-code/plugins/measure.md", - "sha256": "da4e58bf01f5de1d4eeef6c849c3a47354976ab7e10d3336aa5d6e35bdb1b186", - "size": 12831 + "sha256": "a316ab26489e65eda99f55584fa3fb90bfc84eab6e7b8faa514e682bda7a1603", + "size": 12768 }, { "url": "https://code.claude.com/docs/en/plugins/cli-hints", "status": "success", "path": "en/docs/claude-code/plugins/cli-hints.md", - "sha256": "8f7f28fb9568c8acfce79a0ed6761c175062ffb6c01b91936d2780ebd2e91257", - "size": 6742 + "sha256": "cae42089de7d22257f486031fcff3698a3b9e6bdcc642778014fcfc603d570eb", + "size": 6662 }, { "url": "https://code.claude.com/docs/en/plugins/mods/overview", "status": "success", "path": "en/docs/claude-code/plugins/mods/overview.md", - "sha256": "af74ccca2586794bbe110494395c240b3e9b18f24cd1d379b2b90261bcc8460f", - "size": 24219 + "sha256": "20afdec9b2430473a75994b91d066c60127d7950ee57d470695e94727dcbb897", + "size": 23574 }, { "url": "https://code.claude.com/docs/en/plugins/mods/create", "status": "success", "path": "en/docs/claude-code/plugins/mods/create.md", - "sha256": "314a6f37d8ae3689d7dc887815cf6f497eb453b1aa48e07f8551ed7035cf1dac", - "size": 25253 + "sha256": "9196c7718d21c704a01320d4e1ca204caa62703b97df2e3235b0165dd19b6cda", + "size": 23615 }, { "url": "https://code.claude.com/docs/en/plugins/mods/reference", "status": "success", "path": "en/docs/claude-code/plugins/mods/reference.md", - "sha256": "ea2f99e7beb1bc1309a13286bbda0d08826ac7449b652a973106b51cf2970f85", - "size": 40091 + "sha256": "3a0c1d350391fdc524071bfe68995d52dde45bde179dd5c6764a27be5fed0316", + "size": 40429 }, { "url": "https://code.claude.com/docs/en/plugins/mods/interface", "status": "success", "path": "en/docs/claude-code/plugins/mods/interface.md", - "sha256": "66a60b55a7eea45b5c17e4c5ce166a6a93c5695865f2a28eae63f6288167218c", - "size": 51288 + "sha256": "3adba7a62ea2ea432ed21995558e403984b896ac1b52159a6f699c63582ecd8c", + "size": 48451 }, { "url": "https://code.claude.com/docs/en/plugins/mods/gallery", "status": "success", "path": "en/docs/claude-code/plugins/mods/gallery.md", - "sha256": "c62a9fdf24e334a0e97b8d1a56792911786e6614cf945669f0ad981d03337715", - "size": 25558 + "sha256": "6fc25c6363c06d855ad7614567dc75ca985ccd2463521075f33d820c052bc661", + "size": 17658 }, { "url": "https://code.claude.com/docs/en/plugins/mods/events", "status": "success", "path": "en/docs/claude-code/plugins/mods/events.md", - "sha256": "787819d201a9a989c80e152fd802d370dd9b220d79e0d4dcc2a7cc7ae36d455c", - "size": 26491 + "sha256": "20b3b1a764413163c80c698e6ba2c9337d787a5bac45f6f0e9cec1b0faec49de", + "size": 28930 }, { "url": "https://code.claude.com/docs/en/plugins/mods/api", "status": "success", "path": "en/docs/claude-code/plugins/mods/api.md", - "sha256": "428158fb7545adf2ea68f23fed03cd675bc8802f1f100dbf7e93f09dd08ed7b2", - "size": 30214 + "sha256": "742d26d98665bbeffe718582f3b8f55d74ca256d5da994db8ce1f8385fa05b9a", + "size": 30526 }, { "url": "https://code.claude.com/docs/en/plugins/mods/test", "status": "success", "path": "en/docs/claude-code/plugins/mods/test.md", - "sha256": "833c7baa491ab8af5f990bf7a5ac0ed3f436e4fb392b72ab9ecf6480ca3451b4", - "size": 26121 + "sha256": "cd9d5ac58d1d00a14094e660923bf00b3eaf01aaf7a2b9ca7ea5310158093c6a", + "size": 26031 }, { "url": "https://code.claude.com/docs/en/plugins/mods/troubleshoot", "status": "success", "path": "en/docs/claude-code/plugins/mods/troubleshoot.md", - "sha256": "dc13eb7674ab0d0871ea34702d90b0c330ac37a63f82d355773cdc494e6978df", - "size": 26125 + "sha256": "ef2cb833e1edf43f0a2299ff502c63ee2e25d7336d7f7536e5fe2830c3bc7d58", + "size": 26021 }, { "url": "https://code.claude.com/docs/en/plugins/create-marketplace", "status": "success", "path": "en/docs/claude-code/plugins/create-marketplace.md", - "sha256": "0597250fec9a5eb9734df9c6821409431623604656129cf8e462f93460db6a84", - "size": 14189 + "sha256": "d016e2a495335b74acb363c28cc83f516a5c8df3954e64937841edde7271bc8c", + "size": 13855 }, { "url": "https://code.claude.com/docs/en/plugins/host-marketplace", "status": "success", "path": "en/docs/claude-code/plugins/host-marketplace.md", - "sha256": "c7cd5187df8cb7c483d478716b727376310f33e8d417dd5e027188c3be9c4dbc", - "size": 38999 + "sha256": "d9380e0b953c11dfda9d78eb3872287f842484080e4973c5dee537cbc15de2f5", + "size": 38862 }, { "url": "https://code.claude.com/docs/en/plugins/relevance", "status": "success", "path": "en/docs/claude-code/plugins/relevance.md", - "sha256": "bcbe647fd4e587be1dcaf436077181c1a863f9a4ddd18833d96b7862aeed17e9", - "size": 12865 + "sha256": "bed8ccb839090c1ea1d9ca8654e280905276bd44c57f80b68fa4e4b75c02b93a", + "size": 12863 }, { "url": "https://code.claude.com/docs/en/plugins/org", "status": "success", "path": "en/docs/claude-code/plugins/org.md", - "sha256": "693654a82eb3a7b498adb664087b35c5ad0f6a45ef5a8bd12760498ee1bb0936", - "size": 40264 + "sha256": "6a96d39cccb7175f7884a07d38a7ede18094f4333be31ecbc5398bfbc95d13ab", + "size": 40153 }, { "url": "https://code.claude.com/docs/en/plugins/mods/admin", "status": "success", "path": "en/docs/claude-code/plugins/mods/admin.md", - "sha256": "2b9be404c52d624e71edcf985c896a1005968dde33acb6598332532718030fcd", - "size": 36205 + "sha256": "76dfaf5b3c11e7a365608e57df7e0168b7b0d945617b463caec3e4662fb66bb1", + "size": 36157 }, { "url": "https://code.claude.com/docs/en/plugins/troubleshooting", "status": "success", "path": "en/docs/claude-code/plugins/troubleshooting.md", - "sha256": "b296559c8c43d84bf49fef30413c1458f083117c4fd6253e4c34d4f5b4eaea73", - "size": 96912 + "sha256": "796771facc5107ae0caf8a4e86c39e155746a2450e40862c5a9a9a8b4d17ed9f", + "size": 93728 }, { "url": "https://code.claude.com/docs/en/plugins/loading", "status": "success", "path": "en/docs/claude-code/plugins/loading.md", - "sha256": "981414aeb654516276a878dc8f8942f251b279ba36b9003fe77355e4e24484a5", - "size": 39375 + "sha256": "b2fac9343cc5e5bc6f412ca2037a6ab552b571e47179412353158c3b7d0fea1b", + "size": 39286 }, { "url": "https://code.claude.com/docs/en/plugins/manifest-reference", "status": "success", "path": "en/docs/claude-code/plugins/manifest-reference.md", - "sha256": "16b6dafd91d4a258bd1afcb901ee6efafca67c6de52e8c7a2b3c65c3884b5f3d", - "size": 41987 + "sha256": "2af4d8d137d49ce2f1c47fa1cc9d527217d8ba93e146b2b2b5baf221a076ae28", + "size": 41985 }, { "url": "https://code.claude.com/docs/en/plugins/marketplace-reference", "status": "success", "path": "en/docs/claude-code/plugins/marketplace-reference.md", - "sha256": "f9733d0ca8639440700b5e2af718c62052e5b0774e9e9d7903c8cdce353f4a07", - "size": 44335 + "sha256": "1fe46ddd308fbae1bc879280ae03971725a6e1c3123106eebe63ac443bbd37a0", + "size": 44260 }, { "url": "https://code.claude.com/docs/en/plugins/cli-reference", "status": "success", "path": "en/docs/claude-code/plugins/cli-reference.md", - "sha256": "a27045a987676e2291e9f7b5d83facbfb26c9bdb1c8bd7233e1afbc155b8fadc", - "size": 61681 + "sha256": "2012ddc700c8feace5d02da1442bdb10093e2460dfb9d9945678e911805cdea6", + "size": 62057 }, { "url": "https://code.claude.com/docs/en/admin-setup", "status": "success", "path": "en/docs/claude-code/admin-setup.md", - "sha256": "a4e4d4cd17d35096ceb95492214fec61c16e261c5bce2c7ab9a65c174ab162a1", - "size": 26763 + "sha256": "e2191140e4136b93d2ab3ec0961c7538fad83cefecbcdb5e455950ccd12da1f2", + "size": 26745 }, { "url": "https://code.claude.com/docs/en/setup", "status": "success", "path": "en/docs/claude-code/setup.md", - "sha256": "68b9b31f8e22702599ed1d6e08bfbd74da20f5fdfb88f88f49340c29767815dc", - "size": 34205 + "sha256": "dd6dce8da7f515ff0039bb3b4c6f5a4143cc0f74f363a741c5087328ae80a63c", + "size": 34095 }, { "url": "https://code.claude.com/docs/en/authentication", "status": "success", "path": "en/docs/claude-code/authentication.md", - "sha256": "c43ef3e8ddcb34ff6ba8b8d9e72276326ba7b672cd99f1252d5167c111ce67ac", - "size": 31125 + "sha256": "7eee08423ba09f648ad55d2a977d2783960450b5867e1629b23386341293a81d", + "size": 30701 }, { "url": "https://code.claude.com/docs/en/managed-settings", "status": "success", "path": "en/docs/claude-code/managed-settings.md", - "sha256": "6bfb4f806ac254c5562baa28422c7c329ebc57353d95b9106e2a354390e5443c", - "size": 60990 + "sha256": "c72731131801e09b8b9fac316b74757e15d51b638b96b984cd470e6c87e1170c", + "size": 59234 }, { "url": "https://code.claude.com/docs/en/server-managed-settings", "status": "success", "path": "en/docs/claude-code/server-managed-settings.md", - "sha256": "e870a54246a205829ac06012c9bb69ffcdc950f02082348b50f1222a0c26a09c", - "size": 44509 + "sha256": "1e65fdb7a49996f87a240a5257fee834b0a2a403d3a2a0482be964cba4c0ec65", + "size": 44276 }, { "url": "https://code.claude.com/docs/en/managed-mcp", "status": "success", "path": "en/docs/claude-code/managed-mcp.md", - "sha256": "45a53673fa9e07f69610a79437bb4c0cc477090311097772bf740c0e7dbbb6ad", - "size": 45147 + "sha256": "96b82f54bc3e3dca6a9e64b719935784fa764e1ffc269bca984001eb0bd1b84c", + "size": 44973 }, { "url": "https://code.claude.com/docs/en/auto-mode-config", "status": "success", "path": "en/docs/claude-code/auto-mode-config.md", - "sha256": "3052dc2a76cebd5b98825838d109190b0d46fef4eea2ad4a65ac48cf8b1d2cbf", - "size": 30973 + "sha256": "8e3538c437c2df7501ce2565fa8faaac1de47e5ba5f6af6c92459433ee8c2b72", + "size": 31974 }, { "url": "https://code.claude.com/docs/en/third-party-integrations", "status": "success", "path": "en/docs/claude-code/third-party-integrations.md", - "sha256": "dd80519ee76bea457c42edd78e4429c46789106c9e0270cd317fe02deeedd015", - "size": 14135 + "sha256": "a0338db8234f346fe5bfe4eac4280aa3fdba2c0f0c380d6110210ea19ac1d91a", + "size": 11325 }, { "url": "https://code.claude.com/docs/en/feature-availability", "status": "success", "path": "en/docs/claude-code/feature-availability.md", - "sha256": "c43cf9ed02c613f023bb8a5b858466ab0634d1573fee6e3feacdd7da7d1c7ab3", - "size": 22304 + "sha256": "25518a2da5562ee8b3eac99774930fc98558acb5efc9f7557008296f95b4dece", + "size": 21264 }, { "url": "https://code.claude.com/docs/en/amazon-bedrock", "status": "success", "path": "en/docs/claude-code/amazon-bedrock.md", - "sha256": "11faf7e72ff5d9b523406f24dee14de9ba1d976390e27a51e5b1c844c6063779", - "size": 49029 + "sha256": "62e6e7b37785dab3f86cf8c57aea13b3f6c7624c3347c77404eee5d89cdb42bd", + "size": 46218 }, { "url": "https://code.claude.com/docs/en/claude-platform-on-aws", "status": "success", "path": "en/docs/claude-code/claude-platform-on-aws.md", - "sha256": "68320e02903244413a72d9027b0608be3e2800e1556897da190e327631709b20", - "size": 18735 + "sha256": "2d8081ba2cee5cb4ad59be46764ca3739d641bbe80b595aee8edbaafee884acc", + "size": 12108 }, { "url": "https://code.claude.com/docs/en/google-vertex-ai", "status": "success", "path": "en/docs/claude-code/google-vertex-ai.md", - "sha256": "8f10bd8ba84152d1ee9cd704c43f7bdb818fb17cd355d9e1b24b86cf6452a52b", - "size": 24491 + "sha256": "3826ec3febdd1ce17c711d2bd2f29582a958eb8da94add7769bd0103cb05acf6", + "size": 21674 }, { "url": "https://code.claude.com/docs/en/microsoft-foundry", "status": "success", "path": "en/docs/claude-code/microsoft-foundry.md", - "sha256": "85d0e619be75661d5773f746946575be788c6a2a9a87fbaa352390b1b4da083b", - "size": 12868 + "sha256": "81f88dc6ba71e15dcc4b93a112f91d4780061fd13f330f1aec160b9282f21d17", + "size": 10145 }, { "url": "https://code.claude.com/docs/en/network-config", "status": "success", "path": "en/docs/claude-code/network-config.md", - "sha256": "be0f9c442ceb9db6354483b8aba18180427fa910899449368989ec15e6f350e0", - "size": 31795 + "sha256": "bd3e70cd1b4b1c0e2506566a45f526b18b707d113989821ce0244f611c3e809e", + "size": 31775 }, { "url": "https://code.claude.com/docs/en/corporate-launcher", "status": "success", "path": "en/docs/claude-code/corporate-launcher.md", - "sha256": "c07cb9024cf331298fbd73f38ecaf667deea96ed20ea07dac16b1e6c30cd80e2", - "size": 14980 + "sha256": "7a19cefd5968b695a8e9bfe1ba072a4e7e3f331cecee7c251ac9d6d143c3abfc", + "size": 14753 }, { "url": "https://code.claude.com/docs/en/devcontainer", "status": "success", "path": "en/docs/claude-code/devcontainer.md", - "sha256": "8e00a93ee9bd1858c00866868b0287a091d9ee35cb66ce69f240a71a323c9aab", - "size": 18222 + "sha256": "8d2f8be00a322af2b695f17124f5f947103cb948f7d5827ad7c3ac08e4efb46e", + "size": 17311 }, { "url": "https://code.claude.com/docs/en/gateways", "status": "success", "path": "en/docs/claude-code/gateways.md", - "sha256": "4a8fa190a420ebd5148eff94a02033b9dae7a453a823def84589ebfe3f77624a", - "size": 9283 + "sha256": "7e1a055d2fae52fe54375dcfe5078a29f34323e3eab5a3ad6bb40119053dbc19", + "size": 9187 }, { "url": "https://code.claude.com/docs/en/claude-apps-gateway", "status": "success", "path": "en/docs/claude-code/claude-apps-gateway.md", - "sha256": "526386107b512993ff9c13095ce58d6bd3e695ab3797f53f95dd6f4014ed0dea", - "size": 59184 + "sha256": "4e21339c8da63a6ecc6ee14cbadec227cfd6501ef7d2e83b16763bca3a145e34", + "size": 58303 }, { "url": "https://code.claude.com/docs/en/claude-apps-gateway-config", "status": "success", "path": "en/docs/claude-code/claude-apps-gateway-config.md", - "sha256": "7d3225161870efddbe68d834ba87ab0f18ed44f62dcf88c2cf215cd0838557cc", - "size": 135582 + "sha256": "5897b8c015b96c9570152692b2980cc67717f63ab7f7a3a0f02c33905c5b0b60", + "size": 135127 }, { "url": "https://code.claude.com/docs/en/claude-apps-gateway-spend-limits", "status": "success", "path": "en/docs/claude-code/claude-apps-gateway-spend-limits.md", - "sha256": "d366894636585b26f150e707dd0c26382408f7984c6a6d2fe168de59b2c3652c", - "size": 15841 + "sha256": "b4f1ca7b124b5f864f3ca742274b87af032f42776043584642085068bbec16f1", + "size": 15835 }, { "url": "https://code.claude.com/docs/en/claude-apps-gateway-deploy", "status": "success", "path": "en/docs/claude-code/claude-apps-gateway-deploy.md", - "sha256": "3a567d6df5f8dbd4b40f96bec154311cec351db61dc2d1592f9abb45e089be9b", - "size": 62559 + "sha256": "566d795097dffe00479558e5ede03d4d0f9fb6cfe698b73130f2b7beb7a40ddd", + "size": 62547 }, { "url": "https://code.claude.com/docs/en/claude-apps-gateway-on-aws", "status": "success", "path": "en/docs/claude-code/claude-apps-gateway-on-aws.md", - "sha256": "406be9b95710c035b61b4312b7ed6acaca3248a0c63200d16428023cdba6414b", - "size": 50532 + "sha256": "5d87a93b310d2f172bf1d12563472870a8ae9e5d882c262c074a71b285b40771", + "size": 48380 }, { "url": "https://code.claude.com/docs/en/claude-apps-gateway-on-gcp", "status": "success", "path": "en/docs/claude-code/claude-apps-gateway-on-gcp.md", - "sha256": "c5fb057ae072c61f74509bc548a8a9b24eb2ccd2656494a943f084ea4c462e4b", - "size": 22904 + "sha256": "d3e2215b6bd4be83895c44521763bdcc711febadd10e62a4515cda000becb57e", + "size": 21695 }, { "url": "https://code.claude.com/docs/en/llm-gateway", "status": "success", "path": "en/docs/claude-code/llm-gateway.md", - "sha256": "3acb15a32a7a4ad0608c3bfdc50703a6fbca3b79fcddb0de8c89717db0b8b1a1", - "size": 7105 + "sha256": "52ae824ce569956df19ed5a5461b4d59d28007166f813dd74579b039168d37a8", + "size": 7102 }, { "url": "https://code.claude.com/docs/en/llm-gateway-connect", "status": "success", "path": "en/docs/claude-code/llm-gateway-connect.md", - "sha256": "4f3037af1bac4b1bddf6474655ad8ee168491925fe6e28cbfe5c0d21e7df1d37", - "size": 45469 + "sha256": "2656ba7633aa63730243c880603fbfe8128ba54c5875e33db068a68ab725928b", + "size": 44406 }, { "url": "https://code.claude.com/docs/en/llm-gateway-rollout", "status": "success", "path": "en/docs/claude-code/llm-gateway-rollout.md", - "sha256": "6068c8a4e364901a96d473e75cb152ac29577095009e9bebf53d6c2cb464ba57", - "size": 29844 + "sha256": "c6bdd3a6d1900a1783cc86f9f32f1dbbad745f8b808df95e7e0a0dd4b5832a05", + "size": 29422 }, { "url": "https://code.claude.com/docs/en/llm-gateway-protocol", "status": "success", "path": "en/docs/claude-code/llm-gateway-protocol.md", - "sha256": "b4ddc0f86a77e561491c9d82d4114dca8abcd364af6bc7f3bcf1801093718107", - "size": 43899 + "sha256": "f2e51e4471fbcf68d3a69c2f21c6fc1c5ee3a9802f0e4543f1e2baa49aa8939d", + "size": 45169 }, { "url": "https://code.claude.com/docs/en/monitoring-usage", "status": "success", "path": "en/docs/claude-code/monitoring-usage.md", - "sha256": "be8720d8d66e1f233a6116546246909f6b574e31c5498b5a04cbf9f4a0df9464", - "size": 156450 + "sha256": "0e270766248190d60339d61432aeaed04ae6c681f3f9b08761df32547ecef50e", + "size": 156695 }, { "url": "https://code.claude.com/docs/en/costs", "status": "success", "path": "en/docs/claude-code/costs.md", - "sha256": "1454be2b74ace5f003a69242548a5886f755f936451ab9be209e8b8afb27321c", - "size": 42459 + "sha256": "d0a3b42778fcd1716b1ae7b5800f667e897be1e3497975f920a311252171ea6a", + "size": 42226 }, { "url": "https://code.claude.com/docs/en/analytics", "status": "success", "path": "en/docs/claude-code/analytics.md", - "sha256": "b5cc60e906ae8247800a0939e2c0771d20507c0176d5fe224f17b0f227163653", - "size": 12020 + "sha256": "00adc5a9e26df21a18d352c4d23aa9d9464652a822831e78547fda42786be758", + "size": 11893 }, { "url": "https://code.claude.com/docs/en/security", "status": "success", "path": "en/docs/claude-code/security.md", - "sha256": "57603902b3038ab4c51a458516e7d74cb41cd256026e5ebc1d0c20a671aea155", - "size": 14368 + "sha256": "90d88268b970f36359def01e7dd11b86b7bd1209a7f46ad7a57f78a5c668eeba", + "size": 14356 }, { "url": "https://code.claude.com/docs/en/data-usage", "status": "success", "path": "en/docs/claude-code/data-usage.md", - "sha256": "ef5260591575f5c4d2cc649054349b427fb6f3aa91388f9162662d7e3ba0bb03", - "size": 18976 + "sha256": "13aeb717790289ef7819c7cc051aa26b9878c580bb61ea38100abc7a2c17d5a6", + "size": 18079 }, { "url": "https://code.claude.com/docs/en/zero-data-retention", "status": "success", "path": "en/docs/claude-code/zero-data-retention.md", - "sha256": "c2503ddb0196239c62695663306a3e7731c19472da2532f4a3e56520d9b67bf7", - "size": 8126 + "sha256": "c9fd97255cd03e51fc80de057be4f6716c423ffcbb7bd2b6de3308ef8516d789", + "size": 8117 }, { "url": "https://code.claude.com/docs/en/hipaa-setup", "status": "success", "path": "en/docs/claude-code/hipaa-setup.md", - "sha256": "ab947878e22d175b80948482e48e158ad9a060af7f5e1d1726d624cb16cb8562", - "size": 21698 + "sha256": "cc72afd8ae49d4c7ba7601c2f48db069134e07a6c1335706f4c3f5bc210b3749", + "size": 21555 }, { "url": "https://code.claude.com/docs/en/communications-kit", "status": "success", "path": "en/docs/claude-code/communications-kit.md", - "sha256": "116f0e318fe05812cf75c208d2d07e6d85d940d72744dd81c905fe4a6e6d6c0c", - "size": 21477 + "sha256": "a54fef7fa8d839551a57d80c4399b2a469204daa4be26b237ab8bacdaf9f7c94", + "size": 21078 }, { "url": "https://code.claude.com/docs/en/champion-kit", "status": "success", "path": "en/docs/claude-code/champion-kit.md", - "sha256": "0b13b69734332913465664fb2123baef34112b2127551100c437bbcf0b5263d4", - "size": 16228 + "sha256": "e728ad6d2e2f1c4ebb2a10aa515eb4284d80680f8cf913bbd0bb7122373f5614", + "size": 16101 }, { "url": "https://code.claude.com/docs/en/settings", "status": "success", "path": "en/docs/claude-code/settings.md", - "sha256": "a8cc395af5e0938659ddfd38a703bdc8a5151640216c5230098408e30625e380", - "size": 57985 + "sha256": "eeb14dd230adb2a8b37ca738e32ca2ca520ee68d91d47aeb738c7ad15557fdbc", + "size": 41253 }, { "url": "https://code.claude.com/docs/en/settings-reference", "status": "success", "path": "en/docs/claude-code/settings-reference.md", - "sha256": "587bebe2dad933a9da9e1ca598b041178879128b9219cd70409990d2f7be3817", - "size": 425472 + "sha256": "208c7be3af4d4988ddd835a24355e6421b7b9d342197828c22666213b14f67ea", + "size": 404605 }, { "url": "https://code.claude.com/docs/en/settings-example", "status": "success", "path": "en/docs/claude-code/settings-example.md", - "sha256": "f6cf3b20bd043675631782717e77fd398ffb41d5f964d10f736de6fd95c75cec", - "size": 15673 + "sha256": "db4cb3d94a6a21bcb709d054da4ca747b975bc306a9a76a415c91d7daddb5c43", + "size": 14204 }, { "url": "https://code.claude.com/docs/en/permissions", "status": "success", "path": "en/docs/claude-code/permissions.md", - "sha256": "6eb72200e3a344332136702f935268f0c3d360e7c1e5ef77fe91757d95bd7683", - "size": 85661 + "sha256": "f966bcef1c7a05bdc9427ba226ad4293649847f273ec893d40fc742e109e2b57", + "size": 84630 }, { "url": "https://code.claude.com/docs/en/permission-modes", "status": "success", "path": "en/docs/claude-code/permission-modes.md", - "sha256": "f18755bdcc176a7ee1f90f30bc23f598ec3317812fed6648e364d00ae1378c97", - "size": 100298 + "sha256": "60d2df1b0fcee659a531a243e480af89eae0c65ddeced4fcedf81b0a17604b26", + "size": 98372 }, { "url": "https://code.claude.com/docs/en/auto-mode-classifier-billing", @@ -6484,113 +6498,113 @@ "url": "https://code.claude.com/docs/en/sandboxing", "status": "success", "path": "en/docs/claude-code/sandboxing.md", - "sha256": "ac3bda4a1aa12361200c724edc2a1531d21f54fab50814ac7460a7226e987d75", - "size": 94950 + "sha256": "4d1db72abc4d9245e93d907592798ef468adfa89adcfe826879efb72a25a006a", + "size": 94523 }, { "url": "https://code.claude.com/docs/en/sandbox-environments", "status": "success", "path": "en/docs/claude-code/sandbox-environments.md", - "sha256": "7caca9df3a0272fde7d8c41d86d9b14ecb0e78d69eed13e3a12ca735cc120de0", - "size": 18166 + "sha256": "c1669c45965f57183d8ce67b13ac5d4c519b52cada4db1be0471a3d539007ab0", + "size": 18155 }, { "url": "https://code.claude.com/docs/en/cloud-environments", "status": "success", "path": "en/docs/claude-code/cloud-environments.md", - "sha256": "5a5485b2bb1fe9743600eda7ee7eba557259a1cc1e7dbae7d4bc69b84d9e5141", - "size": 63199 + "sha256": "5025aa6f8165471d2718fb70e85c033ba788e3f7b3ffb1011e213de108bd7410", + "size": 61834 }, { "url": "https://code.claude.com/docs/en/self-hosted-environments", "status": "success", "path": "en/docs/claude-code/self-hosted-environments.md", - "sha256": "8d68839a68b4d7da78bd072bea8537de9927ea17180986fccd9fa806ca3d6a2b", - "size": 20738 + "sha256": "bb74d486dce3830657b9aaf1bcf0d1d6720433bd423f60a32afdea8fa7f5daf6", + "size": 19805 }, { "url": "https://code.claude.com/docs/en/self-hosted-environments-quickstart", "status": "success", "path": "en/docs/claude-code/self-hosted-environments-quickstart.md", - "sha256": "fd1b9ba3f4bb4471c7acf9bd0f89b9447ad900a756eac71b473cd83a4813c756", - "size": 15651 + "sha256": "a74b930aeb05fecfb0501f3de72ec28171b722fb9dca80471fabd68a17fa9b86", + "size": 15374 }, { "url": "https://code.claude.com/docs/en/self-hosted-environments-deploy", "status": "success", "path": "en/docs/claude-code/self-hosted-environments-deploy.md", - "sha256": "6ef08a9c3c1cd4b11ca48b3b40f69fd6362ae4f87d38264f8251d5f618108d5b", - "size": 94347 + "sha256": "d5152dd444d20b29d16dc5205ce22f6b6ff39dc302c06992b392dbb0f60e66c9", + "size": 95135 }, { "url": "https://code.claude.com/docs/en/self-hosted-environments-configuration", "status": "success", "path": "en/docs/claude-code/self-hosted-environments-configuration.md", - "sha256": "8b40b2a7546deff365980de99892182a971228071f1c52a3b6c04de83ba6a552", - "size": 76460 + "sha256": "daac6d544908a18fc8a555bebaf3dada9d734dce6136ec62ca912adc55afb96e", + "size": 76056 }, { "url": "https://code.claude.com/docs/en/self-hosted-environments-testing", "status": "success", "path": "en/docs/claude-code/self-hosted-environments-testing.md", - "sha256": "e77515585d7628809b3317490e92897ae4a278d5e202850825913b5d3ec58af8", - "size": 16440 + "sha256": "8bb6b5ff2226ea3f1e06f5bcbe18d7b88d507370fd6d38469b1fb7d5595b41a9", + "size": 16437 }, { "url": "https://code.claude.com/docs/en/self-hosted-environments-reference", "status": "success", "path": "en/docs/claude-code/self-hosted-environments-reference.md", - "sha256": "58b9140a3647d42d4c2805ddd5125110761a830ae71b50fc6bbbb5c2e9ab45a9", - "size": 48755 + "sha256": "dafd88e0a30e06cad405004ba9b1ecba146653175b8c1907f6c40a0a2d3790ff", + "size": 48752 }, { "url": "https://code.claude.com/docs/en/self-hosted-environments-identity", "status": "success", "path": "en/docs/claude-code/self-hosted-environments-identity.md", - "sha256": "ac193faf838309f2d41638d6e6ac179675072bc51ed1a90bb4dbde76c0ba6876", - "size": 18436 + "sha256": "05f11e7abeec787d2c4ce9cd1b717ebb792714fabdb1790978c84246744cbe0f", + "size": 17960 }, { "url": "https://code.claude.com/docs/en/model-config", "status": "success", "path": "en/docs/claude-code/model-config.md", - "sha256": "7c5005a47f8e88ac5dd7732afef8cdd6b008029b6e7a4e33186b5a3fe44797ac", - "size": 121256 + "sha256": "88a3e73340f79e495fae0d97f88af081a744901fe24e5225cfdd5060a55a6f50", + "size": 120859 }, { "url": "https://code.claude.com/docs/en/fast-mode", "status": "success", "path": "en/docs/claude-code/fast-mode.md", - "sha256": "be422724d973d98cccc67ac8b8a234922689c0dfa144052ff116378bb3d5a9de", - "size": 20744 + "sha256": "8f975922930bbd7dc80aedab8817525ec094a190771e776cfb18dcfb7c9ba0ba", + "size": 20736 }, { "url": "https://code.claude.com/docs/en/advisor", "status": "success", "path": "en/docs/claude-code/advisor.md", - "sha256": "735dd5d3f2af64811cb57e7565a44e33e31b7dc3503428a8d435eb141ac92d79", - "size": 17182 + "sha256": "3857397048ff9aed3e0a43986da5a49158b408fecfdbdf4b7d9c2de1ae029d8c", + "size": 17179 }, { "url": "https://code.claude.com/docs/en/output-styles", "status": "success", "path": "en/docs/claude-code/output-styles.md", - "sha256": "caa152d1d974171c4622c6c4f6c6c45d2f553f491c18f867153375b7ffab8623", - "size": 16684 + "sha256": "4ab76c92e36b378b73213398322acee516d4c9714949967ca4b8740e995d056d", + "size": 16463 }, { "url": "https://code.claude.com/docs/en/terminal-config", "status": "success", "path": "en/docs/claude-code/terminal-config.md", - "sha256": "b28078b25fec4fd23a25189561201b0c39d16a34dc687d0cf27933a1ec4b3666", - "size": 25651 + "sha256": "cd074c187046f3b66cbaf3130c940035a5c39f251800a7c8cda4bb99632862ca", + "size": 25437 }, { "url": "https://code.claude.com/docs/en/fullscreen", "status": "success", "path": "en/docs/claude-code/fullscreen.md", - "sha256": "a70a18bae37013550ec8900a59f9e971f915ccb315ad6b7601ebb5bb7ba47010", - "size": 30963 + "sha256": "75c11eebbab588ea9ae7198aa431ae43fb2579b11f647e291b1fb025730f6692", + "size": 30901 }, { "url": "https://code.claude.com/docs/en/accessibility", @@ -6603,78 +6617,78 @@ "url": "https://code.claude.com/docs/en/voice-dictation", "status": "success", "path": "en/docs/claude-code/voice-dictation.md", - "sha256": "222b99354ac354c010370379256c05be57e8854f56dfb3cc5e3dd89a23ac1977", - "size": 18048 + "sha256": "12c2896776945b9a4a81652d4f04898e934c3707c5e4db137d4d87ea3778c264", + "size": 17917 }, { "url": "https://code.claude.com/docs/en/statusline", "status": "success", "path": "en/docs/claude-code/statusline.md", - "sha256": "257fd62e5d0c182d0132d0f8dd88b2388b4019e1dfd538944f16167955fbd24a", - "size": 67379 + "sha256": "0d60891ab06e9b1736d5a9e6e76bc8a60518263b072f90052fdc431f5c61359e", + "size": 65239 }, { "url": "https://code.claude.com/docs/en/keybindings", "status": "success", "path": "en/docs/claude-code/keybindings.md", - "sha256": "a2901681dad404ff4a235db43cf332b6a1506039c2a6a0e0895980e08d3b8f38", - "size": 37621 + "sha256": "856316569b7d0a6bfd4bbdb46ce8bd101ce3ccb600d6e42179543067c447e0c9", + "size": 37845 }, { "url": "https://code.claude.com/docs/en/cli-reference", "status": "success", "path": "en/docs/claude-code/cli-reference.md", - "sha256": "029287d82a4da572e8befd5cc5a699ab516c77b18d375bd715eda5972dede53f", - "size": 47906 + "sha256": "ac829f14528ebcb3b44364c2d27a134cf40bbb9bf26a1e9968d5c9cf1dc8314d", + "size": 47884 }, { "url": "https://code.claude.com/docs/en/commands", "status": "success", "path": "en/docs/claude-code/commands.md", - "sha256": "fcb2694e02cdc2986545f64253a6c9fad49865f3a1eeb4adc3ec47168b59ee19", - "size": 52600 + "sha256": "12d2e58b86afd50be9ca0462359392076372a92df5f29d3d50afccbeadde919f", + "size": 53158 }, { "url": "https://code.claude.com/docs/en/env-vars", "status": "success", "path": "en/docs/claude-code/env-vars.md", - "sha256": "2f8189d3d6345bd18a3741c3e1efab7f29283189fb0c015085f48e009faa67d3", - "size": 171428 + "sha256": "5a1ab03cdf0a8b77f73de8d630372f605ec619313bd5c5e2fdc51a96ceac288c", + "size": 171053 }, { "url": "https://code.claude.com/docs/en/tools-reference", "status": "success", "path": "en/docs/claude-code/tools-reference.md", - "sha256": "e035d409df09550250e9dde336e1ec58a400133d72875ddd49b95eb8667de6f9", - "size": 79828 + "sha256": "fe14db2f763715118993132c4a00e728eeec259b5b35e47a379ab40ab9948553", + "size": 80714 }, { "url": "https://code.claude.com/docs/en/interactive-mode", "status": "success", "path": "en/docs/claude-code/interactive-mode.md", - "sha256": "cdb17ddf90c306d9d97e138627edd5f54992e732463b18393b1deeec41e18688", - "size": 72696 + "sha256": "460314f54f20914cad863b71f78bd6d475bab89360fccea64e2e97fbae3c96aa", + "size": 72991 }, { "url": "https://code.claude.com/docs/en/checkpointing", "status": "success", "path": "en/docs/claude-code/checkpointing.md", - "sha256": "abba6eb58112b4f5638862ec3241218b5fe7878834998f029f38a3a524378df1", - "size": 8861 + "sha256": "24730ad24547ab8dcc5f389575e93513e3dd2f7a92faeb20a21889e1be9c796f", + "size": 9219 }, { "url": "https://code.claude.com/docs/en/hooks", "status": "success", "path": "en/docs/claude-code/hooks.md", - "sha256": "bd43bf9a559f39af292fc159573371c01e19dadd84f8c1b10fac954d975dba11", - "size": 273459 + "sha256": "17cdd5c7fa205b5c2e85ee702dd3644565b051365bffcbe3de07fc478efe99d1", + "size": 269034 }, { "url": "https://code.claude.com/docs/en/channels-reference", "status": "success", "path": "en/docs/claude-code/channels-reference.md", - "sha256": "ff2e4cd795e64681828d44593718164676f82e492c37b81bee7e2ba03268daba", - "size": 46874 + "sha256": "7589c8b66278c7ee147acdff3895fd0f2c3aa4c24447a0b19230bc3e11ee05cc", + "size": 44676 }, { "url": "https://code.claude.com/docs/en/glossary", @@ -6687,36 +6701,36 @@ "url": "https://code.claude.com/docs/en/agent-sdk/overview", "status": "success", "path": "en/docs/claude-code/agent-sdk/overview.md", - "sha256": "970069a3d032e81062aed716308d39420b241f590cddc005a9ee72370241db01", - "size": 6839 + "sha256": "ed21edfcdfb42034063f98d86b60084cd306b1e36c9c8ad851bb9c73d15e61a7", + "size": 6836 }, { "url": "https://code.claude.com/docs/en/agent-sdk/quickstart", "status": "success", "path": "en/docs/claude-code/agent-sdk/quickstart.md", - "sha256": "0dd2bfdabf0c9111a3bf8f44ebbc77ef8dae031072bda5bb28c63ce35e5cf2ed", - "size": 15561 + "sha256": "ae3afba43529511d4856701afbab22c3e42a8edb59c48b3c9343779a6848c304", + "size": 14478 }, { "url": "https://code.claude.com/docs/en/agent-sdk/migration-guide", "status": "success", "path": "en/docs/claude-code/agent-sdk/migration-guide.md", - "sha256": "fe17b0ad3a92aab2b6ce91bce941ba6723b5e734099259ed8b9dfa891a1ee67f", - "size": 7092 + "sha256": "3895d4faf2fd8ef4b437b5e88b0c905376fd332961e0f220f4490d3cbe8ce02e", + "size": 6885 }, { "url": "https://code.claude.com/docs/en/agent-sdk/troubleshooting", "status": "success", "path": "en/docs/claude-code/agent-sdk/troubleshooting.md", - "sha256": "8f14cbdd3a7b7e475fd042535bc9583221b3d5e92c470761211f0d9bdae8062e", - "size": 12996 + "sha256": "51f617396866cae64b2fccfa5b5b0518199e7ef767329118b9c185cb9414f9c1", + "size": 13317 }, { "url": "https://code.claude.com/docs/en/agent-sdk/configuration", "status": "success", "path": "en/docs/claude-code/agent-sdk/configuration.md", - "sha256": "3825f95dc2ea2e25da2d1a33fac37f5f85bbd0b837871f5015e8b0d233d650b7", - "size": 17673 + "sha256": "03cf9f8b2d8cfff30e51429a9a7cd2568203b8ee0f390b34c4bcbac597e31b95", + "size": 17296 }, { "url": "https://code.claude.com/docs/en/agent-sdk/examples", @@ -6729,358 +6743,358 @@ "url": "https://code.claude.com/docs/en/agent-sdk/agent-loop", "status": "success", "path": "en/docs/claude-code/agent-sdk/agent-loop.md", - "sha256": "4daa0c7e6a893f1899446368dd408af34c0cbdbe3b505bddcca1d75bbf71b24b", - "size": 40704 + "sha256": "30b60788b12d98524787a0f0e23b4f0a48b3346dd286add00b1d9f97e7e9addc", + "size": 39741 }, { "url": "https://code.claude.com/docs/en/agent-sdk/claude-code-features", "status": "success", "path": "en/docs/claude-code/agent-sdk/claude-code-features.md", - "sha256": "5e6cc2ab57f08333008146aad73d0e8e3a354f36cea77cad13022029095f2e6f", - "size": 20172 + "sha256": "d3e497371194e7955e8b807cf7a91199080d8c31e3208c61b0d57c2ba2f9ae21", + "size": 19783 }, { "url": "https://code.claude.com/docs/en/agent-sdk/sessions", "status": "success", "path": "en/docs/claude-code/agent-sdk/sessions.md", - "sha256": "c3106db1c25679f0f5557b18e8da687aa9f0232437911db3fb1db5fdecb4d114", - "size": 22295 + "sha256": "82d02eea65bfbef89b6d7b44703b054de13d4a25f710c37ce551396f6726b881", + "size": 21888 }, { "url": "https://code.claude.com/docs/en/agent-sdk/session-storage", "status": "success", "path": "en/docs/claude-code/agent-sdk/session-storage.md", - "sha256": "6e582d288d2062d6b5c1c9fa3c7f426409688fa1c7b917dec7778071fc01cc46", - "size": 23428 + "sha256": "d34bb232693fe1d2cf49f6d1921223db884b3b3e0281d594582e710b7841b6d8", + "size": 23144 }, { "url": "https://code.claude.com/docs/en/agent-sdk/streaming-vs-single-mode", "status": "success", "path": "en/docs/claude-code/agent-sdk/streaming-vs-single-mode.md", - "sha256": "2d7e6f05239baf9c870e5ab7e58fed07b29444c116e1301df5ec36a299e11176", - "size": 9534 + "sha256": "5d955985ced4ea277b67c407abdd4d2f9ecbbb8e47c42399966467989a170a59", + "size": 9141 }, { "url": "https://code.claude.com/docs/en/agent-sdk/user-input", "status": "success", "path": "en/docs/claude-code/agent-sdk/user-input.md", - "sha256": "ff01dec6260ddebd97cdaaa1e05349884a7a5363b01bba70bb0cb1b91db5f6b2", - "size": 36906 + "sha256": "58f197065e8438a15479717f68a3fa007d0dc1ce31fe040de78ed1bdfb12f710", + "size": 34571 }, { "url": "https://code.claude.com/docs/en/agent-sdk/streaming-output", "status": "success", "path": "en/docs/claude-code/agent-sdk/streaming-output.md", - "sha256": "6130ad83b44bbc5c7f703563dc2a968427bdf0c1b343f3debac883fa2f936854", - "size": 14822 + "sha256": "5f175aad838c7e2ea7ba065b113a36ccc3185de5a629ade6fba4f4f555a368d0", + "size": 14365 }, { "url": "https://code.claude.com/docs/en/agent-sdk/structured-outputs", "status": "success", "path": "en/docs/claude-code/agent-sdk/structured-outputs.md", - "sha256": "66c2e8bec15c512f8809209271e17535daeb6af92c7854f7c04f57d3986fcaee", - "size": 20974 + "sha256": "7d93c5dbf12bb6adb32c3994257190f8d38a8ff2ef567413a5cf3b51e59037e7", + "size": 20087 }, { "url": "https://code.claude.com/docs/en/agent-sdk/custom-tools", "status": "success", "path": "en/docs/claude-code/agent-sdk/custom-tools.md", - "sha256": "6473f30bd67d943d1eb51e3634bc7ca1f7473b1b0d64ec0670a4d988da6d95a4", - "size": 38874 + "sha256": "739f8f3b577d32ce70e0ca880217b3564150d9e7de110b615ddfd327f7997733", + "size": 37284 }, { "url": "https://code.claude.com/docs/en/agent-sdk/mcp", "status": "success", "path": "en/docs/claude-code/agent-sdk/mcp.md", - "sha256": "33a0ecdbbc0c2ccff5c5d3c934c28fead463400f8cb5ae1a83850d4c0c2d4dcd", - "size": 39020 + "sha256": "60ea1a24d130cfc89695f81ff9ed368a6f613eb9135b7790663051e92d7b5115", + "size": 37145 }, { "url": "https://code.claude.com/docs/en/agent-sdk/tool-search", "status": "success", "path": "en/docs/claude-code/agent-sdk/tool-search.md", - "sha256": "6589f261d93df7bd500a8ff3218d85b7d4341b0a746e27592820d5f807dc8ac9", - "size": 11324 + "sha256": "088831212a869d960790331f24e4e889df8a82611eee8fc41199d6611dfb1838", + "size": 11117 }, { "url": "https://code.claude.com/docs/en/agent-sdk/subagents", "status": "success", "path": "en/docs/claude-code/agent-sdk/subagents.md", - "sha256": "41c7ddea21c93edaed0d785ddf468becaf9b7dfbbe2747e063e70c284cce7318", - "size": 42210 + "sha256": "0e7ca62297ea9d0225f808b31a4693ab3f946fb87102d579afbe518ae8718c20", + "size": 41169 }, { "url": "https://code.claude.com/docs/en/agent-sdk/modifying-system-prompts", "status": "success", "path": "en/docs/claude-code/agent-sdk/modifying-system-prompts.md", - "sha256": "9cc60ee24b2f7c0c78b2555a46bc58bc06566f3b0f4da7d9af0523d8eae3224e", - "size": 35707 + "sha256": "a15d848400ac82c8140fcac4352f4c071f290c41b4f3d3b5de50ee90d4e2221f", + "size": 35073 }, { "url": "https://code.claude.com/docs/en/agent-sdk/skills", "status": "success", "path": "en/docs/claude-code/agent-sdk/skills.md", - "sha256": "c515e05538b55ae79a3044229d742946785e0dcca66845478d542ceb0620d26c", - "size": 27640 + "sha256": "ba547726732fd543fa07f96bc243fb597d578d8546df1373b721ead01dab0646", + "size": 26910 }, { "url": "https://code.claude.com/docs/en/agent-sdk/plugins", "status": "success", "path": "en/docs/claude-code/agent-sdk/plugins.md", - "sha256": "f46b7b5f3992e08def0859e9cae81fbf5f6703611068c8f6bed0427b3b2ab971", - "size": 12203 + "sha256": "ba08c2397c458a6e4233cbcced01e98095a684057b4e395a98d0a9a0861a9d9d", + "size": 11759 }, { "url": "https://code.claude.com/docs/en/agent-sdk/permissions", "status": "success", "path": "en/docs/claude-code/agent-sdk/permissions.md", - "sha256": "1940596baa7604208c453f669359ab181767659ce8e1892c8bbf4e4274a8c5fc", - "size": 27160 + "sha256": "f7ead1bd80cb2470e8174dace7203c6b0096a96062bf6bfbaf28918b6a6880e9", + "size": 25646 }, { "url": "https://code.claude.com/docs/en/agent-sdk/hooks", "status": "success", "path": "en/docs/claude-code/agent-sdk/hooks.md", - "sha256": "97a80c9a66a35e4addf9e56da5025075936373a69cefeda788d39b2dc598a154", - "size": 45804 + "sha256": "54ed614504619d637d67065e7a541bb843d4b9b99078557966d5dc2aa528fa55", + "size": 44447 }, { "url": "https://code.claude.com/docs/en/agent-sdk/file-checkpointing", "status": "success", "path": "en/docs/claude-code/agent-sdk/file-checkpointing.md", - "sha256": "c2eb54ff4b8d1ba4817082499a22a631ba29f7691c3672c0424ae82134e9c8ee", - "size": 28946 + "sha256": "6f4494b5ae512e0d263556f74b23449c05f731a9d8a2d620efc80ac0d69b93d6", + "size": 27045 }, { "url": "https://code.claude.com/docs/en/agent-sdk/cost-tracking", "status": "success", "path": "en/docs/claude-code/agent-sdk/cost-tracking.md", - "sha256": "0efff313646aefb8e10616b8d5e8b330ffd9904cb08017ccb05073af13d66a61", - "size": 27593 + "sha256": "401c967643e9cb71b15b49dd547750c9f6e8454eaac984caaafa59f7769221a8", + "size": 26515 }, { "url": "https://code.claude.com/docs/en/agent-sdk/observability", "status": "success", "path": "en/docs/claude-code/agent-sdk/observability.md", - "sha256": "4df4a9bacf53675a2e013d5fde79900919c88f2f803d5b8402cb835e961ff495", - "size": 17731 + "sha256": "b2571a030942e332f005a1b6729bffd3b45f4d2aea41759a21a69de446fcbc34", + "size": 17414 }, { "url": "https://code.claude.com/docs/en/agent-sdk/todo-tracking", "status": "success", "path": "en/docs/claude-code/agent-sdk/todo-tracking.md", - "sha256": "faeb4117a415e4d595080c0dc44177b9ea58deb9a1430b6ce9348f987d4c6cbf", - "size": 19337 + "sha256": "0a1cce8c5342e91d82bf8ed1fba9acbf27f9eba980ef854f663de0510df105e7", + "size": 18768 }, { "url": "https://code.claude.com/docs/en/agent-sdk/hosting", "status": "success", "path": "en/docs/claude-code/agent-sdk/hosting.md", - "sha256": "b4cb853b97732c685c09be29f50a2b0592b68b3cb1f2468c03a26fe05e90e1a2", - "size": 24509 + "sha256": "0646cfc95150c12fd1eb1d1c0c4a817d924ab4d3ba8007b3947a8a0c0ed713bf", + "size": 23593 }, { "url": "https://code.claude.com/docs/en/agent-sdk/secure-deployment", "status": "success", "path": "en/docs/claude-code/agent-sdk/secure-deployment.md", - "sha256": "da343d19cfd20cdf69cecd2ade8b8e795209c1e57fe166a294ba1ecce03dbd7d", - "size": 21395 + "sha256": "cf110897512366d91e016eacdf2192b92352ad5ed65762b8a753d28e03c3505d", + "size": 21385 }, { "url": "https://code.claude.com/docs/en/agent-sdk/typescript", "status": "success", "path": "en/docs/claude-code/agent-sdk/typescript.md", - "sha256": "06e4c43f520576fa77f44229ae4d9e5ff9d625b2e7d2f13a446339632e60d6f5", - "size": 292838 + "sha256": "552a46fa859e9688fcaed5974d21307fc4c0a4b19ca232871625057dc579ddc8", + "size": 292692 }, { "url": "https://code.claude.com/docs/en/agent-sdk/typescript-v2-preview", "status": "success", "path": "en/docs/claude-code/agent-sdk/typescript-v2-preview.md", - "sha256": "e9db92c5509efc9988fa54a9fe3301b049ff04c582b4a1eca2f624a7203bd9aa", - "size": 12317 + "sha256": "6fbbb8d4101c8a33a046eb9fb6c0749d1618429f6563ca8a7fcf0bb56c72666c", + "size": 12309 }, { "url": "https://code.claude.com/docs/en/agent-sdk/python", "status": "success", "path": "en/docs/claude-code/agent-sdk/python.md", - "sha256": "a61d932b61854426420d5f7a24a74290088dc02b66b043c81884b043e62ffdd4", - "size": 158972 + "sha256": "dd703abb0f5c5c746e09529b8aa57bef3afbb5502d54191ec6149a8393396d14", + "size": 158925 }, { "url": "https://code.claude.com/docs/en/whats-new/index", "status": "success", "path": "en/docs/claude-code/whats-new/index.md", - "sha256": "461e0053c53a0a3b69992a1a3dcc3e8c3356d55e7b615acb79b5734a812e24ea", - "size": 16070 + "sha256": "a75d000526297bb4116b4a4386f95d17b753a1fe6ace46d9e5852eda2e16c382", + "size": 13831 }, { "url": "https://code.claude.com/docs/en/whats-new/2026-w37", "status": "success", "path": "en/docs/claude-code/whats-new/2026-w37.md", - "sha256": "66bb7870ff980ac9c70b27dc9d2d2f9169c904556ed8fc810a99c2e19b0f110e", - "size": 6152 + "sha256": "5b35137d4dfb615106423f88265bc13e6266e99c58a94349a46cc31836e2e0a9", + "size": 4590 }, { "url": "https://code.claude.com/docs/en/whats-new/2026-w36", "status": "success", "path": "en/docs/claude-code/whats-new/2026-w36.md", - "sha256": "3dcefcf911b781ba55e589371877a3a2d5648fd2ef24146422c276bc29116af5", - "size": 8977 + "sha256": "00dd0cc239b30e213abe12f0a7526299dfbdcb64d9f8e437610259b59e67fd35", + "size": 6420 }, { "url": "https://code.claude.com/docs/en/whats-new/2026-w35", "status": "success", "path": "en/docs/claude-code/whats-new/2026-w35.md", - "sha256": "3a54fe141802374512fac399b91b353a014027881c6b52b700194f8487bbf850", - "size": 8540 + "sha256": "25cba55fd4729a2baca2bf77ba05dd0980faf53dd345634127d055bb3a95269c", + "size": 6291 }, { "url": "https://code.claude.com/docs/en/whats-new/2026-w34", "status": "success", "path": "en/docs/claude-code/whats-new/2026-w34.md", - "sha256": "f60234a2a7d0b415f4c379dd923f040bc43bf854fc3cb97a2612ff124f94d985", - "size": 8432 + "sha256": "7ded63d68d235c7fce90e3aa72941c7053d5ea2e63360dc019d62008bf5e0269", + "size": 6163 }, { "url": "https://code.claude.com/docs/en/whats-new/2026-w33", "status": "success", "path": "en/docs/claude-code/whats-new/2026-w33.md", - "sha256": "3173be034d0a304e8412b1b2d9fce7b53402a5548a3ac66099a6f20af6c84a42", - "size": 7543 + "sha256": "377b94a19f52f592a201fe338892448a7a8da251e7c3988e6fee49b1c99d5643", + "size": 5562 }, { "url": "https://code.claude.com/docs/en/whats-new/2026-w32", "status": "success", "path": "en/docs/claude-code/whats-new/2026-w32.md", - "sha256": "beaa45be6e8d45f70a9acb2c995982807413c72c397cdc1e5367313b6e02cb9c", - "size": 8740 + "sha256": "fb54dc14b0aabd9eabe2ed7912ba88e2aa9d6d0093595eee276dfc308b6d84fc", + "size": 6575 }, { "url": "https://code.claude.com/docs/en/whats-new/2026-w30", "status": "success", "path": "en/docs/claude-code/whats-new/2026-w30.md", - "sha256": "d277689c7c88fd91933efeb8387444de10c73b902c73442c345559b23566108e", - "size": 6986 + "sha256": "c4120e310cc61d1daed8788324b57e15a7c638263b2131fa035bc333a71d47e6", + "size": 5138 }, { "url": "https://code.claude.com/docs/en/whats-new/2026-w29", "status": "success", "path": "en/docs/claude-code/whats-new/2026-w29.md", - "sha256": "118acce134ea5a471a45c714615904a70330fe7e8d3b70d9091fd2060cd1bb0e", - "size": 5449 + "sha256": "62e737ebb5f46ae08cbea9a819ea46891ff488bbe933ab74cacb98a2cc11f2a4", + "size": 4100 }, { "url": "https://code.claude.com/docs/en/whats-new/2026-w28", "status": "success", "path": "en/docs/claude-code/whats-new/2026-w28.md", - "sha256": "181a056217f5115c1f17afc54f2051f2964dd7912fbf26d8269f4478b50a3058", - "size": 4309 + "sha256": "3fad082794ea5fd552814b054cb32f735c70549fde72be9cb63780397d019ad4", + "size": 3094 }, { "url": "https://code.claude.com/docs/en/whats-new/2026-w27", "status": "success", "path": "en/docs/claude-code/whats-new/2026-w27.md", - "sha256": "5654dcbca409024332797dcc36f6089252b026353c54fa2c93703a66b0819870", - "size": 6804 + "sha256": "f19efae60b410e99f2e30cb5a25e5a5f2a5e220bf864c163e88ec9eb0773f02a", + "size": 4723 }, { "url": "https://code.claude.com/docs/en/whats-new/2026-w26", "status": "success", "path": "en/docs/claude-code/whats-new/2026-w26.md", - "sha256": "daa492028b273039d527cdd5cb4fd93e0d8361e64b35e0e1941ad6dae2d46b9e", - "size": 4456 + "sha256": "a1f793b13ac7197364cfeb47d917ad628b2df258cb3fedd321d3adc83596760d", + "size": 3233 }, { "url": "https://code.claude.com/docs/en/whats-new/2026-w25", "status": "success", "path": "en/docs/claude-code/whats-new/2026-w25.md", - "sha256": "9423716d28a7bca0fb8794bb207945d8082a516221978db16da3e35de7603c7d", - "size": 5365 + "sha256": "af21669faa854dc1653171a293136e4122033f7d08b416af8299b99395e6f0fe", + "size": 3782 }, { "url": "https://code.claude.com/docs/en/whats-new/2026-w24", "status": "success", "path": "en/docs/claude-code/whats-new/2026-w24.md", - "sha256": "7a2ee84a1e8ef73acccdc418876e8e5182918c40eebce6ff1e5ee7c043682556", - "size": 5354 + "sha256": "9c22a5311dcc565601815f2ad37278d31d9e15dc76b91d4c5f4161ca3c9d4a5c", + "size": 3745 }, { "url": "https://code.claude.com/docs/en/whats-new/2026-w23", "status": "success", "path": "en/docs/claude-code/whats-new/2026-w23.md", - "sha256": "65d143773a30af241da99abaf593b44ba6e59091a2162d9d83398a97313c5ad0", - "size": 6590 + "sha256": "93edd34091e5147d1e0bc6241bc6ba07b4f133411d7bbbd7b09cea6268573325", + "size": 4530 }, { "url": "https://code.claude.com/docs/en/whats-new/2026-w22", "status": "success", "path": "en/docs/claude-code/whats-new/2026-w22.md", - "sha256": "b84fb555b0e073d555ccade310b47f34b61548e1bc17674ac565a29716ff0061", - "size": 7349 + "sha256": "248b9724e18d6e6cefed1b37f0663f007b2c866c2dcdd2e21f7fb5257f856c5e", + "size": 5088 }, { "url": "https://code.claude.com/docs/en/whats-new/2026-w21", "status": "success", "path": "en/docs/claude-code/whats-new/2026-w21.md", - "sha256": "db1a92b130e8fa64c1478e742a6c755d6df5515237a59c78e56376c1c585aefe", - "size": 4311 + "sha256": "09a1d6893db5af650cce27dc41cdd3dd55c2d5b3aacfa5fa3c8d4567b95baec0", + "size": 3280 }, { "url": "https://code.claude.com/docs/en/whats-new/2026-w20", "status": "success", "path": "en/docs/claude-code/whats-new/2026-w20.md", - "sha256": "4754d13ebbb3548c335457fba4f25ae79fa24973e27adb3641e32ac154f75bf0", - "size": 6758 + "sha256": "666486717c0318fec4cd55e16c7e3e812955b1173cd9c04a2f008826ccec4312", + "size": 4822 }, { "url": "https://code.claude.com/docs/en/whats-new/2026-w19", "status": "success", "path": "en/docs/claude-code/whats-new/2026-w19.md", - "sha256": "09cb0ec35c0be8387903221ee197aed9092a88d620b270d612e8ad3a1de43db0", - "size": 4596 + "sha256": "a4d90c0c33d3f74f60e1551c3d9c25434d0e19c49c1db43921a939f75e9bfe78", + "size": 3417 }, { "url": "https://code.claude.com/docs/en/whats-new/2026-w18", "status": "success", "path": "en/docs/claude-code/whats-new/2026-w18.md", - "sha256": "936c4348cd436832d4d9e3c8740dad334bfbcc10c85cb7ccad08242caf0706e2", - "size": 6659 + "sha256": "079a96ededcfef7cb3f456904a7bcc8b38bc92322b188d7245bbc9e195940177", + "size": 4603 }, { "url": "https://code.claude.com/docs/en/whats-new/2026-w17", "status": "success", "path": "en/docs/claude-code/whats-new/2026-w17.md", - "sha256": "515896de9dc302db5190f3f531b409baa888a32137d8ab045d996b2f0cff00cb", - "size": 7262 + "sha256": "d77082906de52dfe9f768af5e630cd3e920ec18ef801b17014953c80f1b1e314", + "size": 4891 }, { "url": "https://code.claude.com/docs/en/whats-new/2026-w16", "status": "success", "path": "en/docs/claude-code/whats-new/2026-w16.md", - "sha256": "a33bf848ebdfd53be8c9f7aeb09725e9088c65baebd2cd1fcd470ed4c5b3f041", - "size": 8921 + "sha256": "d76209e50734302a23932d2c5ee22d1451aeacac63f39c11ab92ba4d8acfcf8e", + "size": 6028 }, { "url": "https://code.claude.com/docs/en/whats-new/2026-w15", "status": "success", "path": "en/docs/claude-code/whats-new/2026-w15.md", - "sha256": "282687bbdbe4b964dc44ecfe2dc4a5e1e05603fc16309b9c51e520a25e6d2b39", - "size": 7364 + "sha256": "12239fc770920023f32e6a1a6ea96dd246d98a738eda5a31dc80040efcce9825", + "size": 5144 }, { "url": "https://code.claude.com/docs/en/whats-new/2026-w14", "status": "success", "path": "en/docs/claude-code/whats-new/2026-w14.md", - "sha256": "bce201823d55027e0c43415e958d36730d33e06e560d729767c09b8ca0d77201", - "size": 7896 + "sha256": "60c82df293e75c9ce417f99f7647cf7386d258bbce46223008d7c7eff621ca70", + "size": 5339 }, { "url": "https://code.claude.com/docs/en/whats-new/2026-w13", "status": "success", "path": "en/docs/claude-code/whats-new/2026-w13.md", - "sha256": "ab085f5727dbec2b29c3afe9a703936ffe7dc570c01757b64cd1b638a18eaea6", - "size": 7981 + "sha256": "d02e99c7306139fa68f29bf0d5ab4c0e2df76bec4af9fb09ecabf47b59c2b51f", + "size": 5113 }, { "url": "https://code.claude.com/docs/en/legal-and-compliance", @@ -7093,15 +7107,15 @@ "url": "https://modelcontextprotocol.io/community/antitrust", "status": "success", "path": "mcp/community/antitrust.md", - "sha256": "efc7d5ce2696e4bc5a1f43b0ee7f61060087e16f7cb41491cde335c2886c0a60", - "size": 5566 + "sha256": "d9db3824d1934553d3a2b401257b69ed5c71efdfbd33879fce8fc70f0d018718", + "size": 5563 }, { "url": "https://modelcontextprotocol.io/community/charter-template", "status": "success", "path": "mcp/community/charter-template.md", - "sha256": "49f31fd821bb3e6575c76e104f281300ac279eeda2c5de5058a79fbc443afa7b", - "size": 5962 + "sha256": "bdb8ce2516b123c7195716d45c51be514d872f0f322df206bd9fb8edcecf6320", + "size": 5959 }, { "url": "https://modelcontextprotocol.io/community/communication", @@ -7114,15 +7128,15 @@ "url": "https://modelcontextprotocol.io/community/contributing", "status": "success", "path": "mcp/community/contributing.md", - "sha256": "ece8ab869ab47923f2dfd550fd9715b0f3b0deed9d34c97bda492b06295f8809", - "size": 22655 + "sha256": "5db05b5d1bb8fc36ee8f6cff930c36b4f8ef3484de7678006680ef0c650b5942", + "size": 21247 }, { "url": "https://modelcontextprotocol.io/community/contributor-ladder", "status": "success", "path": "mcp/community/contributor-ladder.md", - "sha256": "b0c43968d6323f8015df21bd17f3e42f6f25d4ca52d16dc7cd1112f963658c19", - "size": 18237 + "sha256": "b625670c676fa9f10ac8940b3cbbe126b266176ac5585392c5cf9cd21c48686c", + "size": 18231 }, { "url": "https://modelcontextprotocol.io/community/design-principles", @@ -7163,8 +7177,8 @@ "url": "https://modelcontextprotocol.io/community/interest-groups/enterprise-managed-authorization", "status": "success", "path": "mcp/community/interest-groups/enterprise-managed-authorization.md", - "sha256": "030322d894789b09d5e70e028359526ddd753ea50d3eab19ef3b60a5fdce1518", - "size": 5676 + "sha256": "3bcb129ba24b540e468d495bae382b27391d6664a4ccf8a1a4641b2ab1d0f5d9", + "size": 5673 }, { "url": "https://modelcontextprotocol.io/community/interest-groups/financial-services", @@ -7198,8 +7212,8 @@ "url": "https://modelcontextprotocol.io/community/sdk-tiers", "status": "success", "path": "mcp/community/sdk-tiers.md", - "sha256": "e22245e7246b4d910b95934e25debd8a0b368d64dd7b9a5855d87b03317e12ab", - "size": 6971 + "sha256": "d54f69250a28c51a4da2d79c7157c76f6f5208b5c2dde0c5f1df0c6b04de504b", + "size": 6970 }, { "url": "https://modelcontextprotocol.io/community/security", @@ -7212,8 +7226,8 @@ "url": "https://modelcontextprotocol.io/community/sep-guidelines", "status": "success", "path": "mcp/community/sep-guidelines.md", - "sha256": "7f6502e80026b51737b7b9d320ae32fd3ea7b6da5e46d561e7be19f8a4611897", - "size": 15792 + "sha256": "616b8e81e6498a9d21379703befb566d32c93bdc15367ea696f9d24c8e2ade1e", + "size": 15789 }, { "url": "https://modelcontextprotocol.io/community/working-groups/agents", @@ -7317,71 +7331,71 @@ "url": "https://modelcontextprotocol.io/community/working-interest-groups", "status": "success", "path": "mcp/community/working-interest-groups.md", - "sha256": "b154c587fe86dcdf667be5134df4872301fd6a4eadc5228bd350a648e33502c1", - "size": 15494 + "sha256": "614734a61e2284d323e2703fdd3c1cb2e31da7597218be877b0749021726d6a1", + "size": 15376 }, { "url": "https://modelcontextprotocol.io/development/roadmap", "status": "success", "path": "mcp/development/roadmap.md", - "sha256": "d4bc14ba66ff98e893653fe76f10b948012bd1c8975d62c9755c392d10c6ced1", - "size": 11657 + "sha256": "a61b153e7267f1e30dfbc11dd4386f17e190717addfbfc89c113de153abe2ffb", + "size": 11655 }, { "url": "https://modelcontextprotocol.io/docs/2024-11-05/develop/build-client", "status": "success", "path": "mcp/docs/2024-11-05/develop/build-client.md", - "sha256": "507bb67cac05a7c2f249136391cba53b9fdae636202e602323b5720b22b81f94", - "size": 79528 + "sha256": "706b83a5133bd69de58adf6d34e5db1a133de273d10bd30cf5f5c301b5382728", + "size": 71264 }, { "url": "https://modelcontextprotocol.io/docs/2024-11-05/develop/build-server", "status": "success", "path": "mcp/docs/2024-11-05/develop/build-server.md", - "sha256": "f80d34babc0d92406f6543cc47002945f237553a7e71c9f6f68a33f81aa574b5", - "size": 97350 + "sha256": "c6ea296f779733500ad36afad7bb7940101c9655699577c2e783596f6a05f933", + "size": 85998 }, { "url": "https://modelcontextprotocol.io/docs/2024-11-05/develop/build-with-agent-skills", "status": "success", "path": "mcp/docs/2024-11-05/develop/build-with-agent-skills.md", - "sha256": "78996299fddc8218ada6c513f8a0d27c6d1b1f1a1d10d277c88fa265623d9baf", - "size": 4644 + "sha256": "9fb731a59bf3da89efb7232bc0698af3add6eac23cb01f18ac6a0c93ede14882", + "size": 4488 }, { "url": "https://modelcontextprotocol.io/docs/2024-11-05/develop/clients/client-best-practices", "status": "success", "path": "mcp/docs/2024-11-05/develop/clients/client-best-practices.md", - "sha256": "388a4b0c6d23ba2aa8293e39cacd85f7395f9f89c1cfb4ee16ee1852913b0adc", - "size": 18908 + "sha256": "73b5815e8e455d6197edb2359066ad3d1708bceb1475505e4ece6b0639c10726", + "size": 18745 }, { "url": "https://modelcontextprotocol.io/docs/2024-11-05/develop/connect-local-servers", "status": "success", "path": "mcp/docs/2024-11-05/develop/connect-local-servers.md", - "sha256": "2a7a9acd33ab194c1f6f48a97ebfd3efd435cf836513bf2952c3935e5f51df20", - "size": 13941 + "sha256": "202493e237e6ec55b258c229b8a4d930f62da7911d76e6fda1834843a7174185", + "size": 12143 }, { "url": "https://modelcontextprotocol.io/docs/2024-11-05/develop/connect-remote-servers", "status": "success", "path": "mcp/docs/2024-11-05/develop/connect-remote-servers.md", - "sha256": "fe4e02e69a6ff81e5f36d7854e44d901c9a226cd11da8c35aab38110544ab48e", - "size": 9452 + "sha256": "8351fd547d79a833ffed467806c7bb51b6fb989919781623d54501841fa3f416", + "size": 8347 }, { "url": "https://modelcontextprotocol.io/docs/2024-11-05/getting-started/intro", "status": "success", "path": "mcp/docs/2024-11-05/getting-started/intro.md", - "sha256": "2090cddb2a8bc8e6326fdbd426d49983721a2054993105abebf584693436c7c8", - "size": 3625 + "sha256": "43260f5ff823987335b93cf2a3bc72a96cd54c73619a204ea6de2240c61c5cef", + "size": 3193 }, { "url": "https://modelcontextprotocol.io/docs/2024-11-05/learn/architecture", "status": "success", "path": "mcp/docs/2024-11-05/learn/architecture.md", - "sha256": "f8135b49ffd9e821bbadc7ff448152ba1739aad2db7fe225b3c9c5e2d4ee5b3a", - "size": 25319 + "sha256": "53e4fd33541e4cd3b05ec2009ef42e8a994085e5ba405468bcac7ac31fcd9281", + "size": 23943 }, { "url": "https://modelcontextprotocol.io/docs/2024-11-05/learn/client-concepts", @@ -7394,106 +7408,106 @@ "url": "https://modelcontextprotocol.io/docs/2024-11-05/learn/server-concepts", "status": "success", "path": "mcp/docs/2024-11-05/learn/server-concepts.md", - "sha256": "e800bf3b48063dc63295a8992077f212218f55db6ee4fae9fcb012df8b826842", - "size": 13475 + "sha256": "d67a8de0cc914d4ab14a1b0c5e18731b859127afcb22d541bfae65162b6d1ce3", + "size": 13445 }, { "url": "https://modelcontextprotocol.io/docs/2024-11-05/learn/versioning", "status": "success", "path": "mcp/docs/2024-11-05/learn/versioning.md", - "sha256": "779e10f7ec9b0a903bcd70c9866aecaf2761d243b4e889943693c4fefdb279de", - "size": 2091 + "sha256": "a37acf6dca4a8c9822f722a95d5442fab4edac98a5210d526b87fe3f7ccc76b7", + "size": 2088 }, { "url": "https://modelcontextprotocol.io/docs/2024-11-05/sdk", "status": "success", "path": "mcp/docs/2024-11-05/sdk.md", - "sha256": "5e4c98c6985c042eadd2d8d9caf159dcc00e34c052ed0e15b69b28ff1c2200c1", - "size": 3700 + "sha256": "ae72f1b07205cf4e74baeec0791938dd2908b033e1e9fd2d64b02e74dfbdf836", + "size": 2848 }, { "url": "https://modelcontextprotocol.io/docs/2024-11-05/tools/debugging", "status": "success", "path": "mcp/docs/2024-11-05/tools/debugging.md", - "sha256": "c443ecdd1524f1ccf1efef8372f0d81eb15897e11a243470a271b921f8016cf6", - "size": 10046 + "sha256": "5887f3741cdf6e7b383e6db5cf734bc5644b61da3c06e2d500329d9f390d7e06", + "size": 9674 }, { "url": "https://modelcontextprotocol.io/docs/2024-11-05/tools/inspector", "status": "success", "path": "mcp/docs/2024-11-05/tools/inspector.md", - "sha256": "6f3219ca450658ed133ac088f2f8786a3142349eeccfab16e7cc6cd23d7a0e65", - "size": 4246 + "sha256": "231521784c774035f62d6a663f66255028ab1e0d06f808d7ad3cd1bf0a3c1e10", + "size": 3817 }, { "url": "https://modelcontextprotocol.io/docs/2024-11-05/tutorials/security/authorization", "status": "success", "path": "mcp/docs/2024-11-05/tutorials/security/authorization.md", - "sha256": "cfbd63df67035372a679e0d124e254080577f17b0204fed75b7f58a76f1b493c", - "size": 47690 + "sha256": "94b2a8bfb9d72f6b468fba14c585a41e10e59728ccb44e0896dd6d3ed2cfbf04", + "size": 43886 }, { "url": "https://modelcontextprotocol.io/docs/2024-11-05/tutorials/security/security_best_practices", "status": "success", "path": "mcp/docs/2024-11-05/tutorials/security/security_best_practices.md", - "sha256": "700b837a513ff8b1d988d6273a2deec59ae5740252e47755698916d91e84b409", - "size": 36999 + "sha256": "eea007e741f1a35e8ceaf8c5ff847772b5c5e4c241328965ba4785195a6136d0", + "size": 36996 }, { "url": "https://modelcontextprotocol.io/docs/2025-03-26/develop/build-client", "status": "success", "path": "mcp/docs/2025-03-26/develop/build-client.md", - "sha256": "6905f120fbdacc7c05bd000e28f552484a55daf2ad366ea3b27de2bcb8c98132", - "size": 79528 + "sha256": "1f6eefe096fbec85abc92650a7caed2a370a1a65d7c40d337707467a8d482d82", + "size": 71264 }, { "url": "https://modelcontextprotocol.io/docs/2025-03-26/develop/build-server", "status": "success", "path": "mcp/docs/2025-03-26/develop/build-server.md", - "sha256": "868b1135ac81acc998635ee22d0c8fc3dcad4b3fd9632e10efd9551b71282c66", - "size": 97350 + "sha256": "07ad3d169c011b6acebd58609731a1e2230e83af66c94bb880702041c889abbc", + "size": 85998 }, { "url": "https://modelcontextprotocol.io/docs/2025-03-26/develop/build-with-agent-skills", "status": "success", "path": "mcp/docs/2025-03-26/develop/build-with-agent-skills.md", - "sha256": "d7279623c85edc969b84bbcd599907ca1b746e76d8668df046925cef6ea6434d", - "size": 4648 + "sha256": "b33e5be36745ee20fba908bba3a50922d0e37ba50ad5232fb87d7a545ea0e9d6", + "size": 4492 }, { "url": "https://modelcontextprotocol.io/docs/2025-03-26/develop/clients/client-best-practices", "status": "success", "path": "mcp/docs/2025-03-26/develop/clients/client-best-practices.md", - "sha256": "a474eaa57152b8145ac1cbf4999aaa4c5dda210418ec4144c5e7d552cb056673", - "size": 18908 + "sha256": "7ffd5d6382ccd57692045893ff5ba588b5bf2dd9811652c00cc1aede60a43b3e", + "size": 18745 }, { "url": "https://modelcontextprotocol.io/docs/2025-03-26/develop/connect-local-servers", "status": "success", "path": "mcp/docs/2025-03-26/develop/connect-local-servers.md", - "sha256": "9eee17ad1fda47c14026e2938c5c48e14a23244b4a6bd97875ec36aeac33d170", - "size": 13941 + "sha256": "db15b8e2cc72ce71480b780afa8e09f2d86f11f09ff334e52b47576849e42553", + "size": 12143 }, { "url": "https://modelcontextprotocol.io/docs/2025-03-26/develop/connect-remote-servers", "status": "success", "path": "mcp/docs/2025-03-26/develop/connect-remote-servers.md", - "sha256": "f30f6a686237e1e233b4fee6e437fa7aa145306f34e8a7b30079de44443188af", - "size": 9452 + "sha256": "3bbe4121c32d29b0007364b9218e1ed9a91a5cc1a14766085f07e99762a23731", + "size": 8347 }, { "url": "https://modelcontextprotocol.io/docs/2025-03-26/getting-started/intro", "status": "success", "path": "mcp/docs/2025-03-26/getting-started/intro.md", - "sha256": "9522531af426261f6fd0ac5cdc4266d737315beca3ee19317ab1eb59ff19aeef", - "size": 3625 + "sha256": "114bbe45cdf34901e41088004d7bec54b551f0988e1606573b437e535d071917", + "size": 3193 }, { "url": "https://modelcontextprotocol.io/docs/2025-03-26/learn/architecture", "status": "success", "path": "mcp/docs/2025-03-26/learn/architecture.md", - "sha256": "b1173d8ea0df278cd92b7ff9d4f799d5340fc335ed4f26ac1e3f0daa48a168b5", - "size": 25491 + "sha256": "cff3c65e082267e26bd4c775269df88a96747424f06de147aae0f432b1571f36", + "size": 24092 }, { "url": "https://modelcontextprotocol.io/docs/2025-03-26/learn/client-concepts", @@ -7506,106 +7520,106 @@ "url": "https://modelcontextprotocol.io/docs/2025-03-26/learn/server-concepts", "status": "success", "path": "mcp/docs/2025-03-26/learn/server-concepts.md", - "sha256": "e800bf3b48063dc63295a8992077f212218f55db6ee4fae9fcb012df8b826842", - "size": 13475 + "sha256": "d67a8de0cc914d4ab14a1b0c5e18731b859127afcb22d541bfae65162b6d1ce3", + "size": 13445 }, { "url": "https://modelcontextprotocol.io/docs/2025-03-26/learn/versioning", "status": "success", "path": "mcp/docs/2025-03-26/learn/versioning.md", - "sha256": "f398f64ba31e53fa5a88a71b70021eb2cc81099f72960bdf47c069cab13a41db", - "size": 2091 + "sha256": "e05c4c9c7337d4221f2f0e0e7cc97b86cb39354f9c876503edcdb2c900a2003f", + "size": 2088 }, { "url": "https://modelcontextprotocol.io/docs/2025-03-26/sdk", "status": "success", "path": "mcp/docs/2025-03-26/sdk.md", - "sha256": "bfc183b64e1266fb97fdc98f71e51c5c07762debaa5eaf175f4c208f3604a348", - "size": 3700 + "sha256": "450c10052f6b1e9115394e5741a22f3457a71639090af370f505398b8f8e8d81", + "size": 2848 }, { "url": "https://modelcontextprotocol.io/docs/2025-03-26/tools/debugging", "status": "success", "path": "mcp/docs/2025-03-26/tools/debugging.md", - "sha256": "2b584d6978829b83283e9160b8b8ca971da0f335294ef6e9292b6aa7bbf57586", - "size": 10144 + "sha256": "75d321081abe897a07e012a8d22630c12995d9e8a739ee410977ec9f098a8d2f", + "size": 9772 }, { "url": "https://modelcontextprotocol.io/docs/2025-03-26/tools/inspector", "status": "success", "path": "mcp/docs/2025-03-26/tools/inspector.md", - "sha256": "2a1d4ffa9719f695895d233936d145220d0c057fef066aa8e4f4714bb95d5d38", - "size": 4246 + "sha256": "69912a22a791f547a8bf49dc8f6d5c78a02dd94e90185a0c82e65a972d527f03", + "size": 3817 }, { "url": "https://modelcontextprotocol.io/docs/2025-03-26/tutorials/security/authorization", "status": "success", "path": "mcp/docs/2025-03-26/tutorials/security/authorization.md", - "sha256": "85247666c5655ee21dba4a82d05ff8cbaa52975b1749200948a2354b9219cb0d", - "size": 47690 + "sha256": "c9a8c2e5c16e2b2103c14cd1185bf630664457e23ca16ae5d80780750cf02b86", + "size": 43886 }, { "url": "https://modelcontextprotocol.io/docs/2025-03-26/tutorials/security/security_best_practices", "status": "success", "path": "mcp/docs/2025-03-26/tutorials/security/security_best_practices.md", - "sha256": "5bf3d634453379d1fecee44c43f34a4ba130caa75d1e121ff65e656bb49486bf", - "size": 37327 + "sha256": "ccc10c2f96abb744bc1d2f529619b6c2c1486f452f8a3f8263f08f322b0ee392", + "size": 37324 }, { "url": "https://modelcontextprotocol.io/docs/2025-06-18/develop/build-client", "status": "success", "path": "mcp/docs/2025-06-18/develop/build-client.md", - "sha256": "4c24cbe188caac35061053796daed17f5424b723232821af9ec4b4ae75fbd47f", - "size": 79528 + "sha256": "1d2d1c4a485241f46320ac459d4f5ebced99040f57370d52e67fb745b688f7b8", + "size": 71264 }, { "url": "https://modelcontextprotocol.io/docs/2025-06-18/develop/build-server", "status": "success", "path": "mcp/docs/2025-06-18/develop/build-server.md", - "sha256": "b7350759942d35778b92841ddbd6e99caef324973eed2ba57343ea3dee44b7a7", - "size": 97350 + "sha256": "789805fb7fb8eb812b8f0114f83acc0bab696c4a262ba18f5a6fa0242d816e5f", + "size": 85998 }, { "url": "https://modelcontextprotocol.io/docs/2025-06-18/develop/build-with-agent-skills", "status": "success", "path": "mcp/docs/2025-06-18/develop/build-with-agent-skills.md", - "sha256": "8d335f9fb5ccfe6542860278c9b14654358cefe7f1b0b5a87151e221b5c130cc", - "size": 4797 + "sha256": "44c865ceb34b5e34b8d8278c2f460829ab5defbb0a0a25b99e043e5740fbdfc6", + "size": 4641 }, { "url": "https://modelcontextprotocol.io/docs/2025-06-18/develop/clients/client-best-practices", "status": "success", "path": "mcp/docs/2025-06-18/develop/clients/client-best-practices.md", - "sha256": "da0037590bacc2e60beedc438cd542f995d4debcd26a496ba579d56e661928c5", - "size": 19039 + "sha256": "0a7d9964137238edfdb4374bd811487d4da781baccb34e9052111561a0b4b454", + "size": 18876 }, { "url": "https://modelcontextprotocol.io/docs/2025-06-18/develop/connect-local-servers", "status": "success", "path": "mcp/docs/2025-06-18/develop/connect-local-servers.md", - "sha256": "924774c457aaac4c86f9d568a5ca240e4a2a20b2ce4f6fad0df84f8bd31e41da", - "size": 13941 + "sha256": "1c9cbc486d12e6c706cb27e1a5e19423ed9601ff86c14b74e24a47b96687a83e", + "size": 12143 }, { "url": "https://modelcontextprotocol.io/docs/2025-06-18/develop/connect-remote-servers", "status": "success", "path": "mcp/docs/2025-06-18/develop/connect-remote-servers.md", - "sha256": "3b5ce15b53f5d5d7c0a9612704e150f5af36f1047bafcf587b0863a45b521655", - "size": 9452 + "sha256": "f002a6a38d323069c920518eb1edfe78105d0994eb15f6b0523fc918c48099f0", + "size": 8347 }, { "url": "https://modelcontextprotocol.io/docs/2025-06-18/getting-started/intro", "status": "success", "path": "mcp/docs/2025-06-18/getting-started/intro.md", - "sha256": "b73db9f338e36edfefa18af5f6ccb12ce4dbf300236d863525be0ba0c5d8b3ea", - "size": 3625 + "sha256": "00b81738afedb7582e39a569ed9eae1f6dcf650588f7e8cafe3da67fca7c2f66", + "size": 3193 }, { "url": "https://modelcontextprotocol.io/docs/2025-06-18/learn/architecture", "status": "success", "path": "mcp/docs/2025-06-18/learn/architecture.md", - "sha256": "bbea908f4b2a320a2bccd6b8a1a1fc7eaee07c89bc7588e3637664bd23c4cb20", - "size": 25817 + "sha256": "0a8b72edbf763e59c594e0c14d92e85eac1fae8d193ea4ac6d38f934cdeb6183", + "size": 24418 }, { "url": "https://modelcontextprotocol.io/docs/2025-06-18/learn/client-concepts", @@ -7618,106 +7632,106 @@ "url": "https://modelcontextprotocol.io/docs/2025-06-18/learn/server-concepts", "status": "success", "path": "mcp/docs/2025-06-18/learn/server-concepts.md", - "sha256": "e800bf3b48063dc63295a8992077f212218f55db6ee4fae9fcb012df8b826842", - "size": 13475 + "sha256": "d67a8de0cc914d4ab14a1b0c5e18731b859127afcb22d541bfae65162b6d1ce3", + "size": 13445 }, { "url": "https://modelcontextprotocol.io/docs/2025-06-18/learn/versioning", "status": "success", "path": "mcp/docs/2025-06-18/learn/versioning.md", - "sha256": "d42ab16f20e8ef53b9f0d70bf5dcd76642ad5d6f83a625a9ae4571ce6246c0de", - "size": 2091 + "sha256": "3dd398a697ccaf2aaba6bf8e4bbbd060e9d49f2c37f02f37bc765d8d8e608cb3", + "size": 2088 }, { "url": "https://modelcontextprotocol.io/docs/2025-06-18/sdk", "status": "success", "path": "mcp/docs/2025-06-18/sdk.md", - "sha256": "8fa2e48e896fcb581c1b7e9adc18eb4713c232c39addad0b6a9950c7bb8a2c85", - "size": 3700 + "sha256": "4f83dc66392cb6525def5a7adfb839ed294e304da376d141baba98ae64c2c05d", + "size": 2848 }, { "url": "https://modelcontextprotocol.io/docs/2025-06-18/tools/debugging", "status": "success", "path": "mcp/docs/2025-06-18/tools/debugging.md", - "sha256": "b5dc7a9ce56c4a5a92da4a4d7c6288ef8f0fb7f855e17766acd3234b085b36ad", - "size": 10210 + "sha256": "f8f6f2aedb6f9563e34a0aaa9e3549a106a36319ccb597ccf733d048fc884a59", + "size": 9838 }, { "url": "https://modelcontextprotocol.io/docs/2025-06-18/tools/inspector", "status": "success", "path": "mcp/docs/2025-06-18/tools/inspector.md", - "sha256": "33b028d5013ae804125826174c8d1f49362b3928ceb2ee9773d40bf61311522d", - "size": 4246 + "sha256": "951efdc04fcb117512ff3a87754ee6f5286126d52baa081e6f593dfc23384f28", + "size": 3817 }, { "url": "https://modelcontextprotocol.io/docs/2025-06-18/tutorials/security/authorization", "status": "success", "path": "mcp/docs/2025-06-18/tutorials/security/authorization.md", - "sha256": "b7cf6b31da37d8d985273d7a4275ec3cc0c9c144680a2f99f676863e6f3145ec", - "size": 47690 + "sha256": "3c1fe117a29462e1464fc244f87424c9d56af74fd1b6b4ac05d99034ad47bbb5", + "size": 43886 }, { "url": "https://modelcontextprotocol.io/docs/2025-06-18/tutorials/security/security_best_practices", "status": "success", "path": "mcp/docs/2025-06-18/tutorials/security/security_best_practices.md", - "sha256": "585350b7c111971e27425bb1483b953b0663e9fb1e08c144a0049947b01c7886", - "size": 37327 + "sha256": "9f7ed8051833ab35b3bb8657ca20d40f541ddac7eb472cdd4b80c4e13ee39fcf", + "size": 37324 }, { "url": "https://modelcontextprotocol.io/docs/2025-11-25/develop/build-client", "status": "success", "path": "mcp/docs/2025-11-25/develop/build-client.md", - "sha256": "7f6c37f3e7f283058af4f9441684b8e1350a91eef2222d8acf214e006c4c2234", - "size": 80042 + "sha256": "62964cff8721669ae523879d7acd86949c68bd4f1a8a47a61126efd29eba1ce7", + "size": 71754 }, { "url": "https://modelcontextprotocol.io/docs/2025-11-25/develop/build-server", "status": "success", "path": "mcp/docs/2025-11-25/develop/build-server.md", - "sha256": "d79996e792eefee263922e33becbd9dd2468539edcd75565b6a447174e258f45", - "size": 97350 + "sha256": "2b0dc606f293fa5d638a8dec6cb2407df685670aabb18b495cec2308de1279fd", + "size": 85998 }, { "url": "https://modelcontextprotocol.io/docs/2025-11-25/develop/build-with-agent-skills", "status": "success", "path": "mcp/docs/2025-11-25/develop/build-with-agent-skills.md", - "sha256": "9fb5ed36e9541e17661cafd1ab127426cee415325b37bb794cfa0a45fc66b7ed", - "size": 4797 + "sha256": "5d0b9c81bc7feef5f5ee5f9a16cd05f7c2355d77ff027f363f1f2e7e5b26770e", + "size": 4641 }, { "url": "https://modelcontextprotocol.io/docs/2025-11-25/develop/clients/client-best-practices", "status": "success", "path": "mcp/docs/2025-11-25/develop/clients/client-best-practices.md", - "sha256": "6c5fd1106f45d66260e44d51704bed8202901d1964cafd0d3d7c5edae573ad6c", - "size": 19039 + "sha256": "99df34678168faa7fecbb5dda964afd4dc5e9276137e6d2119d8b1a2ef22f148", + "size": 18876 }, { "url": "https://modelcontextprotocol.io/docs/2025-11-25/develop/connect-local-servers", "status": "success", "path": "mcp/docs/2025-11-25/develop/connect-local-servers.md", - "sha256": "ef0ac75dac5c1c4a6e0a5294041ae6e4141fa6a37323f1486644ad73e0efa3f0", - "size": 13941 + "sha256": "87ebf1599d361450b28aa160090d2c3ca1e77904e02c56dc501ae73c038ed810", + "size": 12143 }, { "url": "https://modelcontextprotocol.io/docs/2025-11-25/develop/connect-remote-servers", "status": "success", "path": "mcp/docs/2025-11-25/develop/connect-remote-servers.md", - "sha256": "13e5952f20dafb639c62e60084b8b80882cae137397711755eeb3750ade0436b", - "size": 9452 + "sha256": "4b0fe775cc0fcaaa08d56b3cd61d0d303098736d523faed089107a73fc8600fa", + "size": 8347 }, { "url": "https://modelcontextprotocol.io/docs/2025-11-25/getting-started/intro", "status": "success", "path": "mcp/docs/2025-11-25/getting-started/intro.md", - "sha256": "db14da7f7048566baf4365c57385262a27454a2137c6052aaa1ca48d8f44d097", - "size": 3625 + "sha256": "e6c17ff0f91e18089ca6efb74aaec80671820c6def109d51fc7b19723dd28e04", + "size": 3193 }, { "url": "https://modelcontextprotocol.io/docs/2025-11-25/learn/architecture", "status": "success", "path": "mcp/docs/2025-11-25/learn/architecture.md", - "sha256": "342f1c66b14d0004db872b47448b9a1a5990a0a7741ce892790453830b68e8ba", - "size": 25817 + "sha256": "a60caee79ef3fdfb4dc3c1088c6e1ad861d958ee3f27d3761f6d329039c8ca61", + "size": 24418 }, { "url": "https://modelcontextprotocol.io/docs/2025-11-25/learn/client-concepts", @@ -7730,169 +7744,169 @@ "url": "https://modelcontextprotocol.io/docs/2025-11-25/learn/server-concepts", "status": "success", "path": "mcp/docs/2025-11-25/learn/server-concepts.md", - "sha256": "e800bf3b48063dc63295a8992077f212218f55db6ee4fae9fcb012df8b826842", - "size": 13475 + "sha256": "d67a8de0cc914d4ab14a1b0c5e18731b859127afcb22d541bfae65162b6d1ce3", + "size": 13445 }, { "url": "https://modelcontextprotocol.io/docs/2025-11-25/learn/versioning", "status": "success", "path": "mcp/docs/2025-11-25/learn/versioning.md", - "sha256": "2ff58b53ce5de82fade66dc6a4be49d6d7caf3e6ff5944084dc4f760719f5eeb", - "size": 2091 + "sha256": "c7fff3f6ad17f68d7f0ba3cb7003efa072f255a177db13dedbc834595ce100b0", + "size": 2088 }, { "url": "https://modelcontextprotocol.io/docs/2025-11-25/sdk", "status": "success", "path": "mcp/docs/2025-11-25/sdk.md", - "sha256": "5e49bdf2557f850bc4167b54655bab971c0c63a703c59df938a5a4919e99e36b", - "size": 3700 + "sha256": "59d6546133aa132aac23d79536c42a7909d27426c93e1bee5788879557b0e3a1", + "size": 2848 }, { "url": "https://modelcontextprotocol.io/docs/2025-11-25/tools/debugging", "status": "success", "path": "mcp/docs/2025-11-25/tools/debugging.md", - "sha256": "f65c9a00332f251c69dbab3a8fe746db89c70e18187f058dc0411d97fcff7a96", - "size": 10210 + "sha256": "3b4db031994cb8bd31e77923a5f09678403fe38f0b51307afc0c5a122b6454be", + "size": 9838 }, { "url": "https://modelcontextprotocol.io/docs/2025-11-25/tools/inspector", "status": "success", "path": "mcp/docs/2025-11-25/tools/inspector.md", - "sha256": "45345532538259aa2e7e6acf090dd72763685e5df22070056c745079d7d7d09b", - "size": 4246 + "sha256": "fcf9a83d4b6ba041c34b64399c81aaea8fb12e77e910b96e642c7e154dcff3f5", + "size": 3817 }, { "url": "https://modelcontextprotocol.io/docs/2025-11-25/tutorials/security/authorization", "status": "success", "path": "mcp/docs/2025-11-25/tutorials/security/authorization.md", - "sha256": "9ce62a4997dd19f259a61bd58ad447ccfe292ed020668cb2e970712cdcdffd36", - "size": 47690 + "sha256": "24bcff323df7791f81ac9206cc0fb242b022f43b56f9c7b8fef1ae05d70c54a1", + "size": 43886 }, { "url": "https://modelcontextprotocol.io/docs/2025-11-25/tutorials/security/security_best_practices", "status": "success", "path": "mcp/docs/2025-11-25/tutorials/security/security_best_practices.md", - "sha256": "27dfdc9c8fb0f29750e52d64797077bc1ba01f25a0d584e3189954f47a2601c7", - "size": 37327 + "sha256": "5421e68cbb0d3f975502dd721935bc26c900b928b71d0d83497a76d1d455e4f4", + "size": 37324 }, { "url": "https://modelcontextprotocol.io/docs/2026-07-28/develop/build-client", "status": "success", "path": "mcp/docs/2026-07-28/develop/build-client.md", - "sha256": "68db92dd2b9ad07afd1a51259312152df0db8b55b8c4af65daaf019d4901848e", - "size": 80847 + "sha256": "f5a3267c5f40c421eddedce21e7ac1fb71c6a159b7913aa0add2577fd32f675d", + "size": 72579 }, { "url": "https://modelcontextprotocol.io/docs/2026-07-28/develop/build-server", "status": "success", "path": "mcp/docs/2026-07-28/develop/build-server.md", - "sha256": "fba0a5d13d73760347c685c5e33b47069d1d89199032d1acfcb528c62d2fe464", - "size": 98455 + "sha256": "c7099a92d2cebd7df62a1c88cfe44ba6631de4bee26a833cfe38e4b656788085", + "size": 87043 }, { "url": "https://modelcontextprotocol.io/docs/2026-07-28/develop/build-with-agent-skills", "status": "success", "path": "mcp/docs/2026-07-28/develop/build-with-agent-skills.md", - "sha256": "800c21cc1642b43d16cfdf5f41254d95292020ad540c3a974a12cdcd952edb85", - "size": 4797 + "sha256": "1734ebe886678b6e0e5775c7297e26f18f3cab49d00a7c8060d774cdcd5bdb4f", + "size": 4641 }, { "url": "https://modelcontextprotocol.io/docs/2026-07-28/develop/clients/client-best-practices", "status": "success", "path": "mcp/docs/2026-07-28/develop/clients/client-best-practices.md", - "sha256": "c2ee3b29d4cb1845d095c5769415d4ff2c2da4de54cc839ec108afcb67fe7b57", - "size": 19462 + "sha256": "24eb8a233c419df10b811b84cdee1c17f687f32ee2a8d00e83420db92ba0ce6e", + "size": 19299 }, { "url": "https://modelcontextprotocol.io/docs/2026-07-28/develop/connect-local-servers", "status": "success", "path": "mcp/docs/2026-07-28/develop/connect-local-servers.md", - "sha256": "386251e50038d2d0240133a24cf140e1ca760f3b004bb0c1513fa94a08dbd109", - "size": 14052 + "sha256": "48100115ce76eb0b7c19834cfac2a896e1289dc9463a76100de44e302a1e9cc3", + "size": 12239 }, { "url": "https://modelcontextprotocol.io/docs/2026-07-28/develop/connect-remote-servers", "status": "success", "path": "mcp/docs/2026-07-28/develop/connect-remote-servers.md", - "sha256": "a9256381a5c4d50d3d4429a9e305c885a03e71bc59ed5ca335a1f059b3e5679b", - "size": 10635 + "sha256": "4fbe9b3dbf5a35a722ea7c010e91b812d84bcbcdb01b4f290877dbdaaae3af01", + "size": 9194 }, { "url": "https://modelcontextprotocol.io/docs/2026-07-28/getting-started/intro", "status": "success", "path": "mcp/docs/2026-07-28/getting-started/intro.md", - "sha256": "a2314e74bbae7765b14a727f4bf9456895b58b6d2c2ad7cd2996fb5bfd830f6c", - "size": 3625 + "sha256": "029712dab43d7c37c031b227ab807d53c203e49dc9cc34e044a512b9c9c2bebe", + "size": 3193 }, { "url": "https://modelcontextprotocol.io/docs/2026-07-28/learn/architecture", "status": "success", "path": "mcp/docs/2026-07-28/learn/architecture.md", - "sha256": "c35ae31222f730ce87adf9344172f8406c51021a34e8c248269fa50fe5e34ae1", - "size": 32772 + "sha256": "0ba2853445fdd465201b5c08a6b6a7b39fb23b6444345377bd0529fbf6a2f6ed", + "size": 30951 }, { "url": "https://modelcontextprotocol.io/docs/2026-07-28/learn/client-concepts", "status": "success", "path": "mcp/docs/2026-07-28/learn/client-concepts.md", - "sha256": "50df72a648b55057271262edf5686bc49da275b932f3ec0aa277c6093420b50d", - "size": 17055 + "sha256": "6811e277adb42c30ae020caa5c41c468a9190300c599fa9b5289de4981fa31c7", + "size": 17043 }, { "url": "https://modelcontextprotocol.io/docs/2026-07-28/learn/server-concepts", "status": "success", "path": "mcp/docs/2026-07-28/learn/server-concepts.md", - "sha256": "370144d729965faa4ebf7759c1ecf2c8233116e9a4ea949c214ef1ec015d4e60", - "size": 13813 + "sha256": "b212835ae02d0080942538eaf9b9cb2ff687916c5af79941cbd4d47c0dfcb842", + "size": 13783 }, { "url": "https://modelcontextprotocol.io/docs/2026-07-28/learn/versioning", "status": "success", "path": "mcp/docs/2026-07-28/learn/versioning.md", - "sha256": "f00269fadddff0f5500bdfda7169d572d2adf3131d239a69c1465d541d7f6eb6", - "size": 3222 + "sha256": "06e45272cc902fc0a8b7376ec60086793c96e10102860ece9650ebb97200bb5f", + "size": 3219 }, { "url": "https://modelcontextprotocol.io/docs/2026-07-28/sdk", "status": "success", "path": "mcp/docs/2026-07-28/sdk.md", - "sha256": "3ed046674789040c08a73b6f26851173ce63e20e93bf5bb239cd0c138af017ac", - "size": 3696 + "sha256": "d2e584944ab7dc5c7de61dcaf987fa11b705a55687e08c3ae93ea466e488cfd6", + "size": 2848 }, { "url": "https://modelcontextprotocol.io/docs/2026-07-28/tools/debugging", "status": "success", "path": "mcp/docs/2026-07-28/tools/debugging.md", - "sha256": "b93e9e2857915eab1745198d64d67a9fa7d504b68d928e5576550cf21bab098a", - "size": 11023 + "sha256": "f8fc3c40fa219ccc7ce599c080b4d295166b3437fdefaf23920c76f8a0eb4a44", + "size": 10641 }, { "url": "https://modelcontextprotocol.io/docs/2026-07-28/tools/inspector", "status": "success", "path": "mcp/docs/2026-07-28/tools/inspector.md", - "sha256": "c388ead280f0c3474eb0b5b513a320a58813847e8e6d705ab54d3b3bd90dd487", - "size": 8044 + "sha256": "b95089538cf374c9794ac778a9af572a368114aaafc004b28c3eac7efca09a68", + "size": 7060 }, { "url": "https://modelcontextprotocol.io/docs/2026-07-28/tools/inspector/authorization", "status": "success", "path": "mcp/docs/2026-07-28/tools/inspector/authorization.md", - "sha256": "9d5793ff9349341ad857741ded87a2e7a50d42861ad31ccc9f2f15b9525f9488", - "size": 11625 + "sha256": "6da30097e797142db708f0918b8c78fac11b6194d78b5bcd05d9a559e89b662e", + "size": 11145 }, { "url": "https://modelcontextprotocol.io/docs/2026-07-28/tools/inspector/cli", "status": "success", "path": "mcp/docs/2026-07-28/tools/inspector/cli.md", - "sha256": "50ac7ebd097ebc55ad05ea12fbebd12cba4d129d7a01b839f116057682348651", - "size": 13726 + "sha256": "165e2bebb724061c4949ea32591635bd99763903c159f7045289d04958d31fa9", + "size": 13712 }, { "url": "https://modelcontextprotocol.io/docs/2026-07-28/tools/inspector/configuration", "status": "success", "path": "mcp/docs/2026-07-28/tools/inspector/configuration.md", - "sha256": "ac852d85ed850b24aa9059be4876bebbe48d7a8dc99658606fca878330b7955e", - "size": 20793 + "sha256": "c2e412e583963ef8273e658f12e76f7772d8520df08c79db3c4c962d9f3eb01e", + "size": 20778 }, { "url": "https://modelcontextprotocol.io/docs/2026-07-28/tools/inspector/mcpdo", @@ -7905,176 +7919,176 @@ "url": "https://modelcontextprotocol.io/docs/2026-07-28/tools/inspector/protocol-eras", "status": "success", "path": "mcp/docs/2026-07-28/tools/inspector/protocol-eras.md", - "sha256": "74dc00b0643fcc957d588851648ccbb767dc9677810384404ef67dbab1f2c138", - "size": 18591 + "sha256": "2f52a66e30e5661e7526676811a17180dd90ee9557f5109744589cb580e692a8", + "size": 15570 }, { "url": "https://modelcontextprotocol.io/docs/2026-07-28/tools/inspector/recipes", "status": "success", "path": "mcp/docs/2026-07-28/tools/inspector/recipes.md", - "sha256": "cbd6f52260a9c74cb036ed2fe9ebf6d89341079bbff020dc4811d1ff8238207f", - "size": 17813 + "sha256": "388b7af3a02d21ebad8ee836ed1ec12e7b1b23825b95bda818707605fa11fa94", + "size": 17041 }, { "url": "https://modelcontextprotocol.io/docs/2026-07-28/tools/inspector/security", "status": "success", "path": "mcp/docs/2026-07-28/tools/inspector/security.md", - "sha256": "38e2d36a2927a83886d2e737b140192d050665e398b08660757b5e67ddb5d58e", - "size": 16604 + "sha256": "c5c5334c77cf0d957702df3d70ba6eacd3b1a4d5ecaa0c50c11d7cf69fbf0b10", + "size": 16590 }, { "url": "https://modelcontextprotocol.io/docs/2026-07-28/tools/inspector/tui", "status": "success", "path": "mcp/docs/2026-07-28/tools/inspector/tui.md", - "sha256": "07b658f0be85670ff4d486aea9421e29c34b0b6eb901dd06860a64269cb9a906", - "size": 7295 + "sha256": "841abdfa9f7ddecc77d7fbd6244902ab9f094ab6d29c0b389a0266f3e39c1f17", + "size": 6838 }, { "url": "https://modelcontextprotocol.io/docs/2026-07-28/tools/inspector/web", "status": "success", "path": "mcp/docs/2026-07-28/tools/inspector/web.md", - "sha256": "a89b71c39a19318e415cfdab961de89d5f2169eed4e4ef493fefa9dc78bbcfca", - "size": 15439 + "sha256": "261d3e87dfa3adee4ec8d96fe77a55ba2ba67e3d28add7fbe1089228d9fdb2a2", + "size": 13810 }, { "url": "https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/authorization", "status": "success", "path": "mcp/docs/2026-07-28/tutorials/security/authorization.md", - "sha256": "cd7a96da60157cc26532bca97c88a63d8c07136296f8724d8c38f4a0d3993de1", - "size": 51492 + "sha256": "679a06869ade9e5c805bd4bc790f69a33c01e1b3dd6bac8b713fdd07d63cff9d", + "size": 47360 }, { "url": "https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/local-server-security", "status": "success", "path": "mcp/docs/2026-07-28/tutorials/security/local-server-security.md", - "sha256": "e45a2b3e6b8d8df3eee6e1993ead5af8fff97de64250d0f1c80270846774ace2", - "size": 22532 + "sha256": "52187f4222fd21d62da87d1d9d6e1b00705ec3ed47ccd5f964b9870866e6d5ed", + "size": 22326 }, { "url": "https://modelcontextprotocol.io/docs/2026-07-28/tutorials/security/security_best_practices", "status": "success", "path": "mcp/docs/2026-07-28/tutorials/security/security_best_practices.md", - "sha256": "d0fc0dc7ac40df6fce85ef036b3ac5d9a1b8ae87b25a674e0a2ec866217745fe", - "size": 42824 + "sha256": "d7a26d0868f5ed33918988977a4bd6d3b8f82bc889d640616a36db7fee442a01", + "size": 42815 }, { "url": "https://modelcontextprotocol.io/docs/draft/develop/build-client", "status": "success", "path": "mcp/docs/draft/develop/build-client.md", - "sha256": "cdd2911e60e3971b646dc639e783e035c07b7fb82f61b978e60dd3ab76d954ea", - "size": 80825 + "sha256": "fdc13a3c3a0969334af3e48629ce7228d4d22c85b9bf8d58ec44c5dc6efd5aa2", + "size": 72557 }, { "url": "https://modelcontextprotocol.io/docs/draft/develop/build-server", "status": "success", "path": "mcp/docs/draft/develop/build-server.md", - "sha256": "4f3cd79fc10472859b8d53345e4c43c8ddc2ca00b5ffede8841609a9e54383a0", - "size": 98449 + "sha256": "17e6f97b8a70e956870a8ae377a58bec2291180d387279f33f991ddf738ec850", + "size": 86988 }, { "url": "https://modelcontextprotocol.io/docs/draft/develop/build-with-agent-skills", "status": "success", "path": "mcp/docs/draft/develop/build-with-agent-skills.md", - "sha256": "24db12e44f584a4d7f4bd1e1ee61419cb58c1330bc41bd9c9a50d1308acd10b5", - "size": 4767 + "sha256": "a0d82c49648bc42a40474627e4cc7fc0355bcfe778ef897e4a6e20aad03f3179", + "size": 4611 }, { "url": "https://modelcontextprotocol.io/docs/draft/develop/clients/client-best-practices", "status": "success", "path": "mcp/docs/draft/develop/clients/client-best-practices.md", - "sha256": "dbfff4e33df9b079bab3026c75d4d7a984a72b84eca986a2ab68fb995a1e816a", - "size": 19437 + "sha256": "4694dd2d5d280a5a3911271d455a4243b8f78bdb497dc5ebbc73a55fa25d3c6f", + "size": 19274 }, { "url": "https://modelcontextprotocol.io/docs/draft/develop/connect-local-servers", "status": "success", "path": "mcp/docs/draft/develop/connect-local-servers.md", - "sha256": "82379d0275e956040f5f7e226190858fe25b762c96ffdfcf22920d9f353693d8", - "size": 14032 + "sha256": "7bf671a2e2dfede6d13be0cb2c9e524aeef158c14bf6d89775f2c8efbbc5827d", + "size": 12219 }, { "url": "https://modelcontextprotocol.io/docs/draft/develop/connect-remote-servers", "status": "success", "path": "mcp/docs/draft/develop/connect-remote-servers.md", - "sha256": "7f433da6bd662549e9086eda341008f351c11541333a8d7457693560193cf817", - "size": 10615 + "sha256": "263a9e26b061abea5172bb9f920b43ddb97d55d91e806736b32fc68d95918147", + "size": 9174 }, { "url": "https://modelcontextprotocol.io/docs/draft/getting-started/intro", "status": "success", "path": "mcp/docs/draft/getting-started/intro.md", - "sha256": "73e10acbd1944e091ddfa6769e7d60ac5e5f2ca4f1cb2f298b56a0bd5a7f5741", - "size": 3605 + "sha256": "d7b3c9740c719da5f863c32e9aababb177e7ffc6491687725e25834efbb6d16b", + "size": 3173 }, { "url": "https://modelcontextprotocol.io/docs/draft/learn/architecture", "status": "success", "path": "mcp/docs/draft/learn/architecture.md", - "sha256": "26c4a49bbeea45c0ad3b9a4bf2b8cde0d4aeeb0be6f3b8e0e59d5b5493e26026", - "size": 32707 + "sha256": "020ac9037f96e8e1bcfe5950d02201878896cb967b28d4862f96ffebe75931fc", + "size": 30886 }, { "url": "https://modelcontextprotocol.io/docs/draft/learn/client-concepts", "status": "success", "path": "mcp/docs/draft/learn/client-concepts.md", - "sha256": "c16cc2a46eca9a067f532a1642e809d00b5accfeba690b6f7ec53570820ce3b2", - "size": 17025 + "sha256": "16b6fc8f9249884c24dd839b5e38be49a7721b872efc1f32bb61be63a3a00d4b", + "size": 17013 }, { "url": "https://modelcontextprotocol.io/docs/draft/learn/server-concepts", "status": "success", "path": "mcp/docs/draft/learn/server-concepts.md", - "sha256": "4ed2d0c9254e27e1a0e79c7bbd6739fc62b175fa5cbcb5349b283c7b76f053ba", - "size": 13808 + "sha256": "d3cb3d5169c48bfa604ce4819f383d1a1f8672df75c66b696ea8157763543d36", + "size": 13778 }, { "url": "https://modelcontextprotocol.io/docs/draft/learn/versioning", "status": "success", "path": "mcp/docs/draft/learn/versioning.md", - "sha256": "fc9348522027ff66fc74d7dce51e8e1c8564dd4e3f43586a5517b3ca80dd95a9", - "size": 3192 + "sha256": "c037a2b4f05c7ea860b74c0a6c0f08be1ce590a63f41c5c011dd3e9df73bb268", + "size": 3189 }, { "url": "https://modelcontextprotocol.io/docs/draft/sdk", "status": "success", "path": "mcp/docs/draft/sdk.md", - "sha256": "ecd2546331aab529c89b26dd99353084a82b44b465ad058c4bf5cc0ef4342fc1", - "size": 3686 + "sha256": "2e1dc8b68ad9eb53ca86a9e5b8769ac1eb872d4ea0d770c229abb87815b86560", + "size": 2838 }, { "url": "https://modelcontextprotocol.io/docs/draft/tools/debugging", "status": "success", "path": "mcp/docs/draft/tools/debugging.md", - "sha256": "cb80dbcc28373e448bddb0df495c87a4ec7b4c6c1a77f5e51d088c911f118b86", - "size": 10928 + "sha256": "d686f65dcb6fefaa55b2aed5cc09591527a6e4eae02f4110a162ebaa9e59e384", + "size": 10546 }, { "url": "https://modelcontextprotocol.io/docs/draft/tools/inspector", "status": "success", "path": "mcp/docs/draft/tools/inspector.md", - "sha256": "2388188f10eda6cfee17638b84be31441a53f70bb8a49964877a47c5ad7aa7f0", - "size": 7954 + "sha256": "29cd18bff5eb5a548c2dd21d01ba3710873ce9af0ffd0a565a520e40dc74b877", + "size": 6970 }, { "url": "https://modelcontextprotocol.io/docs/draft/tools/inspector/authorization", "status": "success", "path": "mcp/docs/draft/tools/inspector/authorization.md", - "sha256": "9338b0a31e6ae5009d50678d6b366202cc4933d5cef0720c4601d42b7cce5169", - "size": 11595 + "sha256": "d6c4af0a1c13dbc4eadf1ed614dde75dfa6214023aa9df91d8a6f559131cf87b", + "size": 11115 }, { "url": "https://modelcontextprotocol.io/docs/draft/tools/inspector/cli", "status": "success", "path": "mcp/docs/draft/tools/inspector/cli.md", - "sha256": "5a4bc981f93f0e99d898690c30c42dd63da0532e08c0ead86d67ac77c4eb01f4", - "size": 13701 + "sha256": "6ee7a3221c12d46e41d1d1d7b118047672cbd5713fd285848b353b54d1ee2180", + "size": 13687 }, { "url": "https://modelcontextprotocol.io/docs/draft/tools/inspector/configuration", "status": "success", "path": "mcp/docs/draft/tools/inspector/configuration.md", - "sha256": "32c01e21df5b5eb1ce36bacc44ee0e05d2f05a5120b51aa4f7a0d04a2ab71a6d", - "size": 20738 + "sha256": "f72ae9061544ed657a33f80f3bc1845b6c4d410dce30beb69fb354ae6b38d672", + "size": 20723 }, { "url": "https://modelcontextprotocol.io/docs/draft/tools/inspector/mcpdo", @@ -8087,57 +8101,57 @@ "url": "https://modelcontextprotocol.io/docs/draft/tools/inspector/protocol-eras", "status": "success", "path": "mcp/docs/draft/tools/inspector/protocol-eras.md", - "sha256": "74dc00b0643fcc957d588851648ccbb767dc9677810384404ef67dbab1f2c138", - "size": 18591 + "sha256": "2f52a66e30e5661e7526676811a17180dd90ee9557f5109744589cb580e692a8", + "size": 15570 }, { "url": "https://modelcontextprotocol.io/docs/draft/tools/inspector/recipes", "status": "success", "path": "mcp/docs/draft/tools/inspector/recipes.md", - "sha256": "eb2db0fad6dad477187c752fd03a6a3e5447269ae4fdcf73fe21824af261a801", - "size": 17748 + "sha256": "acc90410456e4cb5f0b84dd1c48bffaebb50a0f151ff8831942fbc8a4c036ee2", + "size": 16976 }, { "url": "https://modelcontextprotocol.io/docs/draft/tools/inspector/security", "status": "success", "path": "mcp/docs/draft/tools/inspector/security.md", - "sha256": "7fb36dcff667f69cf76daebc80fc426b6315e7406b37ac794ba1d9f6ad0dca46", - "size": 16574 + "sha256": "d41777dc7ccc37586be70163f53df131853c7ed8ffa6ffa39100df67349e9f01", + "size": 16560 }, { "url": "https://modelcontextprotocol.io/docs/draft/tools/inspector/tui", "status": "success", "path": "mcp/docs/draft/tools/inspector/tui.md", - "sha256": "579d4d7285fe1b90dfc3ddd6e2e98a0973edeb31680906b51d5fae196d3ee648", - "size": 7260 + "sha256": "f96d376ddfc48e5b607f5bf9a77cd3c6efc3df31ccfafcf5a74388fa77f44bc6", + "size": 6803 }, { "url": "https://modelcontextprotocol.io/docs/draft/tools/inspector/web", "status": "success", "path": "mcp/docs/draft/tools/inspector/web.md", - "sha256": "74bacbc68d8324c938da6901ba84c83bfe07fb0be0ac472ed2997281ab49d4b6", - "size": 15359 + "sha256": "2b4cd85f5d375109cd36df59755efd7acaf1fc0870fa5450eaa9b6a814e6e2ca", + "size": 13730 }, { "url": "https://modelcontextprotocol.io/docs/draft/tutorials/security/authorization", "status": "success", "path": "mcp/docs/draft/tutorials/security/authorization.md", - "sha256": "d1daeb73897611e5e04d70ca39f3ca76caa0812bd5324df0ccbf5bb9db3b3d1d", - "size": 49654 + "sha256": "d1b68c0a7bfd593276e025a01a3d3228632cd3ba52186479b41a0b6a8e7d41f5", + "size": 45706 }, { "url": "https://modelcontextprotocol.io/docs/draft/tutorials/security/local-server-security", "status": "success", "path": "mcp/docs/draft/tutorials/security/local-server-security.md", - "sha256": "13dbf099af2dea5f5f9db3c35721795e1679605e2e94d1d92de9a6327bb7d4ae", - "size": 22497 + "sha256": "4cc8c1dfcc415c21d15f4a30527feafd4a92deeaa2527288292644592e9d1a1b", + "size": 22291 }, { "url": "https://modelcontextprotocol.io/docs/draft/tutorials/security/security_best_practices", "status": "success", "path": "mcp/docs/draft/tutorials/security/security_best_practices.md", - "sha256": "f935e611d6d7ae1e659b1fb9654a992e5fab63a0adc47f638ca8a00cc4e2dff2", - "size": 42779 + "sha256": "b9c5a87e09e143538cb682d67c6b418b613b0b4f1b55198e432d8aa8acc12906", + "size": 42770 }, { "url": "https://modelcontextprotocol.io/examples", @@ -8150,449 +8164,449 @@ "url": "https://modelcontextprotocol.io/extensions/apps/build", "status": "success", "path": "mcp/extensions/apps/build.md", - "sha256": "3340a6f82e49ead5041f2f25ba72d75fa4ca7e420827bd83fd95f60f1b10296e", - "size": 19412 + "sha256": "b02753c43be07d2f9e1076cba52d3edb59b9420a47c836cf7cb41c991a3778e6", + "size": 17075 }, { "url": "https://modelcontextprotocol.io/extensions/apps/overview", "status": "success", "path": "mcp/extensions/apps/overview.md", - "sha256": "ebae6e6d71c0561230261caf3b84a7493bd55beae704593accc6e1bceedb0e39", - "size": 12907 + "sha256": "836bb7ba4f42ee5cd76ff64e461d6a72c24f987a711bc4e62f8eb9985bf953a3", + "size": 12755 }, { "url": "https://modelcontextprotocol.io/extensions/auth/enterprise-managed-authorization", "status": "success", "path": "mcp/extensions/auth/enterprise-managed-authorization.md", - "sha256": "f3a91c6d40f884daba09f55d7443f8b1cdd3fd169f9de739365d0621596c2af6", - "size": 8893 + "sha256": "bed8b7f29a572ba34c7bb93f3a6c715afc39d891b2036b6b02d9e6f94bf427b4", + "size": 8657 }, { "url": "https://modelcontextprotocol.io/extensions/auth/oauth-client-credentials", "status": "success", "path": "mcp/extensions/auth/oauth-client-credentials.md", - "sha256": "1b4e4a1069c800066f2b310bf29311b321772216110620805c00dde813a8a371", - "size": 14213 + "sha256": "dd740ae521f53e0fbecedc1cca97d25ee53e8fa1897f98b0ea2d7a4bee61c803", + "size": 12115 }, { "url": "https://modelcontextprotocol.io/extensions/auth/overview", "status": "success", "path": "mcp/extensions/auth/overview.md", - "sha256": "935a1eeb6df637d7f8e60d52a068d38d1ed5a3094522b72ef6bc1adb373a12ae", - "size": 3755 + "sha256": "93205df07e398aace6dc3415898eb0f3743d92f6c11cfc18ad3ebc7cce607870", + "size": 3605 }, { "url": "https://modelcontextprotocol.io/extensions/client-matrix", "status": "success", "path": "mcp/extensions/client-matrix.md", - "sha256": "47d9fdd69da4063636807548cbe939c7d57edb26412c8180071c42e198bf926e", - "size": 4354 + "sha256": "0d5ae039092d0d9b5c35ef79eeea13dc645757a7f4e163fb3a145194d4da33aa", + "size": 4040 }, { "url": "https://modelcontextprotocol.io/extensions/overview", "status": "success", "path": "mcp/extensions/overview.md", - "sha256": "37ecd3ab5cf9efadbf90d904424b69e30356b5a3b1b7af10e0c6ab174d8893f4", - "size": 8758 + "sha256": "b00d997868c5be46934758b233d4e8114d5a55ddefff4515445f9343d5eeaa78", + "size": 8654 }, { "url": "https://modelcontextprotocol.io/extensions/skills/overview", "status": "success", "path": "mcp/extensions/skills/overview.md", - "sha256": "a8a6c560a15bdb95c82531508a5f7839e0b235b58682d7ffab34b37b239bef64", - "size": 15703 + "sha256": "95289e0a78e2e0c4c26db766c74cdbff13b580773a5b99871adf9cd14a93edda", + "size": 15664 }, { "url": "https://modelcontextprotocol.io/extensions/tasks/overview", "status": "success", "path": "mcp/extensions/tasks/overview.md", - "sha256": "0e564a883ef11b1b5dfe42933caec982471f09f078ff33297e888da32dcdedc3", - "size": 9967 + "sha256": "6f4008dd167a89b79f6838e4f1e0464ec6658e3d83bef443e52f7ecb548eafce", + "size": 9468 }, { "url": "https://modelcontextprotocol.io/registry/about", "status": "success", "path": "mcp/registry/about.md", - "sha256": "99acf6511a5a8c8e7a6a4926ead632497ce1747684521842afde4b384d119cb8", - "size": 6800 + "sha256": "4081a08ba8b1b9ebff9f4480d56c4a52f6879641200ebc22c5a8ae264ab1cbdb", + "size": 6704 }, { "url": "https://modelcontextprotocol.io/registry/authentication", "status": "success", "path": "mcp/registry/authentication.md", - "sha256": "8743189d635018a1ed6f7c75507a6c166b8460ab9dc8a8b7515618203a059bda", - "size": 11197 + "sha256": "3ff6badd2137df363cdcc2035c97d6192a9767236fb11cfe65f7a12aad488bab", + "size": 10778 }, { "url": "https://modelcontextprotocol.io/registry/faq", "status": "success", "path": "mcp/registry/faq.md", - "sha256": "65be5b21cde343b0e6234d3b5f58c8b28648133f06e0bdfc0e192b00ebb177a1", - "size": 2448 + "sha256": "04b0fea472562f364946e49e0059428bfcb5ba2286c5fa79dd93bb07a8e2c29e", + "size": 2439 }, { "url": "https://modelcontextprotocol.io/registry/github-actions", "status": "success", "path": "mcp/registry/github-actions.md", - "sha256": "110fa46fa9675ccd5be999690f6fd0afa97321480cc2b6230115800d9f125a61", - "size": 7253 + "sha256": "6aa3e8afc34a3f4da4ee92481eeef5e29f5b8cb2e3ad4a2c3169d0baee2bcbd5", + "size": 6965 }, { "url": "https://modelcontextprotocol.io/registry/moderation-policy", "status": "success", "path": "mcp/registry/moderation-policy.md", - "sha256": "5910f0b03e6cacfb6e2f587995288d9939e73ad49472090e9a6de55729855c63", - "size": 3012 + "sha256": "018c889c059410754fc47ff1ad13523acea6d0eb742ac1dd3e8b451c9360e38e", + "size": 3009 }, { "url": "https://modelcontextprotocol.io/registry/package-types", "status": "success", "path": "mcp/registry/package-types.md", - "sha256": "3bef3313bdff89048ff305cb728051017fd8f0e429741fa9fcff0560149f6ef5", - "size": 9971 + "sha256": "8f24e8852b09d9e82464f08d9d7d1b168fccf7877013971bc749c38e1f19909b", + "size": 9968 }, { "url": "https://modelcontextprotocol.io/registry/quickstart", "status": "success", "path": "mcp/registry/quickstart.md", - "sha256": "e6e63b7487c5456f4235b63405d33fe717f6059bc5815902dd831b150d84b759", - "size": 9791 + "sha256": "28b94b6d10d3c8b3fd4d9b6124bc9e75b618eeccdd2f7578363d3748034b9036", + "size": 9743 }, { "url": "https://modelcontextprotocol.io/registry/registry-aggregators", "status": "success", "path": "mcp/registry/registry-aggregators.md", - "sha256": "d6a7b6c85417d85b823582f8408d7f43c8a3d1781c86add2dac8b7db88ab1432", - "size": 5005 + "sha256": "72a94472ed8b37be5c5dba163fd2d537fd2986fc16ecc45df9d8f80aca1bf72d", + "size": 4996 }, { "url": "https://modelcontextprotocol.io/registry/remote-servers", "status": "success", "path": "mcp/registry/remote-servers.md", - "sha256": "cfcc68373feaccc343260222caee504f162e2ed0505ce1960f118c0f3c892b1e", - "size": 5411 + "sha256": "8db6934b713aa74cef7afce90ea7f42cffc33b503f472b50c6323f2c610e85fb", + "size": 5408 }, { "url": "https://modelcontextprotocol.io/registry/terms-of-service", "status": "success", "path": "mcp/registry/terms-of-service.md", - "sha256": "642afe9282b674bcaa646b8e98ad470bc01cc0a48e57c70a97bfcacead11d16f", - "size": 7590 + "sha256": "d49b6b405cfdfb43342414e533b2aaa69af3b103ab8ec754346de30a50a64542", + "size": 7587 }, { "url": "https://modelcontextprotocol.io/registry/versioning", "status": "success", "path": "mcp/registry/versioning.md", - "sha256": "3254e44d7fd0348dd506bb93ad6a2e5eef32f229564b49892209059170d4f2cd", - "size": 5721 + "sha256": "4678c1d76d6d76db7f5edfb76c8d572b19e01ec533ca8f4654b4562898ceffc4", + "size": 5706 }, { "url": "https://modelcontextprotocol.io/seps/1024-mcp-client-security-requirements-for-local-server-", "status": "success", "path": "mcp/seps/1024-mcp-client-security-requirements-for-local-server-.md", - "sha256": "eb9677b70d6163a85a8af6778781c9104070463c2c77addf9af4785a7cba355a", - "size": 6082 + "sha256": "2ef86015044be20c37e4654ae1a6c0d4f7bc79e13133a18a3e64b2658e42540a", + "size": 5922 }, { "url": "https://modelcontextprotocol.io/seps/1034--support-default-values-for-all-primitive-types-in", "status": "success", "path": "mcp/seps/1034--support-default-values-for-all-primitive-types-in.md", - "sha256": "ef3d1668fafc61fa02bc41d0fa2ba544fec33a3fd46db2265e62e61e40c501f2", - "size": 6065 + "sha256": "431b113c21b42a63f67ae98f9683573ccf5c908bcc308e3a6770afc2b28d1ada", + "size": 5905 }, { "url": "https://modelcontextprotocol.io/seps/1036-url-mode-elicitation-for-secure-out-of-band-intera", "status": "success", "path": "mcp/seps/1036-url-mode-elicitation-for-secure-out-of-band-intera.md", - "sha256": "e0b1c8d8a066e576d399276ce4a28acb83d24b552d80b5f63027a227cf660c38", - "size": 15842 + "sha256": "0496b0e724b690c490a25059c98614ea60a2fe5d9e9701552a2c0eb265b93c4d", + "size": 15682 }, { "url": "https://modelcontextprotocol.io/seps/1046-support-oauth-client-credentials-flow-in-authoriza", "status": "success", "path": "mcp/seps/1046-support-oauth-client-credentials-flow-in-authoriza.md", - "sha256": "a4a9543297e77a4e9a1bd4165cb0489c3629e4ea9d82bad54d475dbe72d1cda3", - "size": 3865 + "sha256": "7afaa558c9716cf3f9a3bd1d90aeba08617f01c8160c314c099f909179585289", + "size": 3705 }, { "url": "https://modelcontextprotocol.io/seps/1302-formalize-working-groups-and-interest-groups-in-mc", "status": "success", "path": "mcp/seps/1302-formalize-working-groups-and-interest-groups-in-mc.md", - "sha256": "e970011b4312e60d13a1bcdc384c9eb8b0620eef06b4d8f45bc43d27594bd87e", - "size": 16555 + "sha256": "9bfd2501e0a2c26d7891a7896e316f385b0666c29a810d52fbcdf32807db4218", + "size": 16395 }, { "url": "https://modelcontextprotocol.io/seps/1303-input-validation-errors-as-tool-execution-errors", "status": "success", "path": "mcp/seps/1303-input-validation-errors-as-tool-execution-errors.md", - "sha256": "947480bd210cb7651ed0745416673bdc1357947a36a3ffa9b254b05025d0d047", - "size": 7217 + "sha256": "93c0e54085938e10137de5130e84c08f36f73031f8671226dec561c6aaa70820", + "size": 7057 }, { "url": "https://modelcontextprotocol.io/seps/1319-decouple-request-payload-from-rpc-methods-definiti", "status": "success", "path": "mcp/seps/1319-decouple-request-payload-from-rpc-methods-definiti.md", - "sha256": "d923d566539a49711aab1502488b62c49bd691fec9c2eb8c545e0f3fdff8d21d", - "size": 5940 + "sha256": "5d3fe81c7617850edfcf2e04fb0053c52643f953188a6469710c53b45b2ee115", + "size": 5780 }, { "url": "https://modelcontextprotocol.io/seps/1330-elicitation-enum-schema-improvements-and-standards", "status": "success", "path": "mcp/seps/1330-elicitation-enum-schema-improvements-and-standards.md", - "sha256": "b3749b13d0e6e76ad101dcbebc35d016273c8df0f3b6a74e1d135ffefa56f74f", - "size": 16675 + "sha256": "8390ae142e80e64b2616cd04a34cf99fb202de7066f3b485e30d861b95b9b193", + "size": 16515 }, { "url": "https://modelcontextprotocol.io/seps/1577--sampling-with-tools", "status": "success", "path": "mcp/seps/1577--sampling-with-tools.md", - "sha256": "e85c9bd68abba867d7490eb13f80ee5bcb85cf0c7565a9abae310098f4870a64", - "size": 19396 + "sha256": "55b04c667eec37d9e9fdaefff09171a5e69dd351a8f6ee91332ef380c383099e", + "size": 19236 }, { "url": "https://modelcontextprotocol.io/seps/1613-establish-json-schema-2020-12-as-default-dialect-f", "status": "success", "path": "mcp/seps/1613-establish-json-schema-2020-12-as-default-dialect-f.md", - "sha256": "d1bc3333be921eb0abd7729614a500c8f5bf65c097e871c00abecd75ad7ae179", - "size": 7770 + "sha256": "ff0f76d79ce47047220edb6bcf3fb1c1faf0be4bfe88577f98bb9f14158f5df1", + "size": 7610 }, { "url": "https://modelcontextprotocol.io/seps/1686-tasks", "status": "success", "path": "mcp/seps/1686-tasks.md", - "sha256": "af2fd55fcc5be97ec74fcd7922fb200085d928dba45d1e1e7ece2f5a7dc72927", - "size": 65036 + "sha256": "f314836ad2f51ff20bf6bd80854526d83f7d3cbc4c31acff2b9510c3ad4a086f", + "size": 64876 }, { "url": "https://modelcontextprotocol.io/seps/1699-support-sse-polling-via-server-side-disconnect", "status": "success", "path": "mcp/seps/1699-support-sse-polling-via-server-side-disconnect.md", - "sha256": "0275967d6b56db67204789b7fb18a1cc6bb88d0c89b4d8844ce98771af01448b", - "size": 4307 + "sha256": "e3d1933568595089c0c1626e3f212563f7b74d9bb094812ed22c01c5580306a2", + "size": 4147 }, { "url": "https://modelcontextprotocol.io/seps/1730-sdks-tiering-system", "status": "success", "path": "mcp/seps/1730-sdks-tiering-system.md", - "sha256": "4a8e3759e81a3295352792fcdfb6ea097de3bfa3fd10006483d0b195b04d1a3b", - "size": 10388 + "sha256": "ddf2847b0c2234e6592b0776156eb702e35a4a7dd8758d41adf8327c675a14c3", + "size": 10228 }, { "url": "https://modelcontextprotocol.io/seps/1850-pr-based-sep-workflow", "status": "success", "path": "mcp/seps/1850-pr-based-sep-workflow.md", - "sha256": "0cac3b48af92b1be5f71bbb025511d5e870789222f5740082b66beeabef87823", - "size": 9152 + "sha256": "68c80b23ad72107e84543ffd1f1e3f2f538ffefc16120e363e7ee9b4e8519689", + "size": 8992 }, { "url": "https://modelcontextprotocol.io/seps/1865-mcp-apps-interactive-user-interfaces-for-mcp", "status": "success", "path": "mcp/seps/1865-mcp-apps-interactive-user-interfaces-for-mcp.md", - "sha256": "2b2995bde0b4f3e50f130686b3d58a8555df0653a5f9a94d161d5ba6f5ad581a", - "size": 8476 + "sha256": "e92f8a6256df10dd4a925161635e74cba2714f345dc7c55d2ac522c7e72c8aa6", + "size": 8316 }, { "url": "https://modelcontextprotocol.io/seps/2085-governance-succession-and-amendment", "status": "success", "path": "mcp/seps/2085-governance-succession-and-amendment.md", - "sha256": "6edfbfd1fd421eb02701c050a754af96c885f403ee382916152b93d10aed8b06", - "size": 6801 + "sha256": "fefdc4a06390c4608848a9d77d93269a038c80f009d773595c6a13ed2ff7d3de", + "size": 6641 }, { "url": "https://modelcontextprotocol.io/seps/2106-json-schema-2020-12", "status": "success", "path": "mcp/seps/2106-json-schema-2020-12.md", - "sha256": "85ceea2893adff2bea4166f9432a8d4951c751dd69033262d1530ca3d0522aaf", - "size": 19172 + "sha256": "61ec536ab0e935c61c54d09c493d82537d3cc277126cbb0bf873466171c05b65", + "size": 19012 }, { "url": "https://modelcontextprotocol.io/seps/2127-mcp-server-cards", "status": "success", "path": "mcp/seps/2127-mcp-server-cards.md", - "sha256": "ce942520f4bf5f91b6539e0fc9e048fd03db48cbe07aff1a5583fc8c75cf154e", - "size": 17820 + "sha256": "34e8254284d67964cd85a66d2b0d9c32be1ba1e2bd9e2ecdcea8803f834a7e23", + "size": 17660 }, { "url": "https://modelcontextprotocol.io/seps/2133-extensions", "status": "success", "path": "mcp/seps/2133-extensions.md", - "sha256": "e9fda6688e5a36ae95cb59e052788c54d9ba4daa9b1e991af1037d9de7694c35", - "size": 19796 + "sha256": "10ef6e66f20aec17b09928c5247824c011a98f95a3cd16f7516d7248bb98529e", + "size": 19636 }, { "url": "https://modelcontextprotocol.io/seps/2148-contributor-ladder", "status": "success", "path": "mcp/seps/2148-contributor-ladder.md", - "sha256": "8f7ade8d01091ef1869f906d15c659d0aab40ef1bb943bba69d34ee257830aef", - "size": 25159 + "sha256": "190bc8a62fc33ad0bbcc700c99a28b427fce2887c9baea3b25d929e916b50194", + "size": 24999 }, { "url": "https://modelcontextprotocol.io/seps/2149-working-group-charter-template", "status": "success", "path": "mcp/seps/2149-working-group-charter-template.md", - "sha256": "280c9602190e6f9d3f982f560fa4f9272338c6894e2338e42d112861a9ac2bd0", - "size": 23139 + "sha256": "fb61371243a9b3bb476b16c1d213aa072d638644cb03cee997d571dc078b0ff8", + "size": 22979 }, { "url": "https://modelcontextprotocol.io/seps/2164-resource-not-found-error", "status": "success", "path": "mcp/seps/2164-resource-not-found-error.md", - "sha256": "7ff3f773b92a675ff17603f8bcc877adcf9961357bca24e7da734388063cdb55", - "size": 6339 + "sha256": "c19b7a6020371da9cd64497ad135648de316199dfe3e094f7f16e0c9d525479b", + "size": 6179 }, { "url": "https://modelcontextprotocol.io/seps/2207-oidc-refresh-token-guidance", "status": "success", "path": "mcp/seps/2207-oidc-refresh-token-guidance.md", - "sha256": "d0b5d624a881eb06d8684fc7c9a064eedfb7614ff6d86975b16f81eedcf73fe2", - "size": 9545 + "sha256": "237fca75b20b9a64728a367d7aeca83180d9ab872ea7f3b2c0c9e4aa9c4e2868", + "size": 9385 }, { "url": "https://modelcontextprotocol.io/seps/2243-http-standardization", "status": "success", "path": "mcp/seps/2243-http-standardization.md", - "sha256": "fd3478eb9bbe9789d99a75e99483419b82ea451872c14eedd2547a5b4ac60abe", - "size": 40422 + "sha256": "8138dc4857a8ea41a4fbc7a794908cd3504d896605b69adc7fffd96099ac1498", + "size": 40262 }, { "url": "https://modelcontextprotocol.io/seps/2260-Require-Server-requests-to-be-associated-with-Client-requests", "status": "success", "path": "mcp/seps/2260-Require-Server-requests-to-be-associated-with-Client-requests.md", - "sha256": "eb9b1d4c30b847cbd3d0958c7090d0f1963e91dbddadc0322fa86ff7d9d276da", - "size": 13389 + "sha256": "9ef512d95eb80333dae166880c78951691a5dd5d0b46a1cf543c88b81763ba98", + "size": 13229 }, { "url": "https://modelcontextprotocol.io/seps/2322-MRTR", "status": "success", "path": "mcp/seps/2322-MRTR.md", - "sha256": "ad44aac3c2a66a57d484fc048070e11503285a6ab44153801dff13a05e873518", - "size": 53333 + "sha256": "a7e256b961220b962f92240a05abf17e22f2b8c43f812bcb0ce08bcc4a7908b8", + "size": 53128 }, { "url": "https://modelcontextprotocol.io/seps/2468-recommend-issuer-claim-for-auth", "status": "success", "path": "mcp/seps/2468-recommend-issuer-claim-for-auth.md", - "sha256": "cfc348bc4c2b5a0adfb544da24293eb6397902be4001a506c7647f675ed82eab", - "size": 7899 + "sha256": "ea7527ef2bf7c4578ad6f8d8b6c1f4c5af418902bcae13b8a97ae1ca3ece88ec", + "size": 7739 }, { "url": "https://modelcontextprotocol.io/seps/2484-conformance-tests-required-for-final-seps", "status": "success", "path": "mcp/seps/2484-conformance-tests-required-for-final-seps.md", - "sha256": "f80456f2b16a6620bbafeb147e4e33ee11c0ed2f05ec3471ef2b34dc8bf098a3", - "size": 15299 + "sha256": "c339e56f4e0cb20b4806ab20572314ca20ad6d309ebe18d978efabefab5d02cc", + "size": 15139 }, { "url": "https://modelcontextprotocol.io/seps/2549-TTL-for-list-results", "status": "success", "path": "mcp/seps/2549-TTL-for-list-results.md", - "sha256": "ba7d270a9121a35b8bc7cc1c1c6c831819daaac2a3cbf120f786107e278b309e", - "size": 14099 + "sha256": "fb4726746f02ced29ab10d0c820601494826dcc6702124166bd735fbd7a55ded", + "size": 13939 }, { "url": "https://modelcontextprotocol.io/seps/2567-sessionless-mcp", "status": "success", "path": "mcp/seps/2567-sessionless-mcp.md", - "sha256": "d11d4e725af6a593929895466fdc6418266363561f53e5eeeec3b18362d3acc0", - "size": 35265 + "sha256": "8743a16b8541b38ed28956307cd231fb73215e5a74b887b39e249dca81f3b76b", + "size": 35105 }, { "url": "https://modelcontextprotocol.io/seps/2575-stateless-mcp", "status": "success", "path": "mcp/seps/2575-stateless-mcp.md", - "sha256": "25f7bc653b9aa8e5df33e40a20268366f673956e7dae2dafbb78d6e7c88fdc6e", - "size": 36498 + "sha256": "8d564b150ed19b2921c35316f8dd56079f056c80c6b96b1bbccddbe59fa7b521", + "size": 36338 }, { "url": "https://modelcontextprotocol.io/seps/2577-deprecate-roots-sampling-and-logging", "status": "success", "path": "mcp/seps/2577-deprecate-roots-sampling-and-logging.md", - "sha256": "703d3b770604f05f916cf95430e618bacda0f34a656686db13bab9b590b69d97", - "size": 13494 + "sha256": "ce8ec0ce4963d201273cf160ebcc7b875902023776ba930335e8aae12ce0e85c", + "size": 13334 }, { "url": "https://modelcontextprotocol.io/seps/2596-spec-feature-lifecycle-and-deprecation", "status": "success", "path": "mcp/seps/2596-spec-feature-lifecycle-and-deprecation.md", - "sha256": "606581325637dae2b17f12add433059757142baca2f3d18093ce365f8364311b", - "size": 25926 + "sha256": "2e17b618cf38c12d0f2aa3345815688f3a54295b1cf07eef2df640ecf9ebc885", + "size": 25766 }, { "url": "https://modelcontextprotocol.io/seps/2640-skills-extension", "status": "success", "path": "mcp/seps/2640-skills-extension.md", - "sha256": "5c319731264d31bb1ef6916bc20bb8e8f08db8ecb879fe74e550d040c4d4cbd4", - "size": 65776 + "sha256": "4790679a1b3d66e598d8117874aa833c597b3c3e111471c3f7d98d33b5ec70ca", + "size": 65616 }, { "url": "https://modelcontextprotocol.io/seps/2663-tasks-extension", "status": "success", "path": "mcp/seps/2663-tasks-extension.md", - "sha256": "3f531f9910f66f738bf81d3eaa814b1a86cbff03c6b4f72d29c7af0b3731aecc", - "size": 51158 + "sha256": "1c0a71cd7b3595ea9f569064ec62ecd8556adad20e764816fb58e61722fdc178", + "size": 50998 }, { "url": "https://modelcontextprotocol.io/seps/414-request-meta", "status": "success", "path": "mcp/seps/414-request-meta.md", - "sha256": "d0e9e63344f2f4677eb77f6dd2a225bfc07041c321cf6e4cbc2a2596bccfb83a", - "size": 5333 + "sha256": "8fdf482985c13fbbd52b3506bafc1f1e8631f3cee2ae045172ed592db7e8fbbc", + "size": 5173 }, { "url": "https://modelcontextprotocol.io/seps/932-model-context-protocol-governance", "status": "success", "path": "mcp/seps/932-model-context-protocol-governance.md", - "sha256": "e9c731303e39de864cf46182911b5e5d4f12150d63fb0345d1f3e755cc8da81b", - "size": 4419 + "sha256": "dacdcb94d9ddc987eec8a5fb16d3a142246504e51c0177cfb4ceb879a0fb23dd", + "size": 4259 }, { "url": "https://modelcontextprotocol.io/seps/973-expose-additional-metadata-for-implementations-res", "status": "success", "path": "mcp/seps/973-expose-additional-metadata-for-implementations-res.md", - "sha256": "4a46e013b162b536346e64986ca1a6f8c05fb4990d82f07d6064429a7e1da847", - "size": 6765 + "sha256": "9cf2e984ab51655ff5dc0a2300e056ddf8909e066157b31ed147a7d7254a1c15", + "size": 6522 }, { "url": "https://modelcontextprotocol.io/seps/985-align-oauth-20-protected-resource-metadata-with-rf", "status": "success", "path": "mcp/seps/985-align-oauth-20-protected-resource-metadata-with-rf.md", - "sha256": "b67e181cd6379765352fb7e62939d5e317fac1a1bb5b331566965f5fb11d4b6e", - "size": 5989 + "sha256": "2e0d897e249c9105b2fa97cda7d115b8c20b10aa4e785b28ef4c9ba0bd7084d0", + "size": 5829 }, { "url": "https://modelcontextprotocol.io/seps/986-specify-format-for-tool-names", "status": "success", "path": "mcp/seps/986-specify-format-for-tool-names.md", - "sha256": "b70a5ef80ecb1ba7d2afeffa65dee2efaa16671ee0bb6f56a9e49bfb9d7286e0", - "size": 4296 + "sha256": "8c375167b786983558d1eabdc7d87aaa08137a63ffee3182c9941730c5984f0b", + "size": 4136 }, { "url": "https://modelcontextprotocol.io/seps/990-enable-enterprise-idp-policy-controls-during-mcp-o", "status": "success", "path": "mcp/seps/990-enable-enterprise-idp-policy-controls-during-mcp-o.md", - "sha256": "00243bc07792ff780c4726f2a09128e35d9bf7401bd0b633822587d9d09edcef", - "size": 3320 + "sha256": "ebdead1846411f7d157ebd62c1c6c7c963526b4fe6ad15dc27c03f849b4b7dda", + "size": 3161 }, { "url": "https://modelcontextprotocol.io/seps/991-enable-url-based-client-registration-using-oauth-c", "status": "success", "path": "mcp/seps/991-enable-url-based-client-registration-using-oauth-c.md", - "sha256": "9e9b5e08225879f498c936cef2906fa84734ecd665bc9976cbf32cf642c0e6ff", - "size": 17051 + "sha256": "628b5a9082eb8dfbfb7b941b48df34ff3ac0b7306c942a6ea6e09362b3bb2ff2", + "size": 16891 }, { "url": "https://modelcontextprotocol.io/seps/994-shared-communication-practicesguidelines", "status": "success", "path": "mcp/seps/994-shared-communication-practicesguidelines.md", - "sha256": "98089bf8a0d67da3b59457c42ac288e9256641a234cd640512596cb5a6b1a2ca", - "size": 4403 + "sha256": "8d9094b390fb4c4231ea287ddeb64fc6dd3af6b5643cedae9515a5208b92d129", + "size": 4243 }, { "url": "https://modelcontextprotocol.io/seps", "status": "success", "path": "mcp/seps.md", - "sha256": "5d1d0895015889d4bca065dab598dd265dde247f85a5f522ae293465ed072b6a", - "size": 9751 + "sha256": "b498f065058578a1809fc7ae20e5422c7d6cc477374d3adafe53444bd8359fb5", + "size": 7576 }, { "url": "https://modelcontextprotocol.io/specification/2024-11-05/architecture", @@ -8605,8 +8619,8 @@ "url": "https://modelcontextprotocol.io/specification/2024-11-05/basic", "status": "success", "path": "mcp/specification/2024-11-05/basic.md", - "sha256": "3e16ba3645c9bf3f1aeb87f1b4f3b3f18a73d8c741a1d6ebd084f5da56551a2b", - "size": 3336 + "sha256": "8c405111f1b32b16c05a2ee83f2773aae478c239f20a04369968e50302e6f0df", + "size": 3098 }, { "url": "https://modelcontextprotocol.io/specification/2024-11-05/basic/lifecycle", @@ -8661,43 +8675,43 @@ "url": "https://modelcontextprotocol.io/specification/2024-11-05/client/sampling", "status": "success", "path": "mcp/specification/2024-11-05/client/sampling.md", - "sha256": "4f9c3ae3b8fa0253b3882b5f2820315b87836c4751f0354a95a9278f82b1f3a0", - "size": 6033 + "sha256": "5d8defb5c62f5de573f46dcc14b203b6d3af84cb1aa6bb571f96c7a061a3b7b0", + "size": 6029 }, { "url": "https://modelcontextprotocol.io/specification/2024-11-05", "status": "success", "path": "mcp/specification/2024-11-05.md", - "sha256": "588feb4a1c35a6ac51ab7aa39624e02ebd310cfb85f4e46d20ae85b49ee65456", - "size": 5182 + "sha256": "590f346086d9d5f7ea7df7c06c0e7778d18364238a383459bd585c6453571308", + "size": 4996 }, { "url": "https://modelcontextprotocol.io/specification/2024-11-05/server", "status": "success", "path": "mcp/specification/2024-11-05/server.md", - "sha256": "ed087cfe20e6c97b3f6dc3ea5cbbdc15e72e98ab5de23805fe934e36f780687e", - "size": 1501 + "sha256": "6a77837e6018833193f652fd70ae53d2aa3ef3074c6c476844eebecc2cad257c", + "size": 1369 }, { "url": "https://modelcontextprotocol.io/specification/2024-11-05/server/prompts", "status": "success", "path": "mcp/specification/2024-11-05/server/prompts.md", - "sha256": "5fa889a4a3e6b261fcbebd914a78d55b0a03a848eabb44c8d63a2675340bfc9f", - "size": 6397 + "sha256": "1113b541f56b308e265aa926c4f43c892d40df47aa1b447e9245daf2104a343f", + "size": 6298 }, { "url": "https://modelcontextprotocol.io/specification/2024-11-05/server/resources", "status": "success", "path": "mcp/specification/2024-11-05/server/resources.md", - "sha256": "bee6f791116bb53e4e2c9190322eb572342dff02c8c7e1c4af23f23b3d6ea5fb", - "size": 8362 + "sha256": "bb8fcfc5437d89a762597fb054e934608b4e4120ad8bcb53590c653a4a6ebe11", + "size": 8261 }, { "url": "https://modelcontextprotocol.io/specification/2024-11-05/server/tools", "status": "success", "path": "mcp/specification/2024-11-05/server/tools.md", - "sha256": "9c39136d3114c0f142c74ab5da9be26783e5892704064519fac11a1a175c7453", - "size": 6106 + "sha256": "4be32c889fd036b07852278c8127ea5ea12b5d5bd0ddb230e56546701b96e492", + "size": 6102 }, { "url": "https://modelcontextprotocol.io/specification/2024-11-05/server/utilities/completion", @@ -8752,8 +8766,8 @@ "url": "https://modelcontextprotocol.io/specification/2025-03-26/basic/transports", "status": "success", "path": "mcp/specification/2025-03-26/basic/transports.md", - "sha256": "39154677ecfafd49c3b4d8f4dea9e6383b7810e59ed9636535fe8bb37ba736ca", - "size": 13975 + "sha256": "e603f843368d4a8ba713144b460cf18638d43a19a2e5af807de5edcc568c422c", + "size": 13972 }, { "url": "https://modelcontextprotocol.io/specification/2025-03-26/basic/utilities/cancellation", @@ -8794,43 +8808,43 @@ "url": "https://modelcontextprotocol.io/specification/2025-03-26/client/sampling", "status": "success", "path": "mcp/specification/2025-03-26/client/sampling.md", - "sha256": "df6edf59be481d6926efae8c3ced436ea70b1df49a9d7300abc3eb22174eff7a", - "size": 6175 + "sha256": "a56f114230ed3017030309ab207bbf7f6018e5577193b297934a5f577f3191e3", + "size": 6171 }, { "url": "https://modelcontextprotocol.io/specification/2025-03-26", "status": "success", "path": "mcp/specification/2025-03-26.md", - "sha256": "8d1c04935e57c658d020c6f56a6947b194508593f664e8385a2bfe795b3e281f", - "size": 5333 + "sha256": "063ff3e9f931e3e92658e8828413dee67092dc5d4c6912224092a7552f22c725", + "size": 5147 }, { "url": "https://modelcontextprotocol.io/specification/2025-03-26/server", "status": "success", "path": "mcp/specification/2025-03-26/server.md", - "sha256": "f49957099d59fd9f1445e493693590ff1449f53f9ea438dd5d4797d83778b877", - "size": 1501 + "sha256": "f980389c149f699bc94b1b3cf38fea7d80f005202f132e8f0de62a5df25cddf9", + "size": 1369 }, { "url": "https://modelcontextprotocol.io/specification/2025-03-26/server/prompts", "status": "success", "path": "mcp/specification/2025-03-26/server/prompts.md", - "sha256": "bb2646739440b3feabfa8e5e715297c5f14a522c9b74efe696aad0cb07a9796b", - "size": 6736 + "sha256": "43d1b43d802980084d38af21adcf5c9e00ddfc439024e3a765f8050db7d6752f", + "size": 6637 }, { "url": "https://modelcontextprotocol.io/specification/2025-03-26/server/resources", "status": "success", "path": "mcp/specification/2025-03-26/server/resources.md", - "sha256": "0cabce11fe4e44b2daf29afcbcd1f3401aacbe0bf573bc3527b2a09a161db359", - "size": 8548 + "sha256": "3dcaf9cd709d67db615ca37c7e77c2325778d254b183091ffc92d20f9c30c6ed", + "size": 8447 }, { "url": "https://modelcontextprotocol.io/specification/2025-03-26/server/tools", "status": "success", "path": "mcp/specification/2025-03-26/server/tools.md", - "sha256": "6be6fb433551c6891d9834fcdb2b661b718cc428a1d469ea68a1ce15b11c2fb9", - "size": 6459 + "sha256": "f377a37ada067481e93e28d7e051ded568415498f6e0686e8bd8ccd383d78850", + "size": 6449 }, { "url": "https://modelcontextprotocol.io/specification/2025-03-26/server/utilities/completion", @@ -8857,624 +8871,624 @@ "url": "https://modelcontextprotocol.io/specification/2025-06-18/architecture", "status": "success", "path": "mcp/specification/2025-06-18/architecture.md", - "sha256": "0b883ba161a0c8084ac346cf5a18ecdf165f9b62259da7c122f7e251e67021f8", - "size": 5946 + "sha256": "a6ff10e3587f47c319de4a9dfe2b75d38a6053eec31e8ee2568d6e4c167a809f", + "size": 5909 }, { "url": "https://modelcontextprotocol.io/specification/2025-06-18/basic/authorization", "status": "success", "path": "mcp/specification/2025-06-18/basic/authorization.md", - "sha256": "dbd08ff81e3212c8be1ac3c56e5466c0fc1d6aa6c3e41c79e79e6325c1973aa6", - "size": 20719 + "sha256": "956fcc61fa69e9a5ebea8b2be7235b3f7b3d250eeb39ed111e98312d7f9b81b2", + "size": 20682 }, { "url": "https://modelcontextprotocol.io/specification/2025-06-18/basic", "status": "success", "path": "mcp/specification/2025-06-18/basic.md", - "sha256": "a2e5c407e4a7aad47e1be75450dffc4a7f29e4e338c137c270fa042bb3bcfe22", - "size": 5408 + "sha256": "36b0622b3f11655326ea83cf6132b6e619e3bfabff05c3803011c1e0ac276c44", + "size": 5371 }, { "url": "https://modelcontextprotocol.io/specification/2025-06-18/basic/lifecycle", "status": "success", "path": "mcp/specification/2025-06-18/basic/lifecycle.md", - "sha256": "36207db82201e7aa7cbbed66b0fa02787d6459bfd8e55695673c6db49f264a29", - "size": 8037 + "sha256": "fa329862402507a3d4ee21f7b18c1590172014ea6086d7e12e13c865676edfd8", + "size": 7997 }, { "url": "https://modelcontextprotocol.io/specification/2025-06-18/basic/transports", "status": "success", "path": "mcp/specification/2025-06-18/basic/transports.md", - "sha256": "e4df3c146b524d58f282d3c56e19b2f2df365fbf160c89cdabaed9a182811675", - "size": 14161 + "sha256": "c884a417688076cc3d719ea89945b0047bd005fd451ccbbc1a1991bd3782a3bc", + "size": 14121 }, { "url": "https://modelcontextprotocol.io/specification/2025-06-18/basic/utilities/cancellation", "status": "success", "path": "mcp/specification/2025-06-18/basic/utilities/cancellation.md", - "sha256": "60ea9ca7e1a75dd7b2ea8a960023487fc4edc3173de97ba065d9ba9171d451f3", - "size": 2690 + "sha256": "d2f3b785062228681eada359a8810cbff5173d5c7cad07a73ec775cb415e8454", + "size": 2653 }, { "url": "https://modelcontextprotocol.io/specification/2025-06-18/basic/utilities/ping", "status": "success", "path": "mcp/specification/2025-06-18/basic/utilities/ping.md", - "sha256": "2702be9d7f427a1fcfd120ee8c1f7e26554b690a5d29492a9e259afade53ba15", - "size": 1791 + "sha256": "b595e5b0f38e869a134781ef49ca4c832e4ddb9d982d0916e40891a51d55c072", + "size": 1754 }, { "url": "https://modelcontextprotocol.io/specification/2025-06-18/basic/utilities/progress", "status": "success", "path": "mcp/specification/2025-06-18/basic/utilities/progress.md", - "sha256": "dd91ed70692032d61bf6cf0092b3f62f6ed10495929cba7bc3aeebd5e42e962c", - "size": 2693 + "sha256": "075181028bab9a7d5499c6d45b72dbd72bb55bf081a7598d0cfb4ac6353f137b", + "size": 2656 }, { "url": "https://modelcontextprotocol.io/specification/2025-06-18/changelog", "status": "success", "path": "mcp/specification/2025-06-18/changelog.md", - "sha256": "32a61078c8680e51e82ac43f67bdf1a237e01edd18d43e4eb5ae9b54886a1d2d", - "size": 3311 + "sha256": "a19e2309fda0f15fb24e9cff0cd21d8f522cef9792ddf0f13ea5c9294695a045", + "size": 3274 }, { "url": "https://modelcontextprotocol.io/specification/2025-06-18/client/elicitation", "status": "success", "path": "mcp/specification/2025-06-18/client/elicitation.md", - "sha256": "6ed618ab747edebb8d0401d2823039578e984f81e8e2ca56a38dea234037e716", - "size": 7924 + "sha256": "b1547a8fbbbf5ec045130579b528eb218088ece8f6eddf63ddf028675908a251", + "size": 7881 }, { "url": "https://modelcontextprotocol.io/specification/2025-06-18/client/roots", "status": "success", "path": "mcp/specification/2025-06-18/client/roots.md", - "sha256": "ae50e2ed7a56052547512fff5a814c9ce598bfc9069ff801d2ff20c9f5f6667a", - "size": 4411 + "sha256": "ce257f0e6aad1cff9268fd4b49a9672cf9ea13a75bf394374ab5b67d0568d9da", + "size": 4374 }, { "url": "https://modelcontextprotocol.io/specification/2025-06-18/client/sampling", "status": "success", "path": "mcp/specification/2025-06-18/client/sampling.md", - "sha256": "4c7cf39afef6521f742e2f3d3eb2969c71ba723137117e6a65f32974a03135a3", - "size": 6212 + "sha256": "7238c955eeb8e10a1f2bad0f9497a5dc5327c36ff7d63e944dbd4caa73fb3c5c", + "size": 6171 }, { "url": "https://modelcontextprotocol.io/specification/2025-06-18", "status": "success", "path": "mcp/specification/2025-06-18.md", - "sha256": "30820c0010820ab0059435655263afb6799de706f6bbac749c5979a400674599", - "size": 5542 + "sha256": "357b0fabbbd6b377061c3e3925e65f53f70fd0c57c27870a3f8959aa97e4ce3d", + "size": 5319 }, { "url": "https://modelcontextprotocol.io/specification/2025-06-18/schema", "status": "success", "path": "mcp/specification/2025-06-18/schema.md", - "sha256": "b885de6ae71a314c995a6fbecff73fd37c399ffdf57e3b175478b5073a3454ce", - "size": 277643 + "sha256": "a3df25b955db1c43a2222731fd69d10b20220933f41fc8f75a97972654ae0091", + "size": 76120 }, { "url": "https://modelcontextprotocol.io/specification/2025-06-18/server", "status": "success", "path": "mcp/specification/2025-06-18/server.md", - "sha256": "10d73760283991243e9b07d7d2f33df79a58ddd15a64041b9cda04b3fa8527ed", - "size": 1501 + "sha256": "a4d0e52f65bc1c7e3c245983fc9de7bc1100be18447701cd4feb79809c5b5d04", + "size": 1369 }, { "url": "https://modelcontextprotocol.io/specification/2025-06-18/server/prompts", "status": "success", "path": "mcp/specification/2025-06-18/server/prompts.md", - "sha256": "9fca3cd392e549a88f7ac83c17822ca0b30efaa6d7c9ad67312d04a9fcd49619", - "size": 7098 + "sha256": "baa682106c78e7563bba21b9122a8124b7f2d6d5e4b2d76dccd069aeef24fc56", + "size": 6959 }, { "url": "https://modelcontextprotocol.io/specification/2025-06-18/server/resources", "status": "success", "path": "mcp/specification/2025-06-18/server/resources.md", - "sha256": "a1433b43a7e57a0f4e64e0bc3b05cf6b81d73c44972df0435f0dde6ef96f2e5c", - "size": 10139 + "sha256": "40575c0f219f4a6aee7802af4cd43e1a6314bda71d45bffe0f0f3623d2ddb3fa", + "size": 10001 }, { "url": "https://modelcontextprotocol.io/specification/2025-06-18/server/tools", "status": "success", "path": "mcp/specification/2025-06-18/server/tools.md", - "sha256": "79f709981fe0d60c35b79187e8e29a1e199f8dde7e2047bcb0c8ae8d98c7fe80", - "size": 10860 + "sha256": "c8241c000cfe5d5f14c125e1a915e1a521f25530ea1b52de0d79e478079f35c1", + "size": 10804 }, { "url": "https://modelcontextprotocol.io/specification/2025-06-18/server/utilities/completion", "status": "success", "path": "mcp/specification/2025-06-18/server/utilities/completion.md", - "sha256": "8f6200f7ec5125c1b35df39c4311344283660fd94b183df7bca6ec04c438dafa", - "size": 4808 + "sha256": "5da924ea50ee657e837af0f1daa54d25a832bba9cc9a88739c5efde243057e6f", + "size": 4771 }, { "url": "https://modelcontextprotocol.io/specification/2025-06-18/server/utilities/logging", "status": "success", "path": "mcp/specification/2025-06-18/server/utilities/logging.md", - "sha256": "4fbe2faed37ffdd6793e5c6ae2cdb839a67864ce90a14d7359ee8bea8f1113e0", - "size": 3799 + "sha256": "933b8d0a0cf2f734b2504b0a2483e91f3e04413698d1663c4476f6b58c5ef316", + "size": 3762 }, { "url": "https://modelcontextprotocol.io/specification/2025-06-18/server/utilities/pagination", "status": "success", "path": "mcp/specification/2025-06-18/server/utilities/pagination.md", - "sha256": "e59fbe4c002a467a3fad723d73d74275d2cfa6a068b0fa060be83c6a2d064954", - "size": 2598 + "sha256": "d67e841c63eaef7f59f099a63fc426f567fcc1efd174549c4a5bee2cdf481a88", + "size": 2561 }, { "url": "https://modelcontextprotocol.io/specification/2025-11-25/architecture", "status": "success", "path": "mcp/specification/2025-11-25/architecture.md", - "sha256": "0b6ac42ddf2e9ed2099f142689ac4e8c28915dc5b5f86e8678abeb22ece111fb", - "size": 5946 + "sha256": "f5f34816f14ca85950255cda8f9d220831d72ad0d9bcb207e2da4473f1f99936", + "size": 5909 }, { "url": "https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization", "status": "success", "path": "mcp/specification/2025-11-25/basic/authorization.md", - "sha256": "6a8d5eb77c59812c35f12bbcd4dfd1ed0c466bcad0ff25742aa025d821c3d111", - "size": 41501 + "sha256": "74f29c2296be3b970a46a8970083b9637e9981f0ab0d77bd24ba046c1d46f8d0", + "size": 41464 }, { "url": "https://modelcontextprotocol.io/specification/2025-11-25/basic", "status": "success", "path": "mcp/specification/2025-11-25/basic.md", - "sha256": "a504a34039368f1cb715096d664f234ce7e1af4511e6ad3fd41e901d8040b97e", - "size": 11194 + "sha256": "04b3c620d15e436a8aa59517aaae935021323cf133324a3b6ac4a6eb4f822261", + "size": 11157 }, { "url": "https://modelcontextprotocol.io/specification/2025-11-25/basic/lifecycle", "status": "success", "path": "mcp/specification/2025-11-25/basic/lifecycle.md", - "sha256": "8c030bf50b74e562d244916b16baab1bfcd86ae03736d4e5b6e24ed58a913af9", - "size": 9217 + "sha256": "f1e1c10b6a89b42c92b22262e588d61476d03d65e123399220f513d6018f8987", + "size": 9177 }, { "url": "https://modelcontextprotocol.io/specification/2025-11-25/basic/transports", "status": "success", "path": "mcp/specification/2025-11-25/basic/transports.md", - "sha256": "5a86d66ae0ab08f29460229f3b7f56d504388d1f106e21097575621717fc0e7a", - "size": 16191 + "sha256": "3bf3dd0b84be6f9134725e9366dd7dd4a56afc512f52e4a9b81db31c2284cb3a", + "size": 16151 }, { "url": "https://modelcontextprotocol.io/specification/2025-11-25/basic/utilities/cancellation", "status": "success", "path": "mcp/specification/2025-11-25/basic/utilities/cancellation.md", - "sha256": "a52208278358eebe5d91061d78122247c8e0b348701547386393aa7fbbabdf2e", - "size": 2921 + "sha256": "f74d8eec0b2861ac498ae3f9de70e4e07d4accb5a389492a7d933b3cdf6c59c6", + "size": 2884 }, { "url": "https://modelcontextprotocol.io/specification/2025-11-25/basic/utilities/ping", "status": "success", "path": "mcp/specification/2025-11-25/basic/utilities/ping.md", - "sha256": "2702be9d7f427a1fcfd120ee8c1f7e26554b690a5d29492a9e259afade53ba15", - "size": 1791 + "sha256": "b595e5b0f38e869a134781ef49ca4c832e4ddb9d982d0916e40891a51d55c072", + "size": 1754 }, { "url": "https://modelcontextprotocol.io/specification/2025-11-25/basic/utilities/progress", "status": "success", "path": "mcp/specification/2025-11-25/basic/utilities/progress.md", - "sha256": "8f5b562e852e9af90255d9959b485f8fd7a39318ca7fbf8833f3d996dc688efb", - "size": 3300 + "sha256": "93527d982d146501f1524173745dc3b9bd42fda8621e029fc427bdc9e7a91270", + "size": 3263 }, { "url": "https://modelcontextprotocol.io/specification/2025-11-25/basic/utilities/tasks", "status": "success", "path": "mcp/specification/2025-11-25/basic/utilities/tasks.md", - "sha256": "c33da0b5b3912a4826d6e1d8a6a6fdcb3700d9af9f3e66dd4ee14d7440497fb6", - "size": 35997 + "sha256": "ebe89bd0d1d00316261a2198b2c389af1f152558717eb0021ebc78cb25e022b3", + "size": 35949 }, { "url": "https://modelcontextprotocol.io/specification/2025-11-25/changelog", "status": "success", "path": "mcp/specification/2025-11-25/changelog.md", - "sha256": "0c6f3a313c714462168ef29d3ba07b45e185405ef1fd06d324c7c6eea51250a1", - "size": 5435 + "sha256": "d5500aa4b7bfc7d8758457544cd2fe5a05418d229d6c03c20b132e981788bc89", + "size": 5398 }, { "url": "https://modelcontextprotocol.io/specification/2025-11-25/client/elicitation", "status": "success", "path": "mcp/specification/2025-11-25/client/elicitation.md", - "sha256": "83c5f77e3f8cbb855cc2bd6800de0a5e68ea4ef50673decadcd281f03dd8f3e6", - "size": 30514 + "sha256": "efad60e9d0d99348285c5037a23865dd819927c490194ff08311555d246cef46", + "size": 30463 }, { "url": "https://modelcontextprotocol.io/specification/2025-11-25/client/roots", "status": "success", "path": "mcp/specification/2025-11-25/client/roots.md", - "sha256": "992d141a6f75e02c6305adfd6543541bc9a954a6848a7e177a1fe88bef0fe52f", - "size": 4411 + "sha256": "5b90ccdb46d0c89f42f83e05a124d49a1d2ff6aa1537a88000b5e1336ba8c0f6", + "size": 4374 }, { "url": "https://modelcontextprotocol.io/specification/2025-11-25/client/sampling", "status": "success", "path": "mcp/specification/2025-11-25/client/sampling.md", - "sha256": "3498fca5668fae8df57d2936845fb4f2bb14be3eb67ecb55634a26d7841b0bf2", - "size": 17958 + "sha256": "6069063ae0f7204c177b2e0b1b71863abd9c0ec1b0b6e8271f42f740534f63d9", + "size": 17914 }, { "url": "https://modelcontextprotocol.io/specification/2025-11-25", "status": "success", "path": "mcp/specification/2025-11-25.md", - "sha256": "37bf1590e3e51df1f06b64c8cc80683cec309305fca4fbe7a4a4146231c3eb8f", - "size": 5542 + "sha256": "a9bb733cf823d8dfd147d23a3947096a7b1be343cccc88a5dc39358622fa0fdf", + "size": 5319 }, { "url": "https://modelcontextprotocol.io/specification/2025-11-25/schema", "status": "success", "path": "mcp/specification/2025-11-25/schema.md", - "sha256": "8207583726e71b78ae17ea8c34a7363519df310ab1229ddce63aebfa0f20300f", - "size": 447644 + "sha256": "5ab7cfcd5ea05c7491637e76122362cc4416201ea0c81482f6747f59343f1691", + "size": 130800 }, { "url": "https://modelcontextprotocol.io/specification/2025-11-25/server", "status": "success", "path": "mcp/specification/2025-11-25/server.md", - "sha256": "da797e462becf5973dea96a21a9fe62efb9d270f3dce95ac5a1fe29034601bf7", - "size": 1501 + "sha256": "5e0efbd84389e6dc8b0748edb553da7dbc22bb2aca6c2fcbe58474be488c118b", + "size": 1369 }, { "url": "https://modelcontextprotocol.io/specification/2025-11-25/server/prompts", "status": "success", "path": "mcp/specification/2025-11-25/server/prompts.md", - "sha256": "a17e89016c56051719df5a395a6b95f2308f1ea24b117ba74ad4e602799dfa42", - "size": 7315 + "sha256": "edc84d993e0dea60f7f1906da4021137b3dde7eb7fd22b9eef4a1157adfbd687", + "size": 7176 }, { "url": "https://modelcontextprotocol.io/specification/2025-11-25/server/resources", "status": "success", "path": "mcp/specification/2025-11-25/server/resources.md", - "sha256": "37de412ba819a7cc9816c2ac619c881620d5cb46ffbc805b41cf9f487b953dfc", - "size": 10380 + "sha256": "cfa1b7ab8e3fafd6a01dc365225aa0b9827443be2c5cebd6cc3d1dcc18f088b8", + "size": 10242 }, { "url": "https://modelcontextprotocol.io/specification/2025-11-25/server/tools", "status": "success", "path": "mcp/specification/2025-11-25/server/tools.md", - "sha256": "b372c48eea58744850f5684b796438f32643402533b24084d82b49b580721aff", - "size": 14061 + "sha256": "4d21a7f0af31ba3f2a0cf8bce02f1e668f4df70b30b880ae3579aee3a9e5672a", + "size": 14005 }, { "url": "https://modelcontextprotocol.io/specification/2025-11-25/server/utilities/completion", "status": "success", "path": "mcp/specification/2025-11-25/server/utilities/completion.md", - "sha256": "f8d5f2ed19867081ea1f12201a2319e57ad536b662adbca7866b4a949ef94619", - "size": 4877 + "sha256": "5f54a8aee2168aafb217e6190869d5c99a9cb9bc74a0faebea3e1a5c12ccdca5", + "size": 4840 }, { "url": "https://modelcontextprotocol.io/specification/2025-11-25/server/utilities/logging", "status": "success", "path": "mcp/specification/2025-11-25/server/utilities/logging.md", - "sha256": "4fbe2faed37ffdd6793e5c6ae2cdb839a67864ce90a14d7359ee8bea8f1113e0", - "size": 3799 + "sha256": "933b8d0a0cf2f734b2504b0a2483e91f3e04413698d1663c4476f6b58c5ef316", + "size": 3762 }, { "url": "https://modelcontextprotocol.io/specification/2025-11-25/server/utilities/pagination", "status": "success", "path": "mcp/specification/2025-11-25/server/utilities/pagination.md", - "sha256": "e59fbe4c002a467a3fad723d73d74275d2cfa6a068b0fa060be83c6a2d064954", - "size": 2598 + "sha256": "d67e841c63eaef7f59f099a63fc426f567fcc1efd174549c4a5bee2cdf481a88", + "size": 2561 }, { "url": "https://modelcontextprotocol.io/specification/2026-07-28/architecture", "status": "success", "path": "mcp/specification/2026-07-28/architecture.md", - "sha256": "a5b862e50f21355f9285c1ccb28c19baa8f7c02d2244bbe96bbb721b25ca768b", - "size": 6394 + "sha256": "9bb07f418c60b50d03de71d5731c4a3cdbe0f6e71b81b03e2fbee108f2901ef1", + "size": 6357 }, { "url": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization/authorization-server-discovery", "status": "success", "path": "mcp/specification/2026-07-28/basic/authorization/authorization-server-discovery.md", - "sha256": "10fbd1c72f65f316a04f39736c8e2d159d6a35a39c6584d1ca3b007a8a558775", - "size": 8155 + "sha256": "2402c80d84a1e7e5a7261443e849494aa96b3d5c01e9da99d54485451727740e", + "size": 8118 }, { "url": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization/client-registration", "status": "success", "path": "mcp/specification/2026-07-28/basic/authorization/client-registration.md", - "sha256": "5011e00834cb76c0e84b858762d39a5a5b481159d0a2cf63d7dc916889f27e3d", - "size": 10229 + "sha256": "000a0001f20928b9ee9c371c55d6c01555fcf3fb05acae22d1a46c248d3f15df", + "size": 10186 }, { "url": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization", "status": "success", "path": "mcp/specification/2026-07-28/basic/authorization.md", - "sha256": "93fd383906873fedb80119a636b342e25b166ed3f9bee4fa8ae1b3bcb4c2b8f7", - "size": 25173 + "sha256": "98a7d39856fd292c2db49e1337123e81d5234aa7c591b95f6f35c359e97a2dc3", + "size": 25136 }, { "url": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization/security-considerations", "status": "success", "path": "mcp/specification/2026-07-28/basic/authorization/security-considerations.md", - "sha256": "9d642d93bb5b0210dc6d1bcd9a70f2938f0607d2339009fe0f5caf67229c48f8", - "size": 10089 + "sha256": "4b745950fb14d23f826cd3cad5d5377c1c75616ed320fde89f6577babb75c1be", + "size": 10052 }, { "url": "https://modelcontextprotocol.io/specification/2026-07-28/basic", "status": "success", "path": "mcp/specification/2026-07-28/basic.md", - "sha256": "67a62de95bdc816ff96e8d5c69b0fc19237191f42805846e2ec8f8d7063e123e", - "size": 24001 + "sha256": "be56351e110fde0b1a7f086e11d512edacc82ea5b2bb65b30f6cff25b379a5da", + "size": 23955 }, { "url": "https://modelcontextprotocol.io/specification/2026-07-28/basic/patterns/cancellation", "status": "success", "path": "mcp/specification/2026-07-28/basic/patterns/cancellation.md", - "sha256": "5ad380cae6ee6f29f63210694de90400c2aa84efaddc1c8f3f286ea3a36664a3", - "size": 4627 + "sha256": "8a7393bdd4b67f3c0461c34def8246666cf3b8c48fab1da42ccb101590fcff08", + "size": 4590 }, { "url": "https://modelcontextprotocol.io/specification/2026-07-28/basic/patterns", "status": "success", "path": "mcp/specification/2026-07-28/basic/patterns.md", - "sha256": "a5ac156c3489fc8da38a28a8196d96260f8afb31e04667aa25db8ec0836268e5", - "size": 3169 + "sha256": "e41745bf977fc56b2c57f6684ab0c54c5bc3485d865d520aa50c63665734c3a0", + "size": 3132 }, { "url": "https://modelcontextprotocol.io/specification/2026-07-28/basic/patterns/mrtr", "status": "success", "path": "mcp/specification/2026-07-28/basic/patterns/mrtr.md", - "sha256": "cfbb4bf592fd0678d9b7e3fdeb5ebc3156c106146e583f55851b3a3c026dc6c9", - "size": 13364 + "sha256": "5f8487eeeaa13c2d5baddb0aa3cc0b7bdddfe2ffe52a3209483dde821a08589d", + "size": 13315 }, { "url": "https://modelcontextprotocol.io/specification/2026-07-28/basic/patterns/progress", "status": "success", "path": "mcp/specification/2026-07-28/basic/patterns/progress.md", - "sha256": "47866943e1f4ff0c8e79250ce6ff633545ca41d3ec7e45fe4d5367ca817084bd", - "size": 2707 + "sha256": "5178234f897db0a2b015012f15a9f8790b02900b66b962f1a2519395de74bdfa", + "size": 2670 }, { "url": "https://modelcontextprotocol.io/specification/2026-07-28/basic/patterns/subscriptions", "status": "success", "path": "mcp/specification/2026-07-28/basic/patterns/subscriptions.md", - "sha256": "278c5255b88895a7ac96f4a59e2ac839f0547e16e39f97978fae0a05367deb1d", - "size": 6134 + "sha256": "814a1c50078b191d2077af80b161b0c59786a7f30b15e15773ab94d0cf686553", + "size": 6097 }, { "url": "https://modelcontextprotocol.io/specification/2026-07-28/basic/transports", "status": "success", "path": "mcp/specification/2026-07-28/basic/transports.md", - "sha256": "9d541c583a2769feb38298bba7d19c6d5897b4b6ea329c49da88a436c724dd8c", - "size": 4232 + "sha256": "3c65acb1068d25b1ad0f10f74c9e196bc978eaf3aee0d1b643d55784656adcdd", + "size": 4195 }, { "url": "https://modelcontextprotocol.io/specification/2026-07-28/basic/transports/stdio", "status": "success", "path": "mcp/specification/2026-07-28/basic/transports/stdio.md", - "sha256": "a021917cb77ecd936143aced4fd243e12dd7b5f9a9344546742df97a381277f5", - "size": 7352 + "sha256": "884d4218c5ed1abfd9a3f28505eb734be4771fcff98212c7af5176e0b8d8de33", + "size": 7315 }, { "url": "https://modelcontextprotocol.io/specification/2026-07-28/basic/transports/streamable-http", "status": "success", "path": "mcp/specification/2026-07-28/basic/transports/streamable-http.md", - "sha256": "93daa4bb4e189f0bd51d866950b3b8a3b4e7d0b1e0e6eede5ba1998641d0b955", - "size": 30407 + "sha256": "8e45f8099ebdb3431c340e53c51d364df301e351db91b7c9447cbb655578e2e5", + "size": 30355 }, { "url": "https://modelcontextprotocol.io/specification/2026-07-28/basic/versioning", "status": "success", "path": "mcp/specification/2026-07-28/basic/versioning.md", - "sha256": "43b48c19cbc330410beed44da8cf441e100a05652a3654f39eb331bb94f46402", - "size": 8410 + "sha256": "bae590f2c18a9e5cbc01cfcbab4293d32686cab3b600c9793bbb8f55bb8ab1aa", + "size": 8373 }, { "url": "https://modelcontextprotocol.io/specification/2026-07-28/changelog", "status": "success", "path": "mcp/specification/2026-07-28/changelog.md", - "sha256": "203d3c9974e1a0e22308a4f0ae55e6ff7f1ad4150de64411b8c8e03003589aae", - "size": 11892 + "sha256": "b4c487760d46daf05ae30aea467516794af2dabe806b5fda43f9db9c7edc7c29", + "size": 11855 }, { "url": "https://modelcontextprotocol.io/specification/2026-07-28/client/elicitation", "status": "success", "path": "mcp/specification/2026-07-28/client/elicitation.md", - "sha256": "3817dae8dc076ac675442f9a209e629fa78b2655e00d3695ca21b3a9e8eb5633", - "size": 28215 + "sha256": "b85e1b645df4bdccc5c1abea94ed02a4152ef9329ff381bfd55fbb70ab28d4d7", + "size": 28164 }, { "url": "https://modelcontextprotocol.io/specification/2026-07-28/client/roots", "status": "success", "path": "mcp/specification/2026-07-28/client/roots.md", - "sha256": "eb7641345727acbb6f4cc5ccac071553062c1ae4a559c3eedf44d56809744dd4", - "size": 4718 + "sha256": "f169e12d284da3b2fb1f6d2200535aedf9954cce5bfb96148a56dc4731057e1b", + "size": 4675 }, { "url": "https://modelcontextprotocol.io/specification/2026-07-28/client/sampling", "status": "success", "path": "mcp/specification/2026-07-28/client/sampling.md", - "sha256": "b7207c57ba18190af66e6df7a02b40f1dc331791b193129c457d83d91d74343a", - "size": 22225 + "sha256": "475c0961cd65dfb89fc0e3b1bb82700249927cec4dac8689fbaf84c0a5fe543d", + "size": 22175 }, { "url": "https://modelcontextprotocol.io/specification/2026-07-28/deprecated", "status": "success", "path": "mcp/specification/2026-07-28/deprecated.md", - "sha256": "62a4379256d6a923978dabd0bab20764f3e7048df00f13c3201d83f300b777ca", - "size": 3536 + "sha256": "faad848f7eb11a78180ac581ab3615f3ea8d3acced7ffd6c65044176ae0e8732", + "size": 3499 }, { "url": "https://modelcontextprotocol.io/specification/2026-07-28", "status": "success", "path": "mcp/specification/2026-07-28.md", - "sha256": "f8df03767e5cbdd4921ae569d1d69e8da9e455e1629fadf4d0613cd658dd632f", - "size": 5817 + "sha256": "a666b9a258954e479206de870d2abc4fd5086a7fe4f821ab74bdf41a028aa435", + "size": 5594 }, { "url": "https://modelcontextprotocol.io/specification/2026-07-28/schema", "status": "success", "path": "mcp/specification/2026-07-28/schema.md", - "sha256": "c877bcbc6a26793d48a0c20cb3e7d4ef1cbb2d41cb194b3b73127ac561809bc3", - "size": 701659 + "sha256": "6daa817b8e9fec97ff86197dca32dbca8fdf4ec13df01aa9d1251630e2360c11", + "size": 214138 }, { "url": "https://modelcontextprotocol.io/specification/2026-07-28/server/discover", "status": "success", "path": "mcp/specification/2026-07-28/server/discover.md", - "sha256": "331489cd2984399cfe4828357fdd5a23e062ef40f69f4815499b055b51e2b82c", - "size": 3835 + "sha256": "f75bbb3864098d685ad2b0638844e371d75f13e17c1e2fcc4f5dc9c9c7afde62", + "size": 3795 }, { "url": "https://modelcontextprotocol.io/specification/2026-07-28/server", "status": "success", "path": "mcp/specification/2026-07-28/server.md", - "sha256": "134dc998f0e67f2c224ac731a5845a0239818349ae9f2a860bbb0bbe35c59b2e", - "size": 1501 + "sha256": "d47c929c19423cbef7e39bb307f0ab5fd5f9962b250c4b7f23ee99255d7f8d08", + "size": 1369 }, { "url": "https://modelcontextprotocol.io/specification/2026-07-28/server/prompts", "status": "success", "path": "mcp/specification/2026-07-28/server/prompts.md", - "sha256": "a73afd2caa6c737eba1508c87e41ffa8a8348d01f4942f416ffe52174a89070e", - "size": 10037 + "sha256": "dc6644250429c32a9f54ede44cfca97b473d809a64208d64bb21879c3a35c2d3", + "size": 9895 }, { "url": "https://modelcontextprotocol.io/specification/2026-07-28/server/resources", "status": "success", "path": "mcp/specification/2026-07-28/server/resources.md", - "sha256": "a53726a366fe96d8fe628694e45f5de3a252c2b7206193c8be355a97378e17d5", - "size": 13546 + "sha256": "d1b29181b2406bdd315b8325770186375ec507e888d725f2fdc95bc346f4bc47", + "size": 13405 }, { "url": "https://modelcontextprotocol.io/specification/2026-07-28/server/tools", "status": "success", "path": "mcp/specification/2026-07-28/server/tools.md", - "sha256": "09be49a064940ef288b47f8df09e95e6e3dc087c3f94e466acd60ec66dff25c3", - "size": 24314 + "sha256": "7e3bbac510b8779875304c47696f78cd0953d35f9f4ccc043b4a8034e9319d35", + "size": 24244 }, { "url": "https://modelcontextprotocol.io/specification/2026-07-28/server/utilities/caching", "status": "success", "path": "mcp/specification/2026-07-28/server/utilities/caching.md", - "sha256": "a7167674f44a8e0fafdb4ccfd0e625076313f99a2441909510026ed352d54c09", - "size": 8489 + "sha256": "ef62a1c907f7d0d97326c630b80fcc2ac2aa70e860761a2184ea80d1c509a5b6", + "size": 8443 }, { "url": "https://modelcontextprotocol.io/specification/2026-07-28/server/utilities/completion", "status": "success", "path": "mcp/specification/2026-07-28/server/utilities/completion.md", - "sha256": "29b5181e3a0681f1f05b048fb858fa2f9bd0928a3d5572529e19503461b22a15", - "size": 5390 + "sha256": "537769d43ff663ba5ddf1d597833905fae5b0bb23200216e2d94d6a3054ade2e", + "size": 5350 }, { "url": "https://modelcontextprotocol.io/specification/2026-07-28/server/utilities/logging", "status": "success", "path": "mcp/specification/2026-07-28/server/utilities/logging.md", - "sha256": "b3e82a6b068cd3b130a2c0b140114c924daa0aaaa3ff11033bee05bea92c0705", - "size": 4464 + "sha256": "4deb84dd33c065ddf19b1c8b1373f253cf41282000d6506e847a1cf1cbcd1902", + "size": 4421 }, { "url": "https://modelcontextprotocol.io/specification/2026-07-28/server/utilities/pagination", "status": "success", "path": "mcp/specification/2026-07-28/server/utilities/pagination.md", - "sha256": "38e266b78191c0ffdcc00cde80bcb87b6ac0dfb1afd477e4fdcc6baf74e1fc96", - "size": 3206 + "sha256": "579b4fab27cfaae836b2fff0343cf237ba5763c56971bb624a9d27f1a860dd05", + "size": 3166 }, { "url": "https://modelcontextprotocol.io/specification/draft/architecture", "status": "success", "path": "mcp/specification/draft/architecture.md", - "sha256": "97a6090a0fbac993139ff3ab545e0a1242f6b08b53a2872b6cd4f5705ecf9a48", - "size": 6374 + "sha256": "7441469ede273f74a6449c78b8db80b84d3e8448aee1e0e428cb2ed508975afb", + "size": 6337 }, { "url": "https://modelcontextprotocol.io/specification/draft/basic/authorization/authorization-server-discovery", "status": "success", "path": "mcp/specification/draft/basic/authorization/authorization-server-discovery.md", - "sha256": "b21e5749ebde18fcdd18f7c05ba1bbf7f869b9425f65b060f9b33a8322f61543", - "size": 8145 + "sha256": "20f2d56e12f88efa1c55529e25fdfb9e18542bc8d0fb956121143382f14c55bb", + "size": 8108 }, { "url": "https://modelcontextprotocol.io/specification/draft/basic/authorization/client-registration", "status": "success", "path": "mcp/specification/draft/basic/authorization/client-registration.md", - "sha256": "70d01c6d6308730370bd11af1454f9e98ce6d8dbabdf4b9bd79de2aff55bcaa3", - "size": 10215 + "sha256": "2481eca77762e95dec2f0934b24443bd8d53b79b3fe2fe1b8856adcfcc2a0769", + "size": 10172 }, { "url": "https://modelcontextprotocol.io/specification/draft/basic/authorization", "status": "success", "path": "mcp/specification/draft/basic/authorization.md", - "sha256": "a970584ce441ade352f5e7c15544b99b0b4c0ac12958383c27b392cf98e5ac1b", - "size": 25118 + "sha256": "dd5c6bf8ff8dedad469eee0b0a5dd245798c70923cb60f0ac75dc3a9db15e05e", + "size": 25081 }, { "url": "https://modelcontextprotocol.io/specification/draft/basic/authorization/security-considerations", "status": "success", "path": "mcp/specification/draft/basic/authorization/security-considerations.md", - "sha256": "3a7f3a432d7d3491dddbf6acf9f62407b149a893cea088dba7a97775c10f289c", - "size": 10054 + "sha256": "61a83adc95578c765a6fff1b588c64d4a39a4237dcb4616fc03e995571391293", + "size": 10017 }, { "url": "https://modelcontextprotocol.io/specification/draft/basic", "status": "success", "path": "mcp/specification/draft/basic.md", - "sha256": "fe80a285e0991c3581622d46d7fd1aadbf3118e5fb911a4c1f3c09b37c0f68d0", - "size": 23883 + "sha256": "67548d95720171fb0a54819b3daea89a969d174761c87d27fed92d344266c468", + "size": 23837 }, { "url": "https://modelcontextprotocol.io/specification/draft/basic/patterns/cancellation", "status": "success", "path": "mcp/specification/draft/basic/patterns/cancellation.md", - "sha256": "d25941757311194a70e5eeb6cf4a4ca6fb2bcd6526b3b4060838c49c1e6fc0d8", - "size": 4617 + "sha256": "8a1fde7622ab9873676b370bdc991e1c1d8e436710758d08ba5c597dd20e599d", + "size": 4580 }, { "url": "https://modelcontextprotocol.io/specification/draft/basic/patterns", "status": "success", "path": "mcp/specification/draft/basic/patterns.md", - "sha256": "595cb9618c7d8f60d7c6be2d30e30cf6fdc6173164b0053937b42303a5295092", - "size": 3134 + "sha256": "84e01b2f8932e35eaad6be454296dfcf57aee79488865324ebd692933cc01b78", + "size": 3097 }, { "url": "https://modelcontextprotocol.io/specification/draft/basic/patterns/mrtr", "status": "success", "path": "mcp/specification/draft/basic/patterns/mrtr.md", - "sha256": "629fa9a4697e0d2f4b250cef488524392dcda8f1595e474542ae5e47af1faee9", - "size": 13274 + "sha256": "582ddbb875064453eba04763af6d7ea8ff780be972c0b35f875c7d3efeb718b9", + "size": 13225 }, { "url": "https://modelcontextprotocol.io/specification/draft/basic/patterns/progress", "status": "success", "path": "mcp/specification/draft/basic/patterns/progress.md", - "sha256": "47866943e1f4ff0c8e79250ce6ff633545ca41d3ec7e45fe4d5367ca817084bd", - "size": 2707 + "sha256": "5178234f897db0a2b015012f15a9f8790b02900b66b962f1a2519395de74bdfa", + "size": 2670 }, { "url": "https://modelcontextprotocol.io/specification/draft/basic/patterns/subscriptions", "status": "success", "path": "mcp/specification/draft/basic/patterns/subscriptions.md", - "sha256": "27df6773786bad1b1f62f4b5d2ed96a12e4aa1cb618ba187907faa690b881fd6", - "size": 6129 + "sha256": "b3af752b2b06d7cd5da6ce92d59ec2a210ac4db3966b1d51bd1e6eb09f4eb8c0", + "size": 6092 }, { "url": "https://modelcontextprotocol.io/specification/draft/basic/transports", "status": "success", "path": "mcp/specification/draft/basic/transports.md", - "sha256": "ccee5b6337ae5683cb12d60eabb9d77b12f95ccf8bfb2451adc46be53917d719", - "size": 4182 + "sha256": "2e8c7220be546cccb12bd71fbeecd6d835e65daeda0052a02056547fbf472e24", + "size": 4145 }, { "url": "https://modelcontextprotocol.io/specification/draft/basic/transports/stdio", "status": "success", "path": "mcp/specification/draft/basic/transports/stdio.md", - "sha256": "54d0db644f0303fe096cc4305c67ec00d8cf1eb04e7403ca75ff07d38d020af9", - "size": 7302 + "sha256": "c92e522477c4e0b08022751c61a6bbfee34edab37a57b544261bb7910b9727a5", + "size": 7265 }, { "url": "https://modelcontextprotocol.io/specification/draft/basic/transports/streamable-http", "status": "success", "path": "mcp/specification/draft/basic/transports/streamable-http.md", - "sha256": "5a7d9f4429b7f793fa5628633837d1f82106ff1ec4f7e236e80021090da5997f", - "size": 30393 + "sha256": "40fbb8a1fa48e6bd65efd48a2ad9e25fa5a194d8bc8d70bade2630d60fa51b67", + "size": 30341 }, { "url": "https://modelcontextprotocol.io/specification/draft/basic/versioning", "status": "success", "path": "mcp/specification/draft/basic/versioning.md", - "sha256": "0a401118dffb41a02d9489d5504088461a6df98ae808a074528870026d351e57", - "size": 8365 + "sha256": "a9e881ceda4c2b8a64205cf7d3e04ea501089d33425b075069830bfc06872a9a", + "size": 8328 }, { "url": "https://modelcontextprotocol.io/specification/draft/changelog", @@ -9487,106 +9501,106 @@ "url": "https://modelcontextprotocol.io/specification/draft/client/elicitation", "status": "success", "path": "mcp/specification/draft/client/elicitation.md", - "sha256": "7e81a9adb27cc7098e80fd76a570e2b0e917e5a60663caa18cbbdd8f18789623", - "size": 28180 + "sha256": "a8da60bc09381dc69b572cf18e0ba82ef58dbdabb416a3b42282ca7ede42bb8b", + "size": 28129 }, { "url": "https://modelcontextprotocol.io/specification/draft/client/roots", "status": "success", "path": "mcp/specification/draft/client/roots.md", - "sha256": "b8c928244b0419dec6db4d774fa5ecb7531e21306618304175cd0c89787a3e05", - "size": 4708 + "sha256": "d9ea6dae0e9dc3bed3e322d6e1cee737432d9bd44083ae450a59c4f45b78834b", + "size": 4665 }, { "url": "https://modelcontextprotocol.io/specification/draft/client/sampling", "status": "success", "path": "mcp/specification/draft/client/sampling.md", - "sha256": "349cf6d240d69bccfa4e5e35baa7a61a713c50d216cc4a39ede159606cba3380", - "size": 22210 + "sha256": "695fe159b9c65175e7ccb9994a7d59e562ab4e0fa07ce1d01ee887050a13f37e", + "size": 22160 }, { "url": "https://modelcontextprotocol.io/specification/draft/deprecated", "status": "success", "path": "mcp/specification/draft/deprecated.md", - "sha256": "06c5b29efd42078544ae150197310268098d5679fabbbcbbce9d9e3910497aad", - "size": 3501 + "sha256": "18780e6c22286d549434811197cb9ea95694488f1489c962d72d04c9bf0fb75e", + "size": 3464 }, { "url": "https://modelcontextprotocol.io/specification/draft", "status": "success", "path": "mcp/specification/draft.md", - "sha256": "ddb23908b117a1e2ee4c0c4605a5932d3b32404716e5cff20db67756cfbb80ea", - "size": 5792 + "sha256": "51f7aeb4ad88dfa0521149cecc70088b98f7df833b964273f6f54eb878bee83b", + "size": 5569 }, { "url": "https://modelcontextprotocol.io/specification/draft/schema", "status": "success", "path": "mcp/specification/draft/schema.md", - "sha256": "2bcdb5ff3d046a422c3bbc1909d587914d1a21e4cfffb11d9e90cb3f726dffd4", - "size": 701639 + "sha256": "e8e35c70148d7b4841456ef94b8f78e2d462a4769af1b795c456ed4d7b7d9f5f", + "size": 214118 }, { "url": "https://modelcontextprotocol.io/specification/draft/server/discover", "status": "success", "path": "mcp/specification/draft/server/discover.md", - "sha256": "afcde65a64bc1a8005c447bae10641a25f02fbfca28b6be16157c698cd4b41ed", - "size": 3810 + "sha256": "b27086aec5ed385446122c68b39b04a28735cd929d3141fb0497cda63d5525fe", + "size": 3770 }, { "url": "https://modelcontextprotocol.io/specification/draft/server", "status": "success", "path": "mcp/specification/draft/server.md", - "sha256": "d1ac2fde23aca776bd5ab0254073328529455f028775afb2fc2e70f763004d6a", - "size": 1486 + "sha256": "def10dd3f3e203465c3bd6d81b717679ea91a1abc6a465e334ca965d3c20b798", + "size": 1354 }, { "url": "https://modelcontextprotocol.io/specification/draft/server/prompts", "status": "success", "path": "mcp/specification/draft/server/prompts.md", - "sha256": "ff142c86332670b6ccfbc51905741a4e0dd1c1c27680022ca7f9618f0269e221", - "size": 9972 + "sha256": "c6bccb06efe3d7aea54d7b8e11aa5c590780c3e5787d11624e220e7c49a5f5bd", + "size": 9835 }, { "url": "https://modelcontextprotocol.io/specification/draft/server/resources", "status": "success", "path": "mcp/specification/draft/server/resources.md", - "sha256": "6b1a4f8615fcffd3f974652f05acb2ad6b074e98081367b049bd09acd6befee9", - "size": 13481 + "sha256": "e67532376fabc2fd5941ba3e6c984301e804bb5f9f4b3bfb626cf6c5ce721aae", + "size": 13345 }, { "url": "https://modelcontextprotocol.io/specification/draft/server/tools", "status": "success", "path": "mcp/specification/draft/server/tools.md", - "sha256": "d4a91750a9b352f74ffd11a69fafac45fa6ca2e6ad196c61cfb6477197c0e998", - "size": 24229 + "sha256": "2e112f401aa8d001a559e965fc81e92abfde6f01adfb59b50bf57fdf1e5741e9", + "size": 24159 }, { "url": "https://modelcontextprotocol.io/specification/draft/server/utilities/caching", "status": "success", "path": "mcp/specification/draft/server/utilities/caching.md", - "sha256": "bb704e227fed7c0ad0d638134672f19cf77ac2627e720c4501e70e514a38894d", - "size": 8474 + "sha256": "b3c69707883819efff860796164dce16c25786496fbff0245e80af1bd2598168", + "size": 8428 }, { "url": "https://modelcontextprotocol.io/specification/draft/server/utilities/completion", "status": "success", "path": "mcp/specification/draft/server/utilities/completion.md", - "sha256": "7429c02ef91d8913188cd71fccfc1e1a05b84418ba64e9b6df298bbc59453fd4", - "size": 5385 + "sha256": "792ee42254bb4689c4ae43639aa026aef1695519891166143fbbb4618942bcfc", + "size": 5345 }, { "url": "https://modelcontextprotocol.io/specification/draft/server/utilities/logging", "status": "success", "path": "mcp/specification/draft/server/utilities/logging.md", - "sha256": "1cdc98c8387f2d60337f6a4cccdf1f4c0575760e4a7eb843c74688a332a9050e", - "size": 4454 + "sha256": "13a39d5d188cd369aab1d4a091330713e5d6553c818e92923e9d1d967818c173", + "size": 4411 }, { "url": "https://modelcontextprotocol.io/specification/draft/server/utilities/pagination", "status": "success", "path": "mcp/specification/draft/server/utilities/pagination.md", - "sha256": "68638cd8462b2c052e7b1eb208080fd602874c91535a03d8438cdb60d2f84ab0", - "size": 3201 + "sha256": "8186502c116b5745a7bb28df308543610df9ad7aeabec0cf6b2185163174b445", + "size": 3161 }, { "url": "https://support.claude.com/en/articles/7996845-what-are-some-things-i-can-use-claude-for", @@ -9669,8 +9683,8 @@ "url": "https://support.claude.com/en/articles/8114491-get-started-with-claude", "status": "success", "path": "support/8114491-get-started-with-claude.md", - "sha256": "5128c65701a250da69ebf5f45a3786c9f0edb1fa39f5af9a5fb00bdacf7bd5c4", - "size": 5205 + "sha256": "a9d2c7221786bffbf280579b3ad9a579bf9dc72c276c1207c5bedf7bdd0954ed", + "size": 5207 }, { "url": "https://support.claude.com/en/articles/8114494-how-up-to-date-is-claude-s-training-data", @@ -9746,8 +9760,8 @@ "url": "https://support.claude.com/en/articles/8230524-delete-or-rename-a-conversation", "status": "success", "path": "support/8230524-delete-or-rename-a-conversation.md", - "sha256": "1ce8293d24fc712c5c69372119c0017cee31b5d62f3341a04a62283f789b467e", - "size": 5879 + "sha256": "09d983f23e1f14eee1fa72333b5748d7e3aff9dce308bea532cfd70d53429167", + "size": 5883 }, { "url": "https://support.claude.com/en/articles/8241126-upload-files-to-claude", @@ -9816,8 +9830,8 @@ "url": "https://support.claude.com/en/articles/8325618-paid-plan-billing-faqs", "status": "success", "path": "support/8325618-paid-plan-billing-faqs.md", - "sha256": "2fef5b346cb78e5652ff667153f6e363e478a82a14bd2c2e4608cc5b5697e43e", - "size": 4953 + "sha256": "5e442bf5703c3d96218ff7f6801a88b8785577ba9dcb39ce4fd9426bd103127a", + "size": 4951 }, { "url": "https://support.claude.com/en/articles/8325621-i-would-like-to-input-sensitive-data-into-my-chats-with-claude-who-can-view-my-conversations", @@ -9879,8 +9893,8 @@ "url": "https://support.claude.com/en/articles/8887527-customizing-your-appearance-settings", "status": "success", "path": "support/8887527-customizing-your-appearance-settings.md", - "sha256": "118c0a9ee13fe2c31801f38ccbf7b104706be69e84170e82426122da0a1412dd", - "size": 1870 + "sha256": "1e1080c5337631ee38ccd02ee8b67079cbf49338b23d9c362a25a5fdb43469a3", + "size": 1874 }, { "url": "https://support.claude.com/en/articles/8896518-does-anthropic-crawl-data-from-the-web-and-how-can-site-owners-block-the-crawler", @@ -10054,8 +10068,8 @@ "url": "https://support.claude.com/en/articles/9267400-move-your-personal-claude-account-to-a-team-or-enterprise-organization", "status": "success", "path": "support/9267400-move-your-personal-claude-account-to-a-team-or-enterprise-organization.md", - "sha256": "01504578a1b9386138df921d5e18494e45bbf15e8b602a3296a2cb97b79bfa65", - "size": 10266 + "sha256": "b740552a8c583774233cca79dda07799a2494343f22a8cfc3ce97f1a4c84b736", + "size": 10264 }, { "url": "https://support.claude.com/en/articles/9301722-updates-to-our-acceptable-use-policy-now-usage-policy-consumer-terms-of-service-and-privacy-policy", @@ -10096,8 +10110,8 @@ "url": "https://support.claude.com/en/articles/9519177-how-can-i-create-and-manage-projects", "status": "success", "path": "support/9519177-how-can-i-create-and-manage-projects.md", - "sha256": "0975eee0835b3aa5eb4366d0f208d0f6681f8f22b952f763f0f68e52c6c1af7e", - "size": 9203 + "sha256": "5c5e76d23286d6eabcf375218ec8508f24d8791b6be40103e010114a8848c5d8", + "size": 9205 }, { "url": "https://support.claude.com/en/articles/9519189-manage-project-visibility-and-sharing", @@ -10148,6 +10162,13 @@ "sha256": "f73abae58d77acdb9735d6720f7431255b63c203e00456fd103dcdae5f3fc668", "size": 324 }, + { + "url": "https://support.claude.com/en/articles/9767949-api-key-best-practices-keep-your-keys-safe-and-secure", + "status": "success", + "path": "support/9767949-api-key-best-practices-keep-your-keys-safe-and-secure.md", + "sha256": "8af7a2c5cd8e503ce84c082ca4ebdd96c44442a81fa0ab9839d22d6d64c65b56", + "size": 8296 + }, { "url": "https://support.claude.com/en/articles/9796617-can-you-delete-data-that-i-sent-via-team-and-enterprise-plans", "status": "success", @@ -10155,6 +10176,13 @@ "sha256": "04fc13935af296ee44e969f27b8a8c946d796cd9c38bff9adaf54641856fd2fd", "size": 1160 }, + { + "url": "https://support.claude.com/en/articles/9796807-create-and-manage-workspaces-in-the-claude-console", + "status": "success", + "path": "support/9796807-create-and-manage-workspaces-in-the-claude-console.md", + "sha256": "ec9925224126e88ee9413a7fd204708d73afe2e12085dc906ea3c4a188522d21", + "size": 7379 + }, { "url": "https://support.claude.com/en/articles/9797531-what-is-the-enterprise-plan", "status": "success", @@ -10257,8 +10285,8 @@ "url": "https://support.claude.com/en/articles/10166901-use-google-workspace-connectors", "status": "success", "path": "support/10166901-use-google-workspace-connectors.md", - "sha256": "69f6a025c94c963c41f3a45814251bffed77b494f0cb981f77efbfb7af98cf1a", - "size": 13765 + "sha256": "975e6a4c58f8bf836d01c15920f9a0b7cc35fbe4a73f01dc0dfd7c0271bd31e3", + "size": 13690 }, { "url": "https://support.claude.com/en/articles/10167454-use-the-github-integration", @@ -10334,7 +10362,7 @@ "url": "https://support.claude.com/en/articles/10310342-how-do-i-log-out-of-all-active-sessions", "status": "success", "path": "support/10310342-how-do-i-log-out-of-all-active-sessions.md", - "sha256": "7089d48dfdba20e908fb57a6251f136183fbf9453fd6323001fe337de3891792", + "sha256": "2ec2d59e19fe2e9612f936db732593b50d300ac5976c781e50aebe730410fcb2", "size": 2492 }, { @@ -10383,7 +10411,7 @@ "url": "https://support.claude.com/en/articles/10504844-manage-user-feedback-settings-on-team-and-enterprise-plans", "status": "success", "path": "support/10504844-manage-user-feedback-settings-on-team-and-enterprise-plans.md", - "sha256": "f55e0d74d6bb9ed24fd43f2bdccd359b4bfff755c937acb11686e3b467c4525f", + "sha256": "30f288c895e5314b9f5454db6cf5bef43a2c4fc9c91be4aac60972b5814b482f", "size": 1036 }, { @@ -10404,8 +10432,8 @@ "url": "https://support.claude.com/en/articles/10593882-share-and-unshare-chats", "status": "success", "path": "support/10593882-share-and-unshare-chats.md", - "sha256": "e3a645f58907823bd76269f7b74a79b8a64b02e5e8de136d871b2d7ad2b9ba72", - "size": 4014 + "sha256": "3d9993848a7cc395255964a8785ceefb9c5b2c85c79973674f282e90a044eff4", + "size": 4016 }, { "url": "https://support.claude.com/en/articles/10684626-enable-and-use-web-search", @@ -10432,8 +10460,8 @@ "url": "https://support.claude.com/en/articles/10949351-getting-started-with-local-mcp-servers-on-claude-desktop", "status": "success", "path": "support/10949351-getting-started-with-local-mcp-servers-on-claude-desktop.md", - "sha256": "905ae2161edef5ef5c1056ab401f022723d1a02058a37857240e172f024c7444", - "size": 8392 + "sha256": "9a18ea67842a70b0468fb8755f4e805f205badd7b700df8020503c22ed7be6d2", + "size": 8390 }, { "url": "https://support.claude.com/en/articles/11049741-what-is-the-max-plan", @@ -10467,8 +10495,8 @@ "url": "https://support.claude.com/en/articles/11101966-use-voice-mode", "status": "success", "path": "support/11101966-use-voice-mode.md", - "sha256": "27057d9ac4b56d5f518f85307d962561302487c998b070fc90f1f4d0f4b131c1", - "size": 10565 + "sha256": "1e02b9468d066edb33db30d00d2635fdcb4fe9c1735792d222b6b06ff277d930", + "size": 10555 }, { "url": "https://support.claude.com/en/articles/11107691-why-is-a-coupon-or-promotion-not-available-for-my-account", @@ -10600,7 +10628,7 @@ "url": "https://support.claude.com/en/articles/11725453-set-up-the-claude-lti-in-canvas-by-instructure", "status": "success", "path": "support/11725453-set-up-the-claude-lti-in-canvas-by-instructure.md", - "sha256": "d36bf526e69c15f81c8beb97d6adfec313488e7bb9a7a67733e636c29f305b55", + "sha256": "8838d7d46ebeb4a6bbc557e1dba0d8146ea0fd87b1aa59c4f26319d6a06054c9", "size": 2748 }, { @@ -10614,14 +10642,14 @@ "url": "https://support.claude.com/en/articles/11817273-use-claude-s-chat-search-and-memory-to-build-on-previous-context", "status": "success", "path": "support/11817273-use-claude-s-chat-search-and-memory-to-build-on-previous-context.md", - "sha256": "62389c67c0163f5491e24ec35e88f92531d30afa074a29d478b1377e8b7501ad", - "size": 28554 + "sha256": "d4240cfe00d73e0b7a9bece089f8e9cf25d2cd0a391dfa35bcdce90d0b47299f", + "size": 28550 }, { "url": "https://support.claude.com/en/articles/11818288-why-am-i-being-asked-to-verify-my-payment-method", "status": "success", "path": "support/11818288-why-am-i-being-asked-to-verify-my-payment-method.md", - "sha256": "0c533ba272df69f420ea1b5a556b64fa7a95c8e6abf69dd98b86a6e1175289ad", + "sha256": "37d9b2de680f62766564033b5efca8b2fb475eb1fd1c7b3445451fad5e825524", "size": 814 }, { @@ -10656,8 +10684,8 @@ "url": "https://support.claude.com/en/articles/11869629-use-claude-with-android-apps", "status": "success", "path": "support/11869629-use-claude-with-android-apps.md", - "sha256": "26e3351985f161c7e010a8d16a9f39d8508de8018a1afb8fb4ec998586d56a5a", - "size": 13993 + "sha256": "807e7a04b09597f50f9723efedb8b23d34946cb7968abcbc8a1022735deda135", + "size": 13995 }, { "url": "https://support.claude.com/en/articles/11932705-automated-security-reviews-in-claude-code", @@ -10691,14 +10719,14 @@ "url": "https://support.claude.com/en/articles/12005970-manage-usage-credits-for-team-and-seat-based-enterprise-plans", "status": "success", "path": "support/12005970-manage-usage-credits-for-team-and-seat-based-enterprise-plans.md", - "sha256": "dec125a8d78d3eb893663c85c42d64ec92f336aa55de622228c1f070ef0935ee", - "size": 9715 + "sha256": "cb6bfc6de424a1eda61eb8e2c6ec85223bd9fc3c4adef41571dad2b20be669d8", + "size": 9713 }, { "url": "https://support.claude.com/en/articles/12012173-get-started-with-claude-in-chrome", "status": "success", "path": "support/12012173-get-started-with-claude-in-chrome.md", - "sha256": "6301bd8a036eb3e693900759059038d867d2a042e74cc59012df5b18d1943f4f", + "sha256": "a2409167f4453b46361194c9daeff891857cbbdb8cc57cec30df594f71a17b99", "size": 14857 }, { @@ -10726,7 +10754,7 @@ "url": "https://support.claude.com/en/articles/12111783-create-and-edit-files-with-claude", "status": "success", "path": "support/12111783-create-and-edit-files-with-claude.md", - "sha256": "608a4f0125e5ed4b15cbf08165d46f1529117db20879ab5768f46e194a8853dd", + "sha256": "ed40ec3544a81c5f19ef8789dc7e7a135988985294dee82a609c567ed78cee74", "size": 17958 }, { @@ -10761,15 +10789,15 @@ "url": "https://support.claude.com/en/articles/12260368-use-incognito-chats", "status": "success", "path": "support/12260368-use-incognito-chats.md", - "sha256": "735a5cb51137086fd0318bccc3ca221ef9dea80fa34e9e755e680f433c6ced03", - "size": 4380 + "sha256": "fc01e9af276fb853984baa828497a8339dabfef30f9890ac0f50065df40b317c", + "size": 4376 }, { "url": "https://support.claude.com/en/articles/12293051-use-claude-in-xcode", "status": "success", "path": "support/12293051-use-claude-in-xcode.md", - "sha256": "4387b2ab88eecffe358969ef14ea9e468043d502d491a0a5a083755695780688", - "size": 1909 + "sha256": "e3bf1e3c441e2876b89f9f474de10285a6db0e240178ee31ed484a7da8e1ccd3", + "size": 1911 }, { "url": "https://support.claude.com/en/articles/12304248-manage-api-key-environment-variables-in-claude-code", @@ -10810,15 +10838,15 @@ "url": "https://support.claude.com/en/articles/12429409-manage-usage-credits-for-paid-claude-plans", "status": "success", "path": "support/12429409-manage-usage-credits-for-paid-claude-plans.md", - "sha256": "cb8ab3916f780635bd5a47f5ddb56a6f2c580c7e98a889b5b89a189d3ad50874", - "size": 7972 + "sha256": "897225e63b46c95f79d88a423b0412a552757c201a07af9c5bc8cdd3ad77cfe1", + "size": 7974 }, { "url": "https://support.claude.com/en/articles/12466728-troubleshoot-claude-error-messages", "status": "success", "path": "support/12466728-troubleshoot-claude-error-messages.md", - "sha256": "058662a9a57289bdac435f57ab386c72fe28e0c2a15414d28743b7d045c9eca4", - "size": 5141 + "sha256": "ebd60f54fdf40add83b67aaa1549f160d913eb66fa512afc5274ee24c6bbdc20", + "size": 5139 }, { "url": "https://support.claude.com/en/articles/12489464-use-enterprise-search", @@ -10838,8 +10866,8 @@ "url": "https://support.claude.com/en/articles/12512180-use-skills-in-claude", "status": "success", "path": "support/12512180-use-skills-in-claude.md", - "sha256": "8d18fd5d80b01dbc9eb6ad4fe0699f71fa3047a5a8c748aeed8346a3177606f2", - "size": 19148 + "sha256": "675e30a41ff883c01e99df6bba0fc70de570237256452a76bc0c8076d7591f11", + "size": 19146 }, { "url": "https://support.claude.com/en/articles/12512198-how-to-create-custom-skills", @@ -10859,8 +10887,8 @@ "url": "https://support.claude.com/en/articles/12592343-enabling-and-using-the-desktop-extension-allowlist", "status": "success", "path": "support/12592343-enabling-and-using-the-desktop-extension-allowlist.md", - "sha256": "476192617209327605934db5625832692b79c61d49a8f3e2a92cb17aa2f34167", - "size": 5712 + "sha256": "7c103eee5c0d332fb43ed7320eeb50503f8e7416b22798061df3372fff376803", + "size": 5718 }, { "url": "https://support.claude.com/en/articles/12611117-deploy-claude-desktop-for-macos", @@ -10873,8 +10901,8 @@ "url": "https://support.claude.com/en/articles/12618689-use-claude-code-in-the-cloud", "status": "success", "path": "support/12618689-use-claude-code-in-the-cloud.md", - "sha256": "651ffd605108bd220f9a6bbb421f2e2995a926b7e2b1b10fa9734b81fe078bdc", - "size": 11058 + "sha256": "50345fb4c29d3f0ec8c01ad8a477fa6852731bf1a800124dc85611215c656a73", + "size": 11060 }, { "url": "https://support.claude.com/en/articles/12622667-enterprise-configuration-for-claude-desktop", @@ -10894,8 +10922,8 @@ "url": "https://support.claude.com/en/articles/12626668-use-quick-entry-with-claude-desktop-on-mac", "status": "success", "path": "support/12626668-use-quick-entry-with-claude-desktop-on-mac.md", - "sha256": "80c753c531814b856fec0759a66818750c1890deab21a79ff33344cb657ee389", - "size": 5972 + "sha256": "745de6012b61fbc68141c76a5acd3c241bffb7aa55d35d17f97e489888579f9a", + "size": 5970 }, { "url": "https://support.claude.com/en/articles/12684923-microsoft-365-connector-security-guide", @@ -10929,8 +10957,8 @@ "url": "https://support.claude.com/en/articles/12883420-view-usage-analytics-for-team-and-enterprise-plans", "status": "success", "path": "support/12883420-view-usage-analytics-for-team-and-enterprise-plans.md", - "sha256": "db7b8221f1a11583470e00e6a512976ade4e4665693a998e39915ed41fe10861", - "size": 15101 + "sha256": "8e425981fcb655fa1b6dce83111843fe1e3010db29c2689e7beba302a5e9bc1d", + "size": 15109 }, { "url": "https://support.claude.com/en/articles/12902405-claude-in-chrome-troubleshooting", @@ -10950,7 +10978,7 @@ "url": "https://support.claude.com/en/articles/12902446-claude-in-chrome-permissions-guide", "status": "success", "path": "support/12902446-claude-in-chrome-permissions-guide.md", - "sha256": "550fa8d0827f8a26ad1473cfaaa14bee524711ea81183836bef600df374fd246", + "sha256": "e80a6417ad6ab9d724b910a458fdd990e34cc4ffa55f9a2d8e3d6651afab85fd", "size": 9569 }, { @@ -10978,7 +11006,7 @@ "url": "https://support.claude.com/en/articles/12997503-team-plan-billing-faqs", "status": "success", "path": "support/12997503-team-plan-billing-faqs.md", - "sha256": "e0e985bd86e213439dffbf0d17645c61bc4ac44805bae718522479d11ccf72a5", + "sha256": "ace7870639c148fe7beea9dcda42af9c0ba21dd701df42bc80df136d51acf1e7", "size": 5411 }, { @@ -11027,15 +11055,15 @@ "url": "https://support.claude.com/en/articles/13132885-set-up-single-sign-on-sso", "status": "success", "path": "support/13132885-set-up-single-sign-on-sso.md", - "sha256": "4f6381782d56cf7a0251b3c0aa1a3e0c8f9af343db684bb7936c04774cf3d051", - "size": 13639 + "sha256": "83aaee1724d99f8e2f87e383acfecc2108004854dd154d4977a38fb3bc714f5c", + "size": 13643 }, { "url": "https://support.claude.com/en/articles/13133195-set-up-jit-or-scim-provisioning", "status": "success", "path": "support/13133195-set-up-jit-or-scim-provisioning.md", - "sha256": "627b8af59a29234433abfa5bc5d2097f60a146fd615cbeed6219a2ec8f6566b8", - "size": 22525 + "sha256": "258a9f6e9a40eaab9a4bd7339476601e7bede944dc8bcfaa7a16c4488072de90", + "size": 22519 }, { "url": "https://support.claude.com/en/articles/13133750-manage-members-on-team-and-enterprise-plans", @@ -11062,8 +11090,8 @@ "url": "https://support.claude.com/en/articles/13163631-configuring-session-security-settings", "status": "success", "path": "support/13163631-configuring-session-security-settings.md", - "sha256": "38479102d99ca367927705afd1274f478623a6cfea421dbea69e9d92f9ba61a2", - "size": 3707 + "sha256": "892aa5044e57d70ac6b56bcfb183a1be97f110629b29830b7548b444c4f79e26", + "size": 3703 }, { "url": "https://support.claude.com/en/articles/13171706-crisis-helpline-support-in-claude", @@ -11076,8 +11104,8 @@ "url": "https://support.claude.com/en/articles/13189465-log-in-to-your-claude-account", "status": "success", "path": "support/13189465-log-in-to-your-claude-account.md", - "sha256": "1e7220b091e09db1fd78807481356c4e7b38ba27e4233c002e97637723f84703", - "size": 7037 + "sha256": "8b9a0b3f17c6c5042cb8b136706e11e1e8999f29ba8194ccb191d5b0b1bf481c", + "size": 7039 }, { "url": "https://support.claude.com/en/articles/13198485-enforce-network-level-access-control-with-tenant-restrictions", @@ -11104,15 +11132,22 @@ "url": "https://support.claude.com/en/articles/13325567-account-management-faqs", "status": "success", "path": "support/13325567-account-management-faqs.md", - "sha256": "c81a646fe430582cdd676bd293352326ce1e76bc9dd6d997e0ef63d8d2a2d3e9", - "size": 2634 + "sha256": "7453b481350de2b2841beb4d0bf580c9d8ffcbe862c83ee7b27da23201c40484", + "size": 2636 }, { "url": "https://support.claude.com/en/articles/13345190-get-started-with-claude-cowork", "status": "success", "path": "support/13345190-get-started-with-claude-cowork.md", - "sha256": "6c4bfecd71388ef6369b6b6176fe67a34a770b6a2a06e28bc540804e4be3aa2e", - "size": 23058 + "sha256": "8b2277157ca64c233f2f957b9a000525946c3af2211454630b45069df2384ff5", + "size": 23060 + }, + { + "url": "https://support.claude.com/en/articles/13346458-customize-your-console-appearance-settings", + "status": "success", + "path": "support/13346458-customize-your-console-appearance-settings.md", + "sha256": "e297f7689da1f52251154860c461a914bb33b72186b69e9b90bedd9d545c9ad8", + "size": 227 }, { "url": "https://support.claude.com/en/articles/13346720-export-your-organization-s-data", @@ -11132,8 +11167,8 @@ "url": "https://support.claude.com/en/articles/13371040-log-in-to-your-console-account", "status": "success", "path": "support/13371040-log-in-to-your-console-account.md", - "sha256": "03f3bed2cbfa65a9f479068204caa2a65feeca182eeaa91af7c3a607ab9def09", - "size": 4615 + "sha256": "fb40f9f78cbc73bba7353b4450e4ef7496991b69dc9758a60d2fa591e680d4d5", + "size": 4611 }, { "url": "https://support.claude.com/en/articles/13393991-purchase-and-manage-seats-on-enterprise-plans", @@ -11156,6 +11191,13 @@ "sha256": "c11fc1097ce3aa144b1a21ebfc72566cc017ee2ffb3d52831b7bffa05c8ccff1", "size": 3418 }, + { + "url": "https://support.claude.com/en/articles/13443764-invite-members-to-the-claude-console", + "status": "success", + "path": "support/13443764-invite-members-to-the-claude-console.md", + "sha256": "863f62ead7dca41268718047664ac0a1ff71c462918077f294fc0ce2cf50c400", + "size": 1433 + }, { "url": "https://support.claude.com/en/articles/13454812-use-interactive-connectors-in-claude", "status": "success", @@ -11181,8 +11223,8 @@ "url": "https://support.claude.com/en/articles/13641943-visual-and-interactive-content", "status": "success", "path": "support/13641943-visual-and-interactive-content.md", - "sha256": "c3aebb2f78635ae9b28350aca82c13d9036a625e2868bef05f8182574f4813cc", - "size": 6515 + "sha256": "a626985929e0598763e7d1829c122d923fd5454bbc5885ecd980280ea5a40f63", + "size": 6513 }, { "url": "https://support.claude.com/en/articles/13663666-use-visual-and-interactive-content-on-team-and-enterprise-plans", @@ -11237,8 +11279,8 @@ "url": "https://support.claude.com/en/articles/13837440-use-plugins-in-claude", "status": "success", "path": "support/13837440-use-plugins-in-claude.md", - "sha256": "0944e13cf39dd701e706f9aebd5c88f2e3ad83bf1343389eaf8047927e2752dd", - "size": 15189 + "sha256": "9ae841c8843c1eb65fb42389afd8f1f282ea89232d5f06756e7ccdb30c4799ae", + "size": 15187 }, { "url": "https://support.claude.com/en/articles/13854387-schedule-recurring-tasks-in-claude-cowork", @@ -11321,22 +11363,22 @@ "url": "https://support.claude.com/en/articles/13930452-manage-custom-roles-on-enterprise-plans", "status": "success", "path": "support/13930452-manage-custom-roles-on-enterprise-plans.md", - "sha256": "ba7bfa98ec950e494aaaf2018d7110a4dbc3002dd173f9598040c2d29a6155ab", - "size": 42193 + "sha256": "094f2e9369c86a26fca00e882658f1094efc7b6413a9b11099d8ae7ad6fc455d", + "size": 44967 }, { "url": "https://support.claude.com/en/articles/13930458-set-up-role-based-permissions-on-enterprise-plans", "status": "success", "path": "support/13930458-set-up-role-based-permissions-on-enterprise-plans.md", - "sha256": "de68de88310abb8c800193879743ccc37e19ca7a621eb8dad3c6a9f14caecb34", - "size": 37933 + "sha256": "0ae37c27a46e5f7b91d38289b129e586bc169f7c13b4053e210e0704ecfb185e", + "size": 38971 }, { "url": "https://support.claude.com/en/articles/13947068-assign-tasks-from-anywhere-in-claude-cowork", "status": "success", "path": "support/13947068-assign-tasks-from-anywhere-in-claude-cowork.md", - "sha256": "fece3c9041eb7908c3282d13d8ab36912f1d973585447f6fca1657a735a1cc64", - "size": 9462 + "sha256": "49bb05f6b79afdd1862a481d6fc3cee5fb88bf11e336cf66cbaf4a5a4494afaf", + "size": 9456 }, { "url": "https://support.claude.com/en/articles/13979539-custom-visuals-in-chat-and-cowork", @@ -11356,7 +11398,7 @@ "url": "https://support.claude.com/en/articles/14116274-organize-your-tasks-with-projects-in-claude-cowork", "status": "success", "path": "support/14116274-organize-your-tasks-with-projects-in-claude-cowork.md", - "sha256": "c380ae8860e2bef99866df4c7d72a1145e5d611479db02fb31eefff6b9636203", + "sha256": "7c430fc39e10a1cc6d87ab6be0b5050bb314d9e41f581d0e2241d959c6e41f70", "size": 8395 }, { @@ -11377,8 +11419,8 @@ "url": "https://support.claude.com/en/articles/14233555-set-up-code-review-for-claude-code", "status": "success", "path": "support/14233555-set-up-code-review-for-claude-code.md", - "sha256": "7c84b8d1bfa2258f4096625a1e6900cdc3a837fb95c2caf48069f1a3fdb59057", - "size": 12385 + "sha256": "e703508a64e5fd9861fad3879054b48bc7b6522375f6d4443d7bd29bea61e357", + "size": 12369 }, { "url": "https://support.claude.com/en/articles/14246112-buy-usage-bundles", @@ -11426,8 +11468,8 @@ "url": "https://support.claude.com/en/articles/14499648-how-scim-sync-works-for-enterprise-organizations", "status": "success", "path": "support/14499648-how-scim-sync-works-for-enterprise-organizations.md", - "sha256": "102f2d263a2a843ae283cdc4d693efe2d41d4a13f2881d10392fe53ee9747db9", - "size": 7672 + "sha256": "41349445e188bb3a3ebbe9a4d48f892c78241863547798824a6c36b4a710f116", + "size": 7674 }, { "url": "https://support.claude.com/en/articles/14503520-available-beta-and-research-preview-features", @@ -11538,7 +11580,7 @@ "url": "https://support.claude.com/en/articles/14604842-cyber-verification-program", "status": "success", "path": "support/14604842-cyber-verification-program.md", - "sha256": "3095708ca0c0ce8f2501184a62eb9a581670a66ec96f21702a1341f57eeda999", + "sha256": "f5192b772ab2db36f1c3bb8b883af2132fea8d6fea713e4fc0752fc3814c8da2", "size": 25122 }, { @@ -11650,8 +11692,8 @@ "url": "https://support.claude.com/en/articles/15330088-set-a-default-model-for-your-organization", "status": "success", "path": "support/15330088-set-a-default-model-for-your-organization.md", - "sha256": "9afb7b9802bed33dff44814822614f521e833da4e1389aa01d61632c0b95bf5f", - "size": 11317 + "sha256": "2f36645f52a1b47096edfbb193455119195cba3b936add001f4068e82b802aa8", + "size": 11311 }, { "url": "https://support.claude.com/en/articles/15330651-claude-enterprise-admin-api-reference-guide", @@ -11762,8 +11804,8 @@ "url": "https://support.claude.com/en/articles/15694740-manage-model-access-for-your-organization", "status": "success", "path": "support/15694740-manage-model-access-for-your-organization.md", - "sha256": "00d3edf818e5fbef985cdcebb2bd2aeb17f555aab51a850543827ca335822a85", - "size": 10334 + "sha256": "86f5038945041b2848e818c59d78de621e0ff5f14b6ee02f81e6b12477480db8", + "size": 10332 }, { "url": "https://support.claude.com/en/articles/15707726-using-claude-for-legal-work-privilege-confidentiality-and-how-to-think-about-configuration", @@ -11797,7 +11839,7 @@ "url": "https://support.claude.com/en/articles/15936181-get-started-with-1password-for-claude", "status": "success", "path": "support/15936181-get-started-with-1password-for-claude.md", - "sha256": "e8e690389ede091e4ba78ddfa71fd01ecd6cfb0f68932727c91510a0293908d8", + "sha256": "1d38acb3123c34bd92c9ce049d3f70ef11e32abefcb49d59e1b12e788c07c49e", "size": 5058 }, { @@ -11846,7 +11888,7 @@ "url": "https://support.claude.com/en/articles/16607638-understanding-your-pro-or-max-plan-invoices", "status": "success", "path": "support/16607638-understanding-your-pro-or-max-plan-invoices.md", - "sha256": "fcc2a96e53a0bfc3937f75eff47446faf24396ed0a16b4aa48c8d736eb71c454", + "sha256": "6725dd5990ce2a7dc79c266f42a35db8c99b2cbb816c1f97bdfdf5f55f5f311c", "size": 5832 }, { @@ -11930,8 +11972,8 @@ "url": "https://support.claude.com/en/articles/16893491-get-started-with-smart-reports", "status": "success", "path": "support/16893491-get-started-with-smart-reports.md", - "sha256": "262bb9de7d530519448ebe36d4e522ba657cdabda6f398433fe42e586a2ae27e", - "size": 15499 + "sha256": "6c47be551ba267bfdf99d77ccad35945332ae3528cd86988c7aad1f260f111f8", + "size": 15493 }, { "url": "https://support.claude.com/en/articles/16923645-get-started-with-claude-docs", @@ -11951,7 +11993,7 @@ "url": "https://support.claude.com/en/articles/16951679-use-claude-in-google-docs-sheets-and-slides", "status": "success", "path": "support/16951679-use-claude-in-google-docs-sheets-and-slides.md", - "sha256": "cea738876258e40ccd1a1700a1781a96ac8e3536c4f61883292333d8242139f5", + "sha256": "ce2551f8770925ed8eaa81d487f6a1b7883912b74a14c63cb6f5c7c4faaccf1b", "size": 21894 }, { @@ -11979,8 +12021,8 @@ "url": "https://support.claude.com/en/articles/17005973-manage-pooled-group-budgets-on-enterprise-plans", "status": "success", "path": "support/17005973-manage-pooled-group-budgets-on-enterprise-plans.md", - "sha256": "0f22fe152ef80b4801a5d17b661e17bcec644e2bcc776796d5410f13c7745971", - "size": 6986 + "sha256": "db86dcfe185e9d95a72ae4cf9d1d304cbe7d8020f7dcf2f493a521831f32313a", + "size": 6982 }, { "url": "https://support.claude.com/en/articles/17007452-what-is-a-limit-reset", @@ -12028,8 +12070,8 @@ "url": "https://support.claude.com/en/articles/17203415-set-up-claude-for-intune", "status": "success", "path": "support/17203415-set-up-claude-for-intune.md", - "sha256": "1ac06b912e1325bf62d008e77772a08c184bec09a076535f25216a7d5630e505", - "size": 11371 + "sha256": "768bf6c2a44fc6a6a43dfb3bacd8bfd0ca6fe9a5694fbb2fcc92c64cc8e2f563", + "size": 11379 }, { "url": "https://support.claude.com/en/articles/17318731-use-claude-code-local-mode-and-claude-cowork-local-mode-on-a-hipaa-ready-enterprise-plan", @@ -12042,8 +12084,8 @@ "url": "https://support.claude.com/en/articles/17440474-migrate-from-standalone-claude-design-to-claude", "status": "success", "path": "support/17440474-migrate-from-standalone-claude-design-to-claude.md", - "sha256": "0b078a4b45d1cc14307b3c66f28b1d314a222d8320f975b2655ddaa976ccf150", - "size": 15279 + "sha256": "3297a2c89c2cfe84db4d3dd967da3ccf72ec8a042326ca0fcc2fbf65e33e2d49", + "size": 15293 }, { "url": "https://support.claude.com/en/articles/17444146-claude-haiku-4-5-is-leaving-the-model-selector", @@ -12056,8 +12098,8 @@ "url": "https://support.claude.com/en/articles/17444462-set-up-and-manage-the-new-unified-claude-experience-for-your-enterprise-organization", "status": "success", "path": "support/17444462-set-up-and-manage-the-new-unified-claude-experience-for-your-enterprise-organization.md", - "sha256": "40b56de86e1bc2c29193d28a4f6e5bcb920b3cc42d72ca3183401811276df8e4", - "size": 22016 + "sha256": "e795adf44f99e6129289e42a0ba2c1b1844ee751c5f697cd6c827fe7bf3e99d3", + "size": 22010 }, { "url": "https://support.claude.com/en/articles/17454700-get-started-with-claude-dashboards", @@ -12091,57 +12133,57 @@ "url": "https://claude.com/docs/build/overview", "status": "success", "path": "claude/build/overview.md", - "sha256": "471abc2061074bdc3949a2f555c5a7576189e0d3d989c344a578475347719111", - "size": 9381 + "sha256": "2cdb2e29863749229c3e76f22b3044722fae2c33877f907c372a5d9a8460691b", + "size": 9115 }, { "url": "https://claude.com/docs/claude-science/admin-controls", "status": "success", "path": "claude/claude-science/admin-controls.md", - "sha256": "7cf169e5a9b53ea1c89486f8ed6f81fca83a8dbe2fd1d247a3ee322a274b86e8", - "size": 53449 + "sha256": "6c9f3038408a7e3b4b5ea6be9558169587a31a82c5783281c45fe071471c7979", + "size": 53446 }, { "url": "https://claude.com/docs/claude-science/artifacts", "status": "success", "path": "claude/claude-science/artifacts.md", - "sha256": "4a01c1054d76e6f4c29259e4035e32ee820b2b66d970844234dc2c28bd46c537", - "size": 3527 + "sha256": "56d7dc4187a2e22f099e2d43ed0bce5226e8c5355abc38361e5b72418628948c", + "size": 3524 }, { "url": "https://claude.com/docs/claude-science/changelog", "status": "success", "path": "claude/claude-science/changelog.md", - "sha256": "8984b58ed82ec1cca0136a131152b351a6e5a4426f71ef7d4bddd7e797cbec78", - "size": 22769 + "sha256": "3d98e547eccbb47d1e94c9301bb531143e8b9419dd1a8b1e8978468ff2ad1f94", + "size": 22492 }, { "url": "https://claude.com/docs/claude-science/cloud-storage", "status": "success", "path": "claude/claude-science/cloud-storage.md", - "sha256": "9367eba6afd701b968e1a088b31ba37427e1c9ec253c3c6d15eb03102f43b79b", - "size": 1981 + "sha256": "f8077da2dd05763f9b50cd2f6fa434ded6f1941b58872eeaea6d23c012cf6c84", + "size": 1972 }, { "url": "https://claude.com/docs/claude-science/command-line-settings", "status": "success", "path": "claude/claude-science/command-line-settings.md", - "sha256": "6f9e0aa546ccecc5bb9848b214203ad80c73bcb12b47ca0598d175155535fe69", - "size": 11378 + "sha256": "f0ef156fdfa1963440a00d14d31398d907567c2cc75f4a575416db46ad922824", + "size": 11258 }, { "url": "https://claude.com/docs/claude-science/comments", "status": "success", "path": "claude/claude-science/comments.md", - "sha256": "1cf08f0b44dcdbb6f9e24f639169fd089be2f3308343396a19792ba1450fc70b", - "size": 2708 + "sha256": "8e18d8a66ba47f464bc3f5463fac7a0064781e892559c70cb0b4346b3244a505", + "size": 2705 }, { "url": "https://claude.com/docs/claude-science/compute-providers", "status": "success", "path": "claude/claude-science/compute-providers.md", - "sha256": "67d88f6466d642f810a8ec96d50b136a91caf434925299e0c5086555e96c8e03", - "size": 5095 + "sha256": "0a84ea7a8c4d0479e79a2331a09947db216456e52670572da705a9986e3f9786", + "size": 5092 }, { "url": "https://claude.com/docs/claude-science/configuration-file-reference", @@ -12154,29 +12196,29 @@ "url": "https://claude.com/docs/claude-science/connectors-and-skills", "status": "success", "path": "claude/claude-science/connectors-and-skills.md", - "sha256": "114136a828a73d8f28cd3854a5c9e09132a0ac9c52cd884da3972c7c687b7e99", - "size": 8567 + "sha256": "296f6ab1d177a66e5decfa89cf6576191f1026f3a9f104df8f8d90b86536002f", + "size": 8561 }, { "url": "https://claude.com/docs/claude-science/core-concepts", "status": "success", "path": "claude/claude-science/core-concepts.md", - "sha256": "d3cddb416041080469a95f39711c766ff893ece868f012f741dce346bf06a33a", - "size": 5436 + "sha256": "1dd29283d396f6ee164fc4a8c62c2e20e476a1bda595cfbe8d4a900fb5155fc2", + "size": 5430 }, { "url": "https://claude.com/docs/claude-science/corporate-networks", "status": "success", "path": "claude/claude-science/corporate-networks.md", - "sha256": "68cfbc9fa265ade45cb05f51e682ad2e845bca74401091e5974af957037805ac", - "size": 39495 + "sha256": "3d2a3013e4e6770b349f3fc1c7a21efcf49bbc3d54e65e8ee598795fa60cac59", + "size": 39394 }, { "url": "https://claude.com/docs/claude-science/custom-connectors", "status": "success", "path": "claude/claude-science/custom-connectors.md", - "sha256": "d766adf60f72ebb8f0e8d7fa3734ff389fe87737cf4eb34c51e871c33b9f51d6", - "size": 2310 + "sha256": "9ac3147fbe034a97571292d3e8333c1430a3864dd39a4921e904f869e8ecbfb5", + "size": 2304 }, { "url": "https://claude.com/docs/claude-science/enable-claude-science", @@ -12189,78 +12231,78 @@ "url": "https://claude.com/docs/claude-science/example-gallery", "status": "success", "path": "claude/claude-science/example-gallery.md", - "sha256": "e688ad9ec16511f869b35dc053086b5f21f7d86a376a3fb3bd93db3320007c4e", - "size": 4579 + "sha256": "32c4bf6b39a3612514723d01642e9ec841d675845bf510e4d865edaef1f0c908", + "size": 1595 }, { "url": "https://claude.com/docs/claude-science/example-gallery/bio-drift", "status": "success", "path": "claude/claude-science/example-gallery/bio-drift.md", - "sha256": "4ecf5abcc78fa1b7c6c37278508cd01b381858e199d1a11d47adea7773d7bb02", - "size": 3887 + "sha256": "b0270c2ffbe7896e5db2e4da356f703633d53a72c3f0850d5551a2f3905ddcd0", + "size": 3146 }, { "url": "https://claude.com/docs/claude-science/example-gallery/chem-titration", "status": "success", "path": "claude/claude-science/example-gallery/chem-titration.md", - "sha256": "d35e5b66858393582895b4ecc49a7423d57b805f0bedf49c45ada0af24055b77", - "size": 3718 + "sha256": "bea353e1087e4ae1aa47d4b0cc40bb1f0d527fc529d3def7c9ca03810f2943c8", + "size": 2898 }, { "url": "https://claude.com/docs/claude-science/example-gallery/clin-km", "status": "success", "path": "claude/claude-science/example-gallery/clin-km.md", - "sha256": "012db69781a90dd63ca84a87536d6382472dd9371ec0ab6f3b6e37b500987eec", - "size": 3710 + "sha256": "985cd2461ba2f6e11f04800e9bccc930a05482e45388140ae5dd1fa5144bf96f", + "size": 2972 }, { "url": "https://claude.com/docs/claude-science/example-gallery/cs-pagerank-tiny", "status": "success", "path": "claude/claude-science/example-gallery/cs-pagerank-tiny.md", - "sha256": "1002c6a4f4176ff18b93583779f06cf0f64076148c42eb382c1e2e1bee4e007a", - "size": 4217 + "sha256": "9e6db4547dc302523704c3c1ea6b431d81c440d4d919f7fd902992b60b5f606e", + "size": 3441 }, { "url": "https://claude.com/docs/claude-science/example-gallery/eng-beam", "status": "success", "path": "claude/claude-science/example-gallery/eng-beam.md", - "sha256": "167474c67f6bbfc91184a8c84814098d46dfc5fd85d5006f45bfa293cd4c734f", - "size": 3225 + "sha256": "d83487a405996bd48afb9b39b9e8d4b3c4afc8e29bbcfea2e6b7aaffdf2fba7c", + "size": 2474 }, { "url": "https://claude.com/docs/claude-science/example-gallery/mat-xrd", "status": "success", "path": "claude/claude-science/example-gallery/mat-xrd.md", - "sha256": "362840e1f46ad143819a64688bc1af6ee88d4684acac2680a0de4949bd1d25bb", - "size": 3073 + "sha256": "557a506ac10bba6e9f448b5313342bc274343203911acf5fa07f0595a7898237", + "size": 2397 }, { "url": "https://claude.com/docs/claude-science/example-gallery/math-ulam", "status": "success", "path": "claude/claude-science/example-gallery/math-ulam.md", - "sha256": "429c794d0cf67eadbe2255cd569ef2f9dcceea581462b8d050399196322839c1", - "size": 4114 + "sha256": "233c25e3b2b9c854d1974b9f0c2365d002fb6a5701df403bea619fb478d20b76", + "size": 3356 }, { "url": "https://claude.com/docs/claude-science/example-gallery/phys-doubleslit", "status": "success", "path": "claude/claude-science/example-gallery/phys-doubleslit.md", - "sha256": "b662244aa318727b6b367083b694685a5260010c401939ddc8ce1288ca2b8bbd", - "size": 3856 + "sha256": "0583ec9b27360ff256a82114ffb927fb3a774ce082732f65fddaa54b7138674d", + "size": 3077 }, { "url": "https://claude.com/docs/claude-science/example-gallery/soc-schelling-small", "status": "success", "path": "claude/claude-science/example-gallery/soc-schelling-small.md", - "sha256": "a09b24fce8b785acc3e36209ba548e02779f2300ee9ca478d67eeef81475e93f", - "size": 4313 + "sha256": "d79e3050aee54d714965c95d3d9aeedefbfa004a65c9fd1e31336a47b262b1e9", + "size": 3521 }, { "url": "https://claude.com/docs/claude-science/get-started", "status": "success", "path": "claude/claude-science/get-started.md", - "sha256": "04883cdd352d28a07ce79222fd0e9b2d967b52a5d13e225d047f514f186fd1b6", - "size": 22464 + "sha256": "75141b1fd8353d84f50a44d39141ac77fdff7a61235bdce2e7497f29d9b03dd7", + "size": 21781 }, { "url": "https://claude.com/docs/claude-science/glossary", @@ -12287,15 +12329,15 @@ "url": "https://claude.com/docs/claude-science/literature-access", "status": "success", "path": "claude/claude-science/literature-access.md", - "sha256": "3166f3299625f531690d0c82afd62fc3ac110de6728367bbf84a69329c47dbdf", - "size": 2841 + "sha256": "0d5253054fbf71bd1395b8a857b373251dccf376eda3e6c70f6ca7d3d0247520", + "size": 2838 }, { "url": "https://claude.com/docs/claude-science/mac-app-window", "status": "success", "path": "claude/claude-science/mac-app-window.md", - "sha256": "e06992bcc08e337f7bf75afa652fef348caee3a125b6cc7e30013f4b13766a71", - "size": 3257 + "sha256": "2eacc6549992e521492b8bffb9792809eb3d8ffb09a98624d8f6e31a835089ef", + "size": 3254 }, { "url": "https://claude.com/docs/claude-science/manage-on-devices", @@ -12329,22 +12371,22 @@ "url": "https://claude.com/docs/claude-science/overview", "status": "success", "path": "claude/claude-science/overview.md", - "sha256": "be25499785fa9b643fefb72524232695ae2e73e10dc9f72710b970e4c1787288", - "size": 7507 + "sha256": "c75b5e04a7f051e22c6a52e184e2d491cc9177f71d42f4b94016330551cedc34", + "size": 7504 }, { "url": "https://claude.com/docs/claude-science/remote-compute-clusters", "status": "success", "path": "claude/claude-science/remote-compute-clusters.md", - "sha256": "67610fdfe1450d434a5968c5e8fd52472488681947dc8d0fa01e68fdd56d9115", - "size": 3368 + "sha256": "ecfd335a970aad55f5160601392bd21a9867b07782a10ab296e1c3893e901e2e", + "size": 3362 }, { "url": "https://claude.com/docs/claude-science/run-on-remote-linux-server", "status": "success", "path": "claude/claude-science/run-on-remote-linux-server.md", - "sha256": "0fb4450ef08c8e68a07037e97fe2649ae1eec154b357d78432402ea758976fa8", - "size": 12513 + "sha256": "5fcd97ab2ae57867675baaa6351dff87c6e39c8ef4312ed65d0e699ab307ea1b", + "size": 12507 }, { "url": "https://claude.com/docs/claude-science/safeguards", @@ -12364,617 +12406,617 @@ "url": "https://claude.com/docs/claude-science/tools-and-environments", "status": "success", "path": "claude/claude-science/tools-and-environments.md", - "sha256": "6f388c0d9bae32de21c64f7efcdc9afe262b4ff6aec9cc417fd6fad02bb9db56", - "size": 6938 + "sha256": "ddddaeaf625383e9e0315ee98a24bc4d7e32aaee16264fc3f0b6773f9dac08ff", + "size": 6935 }, { "url": "https://claude.com/docs/claude-science/troubleshooting", "status": "success", "path": "claude/claude-science/troubleshooting.md", - "sha256": "1546f3007453be646871a46874fb8d198077b0ea97c8702051441778a351d31f", - "size": 9475 + "sha256": "aaf618fecab0c4ad3e3f121311900970c0ec425552b9c287ac97414fd29a638b", + "size": 9961 }, { "url": "https://claude.com/docs/claude-tag/admins/add-connections", "status": "success", "path": "claude/claude-tag/admins/add-connections.md", - "sha256": "cf11065fccc23f11a75627f16e45e77a9446099de7759ce7d20f162492ca5348", - "size": 38350 + "sha256": "19315346b157deb305adb1632f00d245ec3a2be2284233275989b8608f3958d0", + "size": 37743 }, { "url": "https://claude.com/docs/claude-tag/admins/attach-to-scope", "status": "success", "path": "claude/claude-tag/admins/attach-to-scope.md", - "sha256": "4e0fd39169e009866f87d36a357921d3eb4d848ff551654810b5673f840a468a", - "size": 24258 + "sha256": "aad35d8dd5d7ff2550ca8c4885fcd1045e712c5483b5a187ad82bbcae2d898bf", + "size": 23155 }, { "url": "https://claude.com/docs/claude-tag/admins/attribute-costs", "status": "success", "path": "claude/claude-tag/admins/attribute-costs.md", - "sha256": "38e393ac3f852d472e63ae1cbeda8d049a8009d58d48ea9cfe4e56c15caa19c9", - "size": 4852 + "sha256": "c5e9da6d72cc980ab77d91b8a5a99acdf46b37f0012ad5c17dc1767e87f22c45", + "size": 4808 }, { "url": "https://claude.com/docs/claude-tag/admins/audit", "status": "success", "path": "claude/claude-tag/admins/audit.md", - "sha256": "b8d9c76426a2e2dd7437ad19fa3b270b977e739c4775fddd1416d6138f3ae7e2", - "size": 4542 + "sha256": "6bfffbc1522e400bc1fb1375b4cd6e482a0e51b484a198479ad421ee4aa3a6fe", + "size": 4498 }, { "url": "https://claude.com/docs/claude-tag/admins/configure-github", "status": "success", "path": "claude/claude-tag/admins/configure-github.md", - "sha256": "b847592e34a31e5cc23c3d3d3e917149861122ffcf80263972f8f5fe9b7b56a8", - "size": 17711 + "sha256": "89835e576cff7cdfd089ef44194faeb1ecaa7b94b555b8162b32d70abe2b8a5d", + "size": 17369 }, { "url": "https://claude.com/docs/claude-tag/admins/configure-gitlab", "status": "success", "path": "claude/claude-tag/admins/configure-gitlab.md", - "sha256": "e52816514ac40c31f16164e315cbdb8980f8819d4ec74d623d01eeb500a75058", - "size": 7296 + "sha256": "be159dd59afe53c8285558116ba394c04f5873afd1059258a207f002f3cb27af", + "size": 7144 }, { "url": "https://claude.com/docs/claude-tag/admins/connections/amplitude", "status": "success", "path": "claude/claude-tag/admins/connections/amplitude.md", - "sha256": "0642fd4fb69d98da8d4cf5b02dd017b2a2d7bbcb5aec05f58144039926fa1775", - "size": 12236 + "sha256": "e1ab6c440a6ab6c096e51d285beb37a4fa3b81683c8a6fa7ab107577ac3c9c47", + "size": 11955 }, { "url": "https://claude.com/docs/claude-tag/admins/connections/asana", "status": "success", "path": "claude/claude-tag/admins/connections/asana.md", - "sha256": "e0e0de1201e10cf838ea634a7c7133c5fe0b6a09120999e8a0ff27ce0852559c", - "size": 3010 + "sha256": "51ddf3f4e26217b33a6c091949971d4e53d8c12f5b377f070eac59f67f3bd4de", + "size": 2966 }, { "url": "https://claude.com/docs/claude-tag/admins/connections/atlassian", "status": "success", "path": "claude/claude-tag/admins/connections/atlassian.md", - "sha256": "0b1be26c1c49ac5355c7fa702f303f6a0b5c44aff202b221b7c357d6633e1454", - "size": 6493 + "sha256": "f4765be28ff9b5a0de7c7148a16984f10ee7973b2016904f0911527d82372f4f", + "size": 6342 }, { "url": "https://claude.com/docs/claude-tag/admins/connections/bigquery", "status": "success", "path": "claude/claude-tag/admins/connections/bigquery.md", - "sha256": "8c785d5b0becbb1ffc6ae699a5e78b80b0b794ce1da1e1459ee505c7ddef0b5e", - "size": 6406 + "sha256": "a00836832b60a4180c69e14a25dd4cf00a2f10ad7e7d6f6dc04eeb83eb5c1aa2", + "size": 6362 }, { "url": "https://claude.com/docs/claude-tag/admins/connections/custom", "status": "success", "path": "claude/claude-tag/admins/connections/custom.md", - "sha256": "b4656b76478ee3f88da0242632fa4e750533242d5d3108e46f8e164d3f2ada0a", - "size": 13533 + "sha256": "8642f23bc976649097d0dcb5c99f87162cd228bb593a5c0de48e512d6712f2aa", + "size": 13385 }, { "url": "https://claude.com/docs/claude-tag/admins/connections/datadog", "status": "success", "path": "claude/claude-tag/admins/connections/datadog.md", - "sha256": "b8b964eb5e6ef80dd92b0f825699aa8d24faeecbcdc68a55157be57e28f40c78", - "size": 4564 + "sha256": "3bf0b18701ba2b19b949ee9a2a77673cd2f2b3296b5f8d1291195c21f1d86fee", + "size": 4520 }, { "url": "https://claude.com/docs/claude-tag/admins/connections/gitlab", "status": "success", "path": "claude/claude-tag/admins/connections/gitlab.md", - "sha256": "e3a1d47e483b012655f20bc72dee40f7e8f07742e12b5216ed3ac2b6f42a91e8", - "size": 4619 + "sha256": "4e0dd1773427881d892dfaf46dd4b9446fde0129fa3eb21a06bc4bed83cc40e0", + "size": 4514 }, { "url": "https://claude.com/docs/claude-tag/admins/connections/gong", "status": "success", "path": "claude/claude-tag/admins/connections/gong.md", - "sha256": "761dfe84aae2e5acbba42f1000637d050cbdd95044928ae7fe3b1dd2d2deec6e", - "size": 3170 + "sha256": "a219ceec8d603d2a2d63a1f837f57e06001dbfb24285c9f1fff2bb3647772b22", + "size": 3126 }, { "url": "https://claude.com/docs/claude-tag/admins/connections/google", "status": "success", "path": "claude/claude-tag/admins/connections/google.md", - "sha256": "0e727ca8b53afd88754900d204b5d9f2ad4ea2e711008ffcbe093cecc5791f59", - "size": 6034 + "sha256": "925fec72fbef7c298a51c941df3075e4773064918ef7dcd5bb66756baae8f600", + "size": 5988 }, { "url": "https://claude.com/docs/claude-tag/admins/connections/hubspot", "status": "success", "path": "claude/claude-tag/admins/connections/hubspot.md", - "sha256": "255092d965c9ae45d73213f1d8b27181c9285ef12bab7cac0b829db894e3490d", - "size": 3016 + "sha256": "2dc236525c1f219bd3a6bea8113bf2cb326f0e443371e4d8d10c5034b4cb923e", + "size": 2972 }, { "url": "https://claude.com/docs/claude-tag/admins/connections/linear", "status": "success", "path": "claude/claude-tag/admins/connections/linear.md", - "sha256": "130d2611ab59e5c106a1d939cbc582aa625c7652ea6d64c87de80ca7018423ee", - "size": 3071 + "sha256": "ce29b894cb90f934582dc346a577b071211741dc9fb2a6b89a49b26268edc96e", + "size": 3027 }, { "url": "https://claude.com/docs/claude-tag/admins/connections/notion", "status": "success", "path": "claude/claude-tag/admins/connections/notion.md", - "sha256": "c7833bfd0b4ae51b8c847a11f7bcff46c5c74ec3eabad3e967622908d8da044d", - "size": 2948 + "sha256": "e298e49f0a140497168031374d77a01f4c2ed3ead455fe9e7ead85f5d20cc5ed", + "size": 2904 }, { "url": "https://claude.com/docs/claude-tag/admins/connections/overview", "status": "success", "path": "claude/claude-tag/admins/connections/overview.md", - "sha256": "a16e1a236e3ea0b882605d92dc83d0b02eb10785c0f5540e78f0bb76693f917c", - "size": 4695 + "sha256": "60b1a273a46cf252fbc1b3fdc22382360a4842c11d152d6dce549e72ecc4b262", + "size": 4649 }, { "url": "https://claude.com/docs/claude-tag/admins/connections/pagerduty", "status": "success", "path": "claude/claude-tag/admins/connections/pagerduty.md", - "sha256": "a3f2a1599892aa41ba89660c6f14bd10848da90d586f2e27fab24fa2295ddf66", - "size": 3333 + "sha256": "6359b8933f8a50abf2fe67384985d935b243baae8cf5e0fcdfb4c294e333acac", + "size": 3289 }, { "url": "https://claude.com/docs/claude-tag/admins/connections/salesforce", "status": "success", "path": "claude/claude-tag/admins/connections/salesforce.md", - "sha256": "4dd9e5de3d7b6b221a26719bc11e62a66ebfab241a084a875f41b0b7dac71032", - "size": 3667 + "sha256": "89014a4b17953d05115ec755f40b99d54d493962960370c3a0e33d8bf25bc910", + "size": 3623 }, { "url": "https://claude.com/docs/claude-tag/admins/connections/sentry", "status": "success", "path": "claude/claude-tag/admins/connections/sentry.md", - "sha256": "674e3ddd5c1c1b3ba4525956d57193cd91b47efde843086485132164a94c08fd", - "size": 3119 + "sha256": "f418706ac8106b02fb3194dd88d786360780433c2f6ccdf766ecbbd27824bfce", + "size": 3075 }, { "url": "https://claude.com/docs/claude-tag/admins/connections/snowflake", "status": "success", "path": "claude/claude-tag/admins/connections/snowflake.md", - "sha256": "97e2cdd331a3fcf9d09c7f5cd3bf5e0cc763821a98f5bbb5cd6f3b3cf1ec0f76", - "size": 3602 + "sha256": "124fb4a0247393cf78df100c1aa83bf33c2fdf74fce061ad9a171822c9522c17", + "size": 3558 }, { "url": "https://claude.com/docs/claude-tag/admins/connections/stripe", "status": "success", "path": "claude/claude-tag/admins/connections/stripe.md", - "sha256": "ce6a8146a5534716dfe9646e04cab5b6fa6182b596eb20aa917c305d7cde9e75", - "size": 2776 + "sha256": "cc2a6e29fd23af108b3b358a37c335e8997e3d71a1bfcaa05750bdc5e3627e04", + "size": 2732 }, { "url": "https://claude.com/docs/claude-tag/admins/connections/vercel", "status": "success", "path": "claude/claude-tag/admins/connections/vercel.md", - "sha256": "3019d70a7ba3b70b9742a0b1a7711f851449ba2c1ed32d08805e42873409a9e6", - "size": 2651 + "sha256": "12fe1734207022ae79f03b7f7a8243b3915860fe035b16197c46af1eeaaedacb", + "size": 2607 }, { "url": "https://claude.com/docs/claude-tag/admins/customize", "status": "success", "path": "claude/claude-tag/admins/customize.md", - "sha256": "2cc7cf553b448ae49c07d3bd9704e856a54115a007ebdc6ca4b77867dbf45455", - "size": 24390 + "sha256": "8c01444887a28a19501d1e2ff4bc5d8e79d62e3dd1d5f2db912d26b029cc86e0", + "size": 24188 }, { "url": "https://claude.com/docs/claude-tag/admins/federated-access/authorization-server", "status": "success", "path": "claude/claude-tag/admins/federated-access/authorization-server.md", - "sha256": "f009c1bd746a7760dc7746dfa1a6d6f0d978de7481308b576249fedda2096d38", - "size": 19596 + "sha256": "2d1d00e7a118d0e12103abd9f6c6e053b9e3f4ebc8609b2be8ecb1787e57b1ee", + "size": 19436 }, { "url": "https://claude.com/docs/claude-tag/admins/federated-access/aws", "status": "success", "path": "claude/claude-tag/admins/federated-access/aws.md", - "sha256": "2b88a58a864bac4c7cf42920397a3f88ffa7cb984739ab76cb374036163c0327", - "size": 16102 + "sha256": "5011d2bf53b2755935686426b361c4e364cdeffcb26d35f67c0f4c73301207e8", + "size": 15741 }, { "url": "https://claude.com/docs/claude-tag/admins/federated-access/connect-a-gateway", "status": "success", "path": "claude/claude-tag/admins/federated-access/connect-a-gateway.md", - "sha256": "4186fc9795c049c407da63fb56302110e3bc84f059c969aef4d2f6a433ee7b3d", - "size": 14641 + "sha256": "7555d2615446a1e3ccdeb65cf2fb8dd261efb6edb80f0db59d4b057f97b9e5ce", + "size": 14466 }, { "url": "https://claude.com/docs/claude-tag/admins/federated-access/gcp", "status": "success", "path": "claude/claude-tag/admins/federated-access/gcp.md", - "sha256": "13bfe75a9bcfbe92500a4e065c1ce328f9b85f40916eafa9adbdcbf2249e2afb", - "size": 19101 + "sha256": "f9f6efbb2dde8f515d8096f6b99f70da99c279d3a37eb7f0099428fc7ea4591b", + "size": 18864 }, { "url": "https://claude.com/docs/claude-tag/admins/federated-access/limits", "status": "success", "path": "claude/claude-tag/admins/federated-access/limits.md", - "sha256": "c30b8edf6d010999ce8d81b462c0450f7505af275a45396926af06a1d461f4df", - "size": 12503 + "sha256": "6528a8bb9c6fd552881c519ed8f651d68ef419728a9e7db757ecca98902ba6eb", + "size": 12459 }, { "url": "https://claude.com/docs/claude-tag/admins/federated-access/overview", "status": "success", "path": "claude/claude-tag/admins/federated-access/overview.md", - "sha256": "313e86e8c742f1bc67dde6703fe7f5e1210060bb05d7af7d23606eebd17a8bfa", - "size": 11987 + "sha256": "a4c345c37a48c3028525353777adcc5243bf9d840cb35a784c8d97a2fcc67139", + "size": 11944 }, { "url": "https://claude.com/docs/claude-tag/admins/federated-access/token-reference", "status": "success", "path": "claude/claude-tag/admins/federated-access/token-reference.md", - "sha256": "00696aa928e85338f8d0ab26398b87fdc566f4a0a4a3bf14db33a539eb9339ef", - "size": 13118 + "sha256": "03e7544827e33365841f0c5c4b361d8d162aa2cf01443f30ce096704169c81ac", + "size": 13075 }, { "url": "https://claude.com/docs/claude-tag/admins/federated-access/troubleshooting", "status": "success", "path": "claude/claude-tag/admins/federated-access/troubleshooting.md", - "sha256": "8e214597807c577b3412d0b360093cc95e50ecaa7716d535d2b980e04040b8fb", - "size": 42859 + "sha256": "0b70a9d4a8e34a2b83a9f32f42a938a4c74a3ec4ac8b0f12ec34f2a1a34fd5e4", + "size": 42816 }, { "url": "https://claude.com/docs/claude-tag/admins/for-slack-admins", "status": "success", "path": "claude/claude-tag/admins/for-slack-admins.md", - "sha256": "8d2a407c59d66ddaa2f67c129c4d1643c540d055f804af4aa39a90df69b70521", - "size": 6464 + "sha256": "6f5cc89a8a86ef538c6b514c90316a0ce26c531a2a21ed98eaf88ad8ae93e313", + "size": 6420 }, { "url": "https://claude.com/docs/claude-tag/admins/healthcare", "status": "success", "path": "claude/claude-tag/admins/healthcare.md", - "sha256": "f344fb1d89a47b16777e3622398d279b85ebf69902f5f5de9dc7a896da124d16", - "size": 14330 + "sha256": "62276b691b1f8405fd6f864eedb47760f1c373ab641103a074a0ef02fb11e4d3", + "size": 14154 }, { "url": "https://claude.com/docs/claude-tag/admins/managed-by", "status": "success", "path": "claude/claude-tag/admins/managed-by.md", - "sha256": "710278d8c7c0d5a75dc3abf2d8aa60ed936567def9f03679007414bf742ba028", - "size": 20065 + "sha256": "b1cd66f5ceedcdaf8df119db387af676a4ca89841c4c4c5b9d5e85025f5f294e", + "size": 19692 }, { "url": "https://claude.com/docs/claude-tag/admins/migrate-from-earlier", "status": "success", "path": "claude/claude-tag/admins/migrate-from-earlier.md", - "sha256": "501d8bd6cca36ad32935c5e7503cc5fb004917268f3f4935e9bc3053c9d23bb2", - "size": 8832 + "sha256": "fb372ff42edf75a37ce713eb77960d3639d3c1222a0f2aabac629b6ffdfae03a", + "size": 8662 }, { "url": "https://claude.com/docs/claude-tag/admins/network-requirements", "status": "success", "path": "claude/claude-tag/admins/network-requirements.md", - "sha256": "0153a6729040dec773fb3a730d58a560ad93575f1eadf51f06bf7f1160a79391", - "size": 3942 + "sha256": "dc1b26025c4c90bfe0ca0be8346d46237ed75c46b0303afc85d8b62fbc162dc8", + "size": 3897 }, { "url": "https://claude.com/docs/claude-tag/admins/restrict-access", "status": "success", "path": "claude/claude-tag/admins/restrict-access.md", - "sha256": "cb31c82efcaf159fdb5da1f3820d915ae72f6d63d500859a53eb463e250660c5", - "size": 68312 + "sha256": "feb0db865f017a8ca6d694fe19fa1bd5c96dbd80e2814618014d2ae444803758", + "size": 67888 }, { "url": "https://claude.com/docs/claude-tag/admins/set-spend-limit", "status": "success", "path": "claude/claude-tag/admins/set-spend-limit.md", - "sha256": "c43d3a13cbe2fc490439d381490f427057243fc05b6cd8696d645a45bde2740b", - "size": 9713 + "sha256": "f285ec2e27b22f104f896629e31661df07b4d6caa86ea29eeabbd3d8ef8eba6e", + "size": 9606 }, { "url": "https://claude.com/docs/claude-tag/admins/setup-oncall", "status": "success", "path": "claude/claude-tag/admins/setup-oncall.md", - "sha256": "89c2b333a79a909b0fae35fce7db21aee7f8c18a09e2153bf1ba0385bf073a7f", - "size": 6600 + "sha256": "297d7802862cb6d0770f37dddb3998249f9e360e41ff23e4a2dd199ff16b8a34", + "size": 6556 }, { "url": "https://claude.com/docs/claude-tag/admins/setup-overview", "status": "success", "path": "claude/claude-tag/admins/setup-overview.md", - "sha256": "04fed81f66f605e5b1faf70a72970456398732966a9bad712998576e105b6542", - "size": 25336 + "sha256": "ef54b70bef159367349519085e58b519af20418dc5025fee185adb524f867206", + "size": 24818 }, { "url": "https://claude.com/docs/claude-tag/admins/skills-repo", "status": "success", "path": "claude/claude-tag/admins/skills-repo.md", - "sha256": "2a7ebd28d08c4fd8d2d5c67e782bae8309a0027b8cf9c6bf7ad24499d5ad3c38", - "size": 8191 + "sha256": "ed6f8de56ba22f3559760cbd7c01e200c05cbf61ff42bd15b45c8c3047b74a81", + "size": 8034 }, { "url": "https://claude.com/docs/claude-tag/admins/troubleshooting", "status": "success", "path": "claude/claude-tag/admins/troubleshooting.md", - "sha256": "db3983ebb716cdad6b23e692883e7c128c8c6f32f0dd8eb2a2c6c124a6a93a9c", - "size": 64776 + "sha256": "293b7e8b9896305247a34ceaade9ca47d307820d4b578ebb07b191b4be060a53", + "size": 64688 }, { "url": "https://claude.com/docs/claude-tag/admins/workspaces", "status": "success", "path": "claude/claude-tag/admins/workspaces.md", - "sha256": "cde1904158cbe7d6cc75afb59f076f342e4d28c5d0cad34f21228bac2a6aa145", - "size": 17422 + "sha256": "fd448681eec14dac43d1fd4fa7e5ce17423281939d91a42e3c7c3d11c4c2c10b", + "size": 17196 }, { "url": "https://claude.com/docs/claude-tag/concepts/agent-identity", "status": "success", "path": "claude/claude-tag/concepts/agent-identity.md", - "sha256": "f8806c5f650f73ddc436566b5f428a49891701d4c90f1707a4e0f4c51f4b2074", - "size": 18002 + "sha256": "7eec217cf0935b792ec11e31c1b53269ca15418e633bc496383caf9f96bd414e", + "size": 15835 }, { "url": "https://claude.com/docs/claude-tag/concepts/data-lifecycle", "status": "success", "path": "claude/claude-tag/concepts/data-lifecycle.md", - "sha256": "33399e04a0584d803e97d260b7aaff5e9c44dd80e4bc258b647edf8f6f8f0053", - "size": 17388 + "sha256": "7bc7f7952c57a12ce08ba8e08565a625cf9f95b27ba15fc423bcbe01c65694c4", + "size": 17344 }, { "url": "https://claude.com/docs/claude-tag/concepts/for-claude-code-users", "status": "success", "path": "claude/claude-tag/concepts/for-claude-code-users.md", - "sha256": "ce644842490012a7f3aafd02719d0118c4bcbdc68a2e7ced4d939e94d3b3df58", - "size": 10255 + "sha256": "c32efacf6532365d48735ccef30f1230e8156a7eed431381f632646a2b6c5680", + "size": 10211 }, { "url": "https://claude.com/docs/claude-tag/concepts/glossary", "status": "success", "path": "claude/claude-tag/concepts/glossary.md", - "sha256": "0e5f0db43a69ed258776fa13ab43f9e6522d3d80877bb70821793f916df4a5ab", - "size": 8563 + "sha256": "65e5fed6b59332b79cbfaa0e169791440fcf4e5abb574ce874b317122dbbeb3f", + "size": 8470 }, { "url": "https://claude.com/docs/claude-tag/concepts/how-it-works", "status": "success", "path": "claude/claude-tag/concepts/how-it-works.md", - "sha256": "8bac4b594ea9cbeec2a69c2bedf91c7d6b80beb3a96c392845615f1be1f56975", - "size": 34289 + "sha256": "d595f56d48d4ac197104003617c4f490d0c9f99ce383ccb5c7d646f6103b16fb", + "size": 29495 }, { "url": "https://claude.com/docs/claude-tag/concepts/personal-connectors", "status": "success", "path": "claude/claude-tag/concepts/personal-connectors.md", - "sha256": "375be1954d5f39a359dd23782beebc77725fa4a0f46816bd6599233f89006db8", - "size": 10776 + "sha256": "7e3aae8f1b25bcfc3b9b455ee9797470915b9ce160825bd0f44b4688c54c9650", + "size": 10732 }, { "url": "https://claude.com/docs/claude-tag/concepts/security-and-data", "status": "success", "path": "claude/claude-tag/concepts/security-and-data.md", - "sha256": "f857370cac532bd3bac991d05dbe416c5521aa0e660e0853c28b8828cc00615e", - "size": 20158 + "sha256": "4d2e7fca89f94376d59d571c0790737f843693d815e6cd552221f9af51c63329", + "size": 17988 }, { "url": "https://claude.com/docs/claude-tag/concepts/settings-map", "status": "success", "path": "claude/claude-tag/concepts/settings-map.md", - "sha256": "a59e48acc0ba63120104ecbdb467f5ee226de484053c810e476db8bbcea904af", - "size": 11517 + "sha256": "e0ab4dd6de976a1fb592dc533e088a724ddf9f380494da30d5739f057505f3ee", + "size": 11473 }, { "url": "https://claude.com/docs/claude-tag/overview", "status": "success", "path": "claude/claude-tag/overview.md", - "sha256": "19a46fee4d7428709b0d1d7498fa6e896cd41523f05f954b96e83b5db5628f50", - "size": 17258 + "sha256": "667c33c2a03dca2bb886e11e642b7fa43e4a06cea742192daa7b7985b273fae5", + "size": 12229 }, { "url": "https://claude.com/docs/claude-tag/users/commands", "status": "success", "path": "claude/claude-tag/users/commands.md", - "sha256": "b215e2512b593ff6ffea181280f82166472389686e8bf70530aa71117f5f3dbc", - "size": 14085 + "sha256": "6afeddc9cda77e46db6a58c3fabe7fc8ffcadc0d8564595125adbc6e3a57cd6f", + "size": 14041 }, { "url": "https://claude.com/docs/claude-tag/users/getting-started", "status": "success", "path": "claude/claude-tag/users/getting-started.md", - "sha256": "96326566322a1c342dd0d1cc74dfebfa8d1b8e3768aabdf936843f34c5e75455", - "size": 11674 + "sha256": "c7c2ece467d38896e12f74114299a4e268af3ebdcc964679f9bcbebca290e99e", + "size": 11631 }, { "url": "https://claude.com/docs/claude-tag/users/good-habits", "status": "success", "path": "claude/claude-tag/users/good-habits.md", - "sha256": "58629852e44ef47b8aeb34b161dd074d5341bb4aef7d280b3815fd4ed48f3c56", - "size": 20434 + "sha256": "f3f04c03acd707b449125ebe97adb4f965ffe32e51902c8d87603d7d079f4588", + "size": 20386 }, { "url": "https://claude.com/docs/claude-tag/users/group-dms", "status": "success", "path": "claude/claude-tag/users/group-dms.md", - "sha256": "d4cc3067bd5bbcbabb723e8e6b9beb7b734f0c7db9017a39b6ebb63e5fd8fb7f", - "size": 7991 + "sha256": "238012356e5628706c8b9bfda3516915ff9e54cdbd9b86080ae15015fcedbc03", + "size": 7868 }, { "url": "https://claude.com/docs/claude-tag/users/memory", "status": "success", "path": "claude/claude-tag/users/memory.md", - "sha256": "afd219383f38b8243cb4390df5d47dcfb9d378b0a685bf9f603b0d3a376094d8", - "size": 5678 + "sha256": "24abe6fbddf93d7465d777c88842dc4e183c973f5c08b62ccba0319b6be09276", + "size": 5634 }, { "url": "https://claude.com/docs/claude-tag/users/models", "status": "success", "path": "claude/claude-tag/users/models.md", - "sha256": "8575dfbde3586bbd227acdc106ed3beafc935e2d9c2da86d44d1e4c3e9ab55d7", - "size": 6936 + "sha256": "b4d8b61040b3fc5d3a6f85ec99ba280c6d22c05fe6c830e2ecf9a581ce6a845b", + "size": 6892 }, { "url": "https://claude.com/docs/claude-tag/users/proactivity", "status": "success", "path": "claude/claude-tag/users/proactivity.md", - "sha256": "3daa82529f28304ccf1e3581a914b124f2909775fc0c8a090665cd4bce261705", - "size": 9880 + "sha256": "62401189120008ef48559268dee075a5b77b0dae3041bf281fdf5515fafc58f0", + "size": 9836 }, { "url": "https://claude.com/docs/claude-tag/users/prompt-library", "status": "success", "path": "claude/claude-tag/users/prompt-library.md", - "sha256": "c8600fe2d27eb73a27d9036df71d66151924c23dbd64ab6d1a1e09293f76ed3f", - "size": 10336 + "sha256": "297fb0de4e438413a0eb303c024953fd76100e34410298030479da91a8718349", + "size": 10292 }, { "url": "https://claude.com/docs/claude-tag/users/troubleshooting", "status": "success", "path": "claude/claude-tag/users/troubleshooting.md", - "sha256": "b203ceace52397f599aeee0b46062acbcc4d671d93f17e244ee00398b20cb107", - "size": 46434 + "sha256": "985f1b085d6cb9ec5714ec44cc5cacbe7bab39fcdb20c34be411dfe5fe208012", + "size": 46313 }, { "url": "https://claude.com/docs/claude-tag/users/use-cases", "status": "success", "path": "claude/claude-tag/users/use-cases.md", - "sha256": "fc3cf886c0dd74bca76e9379f2e8f1a9646afbd744bfce578e38749f5a3b04b8", - "size": 5743 + "sha256": "cd93e7bbb46d1fc67cc6ec15c8a46b7e307fa62cb9edd9eb8e471d8d1464f3f9", + "size": 5700 }, { "url": "https://claude.com/docs/claude-tag/users/use-cases/answer-data-questions", "status": "success", "path": "claude/claude-tag/users/use-cases/answer-data-questions.md", - "sha256": "df2d75b93aaae73391cf7a0fc1860d584006761dc790686e8344cf33dcc26d68", - "size": 3373 + "sha256": "000efa3d840d9c328bc6f6676e23ddb6b21d3ed74e7b8896c624a1556e4dc34c", + "size": 3169 }, { "url": "https://claude.com/docs/claude-tag/users/use-cases/catch-up", "status": "success", "path": "claude/claude-tag/users/use-cases/catch-up.md", - "sha256": "8fc0333e5ea6ee8d796234a23c2629e37922f72161f7ca8768099954a5a3c65a", - "size": 2590 + "sha256": "f143992f4cd77532e65e90dc7adbc788820bb5cd69526222eb25aa815903d8a2", + "size": 2428 }, { "url": "https://claude.com/docs/claude-tag/users/use-cases/create-artifacts", "status": "success", "path": "claude/claude-tag/users/use-cases/create-artifacts.md", - "sha256": "b9027f88caa931c22037f5c9870fb1ffc4a40acdeb482289462e73d0ae27ea23", - "size": 5097 + "sha256": "d2701e84ee1207c18d039b98f85f99df31942a01a20015a766bdf6cadd1cb596", + "size": 4935 }, { "url": "https://claude.com/docs/claude-tag/users/use-cases/find-answers", "status": "success", "path": "claude/claude-tag/users/use-cases/find-answers.md", - "sha256": "b5563cc7c8e7d6c2741eb9a13c58c81c2662f7bb6d9e72b696aab3c86966b856", - "size": 2972 + "sha256": "cec248c3f49c2d8e41cfffbbb91dd3ad764b45762d6527066ea286ae7c004fbd", + "size": 2810 }, { "url": "https://claude.com/docs/claude-tag/users/use-cases/fix-bugs", "status": "success", "path": "claude/claude-tag/users/use-cases/fix-bugs.md", - "sha256": "b929c4e08df7af0a4b4b940ae25512260f99a8febf194513f61fad1d08d0b15c", - "size": 5131 + "sha256": "f87be30e1c4e48a6f64611536266468fb12479fc94de18d22d35a9da313f263c", + "size": 4969 }, { "url": "https://claude.com/docs/claude-tag/users/use-cases/marketing-team", "status": "success", "path": "claude/claude-tag/users/use-cases/marketing-team.md", - "sha256": "be5c02569bfd02b3d1e5c1eab363db3a5cf3ce95977ebdcec5dbfb70b353b14a", - "size": 7508 + "sha256": "f8e0e40c3f1da8d8493c6172651c04559efbaa2a9a4ff832a43990b34d8579a9", + "size": 7346 }, { "url": "https://claude.com/docs/claude-tag/users/use-cases/pull-deal-state", "status": "success", "path": "claude/claude-tag/users/use-cases/pull-deal-state.md", - "sha256": "3612f2db0469f988c1712529d081c465daa60ef3c4b84ef4c5a25b2d8743131c", - "size": 3344 + "sha256": "63bdd777118ec52d4fe81a5ab621220f2a54746bb044763dad38eac435b82e4c", + "size": 3182 }, { "url": "https://claude.com/docs/claude-tag/users/use-cases/review-documents", "status": "success", "path": "claude/claude-tag/users/use-cases/review-documents.md", - "sha256": "54fddb77b60b9e5daefd56d71d8685f98413b2d51e8d26eda67837d618880d18", - "size": 4911 + "sha256": "8e3398642c90c0965c67b18e582c10820f5d8952cb08ec0a2bd9ef839508b635", + "size": 4749 }, { "url": "https://claude.com/docs/claude-tag/users/use-cases/track-projects", "status": "success", "path": "claude/claude-tag/users/use-cases/track-projects.md", - "sha256": "e1574d72c5b69dc6291e9332dbdca51215bc14a93def6a167c29e9544f3a5bd8", - "size": 3742 + "sha256": "8e06d41749c8e44778c684aa6a34e8ad8ce17934066fbf33aa64a9d653649f84", + "size": 3580 }, { "url": "https://claude.com/docs/claude-tag/users/use-cases/triage-requests", "status": "success", "path": "claude/claude-tag/users/use-cases/triage-requests.md", - "sha256": "477b4a39e09386a2d98ecf4c2fb41677fb3bc93925d1f1a4182952ed67a63f25", - "size": 6477 + "sha256": "40d02acfdbdd63ee7c4dc865c74c2c654a5c799d922ab49b56bdd9e5be0aa250", + "size": 6228 }, { "url": "https://claude.com/docs/claude-tag/users/use-cases/watch-monitors", "status": "success", "path": "claude/claude-tag/users/use-cases/watch-monitors.md", - "sha256": "e33d0174432543d778f3378c51de4c7f52e8eb850dc869ad3b3721d93e3c6398", - "size": 4118 + "sha256": "7c71fe29fe320899b2f5472db705d4493dd2ee994cfe0bdede87f294a9155be0", + "size": 3872 }, { "url": "https://claude.com/docs/claude-tag/users/use-cases/work-with-github", "status": "success", "path": "claude/claude-tag/users/use-cases/work-with-github.md", - "sha256": "c2be4f26b22bb9865c392de8f4f0ad733368d213078d4e788efd79f9a2167fab", - "size": 10167 + "sha256": "00df2ad9842831b9315c13a20b712b97d70cc1067830afe39069bf24a32e44b5", + "size": 10005 }, { "url": "https://claude.com/docs/claude-tag/users/use-cases/your-own-channel", "status": "success", "path": "claude/claude-tag/users/use-cases/your-own-channel.md", - "sha256": "430f8ea3ee00e056576795ef361f1ed30f5e968fde4f12e105561d50129dfb44", - "size": 9344 + "sha256": "6eb2653943840f1f0d792f7df79a9608c8213ebb880373980b6584d7bf38bd05", + "size": 9182 }, { "url": "https://claude.com/docs/claude-tag/users/when-claude-responds", "status": "success", "path": "claude/claude-tag/users/when-claude-responds.md", - "sha256": "46b392de95f31a780c0956df2c6d8c8e8ee5cd9cf20e4d36ce218f4378c7f7bc", - "size": 17222 + "sha256": "ff9d28c08014cb36035f0e0ea20db5323b466c473660b341396851edc2fe36f0", + "size": 17175 }, { "url": "https://claude.com/docs/connectors/building/after-publishing", "status": "success", "path": "claude/connectors/building/after-publishing.md", - "sha256": "e1d080e42292e7b8c10ac4b20d06d062259cccb22e5f73f63c537a3a36a3bff9", - "size": 5806 + "sha256": "0048fd40b055fab9e6d56c8d174162e7124c1ec6730b72cb9da69a72e62f11c0", + "size": 5803 }, { "url": "https://claude.com/docs/connectors/building/authentication", "status": "success", "path": "claude/connectors/building/authentication.md", - "sha256": "7d96f0eda4297ab0ea76da8b3ab62011ae5134ac7e1c22f65817945020605cc7", - "size": 26018 + "sha256": "667ffbc1b39c6b0584fbb0361b021037702ee7a610d5139c49dd8bff46da4f67", + "size": 26010 }, { "url": "https://claude.com/docs/connectors/building/directory-vs-custom", "status": "success", "path": "claude/connectors/building/directory-vs-custom.md", - "sha256": "c1d66a8d49c902a075b3d46b8cd818afa48967a441cbf45bcf6a38fdc7c29f42", - "size": 6444 + "sha256": "bd2dfe286dad890e4215c09b12b871f64eeaebfcbc5cb7831e3b3e086b80ae62", + "size": 6438 }, { "url": "https://claude.com/docs/connectors/building/enterprise-managed-auth", "status": "success", "path": "claude/connectors/building/enterprise-managed-auth.md", - "sha256": "605450551aa28bdd0635ebcaa6334485704664ae39d86fc9066d45e718caa969", - "size": 16511 + "sha256": "2ec53b00de34061b75b2b7dd80124e70465fadd0b24310279416f76d87f602b0", + "size": 15153 }, { "url": "https://claude.com/docs/connectors/building", "status": "success", "path": "claude/connectors/building.md", - "sha256": "c28d75fe514557cd8734bc8e4524e11907d08c6bc37fbfbab1516004025a2ee3", - "size": 9498 + "sha256": "1d250ad0cf02b1194b531d0203fb64a2539205b23904e835329d3ce420da46fd", + "size": 9493 }, { "url": "https://claude.com/docs/connectors/building/lazy-authentication", "status": "success", "path": "claude/connectors/building/lazy-authentication.md", - "sha256": "35b6f3c3dd5502e38db429d89d8be85a87cd9416ec326719f0d2060169fdd346", - "size": 22428 + "sha256": "591153ec4c3582184323d5d3828b348ccc6975ff529adf39d732fcf67f846707", + "size": 22156 }, { "url": "https://claude.com/docs/connectors/building/managing-your-listing", "status": "success", "path": "claude/connectors/building/managing-your-listing.md", - "sha256": "591ef446f02fe4e69a4bfccb9b16ba73875413528fd4c9da24b812cf5033669b", - "size": 8007 + "sha256": "20be2f9388c3b493e06d906ca7561adaaa83c63d35a88e5d5a575ed2c89efe70", + "size": 8001 }, { "url": "https://claude.com/docs/connectors/building/mcp", @@ -12987,22 +13029,22 @@ "url": "https://claude.com/docs/connectors/building/mcp-apps/design-guidelines", "status": "success", "path": "claude/connectors/building/mcp-apps/design-guidelines.md", - "sha256": "c8596ee4035c1728c2322823a5c7f80a87ce72b4ddd666cece541309b40c1e73", - "size": 25095 + "sha256": "0ce430db716c50613c10b4a879736a39cdb1abf74f953ceb05105046b5da22b9", + "size": 23422 }, { "url": "https://claude.com/docs/connectors/building/mcp-apps/external-links", "status": "success", "path": "claude/connectors/building/mcp-apps/external-links.md", - "sha256": "3891e31af34f64122bbdc343eada9431196edfdeb89188da9bff40a5adeec4fe", - "size": 4865 + "sha256": "9adc1e5f20d433ca95df55b19a81a7f6605b0de54226dde08be4c15f5d2baa21", + "size": 4862 }, { "url": "https://claude.com/docs/connectors/building/mcp-apps/getting-started", "status": "success", "path": "claude/connectors/building/mcp-apps/getting-started.md", - "sha256": "69371b977e77c4b79025f350d41ef2c44841d6b144935dc6865fe8b43232f320", - "size": 8792 + "sha256": "ee26191a3a8b68a87a5fd131e3695fac73d6bd3fd2d5b282902f978dbe006c61", + "size": 8381 }, { "url": "https://claude.com/docs/connectors/building/mcp-apps/instance-supersession", @@ -13015,281 +13057,281 @@ "url": "https://claude.com/docs/connectors/building/mcp-apps/quickstart", "status": "success", "path": "claude/connectors/building/mcp-apps/quickstart.md", - "sha256": "e6684587dac14824fe9117abf176e4552bcd3f4b5e0f8163fb1d207d29d11adb", - "size": 19933 + "sha256": "53cd6320312a91d7caea17eb7efc822020923bafaa1f36b7e756722466f423a7", + "size": 19262 }, { "url": "https://claude.com/docs/connectors/building/mcp-apps/transparent-theming", "status": "success", "path": "claude/connectors/building/mcp-apps/transparent-theming.md", - "sha256": "6871e6f274731eef7d20e9ade4148dc8889c5c89b1c36bddc21c8235d6539682", - "size": 10057 + "sha256": "9567e28244bace2f3f96ac78f3bc2e01e93b783d28a4a09b5d38c00b80dac5ff", + "size": 9965 }, { "url": "https://claude.com/docs/connectors/building/mcp-apps/troubleshooting", "status": "success", "path": "claude/connectors/building/mcp-apps/troubleshooting.md", - "sha256": "7c622c6add02d54529d598f902f55c2fb85179aa8616ce3ee3abb67e4aa18eb1", - "size": 8905 + "sha256": "45efda55ba030cef541301ecf89649cf652ffc431000fca727593d7677b5bcf4", + "size": 8748 }, { "url": "https://claude.com/docs/connectors/building/mcpb", "status": "success", "path": "claude/connectors/building/mcpb.md", - "sha256": "3e87ac0b65adef7bfc3a02f1ecdf33ab83284b03013200a425686983cd0d0166", - "size": 10432 + "sha256": "80e253f133cd8401e795d2dfd0ef0071a4fcb10c61ccc9b70e51bd3035061ef8", + "size": 10267 }, { "url": "https://claude.com/docs/connectors/building/quickstart", "status": "success", "path": "claude/connectors/building/quickstart.md", - "sha256": "1c3661e014a04fa9267af0f7bab3302023f27dab48fe605c909dd8b7a832558e", - "size": 15096 + "sha256": "f810c42a11c79e28a87e0cae28f0e30f39d0517a62e05921bd163e207ec82223", + "size": 14468 }, { "url": "https://claude.com/docs/connectors/building/review-criteria", "status": "success", "path": "claude/connectors/building/review-criteria.md", - "sha256": "c8521becdba1f64bf7beb7b29eff422aabecd232b596f4ac31e42ddcdeec603c", - "size": 7086 + "sha256": "6f678a99193d43f73a3c9089a17206113e72c5ef77a54301dbb68113d8b2cd1a", + "size": 7083 }, { "url": "https://claude.com/docs/connectors/building/submission", "status": "success", "path": "claude/connectors/building/submission.md", - "sha256": "0ccee5f9ee8d397103ffb318c06d171a6fea41287fa7d236248d9cc64d583148", - "size": 14201 + "sha256": "ec4826fdc88c008af8fbd7c578fe44c317055adf1735cd189a4599c4fac4157d", + "size": 13942 }, { "url": "https://claude.com/docs/connectors/building/testing", "status": "success", "path": "claude/connectors/building/testing.md", - "sha256": "b72d96fec0414e4310a7453d02f7d57dbf1c359a41f39d776e4ba4d61f2bd818", - "size": 6987 + "sha256": "50be1e28a6d35e9e65176ae6834d6a77d704a8f5285c1f9db2ca397f081b5b8a", + "size": 6981 }, { "url": "https://claude.com/docs/connectors/building/troubleshooting", "status": "success", "path": "claude/connectors/building/troubleshooting.md", - "sha256": "52fb8ec398815e1a73d4549d520880b182af2988a58d8aa5e489675e88116f5d", - "size": 20179 + "sha256": "7e98b50d86a514ed25787f52c7399b834b80113525cb0d2926e2dc712236d752", + "size": 19826 }, { "url": "https://claude.com/docs/connectors/building/what-to-build", "status": "success", "path": "claude/connectors/building/what-to-build.md", - "sha256": "5c163988cb09fd45865b580e7ada1e99cf442531c2143f83ed7e990f316bb662", - "size": 7777 + "sha256": "ca46fcf281dd40d0d3f7ab7f2b6345ae49a032296b661b67a77863fb16b7ade4", + "size": 6735 }, { "url": "https://claude.com/docs/connectors/custom/add-unlisted", "status": "success", "path": "claude/connectors/custom/add-unlisted.md", - "sha256": "55769e148a50c4be1dc27a6c636d0e228222e787b162daeb62243716e841cf00", - "size": 14927 + "sha256": "b385a6edf47299ae7fedfe07e8a17914f273e1ee07d4e17f7504ef6dbc81b033", + "size": 14261 }, { "url": "https://claude.com/docs/connectors/directory", "status": "success", "path": "claude/connectors/directory.md", - "sha256": "b8ea87cd24dfb4db494e19ce03255a839afd8253a3a48f9ae2e4697241cc5353", - "size": 5716 + "sha256": "04758a71f4df19d1aa21e2cbb2eb0c2b192c2f7a37f05ac69d7b3fc6601d372f", + "size": 5627 }, { "url": "https://claude.com/docs/connectors/getting-started", "status": "success", "path": "claude/connectors/getting-started.md", - "sha256": "08b7394574668d561627db70ed3e845d8d44032f762172593746752294ee6c03", - "size": 8237 + "sha256": "8e77735e93f26ec0b4ff97120a1010b42866329246e0a26f0da10a889fbfd020", + "size": 7984 }, { "url": "https://claude.com/docs/connectors/github", "status": "success", "path": "claude/connectors/github.md", - "sha256": "0b7f9927ce99e10626b48a4f3663324c020430559aaf8c6ef10afdf894b9e269", - "size": 8104 + "sha256": "917c1d5053bd46639e882fe7fef07f880cb1347d7189f66876b3f9616f31a8ed", + "size": 7614 }, { "url": "https://claude.com/docs/connectors/google/calendar", "status": "success", "path": "claude/connectors/google/calendar.md", - "sha256": "fca642dcc8fd9ac4bfeeef830df299cd1a5871a93499bd762634961e8fb2b1f6", - "size": 3804 + "sha256": "730e9ba37f333dc96556880b657592fc532a28a340dc79015e2072f79e4898fa", + "size": 3715 }, { "url": "https://claude.com/docs/connectors/google/drive", "status": "success", "path": "claude/connectors/google/drive.md", - "sha256": "ab18b8a6545acbce36d60106e734cba6a5faa61f8cbf4ed7eddff113b8c898ff", - "size": 7178 + "sha256": "fe6747b1353d9424762d3f965ab6b82a14c563f2610604f8360378b73155a709", + "size": 6731 }, { "url": "https://claude.com/docs/connectors/google/gmail", "status": "success", "path": "claude/connectors/google/gmail.md", - "sha256": "f5de5c19be56d9b622ad0afb46fe1c06681d09a99ca6a23790b0cbdd7f65b414", - "size": 3794 + "sha256": "a43c13b1bc509f16a03e6ad5601d38c588990b54f3d09c131cc4975b30573650", + "size": 3705 }, { "url": "https://claude.com/docs/connectors/mcp-tunnels/oauth", "status": "success", "path": "claude/connectors/mcp-tunnels/oauth.md", - "sha256": "5b1ffb8242a209410bffb69d1739b0e92d61932ccec5514e4dd50ba106266690", - "size": 8577 + "sha256": "2a2b54ab42fdeed3db3809d28f9577595b61a860fe7913f3e1ffb743ec5a7cb2", + "size": 8571 }, { "url": "https://claude.com/docs/connectors/mcp-tunnels/overview", "status": "success", "path": "claude/connectors/mcp-tunnels/overview.md", - "sha256": "3ee95244245c8b9a49a2235c640a61fe92fefe9883709da7c573f9f54d56d1f9", - "size": 9576 + "sha256": "82e66414d15ae824addecbd001432837b4a5f4e419d6bd324dbeaa50168ad821", + "size": 9567 }, { "url": "https://claude.com/docs/connectors/mcp-tunnels/setup", "status": "success", "path": "claude/connectors/mcp-tunnels/setup.md", - "sha256": "680545e9fae0691bd9ed651e6c3108cbe529d1a225dce45cb5a2c57b9509366f", - "size": 22685 + "sha256": "14cae1394fd3f875cef245a71c2219116cf38da6459357f8cb87d5f57a2bee57", + "size": 19684 }, { "url": "https://claude.com/docs/connectors/mcp-tunnels/troubleshooting", "status": "success", "path": "claude/connectors/mcp-tunnels/troubleshooting.md", - "sha256": "7f6af3579110638f62492c1f2ff45300c98935b99445e9c16a8e56dfc87bcaca", - "size": 11289 + "sha256": "2c6496637ce27be4c3d16b6b8abe98c7e3ad6f085725f66ae29a8c760953f37f", + "size": 11130 }, { "url": "https://claude.com/docs/connectors/microsoft/365", "status": "success", "path": "claude/connectors/microsoft/365.md", - "sha256": "c2c8d867e4a0408dea297e5481197e66c9724346fb600144252339ef12955647", - "size": 12338 + "sha256": "bba8730f101f333cb2fd6e21eac48a58e650ec264daa2e3e16be72ece9dd005a", + "size": 11807 }, { "url": "https://claude.com/docs/connectors/slack", "status": "success", "path": "claude/connectors/slack.md", - "sha256": "5a10924c7e06ad4e59092f7ca80de7a9c73d1166d8d142979917b0a61ee2fb97", - "size": 6697 + "sha256": "b278a6c5523b2010543d988662423a254078ef04e301e44140882c472f0d977d", + "size": 6278 }, { "url": "https://claude.com/docs/connectors/verification", "status": "success", "path": "claude/connectors/verification.md", - "sha256": "e9826c9b5a3f1eea64f37b77a6aa28691f95903eee68c2b1816f53ed951e48e6", - "size": 4949 + "sha256": "e1a48309ab1aa989b85c2c0e5a2dae42aef728fec308d59311c742846d98170a", + "size": 4946 }, { "url": "https://claude.com/docs/cowork/changelog", "status": "success", "path": "claude/cowork/changelog.md", - "sha256": "2d4650b1ed65774e275087c5d644e1f12b3351dca93747fd5818fe9f2200949e", - "size": 215901 + "sha256": "3a69de5621ede8403bc462a7a9178b1526378ef34091e83a922ebf3999eb4b29", + "size": 218556 }, { "url": "https://claude.com/docs/cowork/guide/dispatch", "status": "success", "path": "claude/cowork/guide/dispatch.md", - "sha256": "7a4d67ce9f1910426d69364caef3d05414b166984797d0f61f3c55fac5cb326a", - "size": 4454 + "sha256": "83d1682009444a680921448cc5c7ea542890c83e4721b6d9464351bd5f9b2a05", + "size": 4258 }, { "url": "https://claude.com/docs/cowork/guide/plugins", "status": "success", "path": "claude/cowork/guide/plugins.md", - "sha256": "cd65416b0cc1a730901169f06fbc867fc7b91e8af687731942f174f37a4d725e", - "size": 5595 + "sha256": "678eed10de113982a3568e8bc4e04368a38854992c7f758da2fd2be9a54904e0", + "size": 5414 }, { "url": "https://claude.com/docs/cowork/guide/projects", "status": "success", "path": "claude/cowork/guide/projects.md", - "sha256": "d88cb5094bafe48bab63630a2e96b74bfd5cadf8bbd7dae431ef02498d859031", - "size": 4100 + "sha256": "7bcf521cad01d2a4f20a8edf9a75f0e03e998034a77ed7a980e6d9d24c591c63", + "size": 3998 }, { "url": "https://claude.com/docs/cowork/hipaa-setup", "status": "success", "path": "claude/cowork/hipaa-setup.md", - "sha256": "d759adbe1567f0ee86085ac3f2c405dd9bc2518b5a2c5a9049b499564338ab13", - "size": 25041 + "sha256": "b6bf34449fbb83e8ade6515e08a10b79fce4881300c0f60d822bf665a9a71bcc", + "size": 24691 }, { "url": "https://claude.com/docs/cowork/monitoring", "status": "success", "path": "claude/cowork/monitoring.md", - "sha256": "eaf7fc4f1eb5b7878c4a4db7c1a10c3cd27cb3a17d60642c518f7ca9c9678608", - "size": 14228 + "sha256": "140044d0b7da10f20f720606f4b6326205874f124e6c1144d98d56886175f2b9", + "size": 14216 }, { "url": "https://claude.com/docs/cowork/overview", "status": "success", "path": "claude/cowork/overview.md", - "sha256": "ee17379064e39337723b0553a128ca4938ac73febb0251c30d7d8079c9d24cee", - "size": 2288 + "sha256": "48eaaec11a3083786299613a2c01885819d57ff7fb56c499b404b1161b7ba5be", + "size": 2081 }, { "url": "https://claude.com/docs/directory/publish", "status": "success", "path": "claude/directory/publish.md", - "sha256": "7350d9d0249b82c478ca4533859a2b02713c6bc171aaad5193ccc3f508642901", - "size": 11279 + "sha256": "6e83057caf22e3a4074e886edc8778a0ddc93a67a6020dc1fa76f1d3cb46029e", + "size": 11182 }, { "url": "https://claude.com/docs/directory/submission-status", "status": "success", "path": "claude/directory/submission-status.md", - "sha256": "495e3a1d87ff6a20d49310ad032dcddd059cd1d912517f9d52e6a2e7b0c2487f", - "size": 6741 + "sha256": "ad83b766e735ea8d9564cee6910131a6c3071c2687910a59ef50d0beb5730826", + "size": 6738 }, { "url": "https://claude.com/docs/extend/overview", "status": "success", "path": "claude/extend/overview.md", - "sha256": "57c1bd8bd76072ee0902351dac83e1f5e0ea18a65c5c2fb93a7bed4e74c4c083", - "size": 6660 + "sha256": "0d8a909d79aa3180918a45678d2485baea71855e5a4a9810fd107d7e452e1021", + "size": 5431 }, { "url": "https://claude.com/docs/government/account/overview", "status": "success", "path": "claude/government/account/overview.md", - "sha256": "1a27b68308aae8af9a8c67b192bd8e7afb434d55e3ca805ad6b0a9c129ccadb9", - "size": 5380 + "sha256": "89e4bb1767b9c68943a164a65f09baebbb7e17eb21247080007b1a5ffae9d9c1", + "size": 5081 }, { "url": "https://claude.com/docs/government/account/profile", "status": "success", "path": "claude/government/account/profile.md", - "sha256": "cf540c0552c94450d4bc6832d9b8dcfd22f4621ceadc88a2817eab86c9dbd682", - "size": 5005 + "sha256": "32564f16552693f992f2209b8b01b5c2a612a4291a0f5512e9262c7013ae1843", + "size": 5000 }, { "url": "https://claude.com/docs/government/account/sessions", "status": "success", "path": "claude/government/account/sessions.md", - "sha256": "133d2237d565f5275178a342de0ca39d545e775178a66aa54137a3032828959a", - "size": 5793 + "sha256": "0bcc087672b607741685899d752f7e15e4eab948c9297754e73df652db8df89a", + "size": 5788 }, { "url": "https://claude.com/docs/government/account/usage", "status": "success", "path": "claude/government/account/usage.md", - "sha256": "e0b238a8fb28d44364fabaae42520be600c7862beb9465b17a30a547b780458d", - "size": 6666 + "sha256": "a1dab3b7e8834186c98493364af4e2d37b9e7c664f4a4bd1bba40d8a78326228", + "size": 6658 }, { "url": "https://claude.com/docs/government/changelog", "status": "success", "path": "claude/government/changelog.md", - "sha256": "6204724be52ce7d98b1d0c1c4810d005aad507393818b90d92d612dbdba7dcbf", - "size": 14850 + "sha256": "378cbfe06fdae929c601b4e84601e1ca4c0157c94cd21c95a509914a2d4ff6e9", + "size": 14807 }, { "url": "https://claude.com/docs/government/config/overview", "status": "success", "path": "claude/government/config/overview.md", - "sha256": "1f1ab4b216653f5e93517f81d08dfbd5ee0e8bf3b64746ad840aa8f7d982c9db", - "size": 16999 + "sha256": "477008a7ab1dac91f32074ed6318236e1488c1b1f835e5244e7bf75f15329b54", + "size": 16746 }, { "url": "https://claude.com/docs/government/config/plugins-and-connectors", @@ -13302,36 +13344,36 @@ "url": "https://claude.com/docs/government/config/settings", "status": "success", "path": "claude/government/config/settings.md", - "sha256": "354d4bb82fb5b839bbf632010b624ca406a63b139f4401746eaa5b319fa3a155", - "size": 39273 + "sha256": "fe33a82cb5c17f6da14477eab49d9d299b4700e6e76b2198d1b1b5c688e11386", + "size": 40031 }, { "url": "https://claude.com/docs/government/connectors/microsoft-365", "status": "success", "path": "claude/government/connectors/microsoft-365.md", - "sha256": "55718b9c8e46dc1cc4616f0117b8f407283aadd8d3ca1abdce13682940e65676", - "size": 22571 + "sha256": "149915497021d517605a2b01e890489a7f41af9fc9c47ba5f652f2ae0b52a5ca", + "size": 22316 }, { "url": "https://claude.com/docs/government/connectors/overview", "status": "success", "path": "claude/government/connectors/overview.md", - "sha256": "3cd57372e8367a22f0325e300e2465275f99c76cdb074e20eebd0ad64053a17a", - "size": 12133 + "sha256": "574372a9804aa8b111d75954b5991469d67f2b2820be11de01d4d541d31c4920", + "size": 11877 }, { "url": "https://claude.com/docs/government/deploy-claude-code/configure", "status": "success", "path": "claude/government/deploy-claude-code/configure.md", - "sha256": "8770004fe829957188b38068ba54aadf555c2ae0418cb3a2d0d94ce4d91447f9", - "size": 20006 + "sha256": "22a930a72dc2df0e399845ad7cd4b6ecfaa0bf9c39e8c7de94645a3a8036cd39", + "size": 19899 }, { "url": "https://claude.com/docs/government/deploy-desktop/configure", "status": "success", "path": "claude/government/deploy-desktop/configure.md", - "sha256": "0ab7aec445a1791c53c2b3b4853575982a7a606dff3aa58202c6035df87eb508", - "size": 44997 + "sha256": "242713fff6aa06a05b7fe9205c083b6b15587fdcd7015e8c445c8aebb66bdc1d", + "size": 43815 }, { "url": "https://claude.com/docs/government/deploy-desktop/windows-checklist", @@ -13344,29 +13386,29 @@ "url": "https://claude.com/docs/government/deploy-microsoft-365/configure", "status": "success", "path": "claude/government/deploy-microsoft-365/configure.md", - "sha256": "39730a8d0900698dc4d36ac625738649b7d7e3196c1c2f41529eae4ba704f018", - "size": 11759 + "sha256": "ab4968aad85b5bdb77b56dc411d7e6f699c94e2fcb8e7c74b181166719714c17", + "size": 11317 }, { "url": "https://claude.com/docs/government/desktop/import", "status": "success", "path": "claude/government/desktop/import.md", - "sha256": "ed70bcbd509552e4f0e72fac3f55742e2842ef045714dab2843a961b16659fb0", - "size": 10127 + "sha256": "84a12995e41245ac15910f1c3d20bd0b5b96dcd408d8766085fa15551b6df7ef", + "size": 9404 }, { "url": "https://claude.com/docs/government/desktop/models", "status": "success", "path": "claude/government/desktop/models.md", - "sha256": "b48d9c4e6c916818e1b650395590e2d8bd8d1225a0e18f09e04ee8ee43b66d4d", - "size": 2779 + "sha256": "4d9437b9ac02741879caa93a7610182532ec051ec1b24a70157b4579ed84c981", + "size": 2776 }, { "url": "https://claude.com/docs/government/desktop/plugins", "status": "success", "path": "claude/government/desktop/plugins.md", - "sha256": "e75a93da3bc7a762ffc052fea28e7917e2ff045280037c7dab126f5726bc9767", - "size": 5699 + "sha256": "0cda289939d462c0496e18eb8c6179802f5f67df9ca3feb8ea402f9aa5d5929c", + "size": 5438 }, { "url": "https://claude.com/docs/government/desktop/skills", @@ -13379,8 +13421,8 @@ "url": "https://claude.com/docs/government/desktop/video-walkthroughs", "status": "success", "path": "claude/government/desktop/video-walkthroughs.md", - "sha256": "242e6e0eb296d1d497a6ff741e440927343c659f8c8539350dd3609f87a48385", - "size": 13003 + "sha256": "4da7bb886a5dc21e6e68bd9f586be32ec3adeb7301b45eca0ef1274d25b1f226", + "size": 11562 }, { "url": "https://claude.com/docs/government/moving-from-web", @@ -13393,22 +13435,22 @@ "url": "https://claude.com/docs/government/org-admin/analytics", "status": "success", "path": "claude/government/org-admin/analytics.md", - "sha256": "60061c7468c1ea258fad79482a3d3b06d024147adbc7ef7ef74c865648ae3cf1", - "size": 8965 + "sha256": "55c29825a02815c241358807ee3c8877aa4eece6ee95238dd50af3448437565f", + "size": 8960 }, { "url": "https://claude.com/docs/government/org-admin/billing", "status": "success", "path": "claude/government/org-admin/billing.md", - "sha256": "bfee1446abe5d9a378d15a6da520ec66e30dc8b616a0c201653945437d105d3e", - "size": 4262 + "sha256": "f9936fdbfbf3fd3826359b031642dfb244e822c22469b771c53360362d68acde", + "size": 4254 }, { "url": "https://claude.com/docs/government/org-admin/compliance-api", "status": "success", "path": "claude/government/org-admin/compliance-api.md", - "sha256": "b456da6fd07a7c8a96a4eae456bee49a175d7e3652ba6d417bdafd5e61a6ea24", - "size": 10805 + "sha256": "61ea736e18b1c6569e1e63f5f20656d16ed549bae9a6bac3d22ee703e5974ace", + "size": 10774 }, { "url": "https://claude.com/docs/government/org-admin/configuration", @@ -13421,15 +13463,15 @@ "url": "https://claude.com/docs/government/org-admin/overview", "status": "success", "path": "claude/government/org-admin/overview.md", - "sha256": "ac38a2cbcf101b4789af8a78cb0f920200630c91211d0c97a1e3758715b34e4f", - "size": 8766 + "sha256": "8b741e6f69a18ebe8aa66c24dece710085923de438b7f795ce356b62b5ede96d", + "size": 8431 }, { "url": "https://claude.com/docs/government/org-admin/provisioning", "status": "success", "path": "claude/government/org-admin/provisioning.md", - "sha256": "3cd5b75aa4db8bc1c8cd8d53d791230a7e3c44d6912a23e5a05eea8fb9c55863", - "size": 5446 + "sha256": "4f78b40f1dc4320448f9effa44968bdea697fd06301c26b8be602096771e082a", + "size": 5437 }, { "url": "https://claude.com/docs/government/org-admin/readiness", @@ -13442,15 +13484,15 @@ "url": "https://claude.com/docs/government/org-admin/seat-tiers", "status": "success", "path": "claude/government/org-admin/seat-tiers.md", - "sha256": "602ce4d3625f5cca3bde5d598cb042f2748e3350dd560d65c7e6f07bfb525eb8", - "size": 6967 + "sha256": "441ac8a473eb0aab9e5d4d31ad779fee8a0e89667a8a1e2c46e153c47e13b44a", + "size": 6958 }, { "url": "https://claude.com/docs/government/org-admin/seats", "status": "success", "path": "claude/government/org-admin/seats.md", - "sha256": "d2409fa572ab8a06b43660513e7c1dd4c04a6089155a43ba29d949d08448b723", - "size": 5895 + "sha256": "5b61fb65baf2d77d9118c514612f7875f3a37ab23550fcdbc469ac8468b4c5eb", + "size": 5888 }, { "url": "https://claude.com/docs/government/org-admin/setup-wizard", @@ -13463,29 +13505,29 @@ "url": "https://claude.com/docs/government/org-admin/users", "status": "success", "path": "claude/government/org-admin/users.md", - "sha256": "997cc8d5152937663322d1621a2a488241f37db865dda0ffe647331f6a8f7b53", - "size": 8037 + "sha256": "d60870e75c7953081972a02d9300c29e596154490d080d4a858fed1cfaab9af0", + "size": 8019 }, { "url": "https://claude.com/docs/government/overview", "status": "success", "path": "claude/government/overview.md", - "sha256": "7c0e3cc8a096ee71578477f2aa75b0cea9e631a4e61a842f7aecf1ede3dcf735", - "size": 10825 + "sha256": "43ffc9d8422a599ecba0c577bbad55a1957dad3e6375227d8873e6bb49901bad", + "size": 10574 }, { "url": "https://claude.com/docs/government/security/security-and-data-handling", "status": "success", "path": "claude/government/security/security-and-data-handling.md", - "sha256": "0fad3ffc2842f805db6f552ba942cd63d7ae342554168cac17208cebf95d2473", - "size": 45054 + "sha256": "d90451c0eb57371ad4ab480af68173b2bc16397d921b1d70763a255fe9b57d04", + "size": 44197 }, { "url": "https://claude.com/docs/government/tenant-admin/admins", "status": "success", "path": "claude/government/tenant-admin/admins.md", - "sha256": "3ae2b546d9ccb198bd5208940f8a18c953f48dd2da9fe1adcd3061bbac876efe", - "size": 3489 + "sha256": "d9f294d06cd99e57773046f9739fdd49451c28baf9e2bc8911e8fc4ea091703c", + "size": 3483 }, { "url": "https://claude.com/docs/government/tenant-admin/configuration", @@ -13498,29 +13540,29 @@ "url": "https://claude.com/docs/government/tenant-admin/credits", "status": "success", "path": "claude/government/tenant-admin/credits.md", - "sha256": "5a5a3f741567a5fa1d1ede62a5ce9848959773be54bb689bb3d14fc4bccdb2e7", - "size": 4428 + "sha256": "8e6fd27e1b0923a06105c32fcf1ceefc65da4760d05ccd6fe21bf2810b24fe8a", + "size": 4422 }, { "url": "https://claude.com/docs/government/tenant-admin/identity-and-access", "status": "success", "path": "claude/government/tenant-admin/identity-and-access.md", - "sha256": "5e1ce29d16a86552cad7def58af4f287e798f06e6c62edebcb31881507ed6b5b", - "size": 24552 + "sha256": "5852693f6e3f64c9ce3f09524c4c2e19deae04efe5c47cc3e886a765d2962c5b", + "size": 23945 }, { "url": "https://claude.com/docs/government/tenant-admin/organizations", "status": "success", "path": "claude/government/tenant-admin/organizations.md", - "sha256": "f47c3cd50aa979b1f9bec7a02862c16e37dee991a140940f272e46416e30ba7c", - "size": 5741 + "sha256": "a93b80e45ff5c88541db1dcd19a9ee56d32f011cf487620a517d302cc812817b", + "size": 5736 }, { "url": "https://claude.com/docs/government/tenant-admin/overview", "status": "success", "path": "claude/government/tenant-admin/overview.md", - "sha256": "6ad5eb831e05d39c13016bd7881c9d23de097576d1be52d065ad72d499aa71f2", - "size": 6702 + "sha256": "1f52492b3f2431b4aee972e2e87d7a0036144b2692f12326919db5a09b6018ff", + "size": 6696 }, { "url": "https://claude.com/docs/government/tenant-admin/readiness", @@ -13533,71 +13575,71 @@ "url": "https://claude.com/docs/government/tenant-admin/seats", "status": "success", "path": "claude/government/tenant-admin/seats.md", - "sha256": "51ed8ed606b3554d74112e84efb24fbd0b630de8d2d2f4c5d623ca235c92a849", - "size": 5538 + "sha256": "3fa4464c2ee88029ca7f67f7ad7fe17d2f0c91d91856a2d532bf30e05246171a", + "size": 5535 }, { "url": "https://claude.com/docs/government/tenant-admin/setup-wizard", "status": "success", "path": "claude/government/tenant-admin/setup-wizard.md", - "sha256": "e4c7a90bc35f1989591c115e53b1b2264af259205706755dc67c628628f57c74", - "size": 14871 + "sha256": "b78a55c1bd3a1df8e1a360e69f0b21b5b3788bca96b7e319254f9b347be63946", + "size": 14572 }, { "url": "https://claude.com/docs/government/tenant-admin/tenant-restrictions", "status": "success", "path": "claude/government/tenant-admin/tenant-restrictions.md", - "sha256": "076f5e6a5e6ae0382840dc5e980a55c3cf17ee0b5825878a2821af6b47c424d2", - "size": 8004 + "sha256": "361d21793d2c5f8f416c1b4121f603522e9127b6e09cca69cdf3c1ed139eb020", + "size": 7995 }, { "url": "https://claude.com/docs/government/video-walkthroughs", "status": "success", "path": "claude/government/video-walkthroughs.md", - "sha256": "0d1d3a41fb23757a2816c15e341d4ed01882931df0149f8486ffd2b0e7d29495", - "size": 25186 + "sha256": "82da0480c963a301d693c05398f8e0b9d56b2894247d7b9cab1cd4d765cb3f96", + "size": 22389 }, { "url": "https://claude.com/docs/office-agents/connectors-and-skills", "status": "success", "path": "claude/office-agents/connectors-and-skills.md", - "sha256": "50277010a8d83a9ceaaac540aa83b40926d435578486d9433e361d5911f81f2d", - "size": 2446 + "sha256": "ce32e981efe0c990ea1f1f71dcc3634fc7986d782f70fc0fac79c5f329b6f131", + "size": 2437 }, { "url": "https://claude.com/docs/office-agents/data-storage", "status": "success", "path": "claude/office-agents/data-storage.md", - "sha256": "6f11e399242638ff0be8e615304d76ca43ffa775151bc096e6c19c5fc5efa605", - "size": 30501 + "sha256": "6895e1929a2b60287c6c37ad9a611b22954cbc45cda04498b56ebdf079ce01e1", + "size": 30184 }, { "url": "https://claude.com/docs/office-agents/dictation", "status": "success", "path": "claude/office-agents/dictation.md", - "sha256": "3c84d176b576b4d54ad7c5a4ecb81dcf227d7f3f0a6f0cd82466afb04232fd50", - "size": 2548 + "sha256": "f671fa71ed17dfd393db5497345882efbba8ea047ea623f657a47f0c6f562ea9", + "size": 2452 }, { "url": "https://claude.com/docs/office-agents/enterprise-readiness", "status": "success", "path": "claude/office-agents/enterprise-readiness.md", - "sha256": "4597701876c95c89481ff24ce9fcd9e126b092839895e7f5c45344376bb485c1", - "size": 5594 + "sha256": "0370d1a04f1e11251b1f775c754cfa93c5adefb9f7c9aca1c383472398b3d514", + "size": 5591 }, { "url": "https://claude.com/docs/office-agents/excel", "status": "success", "path": "claude/office-agents/excel.md", - "sha256": "1c7ff871b984f1bbf72ec71b5ef9bdfa1f80d3ce424df097459048e77161fb94", - "size": 11278 + "sha256": "dc33827b6ad7e7b907b536c49b20e67246e09f17403ce47e6ce22f1ea6221607", + "size": 11055 }, { "url": "https://claude.com/docs/office-agents/fsi-plugins", "status": "success", "path": "claude/office-agents/fsi-plugins.md", - "sha256": "ca8c9b1f53b52de6513650c99a32dcfbeab3e4cf6a786f30cbbbc65c3db56010", - "size": 4873 + "sha256": "2f24b81dc35357fb0fb06f8e48d4035d845e7c9987b02d70104b63f386f03bed", + "size": 4672 }, { "url": "https://claude.com/docs/office-agents/opentelemetry", @@ -13610,8 +13652,8 @@ "url": "https://claude.com/docs/office-agents/outlook", "status": "success", "path": "claude/office-agents/outlook.md", - "sha256": "98f3b99900d46110fb53e99b14e86855ecb296648e16059053e8eea5b28514e9", - "size": 21292 + "sha256": "9c6f62a35c852ad758cb40bd7391ae39eaef3a3d812e952112336e61d88adcfa", + "size": 20408 }, { "url": "https://claude.com/docs/office-agents/overview", @@ -13624,148 +13666,148 @@ "url": "https://claude.com/docs/office-agents/performance", "status": "success", "path": "claude/office-agents/performance.md", - "sha256": "32a453b9b357c1b85cb4dda1259a484bcfe80369b36d068fe7ac6c76a2fdb26d", - "size": 29065 + "sha256": "077e87c22a6721d184bfad3679c0197c903eef24795aef310ea694641de8239f", + "size": 23054 }, { "url": "https://claude.com/docs/office-agents/powerpoint", "status": "success", "path": "claude/office-agents/powerpoint.md", - "sha256": "241698685827ce99b72a288f2375d743925381afd459caf7d6c1ec741e5cd96c", - "size": 13464 + "sha256": "f2a91b5c3d55d815a57aba1a35b584c4b999de4bc34b323fe4d7287238e518ef", + "size": 13079 }, { "url": "https://claude.com/docs/office-agents/third-party-platforms", "status": "success", "path": "claude/office-agents/third-party-platforms.md", - "sha256": "907b0e061f6a50e0e0204e2aa5836c8f50ea0db8360d3a8901ca6610935ecbf7", - "size": 57544 + "sha256": "b1f405fe845ec65609b3adc7cf8a89e846179d40aae0a212f5ca3d0b25a6ef0d", + "size": 56125 }, { "url": "https://claude.com/docs/office-agents/word", "status": "success", "path": "claude/office-agents/word.md", - "sha256": "ca98a10f6ff3a389db943314238087334079654c14aaf2b63ab013c2eff425f7", - "size": 16377 + "sha256": "134eb125a70b7c72d615a4d8a4b15393091d4a174789eded0a21ab54c190a700", + "size": 15989 }, { "url": "https://claude.com/docs/office-agents/work-across-apps", "status": "success", "path": "claude/office-agents/work-across-apps.md", - "sha256": "600189568b8a74a7903dee6355f007154b9e1698383f3e903eaf466990aaf4a0", - "size": 6051 + "sha256": "74ba49ba1d0b971fe376356d32f37a15bdc2ea36f0bd0b0f6591f5b3db6554f7", + "size": 5902 }, { "url": "https://claude.com/docs/plugins/admin", "status": "success", "path": "claude/plugins/admin.md", - "sha256": "c9aee30058ee14fca4ad2550a8aa8c8561c85a7a3b0c9deb93486cd4c1ec00fa", - "size": 26492 + "sha256": "b2362a5d7d875c5ddd09a3f64d0395137fa1f5217806f10f140c4933ebfaab59", + "size": 25731 }, { "url": "https://claude.com/docs/plugins/build", "status": "success", "path": "claude/plugins/build.md", - "sha256": "dcb83670761feeb7a691f9f4fc1238039313487e3ee6739db5b4c1fa3deed8b8", - "size": 34087 + "sha256": "e3a028b12741077a35fc3d779becbd7e91af716faa1f0de82e3bc7ea9d03d17d", + "size": 17983 }, { "url": "https://claude.com/docs/plugins/create-with-claude", "status": "success", "path": "claude/plugins/create-with-claude.md", - "sha256": "b2418b8d6244a7f9fd065ddbad70b69c1f217eaef9b84cd9cb118770122129db", - "size": 6943 + "sha256": "d3b7080b2f682c190a282931ceb8c9767ee09f7833fa20f8be97902026e2c687", + "size": 6588 }, { "url": "https://claude.com/docs/plugins/org-rollout", "status": "success", "path": "claude/plugins/org-rollout.md", - "sha256": "ae80597a54883a70bc667dce2070ef94c48da385874412fd9b9b02963d69020b", - "size": 7958 + "sha256": "319d7bb92c3dc5cf135acddfcb85c61d7abc57b898014bc1974db528098303c6", + "size": 7733 }, { "url": "https://claude.com/docs/plugins/org-sync", "status": "success", "path": "claude/plugins/org-sync.md", - "sha256": "90bca88b27aa35e462d887cb4279c6b6222c5b9f6d41e7745a8a2dfa083ac726", - "size": 9051 + "sha256": "88136a146e3034822c8d4df57db09e5d32a825f05c015a39d8f4bf94b0515e9e", + "size": 8784 }, { "url": "https://claude.com/docs/plugins/overview", "status": "success", "path": "claude/plugins/overview.md", - "sha256": "b57e4f069f6da9b92d5adc7e4b8ffb6b5ce8d9b8dd6791fef0b48dc0e5a3b7db", - "size": 14721 + "sha256": "67b060837dc8490f1335a37f76217ebfd0b144a131df2026659a15f6dd0528ca", + "size": 14718 }, { "url": "https://claude.com/docs/plugins/platform-support", "status": "success", "path": "claude/plugins/platform-support.md", - "sha256": "dd5928ac88770db056dba86db8cb83c3f5fbb1eac03b46d491c928220e40ad56", - "size": 6823 + "sha256": "6b50c1c1faca4148c5968546f7ee8bf44b62108934f4a8d566523f017fb05a80", + "size": 6820 }, { "url": "https://claude.com/docs/plugins/pre-submission-checklist", "status": "success", "path": "claude/plugins/pre-submission-checklist.md", - "sha256": "a9350da6a79f87e71334160e5118f125ba4d0a70baceb763373488a8a4bdbb80", - "size": 21874 + "sha256": "967bbe7071e04c3fbfc131a341626319ea82b92130afc7d2d5c4212a98affe46", + "size": 21679 }, { "url": "https://claude.com/docs/plugins/quickstart", "status": "success", "path": "claude/plugins/quickstart.md", - "sha256": "8715083a0c909357e04b7b8763eb0bb443c8a353b3ec326205f1b1a0a52017b3", - "size": 11650 + "sha256": "891d38027b1f46b67387317ae12fc905e17de5cffed7155e9cbeb93c16e24a1f", + "size": 11201 }, { "url": "https://claude.com/docs/plugins/share", "status": "success", "path": "claude/plugins/share.md", - "sha256": "ebf5407e8f66d553fcaff0c1ab4941be801ce08901497f0c52e710505e684dac", - "size": 8806 + "sha256": "d56c3660ec7b58908b3840dc2ffaa82ac4e08aba04e7a68406340c3c455b0001", + "size": 8740 }, { "url": "https://claude.com/docs/plugins/submit", "status": "success", "path": "claude/plugins/submit.md", - "sha256": "22d576d2831fc4e41583545c7bd1aea485fd375e49f3b995ca6e9034ba5f9ca0", - "size": 19463 + "sha256": "8b455ca81059bd97637073247342bb7da7b13a24bc178d68a3e4f866a5513205", + "size": 19222 }, { "url": "https://claude.com/docs/skills/how-to", "status": "success", "path": "claude/skills/how-to.md", - "sha256": "c1b18d4152f67c19beddf864dd4f24becb726f9854bc55839d761948aaa98d24", - "size": 36816 + "sha256": "1505f8b6d3dbad4bb001807613b0a172e83b0f5e93346d3b2e2be12049ea9315", + "size": 20667 }, { "url": "https://claude.com/docs/skills/overview", "status": "success", "path": "claude/skills/overview.md", - "sha256": "de6c66a3e272fd1a3d48c2cd6fc62662a765c3d334e54208428d6fe9c643d9a7", - "size": 5159 + "sha256": "cc3266abc4aeadbff06b06b76516915b88dda4baf919de6e8c8a016ec71e32dd", + "size": 5070 }, { "url": "https://claude.com/docs/third-party/claude-desktop/admin-console", "status": "success", "path": "claude/third-party/claude-desktop/admin-console.md", - "sha256": "865b241ab5deff7e7105ab0052e149bf133202b7e1909bd3cb530d7a6c5ec76c", - "size": 68573 + "sha256": "238b32d894155949850c9aabc028deef5dd5f200a5be821be1236db1f05dd1f3", + "size": 70691 }, { "url": "https://claude.com/docs/third-party/claude-desktop/bedrock", "status": "success", "path": "claude/third-party/claude-desktop/bedrock.md", - "sha256": "f929ef7c00b4846a06611d0219f1dde50901272f0799972265e72d68cad41ae3", - "size": 23251 + "sha256": "1d2baf74c0b38fd6b25c008ec788b3ab0c16bba874ede3854d49ea3b0bf692e8", + "size": 22436 }, { "url": "https://claude.com/docs/third-party/claude-desktop/bootstrap", "status": "success", "path": "claude/third-party/claude-desktop/bootstrap.md", - "sha256": "0ce5ab0d7650a438f386ef63b13e7d7d379a1951bfb90d52a73406b3a8483c5e", - "size": 42653 + "sha256": "03f453f08ad499b0d28c1fbe93913a23424c474073926d0dbc31712382b14df7", + "size": 41736 }, { "url": "https://claude.com/docs/third-party/claude-desktop/browser", @@ -13778,92 +13820,92 @@ "url": "https://claude.com/docs/third-party/claude-desktop/built-in-connectors", "status": "success", "path": "claude/third-party/claude-desktop/built-in-connectors.md", - "sha256": "fe4b76bc3e20fd10b174e98387818e3a14fc5f4f9ebba2fbc96e3bd52c9e3e46", - "size": 3656 + "sha256": "1695dff7e99b77cb162727034b5034d31e5861236e42471951d08d98a0762afb", + "size": 3653 }, { "url": "https://claude.com/docs/third-party/claude-desktop/chat", "status": "success", "path": "claude/third-party/claude-desktop/chat.md", - "sha256": "7ac51e901ca2b874db793567b2f91e98a42a1e0eaecd18169aaa9f1567c3b1e3", - "size": 15105 + "sha256": "460208697ca241ed722f9ba193ec8a4b405978393354bdc24a67b1196cf886b1", + "size": 15249 }, { "url": "https://claude.com/docs/third-party/claude-desktop/claude-api", "status": "success", "path": "claude/third-party/claude-desktop/claude-api.md", - "sha256": "326fbed1fd3e6f1acf134ea189bb56ab5da43282a193d8fcdae9991dfce10ecf", - "size": 2304 + "sha256": "5dbf841d5bbfcc01b477f26fddad6c595c048ae9e75ef590725ecebb41517eb5", + "size": 3254 }, { "url": "https://claude.com/docs/third-party/claude-desktop/code", "status": "success", "path": "claude/third-party/claude-desktop/code.md", - "sha256": "4436671cbd5b42ce7e7888420681db3c84f22178657c79c11819c6f262ffcd70", - "size": 18445 + "sha256": "aa7a2368118296513263fe3492f7c469f70015f4e0ac8de5681a7a5e846156f1", + "size": 19303 }, { "url": "https://claude.com/docs/third-party/claude-desktop/configuration", "status": "success", "path": "claude/third-party/claude-desktop/configuration.md", - "sha256": "facda05ef34fc5017d1a239be040bb4fc4508fb52622256ffb7fee2955962ab0", - "size": 198450 + "sha256": "c5e31217c977579f0410f91cef56f28ece05131800e13a09059a6a76d92f0682", + "size": 195152 }, { "url": "https://claude.com/docs/third-party/claude-desktop/configuration-changelog", "status": "success", "path": "claude/third-party/claude-desktop/configuration-changelog.md", - "sha256": "e41ff29fe74f9dc4de6dad6f5ee1860683ed5159416e14b5bfad055ab1637237", - "size": 64492 + "sha256": "8e90779fe99cae9df8f2fe471bd8b894d40f678e5c45b4988977c3782d1b3542", + "size": 58741 }, { "url": "https://claude.com/docs/third-party/claude-desktop/connectors-box", "status": "success", "path": "claude/third-party/claude-desktop/connectors-box.md", - "sha256": "6f7a786af09c5bf2c2a15b869ada29a307d108a171d099843ad4bc9ccadeb4c7", - "size": 4511 + "sha256": "69be96ded75b67248b2248dfcd39d7a732ab0a62382528b275461f414c786374", + "size": 4266 }, { "url": "https://claude.com/docs/third-party/claude-desktop/connectors-github", "status": "success", "path": "claude/third-party/claude-desktop/connectors-github.md", - "sha256": "53c0e6d555a084b077e61de641adb2fde8012d7cd2e5212d89141561f8d1b219", - "size": 9470 + "sha256": "470f13d7075c519f7211b79c822d67edaa9fbccdd213d1b24b6f90dfd002c2fa", + "size": 9268 }, { "url": "https://claude.com/docs/third-party/claude-desktop/connectors-google-cloud", "status": "success", "path": "claude/third-party/claude-desktop/connectors-google-cloud.md", - "sha256": "5b4efb6f441de6167936b78c41d217059c17d0849d2ade99bc68d707be305c38", - "size": 6474 + "sha256": "34ec18e98ee5376782489ad95edec99d4e3ba555d4d974235f7c2f8dfb54a9c2", + "size": 6041 }, { "url": "https://claude.com/docs/third-party/claude-desktop/connectors-m365", "status": "success", "path": "claude/third-party/claude-desktop/connectors-m365.md", - "sha256": "18bf154a50bdf694dcf0872dec359ceb0996117c3c0b5ac08f4958e01c3a526a", - "size": 46082 + "sha256": "4636ad1219d65ca7f387e0297d741879039a1089f7e45921da4ea9d04da7afe6", + "size": 45394 }, { "url": "https://claude.com/docs/third-party/claude-desktop/connectors-salesforce", "status": "success", "path": "claude/third-party/claude-desktop/connectors-salesforce.md", - "sha256": "b21dae39be217fffb2adaf4452177022cfcc083117d12563f786cd8c69b0ec3f", - "size": 5723 + "sha256": "1102a3651779546f9fc37ea2225d84e1a81e152845fd98701f792eb3a35e04f0", + "size": 5458 }, { "url": "https://claude.com/docs/third-party/claude-desktop/credential-helper", "status": "success", "path": "claude/third-party/claude-desktop/credential-helper.md", - "sha256": "46042624d1391b3745ea00805504a9776e62a8e1eaed0d47faacf43a09045515", - "size": 8214 + "sha256": "8166e6ac0507d566828a0e678723a38ebf56426920cf2d25872899df7bf19a7a", + "size": 8211 }, { "url": "https://claude.com/docs/third-party/claude-desktop/data-storage", "status": "success", "path": "claude/third-party/claude-desktop/data-storage.md", - "sha256": "30a7e1c5816d9e805b25f9a7f5fb35262c9ae6d60e2719a94da0ab719dbe4cb2", - "size": 20553 + "sha256": "051eeb1ba332fea4bf56b16c10cbe3890b4c44f9aeb045ee1f0b87a53558b4ae", + "size": 20608 }, { "url": "https://claude.com/docs/third-party/claude-desktop/entra-broker", @@ -13876,50 +13918,50 @@ "url": "https://claude.com/docs/third-party/claude-desktop/extensions", "status": "success", "path": "claude/third-party/claude-desktop/extensions.md", - "sha256": "0d3c415a86defda0b7e31b7dab68c831ab1247fe82bde77f0774d9d9f00ff229", - "size": 48356 + "sha256": "d638e599cc29f95d45a8369e6486dcb2d54f68e33345386c0496467d17f8c605", + "size": 47554 }, { "url": "https://claude.com/docs/third-party/claude-desktop/feature-matrix", "status": "success", "path": "claude/third-party/claude-desktop/feature-matrix.md", - "sha256": "eec37f8488e2e1987cc5cb61b206b05da0ad4b5b3f37d46a516f5dba7786db62", - "size": 9184 + "sha256": "67f38923a2c877d7aca8657d6bf6c6c057386af8283d1e4f06e85c0a33b1c6ed", + "size": 7719 }, { "url": "https://claude.com/docs/third-party/claude-desktop/foundry", "status": "success", "path": "claude/third-party/claude-desktop/foundry.md", - "sha256": "7ee7799389bd96b7082bd033a73eab717fb5e8c1048fc80441ea5ed714f1f2d4", - "size": 21546 + "sha256": "b90415fffab0b7b2d2e69a8fc8ef3ba70da9147f1a59ff28972bd71bfa4ed92e", + "size": 21017 }, { "url": "https://claude.com/docs/third-party/claude-desktop/gateway", "status": "success", "path": "claude/third-party/claude-desktop/gateway.md", - "sha256": "b9094191cce47c356fd9ec2b2b779ec16d0b8ce88f8dc7eb3ab844e775e5c285", - "size": 52460 + "sha256": "0eb9fbbff7caac92663e86b9525e9d1e3e5b954b2fcb504152cef20d4c33c162", + "size": 51608 }, { "url": "https://claude.com/docs/third-party/claude-desktop/import", "status": "success", "path": "claude/third-party/claude-desktop/import.md", - "sha256": "9e2a54cc3bf3108efb9962ad2ab0b7a595e702706378a620b43f0d1b13ca3fdb", - "size": 19247 + "sha256": "b45f0ad3d403571d73a7dc659112404b4f5b9b9e2d4500b9422d4ca6bd6d8230", + "size": 17787 }, { "url": "https://claude.com/docs/third-party/claude-desktop/in-app-configuration", "status": "success", "path": "claude/third-party/claude-desktop/in-app-configuration.md", - "sha256": "e93d8b7c40c4f312b0107ce2616c0b91bd37818f70ab5d81bb185c3157ecdbd7", - "size": 3867 + "sha256": "53da6180563aa2ddb7a704400541059c6fb249127187f8d7b5ffab616657ef37", + "size": 3648 }, { "url": "https://claude.com/docs/third-party/claude-desktop/installation", "status": "success", "path": "claude/third-party/claude-desktop/installation.md", - "sha256": "f1ead1867a68d232eed6565428fc82bbbed4d9593f68b82106a907974fba7f1b", - "size": 27032 + "sha256": "be9474b50d789673ea4ef6a3c1dc0f53ded1fd243f805c996847a6ee4d63b6a7", + "size": 28836 }, { "url": "https://claude.com/docs/third-party/claude-desktop/legal", @@ -13932,15 +13974,15 @@ "url": "https://claude.com/docs/third-party/claude-desktop/local-access", "status": "success", "path": "claude/third-party/claude-desktop/local-access.md", - "sha256": "d434f23875aaec578bc890757fa3b438c590f6554dfb1e44c82c28cb3a9e9f5a", - "size": 6485 + "sha256": "87afa22df1d9219c84cd0f527202846552c5c94d7ca68481d53b50ace6f44001", + "size": 6482 }, { "url": "https://claude.com/docs/third-party/claude-desktop/mantle", "status": "success", "path": "claude/third-party/claude-desktop/mantle.md", - "sha256": "284830d679552ebf1d443ed7628ff09fab69cd955b6e7cfe8c10115c8468a728", - "size": 7669 + "sha256": "3b7c981355f22aa17e3b3f9ac3924e94daef98a13da1e04531ddbb6088a7811e", + "size": 7062 }, { "url": "https://claude.com/docs/third-party/claude-desktop/mcp-sign-in", @@ -13953,8 +13995,8 @@ "url": "https://claude.com/docs/third-party/claude-desktop/mdm", "status": "success", "path": "claude/third-party/claude-desktop/mdm.md", - "sha256": "371829fb18d84265d92ac62863473c664815fa1ec6bd7154595572b7b61a819d", - "size": 15559 + "sha256": "d76574cb4b1dcb9c59460c96d9f8f54b8e57dcff5087c8110e2cd490a4987bbf", + "size": 15295 }, { "url": "https://claude.com/docs/third-party/claude-desktop/models", @@ -13967,57 +14009,57 @@ "url": "https://claude.com/docs/third-party/claude-desktop/move-to-claude-enterprise", "status": "success", "path": "claude/third-party/claude-desktop/move-to-claude-enterprise.md", - "sha256": "307d3db4259b8ae25335e840c7ca0bcb938ac69735c7552ef06c8fac8cce2f9a", - "size": 10155 + "sha256": "53d2fa8533a5e2c87133b38bd4253ffcc0a6568d369180de9b1b2cda08e2d059", + "size": 9750 }, { "url": "https://claude.com/docs/third-party/claude-desktop/network-proxy", "status": "success", "path": "claude/third-party/claude-desktop/network-proxy.md", - "sha256": "138053fb5fbb57c36ccbd7cbb8c7942e05a1403d9e27f85db468def4fee946db", - "size": 24492 + "sha256": "051ac0273ee51205e8e360dd2bb288607b8c289ba4fd7a5e068d409cb8035148", + "size": 24480 }, { "url": "https://claude.com/docs/third-party/claude-desktop/overview", "status": "success", "path": "claude/third-party/claude-desktop/overview.md", - "sha256": "a272e5e3699a41d9a2efb04a5e06263a7e2b2b82a2181fa730aa14c88316d443", - "size": 13703 + "sha256": "8af6c4599fe181b6091fdd1b7ea203f62d931fb009339a3ff097a7fb134c81db", + "size": 13501 }, { "url": "https://claude.com/docs/third-party/claude-desktop/ssh-remote-sessions", "status": "success", "path": "claude/third-party/claude-desktop/ssh-remote-sessions.md", - "sha256": "030fd842cb26cd45e5c7079d8d7262307c93fb489a2e49f69a939125530f792e", - "size": 59881 + "sha256": "62ceffba6b0e64ca8b9c01ebb6687dbf411261462cb2a63cdae7e30266407269", + "size": 59864 }, { "url": "https://claude.com/docs/third-party/claude-desktop/telemetry", "status": "success", "path": "claude/third-party/claude-desktop/telemetry.md", - "sha256": "d76770a8c3f4ef4d2a8b0f5c169c7b78879d52ff8dbe7ba27efdcbebb6ac2c31", - "size": 34306 + "sha256": "68a08d34deff28cf56f4470b187cabfefdc9a38ac8d180631eda68cd7c182439", + "size": 35309 }, { "url": "https://claude.com/docs/third-party/claude-desktop/unified-claude", "status": "success", "path": "claude/third-party/claude-desktop/unified-claude.md", - "sha256": "203f60abd35f1f973472887180d58a85f06a7809a662c49c669cf5d94628f23b", - "size": 3359 + "sha256": "e0de9fb288437dfe8e8d1b7e6fe6a40d0557393faae765a9a355f49c9923fc93", + "size": 3356 }, { "url": "https://claude.com/docs/third-party/claude-desktop/vertex", "status": "success", "path": "claude/third-party/claude-desktop/vertex.md", - "sha256": "562e43d72f8931fa838ac1d8c77d962b736cee79f87b60523181add30987ad2d", - "size": 31670 + "sha256": "c5fdac6db18953a31afc985d87eba1d3ed809c5ae2c5ec2cda68d587894db058", + "size": 30663 }, { "url": "https://claude.com/docs/third-party/claude-desktop/web-tools", "status": "success", "path": "claude/third-party/claude-desktop/web-tools.md", - "sha256": "eb41c0551b3812ce87e4d0d3462891d3df8b1f65e3a7afdd806faaeda3db992f", - "size": 18370 + "sha256": "bb8e25893d08ac4c4d22438454875ea26a5b15cacc83a09993ae10b563740f9e", + "size": 18110 }, { "url": "https://platform.claude.com/docs/en/api/ruby/models", @@ -22815,36 +22857,36 @@ "url": "https://code.claude.com/docs/en/plugin-marketplaces", "status": "success", "path": "en/docs/claude-code/plugin-marketplaces.md", - "sha256": "0597250fec9a5eb9734df9c6821409431623604656129cf8e462f93460db6a84", - "size": 14189 + "sha256": "d016e2a495335b74acb363c28cc83f516a5c8df3954e64937841edde7271bc8c", + "size": 13855 }, { "url": "https://code.claude.com/docs/en/slash-commands", "status": "success", "path": "en/docs/claude-code/slash-commands.md", - "sha256": "1ac8eb3ec96177a5b960a381dcbf7e14ff5dacd45fa888e647e55bf4acd6f645", - "size": 110002 + "sha256": "96dd113a8aeb5ba5c0371368a26eb55781a840eab78a833b3e6b755178f37813", + "size": 109811 }, { "url": "https://code.claude.com/docs/en/plugins-reference", "status": "success", "path": "en/docs/claude-code/plugins-reference.md", - "sha256": "16b6dafd91d4a258bd1afcb901ee6efafca67c6de52e8c7a2b3c65c3884b5f3d", - "size": 41987 + "sha256": "2af4d8d137d49ce2f1c47fa1cc9d527217d8ba93e146b2b2b5baf221a076ae28", + "size": 41985 }, { "url": "https://code.claude.com/docs/en/plugin-hints", "status": "success", "path": "en/docs/claude-code/plugin-hints.md", - "sha256": "8f7f28fb9568c8acfce79a0ed6761c175062ffb6c01b91936d2780ebd2e91257", - "size": 6742 + "sha256": "cae42089de7d22257f486031fcff3698a3b9e6bdcc642778014fcfc603d570eb", + "size": 6662 }, { "url": "https://code.claude.com/docs/en/plugin-relevance", "status": "success", "path": "en/docs/claude-code/plugin-relevance.md", - "sha256": "bcbe647fd4e587be1dcaf436077181c1a863f9a4ddd18833d96b7862aeed17e9", - "size": 12865 + "sha256": "bed8ccb839090c1ea1d9ca8654e280905276bd44c57f80b68fa4e4b75c02b93a", + "size": 12863 }, { "url": "https://code.claude.com/docs/en/ultraplan", @@ -22857,50 +22899,50 @@ "url": "https://code.claude.com/docs/en/discover-plugins", "status": "success", "path": "en/docs/claude-code/discover-plugins.md", - "sha256": "698096ded7da7addf11ad7894179736ff96bab43eb51370698efb0fcdaca7294", - "size": 32228 + "sha256": "2af08db4214c45b94d140ebb6ae7407f85ee7cc92059095605cc5934a6f8bb51", + "size": 31337 }, { "url": "https://code.claude.com/docs/en/desktop-changelog", "status": "success", "path": "en/docs/claude-code/desktop-changelog.md", - "sha256": "c7bf4f1cdf3b7c16d3b4c092887779602582642e1cebe0fa54387c44d880d32c", - "size": 166053 + "sha256": "2bb49a13cfba31e66f7496fd5b8f305b59a4b2f074a7b9a36608b12a203c419e", + "size": 163615 }, { "url": "https://code.claude.com/docs/en/iam", "status": "success", "path": "en/docs/claude-code/iam.md", - "sha256": "c43ef3e8ddcb34ff6ba8b8d9e72276326ba7b672cd99f1252d5167c111ce67ac", - "size": 31125 + "sha256": "7eee08423ba09f648ad55d2a977d2783960450b5867e1629b23386341293a81d", + "size": 30701 }, { "url": "https://code.claude.com/docs/en/web-scheduled-tasks", "status": "success", "path": "en/docs/claude-code/web-scheduled-tasks.md", - "sha256": "e4369e748142fc2f810cede0a4a8e7feb38fe3764a12ceccba32df9d2e863b92", - "size": 40898 + "sha256": "206c4ab09968481c30f021fb4a521378c01de36a1caeeea561390b8f3ee11ae9", + "size": 39893 }, { "url": "https://code.claude.com/docs/en/plugins", "status": "success", "path": "en/docs/claude-code/plugins.md", - "sha256": "a33630ffe4a2432e4204fa0a512cffda4a037cf1441fb964a2104517589c8654", - "size": 14924 + "sha256": "3d758b5da01f42cf2201c4f4d38a7ac24dbf76e7f31d03cf77632e4d720535cf", + "size": 13310 }, { "url": "https://code.claude.com/docs/en/plugin-dependencies", "status": "success", "path": "en/docs/claude-code/plugin-dependencies.md", - "sha256": "a29a982a1fddb4dbaa361f5c996d4b444fceee116b86bf33720d92e5137ae97e", - "size": 17256 + "sha256": "429195438ab959715ee4d09e29b98163372f93e33fcc14d9efc87bcebfc0c3e2", + "size": 17135 }, { "url": "https://code.claude.com/docs/en/agent-sdk/slash-commands", "status": "success", "path": "en/docs/claude-code/agent-sdk/slash-commands.md", - "sha256": "c515e05538b55ae79a3044229d742946785e0dcca66845478d542ceb0620d26c", - "size": 27640 + "sha256": "ba547726732fd543fa07f96bc243fb597d578d8546df1373b721ead01dab0646", + "size": 26910 }, { "url": "https://raw.githubusercontent.com/anthropics/claude-cookbooks/main/.claude/agents/code-reviewer.md", @@ -25160,7 +25202,7 @@ "url": "https://raw.githubusercontent.com/anthropics/claude-plugins-official/main/.claude-plugin/marketplace.json", "status": "success", "path": "github/claude-plugins-official/.claude-plugin/marketplace.json", - "sha256": "2ecc536e0d674709bdc893076e8fcc097175d66744fa6297208dad4bd34af30c", + "sha256": "0509f3f2598191c60321625ce987a1832fbc3a3aabe18735e6a901f081458e33", "size": 190732 }, { @@ -29143,8 +29185,8 @@ "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-python/main/CHANGELOG.md", "status": "success", "path": "github/anthropic-sdk-python/CHANGELOG.md", - "sha256": "219ea48db75a20badfc9c28e45f9331be5c677f2a15407e5f352643e1ea413ac", - "size": 268275 + "sha256": "961dbefd0eced84d975488a77581c93cbe8851aad7d9b31954897d2313524e94", + "size": 269123 }, { "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-python/main/CLAUDE.md", @@ -29192,8 +29234,8 @@ "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-python/main/api.md", "status": "success", "path": "github/anthropic-sdk-python/api.md", - "sha256": "f0126f59ee0f7b681004c58be0ba3c1df02d18c0f3e677cd5b2f01fb6534e83c", - "size": 189148 + "sha256": "9da86defbcb9755ad4328799436add615f34335b715c93f2f12902f9c229d780", + "size": 193812 }, { "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-python/main/browser-toolset.md", @@ -29241,8 +29283,8 @@ "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-python/main/src/anthropic/lib/google_cloud/README.md", "status": "success", "path": "github/anthropic-sdk-python/src/anthropic/lib/google_cloud/README.md", - "sha256": "ab9b60f41a6f75c18a1f6782b1a6081b93498dd24a85ca76b3a717f4844145d6", - "size": 5259 + "sha256": "940ec2bc7e01de65f6e324d814a8dbaa3cd6b84c95085433b6c87b9f50abb13e", + "size": 5367 }, { "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-python/main/tools.md", @@ -29255,15 +29297,15 @@ "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-typescript/main/CHANGELOG.md", "status": "success", "path": "github/anthropic-sdk-typescript/CHANGELOG.md", - "sha256": "d400af1d16903a5604d18343018ea8c2a9858de907e92f68f46f859fc7309391", - "size": 247345 + "sha256": "3c4f54cf14556302ab5c78c0f622eb10cd9ea50664b63f09634ee94199735420", + "size": 248570 }, { "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-typescript/main/CLAUDE.md", "status": "success", "path": "github/anthropic-sdk-typescript/CLAUDE.md", - "sha256": "0602f79ba427ce105293561fe6395b35634451944c4ab631b83ebd4c058add5b", - "size": 30021 + "sha256": "2d33e9b96e16c67cab675b203501221ec97bc9e966655fcc184b5132131d1f63", + "size": 30094 }, { "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-typescript/main/CONTRIBUTING.md", @@ -29304,8 +29346,8 @@ "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-typescript/main/api.md", "status": "success", "path": "github/anthropic-sdk-typescript/api.md", - "sha256": "6bcb45509fcc70b031ad960b72da1af70cdb8388cdd4f8a9cb8cc2cd336ca07c", - "size": 249991 + "sha256": "90296dd65ab1695286266f5198319192d2fa64ea805f54eccaf0704aec994548", + "size": 255064 }, { "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-typescript/main/browser-toolset.md", @@ -29339,15 +29381,15 @@ "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-typescript/main/helpers.md", "status": "success", "path": "github/anthropic-sdk-typescript/helpers.md", - "sha256": "c33fda6cc5d1860a1be95462979698a141e0cee66cb387431bcf2b2f53ad4dbf", - "size": 34472 + "sha256": "6d8288c6f3691bfedccad8cc2a1f1680e4d13211f72911bcef8766c3cc7b299b", + "size": 35083 }, { "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-typescript/main/packages/aws-sdk/CHANGELOG.md", "status": "success", "path": "github/anthropic-sdk-typescript/packages/aws-sdk/CHANGELOG.md", - "sha256": "dee2319c16be62a77a74427b50e3561d12c72a550f4aad2eb5f15cca22e82e40", - "size": 13269 + "sha256": "0d8fef5c540c2e058bc9f8a6aaa0579ac694ab2c127e730370dc0f355800d3c3", + "size": 13602 }, { "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-typescript/main/packages/aws-sdk/README.md", @@ -29360,8 +29402,8 @@ "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-typescript/main/packages/bedrock-sdk/CHANGELOG.md", "status": "success", "path": "github/anthropic-sdk-typescript/packages/bedrock-sdk/CHANGELOG.md", - "sha256": "1ded19dc3583489c7c32cf2666f7b7070da26f48a04a51b3626681fb0baa1158", - "size": 52566 + "sha256": "5cefb5ccb21d63529d49b5f1b9f054e5e1f88931c77e05e659b8cf8b76a8b541", + "size": 52985 }, { "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-typescript/main/packages/bedrock-sdk/README.md", @@ -29388,22 +29430,22 @@ "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-typescript/main/packages/google-cloud-sdk/CHANGELOG.md", "status": "success", "path": "github/anthropic-sdk-typescript/packages/google-cloud-sdk/CHANGELOG.md", - "sha256": "6c199429e688a6d2af8b71fd15960df48302d823bfc70aff2942cbe583e48765", - "size": 8049 + "sha256": "1b24dd63d0f8b5ca00f4c65f8109472c01232361784a3d40f5774305ddf3c31e", + "size": 8278 }, { "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-typescript/main/packages/google-cloud-sdk/README.md", "status": "success", "path": "github/anthropic-sdk-typescript/packages/google-cloud-sdk/README.md", - "sha256": "de86cdce1c3ef2e757ce3e8a003a873d94e418e70162be0b0fca426ebb939049", + "sha256": "d7556f0afe2e22774a71a4eee53368b26ef1a2cab0cfac16ae2d0097efac7448", "size": 5059 }, { "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-typescript/main/packages/vertex-sdk/CHANGELOG.md", "status": "success", "path": "github/anthropic-sdk-typescript/packages/vertex-sdk/CHANGELOG.md", - "sha256": "bdb4a6e13d9d364e9d55e285cb0fff8b00fb9ebbd51903d473b3fd56358f6982", - "size": 31651 + "sha256": "fac56d0ee11c33e747b87117cc8488e65785377c78f04f028ffa9a782b8f4b78", + "size": 31956 }, { "url": "https://raw.githubusercontent.com/anthropics/anthropic-sdk-typescript/main/packages/vertex-sdk/README.md", @@ -29454,22 +29496,6 @@ "url": "https://code.claude.com/docs/en/claude-tag", "reason": "moved -> https://claude.com/docs/claude-tag/overview" }, - { - "url": "https://support.claude.com/en/articles/9767949-api-key-best-practices-keeping-your-keys-safe-and-secure", - "reason": "moved -> https://support.claude.com/en/articles/9767949-api-key-best-practices-keep-your-keys-safe-and-secure" - }, - { - "url": "https://support.claude.com/en/articles/9796807-creating-and-managing-workspaces-in-the-claude-console", - "reason": "moved -> https://support.claude.com/en/articles/9796807-create-and-manage-workspaces-in-the-claude-console" - }, - { - "url": "https://support.claude.com/en/articles/13346458-customizing-your-console-appearance-settings", - "reason": "moved -> https://support.claude.com/en/articles/13346458-customize-your-console-appearance-settings" - }, - { - "url": "https://support.claude.com/en/articles/13443764-inviting-members-to-the-claude-console", - "reason": "moved -> https://support.claude.com/en/articles/13443764-invite-members-to-the-claude-console" - }, { "url": "https://platform.claude.com/docs/en/agent-sdk/stop-reasons", "reason": "moved -> https://code.claude.com/docs/en/agent-sdk" @@ -30422,6 +30448,10 @@ "url": "https://support.claude.com/en/articles/11174660-online-safety-contacts", "reason": "moved -> https://support.claude.com/en/articles/11174660-point-of-contact-for-authorities-and-regulators" }, + { + "url": "https://support.claude.com/en/articles/9796807-creating-and-managing-workspaces-in-the-claude-console", + "reason": "moved -> https://support.claude.com/en/articles/9796807-create-and-manage-workspaces-in-the-claude-console" + }, { "url": "https://support.claude.com/en/articles/12922832-local-mcp-server-submission-guide", "reason": "HTTP 404" @@ -30554,6 +30584,10 @@ "url": "https://support.claude.com/en/articles/9264804-how-can-i-cancel-my-claude-pro-subscription-on-the-claude-app-for-ios", "reason": "HTTP 404" }, + { + "url": "https://support.claude.com/en/articles/13346458-customizing-your-console-appearance-settings", + "reason": "moved -> https://support.claude.com/en/articles/13346458-customize-your-console-appearance-settings" + }, { "url": "https://support.claude.com/en/articles/11049762-choose-a-claude-plan", "reason": "HTTP 404" @@ -30570,6 +30604,14 @@ "url": "https://support.claude.com/en/articles/10722177-sharing-prompts-in-the-claude-console", "reason": "HTTP 404" }, + { + "url": "https://support.claude.com/en/articles/9767949-api-key-best-practices-keeping-your-keys-safe-and-secure", + "reason": "moved -> https://support.claude.com/en/articles/9767949-api-key-best-practices-keep-your-keys-safe-and-secure" + }, + { + "url": "https://support.claude.com/en/articles/13443764-inviting-members-to-the-claude-console", + "reason": "moved -> https://support.claude.com/en/articles/13443764-invite-members-to-the-claude-console" + }, { "url": "https://support.claude.com/en/articles/13756069-public-sector-faqs", "reason": "moved -> https://claude.com/solutions/government" @@ -30636,8 +30678,8 @@ } ], "summary": { - "total": 4502, - "downloaded": 4206, + "total": 4508, + "downloaded": 4212, "skipped": 0, "failed": 0, "dead": 296, diff --git a/content/claude-code-manifest.json b/content/claude-code-manifest.json index 51ff9c5506..60a06042ea 100644 --- a/content/claude-code-manifest.json +++ b/content/claude-code-manifest.json @@ -116,7 +116,6 @@ "_nodeVersion": "24.21.0", "dependencies": {}, "_hasShrinkwrap": false, - "readmeFilename": "README.md", "optionalDependencies": { "@anthropic-ai/claude-code-linux-x64": "2.1.304", "@anthropic-ai/claude-code-win32-x64": "2.1.304", diff --git a/content/claude/build/overview.md b/content/claude/build/overview.md index 20a318707e..49d1213100 100644 --- a/content/claude/build/overview.md +++ b/content/claude/build/overview.md @@ -17,34 +17,32 @@ When the plugin is ready, you can [submit it](/docs/directory/publish) to Anthro ## Choose a starting page - - - Lay out the plugin folder and manifest, write the skills, reference your MCP server, and test the plugin in Claude. - - - - Teach Claude your workflows: the SKILL.md frontmatter, the instructions, reference files, and scripts. - - - - Give the plugin access to your product or data: implement the server, set up authentication for Claude's clients, and test it. - - - - Have your MCP server show interactive components in the conversation with MCP Apps. Optional. - - - - - List it in Anthropic's directory so anyone can add it: who can submit, what review involves, and the developer portal steps. Submit your MCP server as a connector too, even when your plugin references it. - - - - * If you want to connect a tool or install a plugin for yourself, see the [Customize Claude](/docs/extend/overview) tab - * If you're not sure whether your plugin needs an MCP server at all, see [Decide what to include in your plugin](/docs/connectors/building/what-to-build) - * If you're distributing only inside your organization, see [Roll out a plugin to your whole organization](/docs/plugins/org-rollout) - * If you're building only for Claude Code's terminal and IDE users, see the [Claude Code plugin docs](https://code.claude.com/docs/en/plugins/create), which cover what that surface alone supports - +> **[Build a plugin](/docs/plugins/build)** +> +> Lay out the plugin folder and manifest, write the skills, reference your MCP server, and test the plugin in Claude. + +> **[Write skills](/docs/skills/how-to)** +> +> Teach Claude your workflows: the SKILL.md frontmatter, the instructions, reference files, and scripts. + +> **[Build an MCP server](/docs/connectors/building/index)** +> +> Give the plugin access to your product or data: implement the server, set up authentication for Claude's clients, and test it. + +> **[Add interactive UI](/docs/connectors/building/mcp-apps/getting-started)** +> +> Have your MCP server show interactive components in the conversation with MCP Apps. Optional. + +> **[Submit your plugin or MCP server](/docs/directory/publish)** +> +> List it in Anthropic's directory so anyone can add it: who can submit, what review involves, and the developer portal steps. Submit your MCP server as a connector too, even when your plugin references it. + +> [!NOTE] +> +> * If you want to connect a tool or install a plugin for yourself, see the [Customize Claude](/docs/extend/overview) tab +> * If you're not sure whether your plugin needs an MCP server at all, see [Decide what to include in your plugin](/docs/connectors/building/what-to-build) +> * If you're distributing only inside your organization, see [Roll out a plugin to your whole organization](/docs/plugins/org-rollout) +> * If you're building only for Claude Code's terminal and IDE users, see the [Claude Code plugin docs](https://code.claude.com/docs/en/plugins/create), which cover what that surface alone supports ## Steps to build and publish a plugin diff --git a/content/claude/claude-science/admin-controls.md b/content/claude/claude-science/admin-controls.md index e8685ff3ea..3e2052697a 100644 --- a/content/claude/claude-science/admin-controls.md +++ b/content/claude/claude-science/admin-controls.md @@ -65,9 +65,9 @@ The control on the **Claude Science** page is the upper limit, and roles narrow Turning on the **Claude Science** capability in a role also turns on the seven under it, and you can then turn off the ones that role shouldn't have. Any capability whose control your organization can't turn on stays off. Turning the **Claude Science** capability off turns them all off. A role whose **Capability access** setting is **All capabilities** already includes all seven. A role set to **All generally available** gets them when you turn on its **Claude Science** capability (see [Who gets access after you enable](/docs/claude-science/enable-claude-science#who-gets-access-after-you-enable)). - - Giving a custom role the **Claude Science** capability gives its members the app. For skills from claude.ai and your organization's plugins to reach those members, their custom roles also need one of the capability options listed under [Organization skills](#organization-skills). - +> [!NOTE] +> +> Giving a custom role the **Claude Science** capability gives its members the app. For skills from claude.ai and your organization's plugins to reach those members, their custom roles also need one of the capability options listed under [Organization skills](#organization-skills). For a member whose custom roles don't include a capability, the feature behaves as it does when you turn its control off (see [How changes reach members](#how-changes-reach-members)). The setting is grayed out in the Claude Science app, and what the member set up earlier is kept. To give that member the feature, turn on the capability in one of their roles. A change to a role's capabilities can take up to 15 minutes to reach members, and then applies on the member's next turn or request. diff --git a/content/claude/claude-science/artifacts.md b/content/claude/claude-science/artifacts.md index 970627de11..fe58031356 100644 --- a/content/claude/claude-science/artifacts.md +++ b/content/claude/claude-science/artifacts.md @@ -8,9 +8,9 @@ In Claude Science, an artifact is a file Claude saves into the project: a figure, processed dataset, report, notebook, or other output. Artifacts are stored on your computer in the app's data folder and persist until you delete them. Other files Claude writes during a session are temporary and are cleared a few hours after the session ends; ask Claude to save a scratch file if you want to keep it. - - If you use artifacts in a claude.ai chat rather than the Claude Science app, see [What are artifacts and how do I use them?](https://support.claude.com/en/articles/17153992-what-are-artifacts-and-how-do-i-use-them) in the help center instead. - +> [!NOTE] +> +> If you use artifacts in a claude.ai chat rather than the Claude Science app, see [What are artifacts and how do I use them?](https://support.claude.com/en/articles/17153992-what-are-artifacts-and-how-do-i-use-them) in the help center instead. ## Working with artifacts diff --git a/content/claude/claude-science/changelog.md b/content/claude/claude-science/changelog.md index 1682a784e9..06654dac46 100644 --- a/content/claude/claude-science/changelog.md +++ b/content/claude/claude-science/changelog.md @@ -6,252 +6,267 @@ > Release notes for Claude Science, including new features, improvements, and bug fixes by version. - - * Tabs in the right pane are now all one width, and the tab you're viewing always shows its close button - * Newly saved artifacts now list more of their input files in Provenance when the code that created them read many files - * Linux: Claude Science now detects an NVIDIA GPU only if `nvidia-smi` can run without your `LD_LIBRARY_PATH` and is in `/usr/bin` or one of a few other fixed folders (`/usr/local/bin` isn't one). Otherwise the app finds no GPU, and the **Host GPU** switch in **Settings > Compute** is hidden unless it's already on - * Linux: a uv, conda, mamba, or pixi environment in a folder you've granted is now read-only to Claude when its files are shared with the tool's package cache (the usual case). Claude can still run code from it but can't add, update, or remove packages in it. The rest of the folder usually stays writable - * Various bug fixes and security improvements - - - - * Linux: if Claude Science won't start after updating to 0.1.61, run `claude-science update` in a terminal to get 0.1.62 or later, then start it again. If it's still running and the "Update available" notice shows "restart aborted", select "Check for updates" in **Settings > General > About** so it finds the newer version, then "Restart to update" - * Linux: Claude Science starts again when bubblewrap or socat comes from conda, Homebrew, or a folder in your home directory. 0.1.61's requirement that both be installed for the whole system is withdrawn for now, though installing them that way is still recommended - * Fixed the app sometimes becoming unresponsive after Claude saves results from an analysis that read large files - * Various bug fixes and security improvements - - - - * Sessions you start in the Example project now show on the home screen - * A GitHub token you paste in **Settings > Credentials** now stays after a restart, instead of switching back to the token found on your computer; if yours switched back, paste it again - * Linux: fixed Featured connectors that run on your computer sometimes failing to start right after your first sign-in - * Linux: Claude Science now needs bubblewrap and socat installed for the whole system, from your distribution's packages or by an administrator. If yours came from conda, Homebrew, or a folder in your home directory, the app refuses to start and its message says what to do - * Windows: Claude Science is now signed with a renewed certificate from the same publisher, Anthropic, PBC. If your IT team allows the app by certificate thumbprint, add the new SHA-1 thumbprint `60C2D9C51F09822FFF4F194DE9EEDB67451292D1` and keep the previous one, both listed under [Windows signing certificate](/docs/claude-science/manage-on-devices#windows-signing-certificate) - * Security hardening of the analysis sandbox on Mac, Windows, and Linux - * Various bug fixes and security improvements - - - - * Mac: fixed a problem introduced in 0.1.59 where Python, R, and some shell commands could fail to run when Claude Science has access to many folders - * **Settings > Network > Package mirror** now shows a mirror credential file your organization deployed, instead of asking for a token - - - - * Saved approvals for tools from your organization's plugins are cleared, so Claude asks again; new approvals apply only to the plugin that added the tool - * Skills from plugins your organization's admin uploads now appear under Organization in **Settings > Skills**, instead of under Featured - * Comment boxes on figures, PDFs, reports, and files now grow as you type, and a new comment that fails to save keeps your text and shows an error - * Fixed some files failing to upload when you add hundreds of files to a message at once - * `claude-science --here` now refuses to start on a data folder another install created if it holds organization policy files or folders that Claude Science creates for itself; if the folder is yours, run it once with `--trust-here-data` - * Security hardening of the analysis sandbox on Mac, Windows, and Linux - * Various bug fixes and security improvements - - - - * When safeguards flag a message for life sciences content, Claude Science can now retry it once on another model automatically, depending on the model; turn this off with **Switch models when a message is flagged** in **Settings > General > Model** - * Excel (.xlsx) previews now show cell colors, bold text, and color-scale heat maps - * Reviewer findings now open in place, with a button to the reviewer's full transcript - * A stalled file upload now stops by itself, and a failed upload says why under the file - * Skills: "Check for updates…" now lists only the imported skills whose files changed - * Claude now asks before it uses a tool from a connector that your organization's plugins add - * Fixed a case where the app could delete a skill from your computer when it started - * Windows: zoom the app window with Ctrl+Plus and Ctrl+Minus, and reset it with Ctrl+0 - * Windows: IT teams can now deploy package mirror credentials as a `.netrc` file, as on Mac and Linux - * Mac: the app now applies only a fixed list of variables from the `env` file in the data folder; move a GitHub token to **Settings > Credentials** - * Admins can now turn off Claude's web search tool with `enable_web_search = false` in `config.toml` - * Security hardening of the analysis sandbox on Mac, Windows, and Linux - * Various bug fixes and security improvements - - - - * New sessions on an organization's default model with more life sciences restrictions now show a notice with a one-click switch to another model - * Fixed an error Claude ran into when outlining an existing multi-panel figure or drafting a paper's brief from its abstract and figure captions - - - - * Sessions on Claude Sonnet 5.5 now default to Extra high reasoning effort - * Windows: after an update, the app window reopens on the new version by itself - * Pinned artifacts (formerly starred) and pinned projects now show a pushpin instead of a star - * Editing a Markdown table cell now outlines the cell itself instead of opening a box over it - * The app starts much faster with a long list of allowed domains - * Security hardening of the analysis sandbox on Mac, Windows, and Linux - * Various bug fixes and security improvements - - - - * Paste a list of domains in **Settings > Network** to allow them all at once - * In Markdown files, editing table cells in place now works in files with up to 2,500 table cells, however long their text - * **Settings > Connectors**: a Featured connector that was turned off during setup now shows as off, and turning it back on lets Claude use it again - * Hover over a tab in the right pane to see the file's full name - * Mac: fixed a case where code cells didn't run because Claude wrote the folder's name in a different letter case or accent form than on disk - * Mac: security hardening of the analysis sandbox - * Various bug fixes and security improvements - - - - * Clicking a figure in Claude's answer now opens it beside the chat; Ctrl/Cmd-click or the new "Open fullscreen" button opens it full screen - * Opening or closing the right pane now keeps your place in a long answer - * Markdown files no longer rotate in Safari after they load - * The reviewer no longer flags working figure links in saved reports as broken - * When Claude sets a Python, R, or shell cell to run in a folder other than the session's workspace, its permission card now shows that folder - * "Download script" and "Download notebook" now give the input and output files in the zip plain names: spaces, brackets, and other special characters become underscores - * Various bug fixes and security improvements - - - - * Pinned sessions (formerly starred) from across all your projects now appear at the top of the session list; a new switch in **Settings > General > Appearance** lets you limit them to the open project - * In Markdown files, click a plain-text cell in a table to edit it in place - * Tables in Markdown files keep their scroll position when Claude saves another file - * Fixed the BioMart connector's data queries and identifier translation; a data query that filters on more than a few hundred IDs can still fail - * The BioMart connector now reads from Ensembl's June 2026 archive. If your network allowlist lists `www.ensembl.org` by name, add `jun2026.archive.ensembl.org` - * Removed connector tools that failed on every call: the ENCODE and eQTL Catalogue lookups and ZINC's random-sample tool - * "Download script" on an artifact made by a shell command now includes the script itself - * The app stays more responsive while Claude saves files in projects with tens of thousands of files, and zip downloads with thousands of same-named files are prepared much faster - * Mac: security hardening of the analysis sandbox - * Life Sciences Verification Program (beta): fixed a case where your approved use cases could disappear from the app - * Various bug fixes and security improvements - - - - * Tables in Markdown files now show as a compact grid; a long table keeps its header row in view, and row labels stay in view when you scroll sideways - * Tabs in the right pane can be reordered by dragging, or with Ctrl/Cmd+Shift+Left/Right - * Pasted images are now saved to your uploads, so Claude can keep working with them later in the conversation - * When Claude redraws a figure several times in one turn, the chat keeps only the newest one open; open an earlier step to see its draft - * Closing Settings or Customize by clicking outside it no longer drops an edit you were still typing - * "View in context" on a file version that a different session saved now opens the file's own session instead of an empty screen - * Project settings are now clearer with helper text - * Home screen: project rows now show running sessions in gray like the session cards - - - - * If your organization is in Anthropic's Life Sciences Verification Program (beta), you can now [choose a use case](/docs/claude-science/safeguards#choose-a-use-case) for your sessions - * Saved credentials now reach Claude's code only when it asks for them and you approve. They're no longer present in every cell - * Access Claude Science work saved on your computer from other sign-ins, from Home or Settings. Admins control it on Team and Enterprise plans - * Claude can send you a short message, such as a link to a file, while it keeps working on a task - * Mac: Apple silicon Macs with the Intel version installed can now update, and then run natively - * Mac: if Claude's tools can't start after an Xcode update, the error now says how to accept the Xcode license - * You can comment on and bookmark the short summaries of Claude's progress notes - * Sessions moved to a model with a smaller context window keep going instead of failing - * Turning Auto-review off now applies to agents that are already running; turning it back on resumes their reviews - * Settings > Connectors shows "Not set" for tools without a permission, and saves "Ask each time" - * Windows: `claude-science install` now reports the step that failed instead of reporting success - * Faster search of a long session's history; clearer wording in model settings - - - - * On Windows, environment setup now handles user folders with accented or non-Latin names, tries again if Windows briefly refuses to start the environment installer, and no longer needs the Microsoft Visual C++ Redistributable - * The app now warns you a few days before your sign-in expires and offers a "Sign in again" button - * Various bug fixes and security improvements - - - - * Claude Science is now available for Windows: download it from [claude.com/product/claude-science](https://claude.com/product/claude-science), and see [Get started](/docs/claude-science/get-started) for setup - * Various bug fixes and improvements - - - - * On Linux, commands, notebook cells, and local connectors work again on systems with bubblewrap's recent security update - * Cloud storage in Settings (Amazon S3, S3-compatible services, and Google Cloud Storage with HMAC keys) now works behind a TLS-inspecting proxy such as Zscaler or Netskope, trusting the same corporate root certificate as sign-in and the Claude API - * Various bug fixes and security improvements - - - - * Messages now show when they were sent: hover one of your messages to see the time, and Claude's replies show it next to their copy and feedback buttons - * Reviewer findings now appear as cards directly under the message they refer to, instead of a single summary card; click a card to open the reviewer's reasoning - * When a connector's sign-in expires mid-session, Claude now tells you which connector to reconnect, and Settings > Connectors shows "Sign-in expired" with a Reconnect button - * Choosing a model whose safeguards block most life sciences research now shows a short warning first, with a one-click switch to an alternative model - * Sessions on Claude Opus 5 now stay focused on what you asked for, with fewer unrequested analyses, figures, and sub-agents - * On macOS behind a TLS-inspecting proxy (such as Zscaler or Netskope), Python, pip, curl, and git inside a session now trust the same corporate root certificate that environment builds already use - * Tab-separated (.tsv) files open as tables, and the 3D structure viewer follows dark mode and opens small-molecule files (SDF, MOL2, XYZ, and similar) in stick view - * First-time setup now includes a memory step, with memory on unless you switch it off there; existing installs keep their current setting (change it anytime under Settings > Memory) - * Security hardening across the analysis sandbox and credential handling on macOS and Linux - * Lots of other miscellaneous improvements and fixes - - - - * On macOS, installs that showed an environment setup error in their first session now repair themselves automatically after updating; the Featured connectors become available once the repair finishes, which can take a few minutes - * Star a session from its menu to keep it in a Starred section at the top of your project's session list - * Get notified when any of your sessions finishes or needs your input, even while you work in another project. In-app notifications are on by default; sound and desktop notifications are under Settings > General > Notifications - * Set reasoning effort for a single session from the session options next to the message box; the value in Settings stays the default for new sessions - * On Pro and Max plans, see your credit balance and monthly spend limit and turn usage credits on or off under Settings > Usage - * When you ask for a plan, Claude now waits for your approval before running code or marking steps done - * Lots of other miscellaneous improvements and fixes - - - - **New** - - * **Improved context preservation.** On Max, Team, and Enterprise plans, sessions go much further before older messages are summarized. - * **Works on corporate networks.** Sign in and install packages on networks with corporate proxies, TLS inspection, or authenticated package mirrors. Mirror credentials go in Settings. No config files needed. - * **Search your memories.** Find anything Claude remembers from the memory screen. Results are highlighted and jump to where they live. The screen also loads faster now. - * **Archive projects.** Tidy your project list without deleting anything; archived projects keep all their data and can be brought back anytime. - * **Password sign-in for SSH machines.** Adding a remote machine that asks for a password instead of a key is now supported. You're prompted when it's needed, and the password is never saved to disk. - * **Compute monitor.** See every running kernel with its memory and CPU use from the new Compute tab. Kernels can be stopped if needed with optional feedback sent to the agent such as "redo this analysis using less memory". - - **Improvements and fixes** - - * **Richer artifact previews.** HTML files show rendered thumbnails, Word documents show text previews, large CSVs show their structure, and PDFs show their first page. - * **Parquet files open as tables.** See a parquet file's columns and first rows right in the app, even for very large files. - * **Memories stay in their project.** Notes from one project no longer surface in another. - * **Annotations travel with your message.** Annotations you've added appear above the message box and carry over when you open a side chat. - * **Less disk space for huge files.** When Claude saves the same very large file over and over, it can now keep just the latest version instead of every copy. - * **The conversation view holds still.** Images no longer shove the page as they load, "View in context" lands on the right message, and mentioning a file always attaches the right one. - * **Edit messages with attachments.** Editing an earlier message now supports file mentions, attachments, and uploads. - * **Many other miscellaneous fixes and improvements.** - - - - **Features** - - * Sessions now pause and ask for your confirmation before spending extra usage. Billed usage credits are never drawn on a dismissible warning alone. - * Claude can now monitor how much memory and processing power its computations are using, and plan its work accordingly. - * Search from inside a project: the project view now has a search button that opens the same search as Cmd+K. - * Download any artifact from any surface: every artifact menu now includes a download option. - * Starred artifacts now pin to a new Starred section at the top of the Library, with a star badge. - - **Fixes** - - * Fixed a crash that could prevent very large sessions from loading. - * Fixed several ways a running session could stall or stop early, including long thinking pauses being cut off mid-run and sessions resuming incorrectly after a crash. - * Fixed the app sometimes becoming unresponsive after an automatic update. - * Code blocks now switch correctly when your system switches between light and dark mode. - * Lots of other miscellaneous improvements and fixes. - - - - * **Fixed a bug where idle sessions were consuming usage.** - * Lots of other miscellaneous improvements and fixes. - - - - **Features** - - * Auto-review is now available on the Pro plan: turn it on from the session settings, and it stays off until you do. - * Artifact previews: zoom HTML artifacts (including fit to width), zoom images to native resolution, and choose which version an artifact diff compares against - * Import skills from private GitHub repositories using your own GitHub credentials - * LaTeX previews now resolve cross-references — \ref, \eqref, and section numbering render the way your document intended - * Dashboard upgrades: a project switcher with live per-project status, project names on the "Now" cards, a visible search button, and ⌘K search now matches project descriptions too - * Annotate artifacts faster: drag image annotation pins to reposition them, and use @/# mentions in annotation comments - - **Fixes** - - * Pasted attachments no longer disappear before their first use, very large text and JSON previews no longer freeze the tab, and a stale usage-limit banner now clears itself once your usage limit resets - * Cloning a repo or unpacking an archive no longer floods the chat with every image it contains - * The Reviewer no longer gets stuck on "Reviewing…" or hides its findings tray - * Flaky read-only connector tool calls now retry once automatically instead of failing your turn, and connector setup errors tell you what's actually wrong - * A corrupt pasted image no longer breaks the transcript - * Upgrading with a very large history database no longer fails partway through - * Fixed a crash when the browser's auto-translate feature modified the page - * Lots of other miscellaneous improvements and fixes - - - - * Corporate networks: environment builds now work behind TLS-inspecting proxies (such as Zscaler or Netskope). On macOS, corporate root CAs in your keychain are picked up automatically for conda/pip package downloads; on macOS or Linux you can also point at a CA-bundle file under Settings > Network > Package mirror. The mirror card's Check button now verifies TLS trust with the same bundle the builds use. (In-session `pip`/`curl` and the Desktop app's guest-VM builds are not covered) - * Package mirrors: point conda and pip at your organization's internal mirror (Artifactory/Nexus) via Settings > Network > Package mirror. Setting a mirror also drops the public package hosts from the sandbox network allowlist - * OpenAlex now requires a free API key for full-text access. Claude Science resolves access automatically or asks you in the session when a key is needed; you can also add and validate a key anytime under Settings > Credentials - * New Context usage view: see how full a session's context window is and where tokens go, from the + menu in the composer - * Lots of other miscellaneous improvements and fixes - - - - * Public launch of Claude Science - +**0.1.67** + +* The Example project now holds nine new example sessions from various scientific fields +* If Claude Science opens in its own window, on Windows or on a Mac, you can now search the page you're on with Ctrl+F (Cmd+F on a Mac) +* The Genomes connector's five UCSC Genome Browser tools and the Regulation connector's UniBind region lookup are unavailable for now +* Pictures in Claude's messages that point at another port or path of the address Claude Science is open on (such as localhost:8888) no longer load; save them as files to show them +* Files whose names Windows treats as shortcuts or themes (.url, .website, .lnk, .pif, .library-ms, .searchConnector-ms, .theme, and desktop.ini) are now downloaded and exported with .txt added to the name. If you trust the file, remove .txt from its name to get the shortcut back +* Leaving setup without starting a first task no longer leaves an empty "Getting started" project behind (if the app reloads or restarts during setup, the empty project can still remain) +* Linux: Claude's requests to delete an ordinary file in a folder you've granted are no longer refused while a session is running just because a protected file such as `.env` sits deeper in the same folder +* Bug fixes and reliability improvements + +**0.1.66** + +* Bug fixes and reliability improvements + +**0.1.63** + +* Tabs in the right pane are now all one width, and the tab you're viewing always shows its close button +* Newly saved artifacts now list more of their input files in Provenance when the code that created them read many files +* Linux: Claude Science now detects an NVIDIA GPU only if `nvidia-smi` can run without your `LD_LIBRARY_PATH` and is in `/usr/bin` or one of a few other fixed folders (`/usr/local/bin` isn't one). Otherwise the app finds no GPU, and the **Host GPU** switch in **Settings > Compute** is hidden unless it's already on +* Linux: a uv, conda, mamba, or pixi environment in a folder you've granted is now read-only to Claude when its files are shared with the tool's package cache (the usual case). Claude can still run code from it but can't add, update, or remove packages in it. The rest of the folder usually stays writable +* Various bug fixes and security improvements + +**0.1.62** + +* Linux: if Claude Science won't start after updating to 0.1.61, run `claude-science update` in a terminal to get 0.1.62 or later, then start it again. If it's still running and the "Update available" notice shows "restart aborted", select "Check for updates" in **Settings > General > About** so it finds the newer version, then "Restart to update" +* Linux: Claude Science starts again when bubblewrap or socat comes from conda, Homebrew, or a folder in your home directory. 0.1.61's requirement that both be installed for the whole system is withdrawn for now, though installing them that way is still recommended +* Fixed the app sometimes becoming unresponsive after Claude saves results from an analysis that read large files +* Various bug fixes and security improvements + +**0.1.61** + +* Sessions you start in the Example project now show on the home screen +* A GitHub token you paste in **Settings > Credentials** now stays after a restart, instead of switching back to the token found on your computer; if yours switched back, paste it again +* Linux: fixed Featured connectors that run on your computer sometimes failing to start right after your first sign-in +* Linux: Claude Science now needs bubblewrap and socat installed for the whole system, from your distribution's packages or by an administrator. If yours came from conda, Homebrew, or a folder in your home directory, the app refuses to start and its message says what to do +* Windows: Claude Science is now signed with a renewed certificate from the same publisher, Anthropic, PBC. If your IT team allows the app by certificate thumbprint, add the new SHA-1 thumbprint `60C2D9C51F09822FFF4F194DE9EEDB67451292D1` and keep the previous one, both listed under [Windows signing certificate](/docs/claude-science/manage-on-devices#windows-signing-certificate) +* Security hardening of the analysis sandbox on Mac, Windows, and Linux +* Various bug fixes and security improvements + +**0.1.60** + +* Mac: fixed a problem introduced in 0.1.59 where Python, R, and some shell commands could fail to run when Claude Science has access to many folders +* **Settings > Network > Package mirror** now shows a mirror credential file your organization deployed, instead of asking for a token + +**0.1.59** + +* Saved approvals for tools from your organization's plugins are cleared, so Claude asks again; new approvals apply only to the plugin that added the tool +* Skills from plugins your organization's admin uploads now appear under Organization in **Settings > Skills**, instead of under Featured +* Comment boxes on figures, PDFs, reports, and files now grow as you type, and a new comment that fails to save keeps your text and shows an error +* Fixed some files failing to upload when you add hundreds of files to a message at once +* `claude-science --here` now refuses to start on a data folder another install created if it holds organization policy files or folders that Claude Science creates for itself; if the folder is yours, run it once with `--trust-here-data` +* Security hardening of the analysis sandbox on Mac, Windows, and Linux +* Various bug fixes and security improvements + +**0.1.56** + +* When safeguards flag a message for life sciences content, Claude Science can now retry it once on another model automatically, depending on the model; turn this off with **Switch models when a message is flagged** in **Settings > General > Model** +* Excel (.xlsx) previews now show cell colors, bold text, and color-scale heat maps +* Reviewer findings now open in place, with a button to the reviewer's full transcript +* A stalled file upload now stops by itself, and a failed upload says why under the file +* Skills: "Check for updates…" now lists only the imported skills whose files changed +* Claude now asks before it uses a tool from a connector that your organization's plugins add +* Fixed a case where the app could delete a skill from your computer when it started +* Windows: zoom the app window with Ctrl+Plus and Ctrl+Minus, and reset it with Ctrl+0 +* Windows: IT teams can now deploy package mirror credentials as a `.netrc` file, as on Mac and Linux +* Mac: the app now applies only a fixed list of variables from the `env` file in the data folder; move a GitHub token to **Settings > Credentials** +* Admins can now turn off Claude's web search tool with `enable_web_search = false` in `config.toml` +* Security hardening of the analysis sandbox on Mac, Windows, and Linux +* Various bug fixes and security improvements + +**0.1.55** + +* New sessions on an organization's default model with more life sciences restrictions now show a notice with a one-click switch to another model +* Fixed an error Claude ran into when outlining an existing multi-panel figure or drafting a paper's brief from its abstract and figure captions + +**0.1.54** + +* Sessions on Claude Sonnet 5.5 now default to Extra high reasoning effort +* Windows: after an update, the app window reopens on the new version by itself +* Pinned artifacts (formerly starred) and pinned projects now show a pushpin instead of a star +* Editing a Markdown table cell now outlines the cell itself instead of opening a box over it +* The app starts much faster with a long list of allowed domains +* Security hardening of the analysis sandbox on Mac, Windows, and Linux +* Various bug fixes and security improvements + +**0.1.53** + +* Paste a list of domains in **Settings > Network** to allow them all at once +* In Markdown files, editing table cells in place now works in files with up to 2,500 table cells, however long their text +* **Settings > Connectors**: a Featured connector that was turned off during setup now shows as off, and turning it back on lets Claude use it again +* Hover over a tab in the right pane to see the file's full name +* Mac: fixed a case where code cells didn't run because Claude wrote the folder's name in a different letter case or accent form than on disk +* Mac: security hardening of the analysis sandbox +* Various bug fixes and security improvements + +**0.1.52** + +* Clicking a figure in Claude's answer now opens it beside the chat; Ctrl/Cmd-click or the new "Open fullscreen" button opens it full screen +* Opening or closing the right pane now keeps your place in a long answer +* Markdown files no longer rotate in Safari after they load +* The reviewer no longer flags working figure links in saved reports as broken +* When Claude sets a Python, R, or shell cell to run in a folder other than the session's workspace, its permission card now shows that folder +* "Download script" and "Download notebook" now give the input and output files in the zip plain names: spaces, brackets, and other special characters become underscores +* Various bug fixes and security improvements + +**0.1.51** + +* Pinned sessions (formerly starred) from across all your projects now appear at the top of the session list; a new switch in **Settings > General > Appearance** lets you limit them to the open project +* In Markdown files, click a plain-text cell in a table to edit it in place +* Tables in Markdown files keep their scroll position when Claude saves another file +* Fixed the BioMart connector's data queries and identifier translation; a data query that filters on more than a few hundred IDs can still fail +* The BioMart connector now reads from Ensembl's June 2026 archive. If your network allowlist lists `www.ensembl.org` by name, add `jun2026.archive.ensembl.org` +* Removed connector tools that failed on every call: the ENCODE and eQTL Catalogue lookups and ZINC's random-sample tool +* "Download script" on an artifact made by a shell command now includes the script itself +* The app stays more responsive while Claude saves files in projects with tens of thousands of files, and zip downloads with thousands of same-named files are prepared much faster +* Mac: security hardening of the analysis sandbox +* Life Sciences Verification Program (beta): fixed a case where your approved use cases could disappear from the app +* Various bug fixes and security improvements + +**0.1.50** + +* Tables in Markdown files now show as a compact grid; a long table keeps its header row in view, and row labels stay in view when you scroll sideways +* Tabs in the right pane can be reordered by dragging, or with Ctrl/Cmd+Shift+Left/Right +* Pasted images are now saved to your uploads, so Claude can keep working with them later in the conversation +* When Claude redraws a figure several times in one turn, the chat keeps only the newest one open; open an earlier step to see its draft +* Closing Settings or Customize by clicking outside it no longer drops an edit you were still typing +* "View in context" on a file version that a different session saved now opens the file's own session instead of an empty screen +* Project settings are now clearer with helper text +* Home screen: project rows now show running sessions in gray like the session cards + +**0.1.49** + +* If your organization is in Anthropic's Life Sciences Verification Program (beta), you can now [choose a use case](/docs/claude-science/safeguards#choose-a-use-case) for your sessions +* Saved credentials now reach Claude's code only when it asks for them and you approve. They're no longer present in every cell +* Access Claude Science work saved on your computer from other sign-ins, from Home or Settings. Admins control it on Team and Enterprise plans +* Claude can send you a short message, such as a link to a file, while it keeps working on a task +* Mac: Apple silicon Macs with the Intel version installed can now update, and then run natively +* Mac: if Claude's tools can't start after an Xcode update, the error now says how to accept the Xcode license +* You can comment on and bookmark the short summaries of Claude's progress notes +* Sessions moved to a model with a smaller context window keep going instead of failing +* Turning Auto-review off now applies to agents that are already running; turning it back on resumes their reviews +* Settings > Connectors shows "Not set" for tools without a permission, and saves "Ask each time" +* Windows: `claude-science install` now reports the step that failed instead of reporting success +* Faster search of a long session's history; clearer wording in model settings + +**0.1.48** + +* On Windows, environment setup now handles user folders with accented or non-Latin names, tries again if Windows briefly refuses to start the environment installer, and no longer needs the Microsoft Visual C++ Redistributable +* The app now warns you a few days before your sign-in expires and offers a "Sign in again" button +* Various bug fixes and security improvements + +**0.1.47** + +* Claude Science is now available for Windows: download it from [claude.com/product/claude-science](https://claude.com/product/claude-science), and see [Get started](/docs/claude-science/get-started) for setup +* Various bug fixes and improvements + +**0.1.43** + +* On Linux, commands, notebook cells, and local connectors work again on systems with bubblewrap's recent security update +* Cloud storage in Settings (Amazon S3, S3-compatible services, and Google Cloud Storage with HMAC keys) now works behind a TLS-inspecting proxy such as Zscaler or Netskope, trusting the same corporate root certificate as sign-in and the Claude API +* Various bug fixes and security improvements + +**0.1.41** + +* Messages now show when they were sent: hover one of your messages to see the time, and Claude's replies show it next to their copy and feedback buttons +* Reviewer findings now appear as cards directly under the message they refer to, instead of a single summary card; click a card to open the reviewer's reasoning +* When a connector's sign-in expires mid-session, Claude now tells you which connector to reconnect, and Settings > Connectors shows "Sign-in expired" with a Reconnect button +* Choosing a model whose safeguards block most life sciences research now shows a short warning first, with a one-click switch to an alternative model +* Sessions on Claude Opus 5 now stay focused on what you asked for, with fewer unrequested analyses, figures, and sub-agents +* On macOS behind a TLS-inspecting proxy (such as Zscaler or Netskope), Python, pip, curl, and git inside a session now trust the same corporate root certificate that environment builds already use +* Tab-separated (.tsv) files open as tables, and the 3D structure viewer follows dark mode and opens small-molecule files (SDF, MOL2, XYZ, and similar) in stick view +* First-time setup now includes a memory step, with memory on unless you switch it off there; existing installs keep their current setting (change it anytime under Settings > Memory) +* Security hardening across the analysis sandbox and credential handling on macOS and Linux +* Lots of other miscellaneous improvements and fixes + +**0.1.27** + +* On macOS, installs that showed an environment setup error in their first session now repair themselves automatically after updating; the Featured connectors become available once the repair finishes, which can take a few minutes +* Star a session from its menu to keep it in a Starred section at the top of your project's session list +* Get notified when any of your sessions finishes or needs your input, even while you work in another project. In-app notifications are on by default; sound and desktop notifications are under Settings > General > Notifications +* Set reasoning effort for a single session from the session options next to the message box; the value in Settings stays the default for new sessions +* On Pro and Max plans, see your credit balance and monthly spend limit and turn usage credits on or off under Settings > Usage +* When you ask for a plan, Claude now waits for your approval before running code or marking steps done +* Lots of other miscellaneous improvements and fixes + +**0.1.21** + +**New** + +* **Improved context preservation.** On Max, Team, and Enterprise plans, sessions go much further before older messages are summarized. +* **Works on corporate networks.** Sign in and install packages on networks with corporate proxies, TLS inspection, or authenticated package mirrors. Mirror credentials go in Settings. No config files needed. +* **Search your memories.** Find anything Claude remembers from the memory screen. Results are highlighted and jump to where they live. The screen also loads faster now. +* **Archive projects.** Tidy your project list without deleting anything; archived projects keep all their data and can be brought back anytime. +* **Password sign-in for SSH machines.** Adding a remote machine that asks for a password instead of a key is now supported. You're prompted when it's needed, and the password is never saved to disk. +* **Compute monitor.** See every running kernel with its memory and CPU use from the new Compute tab. Kernels can be stopped if needed with optional feedback sent to the agent such as "redo this analysis using less memory". + +**Improvements and fixes** + +* **Richer artifact previews.** HTML files show rendered thumbnails, Word documents show text previews, large CSVs show their structure, and PDFs show their first page. +* **Parquet files open as tables.** See a parquet file's columns and first rows right in the app, even for very large files. +* **Memories stay in their project.** Notes from one project no longer surface in another. +* **Annotations travel with your message.** Annotations you've added appear above the message box and carry over when you open a side chat. +* **Less disk space for huge files.** When Claude saves the same very large file over and over, it can now keep just the latest version instead of every copy. +* **The conversation view holds still.** Images no longer shove the page as they load, "View in context" lands on the right message, and mentioning a file always attaches the right one. +* **Edit messages with attachments.** Editing an earlier message now supports file mentions, attachments, and uploads. +* **Many other miscellaneous fixes and improvements.** + +**0.1.18** + +**Features** + +* Sessions now pause and ask for your confirmation before spending extra usage. Billed usage credits are never drawn on a dismissible warning alone. +* Claude can now monitor how much memory and processing power its computations are using, and plan its work accordingly. +* Search from inside a project: the project view now has a search button that opens the same search as Cmd+K. +* Download any artifact from any surface: every artifact menu now includes a download option. +* Starred artifacts now pin to a new Starred section at the top of the Library, with a star badge. + +**Fixes** + +* Fixed a crash that could prevent very large sessions from loading. +* Fixed several ways a running session could stall or stop early, including long thinking pauses being cut off mid-run and sessions resuming incorrectly after a crash. +* Fixed the app sometimes becoming unresponsive after an automatic update. +* Code blocks now switch correctly when your system switches between light and dark mode. +* Lots of other miscellaneous improvements and fixes. + +**0.1.17** + +* **Fixed a bug where idle sessions were consuming usage.** +* Lots of other miscellaneous improvements and fixes. + +**0.1.16** + +**Features** + +* Auto-review is now available on the Pro plan: turn it on from the session settings, and it stays off until you do. +* Artifact previews: zoom HTML artifacts (including fit to width), zoom images to native resolution, and choose which version an artifact diff compares against +* Import skills from private GitHub repositories using your own GitHub credentials +* LaTeX previews now resolve cross-references — \ref, \eqref, and section numbering render the way your document intended +* Dashboard upgrades: a project switcher with live per-project status, project names on the "Now" cards, a visible search button, and ⌘K search now matches project descriptions too +* Annotate artifacts faster: drag image annotation pins to reposition them, and use @/# mentions in annotation comments + +**Fixes** + +* Pasted attachments no longer disappear before their first use, very large text and JSON previews no longer freeze the tab, and a stale usage-limit banner now clears itself once your usage limit resets +* Cloning a repo or unpacking an archive no longer floods the chat with every image it contains +* The Reviewer no longer gets stuck on "Reviewing…" or hides its findings tray +* Flaky read-only connector tool calls now retry once automatically instead of failing your turn, and connector setup errors tell you what's actually wrong +* A corrupt pasted image no longer breaks the transcript +* Upgrading with a very large history database no longer fails partway through +* Fixed a crash when the browser's auto-translate feature modified the page +* Lots of other miscellaneous improvements and fixes + +**0.1.15** + +* Corporate networks: environment builds now work behind TLS-inspecting proxies (such as Zscaler or Netskope). On macOS, corporate root CAs in your keychain are picked up automatically for conda/pip package downloads; on macOS or Linux you can also point at a CA-bundle file under Settings > Network > Package mirror. The mirror card's Check button now verifies TLS trust with the same bundle the builds use. (In-session `pip`/`curl` and the Desktop app's guest-VM builds are not covered) +* Package mirrors: point conda and pip at your organization's internal mirror (Artifactory/Nexus) via Settings > Network > Package mirror. Setting a mirror also drops the public package hosts from the sandbox network allowlist +* OpenAlex now requires a free API key for full-text access. Claude Science resolves access automatically or asks you in the session when a key is needed; you can also add and validate a key anytime under Settings > Credentials +* New Context usage view: see how full a session's context window is and where tokens go, from the + menu in the composer +* Lots of other miscellaneous improvements and fixes + +**0.1.14** + +* Public launch of Claude Science diff --git a/content/claude/claude-science/cloud-storage.md b/content/claude/claude-science/cloud-storage.md index de8aefe272..b31e020c09 100644 --- a/content/claude/claude-science/cloud-storage.md +++ b/content/claude/claude-science/cloud-storage.md @@ -14,10 +14,10 @@ Listing a bucket adds its address to the sandbox network allowlist so code can r Claude reads and writes objects with ordinary code using the provider's Python library (`boto3`, Azure SDK). **Settings > Storage** lists connected credentials and lets you browse and import objects (up to 100 GB) or export artifacts. - - From code, reach Google Cloud Storage with an **HMAC key** via `boto3`, or use the import/export flow. `gsutil`, `gcloud storage`, and the google-cloud-storage Python library use path-style addresses that aren't reachable from the sandbox. - +> [!NOTE] +> +> From code, reach Google Cloud Storage with an **HMAC key** via `boto3`, or use the import/export flow. `gsutil`, `gcloud storage`, and the google-cloud-storage Python library use path-style addresses that aren't reachable from the sandbox. - - Code that Claude writes can use a credential you add here only after you approve a **Credentials** card that names it. By default the approval lasts for the conversation. If a bucket should never be reachable from an analysis session, don't add its credential. - +> [!WARNING] +> +> Code that Claude writes can use a credential you add here only after you approve a **Credentials** card that names it. By default the approval lasts for the conversation. If a bucket should never be reachable from an analysis session, don't add its credential. diff --git a/content/claude/claude-science/command-line-settings.md b/content/claude/claude-science/command-line-settings.md index 816cd06a20..c57a6cd71e 100644 --- a/content/claude/claude-science/command-line-settings.md +++ b/content/claude/claude-science/command-line-settings.md @@ -26,9 +26,9 @@ claude-science serve starts Claude Science and opens the web app in your browser | `claude-science --version` | Print the version. | | `claude-science --help` | Print help for any command. | - - `import` has no preview and no undo. Back up the data directory before you run it; running the same import a second time is safe. - +> [!NOTE] +> +> `import` has no preview and no undo. Back up the data directory before you run it; running the same import a second time is safe. ### Roll back to an earlier build @@ -38,9 +38,9 @@ In a browser tab and in the Windows app, Claude Science checks for updates in th If a newer build has already changed how your data directory stores sessions, the command refuses an older build and installs nothing, because an older build can permanently lose part of every session it writes to. The refusal names a flag that overrides it, `--accept-layout-downgrade`, and says when that is safe. If you cannot tell from the message whether it is safe for you, do not add the flag. - - An older build that does install can still refuse to start if a newer build has already updated the database in your data directory. When it does, it stops at startup and changes nothing in your data. At a terminal, it says the data was `written by a NEWER version`. To start the app again, run `claude-science update`, which installs the latest build. - +> [!NOTE] +> +> An older build that does install can still refuse to start if a newer build has already updated the database in your data directory. When it does, it stops at startup and changes nothing in your data. At a terminal, it says the data was `written by a NEWER version`. To start the app again, run `claude-science update`, which installs the latest build. ## Global flags @@ -76,12 +76,12 @@ The app listens on 127.0.0.1 unless you change `--host`, so it is reachable only `claude-science serve` accepts two flags that each turn off a protection. - - * `--dangerously-no-sandbox` turns the [sandbox](/docs/claude-science/core-concepts#sandbox) off. On macOS and Linux, the code Claude runs then has full read and write access to your home directory and unrestricted network access. On Windows, code cells do not run at all while the flag is set. - * `--dangerously-skip-approvals` approves [permission cards](/docs/claude-science/core-concepts#permission-cards) for you without showing them, until you restart without the flag. That includes Claude's requests to run code, reach network hosts, open folders, and use connector tools. Cards still show for a connector tool you set to [**Ask each time**](/docs/claude-science/custom-connectors) and for requests only you can answer, such as entering an SSH password, permanently deleting artifacts, or spending usage credits. On Linux, the card for a folder too large to check for credential files also still shows. Questions Claude asks you still appear. - - These flags are acceptable only on a machine that is already isolated, such as a container or a disposable virtual machine. Never use them with data or prompts that came from someone else, because Claude may follow instructions hidden in them. Neither belongs in everyday use. - +> [!WARNING] +> +> * `--dangerously-no-sandbox` turns the [sandbox](/docs/claude-science/core-concepts#sandbox) off. On macOS and Linux, the code Claude runs then has full read and write access to your home directory and unrestricted network access. On Windows, code cells do not run at all while the flag is set. +> * `--dangerously-skip-approvals` approves [permission cards](/docs/claude-science/core-concepts#permission-cards) for you without showing them, until you restart without the flag. That includes Claude's requests to run code, reach network hosts, open folders, and use connector tools. Cards still show for a connector tool you set to [**Ask each time**](/docs/claude-science/custom-connectors) and for requests only you can answer, such as entering an SSH password, permanently deleting artifacts, or spending usage credits. On Linux, the card for a folder too large to check for credential files also still shows. Questions Claude asks you still appear. +> +> These flags are acceptable only on a machine that is already isolated, such as a container or a disposable virtual machine. Never use them with data or prompts that came from someone else, because Claude may follow instructions hidden in them. Neither belongs in everyday use. If your organization [manages the network allowlist](/docs/claude-science/admin-controls#network-allowlist), the app ignores `--dangerously-no-sandbox` and keeps the sandbox on. If the app learns of that setting only after it has started without the sandbox, it pauses new sessions and messages until you restart it. @@ -98,16 +98,14 @@ See [How the environment variables reach the app](/docs/claude-science/corporate ## See also - - - Install Claude Science on a server and use it from your own browser through an SSH tunnel. - +> **[Run on a remote Linux server](/docs/claude-science/run-on-remote-linux-server)** +> +> Install Claude Science on a server and use it from your own browser through an SSH tunnel. - - Find the `config.toml` file and set its network-related keys. - +> **[Configuration file reference](/docs/claude-science/configuration-file-reference)** +> +> Find the `config.toml` file and set its network-related keys. - - Connect an SSH host and run jobs on it. - - +> **[Remote compute clusters](/docs/claude-science/remote-compute-clusters)** +> +> Connect an SSH host and run jobs on it. diff --git a/content/claude/claude-science/comments.md b/content/claude/claude-science/comments.md index 4248555419..218885204b 100644 --- a/content/claude/claude-science/comments.md +++ b/content/claude/claude-science/comments.md @@ -8,9 +8,9 @@ In Claude Science, comments let you pin notes to specific parts of an artifact instead of describing a location in prose. Select text in a Markdown, plain-text, LaTeX, or code file; select text in a PDF; click a point on an image or figure; or turn on **Comment** and click an element in a rendered HTML report. You can also comment on session transcripts. You can't comment on tables or other artifact types. - - This page covers comments on [artifacts in the Claude Science app](/docs/claude-science/artifacts). For artifacts in a claude.ai chat, see [What are artifacts and how do I use them?](https://support.claude.com/en/articles/17153992-what-are-artifacts-and-how-do-i-use-them) in the help center. - +> [!NOTE] +> +> This page covers comments on [artifacts in the Claude Science app](/docs/claude-science/artifacts). For artifacts in a claude.ai chat, see [What are artifacts and how do I use them?](https://support.claude.com/en/articles/17153992-what-are-artifacts-and-how-do-i-use-them) in the help center. ## Leaving a comment diff --git a/content/claude/claude-science/compute-providers.md b/content/claude/claude-science/compute-providers.md index 55bbddd769..e950045ade 100644 --- a/content/claude/claude-science/compute-providers.md +++ b/content/claude/claude-science/compute-providers.md @@ -26,9 +26,9 @@ A separate card asks before Claude opens a Modal setup shell (capped at 30 minut Input files are limited to 1 GiB per submit. For larger inputs, Claude can stage data to a Modal Volume and mount it into the job. Outputs written to `./out/` (up to 5 GiB) are returned with logs. - - Closing the app doesn't cancel a running Modal job; it continues billing until it finishes or times out. - +> [!NOTE] +> +> Closing the app doesn't cancel a running Modal job; it continues billing until it finishes or times out. Cost controls: there's no spend ceiling. Each job is approved individually with its machine and time limit visible. **Concurrent jobs** (default 10, set on the Modal page under Settings > Compute) caps simultaneous containers that Claude Science on this machine can run. **Default container timeout** is 12 hours (maximum 23), enforced by Modal. Track spend on Modal's dashboard. diff --git a/content/claude/claude-science/connectors-and-skills.md b/content/claude/claude-science/connectors-and-skills.md index 2b3c26e64c..92a52b2701 100644 --- a/content/claude/claude-science/connectors-and-skills.md +++ b/content/claude/claude-science/connectors-and-skills.md @@ -14,7 +14,7 @@ Claude Science includes Featured connectors to public research databases, most o | Connector | Sources | | - | - | -| Genomes | Ensembl (incl. VEP), UCSC | +| Genomes | Ensembl (incl. VEP) | | Genes & Ontologies | MyGene, UniProt, GO, Reactome, OLS | | Variants | gnomAD, ClinVar, dbSNP | | Human Genetics | GWAS Catalog, FinnGen, BioBank Japan | diff --git a/content/claude/claude-science/core-concepts.md b/content/claude/claude-science/core-concepts.md index 2ed7ec7dd6..71dfe237f6 100644 --- a/content/claude/claude-science/core-concepts.md +++ b/content/claude/claude-science/core-concepts.md @@ -18,9 +18,9 @@ Claude reads and writes files in place, in the folders you grant. Anthropic does The one exception to working in place is **Attach files** in the composer: attached files are copied into the application's local data folder so they stay with the conversation. - - Don't move, rename, or delete files inside \~/.claude-science directly. Doing so can break artifact links and version history. Manage artifacts through the app. - +> [!WARNING] +> +> Don't move, rename, or delete files inside \~/.claude-science directly. Doing so can break artifact links and version history. Manage artifacts through the app. ## Permission cards diff --git a/content/claude/claude-science/corporate-networks.md b/content/claude/claude-science/corporate-networks.md index e6247473a3..634a863974 100644 --- a/content/claude/claude-science/corporate-networks.md +++ b/content/claude/claude-science/corporate-networks.md @@ -49,19 +49,17 @@ The organization setting takes a conda channel URL and a Python package index (P Set both a conda channel mirror and a pip index: analysis environments are built from conda packages, so a pip index alone leaves the first build stuck trying to reach the public conda host. - - - Open **Settings** > **Network**, select **Configure** on the **Package mirror** row, and paste the base URL of your conda mirror. For JFrog Artifactory that is the conda API root or a virtual conda repository, for example `https://yourorg.jfrog.io/artifactory/api/conda/conda-all`. - +**1. Enter the conda channel mirror** - - Paste your Python package index, including the `/simple` suffix that Artifactory and Nexus PyPI remotes use, for example `https://yourorg.jfrog.io/artifactory/api/pypi/pypi-remote/simple`. - +Open **Settings** > **Network**, select **Configure** on the **Package mirror** row, and paste the base URL of your conda mirror. For JFrog Artifactory that is the conda API root or a virtual conda repository, for example `https://yourorg.jfrog.io/artifactory/api/conda/conda-all`. - - Select **Save**, then **Check**: a green result confirms the mirror answered, and a `401` or `403` on an authenticated mirror is expected until a credential is saved or, on Windows, deployed as a file (see [Mirror credentials](#mirror-credentials)). The mirror takes effect for the next package operation without a restart. On a machine with an outbound proxy, confirm with a test environment build rather than the check alone (see [Mirror traffic and your other network controls](#mirror-traffic-and-your-other-network-controls)). - - +**2. Enter the pip index URL** + +Paste your Python package index, including the `/simple` suffix that Artifactory and Nexus PyPI remotes use, for example `https://yourorg.jfrog.io/artifactory/api/pypi/pypi-remote/simple`. + +**3. Save, then run the check** + +Select **Save**, then **Check**: a green result confirms the mirror answered, and a `401` or `403` on an authenticated mirror is expected until a credential is saved or, on Windows, deployed as a file (see [Mirror credentials](#mirror-credentials)). The mirror takes effect for the next package operation without a restart. On a machine with an outbound proxy, confirm with a test environment build rather than the check alone (see [Mirror traffic and your other network controls](#mirror-traffic-and-your-other-network-controls)). The mirror must serve the standard conda channel layout, with one base URL, one directory per channel, and one per platform beneath it: @@ -79,9 +77,9 @@ The mirror must serve the standard conda channel layout, with one base URL, one Your mirror must serve at least `conda-forge` (every environment uses it) and `bioconda` for R and bioinformatics work; other channels a member requests (for example `pytorch` or `nvidia`) resolve under the same mirror base, so serve those too if needed. Anaconda's commercial `defaults` channel is rejected while a mirror is configured, so members should use `conda-forge` instead. - - Do not point the conda mirror at a remote repository configured for a single channel (for example one whose upstream is `https://conda.anaconda.org/conda-forge`): it returns an empty index that the check reports green while every build then fails with `nothing provides `. Use a remote that proxies the conda host root (`…/artifactory/api/conda/conda-remote`), a virtual conda repository, or the conda API root with channel-named remote repositories beneath it. - +> [!NOTE] +> +> Do not point the conda mirror at a remote repository configured for a single channel (for example one whose upstream is `https://conda.anaconda.org/conda-forge`): it returns an empty index that the check reports green while every build then fails with `nothing provides `. Use a remote that proxies the conda host root (`…/artifactory/api/conda/conda-remote`), a virtual conda repository, or the conda API root with channel-named remote repositories beneath it. Mirror URLs must use `https://`, name a host by DNS name rather than IP address, and use port 443 or 8443, so an Artifactory instance on its stock port 8081 needs a 443 or 8443 listener or a reverse proxy in front of it. Credentials embedded in the URL are rejected at save time. The Settings page accepts `https://` mirrors only, while Claude Science also accepts an `http://` mirror from `config.toml` when `[conda] allow_insecure_mirror` is set. Validate mirror URLs before distributing a `config.toml`, since an invalid deployed value prevents the app from starting. @@ -100,9 +98,9 @@ To manage mirror credentials centrally, deploy a `.netrc` file to each member's * **macOS and Linux**: `~/.claude-science/conda/.netrc` * **Windows, version 0.1.56 or later**: `%USERPROFILE%\.claude-science\conda\.netrc` - - On Windows, a deployment tool that runs as an administrator or as the system account needs the member's full path, such as `C:\Users\ada\.claude-science\conda\.netrc`. - +> [!NOTE] +> +> On Windows, a deployment tool that runs as an administrator or as the system account needs the member's full path, such as `C:\Users\ada\.claude-science\conda\.netrc`. Write one block like this for each mirror host: @@ -183,9 +181,9 @@ How the variables reach the app depends on the operating system: Only Basic proxy authentication, supplied in the proxy address, is supported; NTLM, Negotiate, and Kerberos proxies aren't. Claude Science doesn't evaluate PAC files on Linux or on a Mac where it opens in a browser tab, so networks that publish only a PAC or WPAD file aren't supported there. The app window on Windows and macOS follows a PAC or WPAD file as described under [System proxy settings on macOS and Windows](#system-proxy-settings-on-macos-and-windows). - - For a proxy that only speaks NTLM or Kerberos, a local relay such as `cntlm` or `px` works: the relay runs on the workstation, authenticates to your corporate proxy with the user's credentials, and exposes a plain HTTP proxy on the loopback interface. Point `HTTPS_PROXY` and `HTTP_PROXY` at the relay (for example `http://127.0.0.1:3128`). The loopback bypass governs which destinations skip the proxy, not whether the proxy can be reached, so a loopback relay works as a proxy address. - +> [!NOTE] +> +> For a proxy that only speaks NTLM or Kerberos, a local relay such as `cntlm` or `px` works: the relay runs on the workstation, authenticates to your corporate proxy with the user's credentials, and exposes a plain HTTP proxy on the loopback interface. Point `HTTPS_PROXY` and `HTTP_PROXY` at the relay (for example `http://127.0.0.1:3128`). The loopback bypass governs which destinations skip the proxy, not whether the proxy can be reached, so a loopback relay works as a proxy address. Environment builds reach a configured [package mirror](#point-package-installs-at-an-internal-mirror) directly, not through the proxy. Separately, on Linux, on Windows, and on a Mac where Claude Science opens in a browser tab, the `claude-science update` terminal command is its own process. It honors proxy variables exported in that shell but not the macOS `env` file, so export the variables in the terminal first. The background updater inside the running app uses the app's proxy settings, except on a Mac where Claude Science opens in its own window (see [Proxy and certificates for updates in the Mac app window](#proxy-and-certificates-for-updates-in-the-mac-app-window)). @@ -216,9 +214,9 @@ ca_bundle = "/etc/claude-science/complete-bundle.pem" The same path rules apply as for `[network] ca_bundle`; the [configuration file reference](/docs/claude-science/configuration-file-reference#package-download-keys) lists them. - - Do not point `[conda] ca_bundle` at the single-root file you use for `[network] ca_bundle`: the package-download setting replaces the whole trust list, so a file containing only your corporate root breaks every package download (on Windows, every download made by code inside a session) on any network your proxy does not inspect, such as a laptop on home Wi-Fi. Build the `[conda]` bundle from your system's public roots plus the corporate root. - +> [!WARNING] +> +> Do not point `[conda] ca_bundle` at the single-root file you use for `[network] ca_bundle`: the package-download setting replaces the whole trust list, so a file containing only your corporate root breaks every package download (on Windows, every download made by code inside a session) on any network your proxy does not inspect, such as a laptop on home Wi-Fi. Build the `[conda]` bundle from your system's public roots plus the corporate root. ### What the certificate settings do not cover diff --git a/content/claude/claude-science/custom-connectors.md b/content/claude/claude-science/custom-connectors.md index 63bf1c3319..4a8e8210f5 100644 --- a/content/claude/claude-science/custom-connectors.md +++ b/content/claude/claude-science/custom-connectors.md @@ -14,8 +14,8 @@ On Team and Enterprise plans, you can add and use custom connectors only if your Every tool from a custom connector starts as **Not set**, and Claude asks before using it. On the connector's page, set individual tools to **Always allow**, **Ask each time**, or **Block** under **Tools**, or turn on Skip approvals for the whole connector. - - Skip approvals disables the per-call card for every tool on that connector. Only use connectors from developers you trust. - +> [!WARNING] +> +> Skip approvals disables the per-call card for every tool on that connector. Only use connectors from developers you trust. Local-command connectors run inside the sandbox with the same network limits as Claude's code and a per-connector writable directory. Environment variables for local connectors are saved unencrypted in a configuration file readable by your account only; don't put high-value secrets there. On Windows, a local-command connector starts with `npx`, `node`, `python`, or the full path of a program. Connectors launched through `npm` or a `.cmd`, `.bat`, or `.ps1` file aren't supported there. diff --git a/content/claude/claude-science/example-gallery.md b/content/claude/claude-science/example-gallery.md index 2170323a4c..071b9a0fe3 100644 --- a/content/claude/claude-science/example-gallery.md +++ b/content/claude/claude-science/example-gallery.md @@ -8,24 +8,20 @@ Copy an example's prompt into a new session in [Claude Science](/docs/claude-science/overview) and compare your result with its reference analysis. -
- - +> **[Genetic drift in a bottle: Buri's 107 fruit-fly populations](/docs/claude-science/example-gallery/bio-drift)** - +> **[A titration curve from the full equilibrium: which indicator finds the equivalence point?](/docs/claude-science/example-gallery/chem-titration)** - +> **[A first Kaplan–Meier curve: the 1963 leukemia trial of 6-MP](/docs/claude-science/example-gallery/clin-km)** - +> **[PageRank on a web of 11 pages: why 1 good link beats 6 weak ones](/docs/claude-science/example-gallery/cs-pagerank-tiny)** - +> **[A first finite-element model: a clamped steel ruler bends and vibrates](/docs/claude-science/example-gallery/eng-beam)** - +> **[A first X-ray diffraction pattern: why silicon shows 6 peaks and salt 9](/docs/claude-science/example-gallery/mat-xrd)** - +> **[The Ulam spiral: are the primes' diagonal streaks real?](/docs/claude-science/example-gallery/math-ulam)** - +> **[The double slit, one electron at a time](/docs/claude-science/example-gallery/phys-doubleslit)** - - -
+> **[Schelling's segregation model: ask for 30% same-color neighbors, end up with 75%](/docs/claude-science/example-gallery/soc-schelling-small)** diff --git a/content/claude/claude-science/example-gallery/bio-drift.md b/content/claude/claude-science/example-gallery/bio-drift.md index ac91a13ab7..fb75b9a7ab 100644 --- a/content/claude/claude-science/example-gallery/bio-drift.md +++ b/content/claude/claude-science/example-gallery/bio-drift.md @@ -6,13 +6,7 @@ > Simulate 107 bottles of 16 fruit flies drifting by chance alone and compare them with Peter Buri's real bottles (1956). -
- - Three panels: 107 simulated allele-frequency paths over 19 generations, histograms at generations 1, 5, 10, and 19, and 20,000 replays at 16 and 9 breeding flies against Buri's 58. - - Three panels: 107 simulated allele-frequency paths over 19 generations, histograms at generations 1, 5, 10, and 19, and 20,000 replays at 16 and 9 breeding flies against Buri's 58. - -
+![Three panels: 107 simulated allele-frequency paths over 19 generations, histograms at generations 1, 5, 10, and 19, and 20,000 replays at 16 and 9 breeding flies against Buri's 58.](https://mintcdn.com/claude-ai/F2QP9ubtYgT0edFI/images/claude-science/example-gallery/bio-drift-full-light.webp?fit=max\&auto=format\&n=F2QP9ubtYgT0edFI\&q=85\&s=2e5d4d7b916e451a8f4d3fcdbcdb7dd9) The numbers in your session might differ from this picture and from the summary in [Reference analysis](#reference-analysis). diff --git a/content/claude/claude-science/example-gallery/chem-titration.md b/content/claude/claude-science/example-gallery/chem-titration.md index d8a3201c22..d6da20e7f1 100644 --- a/content/claude/claude-science/example-gallery/chem-titration.md +++ b/content/claude/claude-science/example-gallery/chem-titration.md @@ -6,13 +6,7 @@ > Solve the full equilibrium for 25.0 mL of 0.100 M acetic acid as 0.100 M NaOH is added, without the usual shortcuts. -
- - Left: acetic acid's titration curve, with pH 2.88 at the start, 4.76 half-way, and 8.73 at equivalence. Right: acetic acid and HCl with the methyl orange and phenolphthalein ranges shaded: for acetic acid, methyl orange turns 17.4 mL too early. - - Left: acetic acid's titration curve, with pH 2.88 at the start, 4.76 half-way, and 8.73 at equivalence. Right: acetic acid and HCl with the methyl orange and phenolphthalein ranges shaded: for acetic acid, methyl orange turns 17.4 mL too early. - -
+![Left: acetic acid's titration curve, with pH 2.88 at the start, 4.76 half-way, and 8.73 at equivalence. Right: acetic acid and HCl with the methyl orange and phenolphthalein ranges shaded: for acetic acid, methyl orange turns 17.4 mL too early.](https://mintcdn.com/claude-ai/F2QP9ubtYgT0edFI/images/claude-science/example-gallery/chem-titration-full-light.webp?fit=max\&auto=format\&n=F2QP9ubtYgT0edFI\&q=85\&s=37e8dfb5f136ac8d3872d9cd328d04be) The numbers in your session might differ from this picture and from the summary in [Reference analysis](#reference-analysis). diff --git a/content/claude/claude-science/example-gallery/clin-km.md b/content/claude/claude-science/example-gallery/clin-km.md index c4ef7916a6..f070d8ff94 100644 --- a/content/claude/claude-science/example-gallery/clin-km.md +++ b/content/claude/claude-science/example-gallery/clin-km.md @@ -6,13 +6,7 @@ > Compare 6-MP against placebo with Kaplan–Meier curves from 42 remission times typed into the prompt. -
- - Two Kaplan–Meier plots: 6-MP and placebo remission curves with medians of 23 and 8 weeks (log-rank p = 0.00004), and the 6-MP curve three ways, with medians of 23, 16, and 10 weeks. - - Two Kaplan–Meier plots: 6-MP and placebo remission curves with medians of 23 and 8 weeks (log-rank p = 0.00004), and the 6-MP curve three ways, with medians of 23, 16, and 10 weeks. - -
+![Two Kaplan–Meier plots: 6-MP and placebo remission curves with medians of 23 and 8 weeks (log-rank p = 0.00004), and the 6-MP curve three ways, with medians of 23, 16, and 10 weeks.](https://mintcdn.com/claude-ai/F2QP9ubtYgT0edFI/images/claude-science/example-gallery/clin-km-full-light.webp?fit=max\&auto=format\&n=F2QP9ubtYgT0edFI\&q=85\&s=c4d20dad5701ebceb1d87c476424d2d3) The numbers in your session might differ from this picture and from the summary in [Reference analysis](#reference-analysis). diff --git a/content/claude/claude-science/example-gallery/cs-pagerank-tiny.md b/content/claude/claude-science/example-gallery/cs-pagerank-tiny.md index 0e29590798..80af841284 100644 --- a/content/claude/claude-science/example-gallery/cs-pagerank-tiny.md +++ b/content/claude/claude-science/example-gallery/cs-pagerank-tiny.md @@ -6,13 +6,7 @@ > Follow a random surfer on Wikipedia's 11-page example until the numbers settle, and reproduce all 11 published values to 0.1 point. -
- - Three panels: the 11-page web as circles sized by PageRank, the 11 shares settling to B 38.4%, C 34.3%, and E 8.1%, and bars showing that C's one link brings 32.7 points while E's six bring 6.5. - - Three panels: the 11-page web as circles sized by PageRank, the 11 shares settling to B 38.4%, C 34.3%, and E 8.1%, and bars showing that C's one link brings 32.7 points while E's six bring 6.5. - -
+![Three panels: the 11-page web as circles sized by PageRank, the 11 shares settling to B 38.4%, C 34.3%, and E 8.1%, and bars showing that C's one link brings 32.7 points while E's six bring 6.5.](https://mintcdn.com/claude-ai/F2QP9ubtYgT0edFI/images/claude-science/example-gallery/cs-pagerank-tiny-full-light.webp?fit=max\&auto=format\&n=F2QP9ubtYgT0edFI\&q=85\&s=44bf56115d462e279420a8cfb04b1499) The numbers in your session might differ from this picture and from the summary in [Reference analysis](#reference-analysis). diff --git a/content/claude/claude-science/example-gallery/eng-beam.md b/content/claude/claude-science/example-gallery/eng-beam.md index a15803ee5d..a23515ae15 100644 --- a/content/claude/claude-science/example-gallery/eng-beam.md +++ b/content/claude/claude-science/example-gallery/eng-beam.md @@ -6,13 +6,7 @@ > Split a 300 mm steel ruler clamped at one end into 4 beam elements and check its bending under 1 N and its first 3 vibration modes against beam theory. -
- - Three plots: the ruler bent under 1 N, tip 0.800 mm down as theory says; its first 3 mode shapes at 27.18, 170.53, and 480.62 Hz over theory; and frequency errors falling from 2 to 16 elements. - - Three plots: the ruler bent under 1 N, tip 0.800 mm down as theory says; its first 3 mode shapes at 27.18, 170.53, and 480.62 Hz over theory; and frequency errors falling from 2 to 16 elements. - -
+![Three plots: the ruler bent under 1 N, tip 0.800 mm down as theory says; its first 3 mode shapes at 27.18, 170.53, and 480.62 Hz over theory; and frequency errors falling from 2 to 16 elements.](https://mintcdn.com/claude-ai/F2QP9ubtYgT0edFI/images/claude-science/example-gallery/eng-beam-full-light.webp?fit=max\&auto=format\&n=F2QP9ubtYgT0edFI\&q=85\&s=f7c1012ed8af806d3ec445c6973cf630) The numbers in your session might differ from this picture and from the summary in [Reference analysis](#reference-analysis). diff --git a/content/claude/claude-science/example-gallery/mat-xrd.md b/content/claude/claude-science/example-gallery/mat-xrd.md index f7b060d443..5801011a81 100644 --- a/content/claude/claude-science/example-gallery/mat-xrd.md +++ b/content/claude/claude-science/example-gallery/mat-xrd.md @@ -6,13 +6,7 @@ > Simulate the X-ray powder patterns of silicon and table salt and label every peak with Bragg's law. -
- - Simulated X-ray diffraction patterns: silicon has 6 labeled peaks, with 200, 222, and 420 marked absent; rock salt has 9. - - Simulated X-ray diffraction patterns: silicon has 6 labeled peaks, with 200, 222, and 420 marked absent; rock salt has 9. - -
+![Simulated X-ray diffraction patterns: silicon has 6 labeled peaks, with 200, 222, and 420 marked absent; rock salt has 9.](https://mintcdn.com/claude-ai/F2QP9ubtYgT0edFI/images/claude-science/example-gallery/mat-xrd-full-light.webp?fit=max\&auto=format\&n=F2QP9ubtYgT0edFI\&q=85\&s=6d56de735b8fe6c1fd456f7259fc7d4d) The numbers in your session might differ from this picture and from the summary in [Reference analysis](#reference-analysis). diff --git a/content/claude/claude-science/example-gallery/math-ulam.md b/content/claude/claude-science/example-gallery/math-ulam.md index d43f89dd38..0abc74141f 100644 --- a/content/claude/claude-science/example-gallery/math-ulam.md +++ b/content/claude/claude-science/example-gallery/math-ulam.md @@ -6,13 +6,7 @@ > Compare the share of primes per diagonal on Ulam's 1963 spiral of 1 to 40,401 against as many random odd numbers. -
- - Primes up to 40,401 on Ulam's spiral, with primes of n² + n + 41 in orange along 2 rays; as many random odd numbers, with no streaks; and histograms of each diagonal's share, wider for the primes. - - Primes up to 40,401 on Ulam's spiral, with primes of n² + n + 41 in orange along 2 rays; as many random odd numbers, with no streaks; and histograms of each diagonal's share, wider for the primes. - -
+![Primes up to 40,401 on Ulam's spiral, with primes of n² + n + 41 in orange along 2 rays; as many random odd numbers, with no streaks; and histograms of each diagonal's share, wider for the primes.](https://mintcdn.com/claude-ai/F2QP9ubtYgT0edFI/images/claude-science/example-gallery/math-ulam-full-light.webp?fit=max\&auto=format\&n=F2QP9ubtYgT0edFI\&q=85\&s=140ca573e05d853818df9ab149c1f064) The numbers in your session might differ from this picture and from the summary in [Reference analysis](#reference-analysis). diff --git a/content/claude/claude-science/example-gallery/phys-doubleslit.md b/content/claude/claude-science/example-gallery/phys-doubleslit.md index 49739fed57..8cfeea4b99 100644 --- a/content/claude/claude-science/example-gallery/phys-doubleslit.md +++ b/content/claude/claude-science/example-gallery/phys-doubleslit.md @@ -6,13 +6,7 @@ > Rebuild the picture of Tonomura's 1989 experiment with an ideal double slit: each electron lands as 1 random dot, yet fringes 10.7 µm apart build up. -
- - Dots after 10 to 100,000 electrons build up into fringes; a histogram fit gives a spacing of 10.706 ± 0.003 µm against λL/d = 10.711 µm, and a smooth curve shows no fringes when the slit is known. - - Dots after 10 to 100,000 electrons build up into fringes; a histogram fit gives a spacing of 10.706 ± 0.003 µm against λL/d = 10.711 µm, and a smooth curve shows no fringes when the slit is known. - -
+![Dots after 10 to 100,000 electrons build up into fringes; a histogram fit gives a spacing of 10.706 ± 0.003 µm against λL/d = 10.711 µm, and a smooth curve shows no fringes when the slit is known.](https://mintcdn.com/claude-ai/F2QP9ubtYgT0edFI/images/claude-science/example-gallery/phys-doubleslit-full-light.webp?fit=max\&auto=format\&n=F2QP9ubtYgT0edFI\&q=85\&s=d33485dbb10e2b0e60ce7127967ae21c) The numbers in your session might differ from this picture and from the summary in [Reference analysis](#reference-analysis). diff --git a/content/claude/claude-science/example-gallery/soc-schelling-small.md b/content/claude/claude-science/example-gallery/soc-schelling-small.md index 7a0a22be3b..f7c2216b16 100644 --- a/content/claude/claude-science/example-gallery/soc-schelling-small.md +++ b/content/claude/claude-science/example-gallery/soc-schelling-small.md @@ -6,13 +6,7 @@ > Ask for 30% same-color neighbors, end up with about 75%: the textbook computer version of Thomas Schelling's 1971 idea. -
- - A random board of blue and orange households (49% of neighbors alike), the same board settled into one-color patches (75%), and a curve of the share alike at the end against the demand, 51.3% to 99.6%. - - A random board of blue and orange households (49% of neighbors alike), the same board settled into one-color patches (75%), and a curve of the share alike at the end against the demand, 51.3% to 99.6%. - -
+![A random board of blue and orange households (49% of neighbors alike), the same board settled into one-color patches (75%), and a curve of the share alike at the end against the demand, 51.3% to 99.6%.](https://mintcdn.com/claude-ai/F2QP9ubtYgT0edFI/images/claude-science/example-gallery/soc-schelling-small-full-light.webp?fit=max\&auto=format\&n=F2QP9ubtYgT0edFI\&q=85\&s=9150fb06019e6cb83311d70c1493c396) The numbers in your session might differ from this picture and from the summary in [Reference analysis](#reference-analysis). diff --git a/content/claude/claude-science/get-started.md b/content/claude/claude-science/get-started.md index 5f756a5539..17e60114b1 100644 --- a/content/claude/claude-science/get-started.md +++ b/content/claude/claude-science/get-started.md @@ -10,71 +10,69 @@ Install Claude Science on your computer, sign in with your Claude account, and r ## Install - - - Download the installer from [claude.com/product/claude-science](https://claude.com/product/claude-science) and double-click to install. On first launch, the app sets up its runtime and starter Python and R environments, which takes a few minutes, then opens a new tab in your default browser. If no browser tab appears, click **Claude Science** in the Dock. +**macOS** - **Updates.** Installing an update from inside Claude Science can switch it from a browser tab to its own window. See [Claude Science in its own window on macOS](/docs/claude-science/mac-app-window). +Download the installer from [claude.com/product/claude-science](https://claude.com/product/claude-science) and double-click to install. On first launch, the app sets up its runtime and starter Python and R environments, which takes a few minutes, then opens a new tab in your default browser. If no browser tab appears, click **Claude Science** in the Dock. - * **If it opens in a browser tab**: Claude Science checks for updates in the background and shows **Update available** when one is ready. Choose **Restart to update** to install it. - * **If it opens in its own window**: Claude Science downloads updates by itself and installs them when you quit. To check for an update right away, choose **Claude Science > Check for App Updates…** in the menu bar. - +**Updates.** Installing an update from inside Claude Science can switch it from a browser tab to its own window. See [Claude Science in its own window on macOS](/docs/claude-science/mac-app-window). - - Download the installer from [claude.com/product/claude-science](https://claude.com/product/claude-science) and open it. It installs Claude Science for your user account, adds **Claude Science** to the Start menu and the desktop, and opens the app in its own window. The installer is signed by Anthropic, PBC. On first launch, Claude Science sets up the sandbox and downloads its app window engine (about 150 MB) from `downloads.claude.ai` before the window appears, so the first start takes longer than later ones, and a notice shows progress. The starter Python and R environments keep setting up in the background for several minutes after the window opens. +* **If it opens in a browser tab**: Claude Science checks for updates in the background and shows **Update available** when one is ready. Choose **Restart to update** to install it. +* **If it opens in its own window**: Claude Science downloads updates by itself and installs them when you quit. To check for an update right away, choose **Claude Science > Check for App Updates…** in the menu bar. - **One-time Windows permission.** If Claude Science asks for one-time permission from Windows so that cells can run git and Command Prompt scripts and PowerShell can change folders, **Yes** lets Windows ask for approval (an administrator's password if you aren't one) and **No** leaves those features off. Python and R cells work either way, and the **Ask Windows now** button under **Settings** > **Permissions** grants the permission later. +**Windows** - **Notification-area icon.** Closing the window leaves Claude Science running, with an icon in the notification area of the taskbar. Click the icon to reopen the window, or choose **Quit Claude Science** from the icon's menu to stop the app. +Download the installer from [claude.com/product/claude-science](https://claude.com/product/claude-science) and open it. It installs Claude Science for your user account, adds **Claude Science** to the Start menu and the desktop, and opens the app in its own window. The installer is signed by Anthropic, PBC. On first launch, Claude Science sets up the sandbox and downloads its app window engine (about 150 MB) from `downloads.claude.ai` before the window appears, so the first start takes longer than later ones, and a notice shows progress. The starter Python and R environments keep setting up in the background for several minutes after the window opens. - **Updates.** Claude Science checks for updates in the background and shows **Update available** when one is ready; choose **Restart to update** to install it. Administrators who distribute the app themselves can turn the background check off with `auto_update = false` under `[update]` in `config.toml` (see [Manage Claude Science on devices](/docs/claude-science/manage-on-devices#deploy-configuration-with-device-management)). To update Claude Science yourself instead, open a newer installer, which upgrades the installed copy in place and keeps your data. +**One-time Windows permission.** If Claude Science asks for one-time permission from Windows so that cells can run git and Command Prompt scripts and PowerShell can change folders, **Yes** lets Windows ask for approval (an administrator's password if you aren't one) and **No** leaves those features off. Python and R cells work either way, and the **Ask Windows now** button under **Settings** > **Permissions** grants the permission later. - **Uninstall.** To remove the app, follow the Windows steps in [Uninstall Claude Science](#uninstall-claude-science). +**Notification-area icon.** Closing the window leaves Claude Science running, with an icon in the notification area of the taskbar. Click the icon to reopen the window, or choose **Quit Claude Science** from the icon's menu to stop the app. - **Corporate networks.** Claude Science follows the proxy configured in Windows proxy settings and trusts corporate root certificates installed for the whole computer, so most managed PCs need no Claude Science configuration. See [Use Claude Science on a corporate network](/docs/claude-science/corporate-networks). +**Updates.** Claude Science checks for updates in the background and shows **Update available** when one is ready; choose **Restart to update** to install it. Administrators who distribute the app themselves can turn the background check off with `auto_update = false` under `[update]` in `config.toml` (see [Manage Claude Science on devices](/docs/claude-science/manage-on-devices#deploy-configuration-with-device-management)). To update Claude Science yourself instead, open a newer installer, which upgrades the installed copy in place and keeps your data. - **Differences on Windows:** +**Uninstall.** To remove the app, follow the Windows steps in [Uninstall Claude Science](#uninstall-claude-science). - * Claude runs shell commands with PowerShell. Command Prompt scripts, git inside cells, and folder changes in PowerShell need the one-time Windows permission. - * Only folders on local NTFS or ReFS drives can be granted, not network shares, mapped network drives, FAT or exFAT drives (many USB sticks and memory cards), or a whole drive such as `D:\`. Copy such files to a local folder or attach them in the chat. - * [Custom connectors](/docs/claude-science/custom-connectors) that run a local command start with `npx`, `node`, `python`, or the full path of a program. Connectors launched through `npm` or a `.cmd`, `.bat`, or `.ps1` file aren't supported. - * The **Model endpoints** section of **Settings** > **Compute** (NVIDIA BioNeMo NIM) isn't available. +**Corporate networks.** Claude Science follows the proxy configured in Windows proxy settings and trusts corporate root certificates installed for the whole computer, so most managed PCs need no Claude Science configuration. See [Use Claude Science on a corporate network](/docs/claude-science/corporate-networks). - **Linux version under WSL.** To use Claude Science from a Linux environment on your Windows computer, run the Linux command-line version under Windows Subsystem for Linux (WSL 2, not WSL 1) with Ubuntu 24.04 or later. The Windows app itself doesn't need WSL. Inside the Ubuntu terminal, follow the install steps in the Linux tab, then start Claude Science with `claude-science serve --port 8765 --no-browser` and open the printed link, which starts with `http://127.0.0.1:8765`, in a Windows browser. Projects you create there stay in WSL, and the Windows app keeps its own. +**Differences on Windows:** - If Claude Science under WSL shows one of these errors or problems, use the matching fix: +* Claude runs shell commands with PowerShell. Command Prompt scripts, git inside cells, and folder changes in PowerShell need the one-time Windows permission. +* Only folders on local NTFS or ReFS drives can be granted, not network shares, mapped network drives, FAT or exFAT drives (many USB sticks and memory cards), or a whole drive such as `D:\`. Copy such files to a local folder or attach them in the chat. +* [Custom connectors](/docs/claude-science/custom-connectors) that run a local command start with `npx`, `node`, `python`, or the full path of a program. Connectors launched through `npm` or a `.cmd`, `.bat`, or `.ps1` file aren't supported. +* The **Model endpoints** section of **Settings** > **Compute** (NVIDIA BioNeMo NIM) isn't available. - * `daemon already running`: Claude Science is already running. Run `claude-science url` to print a fresh link, and open it in a Windows browser. - * `port 8765 is already in use`: another program, or another copy of Claude Science, has that port. Start with a different one, for example `--port 8080`. - * The link stops working: check that Claude Science is still running with `claude-science status`. If it's still running, run `claude-science url` for a fresh link and open it in a Windows browser. Claude Science stops when WSL shuts down, for example after `wsl --shutdown`. Start it again by running `claude-science serve --port 8765 --no-browser` in the Ubuntu terminal. - * An SSH host can't be added: under WSL, Claude Science reads the SSH settings in Ubuntu's `~/.ssh`, not the ones in Windows. Copy the host's entry from `C:\Users\\.ssh\config`, and its key file, into Ubuntu's `~/.ssh` folder, then run `chmod 600` on them. - * `The database is on /mnt/*`: Claude Science's data folder is on a Windows drive, which it can't use under WSL. Move the folder into your Ubuntu home folder, such as the default `~/.claude-science`, and if you set `data_dir` or `--data-dir`, point it there. If you use a folder other than the default, choose a new, empty one, because Claude Science can delete files in that folder that it didn't create. - +**Linux version under WSL.** To use Claude Science from a Linux environment on your Windows computer, run the Linux command-line version under Windows Subsystem for Linux (WSL 2, not WSL 1) with Ubuntu 24.04 or later. The Windows app itself doesn't need WSL. Inside the Ubuntu terminal, follow the install steps in the Linux tab, then start Claude Science with `claude-science serve --port 8765 --no-browser` and open the printed link, which starts with `http://127.0.0.1:8765`, in a Windows browser. Projects you create there stay in WSL, and the Windows app keeps its own. - - Install the sandbox dependencies, then run the installer. The sandbox needs bubblewrap 0.8.0 or later and socat, and installing them takes administrator (root or `sudo`) access; if you don't have it, ask your system administrator to install them, or see [Run Claude Science without administrator access](/docs/claude-science/run-on-remote-linux-server#run-claude-science-without-administrator-access). +If Claude Science under WSL shows one of these errors or problems, use the matching fix: - * Ubuntu or Debian: `sudo apt-get update && sudo apt-get install -y curl bubblewrap socat` - * Fedora or RHEL: `sudo dnf install -y curl bubblewrap socat` - * Arch: `sudo pacman -S curl bubblewrap socat` +* `daemon already running`: Claude Science is already running. Run `claude-science url` to print a fresh link, and open it in a Windows browser. +* `port 8765 is already in use`: another program, or another copy of Claude Science, has that port. Start with a different one, for example `--port 8080`. +* The link stops working: check that Claude Science is still running with `claude-science status`. If it's still running, run `claude-science url` for a fresh link and open it in a Windows browser. Claude Science stops when WSL shuts down, for example after `wsl --shutdown`. Start it again by running `claude-science serve --port 8765 --no-browser` in the Ubuntu terminal. +* An SSH host can't be added: under WSL, Claude Science reads the SSH settings in Ubuntu's `~/.ssh`, not the ones in Windows. Copy the host's entry from `C:\Users\\.ssh\config`, and its key file, into Ubuntu's `~/.ssh` folder, then run `chmod 600` on them. +* `The database is on /mnt/*`: Claude Science's data folder is on a Windows drive, which it can't use under WSL. Move the folder into your Ubuntu home folder, such as the default `~/.claude-science`, and if you set `data_dir` or `--data-dir`, point it there. If you use a folder other than the default, choose a new, empty one, because Claude Science can delete files in that folder that it didn't create. - Ubuntu 24.04's repositories carry a new enough bubblewrap and Ubuntu 22.04's don't; on any distribution, confirm with `bwrap --version` that the installed version is 0.8.0 or later before you start Claude Science. +**Linux** - ```bash theme={null} - curl -fsSL https://claude.ai/install-claude-science.sh | bash - ``` +Install the sandbox dependencies, then run the installer. The sandbox needs bubblewrap 0.8.0 or later and socat, and installing them takes administrator (root or `sudo`) access; if you don't have it, ask your system administrator to install them, or see [Run Claude Science without administrator access](/docs/claude-science/run-on-remote-linux-server#run-claude-science-without-administrator-access). - ```bash theme={null} - claude-science serve - ``` +* Ubuntu or Debian: `sudo apt-get update && sudo apt-get install -y curl bubblewrap socat` +* Fedora or RHEL: `sudo dnf install -y curl bubblewrap socat` +* Arch: `sudo pacman -S curl bubblewrap socat` - First launch prints a local URL right away, then continues setting up its starter Python and R environments. To run Claude Science on a remote server and use it from your computer, see [Run on a remote Linux server](/docs/claude-science/run-on-remote-linux-server). - - +Ubuntu 24.04's repositories carry a new enough bubblewrap and Ubuntu 22.04's don't; on any distribution, confirm with `bwrap --version` that the installed version is 0.8.0 or later before you start Claude Science. - - Claude Science is a local application, not a website, so there's no public URL to visit. On Windows it opens in its own window, and on Linux it opens in a browser tab. On a Mac it opens in a browser tab, or in its own window once an update has switched it over (see [Claude Science in its own window on macOS](/docs/claude-science/mac-app-window)). Open it from the application itself: Claude Science in Applications or the Dock on macOS, the Start menu on Windows, or the `claude-science` command on Linux. On a remote server, the sign-in link reaches your browser through an SSH tunnel; see [Run on a remote Linux server](/docs/claude-science/run-on-remote-linux-server). - +```bash theme={null} +curl -fsSL https://claude.ai/install-claude-science.sh | bash +``` + +```bash theme={null} +claude-science serve +``` + +First launch prints a local URL right away, then continues setting up its starter Python and R environments. To run Claude Science on a remote server and use it from your computer, see [Run on a remote Linux server](/docs/claude-science/run-on-remote-linux-server). + +> [!NOTE] +> +> Claude Science is a local application, not a website, so there's no public URL to visit. On Windows it opens in its own window, and on Linux it opens in a browser tab. On a Mac it opens in a browser tab, or in its own window once an update has switched it over (see [Claude Science in its own window on macOS](/docs/claude-science/mac-app-window)). Open it from the application itself: Claude Science in Applications or the Dock on macOS, the Start menu on Windows, or the `claude-science` command on Linux. On a remote server, the sign-in link reaches your browser through an SSH tunnel; see [Run on a remote Linux server](/docs/claude-science/run-on-remote-linux-server). ## Sign in and complete setup @@ -88,9 +86,9 @@ In a browser tab or in the Windows app, if you approve the sign-in in your brows After sign-in, a setup wizard walks you through enabling connectors and skills, setting which websites Claude can access, and choosing whether memory is on. You can change these at any time in Settings. - - Claude Science keeps your data in a single folder in your home directory: `~/.claude-science` on macOS and Linux, and `%USERPROFILE%\.claude-science` on Windows. On Linux, the `claude-science` command itself installs to `~/.local/bin`, and on Windows the app installs to `%LOCALAPPDATA%\Programs\ClaudeScience` and adds that folder to your user PATH. Beyond that, it doesn't modify your existing conda installation, R libraries, or shell configuration. To remove Claude Science, see [Uninstall Claude Science](#uninstall-claude-science). - +> [!NOTE] +> +> Claude Science keeps your data in a single folder in your home directory: `~/.claude-science` on macOS and Linux, and `%USERPROFILE%\.claude-science` on Windows. On Linux, the `claude-science` command itself installs to `~/.local/bin`, and on Windows the app installs to `%LOCALAPPDATA%\Programs\ClaudeScience` and adds that folder to your user PATH. Beyond that, it doesn't modify your existing conda installation, R libraries, or shell configuration. To remove Claude Science, see [Uninstall Claude Science](#uninstall-claude-science). ## Run your first analysis @@ -104,74 +102,66 @@ After sign-in, a setup wizard walks you through enabling connectors and skills, Uninstalling removes the application and keeps your data folder. Your projects, artifacts, and conversation history stay on your computer until you delete that folder. - - Deleting the data folder (`~/.claude-science`, or `%USERPROFILE%\.claude-science` on Windows) removes all your projects, artifacts, conversation history, environments, and settings, and signs you out. Copy anything you want to keep first, with **Download** on an artifact or by copying the project's folder from inside the data folder. +> [!WARNING] +> +> Deleting the data folder (`~/.claude-science`, or `%USERPROFILE%\.claude-science` on Windows) removes all your projects, artifacts, conversation history, environments, and settings, and signs you out. Copy anything you want to keep first, with **Download** on an artifact or by copying the project's folder from inside the data folder. +> +> Before you uninstall, check where your data is under **Settings > Storage > Data location**. If it shows a folder other than the default, the default folder still holds your environments and your sign-in, and it can also hold projects from before that location was set. To remove all your data: +> +> * The folder that **Data location** shows holds your current projects. Move anything else you stored there yourself out of it, then delete that folder. +> * Delete the default folder (`~/.claude-science`, or `%USERPROFILE%\.claude-science` on Windows). +> +> Files in the folders you granted Claude access to aren't affected unless they're inside the folder that **Data location** shows. + +**macOS** + +**1. Quit Claude Science** + +In the Dock, Control-click the **Claude Science** icon and choose **Quit**. If you started Claude Science from Terminal with `claude-science serve`, also run `claude-science stop`. + +**2. Move the application to the Trash** + +In Finder, open the **Applications** folder and move **Claude Science** to the Trash. If **Claude Science** isn't there, look in the **Applications** folder inside your home folder. + +**3. Remove the Terminal command** + +The app also adds a `claude-science` command for Terminal. Remove it with `rm ~/.local/bin/claude-science`. - Before you uninstall, check where your data is under **Settings > Storage > Data location**. If it shows a folder other than the default, the default folder still holds your environments and your sign-in, and it can also hold projects from before that location was set. To remove all your data: +To remove your data as well, delete the `~/.claude-science` folder. If Claude Science opened in its own window, also delete `~/Library/Application Support/Claude Science`, which holds that window's own settings and stored data. - * The folder that **Data location** shows holds your current projects. Move anything else you stored there yourself out of it, then delete that folder. - * Delete the default folder (`~/.claude-science`, or `%USERPROFILE%\.claude-science` on Windows). +**Windows** - Files in the folders you granted Claude access to aren't affected unless they're inside the folder that **Data location** shows. - +**1. Quit Claude Science** - - - - - In the Dock, Control-click the **Claude Science** icon and choose **Quit**. If you started Claude Science from Terminal with `claude-science serve`, also run `claude-science stop`. - +Right-click the Claude Science icon in the notification area of the taskbar and choose **Quit Claude Science**. The uninstaller doesn't run while the app is running. - - In Finder, open the **Applications** folder and move **Claude Science** to the Trash. If **Claude Science** isn't there, look in the **Applications** folder inside your home folder. - +**2. Uninstall the app** - - The app also adds a `claude-science` command for Terminal. Remove it with `rm ~/.local/bin/claude-science`. - - +In Windows **Settings**, go to **Apps > Installed apps** and uninstall **Claude Science**, or run `claude-science uninstall` in a terminal. - To remove your data as well, delete the `~/.claude-science` folder. If Claude Science opened in its own window, also delete `~/Library/Application Support/Claude Science`, which holds that window's own settings and stored data. - +To remove the app and your data together, use `claude-science uninstall --purge` instead. It deletes the whole folder your data location points to, including anything you stored there yourself, so move those files out first. - - - - Right-click the Claude Science icon in the notification area of the taskbar and choose **Quit Claude Science**. The uninstaller doesn't run while the app is running. - +When your data location isn't `%USERPROFILE%\.claude-science`, `--purge` leaves that folder in place. It still holds your environments and your sign-in, and it can also hold projects from before that location was set. To remove those too, delete `%USERPROFILE%\.claude-science` yourself. - - In Windows **Settings**, go to **Apps > Installed apps** and uninstall **Claude Science**, or run `claude-science uninstall` in a terminal. +**Linux** - To remove the app and your data together, use `claude-science uninstall --purge` instead. It deletes the whole folder your data location points to, including anything you stored there yourself, so move those files out first. +For the Linux version under Windows Subsystem for Linux (WSL), run these commands in the Ubuntu terminal. - When your data location isn't `%USERPROFILE%\.claude-science`, `--purge` leaves that folder in place. It still holds your environments and your sign-in, and it can also hold projects from before that location was set. To remove those too, delete `%USERPROFILE%\.claude-science` yourself. - - - +**1. Stop Claude Science** - - For the Linux version under Windows Subsystem for Linux (WSL), run these commands in the Ubuntu terminal. +```bash theme={null} +claude-science stop +``` - - - ```bash theme={null} - claude-science stop - ``` - +**2. Delete the command** - - ```bash theme={null} - rm ~/.local/bin/claude-science - ``` +```bash theme={null} +rm ~/.local/bin/claude-science +``` - If you installed it somewhere else, `command -v claude-science` shows where. - - +If you installed it somewhere else, `command -v claude-science` shows where. - To remove your data as well, delete the `~/.claude-science` folder. - - +To remove your data as well, delete the `~/.claude-science` folder. To reinstall, follow [Install](#install) again. Installing doesn't replace an existing data folder. diff --git a/content/claude/claude-science/literature-access.md b/content/claude/claude-science/literature-access.md index b41be0d651..f4469da046 100644 --- a/content/claude/claude-science/literature-access.md +++ b/content/claude/claude-science/literature-access.md @@ -10,9 +10,9 @@ Claude retrieves open-access full text without credentials. To reach paywalled t To add a key or proxy, open the account menu (the gear icon at the bottom of the sidebar inside a project, or the account icon at the top right of the home screen), choose **Settings**, and select **Credentials**. Then choose **Literature access (journals, etc.)** in the **Services** list. - - These panels live in the Claude Science app's own **Settings**, separate from your claude.ai account and organization settings. If you've added custom credentials, the **Services** list appears below your **Custom** credentials. - +> [!NOTE] +> +> These panels live in the Claude Science app's own **Settings**, separate from your claude.ai account and organization settings. If you've added custom credentials, the **Services** list appears below your **Custom** credentials. Given a DOI or title, Claude tries in order: an open-access copy (Unpaywall, Semantic Scholar, PubMed Central), CrossRef full-text links, publisher routes you hold keys for, your library proxy, then the publisher page. Retrieved files (PDF, XML, or text) are saved into the session. diff --git a/content/claude/claude-science/mac-app-window.md b/content/claude/claude-science/mac-app-window.md index 414cdf5976..952645442e 100644 --- a/content/claude/claude-science/mac-app-window.md +++ b/content/claude/claude-science/mac-app-window.md @@ -8,9 +8,9 @@ On a Mac, Claude Science can now run as its own app, in its own window, rather than in the browser. If yours opens in a browser tab, installing an update from inside Claude Science, such as with **Restart to update**, can switch it over. Installing an update doesn't switch a copy that another account on your Mac installed, such as one that your organization's device management installed. To check whether yours has switched, open Claude Science from your **Applications** folder after the update. If it still opens in a browser tab, it hasn't switched, and you keep using it as before. - - To manage Claude Science on your organization's Macs, see [Manage Claude Science on devices](/docs/claude-science/manage-on-devices#macs-where-claude-science-opens-in-its-own-window). - +> [!NOTE] +> +> To manage Claude Science on your organization's Macs, see [Manage Claude Science on devices](/docs/claude-science/manage-on-devices#macs-where-claude-science-opens-in-its-own-window). ## What changes when Claude Science switches to its own window diff --git a/content/claude/claude-science/overview.md b/content/claude/claude-science/overview.md index 2d7a73427a..338b6483e2 100644 --- a/content/claude/claude-science/overview.md +++ b/content/claude/claude-science/overview.md @@ -12,9 +12,9 @@ You describe a research task or analysis in plain language; Claude writes and ru Your files stay on your computer, and code runs in a sandbox. You approve each new folder, network host, and remote job before Claude can use it. - - Claude can make mistakes. The reviewer reduces, but doesn't eliminate, errors. It checks claims against the execution record and doesn't re-run analyses. Verify results before relying on them in research, publication, or downstream decisions. Claude Science is a research tool and isn't intended for clinical or diagnostic use. - +> [!NOTE] +> +> Claude can make mistakes. The reviewer reduces, but doesn't eliminate, errors. It checks claims against the execution record and doesn't re-run analyses. Verify results before relying on them in research, publication, or downstream decisions. Claude Science is a research tool and isn't intended for clinical or diagnostic use. ## Use Claude Science outside the life sciences diff --git a/content/claude/claude-science/remote-compute-clusters.md b/content/claude/claude-science/remote-compute-clusters.md index aadda2653f..c10901f0da 100644 --- a/content/claude/claude-science/remote-compute-clusters.md +++ b/content/claude/claude-science/remote-compute-clusters.md @@ -28,9 +28,9 @@ On the host's detail page, set **Scratch directory** (must be on a shared filesy When Claude proposes a remote job, a **Run this job on ``?** card shows the command and script. Approve with **Once**, **This conversation**, **This project**, or **Global** scope. On approval, the job script and inputs are copied to a job directory under the scratch directory. - - Remote jobs run outside the sandbox, as your user on the host, with access to everything your account can read and write there. - +> [!WARNING] +> +> Remote jobs run outside the sandbox, as your user on the host, with access to everything your account can read and write there. Default job timeout is 30 minutes; tell Claude before submitting longer work. When a job finishes, outputs are pulled back into the session. Files over the size threshold (about 100 MB by default) stay on the host, and Claude records their paths. diff --git a/content/claude/claude-science/run-on-remote-linux-server.md b/content/claude/claude-science/run-on-remote-linux-server.md index 4d4abad418..dd5733fe33 100644 --- a/content/claude/claude-science/run-on-remote-linux-server.md +++ b/content/claude/claude-science/run-on-remote-linux-server.md @@ -8,9 +8,9 @@ Claude Science runs on a remote Linux server (a cloud VM or a lab machine) the same way it runs on a workstation: the application and your data stay on the server, and you use the web app from your computer's browser through an SSH tunnel. Setup takes about five minutes, plus a few minutes of environment setup on first launch. - - This page covers running all of Claude Science on a remote machine. To keep Claude Science on your own computer and have it run jobs on a machine you reach over SSH, see [Remote compute clusters](/docs/claude-science/remote-compute-clusters). - +> [!NOTE] +> +> This page covers running all of Claude Science on a remote machine. To keep Claude Science on your own computer and have it run jobs on a machine you reach over SSH, see [Remote compute clusters](/docs/claude-science/remote-compute-clusters). The server needs x64 Linux on a glibc-based distribution (arm64 and musl-based distributions such as Alpine aren't supported), about 5 GB of free disk space, and the system packages below. Your Claude account needs a Pro, Max, Team, or Enterprise plan; see [Requirements](/docs/claude-science/overview#requirements). @@ -24,9 +24,9 @@ On Fedora, RHEL, or Arch, use the command for your distribution from the Linux t sudo apt-get update && sudo apt-get install -y curl bubblewrap socat ``` - - The sandbox requires bubblewrap 0.8.0 or later; check with `bwrap --version`. Ubuntu 24.04 ships a new enough version, and Ubuntu 22.04 doesn't. If Claude Science can't set up the sandbox, it refuses to start rather than run code unsandboxed. - +> [!NOTE] +> +> The sandbox requires bubblewrap 0.8.0 or later; check with `bwrap --version`. Ubuntu 24.04 ships a new enough version, and Ubuntu 22.04 doesn't. If Claude Science can't set up the sandbox, it refuses to start rather than run code unsandboxed. ## Run Claude Science without administrator access diff --git a/content/claude/claude-science/tools-and-environments.md b/content/claude/claude-science/tools-and-environments.md index 447a9883ca..8c8777f604 100644 --- a/content/claude/claude-science/tools-and-environments.md +++ b/content/claude/claude-science/tools-and-environments.md @@ -50,9 +50,9 @@ To add packages, choose one of these: If your Linux machine has NVIDIA GPUs, the sandbox makes them available to code Claude runs, including on multi-GPU machines. To use them, turn on the **Host GPU** switch in **Settings > Compute**. Sessions you start after that can use the GPU. A session started while the switch was off keeps running without it, and so does a session continued from it with **Continue as a new session**. - - Turning on the **Host GPU** switch reduces the default sandboxing configuration applied by Claude Science. - +> [!NOTE] +> +> Turning on the **Host GPU** switch reduces the default sandboxing configuration applied by Claude Science. If Claude Science finds no GPU, Claude notes this when a task needs one and can run the work on the remote compute you've connected. See [Remote compute clusters](/docs/claude-science/remote-compute-clusters) and [Compute providers](/docs/claude-science/compute-providers). If your machine has an NVIDIA GPU but the **Host GPU** switch isn't in **Settings > Compute**, or Claude says there's no GPU in a session started with the switch on, see [How Claude Science detects a GPU](#how-claude-science-detects-a-gpu). diff --git a/content/claude/claude-science/troubleshooting.md b/content/claude/claude-science/troubleshooting.md index 4b8d488897..cce84cd11e 100644 --- a/content/claude/claude-science/troubleshooting.md +++ b/content/claude/claude-science/troubleshooting.md @@ -93,6 +93,11 @@ On the "Update available" notice, this means the new version was downloaded but On Linux, an update to version 0.1.61 ends this way on a computer where bubblewrap or socat came from conda, Homebrew, or a folder in your home directory, because version 0.1.61 needs both installed for the whole system. Version 0.1.62 withdraws that requirement, so trying again as above now gets a version that starts. If Claude Science won't start at all, run `claude-science update` in a terminal, then start it again. +In version 0.1.67 and later, the notice can show one of these two sentences, with the new version's error on a **Reason** line when there is one: + +* "Update failed: the new version couldn't start. You're still on version …" (Linux only) means Claude Science went back to the version you had. +* "The update is installed, but the restart failed. The next start will run the new version." means the new version is in place but didn't start; the steps for "restart aborted" still apply. + ### Couldn't check for updates On a Mac where Claude Science opens in its own window, the **Updates** window shows this message when Claude Science couldn't get update information from Anthropic's update server. The same steps apply when it says "Couldn't download the update": diff --git a/content/claude/claude-tag/admins/add-connections.md b/content/claude/claude-tag/admins/add-connections.md index c910838337..ba057c6c99 100644 --- a/content/claude/claude-tag/admins/add-connections.md +++ b/content/claude/claude-tag/admins/add-connections.md @@ -6,11 +6,13 @@ > Add connectors so Claude Tag acts in your tools with its own credentials. Covers service accounts, bundles, allowed websites, domain entries, and plugins. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. - - -Claude starts delivering work before you connect anything. On Slack content alone, it can [catch a team up on a channel or thread](/docs/claude-tag/users/use-cases/catch-up), [triage a request channel](/docs/claude-tag/users/use-cases/triage-requests), [turn a discussion into a doc](/docs/claude-tag/users/use-cases/create-artifacts), and [track a project from channel history](/docs/claude-tag/users/use-cases/track-projects). +> [!TIP] +> +> Claude starts delivering work before you connect anything. On Slack content alone, it can [catch a team up on a channel or thread](/docs/claude-tag/users/use-cases/catch-up), [triage a request channel](/docs/claude-tag/users/use-cases/triage-requests), [turn a discussion into a doc](/docs/claude-tag/users/use-cases/create-artifacts), and [track a project from channel history](/docs/claude-tag/users/use-cases/track-projects). A connector gives Claude its own credential for one of your tools, like a Datadog API key or a warehouse service account, so Claude can act in that tool from Slack channels. This page is for the admins who add connectors and decide where they apply. To let Claude act as a member with that member's own claude.ai connectors, see [Personal connectors](/docs/claude-tag/concepts/personal-connectors) instead. @@ -37,7 +39,9 @@ Per-service instructions, with the credential fields and allowed-websites values ### Create a dedicated account per service -The credential you connect is Claude's account in that tool, not yours. Anyone in a channel where the connector applies can use it through Claude, so connect a dedicated identity you control rather than your personal login. +> [!WARNING] +> +> The credential you connect is Claude's account in that tool, not yours. Anyone in a channel where the connector applies can use it through Claude, so connect a dedicated identity you control rather than your personal login. For each tool, create that identity specifically for the agent rather than reusing a shared bot key. The pattern depends on the service. @@ -68,10 +72,6 @@ The host, path, and method restrictions on a credential control which API endpoi For a shared or external channel, put the narrowed credential in its own [bundle](#create-a-bundle) and add only that channel under the bundle's **Where it applies**, so the credential is unavailable elsewhere. - - - - ## Add a connector The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. You can give it narrower reach: @@ -82,23 +82,21 @@ The first credential you add for a service from the **Connectors** tab is on in If the service, or a custom connector's host, is already on the **Connectors** tab, the new credential starts off everywhere until you choose where it applies. - - - Go to [**Organization settings > Claude Tag**](https://claude.ai/admin-settings/claude-tag). Under **Claude's access**, select the **Connectors** tab and click **Add**. - +**1. Open the Connectors tab** + +Go to [**Organization settings > Claude Tag**](https://claude.ai/admin-settings/claude-tag). Under **Claude's access**, select the **Connectors** tab and click **Add**. + +**2. Pick the service** - - In the **Add a connector** dialog, search for the service and select it. A service Claude already holds a credential for shows **Connected**. For GitHub, see [Configure GitHub access](/docs/claude-tag/admins/configure-github). For a service that isn't listed, select **Custom connector** at the bottom of the list; see [Connect a service that isn't in the list](#connect-a-service-that-isn%E2%80%99t-in-the-list). +In the **Add a connector** dialog, search for the service and select it. A service Claude already holds a credential for shows **Connected**. For GitHub, see [Configure GitHub access](/docs/claude-tag/admins/configure-github). For a service that isn't listed, select **Custom connector** at the bottom of the list; see [Connect a service that isn't in the list](#connect-a-service-that-isn%E2%80%99t-in-the-list). - For a service that offers a sign-in as well as a key, such as Amplitude, the dialog then shows **How Claude authenticates**. Leave **Paste an API key** selected, or select the sign-in option, such as **Sign in to Amplitude as Claude**, and click **Continue to** *service*. - +For a service that offers a sign-in as well as a key, such as Amplitude, the dialog then shows **How Claude authenticates**. Leave **Paste an API key** selected, or select the sign-in option, such as **Sign in to Amplitude as Claude**, and click **Continue to** *service*. - - In the connect form, enter the credential from the service's [dedicated account](#create-a-dedicated-account-per-service). On the form's **Advanced** tab, check the hosts under **Allowed websites** (see [Set allowed websites](#set-allowed-websites)), then click **Connect**. +**3. Enter the credential** - If you chose the sign-in option, click the form's sign-in button, such as **Sign in with Amplitude**, and sign in with an account made for Claude. - - +In the connect form, enter the credential from the service's [dedicated account](#create-a-dedicated-account-per-service). On the form's **Advanced** tab, check the hosts under **Allowed websites** (see [Set allowed websites](#set-allowed-websites)), then click **Connect**. + +If you chose the sign-in option, click the form's sign-in button, such as **Sign in with Amplitude**, and sign in with an account made for Claude. After you click **Connect**, the connector's page opens. The line under the new credential's name in the **Access from** table reads **On for all of Slack.** when the credential applies everywhere, or **Not assigned yet. Choose where Claude can use it.** when it waits for you to pick its places under **Assign access**. @@ -106,19 +104,17 @@ After you click **Connect**, the connector's page opens. The line under the new To connect a service that applies in one workspace or channel only, start from that place's page instead of the **Connectors** tab. - - - Go to [**Organization settings > Claude Tag**](https://claude.ai/admin-settings/claude-tag). Under **Claude's access**, select the **Channels** tab and open the workspace's or channel's page. - +**1. Open the place's page** + +Go to [**Organization settings > Claude Tag**](https://claude.ai/admin-settings/claude-tag). Under **Claude's access**, select the **Channels** tab and open the workspace's or channel's page. + +**2. Pick the service** - - On that page, click **Add** under **Claude's access** and select **Connector**. On the dialog's **Connectors** tab, select the service under **Connect new**, or select **Custom connector** there for a service that isn't listed, and click **Continue**. - +On that page, click **Add** under **Claude's access** and select **Connector**. On the dialog's **Connectors** tab, select the service under **Connect new**, or select **Custom connector** there for a service that isn't listed, and click **Continue**. - - In the connect form, enter the credential from the service's [dedicated account](#create-a-dedicated-account-per-service) and click **Connect**. - - +**3. Enter the credential** + +In the connect form, enter the credential from the service's [dedicated account](#create-a-dedicated-account-per-service) and click **Connect**. The credential applies only in that workspace or channel, and a workspace's credential reaches every channel in it. To use it in more places, pick it in each place's row under **Assign access** on the connector's page, selecting **Add place** for a place that isn't listed. @@ -126,7 +122,9 @@ The credential applies only in that workspace or channel, and a workspace's cred List the hosts a credential may be sent to under **Allowed websites** in the connect form. A wildcard works only as the leftmost label, like `*.example.com`; it covers subdomains at any depth but not `example.com` itself. You can't enter `*` alone here; a credential is always limited to specific hosts. To let Claude reach any host without a credential, see [Allow all hosts](#allow-all-hosts). -You can't save a connector whose **Allowed websites** include an `anthropic.com`, `claude.ai`, or `claude.com` host, such as `api.anthropic.com`. +> [!NOTE] +> +> You can't save a connector whose **Allowed websites** include an `anthropic.com`, `claude.ai`, or `claude.com` host, such as `api.anthropic.com`. Check the host against your account's region before saving. Some services fill a default host that may not match your account's region; a Datadog key, for example, only works against your account's Datadog site, like `api.datadoghq.com` or `api.datadoghq.eu`. @@ -138,7 +136,9 @@ To change a credential's name or hosts after saving, open the **⋮** menu on it When someone else holds a service's secret, send them a setup link instead of collecting the secret yourself. In the service's connect form, click **Copy setup link for another admin**. Whoever opens the link signs in to your Claude organization and submits the credential there. They don't need an admin role. -Setup links work for the Bearer and Basic credential types. For other types the button is unavailable. +> [!NOTE] +> +> Setup links work for the Bearer and Basic credential types. For other types the button is unavailable. After the teammate submits the credential, it waits for your approval. Go to [**Notifications**](https://claude.ai/admin-settings/notifications) in admin settings, open the **Requests** tab, and click **Review** on the **Approval needed** row. Then click **Approve** or **Reject**. The credential becomes active only after you approve it. @@ -163,23 +163,21 @@ For a connector you added from the **Connectors** tab, the **Slack** row under * When a bundle holds the connector's credential along with other access, such as other connectors, **Assign access** can't add that credential to a place or take it off one. If **Assign access** refuses a credential with "This credential was added for one place only", that credential stays where it is. To use the service in another place, connect it again there, as [Use a different credential in one workspace or channel](#use-a-different-credential-in-one-workspace-or-channel) describes. - - - Go to [**Organization settings > Claude Tag**](https://claude.ai/admin-settings/claude-tag). Under **Claude's access**, select the **Connectors** tab, then select the connector to open its page. - +**1. Open the connector's page** + +Go to [**Organization settings > Claude Tag**](https://claude.ai/admin-settings/claude-tag). Under **Claude's access**, select the **Connectors** tab, then select the connector to open its page. - - Under **Assign access**, open the picker in the **Access** column of the **Slack** row and clear the credential's checkbox. - +**2. Take the credential off the Slack row** - - Click **Add place** and choose the workspace or channel under **Where**. The dialog fills in one of the connector's credentials under **Credential**, which you can change if the connector holds more than one. Click **Add**, and repeat for each place that should keep the connector. A workspace you add also covers every channel in it. - +Under **Assign access**, open the picker in the **Access** column of the **Slack** row and clear the credential's checkbox. - - Click **Save changes**. - - +**3. Add each place that keeps the connector** + +Click **Add place** and choose the workspace or channel under **Where**. The dialog fills in one of the connector's credentials under **Credential**, which you can change if the connector holds more than one. Click **Add**, and repeat for each place that should keep the connector. A workspace you add also covers every channel in it. + +**4. Save** + +Click **Save changes**. Each row's **Access** picker lists the connector's own credentials first, then each bundle on the **Bundles** tab that holds one of its credentials. Selecting a bundle there attaches that bundle at the place, along with everything else the bundle holds. @@ -212,25 +210,21 @@ To narrow a credential before any channel can use it, add the connector to a new Agent Proxy starts applying an edit to a credential or a domain entry within about a minute after you save it, in existing threads as well as new ones. It checks the channel's credentials and domain entries first, then the workspace's, then the organization's, and within each by priority. A request that matches no credential, no domain entry, and nothing in the environment's network access is blocked. Private IP ranges and cloud metadata endpoints stay blocked regardless. - - ## Create a bundle A [bundle](/docs/claude-tag/concepts/glossary#access-bundle) is a named set of connectors, repositories, domain entries, plugins, and instructions that Claude takes on wherever the bundle applies. Use one to give a group of channels the same access, and to add a connector to only some channels from the start. - - - Go to [**Organization settings > Claude Tag**](https://claude.ai/admin-settings/claude-tag). Under **Claude's access**, select the **Bundles** tab and click **Add**. In the **Create a bundle** dialog, enter a **Name** and an optional **Description**, pick a **Color** and **Icon**, and click **Create**. The bundle's page opens. - +**1. Create the bundle** + +Go to [**Organization settings > Claude Tag**](https://claude.ai/admin-settings/claude-tag). Under **Claude's access**, select the **Bundles** tab and click **Add**. In the **Create a bundle** dialog, enter a **Name** and an optional **Description**, pick a **Color** and **Icon**, and click **Create**. The bundle's page opens. - - Under **What's in it**, click **Add** and choose **Connector**, **Repository**, **Domain**, or **Plugin**. Each item saves as soon as you add it. A connector added here applies only where the bundle applies. - +**2. Add what's in it** - - Under **Where it applies**, turn on the switch in the **Slack** row to apply the bundle in every workspace and channel, or in a workspace's row to apply it in that workspace. For a channel, click **Add place**, choose the channel under **Where**, and click **Add**. Then click **Save changes**. A bundle applies nowhere until you turn on a row or add a place. - - +Under **What's in it**, click **Add** and choose **Connector**, **Repository**, **Domain**, or **Plugin**. Each item saves as soon as you add it. A connector added here applies only where the bundle applies. + +**3. Choose where it applies** + +Under **Where it applies**, turn on the switch in the **Slack** row to apply the bundle in every workspace and channel, or in a workspace's row to apply it in that workspace. For a channel, click **Add place**, choose the channel under **Where**, and click **Add**. Then click **Save changes**. A bundle applies nowhere until you turn on a row or add a place. To add an existing bundle from a workspace or channel instead, open that place's page from the **Channels** tab, click **Add** under **Claude's access**, and select **Bundle**. [Attach bundles to workspaces and channels](/docs/claude-tag/admins/attach-to-scope) covers channel rules and how bundles combine. @@ -301,7 +295,9 @@ You don't have to predict the full list up front. When a request is blocked, Cla Typical entries are hosts the work calls without a key, such as a docs site or a public API. Common package registries are usually already reachable through the [environment's Trusted access default](#broad-web-access-through-the-environment), and a host that needs a credential belongs in a [connector](#add-a-connector) instead. Entries appear under **What's in it** with the type **Domain**, and each row's menu has **Edit** and **Remove**. -[Agent Proxy](/docs/claude-tag/concepts/agent-identity#agent-proxy) carries only HTTP and HTTPS. A protocol that isn't HTTP, such as SSH, can't cross the proxy, so a domain entry doesn't make a host reachable over SSH. +> [!NOTE] +> +> [Agent Proxy](/docs/claude-tag/concepts/agent-identity#agent-proxy) carries only HTTP and HTTPS. A protocol that isn't HTTP, such as SSH, can't cross the proxy, so a domain entry doesn't make a host reachable over SSH. ### Broad web access through the environment @@ -321,8 +317,6 @@ With `*` active: * A `*` entry never carries a credential, and a connector's credential still travels only to its [allowed websites](#set-allowed-websites). * Private and internal network addresses and cloud metadata endpoints remain blocked. - - ### Web search vs. network requests Web search needs no domain entry, connector, or environment setting. It's [Anthropic's built-in web search tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-search-tool), and the searching happens on Anthropic's servers rather than in the channel's sandbox, so no allow layer applies. @@ -357,8 +351,6 @@ Anthropic's **Security Guidance** [plugin](https://code.claude.com/docs/en/plugi **Security Guidance** is off by default. Add it on the **Skills and plugins** tab or a bundle's page, and new threads in the channels it covers pick it up. The plugin flags problems and suggests fixes; it doesn't block a commit or a push. To require review before code merges, use your repository's branch protection and required checks. - - ## Verify the connector saved * The connector appears on the **Connectors** tab, under **Services** or **Custom hosts**. diff --git a/content/claude/claude-tag/admins/attach-to-scope.md b/content/claude/claude-tag/admins/attach-to-scope.md index e5d808122c..cb42b962ef 100644 --- a/content/claude/claude-tag/admins/attach-to-scope.md +++ b/content/claude/claude-tag/admins/attach-to-scope.md @@ -6,9 +6,9 @@ > Choose which Slack workspaces and channels a Claude Tag bundle applies to, attach bundles to channels by name, and see how access stacks when bundles overlap. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. A bundle applies at one of three levels, called scopes, and each has its own page on the **Channels** tab under **Claude's access** at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag). The **Slack** page covers every connected workspace and channel, a workspace's page covers the channels in that workspace, and a channel's page covers one channel. Bundles inherit downward through those scopes, and when credentials overlap, Claude uses the one from the narrowest scope. @@ -20,9 +20,7 @@ This page assumes you have already [paired a workspace](/docs/claude-tag/admins/ Bundles stack downward. A channel gets whatever applies on the **Slack** page, plus its workspace, plus anything added to the channel itself. -Nested boxes. The outermost box is the Slack scope: a bundle attached here is the baseline every channel gets. Inside it, two examples. Outside the workspace box, a channel called another-team in a different workspace gets only the baseline. Inside the workspace box, which adds an optional bundle for channels inside it, two channel boxes: a public channel called general, with no channel bundle, gets the baseline plus the workspace bundle; a private channel, marked with a lock, with its own channel bundle, gets all three, the baseline, workspace, and channel bundles. - -Nested boxes. The outermost box is the Slack scope: a bundle attached here is the baseline every channel gets. Inside it, two examples. Outside the workspace box, a channel called another-team in a different workspace gets only the baseline. Inside the workspace box, which adds an optional bundle for channels inside it, two channel boxes: a public channel called general, with no channel bundle, gets the baseline plus the workspace bundle; a private channel, marked with a lock, with its own channel bundle, gets all three, the baseline, workspace, and channel bundles. +![Nested boxes. The outermost box is the Slack scope: a bundle attached here is the baseline every channel gets. Inside it, two examples. Outside the workspace box, a channel called another-team in a different workspace gets only the baseline. Inside the workspace box, which adds an optional bundle for channels inside it, two channel boxes: a public channel called general, with no channel bundle, gets the baseline plus the workspace bundle; a private channel, marked with a lock, with its own channel bundle, gets all three, the baseline, workspace, and channel bundles.](https://mintcdn.com/claude-ai/RSTtvSydy0FU_pcP/images/claude-tag/diagrams/scope-inheritance.svg?fit=max\&auto=format\&n=RSTtvSydy0FU_pcP\&q=85\&s=7a225f1cefadc49cd6efaaf093f0b041) | Scope | What it covers | Access | | :- | :- | :- | @@ -36,8 +34,6 @@ Memory is also scoped, but differently: there is no organization-wide memory, ea One-to-one DMs from members who have connected a Claude account run under the member's own claude.ai account. See [how DMs work in this model](/docs/claude-tag/concepts/agent-identity#direct-message-channels). A [DM from a member who hasn't connected a Claude account](/docs/claude-tag/admins/restrict-access#access-in-a-direct-message-from-a-member-without-a-claude-account) reaches bundles. A [group DM](/docs/claude-tag/admins/restrict-access#group-dms) gets the bundles on the workspace's page and on the **Slack** page. - - ## Choose where a bundle applies A bundle applies nowhere until you add places to it. A place is **Slack**, a workspace, or a channel, the same three scopes, or a [group of channels matched by name](#attach-a-bundle-to-channels-by-name). You can add a place from either side: @@ -66,7 +62,9 @@ Sharing a channel changes which bundles apply there: * **Shared across workspaces in your Enterprise Grid**: bundles on the channel or its workspace don't apply. See [Channels shared across workspaces in your Enterprise Grid](/docs/claude-tag/admins/restrict-access#channels-shared-across-workspaces-in-your-enterprise-grid) for what Claude does there instead. * **Shared with another company through Slack Connect**: once Claude is [turned on in the channel](/docs/claude-tag/admins/restrict-access#slack-connect-channels), bundles attached directly to the channel apply there, including ones you attached before the channel was shared. Claude can use their connectors for the other company's people in the channel too. [What access Claude has in a Slack Connect channel](/docs/claude-tag/admins/restrict-access#what-access-claude-has-in-a-slack-connect-channel) covers which bundles reach that channel and which don't. -A bundle attached to a public channel grants its access to anyone who joins that channel. In most Slack workspaces, anyone can join a public channel, so the channel's join policy becomes the effective access control for whatever the bundle grants. Keep elevated credentials in private channels. +> [!WARNING] +> +> A bundle attached to a public channel grants its access to anyone who joins that channel. In most Slack workspaces, anyone can join a public channel, so the channel's join policy becomes the effective access control for whatever the bundle grants. Keep elevated credentials in private channels. #### Set up a channel before Claude joins @@ -103,7 +101,9 @@ A rule's pattern has its own constraints: * **Number of rules**: each scope holds up to 50 channel rules, and a rule with more than one bundle counts once for each bundle * **Organization patterns**: on a workspace's page, the **Auto-join channels** table also lists the organization's patterns, marked **Org-wide**. You can attach a bundle to an **Org-wide** pattern from the workspace's table, and that rule covers only the workspace's matching channels. You edit the pattern itself on the **Slack** page. -A channel rule grants its bundle in every matching channel Claude is in, now or in the future, and anyone who can rename a channel can move it into or out of a pattern. Keep elevated credentials out of broad patterns, and add a [blocked channel pattern](/docs/claude-tag/admins/restrict-access#block-or-auto-join-channels-by-name) for name shapes that should never carry access; a blocked channel stays off-limits whatever rules match it. +> [!WARNING] +> +> A channel rule grants its bundle in every matching channel Claude is in, now or in the future, and anyone who can rename a channel can move it into or out of a pattern. Keep elevated credentials out of broad patterns, and add a [blocked channel pattern](/docs/claude-tag/admins/restrict-access#block-or-auto-join-channels-by-name) for name shapes that should never carry access; a blocked channel stays off-limits whatever rules match it. ### Where rule-attached bundles appear diff --git a/content/claude/claude-tag/admins/attribute-costs.md b/content/claude/claude-tag/admins/attribute-costs.md index d7eda0a596..bdb144fef1 100644 --- a/content/claude/claude-tag/admins/attribute-costs.md +++ b/content/claude/claude-tag/admins/attribute-costs.md @@ -6,9 +6,9 @@ > Pull channel spend per Slack user from the Claude Enterprise Analytics API for showback or chargeback reporting, and see how Claude's work is attributed to people. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. You can pull Claude Tag channel spend broken out by the Slack user Claude did the work for. The [Claude Enterprise Analytics API](https://platform.claude.com/docs/en/manage-claude/analytics-api) reports your organization's spend over time, and grouping its [cost report](https://platform.claude.com/docs/en/api/admin/analytics/cost/list) by `claude_tag_user_id` returns one row per attributed Slack user. Use the rows to attribute spend to people or departments for showback and chargeback reporting. diff --git a/content/claude/claude-tag/admins/audit.md b/content/claude/claude-tag/admins/audit.md index 86e5320805..52009ce5ad 100644 --- a/content/claude/claude-tag/admins/audit.md +++ b/content/claude/claude-tag/admins/audit.md @@ -6,9 +6,9 @@ > Claude Tag actions appear under its own service accounts in each connected tool's audit log. See what the Activity page covers, how to trace an action to its source, and where each connected tool keeps logs. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Use this page to review what Claude Tag is doing across your organization: which routines are scheduled, what memory it has saved, and where to find a record of each action it took. diff --git a/content/claude/claude-tag/admins/configure-github.md b/content/claude/claude-tag/admins/configure-github.md index 5f3c2f8456..0cae2fa525 100644 --- a/content/claude/claude-tag/admins/configure-github.md +++ b/content/claude/claude-tag/admins/configure-github.md @@ -6,11 +6,13 @@ > Give Claude its own GitHub identity through the Claude GitHub App. Covers linking your GitHub organization, granting repositories, and GitHub Actions. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. - - -Using GitLab instead of GitHub? See [Configure GitLab access](/docs/claude-tag/admins/configure-gitlab). GitLab uses a service-account token rather than an installed app. +> [!TIP] +> +> Using GitLab instead of GitHub? See [Configure GitLab access](/docs/claude-tag/admins/configure-gitlab). GitLab uses a service-account token rather than an installed app. Claude Tag gives Claude its own GitHub identity, the Claude GitHub App, so pull requests it opens from a channel or a DM are authored by Claude rather than by a person. You only need GitHub access if a team will hand Claude code work: branches, pull requests, review, or CI follow-up. @@ -18,29 +20,27 @@ You link GitHub once for your Claude organization, then choose which repositorie ## Link your GitHub organization - - The person who completes the link must be both an **owner of the GitHub organization** and an **Owner in your Claude organization**. If you aren't a GitHub organization owner, click the **Not the GitHub owner? Send instructions** link in the **GitHub** section of [**Organization settings > Git providers**](https://claude.ai/admin-settings/source-control). In the dialog that opens, click **Copy message** to copy a request you can send to someone who is. - +> [!NOTE] +> +> The person who completes the link must be both an **owner of the GitHub organization** and an **Owner in your Claude organization**. If you aren't a GitHub organization owner, click the **Not the GitHub owner? Send instructions** link in the **GitHub** section of [**Organization settings > Git providers**](https://claude.ai/admin-settings/source-control). In the dialog that opens, click **Copy message** to copy a request you can send to someone who is. + +**1. Open the Git providers page** + +Go to **Organization settings > Git providers** at [`claude.ai/admin-settings/source-control`](https://claude.ai/admin-settings/source-control). This page is shared with Claude Code; one connection serves both products. Until the Claude GitHub App is installed, you can also reach this page from Claude Tag admin settings. On the **Connectors** tab under **Claude's access**, click **Add** and select **GitHub**. - - - Go to **Organization settings > Git providers** at [`claude.ai/admin-settings/source-control`](https://claude.ai/admin-settings/source-control). This page is shared with Claude Code; one connection serves both products. Until the Claude GitHub App is installed, you can also reach this page from Claude Tag admin settings. On the **Connectors** tab under **Claude's access**, click **Add** and select **GitHub**. - +**2. Connect GitHub** - - Beside the **GitHub** heading, click **Connect** (the button reads **Add organization** once a GitHub account is connected) and complete the GitHub authorization. After authorizing, the table in the **GitHub** section lists the GitHub accounts the Claude GitHub App is installed on. The **Type** column reads **Organization** or **Personal**. In the **Status** column, an account already linked to your Claude organization shows **Connected**, and one that still needs linking shows **Not linked**. - +Beside the **GitHub** heading, click **Connect** (the button reads **Add organization** once a GitHub account is connected) and complete the GitHub authorization. After authorizing, the table in the **GitHub** section lists the GitHub accounts the Claude GitHub App is installed on. The **Type** column reads **Organization** or **Personal**. In the **Status** column, an account already linked to your Claude organization shows **Connected**, and one that still needs linking shows **Not linked**. - - If your organization's row reads **Not linked**, select the **Link** button next to it. If it isn't listed at all, click **Add organization** beside the **GitHub** heading and complete the install on github.com; you're returned to this page with the organization's row showing **Connected**. +**3. Link or install** - An organization can also be missing from the table because single sign-on (SSO) on GitHub hides it. A note under the table counts the organizations hidden that way. To make them appear, authorize the Claude app for those organizations on GitHub. +If your organization's row reads **Not linked**, select the **Link** button next to it. If it isn't listed at all, click **Add organization** beside the **GitHub** heading and complete the install on github.com; you're returned to this page with the organization's row showing **Connected**. - * A disabled **Link** button means you can't link that account yet; the button's tooltip names the reason, such as not being an owner of that GitHub organization - * A **Needs permissions** status means the installation has a pending request; **Review permissions** takes you to github.com to approve it - * An **Authorize SSO** button in place of **Link** means your GitHub token isn't authorized for that organization's SSO; the button opens github.com to authorize it, and you link after returning - - +An organization can also be missing from the table because single sign-on (SSO) on GitHub hides it. A note under the table counts the organizations hidden that way. To make them appear, authorize the Claude app for those organizations on GitHub. + +* A disabled **Link** button means you can't link that account yet; the button's tooltip names the reason, such as not being an owner of that GitHub organization +* A **Needs permissions** status means the installation has a pending request; **Review permissions** takes you to github.com to approve it +* An **Authorize SSO** button in place of **Link** means your GitHub token isn't authorized for that organization's SSO; the button opens github.com to authorize it, and you link after returning ## Grant repository access @@ -50,23 +50,21 @@ The GitHub page, a bundle's page, and a workspace's or channel's own page each o ### Pick repositories for a workspace or channel - - - Go to [**Organization settings > Claude Tag**](https://claude.ai/admin-settings/claude-tag). Under **Claude's access**, select the **Connectors** tab and open **GitHub**. - +**1. Open the GitHub page** + +Go to [**Organization settings > Claude Tag**](https://claude.ai/admin-settings/claude-tag). Under **Claude's access**, select the **Connectors** tab and open **GitHub**. + +**2. Find the place** - - Under **Assign access**, find the row for where Claude should use the repositories: **Slack** for every workspace and channel, or a workspace or channel. If the place isn't listed, click **Add place**, choose it under **Where**, and click **Add**. - +Under **Assign access**, find the row for where Claude should use the repositories: **Slack** for every workspace and channel, or a workspace or channel. If the place isn't listed, click **Add place**, choose it under **Where**, and click **Add**. - - In the place's **Access** column, click **Select access**, or the repositories already picked there, and select each repository Claude should use. Selecting **Every repository in** an account also covers repositories created in it later, and asks you to confirm with **Connect all**. To attach a bundle that holds repositories instead, select it under **Bundles** in the same picker. - +**3. Pick the repositories** - - Click **Save changes**. - - +In the place's **Access** column, click **Select access**, or the repositories already picked there, and select each repository Claude should use. Selecting **Every repository in** an account also covers repositories created in it later, and asks you to confirm with **Connect all**. To attach a bundle that holds repositories instead, select it under **Bundles** in the same picker. + +**4. Save the changes** + +Click **Save changes**. To add a repository from a workspace's or channel's own page instead, open the page from the **Channels** tab, and under **Claude's access**, click **Add**, select **Repository**, pick the repository on the **Repositories** tab, and click **Add**. @@ -74,19 +72,17 @@ To add a repository from a workspace's or channel's own page instead, open the p A [bundle](/docs/claude-tag/admins/add-connections#create-a-bundle)'s places decide which channels can use the repositories in it. - - - Go to [**Organization settings > Claude Tag**](https://claude.ai/admin-settings/claude-tag). Under **Claude's access**, select the **Bundles** tab and open the bundle, or click **Add** to create one. - +**1. Open a bundle** + +Go to [**Organization settings > Claude Tag**](https://claude.ai/admin-settings/claude-tag). Under **Claude's access**, select the **Bundles** tab and open the bundle, or click **Add** to create one. + +**2. Add repositories** + +Under **What's in it**, click **Add** and choose **Repository**. In the dialog that opens, pick the **GitHub account** when more than one is linked, then search for a repository and select it. To grant every repository in the account's GitHub App installation, including ones added later, select the **Every repository in** option for that account. Click **Add**, and for the **Every repository in** option, confirm with **Connect all**. Before any GitHub account is linked, the dialog reads "Connect a GitHub account to your organization first." - - Under **What's in it**, click **Add** and choose **Repository**. In the dialog that opens, pick the **GitHub account** when more than one is linked, then search for a repository and select it. To grant every repository in the account's GitHub App installation, including ones added later, select the **Every repository in** option for that account. Click **Add**, and for the **Every repository in** option, confirm with **Connect all**. Before any GitHub account is linked, the dialog reads "Connect a GitHub account to your organization first." - +**3. Choose where the bundle applies** - - Under **Where it applies**, turn on the switch in the **Slack** row to apply the bundle in every workspace and channel, or in a workspace's row to apply it in that workspace. For a channel, click **Add place**, choose the channel under **Where**, and click **Add**. Then click **Save changes**. - - +Under **Where it applies**, turn on the switch in the **Slack** row to apply the bundle in every workspace and channel, or in a workspace's row to apply it in that workspace. For a channel, click **Add place**, choose the channel under **Where**, and click **Add**. Then click **Save changes**. ## Verify GitHub access diff --git a/content/claude/claude-tag/admins/configure-gitlab.md b/content/claude/claude-tag/admins/configure-gitlab.md index d5d3f21fb5..b083872cb7 100644 --- a/content/claude/claude-tag/admins/configure-gitlab.md +++ b/content/claude/claude-tag/admins/configure-gitlab.md @@ -6,9 +6,9 @@ > Give Claude its own GitLab identity to read projects, manage issues, review merge requests, and check pipelines. Covers the account, token, and connector. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Connecting GitLab lets Claude read repository contents, manage issues, review and comment on merge requests, and check pipeline status from any channel where the GitLab connector applies, all through the GitLab API. Unlike GitHub, there is no Claude app to install in GitLab. Instead, you give Claude its own GitLab user and add that user's personal access token as a connector. @@ -44,29 +44,29 @@ Create a [personal access token](https://docs.gitlab.com/user/profile/personal_a Set an expiry that matches your rotation policy, and store the token somewhere you can retrieve it once; GitLab shows it only at creation. -Group access tokens and project access tokens also work in the same field. The service-account approach is recommended because one token covers every group you add the account to, and the identity on comments and issues is yours to name. A group or project token is scoped to that single group or project and appears under a GitLab-generated bot name. +> [!NOTE] +> +> Group access tokens and project access tokens also work in the same field. The service-account approach is recommended because one token covers every group you add the account to, and the identity on comments and issues is yours to name. A group or project token is scoped to that single group or project and appears under a GitLab-generated bot name. ## Add the token as a connector The first GitLab token you add from the **Connectors** tab is on in every workspace and channel as soon as you save it. To add GitLab for only the channels a bundle covers, add it from the bundle's page under **What's in it** instead; see [Create a bundle](/docs/claude-tag/admins/add-connections#create-a-bundle). To add it for one workspace or channel, [connect it from that place's page](/docs/claude-tag/admins/add-connections#connect-a-service-for-one-workspace-or-channel). - - - Go to [**Organization settings > Claude Tag**](https://claude.ai/admin-settings/claude-tag). Under **Claude's access**, select the **Connectors** tab and click **Add**. - +**1. Open the Connectors tab** + +Go to [**Organization settings > Claude Tag**](https://claude.ai/admin-settings/claude-tag). Under **Claude's access**, select the **Connectors** tab and click **Add**. + +**2. Connect GitLab** + +Search for **GitLab** and select it. Paste the token into **Claude’s personal access token** and click **Connect**. + +**3. Choose where GitLab applies** - - Search for **GitLab** and select it. Paste the token into **Claude’s personal access token** and click **Connect**. - +If this is GitLab's first token, GitLab is now on in every workspace and channel. A later token starts off everywhere until you pick its places under **Assign access** on GitLab's page. To use GitLab in only some channels, [restrict it on GitLab's page](/docs/claude-tag/admins/add-connections#restrict-a-connector-to-some-channels). - - If this is GitLab's first token, GitLab is now on in every workspace and channel. A later token starts off everywhere until you pick its places under **Assign access** on GitLab's page. To use GitLab in only some channels, [restrict it on GitLab's page](/docs/claude-tag/admins/add-connections#restrict-a-connector-to-some-channels). - +**4. Add the GitLab plugin** - - If your organization's plugin library includes a GitLab plugin, add it where GitLab applies so Claude knows how to call the GitLab API. See [Attach plugins](/docs/claude-tag/admins/add-connections#attach-plugins). The connector works without the plugin, which adds ready-made workflows. - - +If your organization's plugin library includes a GitLab plugin, add it where GitLab applies so Claude knows how to call the GitLab API. See [Attach plugins](/docs/claude-tag/admins/add-connections#attach-plugins). The connector works without the plugin, which adds ready-made workflows. The token is held by [Agent Proxy](/docs/claude-tag/concepts/agent-identity#agent-proxy) and injected on every API request to your GitLab host. The model and the session sandbox never see it. diff --git a/content/claude/claude-tag/admins/connections/amplitude.md b/content/claude/claude-tag/admins/connections/amplitude.md index 77f58f7856..b43d941d67 100644 --- a/content/claude/claude-tag/admins/connections/amplitude.md +++ b/content/claude/claude-tag/admins/connections/amplitude.md @@ -6,9 +6,9 @@ > Connect Amplitude to Claude Tag with a project API key and secret key, or by signing in with Amplitude, so Claude can answer product-analytics questions. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Connecting Amplitude lets Claude answer product-analytics questions, such as funnel and retention numbers, event segmentation, a user's recent activity, and cohort sizes, in any channel where the connector is on. Claude connects with its own credential, not a person's. @@ -43,39 +43,37 @@ Amplitude's own guide for creating the keys is at [amplitude.com](https://amplit A saved credential works with every HTTP method wherever the connector is on, and the first Amplitude credential added on the **Connectors** tab is on in every workspace and channel as soon as you save it. To restrict the key pair before any channel can use it, add Amplitude to a new bundle, which applies nowhere until you add places to it. - - - Go to [**Organization settings > Claude Tag > Bundles**](https://claude.ai/admin-settings/claude-tag?access=presets), click **Add**, enter a name such as `Amplitude`, and click **Create**. The bundle's page opens. - +**1. Create a bundle for Amplitude** + +Go to [**Organization settings > Claude Tag > Bundles**](https://claude.ai/admin-settings/claude-tag?access=presets), click **Add**, enter a name such as `Amplitude`, and click **Create**. The bundle's page opens. + +**2. Open the Amplitude form** + +Under **What's in it**, click **Add**, select **Connector**, and select **Amplitude**. Leave **Paste an API key** selected and click **Continue to Amplitude**. The connect form opens. - - Under **What's in it**, click **Add**, select **Connector**, and select **Amplitude**. Leave **Paste an API key** selected and click **Continue to Amplitude**. The connect form opens. - +**3. Enter the key pair** - - With **Use an API token** selected, fill in these fields. +With **Use an API token** selected, fill in these fields. - | Field | Value | - | :- | :- | - | Claude's API key | The project's API key from Amplitude | - | Claude's secret key | The secret key you generated for this connector | - | Allowed websites | `amplitude.com` (preset) | +| Field | Value | +| :- | :- | +| Claude's API key | The project's API key from Amplitude | +| Claude's secret key | The secret key you generated for this connector | +| Allowed websites | `amplitude.com` (preset) | - If Amplitude hosts your organization's data in its EU data center (you sign in to Amplitude at `app.eu.amplitude.com` rather than `app.amplitude.com`), replace the host with `analytics.eu.amplitude.com`. +If Amplitude hosts your organization's data in its EU data center (you sign in to Amplitude at `app.eu.amplitude.com` rather than `app.amplitude.com`), replace the host with `analytics.eu.amplitude.com`. - Click **Connect** to save the connector. - +Click **Connect** to save the connector. - - The credential is created with the `/api/` path prefix, which covers Amplitude's REST APIs and keeps the key pair off the rest of `amplitude.com`. Add the method restriction yourself: under **What's in it**, open the menu on the Amplitude row and click **Edit**. In the **Edit connection** dialog, clear **All methods** under **Methods**, select `GET`, and click **Save**. +**4. Restrict the credential to read requests** - With the restriction in place, the Agent Proxy attaches the key pair only to `GET` requests under `/api/`. A request outside that restriction, such as a write or a user-deletion call, doesn't match the credential. Agent Proxy never attaches the key pair to it, so the request can't authenticate to Amplitude. - +The credential is created with the `/api/` path prefix, which covers Amplitude's REST APIs and keeps the key pair off the rest of `amplitude.com`. Add the method restriction yourself: under **What's in it**, open the menu on the Amplitude row and click **Edit**. In the **Edit connection** dialog, clear **All methods** under **Methods**, select `GET`, and click **Save**. - - Under **Where it applies**, click **Add place**, choose a workspace or channel under **Where**, and click **Add**. The bundle applies there and in every channel beneath it. Click **Save changes** to save the places. - - +With the restriction in place, the Agent Proxy attaches the key pair only to `GET` requests under `/api/`. A request outside that restriction, such as a write or a user-deletion call, doesn't match the credential. Agent Proxy never attaches the key pair to it, so the request can't authenticate to Amplitude. + +**5. Choose where the bundle applies** + +Under **Where it applies**, click **Add place**, choose a workspace or channel under **Where**, and click **Add**. The bundle applies there and in every channel beneath it. Click **Save changes** to save the places. Amplitude rate-limits these APIs per project, with a cap on concurrent requests and an hourly budget in which queries that span more days or segments cost more. Claude's queries draw on the same budget as your project's other API clients. If Claude reports that Amplitude returned a rate-limit error (HTTP 429), narrow the date range, drop a group-by, or ask again later. Amplitude's [Dashboard REST API documentation](https://amplitude.com/docs/apis/analytics/dashboard-rest) lists the current limits. @@ -83,23 +81,23 @@ The Agent Proxy injects the credential at the network boundary; the model and th ## Add the connector with Amplitude sign-in -Sign in as a dedicated Amplitude user created for this connector (for example, `claude@yourcompany.example.com`), not with your own account. Anyone in a channel where the connector is on can ask Claude to use it, so everything that user can reach in Amplitude is available to every member of those channels. Because Amplitude's MCP tools can create and edit charts, dashboards, and cohorts as well as read them, give the user the most limited role that covers what the channels need in each project, such as Viewer. A dedicated user also limits Claude to the projects you add that user to and keeps Claude's activity in Amplitude traceable to one account. +> [!WARNING] +> +> Sign in as a dedicated Amplitude user created for this connector (for example, `claude@yourcompany.example.com`), not with your own account. Anyone in a channel where the connector is on can ask Claude to use it, so everything that user can reach in Amplitude is available to every member of those channels. Because Amplitude's MCP tools can create and edit charts, dashboards, and cohorts as well as read them, give the user the most limited role that covers what the channels need in each project, such as Viewer. A dedicated user also limits Claude to the projects you add that user to and keeps Claude's activity in Amplitude traceable to one account. This route connects to the MCP server for Amplitude's US data center. If you sign in to Amplitude at `app.eu.amplitude.com`, Amplitude hosts your organization's data in its EU data center, so use the [API key route](#add-the-connector-with-an-api-key) instead. - - - Go to [**Organization settings > Claude Tag > Connectors**](https://claude.ai/admin-settings/claude-tag?access=connectors), click **Add**, and select **Amplitude**. Select **Sign in to Amplitude as Claude** and click **Continue to Amplitude**. The connect form opens. - +**1. Open the Amplitude form** + +Go to [**Organization settings > Claude Tag > Connectors**](https://claude.ai/admin-settings/claude-tag?access=connectors), click **Add**, and select **Amplitude**. Select **Sign in to Amplitude as Claude** and click **Continue to Amplitude**. The connect form opens. + +**2. Sign in as the dedicated user** - - The **Sign in to Amplitude as Claude** option shows the MCP server the sign-in grants access to, `https://mcp.amplitude.com/mcp`, and the form sets the connector's allowed host to that server for you. +The **Sign in to Amplitude as Claude** option shows the MCP server the sign-in grants access to, `https://mcp.amplitude.com/mcp`, and the form sets the connector's allowed host to that server for you. - The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](/docs/claude-tag/admins/add-connections#add-a-connection) before you sign in. +The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](/docs/claude-tag/admins/add-connections#add-a-connection) before you sign in. - Click **Sign in with Amplitude** at the bottom of the form. A sign-in window opens. If your browser blocks pop-ups, allow them for claude.ai and click **Sign in with Amplitude** again. Sign in to Amplitude as the dedicated user and approve access. When the sign-in completes and the window closes, the connector is saved and Amplitude's connector page opens, with the new credential marked **New**. - - +Click **Sign in with Amplitude** at the bottom of the form. A sign-in window opens. If your browser blocks pop-ups, allow them for claude.ai and click **Sign in with Amplitude** again. Sign in to Amplitude as the dedicated user and approve access. When the sign-in completes and the window closes, the connector is saved and Amplitude's connector page opens, with the new credential marked **New**. Amplitude decides what the signed-in user can read and change, and that user's roles and project access apply to every request Claude makes through this connector. The `GET` restriction described for the API key route applies only to that route's key pair. If the sign-in succeeds but Claude reports that Amplitude denied a request, check the dedicated user's role and project access in Amplitude. See [Amplitude MCP](https://amplitude.com/docs/amplitude-ai/amplitude-mcp) for what Amplitude's MCP server can do. diff --git a/content/claude/claude-tag/admins/connections/asana.md b/content/claude/claude-tag/admins/connections/asana.md index c661468e58..2671a78a1f 100644 --- a/content/claude/claude-tag/admins/connections/asana.md +++ b/content/claude/claude-tag/admins/connections/asana.md @@ -6,9 +6,9 @@ > Connect Asana to Claude Tag so it can file tasks and read project status. Covers the dedicated account to create, the token fields, and the URL to allow. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Connecting Asana lets Claude file tasks and pull project status in any channel where the connector is on. Claude connects with its own credential, not a person's. diff --git a/content/claude/claude-tag/admins/connections/atlassian.md b/content/claude/claude-tag/admins/connections/atlassian.md index 237440c6f9..084c0c096d 100644 --- a/content/claude/claude-tag/admins/connections/atlassian.md +++ b/content/claude/claude-tag/admins/connections/atlassian.md @@ -6,9 +6,9 @@ > Connect Atlassian Cloud to Claude Tag so it can read and update Jira issues and search Confluence pages. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Connecting Atlassian Cloud lets Claude read and search Confluence pages and read, comment on, and update Jira issues in any channel where the connector is on. One credential covers both products on the same Atlassian site. @@ -20,7 +20,9 @@ Create a dedicated Atlassian account for Claude (for example `claude@yourcompany Sign in as that account and create an API token at [id.atlassian.com/manage-profile/security/api-tokens](https://id.atlassian.com/manage-profile/security/api-tokens). Atlassian shows the token once; store it somewhere you can retrieve it. Atlassian API tokens expire, with a maximum lifetime of one year, so plan to create a new token and rotate the connector's credential before the old one lapses. -Create the API token without scopes. Atlassian accepts tokens with scopes, including service account tokens, only at its `api.atlassian.com` gateway, not at your site's hostname, so the **Jira & Confluence** entry can't use them. +> [!NOTE] +> +> Create the API token without scopes. Atlassian accepts tokens with scopes, including service account tokens, only at its `api.atlassian.com` gateway, not at your site's hostname, so the **Jira & Confluence** entry can't use them. If your organization requires tokens with scopes, see [Connect a token with scopes through the Atlassian gateway](#connect-a-token-with-scopes-through-the-atlassian-gateway). @@ -32,29 +34,29 @@ In the connect form, with **Use an API token** selected, enter the dedicated acc The Agent Proxy injects the credential at the network boundary; the model and the sandbox are not given the key. See [how Agent Proxy works](/docs/claude-tag/concepts/agent-identity#agent-proxy). -Atlassian Data Center (self-hosted) isn't covered by the **Jira & Confluence** entry because it authenticates with a personal access token sent as a Bearer header. Add a Data Center instance as a [custom connector](/docs/claude-tag/admins/connections/custom) with the **Bearer** credential type and your instance's hostname under **Allowed websites**. The instance must be reachable from the public internet. +> [!NOTE] +> +> Atlassian Data Center (self-hosted) isn't covered by the **Jira & Confluence** entry because it authenticates with a personal access token sent as a Bearer header. Add a Data Center instance as a [custom connector](/docs/claude-tag/admins/connections/custom) with the **Bearer** credential type and your instance's hostname under **Allowed websites**. The instance must be reachable from the public internet. ## Connect a token with scopes through the Atlassian gateway If your organization requires tokens with scopes, connect through the gateway instead of the **Jira & Confluence** entry. Add the gateway connector inside a new bundle. A new bundle applies nowhere until you add places to it, so you can limit the token to your site's paths before any channel can use it. - - - Go to [**Organization settings > Claude Tag > Bundles**](https://claude.ai/admin-settings/claude-tag?access=presets), click **Add**, enter a name such as `Atlassian gateway`, and click **Create**. The bundle's page opens. - +**1. Create a bundle for the gateway** + +Go to [**Organization settings > Claude Tag > Bundles**](https://claude.ai/admin-settings/claude-tag?access=presets), click **Add**, enter a name such as `Atlassian gateway`, and click **Create**. The bundle's page opens. + +**2. Add the gateway connector** + +Under **What's in it**, click **Add**, select **Connector**, and select **Custom connector**. In the [custom connector](/docs/claude-tag/admins/connections/custom) form, enter a **Name**, choose the **Basic** credential type, enter the dedicated account's email as the **Username** and the API token as the **Password**, and enter `api.atlassian.com` under **Allowed websites**. Click **Connect** to save the connector. + +**3. Limit the credential to your site's paths** - - Under **What's in it**, click **Add**, select **Connector**, and select **Custom connector**. In the [custom connector](/docs/claude-tag/admins/connections/custom) form, enter a **Name**, choose the **Basic** credential type, enter the dedicated account's email as the **Username** and the API token as the **Password**, and enter `api.atlassian.com` under **Allowed websites**. Click **Connect** to save the connector. - +Under **What's in it**, open the menu on the new connector's row and click **Edit**. In the **Edit connection** dialog, add `/ex/jira//` and `/ex/confluence//` under **Path prefixes**, then click **Save**. The cloud ID in a gateway request's path chooses which Atlassian site the request reaches. - - Under **What's in it**, open the menu on the new connector's row and click **Edit**. In the **Edit connection** dialog, add `/ex/jira//` and `/ex/confluence//` under **Path prefixes**, then click **Save**. The cloud ID in a gateway request's path chooses which Atlassian site the request reaches. - +**4. Choose where the bundle applies** - - Under **Where it applies**, click **Add place**, choose a workspace or channel under **Where**, and click **Add**. Click **Save changes** to save the places. - - +Under **Where it applies**, click **Add place**, choose a workspace or channel under **Where**, and click **Add**. Click **Save changes** to save the places. Atlassian documents [tokens with scopes](https://support.atlassian.com/atlassian-account/docs/manage-api-tokens-for-your-atlassian-account/), [service account tokens](https://support.atlassian.com/user-management/docs/manage-api-tokens-for-service-accounts/), and [how to find your site's cloud ID](https://support.atlassian.com/jira/kb/retrieve-my-atlassian-sites-cloud-id/). diff --git a/content/claude/claude-tag/admins/connections/bigquery.md b/content/claude/claude-tag/admins/connections/bigquery.md index 4857c412cc..8a9ae7889a 100644 --- a/content/claude/claude-tag/admins/connections/bigquery.md +++ b/content/claude/claude-tag/admins/connections/bigquery.md @@ -6,9 +6,9 @@ > Connect BigQuery to Claude Tag so it can run read-only queries on your datasets, using a GCP service-account key. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Connecting BigQuery lets Claude run queries against your datasets in any channel where the connector is on. Claude connects with its own credential, not a person's. diff --git a/content/claude/claude-tag/admins/connections/custom.md b/content/claude/claude-tag/admins/connections/custom.md index 48dc23b694..49161abcb5 100644 --- a/content/claude/claude-tag/admins/connections/custom.md +++ b/content/claude/claude-tag/admins/connections/custom.md @@ -6,9 +6,9 @@ > Connect a tool that isn't in Claude Tag's connector list. Covers credential types, what each form field means, and how to add a custom MCP server. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. For a service that isn't in the **Add a connector** list, add a custom connector. This works for any service with an HTTP API. The [BigQuery](/docs/claude-tag/admins/connections/bigquery) guide is a worked example. @@ -28,8 +28,6 @@ To open the form, go to [**Organization settings > Claude Tag**](https://claude. See [Create a dedicated account per service](/docs/claude-tag/admins/add-connections#create-a-dedicated-account-per-service) for the service-account patterns. - - ### Fill out the custom connector form | Field | What to enter | @@ -56,7 +54,9 @@ After saving, where the credential has an allow rule, you can narrow it by HTTP | **OAuth 2.0 client credentials** | Machine-to-machine OAuth with a client ID and secret | | **MCP Connector** | OAuth sign-in to one of the providers in the picker or to a [remote MCP connector](/docs/connectors/custom/add-unlisted) your organization has added on claude.ai. Sign in once as an admin; the agent acts as that account. Other OAuth APIs can't be connected this way. | -The **MCP Connector** type signs in to a connector from your organization's connector library. If you register a new connector from this form with **Add custom connector…**, that connector is added to the library on the **Connectors** page at [`claude.ai/admin-settings/connectors`](https://claude.ai/admin-settings/connectors), not only to Claude Tag. Removing the Claude Tag connector later leaves the library entry in place. +> [!NOTE] +> +> The **MCP Connector** type signs in to a connector from your organization's connector library. If you register a new connector from this form with **Add custom connector…**, that connector is added to the library on the **Connectors** page at [`claude.ai/admin-settings/connectors`](https://claude.ai/admin-settings/connectors), not only to Claude Tag. Removing the Claude Tag connector later leaves the library entry in place. For GitHub repositories, use the Claude GitHub App at [Configure GitHub access](/docs/claude-tag/admins/configure-github) rather than a credential from this table. @@ -115,15 +115,13 @@ The server must be a remote endpoint that Claude can reach at a URL over the int To give Claude an MCP server (one you run, or a vendor's hosted MCP endpoint), the pattern is a plugin plus a credential: - - - Add a plugin whose `.mcp.json` points at the server URL, from your organization's library or your [skills repository](/docs/claude-tag/admins/skills-repo), wherever the server should be available; see [Attach plugins](/docs/claude-tag/admins/add-connections#attach-plugins). The plugin tells Claude the server exists and how to call it. - +**1. Add a plugin that declares the MCP server** + +Add a plugin whose `.mcp.json` points at the server URL, from your organization's library or your [skills repository](/docs/claude-tag/admins/skills-repo), wherever the server should be available; see [Attach plugins](/docs/claude-tag/admins/add-connections#attach-plugins). The plugin tells Claude the server exists and how to call it. + +**2. Add a credential for the server's host** - - Add a custom connector for the MCP server's host (for example, a Bearer token with **Allowed websites** set to `your-mcp-host.example.com`), where the plugin applies. This lets the call leave the sandbox with auth attached. - - +Add a custom connector for the MCP server's host (for example, a Bearer token with **Allowed websites** set to `your-mcp-host.example.com`), where the plugin applies. This lets the call leave the sandbox with auth attached. The plugin's `.mcp.json` is loaded because it's part of an attached plugin; an `.mcp.json` checked into a repository Claude clones is not loaded. diff --git a/content/claude/claude-tag/admins/connections/datadog.md b/content/claude/claude-tag/admins/connections/datadog.md index 8d2ffff3ca..03c5efaa47 100644 --- a/content/claude/claude-tag/admins/connections/datadog.md +++ b/content/claude/claude-tag/admins/connections/datadog.md @@ -6,9 +6,9 @@ > Connect Datadog to Claude Tag so it can query metrics, logs, and monitors. Covers the dedicated account to create, the API key fields, and the URL to allow. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Connecting Datadog lets Claude query metrics, logs, and monitors during debugging in any channel where the connector is on. Claude connects with its own credential, not a person's. diff --git a/content/claude/claude-tag/admins/connections/gitlab.md b/content/claude/claude-tag/admins/connections/gitlab.md index 86d31936d8..4031a02c0c 100644 --- a/content/claude/claude-tag/admins/connections/gitlab.md +++ b/content/claude/claude-tag/admins/connections/gitlab.md @@ -6,27 +6,27 @@ > Connect GitLab to Claude Tag so it can read code, manage issues, comment on merge requests, and check pipelines through the GitLab API. Covers token permissions, self-managed hostnames, and how it differs from GitHub. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Connecting GitLab lets Claude read and search projects, manage issues, comment on merge requests, and check pipeline status, all through the GitLab REST API. The connector holds a single access token. -This page is the credential field reference. The full setup walkthrough, including creating a dedicated GitLab service account for Claude and scoping its group access, is at [Configure GitLab access](/docs/claude-tag/admins/configure-gitlab). +> [!TIP] +> +> This page is the credential field reference. The full setup walkthrough, including creating a dedicated GitLab service account for Claude and scoping its group access, is at [Configure GitLab access](/docs/claude-tag/admins/configure-gitlab). If your plugin marketplace includes a GitLab plugin, pair it with this connector so Claude knows how to call the API. Add the plugin on the [**Skills and plugins**](https://claude.ai/admin-settings/claude-tag?access=plugins) tab. The connector works without it. ## Add the connector - - - A personal access token from a [dedicated service account](/docs/claude-tag/admins/configure-gitlab#create-a-dedicated-gitlab-account-for-claude) is recommended, so one identity covers every group you add it to. Project and group access tokens also work if you only need a single project or group. Grant the `api` scope for read and write, or `read_api` for read-only. The token starts with `glpat-`. - +**1. Create the token in GitLab** + +A personal access token from a [dedicated service account](/docs/claude-tag/admins/configure-gitlab#create-a-dedicated-gitlab-account-for-claude) is recommended, so one identity covers every group you add it to. Project and group access tokens also work if you only need a single project or group. Grant the `api` scope for read and write, or `read_api` for read-only. The token starts with `glpat-`. + +**2. Add the connector** - - Go to [**Organization settings > Claude Tag > Connectors**](https://claude.ai/admin-settings/claude-tag?access=connectors), click **Add**, select **GitLab**, and paste the token. For self-managed GitLab, switch to the form's **Advanced** tab and add your instance's hostname under **Allowed websites**. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](/docs/claude-tag/admins/add-connections#add-a-connection) before you save the connector. Click **Connect** to save the connector. - - +Go to [**Organization settings > Claude Tag > Connectors**](https://claude.ai/admin-settings/claude-tag?access=connectors), click **Add**, select **GitLab**, and paste the token. For self-managed GitLab, switch to the form's **Advanced** tab and add your instance's hostname under **Allowed websites**. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](/docs/claude-tag/admins/add-connections#add-a-connection) before you save the connector. Click **Connect** to save the connector. **You'll see:** GitLab on the **Connectors** tab, and `@Claude what can you access from this channel?` returns it in a new thread in any channel where the connector is on. New threads pick up the connector on their own; in an existing thread, ask Claude to use the service by name. diff --git a/content/claude/claude-tag/admins/connections/gong.md b/content/claude/claude-tag/admins/connections/gong.md index c7ecae5605..9a4bfd5d71 100644 --- a/content/claude/claude-tag/admins/connections/gong.md +++ b/content/claude/claude-tag/admins/connections/gong.md @@ -6,9 +6,9 @@ > Connect Gong to Claude Tag so it can pull call summaries and deal context. Covers the dedicated account to create, the token fields, and the URL to allow. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Connecting Gong lets Claude pull call summaries and deal context in any channel where the connector is on. Claude connects with its own credential, not a person's. diff --git a/content/claude/claude-tag/admins/connections/google.md b/content/claude/claude-tag/admins/connections/google.md index 5991c5cbaf..22c269e999 100644 --- a/content/claude/claude-tag/admins/connections/google.md +++ b/content/claude/claude-tag/admins/connections/google.md @@ -6,9 +6,9 @@ > Connect Google Drive, Calendar, and Gmail to Claude Tag so it can read docs, sheets, events, and email. Covers OAuth setup, the service-account option, and what each grants. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Connecting Google Drive, Calendar, and Gmail lets Claude read documents, spreadsheets, calendar events, and email in any channel where the connector is on. Claude connects with its own credential, not a person's. @@ -27,7 +27,9 @@ Both routes create a credential and an allowed-websites rule for the Google host ## Add the connector with Google sign-in -Use a dedicated Google account for this connector (for example, `claude@yourcompany.example.com`), not your own. The connector is shared: anyone in a channel where it's on can ask Claude to read whatever this account can see in Drive, Calendar, and Gmail. A dedicated account starts with no access until you share the specific folders and calendars Claude needs, and keeps its activity under a separate identity in Google's audit log. +> [!WARNING] +> +> Use a dedicated Google account for this connector (for example, `claude@yourcompany.example.com`), not your own. The connector is shared: anyone in a channel where it's on can ask Claude to read whatever this account can see in Drive, Calendar, and Gmail. A dedicated account starts with no access until you share the specific folders and calendars Claude needs, and keeps its activity under a separate identity in Google's audit log. Go to [**Organization settings > Claude Tag > Connectors**](https://claude.ai/admin-settings/claude-tag?access=connectors), click **Add**, and select **Google Drive**, **Google Calendar**, or **Gmail**. The connect form lists the Google hosts the connector can reach; there are no scopes to choose. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](/docs/claude-tag/admins/add-connections#add-a-connection) before you sign in. Click **Sign in with Google Drive** (or **Sign in with Google Calendar**, or **Sign in with Gmail**), approve the Google consent screen, and the credential is saved. diff --git a/content/claude/claude-tag/admins/connections/hubspot.md b/content/claude/claude-tag/admins/connections/hubspot.md index 44bde4a1ce..a6c829408c 100644 --- a/content/claude/claude-tag/admins/connections/hubspot.md +++ b/content/claude/claude-tag/admins/connections/hubspot.md @@ -6,9 +6,9 @@ > Connect HubSpot to Claude Tag so it can read pipeline, deal, and contact data. Covers the dedicated account to create, the token fields, and the URL to allow. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Connecting HubSpot lets Claude pull pipeline, deal, and contact state in any channel where the connector is on. Claude connects with its own credential, not a person's. diff --git a/content/claude/claude-tag/admins/connections/linear.md b/content/claude/claude-tag/admins/connections/linear.md index 73e76a86b4..9a3b72d353 100644 --- a/content/claude/claude-tag/admins/connections/linear.md +++ b/content/claude/claude-tag/admins/connections/linear.md @@ -6,9 +6,9 @@ > Connect Linear to Claude Tag so it can file tickets and post status updates. Covers the dedicated account to create, the token fields, and the URL to allow. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Connecting Linear lets Claude file tickets and post status updates from a thread in any channel where the connector is on. Claude connects with its own credential, not a person's. diff --git a/content/claude/claude-tag/admins/connections/notion.md b/content/claude/claude-tag/admins/connections/notion.md index a8159e6971..60b08309c6 100644 --- a/content/claude/claude-tag/admins/connections/notion.md +++ b/content/claude/claude-tag/admins/connections/notion.md @@ -6,9 +6,9 @@ > Connect Notion to Claude Tag so it can read and search your Notion workspace. Covers the dedicated account to create, the token fields, and the URL to allow. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Connecting Notion lets Claude ground answers in your Notion workspace in any channel where the connector is on. Claude connects with its own credential, not a person's. diff --git a/content/claude/claude-tag/admins/connections/overview.md b/content/claude/claude-tag/admins/connections/overview.md index c32b185890..1c3b6488fa 100644 --- a/content/claude/claude-tag/admins/connections/overview.md +++ b/content/claude/claude-tag/admins/connections/overview.md @@ -6,13 +6,15 @@ > Step-by-step setup for each tool Claude Tag can connect to. Each guide covers the dedicated account to create, the credential to enter, and the URL to allow. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Each guide covers one service: how to create the credential as a dedicated identity, what to paste into the connect form, and the **Allowed websites** value. For the model behind connectors (credential types, Agent Proxy, allowed websites, bundles), see [Give Claude access](/docs/claude-tag/admins/add-connections). -Always connect a dedicated account for Claude (for example, `claude@yourcompany.example.com`), not your personal login. Anyone in a channel where the connector applies can use it through Claude, so whatever this account can reach is available to every member of those channels. See [Create a dedicated account per service](/docs/claude-tag/admins/add-connections#create-a-dedicated-account-per-service). Before you add a connector, see [where a new connector applies](/docs/claude-tag/admins/add-connections#where-a-new-connector-applies). +> [!WARNING] +> +> Always connect a dedicated account for Claude (for example, `claude@yourcompany.example.com`), not your personal login. Anyone in a channel where the connector applies can use it through Claude, so whatever this account can reach is available to every member of those channels. See [Create a dedicated account per service](/docs/claude-tag/admins/add-connections#create-a-dedicated-account-per-service). Before you add a connector, see [where a new connector applies](/docs/claude-tag/admins/add-connections#where-a-new-connector-applies). | Service | Category | Guide | | :- | :- | :- | diff --git a/content/claude/claude-tag/admins/connections/pagerduty.md b/content/claude/claude-tag/admins/connections/pagerduty.md index d4b915eea4..65117cbfaf 100644 --- a/content/claude/claude-tag/admins/connections/pagerduty.md +++ b/content/claude/claude-tag/admins/connections/pagerduty.md @@ -6,9 +6,9 @@ > Connect PagerDuty to Claude Tag so it can read incidents and on-call schedules. Covers the dedicated account to create, the token fields, and the URL to allow. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Connecting PagerDuty lets Claude read incidents and on-call schedules during incident work in any channel where the connector is on. Claude connects with its own credential, not a person's. diff --git a/content/claude/claude-tag/admins/connections/salesforce.md b/content/claude/claude-tag/admins/connections/salesforce.md index 64558e5565..fc7bb28cc7 100644 --- a/content/claude/claude-tag/admins/connections/salesforce.md +++ b/content/claude/claude-tag/admins/connections/salesforce.md @@ -6,9 +6,9 @@ > Connect Salesforce to Claude Tag so it can read and update CRM records. Covers the connected app to create, the client credential fields, and the host to allow. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Connecting Salesforce lets Claude read accounts, contacts, opportunities, and cases (and write, if you grant it) in any channel where the connector is on. Claude connects with its own credential, not a person's. The connector uses the OAuth 2.0 client credentials flow. diff --git a/content/claude/claude-tag/admins/connections/sentry.md b/content/claude/claude-tag/admins/connections/sentry.md index 4507ec3d21..3b82ad602c 100644 --- a/content/claude/claude-tag/admins/connections/sentry.md +++ b/content/claude/claude-tag/admins/connections/sentry.md @@ -6,9 +6,9 @@ > Connect Sentry to Claude Tag so it can pull errors and stack traces into threads. Covers the dedicated account to create, the token fields, and the URL to allow. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Connecting Sentry lets Claude pull errors and stack traces into incident threads in any channel where the connector is on. Claude connects with its own credential, not a person's. diff --git a/content/claude/claude-tag/admins/connections/snowflake.md b/content/claude/claude-tag/admins/connections/snowflake.md index 6d9735fd65..946cca49b3 100644 --- a/content/claude/claude-tag/admins/connections/snowflake.md +++ b/content/claude/claude-tag/admins/connections/snowflake.md @@ -6,9 +6,9 @@ > Connect Snowflake to Claude Tag so it can run read-only queries on your warehouse. Covers the dedicated user to create, the access token field, and the host to allow. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Connecting Snowflake lets Claude run queries against your warehouse in any channel where the connector is on. Claude connects with its own credential, not a person's. diff --git a/content/claude/claude-tag/admins/connections/stripe.md b/content/claude/claude-tag/admins/connections/stripe.md index b4ea935450..cdd000679f 100644 --- a/content/claude/claude-tag/admins/connections/stripe.md +++ b/content/claude/claude-tag/admins/connections/stripe.md @@ -6,9 +6,9 @@ > Connect Stripe to Claude Tag so it can answer billing and subscription questions. Covers the dedicated account to create, the key fields, and the URL to allow. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Connecting Stripe lets Claude answer billing and subscription questions in any channel where the connector is on. Claude connects with its own credential, not a person's. diff --git a/content/claude/claude-tag/admins/connections/vercel.md b/content/claude/claude-tag/admins/connections/vercel.md index 972d1bf8e7..0db8d6bc7a 100644 --- a/content/claude/claude-tag/admins/connections/vercel.md +++ b/content/claude/claude-tag/admins/connections/vercel.md @@ -6,9 +6,9 @@ > Connect Vercel to Claude Tag so it can check deployment status and logs. Covers the dedicated account to create, the token fields, and the URL to allow. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Connecting Vercel lets Claude check deployment status and logs in any channel where the connector is on. Claude connects with its own credential, not a person's. diff --git a/content/claude/claude-tag/admins/customize.md b/content/claude/claude-tag/admins/customize.md index 46dcc7d492..47c4d4b034 100644 --- a/content/claude/claude-tag/admins/customize.md +++ b/content/claude/claude-tag/admins/customize.md @@ -6,9 +6,9 @@ > Claude Tag is customized per channel and workspace (a scope), not per user. See what admins set in claude.ai, what anyone can change from the channel, and what stays fixed. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Claude Tag's behavior is shaped by four layers, each set in a different place: @@ -38,8 +38,6 @@ Access and organization-wide behavior are set at [`claude.ai/admin-settings/clau | Enable Claude Tag | Turns Claude on or off in a scope. On the **Slack** page, the switch is labeled **Respond in all channels** or **Respond in channels** | [Turn Claude Tag on or off and set the version for a scope](/docs/claude-tag/admins/workspaces#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope) | | Claude Tag version | Which generation answers in a scope (**New** or **Legacy**) | [Turn Claude Tag on or off and set the version for a scope](/docs/claude-tag/admins/workspaces#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope) | - - ### Claude Tag connectors are separate from personal connectors An Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access#delegate-claude-tag-administration) configures Claude Tag connectors, plugins, and skills, and they apply per scope. They are separate from the personal connectors, skills, or MCP servers an individual user has set up in their own claude.ai or Claude Desktop account. A user's personal connectors are not part of a channel's configuration, and the channel's connectors are not listed among that user's personal connectors in claude.ai. Claude can [use a user's personal connectors in a channel](/docs/claude-tag/concepts/personal-connectors) for that user's own tasks, after the user allows it. That work runs with the user's permissions and is recorded under their name. Projects in claude.ai are separate too. Claude doesn't read a Project's instructions or knowledge in Slack, and a channel can't be pointed at a Project. Put standing guidance for a channel in its [custom instructions](/docs/claude-tag/admins/attach-to-scope#add-custom-instructions). @@ -129,19 +127,17 @@ Keep credentials out of environment variables because every session on the envir Creating the environment and choosing it on a scope happen on two different admin pages. Choose it on a channel to change only that channel's sessions, on a workspace to cover every channel in the workspace where you haven't chosen one, or on the **Slack** page to cover every workspace. - - - From the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings), add an [organization-shared environment](https://code.claude.com/docs/en/cloud-environments#organization-shared-environments) and fill in its setup script, environment variables, and network access level. - +**1. Create the environment** + +From the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings), add an [organization-shared environment](https://code.claude.com/docs/en/cloud-environments#organization-shared-environments) and fill in its setup script, environment variables, and network access level. + +**2. Set the scope's environment** + +Go to [**Claude's access > Channels**](https://claude.ai/admin-settings/claude-tag?access=channels) and open the scope's page (**Slack** for the whole organization). On its **Advanced** tab, pick the environment in **Environment** under **Sessions**. - - Go to [**Claude's access > Channels**](https://claude.ai/admin-settings/claude-tag?access=channels) and open the scope's page (**Slack** for the whole organization). On its **Advanced** tab, pick the environment in **Environment** under **Sessions**. - +**3. Confirm the environment in a new thread** - - Start a fresh thread in the channel and ask Claude to use what you added, such as running the tool your setup script installed. Threads already underway keep the environment they started on, so an existing thread won't show the change. - - +Start a fresh thread in the channel and ask Claude to use what you added, such as running the tool your setup script installed. Threads already underway keep the environment they started on, so an existing thread won't show the change. ### Which environment a channel's sessions use @@ -170,7 +166,9 @@ The rules list has three properties: * **Inheritance:** rules you set on a workspace or on the [**Slack** page](/docs/claude-tag/admins/attach-to-scope#how-scopes-inherit) (the organization-wide root) carry down to the channels beneath, the way [custom instructions](/docs/claude-tag/admins/attach-to-scope#custom-instructions) stack. A channel's own rules add to those and never replace them, so put a rule on a single channel's scope to pre-approve an action there without changing any other channel. * **Access:** you edit the list with the same admin access as the scope's other **Advanced** settings -Once you add an allow rule, Claude runs the actions it names in every channel the scope covers without anyone approving them in the moment. Keep each rule narrow: name the tool, the action, and the environment it allows, and put rules that unlock sensitive systems on the narrowest scope that needs them. +> [!WARNING] +> +> Once you add an allow rule, Claude runs the actions it names in every channel the scope covers without anyone approving them in the moment. Keep each rule narrow: name the tool, the action, and the environment it allows, and put rules that unlock sensitive systems on the narrowest scope that needs them. ## Name, handle, and avatar of the Claude app diff --git a/content/claude/claude-tag/admins/federated-access/authorization-server.md b/content/claude/claude-tag/admins/federated-access/authorization-server.md index bcb7555702..10c72489ad 100644 --- a/content/claude/claude-tag/admins/federated-access/authorization-server.md +++ b/content/claude/claude-tag/admins/federated-access/authorization-server.md @@ -6,11 +6,13 @@ > Let Claude exchange a short-lived identity token for an access token from an OAuth 2.0 authorization server you run, then call your APIs with it. Covers what your token endpoint receives and must check, what it returns, and how to register it in the console. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. - - -Authorization servers are connected on the [**Federated agent access**](https://claude.ai/admin-settings/claude-tag/federated-cloud-access) page, under **Claude Tag** in the admin settings sidebar. Use its **Authorization servers** section. Connecting a server needs an organization Owner, or an admin with full Claude Tag management permission. +> [!NOTE] +> +> Authorization servers are connected on the [**Federated agent access**](https://claude.ai/admin-settings/claude-tag/federated-cloud-access) page, under **Claude Tag** in the admin settings sidebar. Use its **Authorization servers** section. Connecting a server needs an organization Owner, or an admin with full Claude Tag management permission. With an authorization server connection, Claude presents a short-lived identity token to an OAuth 2.0 authorization server you run, receives one of your access tokens in return, and calls your APIs with it. No long-lived credential for your systems is stored in Claude, and [Agent Proxy](/docs/claude-tag/concepts/agent-identity#agent-proxy) holds each access token only until it expires. The identity token names your organization and the [agent](/docs/claude-tag/concepts/agent-identity) making the request (Claude's identity in one Slack channel), and your server decides whether to issue a token for it. @@ -68,27 +70,25 @@ To refuse a grant, return a standard OAuth 2.0 error response, such as `400` wit ## Register the endpoint and connect the server - - - In **Authorization servers**, click **Connect an authorization server**. - +**1. Open the Connect an authorization server dialog** + +In **Authorization servers**, click **Connect an authorization server**. + +**2. Enter the token endpoint** + +In the **Token endpoint** field, enter the full address starting with `https://`, for example `https://auth.example.com/oauth2/token`. In the **Issuer URL** field, enter your authorization server's issuer identifier, the `iss` value it uses, for example `https://auth.example.com`. That value is the token's audience, and it must be an HTTPS URL on the same host as the token endpoint. Leave the field empty only if your server requires the token endpoint URL as the audience. Then the **Token endpoint** address is the audience. The **Audience** row of the card shows which one will be sent. + +**3. Confirm the subject check and register** - - In the **Token endpoint** field, enter the full address starting with `https://`, for example `https://auth.example.com/oauth2/token`. In the **Issuer URL** field, enter your authorization server's issuer identifier, the `iss` value it uses, for example `https://auth.example.com`. That value is the token's audience, and it must be an HTTPS URL on the same host as the token endpoint. Leave the field empty only if your server requires the token endpoint URL as the audience. Then the **Token endpoint** address is the audience. The **Audience** row of the card shows which one will be sent. - +Select the checkbox labeled **This authorization server checks that each token's subject belongs to your organization**. The **Register server** button stays disabled until you do. The checkbox is your confirmation that the server makes the subject check described under [Configure the authorization server](#configure-the-authorization-server), and a server that doesn't must not be connected. Then click **Register server**. The dialog notes that the automatic connection check doesn't run for token endpoints. The token's audience, your **Issuer URL** value or the token endpoint if you left that field empty, is registered as a gateway with the check marked **Skipped**, and the dialog moves to the second step. - - Select the checkbox labeled **This authorization server checks that each token's subject belongs to your organization**. The **Register server** button stays disabled until you do. The checkbox is your confirmation that the server makes the subject check described under [Configure the authorization server](#configure-the-authorization-server), and a server that doesn't must not be connected. Then click **Register server**. The dialog notes that the automatic connection check doesn't run for token endpoints. The token's audience, your **Issuer URL** value or the token endpoint if you left that field empty, is registered as a gateway with the check marked **Skipped**, and the dialog moves to the second step. +If you close the dialog at that point, the audience address stays registered and counts toward the limit. To continue later, click **Connect an authorization server** again, enter the same **Token endpoint** and **Issuer URL**, and select the checkbox again, which returns you to the second step. Don't use **Add to bundle** on that address's row in the **Gateways** table; that would connect the address as a gateway, after which the server can't be connected. - If you close the dialog at that point, the audience address stays registered and counts toward the limit. To continue later, click **Connect an authorization server** again, enter the same **Token endpoint** and **Issuer URL**, and select the checkbox again, which returns you to the second step. Don't use **Add to bundle** on that address's row in the **Gateways** table; that would connect the address as a gateway, after which the server can't be connected. - +**4. Choose the APIs and the bundle** - - Optionally enter a **Resource**, the API the returned token should be scoped to as an absolute URI (for example `https://api.example.com`), and a **Scope**, space-separated scopes to request. In **Allowed API hosts**, add the hosts Claude may call with the returned token, for example `api.example.com`. A wildcard as the leftmost label matches any subdomain. An entry or wildcard can cover the token endpoint's host only when the endpoint's address has a folder of its own, like `/oauth2` in `https://auth.example.com/oauth2/token`. In that case, list the paths Claude may use, such as `/graphql`, under **Allowed API paths**. A listed path covers everything under it, and a path that overlaps the token endpoint's folder isn't allowed. Then choose a bundle from the **Access bundle** list (or create one: click **New bundle** if the dialog shows it, enter a **Bundle name**, and click **Create bundle**) and click **Connect server**. +Optionally enter a **Resource**, the API the returned token should be scoped to as an absolute URI (for example `https://api.example.com`), and a **Scope**, space-separated scopes to request. In **Allowed API hosts**, add the hosts Claude may call with the returned token, for example `api.example.com`. A wildcard as the leftmost label matches any subdomain. An entry or wildcard can cover the token endpoint's host only when the endpoint's address has a folder of its own, like `/oauth2` in `https://auth.example.com/oauth2/token`. In that case, list the paths Claude may use, such as `/graphql`, under **Allowed API paths**. A listed path covers everything under it, and a path that overlaps the token endpoint's folder isn't allowed. Then choose a bundle from the **Access bundle** list (or create one: click **New bundle** if the dialog shows it, enter a **Bundle name**, and click **Create bundle**) and click **Connect server**. - This creates a [connection](/docs/claude-tag/admins/add-connections) in that bundle, with the API hosts under **Allowed hosts**. Agent Proxy attaches the access token as an `Authorization: Bearer` header to every request Claude makes to those hosts. A token endpoint can be connected once in your organization, in one bundle, and the connection applies wherever that bundle applies. - - +This creates a [connection](/docs/claude-tag/admins/add-connections) in that bundle, with the API hosts under **Allowed hosts**. Agent Proxy attaches the access token as an `Authorization: Bearer` header to every request Claude makes to those hosts. A token endpoint can be connected once in your organization, in one bundle, and the connection applies wherever that bundle applies. The **Authorization servers** table lists each server by its **Token endpoint**, with its **Access bundle**, its **Allowed hosts**, when it was **Added**, and a **Remove** action. The audience address also appears in the **Gateways** table with its check marked **Skipped** and a note that a connected authorization server uses it. diff --git a/content/claude/claude-tag/admins/federated-access/aws.md b/content/claude/claude-tag/admins/federated-access/aws.md index 0a27a756d7..5e53cea081 100644 --- a/content/claude/claude-tag/admins/federated-access/aws.md +++ b/content/claude/claude-tag/admins/federated-access/aws.md @@ -6,11 +6,13 @@ > Let Claude sign in to an IAM role in your AWS account with a short-lived identity token instead of stored access keys. Covers the identity provider and trust policy to create in AWS, how to connect the role in the console, and how to verify the connection in CloudTrail. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. - - -AWS roles are connected on the [**Federated agent access**](https://claude.ai/admin-settings/claude-tag/federated-cloud-access) page, under **Claude Tag** in the admin settings sidebar. Use its **Cloud roles** section. Connecting a role needs an organization Owner, or an admin with full Claude Tag management permission. +> [!NOTE] +> +> AWS roles are connected on the [**Federated agent access**](https://claude.ai/admin-settings/claude-tag/federated-cloud-access) page, under **Claude Tag** in the admin settings sidebar. Use its **Cloud roles** section. Connecting a role needs an organization Owner, or an admin with full Claude Tag management permission. With an AWS role connection, Claude signs in to an IAM role in your AWS account with a short-lived identity token and calls AWS with the role's permissions. No access key is stored in Claude. The token names your organization and the [agent](/docs/claude-tag/concepts/agent-identity) making the request (Claude's identity in one Slack channel), and your role's trust policy decides which tokens to accept. If someone else manages your AWS account, give them the values from the console and the trust policy below; the console steps need an organization Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access#delegate-claude-tag-administration). @@ -32,72 +34,68 @@ In **Cloud roles**, click **Connect an AWS role** and copy the **Issuer**, **Aud ## Create the identity provider and role in AWS - - - In the AWS account that owns the role, create an IAM OpenID Connect (OIDC) identity provider with the provider URL `https://identity.anthropic.com/agents` and the audience `sts.amazonaws.com`. Include the `/agents` path. A provider created with the bare hostname, or with any other path, makes every sign-in fail later with an invalid-token or provider error from AWS. You don't need to supply a certificate thumbprint, because AWS verifies the provider's certificate itself. +**1. Create the IAM identity provider** + +In the AWS account that owns the role, create an IAM OpenID Connect (OIDC) identity provider with the provider URL `https://identity.anthropic.com/agents` and the audience `sts.amazonaws.com`. Include the `/agents` path. A provider created with the bare hostname, or with any other path, makes every sign-in fail later with an invalid-token or provider error from AWS. You don't need to supply a certificate thumbprint, because AWS verifies the provider's certificate itself. + +To confirm the provider, run `aws iam get-open-id-connect-provider --open-id-connect-provider-arn ` and check that `Url` is `identity.anthropic.com/agents` (AWS stores the URL without `https://`) and `ClientIDList` contains `sts.amazonaws.com`. - To confirm the provider, run `aws iam get-open-id-connect-provider --open-id-connect-provider-arn ` and check that `Url` is `identity.anthropic.com/agents` (AWS stores the URL without `https://`) and `ClientIDList` contains `sts.amazonaws.com`. - +**2. Create the role with this trust policy** - - Create an IAM role with the trust policy below. Replace the account ID with yours (the rest of the provider ARN is the same for every account), and replace the `sub` value with your **Subject prefix** followed by `*`. +Create an IAM role with the trust policy below. Replace the account ID with yours (the rest of the provider ARN is the same for every account), and replace the `sub` value with your **Subject prefix** followed by `*`. - ```json theme={null} +```json theme={null} +{ + "Version": "2012-10-17", + "Statement": [ { - "Version": "2012-10-17", - "Statement": [ - { - "Effect": "Allow", - "Principal": { - "Federated": "arn:aws:iam::123456789012:oidc-provider/identity.anthropic.com/agents" - }, - "Action": "sts:AssumeRoleWithWebIdentity", - "Condition": { - "StringEquals": { - "identity.anthropic.com/agents:aud": "sts.amazonaws.com" - }, - "StringLike": { - "identity.anthropic.com/agents:sub": "wimse://identity.anthropic.com/org/org_01Hx7rQkPzT9sN3mVbJw2eYd/agent/*" - } - } + "Effect": "Allow", + "Principal": { + "Federated": "arn:aws:iam::123456789012:oidc-provider/identity.anthropic.com/agents" + }, + "Action": "sts:AssumeRoleWithWebIdentity", + "Condition": { + "StringEquals": { + "identity.anthropic.com/agents:aud": "sts.amazonaws.com" + }, + "StringLike": { + "identity.anthropic.com/agents:sub": "wimse://identity.anthropic.com/org/org_01Hx7rQkPzT9sN3mVbJw2eYd/agent/*" } - ] + } } - ``` + ] +} +``` + +Keep both conditions. Because every organization's tokens come from the same issuer with the same audience, the `sub` condition is the only thing that limits the role to your organization; see [Authorize on the subject](/docs/claude-tag/admins/federated-access/token-reference#authorize-on-the-subject). The wildcard replaces only the agent ID at the end. Never put a wildcard before `/agent/`. `StringEquals` on the prefix never matches, so keep the prefix condition under `StringLike`. Both condition keys start with `identity.anthropic.com/agents:` (the issuer without `https://`). - Keep both conditions. Because every organization's tokens come from the same issuer with the same audience, the `sub` condition is the only thing that limits the role to your organization; see [Authorize on the subject](/docs/claude-tag/admins/federated-access/token-reference#authorize-on-the-subject). The wildcard replaces only the agent ID at the end. Never put a wildcard before `/agent/`. `StringEquals` on the prefix never matches, so keep the prefix condition under `StringLike`. Both condition keys start with `identity.anthropic.com/agents:` (the issuer without `https://`). +The prefix condition is the minimum, and it admits every agent in your organization. Where your use case allows, pin the role to specific agents instead, which is the strongest form: use `StringEquals` on `identity.anthropic.com/agents:sub` with one full subject, or a JSON array of full subjects. The console doesn't show agent IDs, so you learn a subject from CloudTrail after a first sign-in under the prefix condition. Agent IDs change when a Slack channel is deleted and recreated, so update the policy when that happens. - The prefix condition is the minimum, and it admits every agent in your organization. Where your use case allows, pin the role to specific agents instead, which is the strongest form: use `StringEquals` on `identity.anthropic.com/agents:sub` with one full subject, or a JSON array of full subjects. The console doesn't show agent IDs, so you learn a subject from CloudTrail after a first sign-in under the prefix condition. Agent IDs change when a Slack channel is deleted and recreated, so update the policy when that happens. - +**3. Attach permissions** - - Attach a least-privilege permissions policy to the role for the work Claude will do. The check under [Verify the connection](#verify-the-connection) needs no permissions. Each sign-in gives Claude temporary credentials that last 1 hour, the AWS default. Claude doesn't ask for a different length, and the role's maximum session duration setting doesn't change this. To cut off access before they expire, use the role's **Revoke active sessions** option in IAM or change its permissions. - - +Attach a least-privilege permissions policy to the role for the work Claude will do. The check under [Verify the connection](#verify-the-connection) needs no permissions. Each sign-in gives Claude temporary credentials that last 1 hour, the AWS default. Claude doesn't ask for a different length, and the role's maximum session duration setting doesn't change this. To cut off access before they expire, use the role's **Revoke active sessions** option in IAM or change its permissions. ## Connect the role in the console - - - In **Cloud roles**, click **Connect an AWS role**. - +**1. Open the Connect an AWS role dialog** + +In **Cloud roles**, click **Connect an AWS role**. + +**2. Enter the role ARN** + +In the **Role ARN** field, enter the role's ARN, for example `arn:aws:iam::123456789012:role/ClaudeTag`. The role's name is used as the connection's name. + +**3. Narrow the allowed AWS hosts** + +The **Allowed AWS hosts** field starts with `*.amazonaws.com`, which lets Claude use the role with any AWS service. Keep that entry for the first verification, then narrow the list to the hosts Claude needs from the connection's [**Edit connection** dialog](/docs/claude-tag/admins/add-connections#set-allowed-websites), which you open from the connection's row on the **Connectors** tab; see [Manage federated connections on the Connectors tab](/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab). A wildcard covers subdomains only: `*.s3.us-west-2.amazonaws.com` matches `example-reports.s3.us-west-2.amazonaws.com` but not `s3.us-west-2.amazonaws.com`. The AWS CLI and SDKs use both forms for S3, so list both the plain host and the wildcard for each region, and for `us-east-1` also `*.s3.amazonaws.com`, the older global S3 address some tools still use there. Every host must end in `.amazonaws.com`. The sign-in itself goes to the AWS Security Token Service (STS) from Anthropic's side and doesn't need an entry here. - - In the **Role ARN** field, enter the role's ARN, for example `arn:aws:iam::123456789012:role/ClaudeTag`. The role's name is used as the connection's name. - +**4. Confirm the trust policy** - - The **Allowed AWS hosts** field starts with `*.amazonaws.com`, which lets Claude use the role with any AWS service. Keep that entry for the first verification, then narrow the list to the hosts Claude needs from the connection's [**Edit connection** dialog](/docs/claude-tag/admins/add-connections#set-allowed-websites), which you open from the connection's row on the **Connectors** tab; see [Manage federated connections on the Connectors tab](/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab). A wildcard covers subdomains only: `*.s3.us-west-2.amazonaws.com` matches `example-reports.s3.us-west-2.amazonaws.com` but not `s3.us-west-2.amazonaws.com`. The AWS CLI and SDKs use both forms for S3, so list both the plain host and the wildcard for each region, and for `us-east-1` also `*.s3.amazonaws.com`, the older global S3 address some tools still use there. Every host must end in `.amazonaws.com`. The sign-in itself goes to the AWS Security Token Service (STS) from Anthropic's side and doesn't need an entry here. - +Select the checkbox labeled **The role's trust policy requires the subject prefix shown above**. The **Connect role** button stays disabled until you do. Select it only if the trust policy pins `sub` to one or more full subjects under your **Subject prefix**, or to your prefix followed by `*` under `StringLike`, as described under [Create the identity provider and role in AWS](#create-the-identity-provider-and-role-in-aws). - - Select the checkbox labeled **The role's trust policy requires the subject prefix shown above**. The **Connect role** button stays disabled until you do. Select it only if the trust policy pins `sub` to one or more full subjects under your **Subject prefix**, or to your prefix followed by `*` under `StringLike`, as described under [Create the identity provider and role in AWS](#create-the-identity-provider-and-role-in-aws). - +**5. Choose a bundle and connect** - - Choose a bundle from the **Access bundle** list, or create one: click **New bundle** if the dialog shows it, enter a **Bundle name**, and click **Create bundle**. Then click **Connect role**. This creates a [connection](/docs/claude-tag/admins/add-connections) in that bundle, with the hosts you entered under **Allowed hosts**. A role can be connected in one bundle only, and it applies wherever that bundle applies. - - +Choose a bundle from the **Access bundle** list, or create one: click **New bundle** if the dialog shows it, enter a **Bundle name**, and click **Create bundle**. Then click **Connect role**. This creates a [connection](/docs/claude-tag/admins/add-connections) in that bundle, with the hosts you entered under **Allowed hosts**. A role can be connected in one bundle only, and it applies wherever that bundle applies. The **Cloud roles** table has **Role**, **Access bundle**, **Allowed hosts**, **Added**, and **Actions** columns. Each connection's name appears under **Role** with the role's ARN and an **AWS role** chip beneath it, and **Check trust policy** and **Remove** are under **Actions**. diff --git a/content/claude/claude-tag/admins/federated-access/connect-a-gateway.md b/content/claude/claude-tag/admins/federated-access/connect-a-gateway.md index feb582f08c..3d9a74ed59 100644 --- a/content/claude/claude-tag/admins/federated-access/connect-a-gateway.md +++ b/content/claude/claude-tag/admins/federated-access/connect-a-gateway.md @@ -6,11 +6,13 @@ > Connect a gateway you run so Claude Tag can call your internal services with a short-lived identity token instead of a stored credential. Covers what the gateway must check, how to register it in the console, and how to verify the connection. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. - - -Gateways are connected on the [**Federated agent access**](https://claude.ai/admin-settings/claude-tag/federated-cloud-access) page, under **Claude Tag** in the admin settings sidebar. Use its **Gateways** section. Connecting a gateway needs an organization Owner, or an admin with full Claude Tag management permission. +> [!NOTE] +> +> Gateways are connected on the [**Federated agent access**](https://claude.ai/admin-settings/claude-tag/federated-cloud-access) page, under **Claude Tag** in the admin settings sidebar. Use its **Gateways** section. Connecting a gateway needs an organization Owner, or an admin with full Claude Tag management permission. A gateway is a service you run between Claude and your internal systems. Every request Claude sends it carries a signed identity token naming your organization and the [agent](/docs/claude-tag/concepts/agent-identity) making the request (Claude's identity in one Slack channel). The gateway checks the token, decides what that agent may do, and forwards the request with your own credentials. No long-lived credential for your systems is stored in Claude. @@ -56,27 +58,25 @@ Never forward the Claude Tag token downstream; replace the `Authorization` heade ## Register the gateway in the console - - - In **Gateways**, click **Connect a gateway**. - +**1. Open the Connect a gateway dialog** + +In **Gateways**, click **Connect a gateway**. + +**2. Enter the gateway address** + +In the **Gateway address** field, enter the host only, in lowercase, starting with `https://`, for example `https://gateway.example.com`. This address is the token's audience. + +**3. Confirm the subject check** + +Select the **This gateway checks that each token's subject belongs to your organization** checkbox. The **Run check and connect** button stays disabled until you do. Select it only if the gateway rejects every subject outside your organization, by explicit list, by prefix, or by the `tenant` claim. - - In the **Gateway address** field, enter the host only, in lowercase, starting with `https://`, for example `https://gateway.example.com`. This address is the token's audience. - +**4. Run the connection check** - - Select the **This gateway checks that each token's subject belongs to your organization** checkbox. The **Run check and connect** button stays disabled until you do. Select it only if the gateway rejects every subject outside your organization, by explicit list, by prefix, or by the `tenant` claim. - +Leave the **Run the check** option selected and click **Run check and connect**. The check can take up to a minute. If it fails, nothing is registered; see [Common errors](#common-errors). If the gateway can't be reached from the internet yet, select the **Skip the check** option, enter a **Reason for skipping**, and click **Connect without the check**. The reason is shown in the **Gateways** table, under the **Skipped** result's **Details**. Entering an address that is already registered runs the check again (unless you skip it) without changing the stored result, then moves to the bundle step. - - Leave the **Run the check** option selected and click **Run check and connect**. The check can take up to a minute. If it fails, nothing is registered; see [Common errors](#common-errors). If the gateway can't be reached from the internet yet, select the **Skip the check** option, enter a **Reason for skipping**, and click **Connect without the check**. The reason is shown in the **Gateways** table, under the **Skipped** result's **Details**. Entering an address that is already registered runs the check again (unless you skip it) without changing the stored result, then moves to the bundle step. - +**5. Add the gateway to a bundle** - - Choose a bundle from the **Access bundle** list, or create one: click **New bundle** if the dialog shows it, enter a **Bundle name**, and click **Create bundle**. Then click **Add to bundle**. This creates a connection in that bundle, with the gateway's host as its allowed website. A gateway can be in more than one bundle, and it applies wherever those bundles apply. The **Access bundle** list offers only the bundles it isn't in yet. Click **Not now** to finish without a bundle. - - +Choose a bundle from the **Access bundle** list, or create one: click **New bundle** if the dialog shows it, enter a **Bundle name**, and click **Create bundle**. Then click **Add to bundle**. This creates a connection in that bundle, with the gateway's host as its allowed website. A gateway can be in more than one bundle, and it applies wherever those bundles apply. The **Access bundle** list offers only the bundles it isn't in yet. Click **Not now** to finish without a bundle. The **Gateways** table lists each gateway with its **Access bundles**, its **Connection check** result (**Passed**, or **Skipped**, with the reason you gave under **Details**), when it was added, and **Add to bundle** and **Remove** actions; on a row that is already in a bundle, the add action reads **Add to another bundle**. For a gateway that is already registered, skip the dialog's first step: click the add action in the gateway's row of the **Gateways** table, which opens the dialog at the bundle step. Entering the address again in **Connect a gateway** also reaches the bundle step, but unless you skip the check it runs again first, and that run counts toward the check limit. diff --git a/content/claude/claude-tag/admins/federated-access/gcp.md b/content/claude/claude-tag/admins/federated-access/gcp.md index b962e1728e..5235fe4954 100644 --- a/content/claude/claude-tag/admins/federated-access/gcp.md +++ b/content/claude/claude-tag/admins/federated-access/gcp.md @@ -6,11 +6,13 @@ > Let Claude call Google Cloud through workload identity federation with a short-lived identity token instead of a service account key. Covers the pool, provider, and IAM grants to create, with or without a service account, and how to connect the identity in the console. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. - - -Google Cloud identities are connected on the [**Federated agent access**](https://claude.ai/admin-settings/claude-tag/federated-cloud-access) page, under **Claude Tag** in the admin settings sidebar. Use its **Cloud roles** section. Connecting an identity needs an organization Owner, or an admin with full Claude Tag management permission. +> [!NOTE] +> +> Google Cloud identities are connected on the [**Federated agent access**](https://claude.ai/admin-settings/claude-tag/federated-cloud-access) page, under **Claude Tag** in the admin settings sidebar. Use its **Cloud roles** section. Connecting an identity needs an organization Owner, or an admin with full Claude Tag management permission. With a Google Cloud identity connection, Claude exchanges a short-lived identity token at a workload identity pool you create and calls Google Cloud APIs with the result. No service account key is stored in Claude. The token names your organization and the [agent](/docs/claude-tag/concepts/agent-identity) making the request (Claude's identity in one Slack channel), and your pool's attribute condition decides which tokens to accept. If someone else manages your Google Cloud project, give them the values from Claude's admin settings and the settings below; the console steps need an organization Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access#delegate-claude-tag-administration). @@ -73,41 +75,39 @@ Create a dedicated service account in any project and grant it the roles Claude ## Connect the identity in the console - - - In **Cloud roles**, click **Connect a Google Cloud identity**. - +**1. Open the Connect a Google Cloud identity dialog** + +In **Cloud roles**, click **Connect a Google Cloud identity**. + +**2. Enter the provider resource name** + +In the **Workload identity provider** field, enter `//iam.googleapis.com/` followed by the provider's full name as Google reports it, for example `//iam.googleapis.com/projects/123456789/locations/global/workloadIdentityPools/claude/providers/agents`. Use the project number, not the project ID (find it on the project's dashboard in the Google Cloud console). The value is stored as you type it and is the token's audience. + +**3. Name the service account, or leave the field empty** + +In the **Service account to act as (optional)** field, enter the service account's email, for example `claude@my-project.iam.gserviceaccount.com`, if you chose the form with a service account. Leave the field empty to have Claude act as the federated identity itself. The connection is named after the service account, or after the provider's ID (the last part of its resource name) when there is none. + +**4. Decide whether to block credential minting** + +The **Block requests that mint new credentials** checkbox is selected by default. With it selected: - - In the **Workload identity provider** field, enter `//iam.googleapis.com/` followed by the provider's full name as Google reports it, for example `//iam.googleapis.com/projects/123456789/locations/global/workloadIdentityPools/claude/providers/agents`. Use the project number, not the project ID (find it on the project's dashboard in the Google Cloud console). The value is stored as you type it and is the token's audience. - +* Claude can't use this identity to call Google endpoints that create keys, tokens, or other credentials, even if IAM would allow the call. +* Requests to a list of services that deal in credentials are refused entirely. See [what the credential-minting block refuses](/docs/claude-tag/admins/federated-access/limits#what-the-credential-minting-block-refuses) on the limits page. +* gRPC calls are refused, so tell Claude in the custom instructions to use the REST transport of client libraries such as Spanner, Bigtable, Firestore, and Pub/Sub. - - In the **Service account to act as (optional)** field, enter the service account's email, for example `claude@my-project.iam.gserviceaccount.com`, if you chose the form with a service account. Leave the field empty to have Claude act as the federated identity itself. The connection is named after the service account, or after the provider's ID (the last part of its resource name) when there is none. - +If Claude needs one of the refused services, clear the checkbox and rely on your IAM grants alone. The token exchange itself, including acting as the service account, happens inside Agent Proxy and isn't affected by this checkbox or by the allowed hosts. - - The **Block requests that mint new credentials** checkbox is selected by default. With it selected: +**5. Narrow the allowed Google hosts** - * Claude can't use this identity to call Google endpoints that create keys, tokens, or other credentials, even if IAM would allow the call. - * Requests to a list of services that deal in credentials are refused entirely. See [what the credential-minting block refuses](/docs/claude-tag/admins/federated-access/limits#what-the-credential-minting-block-refuses) on the limits page. - * gRPC calls are refused, so tell Claude in the custom instructions to use the REST transport of client libraries such as Spanner, Bigtable, Firestore, and Pub/Sub. +Replace the prefilled `*.googleapis.com` entry in the **Allowed Google hosts** field with the hosts Claude needs, for example `storage.googleapis.com`. A wildcard as the leftmost label, such as `*.storage.googleapis.com`, matches any subdomain but not the name itself. Every host must be `googleapis.com`, a subdomain of it, or a subdomain of `clients6.google.com`. You can change the list later from the connection's [**Edit connection** dialog](/docs/claude-tag/admins/add-connections#set-allowed-websites), which you open from the connection's row on the **Connectors** tab; see [Manage federated connections on the Connectors tab](/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab). - If Claude needs one of the refused services, clear the checkbox and rely on your IAM grants alone. The token exchange itself, including acting as the service account, happens inside Agent Proxy and isn't affected by this checkbox or by the allowed hosts. - +**6. Confirm the attribute condition** - - Replace the prefilled `*.googleapis.com` entry in the **Allowed Google hosts** field with the hosts Claude needs, for example `storage.googleapis.com`. A wildcard as the leftmost label, such as `*.storage.googleapis.com`, matches any subdomain but not the name itself. Every host must be `googleapis.com`, a subdomain of it, or a subdomain of `clients6.google.com`. You can change the list later from the connection's [**Edit connection** dialog](/docs/claude-tag/admins/add-connections#set-allowed-websites), which you open from the connection's row on the **Connectors** tab; see [Manage federated connections on the Connectors tab](/docs/claude-tag/admins/federated-access/overview#manage-federated-connections-on-the-connectors-tab). - +Select the checkbox labeled **The provider's attribute condition requires the subject prefix shown above**. The **Connect identity** button stays disabled until you do. Select the checkbox only if the provider's attribute condition pins `assertion.sub` to one or more full subjects under your **Subject prefix**, or at minimum pins `assertion.sub` to your **Subject prefix** (or, if you mapped it, `attribute.org` to your organization ID), as described under [Create the pool and provider in Google Cloud](#create-the-pool-and-provider-in-google-cloud). - - Select the checkbox labeled **The provider's attribute condition requires the subject prefix shown above**. The **Connect identity** button stays disabled until you do. Select the checkbox only if the provider's attribute condition pins `assertion.sub` to one or more full subjects under your **Subject prefix**, or at minimum pins `assertion.sub` to your **Subject prefix** (or, if you mapped it, `attribute.org` to your organization ID), as described under [Create the pool and provider in Google Cloud](#create-the-pool-and-provider-in-google-cloud). - +**7. Choose a bundle and connect** - - Choose a bundle from the **Access bundle** list, or create one: click **New bundle** if the dialog shows it, enter a **Bundle name**, and click **Create bundle**. Then click **Connect identity**. This creates a [connection](/docs/claude-tag/admins/add-connections) in that bundle, with the hosts you entered under **Allowed hosts**. The same provider can be connected more than once, for example once with a service account and once without, as long as no two Google Cloud connections in one bundle share a host under **Allowed hosts**. Each connection applies wherever its bundle applies. - - +Choose a bundle from the **Access bundle** list, or create one: click **New bundle** if the dialog shows it, enter a **Bundle name**, and click **Create bundle**. Then click **Connect identity**. This creates a [connection](/docs/claude-tag/admins/add-connections) in that bundle, with the hosts you entered under **Allowed hosts**. The same provider can be connected more than once, for example once with a service account and once without, as long as no two Google Cloud connections in one bundle share a host under **Allowed hosts**. Each connection applies wherever its bundle applies. The **Cloud roles** table has **Role**, **Access bundle**, **Allowed hosts**, **Added**, and **Actions** columns. Each connection's name appears under **Role** with the provider and a **Google Cloud** chip beneath it, which also names the service account when the connection acts as one, and **Remove** is under **Actions**. diff --git a/content/claude/claude-tag/admins/federated-access/limits.md b/content/claude/claude-tag/admins/federated-access/limits.md index 8155a387c8..08ae719112 100644 --- a/content/claude/claude-tag/admins/federated-access/limits.md +++ b/content/claude/claude-tag/admins/federated-access/limits.md @@ -6,9 +6,9 @@ > Counts, lengths, lifetimes, and unsupported configurations for Claude Tag's federated agent access: gateways, AWS roles, Google Cloud identities, and authorization servers. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. This page collects the fixed limits of Federated agent access in one place. diff --git a/content/claude/claude-tag/admins/federated-access/overview.md b/content/claude/claude-tag/admins/federated-access/overview.md index 28996939d4..e5ef0d4494 100644 --- a/content/claude/claude-tag/admins/federated-access/overview.md +++ b/content/claude/claude-tag/admins/federated-access/overview.md @@ -6,11 +6,13 @@ > Claude Tag proves its identity to your systems with a short-lived signed token instead of a credential stored in Claude. Learn how the token works and which of the four connection types to use. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. - - -Federated connections are managed on the [**Federated agent access**](https://claude.ai/admin-settings/claude-tag/federated-cloud-access) page, under **Claude Tag** in the admin settings sidebar. Connecting a gateway, cloud role, or authorization server needs an organization Owner, or an admin with full Claude Tag management permission. +> [!NOTE] +> +> Federated connections are managed on the [**Federated agent access**](https://claude.ai/admin-settings/claude-tag/federated-cloud-access) page, under **Claude Tag** in the admin settings sidebar. Connecting a gateway, cloud role, or authorization server needs an organization Owner, or an admin with full Claude Tag management permission. In Slack channels, Claude Tag acts under its own [agent identity](/docs/claude-tag/concepts/agent-identity) rather than as any person. Federated agent access lets that identity prove itself to your systems with a short-lived, signed identity token instead of a credential you store in Claude. diff --git a/content/claude/claude-tag/admins/federated-access/token-reference.md b/content/claude/claude-tag/admins/federated-access/token-reference.md index 9f4ed76095..ca84ec53ef 100644 --- a/content/claude/claude-tag/admins/federated-access/token-reference.md +++ b/content/claude/claude-tag/admins/federated-access/token-reference.md @@ -6,9 +6,9 @@ > The claims, issuer, signing keys, lifetime, and subject format of the identity token Claude Tag presents to a gateway, cloud provider, or authorization server. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. When Claude calls a system you connected through Federated agent access, it proves who it is with a signed identity token instead of a stored credential. The token is a JSON Web Token (JWT) that names your organization and the agent making the request. A gateway you run receives it in the `Authorization: Bearer` header and verifies it directly. AWS, Google Cloud, or your authorization server receives it in a token exchange and returns one of its own credentials. @@ -105,7 +105,9 @@ Anthropic sends the token only to the destinations you connect in **Federated ag Authorize on `sub`, as described under [Authorize on the subject](#authorize-on-the-subject). A gateway or authorization server, which can read every claim, can use `tenant` and `agent_id` instead, because they repeat the subject's two parts. An AWS trust policy matches on `sub` and `aud` only; a Google Cloud attribute condition can read `sub` or `tenant`. The token carries no claim that names the person behind the request, and no `groups`, `roles`, or `scope` claims. A rule that needs `slack_workspace_id` or `slack_channel_id` should refuse a token that lacks them. -Anthropic may add claims to the token. A verifier must ignore claims it doesn't recognize and must never depend on a claim not listed here being present. +> [!NOTE] +> +> Anthropic may add claims to the token. A verifier must ignore claims it doesn't recognize and must never depend on a claim not listed here being present. ### Example payload diff --git a/content/claude/claude-tag/admins/federated-access/troubleshooting.md b/content/claude/claude-tag/admins/federated-access/troubleshooting.md index 762322e3b3..86f11a26aa 100644 --- a/content/claude/claude-tag/admins/federated-access/troubleshooting.md +++ b/content/claude/claude-tag/admins/federated-access/troubleshooting.md @@ -6,11 +6,13 @@ > Errors from Claude Tag's federated agent access and what fixes each: console dialog messages, requests Claude reports as blocked or failed, and rejections your gateway, AWS, Google Cloud, or authorization server records. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. - - -Federated connections are managed on the [**Federated agent access**](https://claude.ai/admin-settings/claude-tag/federated-cloud-access) page, under **Claude Tag** in the admin settings sidebar. Changing them needs an organization Owner, or an admin with full Claude Tag management permission. +> [!NOTE] +> +> Federated connections are managed on the [**Federated agent access**](https://claude.ai/admin-settings/claude-tag/federated-cloud-access) page, under **Claude Tag** in the admin settings sidebar. Changing them needs an organization Owner, or an admin with full Claude Tag management permission. This page covers what goes wrong after you connect a gateway, AWS role, Google Cloud identity, or authorization server through **Federated agent access**. It's organized by where the problem shows up: a message in a console dialog, an error Claude reports in the thread, or a rejection in your own logs. The token terms used below are explained on the [identity token reference](/docs/claude-tag/admins/federated-access/token-reference). diff --git a/content/claude/claude-tag/admins/for-slack-admins.md b/content/claude/claude-tag/admins/for-slack-admins.md index 6562f3ffe2..d5c3d1abe6 100644 --- a/content/claude/claude-tag/admins/for-slack-admins.md +++ b/content/claude/claude-tag/admins/for-slack-admins.md @@ -6,9 +6,9 @@ > What the Claude app reads and posts in Slack, the OAuth scopes it requests, and what installing it does not grant. Written for the Slack admin approving the install. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. You're approving the Claude app install for someone who's setting up Claude Tag. This page covers what the app can do in your Slack workspace. The rest of setup happens on their side, in the Claude console; you don't need a Claude account. diff --git a/content/claude/claude-tag/admins/healthcare.md b/content/claude/claude-tag/admins/healthcare.md index 30cd988abe..4ca1c7122d 100644 --- a/content/claude/claude-tag/admins/healthcare.md +++ b/content/claude/claude-tag/admins/healthcare.md @@ -6,9 +6,9 @@ > Claude Tag is not covered by Anthropic's Business Associate Agreement. Configure it so protected health information never reaches a channel, direct message, or tool Claude can read: limit Claude to approved channels, turn off direct messages, and connect only PHI-free tools. Also covers what to do if PHI is posted where Claude can read it. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Claude Tag, the Claude app that works in your Slack channels, is not covered by Anthropic's Business Associate Agreement (BAA). A healthcare organization can use it for work that doesn't involve protected health information (PHI) by configuring it so that PHI never enters a channel, direct message, or connected tool that Claude can read. @@ -46,27 +46,25 @@ Ask your account team about creating a separate Claude organization without thos An Owner turns Claude off everywhere by default, turns it on only in channels approved as PHI-free, turns off direct messages, and blocks channel names that signal PHI. Every setting in these steps is at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), and the workspace and channel settings are on the **Channels** tab under **Claude's access**. - - - Go to [**Claude's access > Channels > Slack**](https://claude.ai/admin-settings/claude-tag/channels/slack) and turn off the **Respond in all channels** switch at the top of the **General** tab. [Limit Claude Tag to specific channels](/docs/claude-tag/admins/restrict-access#limit-claude-tag-to-specific-channels) has the full procedure. - +**1. Turn Claude off by default** + +Go to [**Claude's access > Channels > Slack**](https://claude.ai/admin-settings/claude-tag/channels/slack) and turn off the **Respond in all channels** switch at the top of the **General** tab. [Limit Claude Tag to specific channels](/docs/claude-tag/admins/restrict-access#limit-claude-tag-to-specific-channels) has the full procedure. + +**2. Reset workspaces and channels that have their own setting** + +A workspace's or channel's own **Enable Claude Tag** setting takes precedence over the **Slack** page, so a workspace or channel switched on during an earlier pilot keeps Claude active there. On the **Channels** tab, open each workspace's and channel's page that has its own setting, and click the **Use inherited setting** link under its switch. + +**3. Turn Claude on in each approved channel** + +On the **Channels** tab, open the approved channel's page and turn on its **Enable Claude Tag in this channel** switch. If the channel isn't listed on the **Channels** tab, [set it up](/docs/claude-tag/admins/attach-to-scope#attach-to-a-channel) first. - - A workspace's or channel's own **Enable Claude Tag** setting takes precedence over the **Slack** page, so a workspace or channel switched on during an earlier pilot keeps Claude active there. On the **Channels** tab, open each workspace's and channel's page that has its own setting, and click the **Use inherited setting** link under its switch. - +**4. Turn off direct messages** - - On the **Channels** tab, open the approved channel's page and turn on its **Enable Claude Tag in this channel** switch. If the channel isn't listed on the **Channels** tab, [set it up](/docs/claude-tag/admins/attach-to-scope#attach-to-a-channel) first. - +On the same [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag) page, select **Edit** on the **Direct messages** row and turn off the [**Allow direct messages** toggle](/docs/claude-tag/admins/restrict-access#allow-or-disable-direct-messages). Claude is then reachable only in channels. - - On the same [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag) page, select **Edit** on the **Direct messages** row and turn off the [**Allow direct messages** toggle](/docs/claude-tag/admins/restrict-access#allow-or-disable-direct-messages). Claude is then reachable only in channels. - +**5. Block channel names that signal PHI** - - Go to [**Claude's access > Channels > Slack**](https://claude.ai/admin-settings/claude-tag/channels/slack), open the **Advanced** tab, and under **Channels** add the naming patterns your workspace uses for clinical or patient channels to **Blocked channel patterns**, for example `*-patient-*`. Claude won't read or respond in a matching channel even if someone invites it. See [Block or auto-join channels by name](/docs/claude-tag/admins/restrict-access#block-or-auto-join-channels-by-name). - - +Go to [**Claude's access > Channels > Slack**](https://claude.ai/admin-settings/claude-tag/channels/slack), open the **Advanced** tab, and under **Channels** add the naming patterns your workspace uses for clinical or patient channels to **Blocked channel patterns**, for example `*-patient-*`. Claude won't read or respond in a matching channel even if someone invites it. See [Block or auto-join channels by name](/docs/claude-tag/admins/restrict-access#block-or-auto-join-channels-by-name). Any member of the workspace can still invite `@Claude` to a channel that isn't approved. Claude stays silent there, and an @-mention gets a notice that Claude is disabled in that channel instead of a reply. diff --git a/content/claude/claude-tag/admins/managed-by.md b/content/claude/claude-tag/admins/managed-by.md index 67915cd2b2..5dbfe2df0b 100644 --- a/content/claude/claude-tag/admins/managed-by.md +++ b/content/claude/claude-tag/admins/managed-by.md @@ -6,9 +6,9 @@ > Managed by lets a central team write a Slack channel's standing Claude instructions from its own channel. Covers setup, the Confirm card, and limits. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. **Managed by** is a channel setting that names other Slack channels whose members can write that channel's standing instructions for Claude. The channel that carries the setting is the managed channel, and each channel it names is a managing channel. People in a managing channel ask Claude to set or update the managed channel's instructions and confirm the change on a card, and Claude follows that text in every new conversation in the managed channel. This page is for admins who set up the pairing and for the people in a managing channel who write the instructions. @@ -45,19 +45,17 @@ A managed channel can have up to five managing channels. A private managed chann ## Choose the managing channels - - - In the channel whose instructions will be managed, select the **Configure** link in the footer of any Claude reply, or send [`@Claude !configure`](/docs/claude-tag/users/commands#get-the-link-to-configure-a-channel) and follow the link Claude posts. Go to the **Admin** tab. - +**1. Open the managed channel's Configure page** + +In the channel whose instructions will be managed, select the **Configure** link in the footer of any Claude reply, or send [`@Claude !configure`](/docs/claude-tag/users/commands#get-the-link-to-configure-a-channel) and follow the link Claude posts. Go to the **Admin** tab. + +**2. Select channels under Managed by** + +Open the **Managed by** list and select up to five channels. The list shows channels that you and Claude are both in. It finds them through the Slack account connected to your Claude account, and it asks you to connect one if you haven't. The selection saves when you close the list. - - Open the **Managed by** list and select up to five channels. The list shows channels that you and Claude are both in. It finds them through the Slack account connected to your Claude account, and it asks you to connect one if you haven't. The selection saves when you close the list. - +**3. Tell the managing channel** - - Nothing is posted in the managing channel when you add it. Claude learns about the pairing at the start of a conversation, so ask people there to start a new thread before they make the first change, and point them to [Write or update managed instructions](#write-or-update-managed-instructions). - - +Nothing is posted in the managing channel when you add it. Claude learns about the pairing at the start of a conversation, so ask people there to start a new thread before they make the first change, and point them to [Write or update managed instructions](#write-or-update-managed-instructions). To stop a channel managing another, clear it from the same list. Removing a channel works even when the pairing no longer meets the requirements. @@ -65,25 +63,23 @@ To stop a channel managing another, clear it from the same list. Removing a chan A managing channel is a Slack channel that an Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access#delegate-claude-tag-administration) selected under **Managed by** on another channel's Configure page. Any full member of the workspace who is in a managing channel can ask Claude there to change the managed channel's instructions. Guests and people from other organizations can't. - - - Mention Claude, name the managed channel, and say what the instructions should be. +**1. Ask Claude in the managing channel** + +Mention Claude, name the managed channel, and say what the instructions should be. + +```text wrap theme={null} +@Claude set the instructions for #it-help to: Answer from the IT handbook first. For laptop requests, link the hardware form. If someone reports a security problem, tell them to page the on-call and stop. +``` - ```text wrap theme={null} - @Claude set the instructions for #it-help to: Answer from the IT handbook first. For laptop requests, link the hardware form. If someone reports a security problem, tell them to page the on-call and stop. - ``` +Claude reads the managed channel's current text, then posts a card in the managing channel that shows every line the change adds or removes. - Claude reads the managed channel's current text, then posts a card in the managing channel that shows every line the change adds or removes. - +**2. Confirm the card** - - Any full member of the managing channel can select **Confirm**. Nothing changes until someone selects it. **Cancel** drops the proposal. - +Any full member of the managing channel can select **Confirm**. Nothing changes until someone selects it. **Cancel** drops the proposal. - - Start a new thread in the managed channel and ask Claude to repeat its admin instructions. The text you confirmed appears after your workspace's instructions and before the channel's own. You need to be a member of the managed channel to check. - - +**3. Check the result** + +Start a new thread in the managed channel and ask Claude to repeat its admin instructions. The text you confirmed appears after your workspace's instructions and before the channel's own. You need to be a member of the managed channel to check. To add long material as a [reference file](#how-managed-instructions-load), give the file a short name made of lowercase letters, digits, hyphens, or underscores. @@ -105,35 +101,33 @@ A managing channel is a Slack channel that an Owner or a [Claude Tag admin](/doc Claude proposes the correction as a change to the managed channel's instructions. After you confirm, Claude follows the new text in [conversations that start afterward](#how-managed-instructions-load) in the managed channel. While a guest is present in a managed channel that runs with [channel-only access](/docs/claude-tag/admins/restrict-access#how-channel-only-works), Claude doesn't load managed instructions. - - - Skip this step if the managed channel already has a private managing channel that you're in. Otherwise, create a private channel in Slack and run `/invite @Claude` in it. Then an Owner or a Claude Tag admin who is a member of the private channel selects it, following [Choose the managing channels](#choose-the-managing-channels). If you're that person, you and Claude can be the private channel's only members. +**1. Set up a private managing channel** + +Skip this step if the managed channel already has a private managing channel that you're in. Otherwise, create a private channel in Slack and run `/invite @Claude` in it. Then an Owner or a Claude Tag admin who is a member of the private channel selects it, following [Choose the managing channels](#choose-the-managing-channels). If you're that person, you and Claude can be the private channel's only members. + +To open the Configure page without posting in the managed channel, select the **Configure** link in the footer of a Claude reply there. + +**2. Ask Claude in the private managing channel** - To open the Configure page without posting in the managed channel, select the **Configure** link in the footer of a Claude reply there. - +Start a new thread, mention Claude, tell it which thread it got wrong, and say what it should do next time. - - Start a new thread, mention Claude, tell it which thread it got wrong, and say what it should do next time. +* **Public managed channel:** paste the thread's link. Claude can read the linked thread as long as the managing channel has no guests. If it has guests, describe what happened. +* **Private managed channel:** describe what happened, because Claude reads a private channel's threads only from inside that channel + +```text wrap theme={null} +@Claude in this #it-help thread you told someone to email IT about a new laptop: https://example.slack.com/archives/C0123456789/p1700000000000000 +Add a rule to the instructions for #it-help that laptop requests get a link to the hardware form. +``` - * **Public managed channel:** paste the thread's link. Claude can read the linked thread as long as the managing channel has no guests. If it has guests, describe what happened. - * **Private managed channel:** describe what happened, because Claude reads a private channel's threads only from inside that channel +Claude reads any thread you linked and the managed channel's current text, then posts a card in the managing channel that shows every line the change adds or removes. - ```text wrap theme={null} - @Claude in this #it-help thread you told someone to email IT about a new laptop: https://example.slack.com/archives/C0123456789/p1700000000000000 - Add a rule to the instructions for #it-help that laptop requests get a link to the hardware form. - ``` +**3. Confirm the card** - Claude reads any thread you linked and the managed channel's current text, then posts a card in the managing channel that shows every line the change adds or removes. - +Select **Confirm** if the wording is right. To reword it, select **Cancel** and tell Claude what to change. The card expires 30 minutes after Claude posts it. After you confirm, the card says that the managed channel's instructions were updated. - - Select **Confirm** if the wording is right. To reword it, select **Cancel** and tell Claude what to change. The card expires 30 minutes after Claude posts it. After you confirm, the card says that the managed channel's instructions were updated. - +**4. Read the text back** - - In a new message in the managing channel, ask Claude to show the managed channel's instructions. Claude replies there with the current text. - - +In a new message in the managing channel, ask Claude to show the managed channel's instructions. Claude replies there with the current text. People who are in the managed channel and not in the managing channel see only part of a correction. diff --git a/content/claude/claude-tag/admins/migrate-from-earlier.md b/content/claude/claude-tag/admins/migrate-from-earlier.md index 0f6cd0c101..3a7e2962b9 100644 --- a/content/claude/claude-tag/admins/migrate-from-earlier.md +++ b/content/claude/claude-tag/admins/migrate-from-earlier.md @@ -6,39 +6,39 @@ > Claude Tag replaces the earlier per-user Claude in Slack app in place. See what changes, what stays, how the version is chosen per channel, and what existing users notice. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. If your organization already used the earlier Claude in Slack, including [Claude Code in Slack](https://code.claude.com/docs/en/slack), Claude Tag replaces it. Your existing Slack app and `@Claude` handle stay, and no data migrates. What changes is who Claude acts as and who sets it up. -If your Team plan organization has the single [**Respond in channels** switch](/docs/claude-tag/admins/workspaces#turn-claude-tag-on-or-off-on-the-team-plan), it has no **Claude Tag version** controls and there is nothing to migrate. +> [!NOTE] +> +> If your Team plan organization has the single [**Respond in channels** switch](/docs/claude-tag/admins/workspaces#turn-claude-tag-on-or-off-on-the-team-plan), it has no **Claude Tag version** controls and there is nothing to migrate. ## Switch your workspace to Claude Tag - - - Open [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag). If your workspace isn't paired, run [setup](/docs/claude-tag/admins/setup-overview); otherwise you're already on Claude Tag. Once paired, channels and linked-user DMs answer with the New version by default; no per-channel action is needed. - +**1. Connect the workspace in the Claude console** + +Open [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag). If your workspace isn't paired, run [setup](/docs/claude-tag/admins/setup-overview); otherwise you're already on Claude Tag. Once paired, channels and linked-user DMs answer with the New version by default; no per-channel action is needed. + +**2. Check for channels still on Legacy** + +Pairing defaults every workspace and channel to **New**, so this is usually quick. + +1. Go to [**Claude's access > Channels**](https://claude.ai/admin-settings/claude-tag?access=channels). A workspace or channel set to Legacy shows **legacy Claude in Slack** in the **Changes from defaults** column. +2. Open each one, and on its **Advanced** tab set **Claude Tag version** to **New**. +3. The **Slack** row never shows that marker, so also go to [**Claude's access > Channels > Slack**](https://claude.ai/admin-settings/claude-tag/channels/slack) and set **Claude Tag version** on its **Advanced** tab to **New** if it shows **Legacy**. - - Pairing defaults every workspace and channel to **New**, so this is usually quick. +**3. Give Claude its connections** - 1. Go to [**Claude's access > Channels**](https://claude.ai/admin-settings/claude-tag?access=channels). A workspace or channel set to Legacy shows **legacy Claude in Slack** in the **Changes from defaults** column. - 2. Open each one, and on its **Advanced** tab set **Claude Tag version** to **New**. - 3. The **Slack** row never shows that marker, so also go to [**Claude's access > Channels > Slack**](https://claude.ai/admin-settings/claude-tag/channels/slack) and set **Claude Tag version** on its **Advanced** tab to **New** if it shows **Legacy**. - +The New version starts with no access of its own. GitHub repositories and other connections do not carry over from individual users' linked accounts, so code requests in a switched channel have nothing to clone until you configure them. Follow the [setup overview](/docs/claude-tag/admins/setup-overview) to add connections, and [GitHub access](/docs/claude-tag/admins/configure-github) for code work specifically. - - The New version starts with no access of its own. GitHub repositories and other connections do not carry over from individual users' linked accounts, so code requests in a switched channel have nothing to clone until you configure them. Follow the [setup overview](/docs/claude-tag/admins/setup-overview) to add connections, and [GitHub access](/docs/claude-tag/admins/configure-github) for code work specifically. +If your teams keep custom skills in a repository's `.claude/skills/` folder, those skills apply only in threads that have the repository. Add the repository to a [bundle](/docs/claude-tag/concepts/glossary#access-bundle) that applies to the channel, and have users name it in the first message. To give skills to every channel in a workspace or in all of Slack, add them through a [skills repository](/docs/claude-tag/admins/skills-repo). - If your teams keep custom skills in a repository's `.claude/skills/` folder, those skills apply only in threads that have the repository. Add the repository to a [bundle](/docs/claude-tag/concepts/glossary#access-bundle) that applies to the channel, and have users name it in the first message. To give skills to every channel in a workspace or in all of Slack, add them through a [skills repository](/docs/claude-tag/admins/skills-repo). - +**4. Tell your users** - - Send them [Get started](/docs/claude-tag/users/getting-started). The visible change is that work now belongs to the channel; see [What existing users notice after the switch](#what-existing-users-notice-after-the-switch) below. - - +Send them [Get started](/docs/claude-tag/users/getting-started). The visible change is that work now belongs to the channel; see [What existing users notice after the switch](#what-existing-users-notice-after-the-switch) below. **You'll see:** the workspace under **Connected workspaces** on the **Slack** page, **New** as the **Slack** page's **Claude Tag version**, and no row on the **Channels** tab showing **legacy Claude in Slack**. @@ -46,7 +46,9 @@ If your organization already used the earlier Claude in Slack, including [Claude On Enterprise Grid, an earlier install can lose its connection and stop responding in every workspace. See [Claude is silent everywhere on Enterprise Grid](/docs/claude-tag/admins/troubleshooting#claude-is-silent-everywhere-on-enterprise-grid) for the reinstall that refreshes it without uninstalling, then send `@Claude connect` again in a channel of that workspace and [pair the workspace](/docs/claude-tag/admins/setup-overview#pair-your-slack-workspace) with the new code. -Since October 5, 2026, the earlier Claude in Slack app, shown as **Legacy** in admin settings, no longer answers in channels of a workspace paired with your Claude organization. A channel there that's still set to Legacy gets a notice that the legacy bot is retired, until you set **Claude Tag version** to **New** on the channel, or on its workspace if the channel inherits the setting. You also can't switch a workspace or channel to Legacy anymore. Direct messages aren't affected. In a workspace that isn't paired, Pro and Max users still get answers from the earlier app in channels, and anyone else with a connected Claude account gets the [workspace setup notice](/docs/claude-tag/admins/troubleshooting#this-workspace-isn%E2%80%99t-set-up-for-claude-tag-yet) instead. +> [!WARNING] +> +> Since October 5, 2026, the earlier Claude in Slack app, shown as **Legacy** in admin settings, no longer answers in channels of a workspace paired with your Claude organization. A channel there that's still set to Legacy gets a notice that the legacy bot is retired, until you set **Claude Tag version** to **New** on the channel, or on its workspace if the channel inherits the setting. You also can't switch a workspace or channel to Legacy anymore. Direct messages aren't affected. In a workspace that isn't paired, Pro and Max users still get answers from the earlier app in channels, and anyone else with a connected Claude account gets the [workspace setup notice](/docs/claude-tag/admins/troubleshooting#this-workspace-isn%E2%80%99t-set-up-for-claude-tag-yet) instead. ## What stays the same diff --git a/content/claude/claude-tag/admins/network-requirements.md b/content/claude/claude-tag/admins/network-requirements.md index 355245f5ba..e1ebb67958 100644 --- a/content/claude/claude-tag/admins/network-requirements.md +++ b/content/claude/claude-tag/admins/network-requirements.md @@ -6,9 +6,9 @@ > Claude Tag reaches your services from a published egress range, over HTTP and HTTPS only. See the IP block to allowlist and how the allowlist relates to the allowed-websites setting on a connection. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. If a service you want to connect (a data warehouse, an internal API, a GitHub organization with an IP allow list) restricts access by source IP, add Anthropic's egress range to its allowlist. Hand this page to the team that manages it. @@ -24,11 +24,15 @@ The authoritative list is [Anthropic's published IP addresses](https://platform. The range is shared across Anthropic services, and dedicated per-organization egress addresses aren't available, so the allowlist entry admits Anthropic's infrastructure as a whole. Your credential's [allowed websites](/docs/claude-tag/admins/add-connections#set-allowed-websites) are what scope which of *your* systems Claude can call. -If your Google Cloud project uses VPC Service Controls, an IP-based access level doesn't admit Claude's queries through the [BigQuery connection](/docs/claude-tag/admins/connections/bigquery). See [Allow the connection through a VPC Service Controls perimeter](/docs/claude-tag/admins/connections/bigquery#allow-the-connection-through-a-vpc-service-controls-perimeter) on the BigQuery page. +> [!NOTE] +> +> If your Google Cloud project uses VPC Service Controls, an IP-based access level doesn't admit Claude's queries through the [BigQuery connection](/docs/claude-tag/admins/connections/bigquery). See [Allow the connection through a VPC Service Controls perimeter](/docs/claude-tag/admins/connections/bigquery#allow-the-connection-through-a-vpc-service-controls-perimeter) on the BigQuery page. ## Internet reachability -A connected service must accept traffic from the internet (restricted by IP allowlist if you like). A service reachable only inside your private network can't be connected; private networking such as PrivateLink or VPC peering is not supported. +> [!WARNING] +> +> A connected service must accept traffic from the internet (restricted by IP allowlist if you like). A service reachable only inside your private network can't be connected; private networking such as PrivateLink or VPC peering is not supported. In an Anthropic-hosted environment, every request from a channel's sandbox to your service passes through [Agent Proxy](/docs/claude-tag/concepts/agent-identity#agent-proxy), which carries HTTP and HTTPS only. A service reachable only over another protocol, such as SSH or a database's native wire protocol, can't be connected; put an HTTP API in front of it instead. diff --git a/content/claude/claude-tag/admins/restrict-access.md b/content/claude/claude-tag/admins/restrict-access.md index e9e361362d..4e6cc07eba 100644 --- a/content/claude/claude-tag/admins/restrict-access.md +++ b/content/claude/claude-tag/admins/restrict-access.md @@ -6,20 +6,20 @@ > Claude Tag responds only where it has been added and addressed. See who can invoke it, what changes in guest and Slack Connect channels, the per-scope version setting, how to limit it to chosen channels, how to delegate administration or a channel's setup, and how to quiet or remove it. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. In channels, Claude Tag responds only where it's been added and addressed, and the controls on this page narrow that further. One-to-one DMs are a separate surface. A DM from a member who has connected a Claude account runs on that member's own account; see [how DMs differ from channels](/docs/claude-tag/concepts/agent-identity#direct-message-channels). A [DM from a member who hasn't](#direct-messages-from-members-without-a-claude-account) can bill to your organization. In a [group DM](#group-dms), the work bills to your organization. -Most controls on this page require the Owner role in your Claude organization; the [permissions table](#permissions-by-role) lists which actions a channel manager or a channel member can take. On the Enterprise plan, an Owner can delegate many of these controls through the [**Claude Tag Admin** permission](#delegate-claude-tag-administration). +> [!NOTE] +> +> Most controls on this page require the Owner role in your Claude organization; the [permissions table](#permissions-by-role) lists which actions a channel manager or a channel member can take. On the Enterprise plan, an Owner can delegate many of these controls through the [**Claude Tag Admin** permission](#delegate-claude-tag-administration). ## Control who can invoke Claude Tag In channels where the app has been added, an @-mention guarantees a response; Claude may also respond to a message that doesn't mention it when it judges a reply is warranted, and once a thread is active it follows replies in that thread. By default, anyone in such a channel can address it. A single toggle narrows that to people in your Claude organization. - - ### Restrict who can use Claude Go to [**Claude's access > Channels > Slack**](https://claude.ai/admin-settings/claude-tag/channels/slack) and open the **Advanced** tab. Under **Access**, a toggle controls who in your Slack workspace can use Claude at all; its label depends on your plan. You must be an Owner of your Claude organization to change it. @@ -31,9 +31,9 @@ Go to [**Claude's access > Channels > Slack**](https://claude.ai/admin-settings/ The toggle applies to channels and DMs alike. While the toggle is off, a [DM from a member who hasn't connected a Claude account](#direct-messages-from-members-without-a-claude-account) can bill to your organization. - - You may see the earlier three-option **Members** dropdown instead of the toggle. The **Access** group keeps the dropdown while your organization's stored choice matches neither toggle state. That happens for an Enterprise organization that previously chose **Open to any organization member** (now marked deprecated), and for a Team organization still restricted by role from an earlier Enterprise plan. Switch to one of the toggle's two states. The dropdown is then replaced by the toggle, and the deprecated option is no longer offered. - +> [!NOTE] +> +> You may see the earlier three-option **Members** dropdown instead of the toggle. The **Access** group keeps the dropdown while your organization's stored choice matches neither toggle state. That happens for an Enterprise organization that previously chose **Open to any organization member** (now marked deprecated), and for a Team organization still restricted by role from an earlier Enterprise plan. Switch to one of the toggle's two states. The dropdown is then replaced by the toggle, and the deprecated option is no longer offered. #### Restrict by role on Enterprise @@ -65,7 +65,9 @@ On Enterprise plans, if your organization belongs to a parent enterprise organiz When the toggle is on, a Slack user whose profile email isn't on one of the enterprise's verified domains can't link a Claude account to this organization; the sign-in is refused. -Turning this on in any one organization also stops Slack users on a verified domain from linking a Claude account to any organization outside the enterprise. +> [!WARNING] +> +> Turning this on in any one organization also stops Slack users on a verified domain from linking a Claude account to any organization outside the enterprise. ## Control where Claude Tag operates @@ -105,23 +107,23 @@ To let Claude respond only in channels you choose, for example during a pilot co These steps need the per-scope switches. If the **Slack** page shows [**Respond in channels**](/docs/claude-tag/admins/workspaces#turn-claude-tag-on-or-off-on-the-team-plan) instead, you can't limit Claude this way. Use [blocked channel patterns](#block-or-auto-join-channels-by-name) to keep it out of specific channels. -Turning Claude off in a scope silences the earlier Claude in Slack there too. +> [!NOTE] +> +> Turning Claude off in a scope silences the earlier Claude in Slack there too. + +**1. Turn Claude Tag off in every channel** + +Go to [**Claude's access > Channels > Slack**](https://claude.ai/admin-settings/claude-tag/channels/slack) and turn off the **Respond in all channels** switch at the top of the **General** tab. - - - Go to [**Claude's access > Channels > Slack**](https://claude.ai/admin-settings/claude-tag/channels/slack) and turn off the **Respond in all channels** switch at the top of the **General** tab. - +**2. Reset the scopes that override it** - - Open each workspace's or channel's page that has its own setting. Its switch shows **Set for this workspace** or **Set for this channel** underneath. Click the **Use inherited setting** link beside that line. The scope then follows the off state on the **Slack** page. - +Open each workspace's or channel's page that has its own setting. Its switch shows **Set for this workspace** or **Set for this channel** underneath. Click the **Use inherited setting** link beside that line. The scope then follows the off state on the **Slack** page. - - On the **Channels** tab, find the channel with the search field; channels Claude was added to are already listed. If it isn't listed, set it up as described in [Attach to a channel](/docs/claude-tag/admins/attach-to-scope#attach-to-a-channel). Open the channel's page and turn on the **Enable Claude Tag in this channel** switch at the top of its **General** tab. +**3. Switch each chosen channel back on** - A channel's own setting wins over the off setting above it, so Claude responds in the chosen channels and nowhere else. - - +On the **Channels** tab, find the channel with the search field; channels Claude was added to are already listed. If it isn't listed, set it up as described in [Attach to a channel](/docs/claude-tag/admins/attach-to-scope#attach-to-a-channel). Open the channel's page and turn on the **Enable Claude Tag in this channel** switch at the top of its **General** tab. + +A channel's own setting wins over the off setting above it, so Claude responds in the chosen channels and nowhere else. If someone invites the app into another channel afterward, Claude stays silent there. Mentioning `@Claude` in that channel gets a notice that Claude is disabled in the channel, not a reply. In a Slack Connect channel, Claude posts no notice. @@ -218,8 +220,6 @@ A value on a channel or workspace replaces the value it would inherit, in either Neither value adds private channels to workspace search. In a [channel that includes a guest](#restrict-guest-channels), workspace search is unavailable whichever value applies. - - ### Slack Connect channels A Slack Connect channel is a channel your Slack workspace shares with another company. The [**How should Claude work in channels with guests**](#restrict-guest-channels) setting, the same one that governs channels that include guests, decides whether Claude answers in one: @@ -244,7 +244,9 @@ Claude answers in a Slack Connect channel where [**How should Claude work in cha When a bundle applies there, Claude can use the bundle's connectors for anyone it answers in the channel, including the other company's people. -Treat the channel's instructions, and the connectors in its bundles, as available to the other company. Before you turn Claude on in a Slack Connect channel, or share a channel where it's already on, open the channel's page under [**Claude's access > Channels**](https://claude.ai/admin-settings/claude-tag?access=channels), check its bundles, and [remove the channel from any bundle](/docs/claude-tag/admins/attach-to-scope#choose-where-a-bundle-applies) you don't want used there. +> [!WARNING] +> +> Treat the channel's instructions, and the connectors in its bundles, as available to the other company. Before you turn Claude on in a Slack Connect channel, or share a channel where it's already on, open the channel's page under [**Claude's access > Channels**](https://claude.ai/admin-settings/claude-tag?access=channels), check its bundles, and [remove the channel from any bundle](/docs/claude-tag/admins/attach-to-scope#choose-where-a-bundle-applies) you don't want used there. When it answers there, Claude also has: @@ -411,27 +413,25 @@ Some actions stay outside the permission: ### Give a member the Claude Tag Admin permission - - - Go to [**Organization settings > Roles**](https://claude.ai/admin-settings/roles), select **Add role**, and give the role a name. - +**1. Create a role** + +Go to [**Organization settings > Roles**](https://claude.ai/admin-settings/roles), select **Add role**, and give the role a name. - - On the role's **Admin permissions** tab, set **Claude Tag Admin**, under **Product admin**, to **Can manage**. Changing the member's role type to **Custom** takes them off the built-in Admin role, so if the member is an Admin today, also set **User Management** to **Can manage** and **Analytics** to **Can view**, both under **Organization admin**. Leave the **Capabilities** and **Connectors** tabs as they are, then select **Save**. - +**2. Grant the permission** - - A custom role applies to the members of the groups it's assigned to. Go to [**Organization settings > Groups**](https://claude.ai/admin-settings/groups) and select **Add group**. Name the group and pick the new role under **Roles**. Add the member under **Members**, then select **Add group**. To use a group the member is already in, open the role on the [**Roles** page](https://claude.ai/admin-settings/roles) instead and add that group on its **Details** tab. - +On the role's **Admin permissions** tab, set **Claude Tag Admin**, under **Product admin**, to **Can manage**. Changing the member's role type to **Custom** takes them off the built-in Admin role, so if the member is an Admin today, also set **User Management** to **Can manage** and **Analytics** to **Can view**, both under **Organization admin**. Leave the **Capabilities** and **Connectors** tabs as they are, then select **Save**. - - On the [**Members** page](https://claude.ai/admin-settings/members), change the member's role to **Custom**. Custom roles apply only to members whose role type is **Custom**. If member roles are managed through your identity provider, make the change in the identity provider instead. - +**3. Assign the role through a group** - - The member can now open **Claude Tag** under **Products** in **Organization settings**. If it isn't listed for them yet, have them refresh the page. - - +A custom role applies to the members of the groups it's assigned to. Go to [**Organization settings > Groups**](https://claude.ai/admin-settings/groups) and select **Add group**. Name the group and pick the new role under **Roles**. Add the member under **Members**, then select **Add group**. To use a group the member is already in, open the role on the [**Roles** page](https://claude.ai/admin-settings/roles) instead and add that group on its **Details** tab. + +**4. Change the member's role to Custom** + +On the [**Members** page](https://claude.ai/admin-settings/members), change the member's role to **Custom**. Custom roles apply only to members whose role type is **Custom**. If member roles are managed through your identity provider, make the change in the identity provider instead. + +**5. Confirm the member's access** + +The member can now open **Claude Tag** under **Products** in **Organization settings**. If it isn't listed for them yet, have them refresh the page. ## Delegate channel setup to channel managers @@ -463,23 +463,21 @@ Channel managers see their assigned channels at [`claude.ai/admin-settings/claud Channel managers are built on [custom roles](https://claude.ai/admin-settings/roles). When you add the first manager to a channel, you create a custom role for it, named **Channel managers** plus the channel's name and ID, with the **Claude Tag channel setup** permission. A custom role works only for members on the **Custom roles** access level, so the last step below checks each manager's level. - - - Go to [**Claude's access > Channels**](https://claude.ai/admin-settings/claude-tag?access=channels) and open the channel's page. The channel must be a public or private channel. If it isn't listed, [add Claude to the channel](/docs/claude-tag/users/getting-started#add-claude-to-a-channel) in Slack first. - +**1. Open the channel's page** + +Go to [**Claude's access > Channels**](https://claude.ai/admin-settings/claude-tag?access=channels) and open the channel's page. The channel must be a public or private channel. If it isn't listed, [add Claude to the channel](/docs/claude-tag/users/getting-started#add-claude-to-a-channel) in Slack first. + +**2. Add people or a group** + +In the page's header, select **Add managers**. Search for people and groups, and select each one to add. People you add join the channel's default group. A group you pick comes from [`claude.ai/admin-settings/groups`](https://claude.ai/admin-settings/groups), and the same group can manage several channels. - - In the page's header, select **Add managers**. Search for people and groups, and select each one to add. People you add join the channel's default group. A group you pick comes from [`claude.ai/admin-settings/groups`](https://claude.ai/admin-settings/groups), and the same group can manage several channels. - +**3. Check each manager's access level** - - When you add a member on the User or Claude Code user level, you move them to the **Custom roles** level in the same step; if they already hold other custom roles, you confirm the move first. For a member on any other level, you see **Not in effect** until you change their level on the Members page. Adding a group changes nobody's level. +When you add a member on the User or Claude Code user level, you move them to the **Custom roles** level in the same step; if they already hold other custom roles, you confirm the move first. For a member on any other level, you see **Not in effect** until you change their level on the Members page. Adding a group changes nobody's level. - If you're a Claude Tag admin, the move also needs **User Management** set to **Can manage** on your role. Without it, the member is still added but shows **Not in effect** until their access level is changed on the Members page. +If you're a Claude Tag admin, the move also needs **User Management** set to **Can manage** on your role. Without it, the member is still added but shows **Not in effect** until their access level is changed on the Members page. - If your identity provider manages access levels, you can't change a level on the Members page, and the move doesn't happen. Put the channel managers in an identity provider group and map that group to the **Custom roles** level instead. If you turn on identity provider management after adding channel managers, the next sync sets every member's level from your group mappings, so managers you moved by hand show **Not in effect** until a mapped group covers them. The role and its group are kept; you don't need to add the managers again. - - +If your identity provider manages access levels, you can't change a level on the Members page, and the move doesn't happen. Put the channel managers in an identity provider group and map that group to the **Custom roles** level instead. If you turn on identity provider management after adding channel managers, the next sync sets every member's level from your group mappings, so managers you moved by hand show **Not in effect** until a mapped group covers them. The role and its group are kept; you don't need to add the managers again. Owners can already configure every channel, so you see them as **Already has full access** and can't add them. diff --git a/content/claude/claude-tag/admins/set-spend-limit.md b/content/claude/claude-tag/admins/set-spend-limit.md index d160b27b14..42caecaa18 100644 --- a/content/claude/claude-tag/admins/set-spend-limit.md +++ b/content/claude/claude-tag/admins/set-spend-limit.md @@ -6,9 +6,9 @@ > Claude Tag channel work bills to your organization's usage balance. Set the spend limit and see what happens when it's reached. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Work Claude does in channels and group DMs bills to your **organization's usage balance**, not to individual seats. The **spend limit** is a cap you set on how much of that balance Claude Tag can use each month. @@ -35,15 +35,13 @@ Slack users can work with Claude in channels [without holding a Claude seat](/do Not every organization sees this page. A trial organization that hasn't enabled usage billing, a single-seat Team plan, an organization with a hybrid desktop deployment, or an admin whose role can't view billing is redirected to personal usage settings instead. If your organization bills through a reseller, the page is not available and these steps don't apply; your organization's usage is funded through the reseller instead. - - - Go to [`claude.ai/admin-settings/usage/claude-tag`](https://claude.ai/admin-settings/usage/claude-tag). - +**1. Open the usage page** + +Go to [`claude.ai/admin-settings/usage/claude-tag`](https://claude.ai/admin-settings/usage/claude-tag). + +**2. Enter an amount** - - Enter an amount in your organization's billing currency. The spend limit resets at the start of each month and applies across every paired workspace. You can change it any time. - - +Enter an amount in your organization's billing currency. The spend limit resets at the start of each month and applies across every paired workspace. You can change it any time. There's no published per-task cost guidance. For a pilot, set a spend limit you're comfortable with for the first month, then watch the per-channel usage breakdown on the same page and adjust. If a promotional credit covers the pilot's usage, that breakdown shows \$0.00. In that case, watch the **List price** column of the **Spend by channel** table at [`claude.ai/analytics/claude-tag`](https://claude.ai/analytics/claude-tag) instead. diff --git a/content/claude/claude-tag/admins/setup-oncall.md b/content/claude/claude-tag/admins/setup-oncall.md index 1f67884377..507dae1f7a 100644 --- a/content/claude/claude-tag/admins/setup-oncall.md +++ b/content/claude/claude-tag/admins/setup-oncall.md @@ -6,9 +6,9 @@ > Put Claude on call for incident response in Slack: run setup at claude.ai/oncall, pick or auto-join incident channels, cap spend, and deploy. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Claude Tag on-call puts Claude on call with your team for incident response in Slack. Claude watches your monitoring tools and posts what it finds, or joins your incident channels and investigates alongside your team. Your team keeps its own on-call rotation, and Claude works alongside whoever is on call. You set up on-call for your whole organization at [`claude.ai/oncall`](https://claude.ai/oncall). diff --git a/content/claude/claude-tag/admins/setup-overview.md b/content/claude/claude-tag/admins/setup-overview.md index 4914ce34b8..663e90dc95 100644 --- a/content/claude/claude-tag/admins/setup-overview.md +++ b/content/claude/claude-tag/admins/setup-overview.md @@ -6,9 +6,9 @@ > Set up Claude Tag for your organization: pair your Slack workspace, add Claude to channels, launch, give Claude access to your tools, and check that it works. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Claude Tag is Claude working in your team's Slack channels. Setup connects Claude to your Slack workspace and turns Claude Tag on. Claude gets access to your other tools, like your issue tracker or data warehouse, after setup. Running setup requires the Owner role in a Claude organization on a Team or Enterprise plan. @@ -23,79 +23,79 @@ If you leave after pairing a workspace, click **Resume setup** to continue from When you've launched, [give Claude access to your tools](#give-claude-access-to-your-tools) and [verify your setup](#verify-your-setup). - - | Prerequisite | Why you need it | If you don't have it | - | :- | :- | :- | - | A **Team or Enterprise plan** on claude.ai | Claude Tag is available on Team and Enterprise plans, on Anthropic's first-party service. It isn't available on individual plans (Free, Pro, or Max), or for third-party deployments. | Start a Team or Enterprise plan at [claude.com/pricing](https://claude.com/pricing) | - | A Claude organization **without Zero Data Retention (ZDR), customer-managed encryption (CMEK), or the HIPAA configuration for Claude Code (local mode) and Cowork (local mode)** | Claude Tag stores channel memory and session transcripts, which ZDR doesn't permit. A CMEK policy and the HIPAA configuration don't allow Claude Tag either. | Claude Tag isn't available to organizations with any of these. See [Healthcare organizations](/docs/claude-tag/admins/healthcare#plan-and-organization-requirements) | - | **Routines** enabled for your Claude organization | Until it is, Claude answers every mention and DM with a reply that it's unavailable and does no work. | An admin turns on [**Admin settings > Capabilities > Remote sessions > Routines**](https://claude.ai/admin-settings/capabilities) | - | **Owner** role in the Claude organization you're setting up | Setup pairs a workspace and turns Claude Tag on, and only an Owner can do either. Roles are per organization, so being an Owner elsewhere doesn't carry over. | Ask an Owner to run setup, or have one promote you at [`claude.ai/admin-settings/members`](https://claude.ai/admin-settings/members) | - | A **Slack workspace admin** | Running `@Claude connect` requires a Slack workspace admin; installing the app usually does too. | If that's someone else, [send them the install request](#if-you-re-not-the-slack-workspace-admin) early (app approval can take time), and plan to be online together when you pair; pairing codes expire 15 minutes after they're issued | - | **Usage credits** (Team plans) | Channel work draws from your organization's usage balance; on a Team plan nothing runs until credits are loaded. | Buy credits at [`claude.ai/admin-settings/usage`](https://claude.ai/admin-settings/usage) | - | A **public channel** for Claude to join | The launch step asks you to select at least one public channel, and you can [verify your setup](#verify-your-setup) there. | Create a public Slack channel for the pilot, or pick any existing one | +> **Before you start: check that you have what setup needs** +> +> | Prerequisite | Why you need it | If you don't have it | +> | :- | :- | :- | +> | A **Team or Enterprise plan** on claude.ai | Claude Tag is available on Team and Enterprise plans, on Anthropic's first-party service. It isn't available on individual plans (Free, Pro, or Max), or for third-party deployments. | Start a Team or Enterprise plan at [claude.com/pricing](https://claude.com/pricing) | +> | A Claude organization **without Zero Data Retention (ZDR), customer-managed encryption (CMEK), or the HIPAA configuration for Claude Code (local mode) and Cowork (local mode)** | Claude Tag stores channel memory and session transcripts, which ZDR doesn't permit. A CMEK policy and the HIPAA configuration don't allow Claude Tag either. | Claude Tag isn't available to organizations with any of these. See [Healthcare organizations](/docs/claude-tag/admins/healthcare#plan-and-organization-requirements) | +> | **Routines** enabled for your Claude organization | Until it is, Claude answers every mention and DM with a reply that it's unavailable and does no work. | An admin turns on [**Admin settings > Capabilities > Remote sessions > Routines**](https://claude.ai/admin-settings/capabilities) | +> | **Owner** role in the Claude organization you're setting up | Setup pairs a workspace and turns Claude Tag on, and only an Owner can do either. Roles are per organization, so being an Owner elsewhere doesn't carry over. | Ask an Owner to run setup, or have one promote you at [`claude.ai/admin-settings/members`](https://claude.ai/admin-settings/members) | +> | A **Slack workspace admin** | Running `@Claude connect` requires a Slack workspace admin; installing the app usually does too. | If that's someone else, [send them the install request](#if-you-re-not-the-slack-workspace-admin) early (app approval can take time), and plan to be online together when you pair; pairing codes expire 15 minutes after they're issued | +> | **Usage credits** (Team plans) | Channel work draws from your organization's usage balance; on a Team plan nothing runs until credits are loaded. | Buy credits at [`claude.ai/admin-settings/usage`](https://claude.ai/admin-settings/usage) | +> | A **public channel** for Claude to join | The launch step asks you to select at least one public channel, and you can [verify your setup](#verify-your-setup) there. | Create a public Slack channel for the pilot, or pick any existing one | +> +> If any of your services restrict traffic by IP, file the [network requirements](/docs/claude-tag/admins/network-requirements) request with your network team early; in many organizations, IP allowlist changes take days to approve. +> +> If you see **View setup guide** and **Go to chat** buttons instead of **Start setup**, your signed-in account can't run setup. See [Common setup issues](#common-setup-issues). + +> [!NOTE] +> +> If your team already uses the earlier Claude in Slack, the same steps apply and your existing app stays; see [Migrate from the earlier app](/docs/claude-tag/admins/migrate-from-earlier) for what changes. - If any of your services restrict traffic by IP, file the [network requirements](/docs/claude-tag/admins/network-requirements) request with your network team early; in many organizations, IP allowlist changes take days to approve. +## Pair your Slack workspace - If you see **View setup guide** and **Go to chat** buttons instead of **Start setup**, your signed-in account can't run setup. See [Common setup issues](#common-setup-issues). - +Install the Claude app in Slack, get a pairing code from Slack, and paste it on the setup page. -If your team already uses the earlier Claude in Slack, the same steps apply and your existing app stays; see [Migrate from the earlier app](/docs/claude-tag/admins/migrate-from-earlier) for what changes. +**1. Add the Claude app to Slack** -## Pair your Slack workspace +**Where:** the Slack Marketplace, at [claude.com/claude-for-slack](https://claude.com/claude-for-slack). -Install the Claude app in Slack, get a pairing code from Slack, and paste it on the setup page. +Click **Add the Claude app** on the setup page to open the listing, then click **Add to Slack** and approve the permissions. If the app is already installed, click **Add to Slack** anyway: you reinstall over the existing app with its current permissions and keep your settings. + +On Slack Enterprise Grid, installing takes two Slack actions. See [Set up Claude Tag on Enterprise Grid](/docs/claude-tag/admins/workspaces#set-up-claude-tag-on-enterprise-grid) for the steps. - - - **Where:** the Slack Marketplace, at [claude.com/claude-for-slack](https://claude.com/claude-for-slack). +**2. Send @Claude connect in any channel** - Click **Add the Claude app** on the setup page to open the listing, then click **Add to Slack** and approve the permissions. If the app is already installed, click **Add to Slack** anyway: you reinstall over the existing app with its current permissions and keep your settings. +**Where:** Slack, in the workspace you just installed the app in. - On Slack Enterprise Grid, installing takes two Slack actions. See [Set up Claude Tag on Enterprise Grid](/docs/claude-tag/admins/workspaces#set-up-claude-tag-on-enterprise-grid) for the steps. - +Open any channel and add Claude to it with `/invite @Claude`. Claude posts a short welcome message when it joins. Then send `@Claude connect` as a new message with no other text. Claude replies in the channel with a message only you can see, containing the pairing code: - - **Where:** Slack, in the workspace you just installed the app in. +> Connect **this workspace** (Acme) to your Claude organization for billing: have a Claude **organization admin** redeem this code in Claude admin settings. The code works once and expires in 15 minutes. +> +> `workspace_a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6` +> +> *Once connected, Claude usage in this workspace is billed to that organization.* - Open any channel and add Claude to it with `/invite @Claude`. Claude posts a short welcome message when it joins. Then send `@Claude connect` as a new message with no other text. Claude replies in the channel with a message only you can see, containing the pairing code: +Only a Slack workspace admin (or Grid org admin) can run this command; anyone else gets a message naming who to ask. - > Connect **this workspace** (Acme) to your Claude organization for billing: have a Claude **organization admin** redeem this code in Claude admin settings. The code works once and expires in 15 minutes. - > - > `workspace_a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6` - > - > *Once connected, Claude usage in this workspace is billed to that organization.* +If you skip the invite, Slack shows you a notice that Claude isn't in the channel, with an **Add Them** button. Click it, then send `@Claude connect` again. - Only a Slack workspace admin (or Grid org admin) can run this command; anyone else gets a message naming who to ask. +**3. Paste the pairing code** - If you skip the invite, Slack shows you a notice that Claude isn't in the channel, with an **Add Them** button. Click it, then send `@Claude connect` again. - +**Where:** the Claude Tag setup page at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag). - - **Where:** the Claude Tag setup page at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag). +Paste the pairing code Claude sent into the **Paste the pairing code** field. **Connected to** followed by your workspace name appears under it when the code is accepted. - Paste the pairing code Claude sent into the **Paste the pairing code** field. **Connected to** followed by your workspace name appears under it when the code is accepted. - +**4. Click Pair workspace** - - The setup page continues to the next step that applies to your organization. - - +The setup page continues to the next step that applies to your organization. Pairing covers the whole workspace. Claude doesn't answer mentions in Slack until you finish [Launch Claude Tag](#launch-claude-tag). A mention before then gets a notice that starts "Claude isn't on in this channel yet." After launch, people can tag Claude in any channel it has joined. To keep Claude to certain channels, see [Limit Claude Tag to specific channels](/docs/claude-tag/admins/restrict-access#limit-claude-tag-to-specific-channels). - - Only a Slack workspace admin can run `@Claude connect`, and in most workspaces only an admin can install the app. If that's not you, send the Slack admin the message below and have them return the pairing code: - - ```text wrap theme={null} - Please install the Claude app (https://claude.com/claude-for-slack) in [workspace]. When that's done, let me know a time that works for the next part: in any channel, run /invite @Claude, then post "@Claude connect" with no other text and send me the code it returns. Pick a channel that belongs to just [workspace]. The code expires 15 minutes after Claude posts it, so I'll redeem it right away. What it can access: https://claude.com/docs/claude-tag/admins/for-slack-admins - ``` - +> **If you're not the Slack workspace admin** +> +> Only a Slack workspace admin can run `@Claude connect`, and in most workspaces only an admin can install the app. If that's not you, send the Slack admin the message below and have them return the pairing code: +> +> ```text wrap theme={null} +> Please install the Claude app (https://claude.com/claude-for-slack) in [workspace]. When that's done, let me know a time that works for the next part: in any channel, run /invite @Claude, then post "@Claude connect" with no other text and send me the code it returns. Pick a channel that belongs to just [workspace]. The code expires 15 minutes after Claude posts it, so I'll redeem it right away. What it can access: https://claude.com/docs/claude-tag/admins/for-slack-admins +> ``` - - When a Slack Org Owner or Org Admin sends `@Claude connect`, the reply includes two codes. One begins `workspace_` and pairs only the workspace the admin sent the command in, and one begins `enterprise_` and pairs the whole Grid. Paste the `enterprise_` code. See [Pair an Enterprise Grid](/docs/claude-tag/admins/workspaces#pair-an-enterprise-grid). - +> **If your Slack is on Enterprise Grid** +> +> When a Slack Org Owner or Org Admin sends `@Claude connect`, the reply includes two codes. One begins `workspace_` and pairs only the workspace the admin sent the command in, and one begins `enterprise_` and pairs the whole Grid. Paste the `enterprise_` code. See [Pair an Enterprise Grid](/docs/claude-tag/admins/workspaces#pair-an-enterprise-grid). ## Buy usage credits @@ -116,34 +116,32 @@ The spend limit caps how much of your organization's usage balance Claude Tag ca * **Channel work**: draws from that balance, not from individual seats * **Direct messages (DMs)**: One-to-one DMs from members who have connected a Claude account run on the member's own claude.ai account and aren't capped by this limit. For members who haven't connected one, see [Direct messages from members without a Claude account](/docs/claude-tag/admins/restrict-access#direct-messages-from-members-without-a-claude-account). - - - If setup included the [**Buy usage credits**](#buy-usage-credits) step, the launch step has no spend limit picker. Set a limit after launch at [`claude.ai/admin-settings/usage/claude-tag`](https://claude.ai/admin-settings/usage/claude-tag). +**1. Set monthly spend limits** - Otherwise, choose from `$500`, `$1,000`, `$2,500`, `$5,000`, **Unlimited**, or **Custom** (a US-dollar amount up to `$1,000,000`). `$2,500` is preselected unless your organization already has a Claude Tag spend limit. Usage bills against your organization's balance up to that amount each month. See [Set a spend limit](/docs/claude-tag/admins/set-spend-limit) for what counts toward the cap, per-channel limits, and what users see when it's reached. - +If setup included the [**Buy usage credits**](#buy-usage-credits) step, the launch step has no spend limit picker. Set a limit after launch at [`claude.ai/admin-settings/usage/claude-tag`](https://claude.ai/admin-settings/usage/claude-tag). - - Choose which channels Claude joins when you launch. +Otherwise, choose from `$500`, `$1,000`, `$2,500`, `$5,000`, **Unlimited**, or **Custom** (a US-dollar amount up to `$1,000,000`). `$2,500` is preselected unless your organization already has a Claude Tag spend limit. Usage bills against your organization's balance up to that amount each month. See [Set a spend limit](/docs/claude-tag/admins/set-spend-limit) for what counts toward the cap, per-channel limits, and what users see when it's reached. - * **If the launch step lists public channels from the workspace you paired**: select at least one. **Launch Claude Tag** stays unavailable until you do. Claude joins the channels you selected when you launch, so people can tag it there right away. - * **If the launch step shows no channel list**: launch, then run `/invite @Claude` in a channel in Slack. +**2. Add Claude to your channels** - To add Claude to a private channel, or to more channels later, run `/invite @Claude` in that channel. - +Choose which channels Claude joins when you launch. - - If you paired a whole Enterprise Grid, skip this step. The launch step doesn't show the toggle, launching doesn't send the DMs, and the admin page has no row for them. +* **If the launch step lists public channels from the workspace you paired**: select at least one. **Launch Claude Tag** stays unavailable until you do. Claude joins the channels you selected when you launch, so people can tag it there right away. +* **If the launch step shows no channel list**: launch, then run `/invite @Claude` in a channel in Slack. - Otherwise, the **Let members know they can now tag Claude** toggle is on by default. After launch, Claude DMs each member of the workspace to help them get started. Those DMs don't count toward your usage. Turn the toggle off to skip them. +To add Claude to a private channel, or to more channels later, run `/invite @Claude` in that channel. - The admin page has a matching row, **Let people know they can talk to Claude**. To send the DMs from the admin page, select **Notify members now** on that row and confirm. The row reads **Members notified** once the DMs have gone out. - +**3. Let members know they can now tag Claude** - - Claude Tag turns on. From here on, Claude answers mentions in the workspace you paired. The setup page shows **You're set**. Click **Done** to open the Claude Tag admin page. - - +If you paired a whole Enterprise Grid, skip this step. The launch step doesn't show the toggle, launching doesn't send the DMs, and the admin page has no row for them. + +Otherwise, the **Let members know they can now tag Claude** toggle is on by default. After launch, Claude DMs each member of the workspace to help them get started. Those DMs don't count toward your usage. Turn the toggle off to skip them. + +The admin page has a matching row, **Let people know they can talk to Claude**. To send the DMs from the admin page, select **Notify members now** on that row and confirm. The row reads **Members notified** once the DMs have gone out. + +**4. Click Launch Claude Tag** + +Claude Tag turns on. From here on, Claude answers mentions in the workspace you paired. The setup page shows **You're set**. Click **Done** to open the Claude Tag admin page. To stop before launching, leave the setup page. Your pairing is saved, and your choices on the launch step aren't. @@ -170,27 +168,25 @@ In each tool other than GitHub, Claude works through an account of its own, so y Work through one tool end to end before starting the next. - - - In your company's email admin console, create a new user for Claude with any address, for example `claude@yourcompany.example.com`, the same way you'd create a mailbox for a new hire. Every tool invitation and verification email for Claude lands in that inbox. - +**1. Create an email address for Claude** + +In your company's email admin console, create a new user for Claude with any address, for example `claude@yourcompany.example.com`, the same way you'd create a mailbox for a new hire. Every tool invitation and verification email for Claude lands in that inbox. + +**2. Add Claude to the tool as a member** + +In the tool's member or user settings, invite `claude@yourcompany.example.com` the way you'd add a new teammate. Open the invitation from Claude's inbox and finish creating the account, including a password. Give the account the narrowest role that covers the work, read-only where the tool offers it. + +For a tool that offers service accounts, create one in the tool's admin settings instead of inviting the email address, scoped read-only or to the specific project. - - In the tool's member or user settings, invite `claude@yourcompany.example.com` the way you'd add a new teammate. Open the invitation from Claude's inbox and finish creating the account, including a password. Give the account the narrowest role that covers the work, read-only where the tool offers it. +**3. Create an API key in Claude's account** - For a tool that offers service accounts, create one in the tool's admin settings instead of inviting the email address, scoped read-only or to the specific project. - +Sign in to the tool as Claude and create the credential that tool's [connection guide](/docs/claude-tag/admins/connections/overview) names, usually an API key or personal access token from the tool's settings. Copy it. The credential belongs to Claude's account, so Claude's actions show up in the tool's audit log under Claude's name. - - Sign in to the tool as Claude and create the credential that tool's [connection guide](/docs/claude-tag/admins/connections/overview) names, usually an API key or personal access token from the tool's settings. Copy it. The credential belongs to Claude's account, so Claude's actions show up in the tool's audit log under Claude's name. - +**4. Add the key as a connector** - - Go to [**Organization settings > Claude Tag**](https://claude.ai/admin-settings/claude-tag). Under **Claude's access**, select the **Connectors** tab and click **Add**. Then [add a connector](/docs/claude-tag/admins/add-connections#add-a-connection) for the tool and paste the key you created. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](/docs/claude-tag/admins/add-connections#add-a-connection) before you save the connector. +Go to [**Organization settings > Claude Tag**](https://claude.ai/admin-settings/claude-tag). Under **Claude's access**, select the **Connectors** tab and click **Add**. Then [add a connector](/docs/claude-tag/admins/add-connections#add-a-connection) for the tool and paste the key you created. The first credential you add for a service from the **Connectors** tab is on in every workspace and channel as soon as you save it. To give it narrower reach, see [where a new connector applies](/docs/claude-tag/admins/add-connections#add-a-connection) before you save the connector. - For the next tool, start again from **Add Claude to the tool as a member**. Claude keeps the one email address for every tool. - - +For the next tool, start again from **Add Claude to the tool as a member**. Claude keeps the one email address for every tool. See [Give Claude access](/docs/claude-tag/admins/add-connections) for which services to connect first and what access to give each account, and the [per-service connection guides](/docs/claude-tag/admins/connections/overview) for the credential fields per tool. diff --git a/content/claude/claude-tag/admins/skills-repo.md b/content/claude/claude-tag/admins/skills-repo.md index 0b73da90cc..d9bfd1f40b 100644 --- a/content/claude/claude-tag/admins/skills-repo.md +++ b/content/claude/claude-tag/admins/skills-repo.md @@ -6,9 +6,9 @@ > Put your org's Claude Tag skills in a git repository with auto-sync, grant Claude write access, and Claude can open pull requests to improve its own skills from what it learns in channels. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. A **skill** is a set of instructions that teaches Claude how to use a specific tool or follow a specific process (for example, which Datadog endpoints answer which questions, or your org's incident-response runbook). Claude Tag uses the same [skills format as Claude Code](https://code.claude.com/docs/en/skills). A **plugin** bundles one or more skills together. @@ -16,25 +16,23 @@ You can upload skills one at a time in the console, but putting them in a git re ## Set up the skills repository - - - A private or internal GitHub repository, laid out as a [Claude Code plugin marketplace](https://code.claude.com/docs/en/plugin-marketplaces): a `.claude-plugin/marketplace.json` file at the root that lists each plugin, and one folder per plugin. Each plugin bundles one or more skills. A public repository can't be selected in the next step; fork it into a private one first. - +**1. Create the repository** + +A private or internal GitHub repository, laid out as a [Claude Code plugin marketplace](https://code.claude.com/docs/en/plugin-marketplaces): a `.claude-plugin/marketplace.json` file at the root that lists each plugin, and one folder per plugin. Each plugin bundles one or more skills. A public repository can't be selected in the next step; fork it into a private one first. + +**2. Register the repository as a plugin marketplace** + +For a github.com repository, the GitHub connector must be enabled for your organization. In [**Organization settings > Plugins & skills**](https://claude.ai/admin-settings/skills?tab=inventory), click **Add** and choose **Sync from GitHub**. Select the repository, leave **Sync automatically** on (the default), and click **Create**. + +When you click **Create**, and on every sync after that, the whole repository is downloaded as one archive, and the archive can't be larger than 512 MiB. A repository over that size, such as a large monorepo, is rejected with `Download too large (>536.9MB)` even when the plugins in it are small. Put the plugins in a smaller dedicated repository, or [upload the plugin as a zip file](#upload-a-plugin-as-a-zip-file) instead. - - For a github.com repository, the GitHub connector must be enabled for your organization. In [**Organization settings > Plugins & skills**](https://claude.ai/admin-settings/skills?tab=inventory), click **Add** and choose **Sync from GitHub**. Select the repository, leave **Sync automatically** on (the default), and click **Create**. +**3. Grant Claude write access to the repository** - When you click **Create**, and on every sync after that, the whole repository is downloaded as one archive, and the archive can't be larger than 512 MiB. A repository over that size, such as a large monorepo, is rejected with `Download too large (>536.9MB)` even when the plugins in it are small. Put the plugins in a smaller dedicated repository, or [upload the plugin as a zip file](#upload-a-plugin-as-a-zip-file) instead. - +At [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), open a [bundle](/docs/claude-tag/admins/add-connections) on the **Bundles** tab under **Claude's access**. In its **What's in it** section, select **Add**, then **Repository**, and pick the repository. The Claude GitHub App must already be linked to your GitHub organization; see [Configure GitHub access](/docs/claude-tag/admins/configure-github). - - At [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), open a [bundle](/docs/claude-tag/admins/add-connections) on the **Bundles** tab under **Claude's access**. In its **What's in it** section, select **Add**, then **Repository**, and pick the repository. The Claude GitHub App must already be linked to your GitHub organization; see [Configure GitHub access](/docs/claude-tag/admins/configure-github). - +**4. Add the plugins to the bundle** - - On the same bundle's page, select **Add**, then **Plugin**, and pick each plugin from your new marketplace. A plugin isn't in the bundle until you add it, and the bundle's plugins apply wherever the bundle applies; see [Choose where a bundle applies](/docs/claude-tag/admins/attach-to-scope#attach-the-bundle) and [Attach plugins](/docs/claude-tag/admins/add-connections#attach-plugins). - - +On the same bundle's page, select **Add**, then **Plugin**, and pick each plugin from your new marketplace. A plugin isn't in the bundle until you add it, and the bundle's plugins apply wherever the bundle applies; see [Choose where a bundle applies](/docs/claude-tag/admins/attach-to-scope#attach-the-bundle) and [Attach plugins](/docs/claude-tag/admins/add-connections#attach-plugins). **You'll see:** the repository and the plugins appear in the bundle's **What's in it** table, with **Repository** or **Plugin** as each row's type. diff --git a/content/claude/claude-tag/admins/troubleshooting.md b/content/claude/claude-tag/admins/troubleshooting.md index d4fc71ca79..b8e7f1ea59 100644 --- a/content/claude/claude-tag/admins/troubleshooting.md +++ b/content/claude/claude-tag/admins/troubleshooting.md @@ -6,13 +6,15 @@ > Error messages from Claude Tag setup and what fixes each. Covers permission mismatches, GitHub access gaps, session start failures, and account errors. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. This page covers errors you might hit setting up and administering Claude Tag: Slack app permissions, guest and shared channels, console errors, channels and threads where nothing responds, access and connections, and session starts. -For problems people can resolve on their own in a channel, like a missing reply or a thread that lost its work, see [Troubleshoot Claude Tag in channels and DMs](/docs/claude-tag/users/troubleshooting). +> [!NOTE] +> +> For problems people can resolve on their own in a channel, like a missing reply or a thread that lost its work, see [Troubleshoot Claude Tag in channels and DMs](/docs/claude-tag/users/troubleshooting). If someone reports that Claude can't reach a service you connected, check two things before anything else: @@ -342,9 +344,9 @@ A Slack workspace can pair with only one Claude organization at a time, and this 2. Have an Owner in that organization [disconnect the workspace](/docs/claude-tag/admins/workspaces#revoke-a-pairing) under **Connected workspaces** on their **Slack** page. 3. Send `@Claude connect` again for a fresh code and redeem it here. - - Disconnecting deletes the workspace's Claude data, including its memory, channel configurations, sessions, and the routines set up in its channels. The deletion can't be undone. See [Data lifecycle and deletion](/docs/claude-tag/concepts/data-lifecycle) for the full list of what's deleted. - +> [!WARNING] +> +> Disconnecting deletes the workspace's Claude data, including its memory, channel configurations, sessions, and the routines set up in its channels. The deletion can't be undone. See [Data lifecycle and deletion](/docs/claude-tag/concepts/data-lifecycle) for the full list of what's deleted. ### This workspace is connected to a different Claude organization @@ -375,8 +377,6 @@ Connect a Claude account that belongs to the organization your Slack workspace i 3. Select **Connect Claude account**. 4. Sign in with an account from the paired organization. - - ### Claim code is invalid, expired, or already used **What you see** @@ -416,7 +416,9 @@ Without either notice, the session behind that thread is stuck: it hasn't replie Have someone in the thread send [`@Claude !restart`](/docs/claude-tag/users/commands#restart-a-stuck-or-wrong-context-session). The command archives the stuck session and starts a fresh one that rereads the thread, so a follow-up message in the same thread gets an answer. Starting a new thread and restating the request also works. -Restarting abandons whatever the session was midway through, and there's no way to resume it. A silent session may still be working through a long task, so treat `!restart` as a last resort. +> [!WARNING] +> +> Restarting abandons whatever the session was midway through, and there's no way to resume it. A silent session may still be working through a long task, so treat `!restart` as a last resort. If the same request stalls again on the fresh session, send [feedback](/docs/claude-tag/users/commands#send-feedback) from that thread so Anthropic can investigate. @@ -542,9 +544,9 @@ If the switch can't be turned on, start at step 2. When the workspace is already 2. If the message persists, check which Claude organization the workspace is paired to. If your company has more than one (a trial organization alongside the main one, for example), an Owner in the wrong organization can [revoke the pairing](/docs/claude-tag/admins/workspaces#revoke-a-pairing) so you can pair the workspace to the right one. 3. If the right organization has the switch on and the message persists, contact your account team to confirm Claude Tag is enabled for it. - - Revoking the pairing deletes the workspace's Claude data, including its memory, channel configurations, sessions, and the routines set up in its channels. The deletion can't be undone. See [Data lifecycle and deletion](/docs/claude-tag/concepts/data-lifecycle) for the full list of what's deleted. - +> [!WARNING] +> +> Revoking the pairing deletes the workspace's Claude data, including its memory, channel configurations, sessions, and the routines set up in its channels. The deletion can't be undone. See [Data lifecycle and deletion](/docs/claude-tag/concepts/data-lifecycle) for the full list of what's deleted. ### Claude Tag is unavailable because Routines are not enabled diff --git a/content/claude/claude-tag/admins/workspaces.md b/content/claude/claude-tag/admins/workspaces.md index 4cbb08f5c3..b0e898231b 100644 --- a/content/claude/claude-tag/admins/workspaces.md +++ b/content/claude/claude-tag/admins/workspaces.md @@ -6,9 +6,9 @@ > Connect more Slack workspaces or an Enterprise Grid to Claude Tag, choose which Claude Tag version each channel uses, and disconnect a workspace. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. This page covers managing Slack workspace pairings after initial setup: adding more workspaces, installing the app and pairing across a Slack Enterprise Grid, choosing which Claude Tag version each one runs, turning Claude on or off on the Team plan, and disconnecting a workspace. @@ -24,23 +24,23 @@ To move a pairing to a different Claude organization, an Owner in the organizati If your company has more than one Claude organization (a subsidiary with its own, for example), agree on which one holds the pairing before connecting. - - - Go to [**Claude's access > Channels > Slack**](https://claude.ai/admin-settings/claude-tag/channels/slack). On the **General** tab, under **Connected workspaces**, click **Connect new**. - +**1. Open the pairing dialog** + +Go to [**Claude's access > Channels > Slack**](https://claude.ai/admin-settings/claude-tag/channels/slack). On the **General** tab, under **Connected workspaces**, click **Connect new**. + +**2. Get a pairing code from Slack** - - In any channel of the new workspace, send `@Claude connect` with no other text, as a new top-level message or in a thread where Claude isn't already working, then paste the code Claude sends you into the dialog. +In any channel of the new workspace, send `@Claude connect` with no other text, as a new top-level message or in a thread where Claude isn't already working, then paste the code Claude sends you into the dialog. - Pick a channel that belongs to just the new workspace. Claude can decline to reply in [guest and shared channels](/docs/claude-tag/admins/troubleshooting#guest-and-shared-channels). - +Pick a channel that belongs to just the new workspace. Claude can decline to reply in [guest and shared channels](/docs/claude-tag/admins/troubleshooting#guest-and-shared-channels). - - Once the code is accepted, click **Next**, work through the dialog's remaining steps, and click **Launch Claude** on the last one. - - +**3. Finish the dialog and launch** -If your organization used the earlier Claude in Slack app, the new workspace is added alongside your existing one, not in place of it. +Once the code is accepted, click **Next**, work through the dialog's remaining steps, and click **Launch Claude** on the last one. + +> [!NOTE] +> +> If your organization used the earlier Claude in Slack app, the new workspace is added alongside your existing one, not in place of it. **You'll see:** the new workspace in the **Connected workspaces** list with the status **Active**, and as a row on the **Channels** tab. @@ -50,21 +50,19 @@ On Slack Enterprise Grid, installing the Claude app takes two Slack actions inst ### Install the app across the Grid - - - As a Slack Org Owner or Org Admin, sign in to one of the Grid's workspaces rather than the Slack organization admin dashboard. Slack offers **Install to entire organization** only when you start from inside a workspace. - +**1. Sign in to a workspace in the Grid** + +As a Slack Org Owner or Org Admin, sign in to one of the Grid's workspaces rather than the Slack organization admin dashboard. Slack offers **Install to entire organization** only when you start from inside a workspace. - - On the [Claude for Slack](https://claude.com/claude-for-slack) listing, select **Add to Slack > Install to entire organization**. +**2. Install to the entire organization** - If some workspaces in the Grid already installed the app on their own, leave those installations in place and choose **Install to entire organization** anyway. Don't uninstall first, because uninstalling the app from a workspace [deletes that workspace's Claude data](/docs/claude-tag/concepts/data-lifecycle#actions-in-slack). - +On the [Claude for Slack](https://claude.com/claude-for-slack) listing, select **Add to Slack > Install to entire organization**. - - From the Slack organization admin dashboard, add the Claude app to each workspace where people will use Claude. Each workspace still needs the app added before people there can invite and mention `@Claude`. - - +If some workspaces in the Grid already installed the app on their own, leave those installations in place and choose **Install to entire organization** anyway. Don't uninstall first, because uninstalling the app from a workspace [deletes that workspace's Claude data](/docs/claude-tag/concepts/data-lifecycle#actions-in-slack). + +**3. Add the app to each workspace** + +From the Slack organization admin dashboard, add the Claude app to each workspace where people will use Claude. Each workspace still needs the app added before people there can invite and mention `@Claude`. ### Pair an Enterprise Grid @@ -75,7 +73,9 @@ Paste the `enterprise_` code in one of these places: * **During setup:** paste the code into the **Paste the pairing code** field on the [setup page](/docs/claude-tag/admins/setup-overview#pair-your-slack-workspace) * **After setup:** click **Connect new** under **Connected workspaces** on the **Slack** page, as in [Pair another workspace](#pair-another-workspace), and paste the code into the dialog. If a workspace you've already paired belongs to a Grid you haven't paired, the list also has an **Enterprise Grid** row with the status **Not connected**, and **Connect** on that row opens the same dialog. -Leave the workspaces you've already paired connected while you pair the Grid. They stay paired and keep their Claude data. +> [!NOTE] +> +> Leave the workspaces you've already paired connected while you pair the Grid. They stay paired and keep their Claude data. **You'll see:** the Grid in the **Connected workspaces** list with **Enterprise Grid** and **Active** in the **Status** column. @@ -160,17 +160,17 @@ Go to [**Claude's access > Channels > Slack**](https://claude.ai/admin-settings/ Claude stops responding in that workspace's channels immediately, and your organization is no longer billed for Claude usage there. One-to-one direct messages from members who have connected a Claude account run on the member's own account, so they keep working until the deletion below removes the member's account link. A member who reconnects their account afterward can use direct messages again while the app stays installed. - - When you disconnect a workspace, Anthropic deletes its Claude data: - - * The workspace's sessions and their transcripts, including members' direct-message conversations with Claude in that workspace - * Its channel, workspace, and direct-message memory - * The routines set up in its channels, and the artifacts published from them - * Its scopes, with their instructions and bundle bindings - * The links between members' Slack and Claude accounts - - Deletion starts as soon as you confirm and runs to completion in the background. This can't be undone. Routines a person set up in a one-to-one direct message with Claude belong to that person's account and keep running. - +> [!WARNING] +> +> When you disconnect a workspace, Anthropic deletes its Claude data: +> +> * The workspace's sessions and their transcripts, including members' direct-message conversations with Claude in that workspace +> * Its channel, workspace, and direct-message memory +> * The routines set up in its channels, and the artifacts published from them +> * Its scopes, with their instructions and bundle bindings +> * The links between members' Slack and Claude accounts +> +> Deletion starts as soon as you confirm and runs to completion in the background. This can't be undone. Routines a person set up in a one-to-one direct message with Claude belong to that person's account and keep running. Bundles belong to your organization, not to a workspace, so they stay available to add to other workspaces and channels; only their bindings to the deleted workspace and its channels go. diff --git a/content/claude/claude-tag/concepts/agent-identity.md b/content/claude/claude-tag/concepts/agent-identity.md index 2709b3cb6a..6d3b0919b5 100644 --- a/content/claude/claude-tag/concepts/agent-identity.md +++ b/content/claude/claude-tag/concepts/agent-identity.md @@ -6,9 +6,9 @@ > Claude Tag acts under its own service accounts in Slack channels, not as you. See how channel access is bounded, how credentials reach it, how Claude uses your personal connectors for your own tasks in a channel, and why DMs differ. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Claude Tag's identity depends on where you message it. @@ -16,9 +16,9 @@ In Slack channels, and in [group DMs](#group-dms) that include Claude, Claude ac In one-to-one direct messages (DMs) between `@Claude` and a user who has connected a Claude account, the session runs on [the individual's own claude.ai account](#direct-message-channels), with their personal connectors. A pull request opened from a DM is authored by the Claude GitHub App, the same as in channels, though the session can only work with repositories connected on that user's own account. An Owner can turn off DMs for the whole organization; see [Allow or disable direct messages](/docs/claude-tag/admins/restrict-access#allow-or-disable-direct-messages). For DMs from users who haven't connected a Claude account, see [Direct messages from members without a Claude account](/docs/claude-tag/admins/restrict-access#direct-messages-from-members-without-a-claude-account). - - How Claude behaves in channels (its standing instructions, plugins, and channel memory) is configured separately from its identity; see [custom instructions](/docs/claude-tag/admins/attach-to-scope#add-custom-instructions), [plugins](/docs/claude-tag/admins/add-connections#attach-plugins), and [memory](/docs/claude-tag/users/memory) for more information. - +> [!NOTE] +> +> How Claude behaves in channels (its standing instructions, plugins, and channel memory) is configured separately from its identity; see [custom instructions](/docs/claude-tag/admins/attach-to-scope#add-custom-instructions), [plugins](/docs/claude-tag/admins/add-connections#attach-plugins), and [memory](/docs/claude-tag/users/memory) for more information. ## Channel sessions @@ -30,31 +30,27 @@ When Claude works on a channel task, the request moves through three places: The diagram below traces one request through this process. -Diagram showing the request path across three zones, labeled your Slack workspace, Anthropic's infrastructure, and your systems. A task mentioned in the Slack workspace runs in a session sandbox in the middle zone, one sandbox per thread, holding no stored credentials. Outbound requests pass to Agent Proxy, which injects the credential drawn from the credential store; a request that no rule, domain entry, or environment network access setting allows is blocked. Credentialed requests reach your systems, like GitHub, a data warehouse, monitoring, or any HTTP API. A dashed return path shows results posting back in the thread, as Claude. +![Diagram showing the request path across three zones, labeled your Slack workspace, Anthropic's infrastructure, and your systems. A task mentioned in the Slack workspace runs in a session sandbox in the middle zone, one sandbox per thread, holding no stored credentials. Outbound requests pass to Agent Proxy, which injects the credential drawn from the credential store; a request that no rule, domain entry, or environment network access setting allows is blocked. Credentialed requests reach your systems, like GitHub, a data warehouse, monitoring, or any HTTP API. A dashed return path shows results posting back in the thread, as Claude.](https://mintcdn.com/claude-ai/lijct3C2aoA3LHFn/images/claude-tag/diagrams/request-path.svg?fit=max\&auto=format\&n=lijct3C2aoA3LHFn\&q=85\&s=10d796e77738a52a505dcab2c9950cda) + +**1. Tag Claude in a channel** + +A user asks Claude to chart last week's signups or fix a deploy test. The task gets a session in a thread under the message. + +**2. The session sandbox starts** -Diagram showing the request path across three zones, labeled your Slack workspace, Anthropic's infrastructure, and your systems. A task mentioned in the Slack workspace runs in a session sandbox in the middle zone, one sandbox per thread, holding no stored credentials. Outbound requests pass to Agent Proxy, which injects the credential drawn from the credential store; a request that no rule, domain entry, or environment network access setting allows is blocked. Credentialed requests reach your systems, like GitHub, a data warehouse, monitoring, or any HTTP API. A dashed return path shows results posting back in the thread, as Claude. +Claude does the work in an isolated environment built for this thread, reading files, writing documents, and running code. The credentials you provision are not placed in the sandbox; they stay in the credential store and are injected at the proxy. - - - A user asks Claude to chart last week's signups or fix a deploy test. The task gets a session in a thread under the message. - +**3. The request crosses Agent Proxy** - - Claude does the work in an isolated environment built for this thread, reading files, writing documents, and running code. The credentials you provision are not placed in the sandbox; they stay in the credential store and are injected at the proxy. - +When the work needs something outside the sandbox, like calling the GitHub API or querying a warehouse, the request crosses Agent Proxy, the network boundary between the sandbox and everything else. Agent Proxy checks it against the rules an admin configured, and decides whether it proceeds and what credential, if any, travels with it. - - When the work needs something outside the sandbox, like calling the GitHub API or querying a warehouse, the request crosses Agent Proxy, the network boundary between the sandbox and everything else. Agent Proxy checks it against the rules an admin configured, and decides whether it proceeds and what credential, if any, travels with it. - +**4. Agent Proxy attaches a credential** - - A matching credential comes from the credential store, which keeps the credentials of the [connectors](/docs/claude-tag/admins/add-connections) an admin added. Once saved, a credential is never displayed again; Agent Proxy retrieves it only at the moment of injection and attaches it to the request at the boundary, so the model and the sandbox itself are not given the key. - +A matching credential comes from the credential store, which keeps the credentials of the [connectors](/docs/claude-tag/admins/add-connections) an admin added. Once saved, a credential is never displayed again; Agent Proxy retrieves it only at the moment of injection and attaches it to the request at the boundary, so the model and the sandbox itself are not given the key. - - The credentialed request reaches your system, like GitHub or the warehouse, and the result returns to the thread. - - +**5. The result posts back, as Claude** + +The credentialed request reaches your system, like GitHub or the warehouse, and the result returns to the thread. ### Agent Proxy @@ -79,8 +75,6 @@ For the endpoints and addresses your network team may need to allowlist, see [Ne A host that none of the three layers above allows is blocked, and Claude names the blocked host in the thread so an admin can add it; see [Give Claude access to your tools](/docs/claude-tag/admins/add-connections). - - ### Web search vs. network requests Claude can search the web from a channel without any Domains entry. Web search is [Anthropic's built-in web search tool](https://platform.claude.com/docs/en/agents-and-tools/tool-use/web-search-tool), which runs on Anthropic's servers, not code running in the channel's sandbox. @@ -114,9 +108,7 @@ A channel session works with the access an admin applied to the channel, so the A one-to-one DM with Claude works differently from a channel. A DM session runs with your own claude.ai account, the same way a Claude Code session on the web does, using your own connectors and credentials, with results attributed to you (pull requests excepted; the Claude GitHub App authors those from DMs too). The diagram contrasts with the channel path above. -Diagram showing how a DM session reaches your systems. A message to Claude in a direct message runs in a session sandbox, in a zone labeled Anthropic's infrastructure, the same engine as a channel session, but it runs with your identity. From there it reaches your systems through your own connectors and accounts, like GitHub or Drive, using your own credentials. A dashed return path shows results posting back in the DM, as you. - -Diagram showing how a DM session reaches your systems. A message to Claude in a direct message runs in a session sandbox, in a zone labeled Anthropic's infrastructure, the same engine as a channel session, but it runs with your identity. From there it reaches your systems through your own connectors and accounts, like GitHub or Drive, using your own credentials. A dashed return path shows results posting back in the DM, as you. +![Diagram showing how a DM session reaches your systems. A message to Claude in a direct message runs in a session sandbox, in a zone labeled Anthropic's infrastructure, the same engine as a channel session, but it runs with your identity. From there it reaches your systems through your own connectors and accounts, like GitHub or Drive, using your own credentials. A dashed return path shows results posting back in the DM, as you.](https://mintcdn.com/claude-ai/5JFKyLlO7sHMMf5J/images/claude-tag/diagrams/dm-identity.svg?fit=max\&auto=format\&n=5JFKyLlO7sHMMf5J\&q=85\&s=d4089034f46e4a760f9fac9d36a689cc) The table lines up the two paths on the four dimensions that differ. diff --git a/content/claude/claude-tag/concepts/data-lifecycle.md b/content/claude/claude-tag/concepts/data-lifecycle.md index 23de0b8c1d..5546edcd9c 100644 --- a/content/claude/claude-tag/concepts/data-lifecycle.md +++ b/content/claude/claude-tag/concepts/data-lifecycle.md @@ -6,9 +6,9 @@ > What Claude Tag stores on Anthropic's side, how long session transcripts and memory are kept, and what disconnecting a workspace, uninstalling the app, deleting a Slack channel, removing a scope, or leaving the organization does to that data. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Claude Tag keeps a record of its work on Anthropic's side, separate from the messages in your Slack workspace. This page is for an Owner or security reviewer who needs to know what that record contains, how long Anthropic keeps it, and which actions in Slack or in your Claude admin settings delete it. For each action, the tables below say what is deleted and whether Claude keeps responding, because the two don't always go together. diff --git a/content/claude/claude-tag/concepts/for-claude-code-users.md b/content/claude/claude-tag/concepts/for-claude-code-users.md index fa676edd4f..7aebf95e99 100644 --- a/content/claude/claude-tag/concepts/for-claude-code-users.md +++ b/content/claude/claude-tag/concepts/for-claude-code-users.md @@ -6,9 +6,9 @@ > Which parts of a Claude Code setup carry into Claude Tag, which move to admin settings, and how Slack threads map to sessions. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Claude Tag runs the same engine as Claude Code. When you tag `@Claude` in Slack with a task, a session starts in a sandbox that your organization configures, not on your machine. That sandbox is the same infrastructure that runs [Claude Code on the web](https://code.claude.com/docs/en/web-quickstart), described in [Compute and the sandbox](/docs/claude-tag/concepts/security-and-data#compute-and-the-sandbox). diff --git a/content/claude/claude-tag/concepts/glossary.md b/content/claude/claude-tag/concepts/glossary.md index 017a2d78c8..2121708c2b 100644 --- a/content/claude/claude-tag/concepts/glossary.md +++ b/content/claude/claude-tag/concepts/glossary.md @@ -6,9 +6,9 @@ > Claude Tag terms defined in one place, including agent identity, bundle, connector, personal connector, scope, Agent Proxy, routine, and session. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. ## Agent identity @@ -18,8 +18,6 @@ The service accounts Claude acts with: the Claude app in Slack, the Claude GitHu The network layer that injects credentials into Claude's outbound requests. The model and the sandbox are not given the key; Agent Proxy adds the credential at the network boundary when a request matches the rules an admin set. See [How agent identity works](/docs/claude-tag/concepts/agent-identity#agent-proxy). - - ## Bundle A named set of connectors, repositories, [allowed domains](/docs/claude-tag/admins/add-connections#add-a-domain), plugins, and instructions that Claude uses for one kind of work, such as support triage. An Owner or a [Claude Tag admin](#claude-tag-admin) creates bundles on the **Bundles** tab under **Claude's access** at [`claude.ai/admin-settings/claude-tag`](https://claude.ai/admin-settings/claude-tag), then adds the places where each one applies: all of Slack, a workspace, or a channel. One bundle can apply in many places, and an Owner can also apply one to every channel whose name matches a pattern. See [Give Claude access](/docs/claude-tag/admins/add-connections). @@ -49,8 +47,6 @@ Claude Tag is the second generation of the Claude app in Slack: Your admin chooses which generation answers `@Claude` in a given channel, so two channels in the same workspace can work differently. See [Migrate from the earlier Claude in Slack](/docs/claude-tag/admins/workspaces#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope). - - ## Connector A service Claude Tag reaches with a credential of its own. An Owner or a [Claude Tag admin](#claude-tag-admin) adds connectors on the **Connectors** tab under **Claude's access**, and each connector holds one or more credentials, such as an API key for the service, that belong to the agent identity rather than to any user. To add a connector and choose where its credentials apply, see [Add a connector](/docs/claude-tag/admins/add-connections#add-a-connection). The [federated access](/docs/claude-tag/admins/federated-access/overview) pages and their console screens say **connection** for a gateway, cloud role, or authorization server Claude reaches with a token instead of a stored key. diff --git a/content/claude/claude-tag/concepts/how-it-works.md b/content/claude/claude-tag/concepts/how-it-works.md index 0ff83a7346..e82ca1be28 100644 --- a/content/claude/claude-tag/concepts/how-it-works.md +++ b/content/claude/claude-tag/concepts/how-it-works.md @@ -6,9 +6,9 @@ > Each Claude Tag thread in Slack runs a working session in a sandbox. See how progress shows in the thread, how to steer mid-task, what survives between turns, and how memory is scoped. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Claude Tag is Claude, working inside your team's Slack channels. An organization Owner gives it its own accounts to the tools your team uses, so it arrives already able to act, and anyone in a channel can tag it into a problem without setting anything up. @@ -27,61 +27,29 @@ This page covers: The thread below is one task end to end in Slack: Jordan tags @Claude into `#launch-week` with a question, a colleague steers mid-thread, and the answer lands in the channel. -
-
- # launch-week - 19 members -
- -
-
- - -
-
Jordan9:02 AM
-

@Claude where are we on launch prep? Pull together what's still open from this channel.

-
-
- -
- - - - -
-
ClaudeAPP9:02 AM
-

On it. I'll go through this channel's open threads and the launch plan.

- -
- Done: Read 14 open threads - Done: Cross-checked the launch plan in Drive - Done: Listed who each item is waiting on - Done: Drafted the status summary -
-
-
- -
- - -
-
Sam9:06 AM
-

fold in the vendor quotes from last week's thread too

-
-
- -
- - - - -
-
ClaudeAPP9:08 AM
-

Done. Full status below: eight items closed, three open. The venue contract is the oldest, waiting on legal since the 2nd.

-
-
-
-
+\# launch-week +19 members + + + +Jordan9:02 AM\@Claude where are we on launch prep? Pull together what's still open from this channel. + +![](https://mintcdn.com/claude-ai/5JFKyLlO7sHMMf5J/images/claude-tag/logo/clay-spark.svg?fit=max\&auto=format\&n=5JFKyLlO7sHMMf5J\&q=85\&s=032101c39ca3b1af9f72fc4af8e60d12) + +ClaudeAPP9:02 AMOn it. I'll go through this channel's open threads and the launch plan. + +Done: Read 14 open threads +Done: Cross-checked the launch plan in Drive +Done: Listed who each item is waiting on +Done: Drafted the status summary + + + +Sam9:06 AMfold in the vendor quotes from last week's thread too + +![](https://mintcdn.com/claude-ai/5JFKyLlO7sHMMf5J/images/claude-tag/logo/clay-spark.svg?fit=max\&auto=format\&n=5JFKyLlO7sHMMf5J\&q=85\&s=032101c39ca3b1af9f72fc4af8e60d12) + +ClaudeAPP9:08 AMDone. Full status below: eight items closed, three open. The venue contract is the oldest, waiting on legal since the 2nd. Each of the five moments in that thread shows a piece of how Claude Tag works: @@ -161,9 +129,7 @@ Every session, in any channel, follows the same five-step loop. 4. **The result lands in the thread.** An answer, a doc, a chart, or a pull request. 5. **A quiet period follows.** The sandbox is released while the thread persists; a new reply rebuilds it and starts the loop again. -Flow diagram of one session in five numbered steps. Step 1, tag Claude in with an @Claude message carrying a task. Steps 2 and 3 happen inside the sandbox. Step 2, a sandbox builds, one per thread; step 3, the working loop runs through the task's steps using the channel's access. Step 4, Claude posts the result in the thread as an answer, a doc, a chart, or a pull request. Step 5, a dashed quiet period follows, where the sandbox is released while the thread persists. A dashed return arrow from the quiet period back up into the sandbox shows that a new reply rebuilds it and the loop continues. - -Flow diagram of one session in five numbered steps. Step 1, tag Claude in with an @Claude message carrying a task. Steps 2 and 3 happen inside the sandbox. Step 2, a sandbox builds, one per thread; step 3, the working loop runs through the task's steps using the channel's access. Step 4, Claude posts the result in the thread as an answer, a doc, a chart, or a pull request. Step 5, a dashed quiet period follows, where the sandbox is released while the thread persists. A dashed return arrow from the quiet period back up into the sandbox shows that a new reply rebuilds it and the loop continues. +![Flow diagram of one session in five numbered steps. Step 1, tag Claude in with an @Claude message carrying a task. Steps 2 and 3 happen inside the sandbox. Step 2, a sandbox builds, one per thread; step 3, the working loop runs through the task's steps using the channel's access. Step 4, Claude posts the result in the thread as an answer, a doc, a chart, or a pull request. Step 5, a dashed quiet period follows, where the sandbox is released while the thread persists. A dashed return arrow from the quiet period back up into the sandbox shows that a new reply rebuilds it and the loop continues.](https://mintcdn.com/claude-ai/5JFKyLlO7sHMMf5J/images/claude-tag/diagrams/session-loop.svg?fit=max\&auto=format\&n=5JFKyLlO7sHMMf5J\&q=85\&s=436dd451c4ab3ab0f0b072f85051e844) Steps 1 and 2 are [starting a session](#start-a-session): a message tags Claude in, and a sandbox builds for that thread. Step 3, the working loop, is [the checklist](#how-the-checklist-updates) below. Steps 4 and 5, the result and the quiet period that follows, are covered in [What survives between replies](#what-survives-between-replies). @@ -257,9 +223,7 @@ A thread is durable, but the sandbox behind it is not. Durable means the thread | Someone sends [`@Claude !restart`](/docs/claude-tag/users/commands#restart-a-stuck-or-wrong-context-session) | Archives the session right away and starts a fresh one that rereads the thread | | The session [gets stuck and fails](/docs/claude-tag/users/troubleshooting#claude-reacted-or-started-thinking-then-never-replied) | Starts the replacement when the next message arrives in the thread | -Timeline with two lanes. The Slack thread lane is one continuous bar that persists from the moment a task starts. The sandbox lane below it is segmented, built when the task starts, released while the thread goes quiet, and rebuilt fresh when someone replies. - -Timeline with two lanes. The Slack thread lane is one continuous bar that persists from the moment a task starts. The sandbox lane below it is segmented, built when the task starts, released while the thread goes quiet, and rebuilt fresh when someone replies. +![Timeline with two lanes. The Slack thread lane is one continuous bar that persists from the moment a task starts. The sandbox lane below it is segmented, built when the task starts, released while the thread goes quiet, and rebuilt fresh when someone replies.](https://mintcdn.com/claude-ai/5JFKyLlO7sHMMf5J/images/claude-tag/diagrams/session-lifecycle.svg?fit=max\&auto=format\&n=5JFKyLlO7sHMMf5J\&q=85\&s=9a56231787b03f179e8d552d887778fc) | | Survives idle periods | | :- | :- | @@ -288,9 +252,7 @@ To see what it holds, ask `@Claude what do you remember about this channel?`. An The whole model so far fits in one picture, with access set at the scope, memory kept per channel, work in progress per thread, and one-to-one DMs outside all of it. -Diagram showing three nested levels. A scope container holds two channels, #platform-eng and #gtm-west, and each channel holds its own threads, like 'fix checkout latency' or 'pull deal state'. The private channel is marked with a lock. Callouts mark what lives at each level (identity and access at the scope, memory at the channel plus workspace notes shared from public channels, and work in progress at the thread). A DM with Claude sits below, outside every scope, and runs on your own account. - -Diagram showing three nested levels. A scope container holds two channels, #platform-eng and #gtm-west, and each channel holds its own threads, like 'fix checkout latency' or 'pull deal state'. The private channel is marked with a lock. Callouts mark what lives at each level (identity and access at the scope, memory at the channel plus workspace notes shared from public channels, and work in progress at the thread). A DM with Claude sits below, outside every scope, and runs on your own account. +![Diagram showing three nested levels. A scope container holds two channels, #platform-eng and #gtm-west, and each channel holds its own threads, like 'fix checkout latency' or 'pull deal state'. The private channel is marked with a lock. Callouts mark what lives at each level (identity and access at the scope, memory at the channel plus workspace notes shared from public channels, and work in progress at the thread). A DM with Claude sits below, outside every scope, and runs on your own account.](https://mintcdn.com/claude-ai/ZNX07pWnPReWiLwB/images/claude-tag/diagrams/three-levels.svg?fit=max\&auto=format\&n=ZNX07pWnPReWiLwB\&q=85\&s=78dfe70e5cf12007485d19baf47b803b) One-to-one DMs are outside this picture; they run on your own account, as covered in [Team channels and personal DMs](#team-channels-and-personal-dms). An Owner can turn off DMs for the whole organization; see [Allow or disable direct messages](/docs/claude-tag/admins/restrict-access#allow-or-disable-direct-messages). diff --git a/content/claude/claude-tag/concepts/personal-connectors.md b/content/claude/claude-tag/concepts/personal-connectors.md index d449d6760c..69917de72d 100644 --- a/content/claude/claude-tag/concepts/personal-connectors.md +++ b/content/claude/claude-tag/concepts/personal-connectors.md @@ -6,9 +6,9 @@ > Claude can use your own claude.ai connectors, called personal connectors, for your tasks in a Slack channel. See how you approve connector use, when Claude asks you to review a result before posting it, and what other people in the channel can reach. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Personal connectors are the tools you add to your own claude.ai account, like your calendar or your email. When a task you ask for in a Slack channel needs one of your own tools, Claude can offer to use your connector for it. diff --git a/content/claude/claude-tag/concepts/security-and-data.md b/content/claude/claude-tag/concepts/security-and-data.md index 0b8c49c511..32ac38451e 100644 --- a/content/claude/claude-tag/concepts/security-and-data.md +++ b/content/claude/claude-tag/concepts/security-and-data.md @@ -6,9 +6,9 @@ > How Claude Tag keeps credentials out of the sandbox, limits where a channel session's requests can go, and controls who can see artifacts and invoke Claude. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. In channels, Claude acts under its own service accounts. By default it can read and post in Slack channels it's been added to and search public channels by keyword; it has no access to your external systems until an Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access#delegate-claude-tag-administration) adds Claude Tag connectors. An admin chooses where each connector applies, from every channel down to one, and the actions Claude takes in connected tools are attributable to its own service accounts. @@ -20,9 +20,7 @@ One-to-one DMs from members who have connected a Claude account run on the membe Each Slack thread runs in its own sandbox. In an Anthropic-hosted environment, every outbound call from that sandbox passes through the same checkpoints. -Diagram showing the request path across three zones, labeled your Slack workspace, Anthropic's infrastructure, and your systems. A task mentioned in the Slack workspace runs in a session sandbox in the middle zone, one sandbox per thread, holding no stored credentials. Outbound requests pass to Agent Proxy, which injects the credential drawn from the credential store; a request that no rule, domain entry, or environment network access setting allows is blocked. Credentialed requests reach your systems, like GitHub, a data warehouse, monitoring, or any HTTP API. A dashed return path shows results posting back in the thread, as Claude. - -Diagram showing the request path across three zones, labeled your Slack workspace, Anthropic's infrastructure, and your systems. A task mentioned in the Slack workspace runs in a session sandbox in the middle zone, one sandbox per thread, holding no stored credentials. Outbound requests pass to Agent Proxy, which injects the credential drawn from the credential store; a request that no rule, domain entry, or environment network access setting allows is blocked. Credentialed requests reach your systems, like GitHub, a data warehouse, monitoring, or any HTTP API. A dashed return path shows results posting back in the thread, as Claude. +![Diagram showing the request path across three zones, labeled your Slack workspace, Anthropic's infrastructure, and your systems. A task mentioned in the Slack workspace runs in a session sandbox in the middle zone, one sandbox per thread, holding no stored credentials. Outbound requests pass to Agent Proxy, which injects the credential drawn from the credential store; a request that no rule, domain entry, or environment network access setting allows is blocked. Credentialed requests reach your systems, like GitHub, a data warehouse, monitoring, or any HTTP API. A dashed return path shows results posting back in the thread, as Claude.](https://mintcdn.com/claude-ai/lijct3C2aoA3LHFn/images/claude-tag/diagrams/request-path.svg?fit=max\&auto=format\&n=lijct3C2aoA3LHFn\&q=85\&s=10d796e77738a52a505dcab2c9950cda) | Checkpoint | The guarantee | | :- | :- | @@ -55,9 +53,7 @@ This means: In an Anthropic-hosted environment, outbound traffic from a channel session's sandbox is default-deny. Requests go only to hosts an allow layer covers, and the layers are a [credential's allowed websites](/docs/claude-tag/admins/connections/custom#fill-out-the-custom-tool-form), the [allowed domains](/docs/claude-tag/admins/add-connections#allow-a-host-without-a-credential) that apply to the channel, and the network access setting of the [environment](/docs/claude-tag/concepts/glossary#environment) the scope's sessions run on. A new environment's default level, Trusted access, already covers a [documented set of package registries and developer hosts](https://code.claude.com/docs/en/cloud-environments#default-allowed-domains). See [Agent Proxy](/docs/claude-tag/concepts/agent-identity#agent-proxy) for what happens to a request under each layer. -Flow diagram across two zones, labeled Anthropic's infrastructure and your systems. In the first zone, a session sandbox that holds no stored credentials sends every outbound request to Agent Proxy, which matches it against admin rules. Three outcomes branch toward your systems: on a rule match, the credential is attached at the boundary and the request proceeds; on an allowlist-only match, from an allowed domain or the environment's network access setting, the request is sent without credentials; on no match, the request is blocked entirely (the default-deny outcome) and the host is unreachable. - -Flow diagram across two zones, labeled Anthropic's infrastructure and your systems. In the first zone, a session sandbox that holds no stored credentials sends every outbound request to Agent Proxy, which matches it against admin rules. Three outcomes branch toward your systems: on a rule match, the credential is attached at the boundary and the request proceeds; on an allowlist-only match, from an allowed domain or the environment's network access setting, the request is sent without credentials; on no match, the request is blocked entirely (the default-deny outcome) and the host is unreachable. +![Flow diagram across two zones, labeled Anthropic's infrastructure and your systems. In the first zone, a session sandbox that holds no stored credentials sends every outbound request to Agent Proxy, which matches it against admin rules. Three outcomes branch toward your systems: on a rule match, the credential is attached at the boundary and the request proceeds; on an allowlist-only match, from an allowed domain or the environment's network access setting, the request is sent without credentials; on no match, the request is blocked entirely (the default-deny outcome) and the host is unreachable.](https://mintcdn.com/claude-ai/f29MqpCRlPctgTn5/images/claude-tag/diagrams/proxy-decision.svg?fit=max\&auto=format\&n=f29MqpCRlPctgTn5\&q=85\&s=f87bc9ca2d2de09e4feda0a60695e9bd) Because requests to any other host are blocked, data can only leave the sandbox to hosts an allow layer covers. An admin sets the allowed websites on each credential and the allowed domains. An admin sets the environment's network access level, which defaults to Trusted access, from the **Cloud environments** page in [admin settings](https://claude.ai/admin-settings). See [Set allowed websites](/docs/claude-tag/admins/add-connections#set-allowed-websites) and [Allow a host without a credential](/docs/claude-tag/admins/add-connections#allow-a-host-without-a-credential). diff --git a/content/claude/claude-tag/concepts/settings-map.md b/content/claude/claude-tag/concepts/settings-map.md index 923d098148..8591823efe 100644 --- a/content/claude/claude-tag/concepts/settings-map.md +++ b/content/claude/claude-tag/concepts/settings-map.md @@ -6,9 +6,9 @@ > Claude Tag settings map: the admin page for access and behavior, the usage page for spend limits, the in-Slack Configure link for channel instructions, and personal connectors for DMs and your own tasks in channels. Claude Managed Agents is configured separately on the Claude Platform. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Claude Tag's settings live on claude.ai, split across a few pages that each own a different kind of setting. Which page you need depends on what you're changing. The table maps each surface to what it controls. diff --git a/content/claude/claude-tag/overview.md b/content/claude/claude-tag/overview.md index ab4454391f..969ff22d3f 100644 --- a/content/claude/claude-tag/overview.md +++ b/content/claude/claude-tag/overview.md @@ -6,63 +6,32 @@ > Claude Tag puts Claude in your Slack channels with admin-governed access. See what to hand it, how setup works, and where to start as an admin or end user. -
- - -
-
- # platform-eng - 38 members -
- -
-
- - -
-
Dana2:14 PM
-

checkout has felt slow all morning — anyone else seeing it?

-
-
- -
- - -
-
Leo2:15 PM
-

same. @Claude can you investigate? Compare latency against this morning's deploy and find what's causing it.

-
-
- -
- - - - -
-
ClaudeAPP2:15 PM
-

On it. I'll compare latency before and after the deploy, track down the cause, and report back here.

- -
- Done: Pulled p99 latency from Datadog - Done: Diffed deploy 4f2c1 against main - Done: Reproduced the slow query locally - In progress: Opening a pull request with the fix… -
-
-
-
-
-
+Public Beta +Tag @Claude in. Get results back in the thread. +Anyone in a Slack channel can tag Claude into a problem and hand it work: reproduce a bug and open a pull request, turn a decision thread into a doc, assemble the state of a project. It posts a checklist in the thread as it goes, and the whole exchange stays visible to the channel. + +[I'm setting it up →](/docs/claude-tag/admins/setup-overview) +[Use it in your channel ↓](#put-claude-tag-to-work) + +\# platform-eng +38 members + + + +Dana2:14 PMcheckout has felt slow all morning — anyone else seeing it? + + + +Leo2:15 PMsame. @Claude can you investigate? Compare latency against this morning's deploy and find what's causing it. + +![](https://mintcdn.com/claude-ai/5JFKyLlO7sHMMf5J/images/claude-tag/logo/clay-spark.svg?fit=max\&auto=format\&n=5JFKyLlO7sHMMf5J\&q=85\&s=032101c39ca3b1af9f72fc4af8e60d12) + +ClaudeAPP2:15 PMOn it. I'll compare latency before and after the deploy, track down the cause, and report back here. + +Done: Pulled p99 latency from Datadog +Done: Diffed deploy 4f2c1 against main +Done: Reproduced the slow query locally +In progress: Opening a pull request with the fix… ## Plans that include Claude Tag @@ -86,89 +55,43 @@ When Claude works on a task, it runs in an ephemeral sandbox, not on your comput You extend what Claude can reach, like your repositories, ticketing systems, data warehouses, and custom tools, through [Claude Tag connectors](/docs/claude-tag/admins/add-connections), [plugins, and skills](/docs/claude-tag/admins/customize). An Owner or a [Claude Tag admin](/docs/claude-tag/admins/restrict-access#delegate-claude-tag-administration) configures these for all of Slack, for one workspace, or for one channel. Members' own claude.ai connectors are separate from that configuration; Claude can use them in a channel for the member's own requests, as [personal connectors in channels](/docs/claude-tag/concepts/personal-connectors) describes. -
- - - -
+For administrators +Set up Claude Tag + +![](https://mintcdn.com/claude-ai/5JFKyLlO7sHMMf5J/images/claude-tag/illustrations/Hand-Key.svg?fit=max\&auto=format\&n=5JFKyLlO7sHMMf5J\&q=85\&s=1b7a9675728f971bc7a4663c7f1ea599) + +[Open](/docs/claude-tag/admins/setup-overview) + +[Where do I start? +Pair your Slack workspace, launch, and test that it works](/docs/claude-tag/admins/setup-overview) + +[What can Claude Tag access? +How admins set access per channel, and where credentials are stored](/docs/claude-tag/concepts/agent-identity) + +[How do I connect each service? +Credential types, allowed hosts, and what each connection lets Claude reach](/docs/claude-tag/admins/add-connections) + +For end users +Put Claude Tag to work + +![](https://mintcdn.com/claude-ai/5JFKyLlO7sHMMf5J/images/claude-tag/illustrations/Hand-NodePair.svg?fit=max\&auto=format\&n=5JFKyLlO7sHMMf5J\&q=85\&s=c64df4c6d27a6da752aa32c9e0622781) + +[Open](#put-claude-tag-to-work) + +[How do I hand Claude Tag a task? +Mention Claude in any channel it's in, with nothing to install](/docs/claude-tag/users/getting-started) + +[What is Claude Tag good at? +Use cases for coding, data, incidents, and go-to-market](/docs/claude-tag/users/use-cases) + +[How do I get good results? +Good habits for scoping and reviewing work](/docs/claude-tag/users/good-habits) + +[What does Claude Tag remember? +Channel memory, what's shared across the workspace, and who can see what](/docs/claude-tag/users/memory) + +[Can Claude Tag run tasks on a schedule? +Scheduled jobs, channel watching, and triggers](/docs/claude-tag/users/proactivity) ## Billing and spend limits @@ -178,7 +101,7 @@ One-to-one direct messages from members who have connected a Claude account don' To learn what your team's usage costs, run a pilot with a spend limit set and watch the per-channel breakdown on the [usage page in your admin settings](https://claude.ai/admin-settings/usage/claude-tag). [Set a spend limit](/docs/claude-tag/admins/set-spend-limit) covers how to fund the balance on each plan, set the limit, and what happens when usage reaches it. -
For end users
+For end users ## Put Claude Tag to work @@ -205,7 +128,7 @@ Each link opens a guide with the prompts to paste and the connections the task n [Get started](/docs/claude-tag/users/getting-started) covers your first message, what you see while Claude works, and how to shape Claude's behavior in your channel. -
For administrators
+For administrators ## Set Claude Tag up once for everyone @@ -220,31 +143,25 @@ Claude Tag starts with no access of its own to your external systems. After you [Set up Claude Tag](/docs/claude-tag/admins/setup-overview) walks through setup and connecting tools, with what to have ready, what each choice means, and how to verify Claude Tag works once you launch. -
-
-

Security review

- Security and data handling -
+Security review +[Security and data handling](/docs/claude-tag/concepts/security-and-data) -

The security model, what admins can and can't restrict, audit trails, and network requirements.

-
+The security model, what admins can and can't restrict, audit trails, and network requirements. ## Where to start with Claude Tag - - - Admins: pair your Slack workspace and launch - +> **[Set up Claude Tag](/docs/claude-tag/admins/setup-overview)** +> +> Admins: pair your Slack workspace and launch - - It's already in your channel: send your first message - +> **[Hand Claude Tag your first task](/docs/claude-tag/users/getting-started)** +> +> It's already in your channel: send your first message - - The session model, what it can read, and how memory follows places - +> **[How Claude Tag works](/docs/claude-tag/concepts/how-it-works)** +> +> The session model, what it can read, and how memory follows places - - Prompts to paste, by team and connection - - +> **[Use case library](/docs/claude-tag/users/use-cases)** +> +> Prompts to paste, by team and connection diff --git a/content/claude/claude-tag/users/commands.md b/content/claude/claude-tag/users/commands.md index a92f8f38e2..c0e49b9c45 100644 --- a/content/claude/claude-tag/users/commands.md +++ b/content/claude/claude-tag/users/commands.md @@ -6,9 +6,9 @@ > A few exact, bang-prefixed words after an @-mention run a fixed action instead of starting a normal turn: see the command list, get the link to a channel's settings page, restart a stuck or wrong-context session, check whether Claude is still working in a thread or channel, mute or unmute a thread, turn fast mode on or off, send feedback, list a channel's routines, and fork a thread's conversation into a new thread, here or in another channel. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. A command is `@Claude` followed immediately by one of a few exact words starting with `!`. Claude matches the message against that word and runs a fixed action instead of starting a normal turn. diff --git a/content/claude/claude-tag/users/getting-started.md b/content/claude/claude-tag/users/getting-started.md index 69be39e68b..154863d461 100644 --- a/content/claude/claude-tag/users/getting-started.md +++ b/content/claude/claude-tag/users/getting-started.md @@ -6,9 +6,9 @@ > Claude Tag works in your Slack channels. See how to check it's on, send your first message, what it can read, and why DMs work differently. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Claude Tag is Claude working in your Slack workspace. You hand it work by writing a message where Claude is, and Claude carries it out in that thread. An `@Claude` mention guarantees a response in a channel, but it isn't required everywhere. One-to-one DMs and threads Claude is already in reach it without one. There's nothing for you to install or configure; if `@Claude` is in your channel, you can use it (unless your admin has [restricted who can invoke Claude](/docs/claude-tag/admins/restrict-access#restrict-who-can-use-claude)). @@ -108,7 +108,9 @@ Claude reads images and PDFs directly. It puts any other file type in its workin Claude can't read an image or PDF over its limit and answers from the rest of your message. To hand Claude a larger image or PDF, resize the image, split the PDF, or paste the text. -Slack doesn't expose personal account settings (your sidebar, notification preferences, channel membership, or DMs between you and other people) to apps. If you want help organizing channels, paste or screenshot the list and Claude can propose a scheme you apply yourself. +> [!NOTE] +> +> Slack doesn't expose personal account settings (your sidebar, notification preferences, channel membership, or DMs between you and other people) to apps. If you want help organizing channels, paste or screenshot the list and Claude can propose a scheme you apply yourself. ### Which messages Claude reads diff --git a/content/claude/claude-tag/users/good-habits.md b/content/claude/claude-tag/users/good-habits.md index 13e54b7009..1fdf566efa 100644 --- a/content/claude/claude-tag/users/good-habits.md +++ b/content/claude/claude-tag/users/good-habits.md @@ -6,9 +6,9 @@ > Name the outcome, give every task a definition of done, and pick the right channel. See how to write tasks Claude can finish and how to keep many threads reviewable. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Tasks should have a verifiable end state. Claude runs each one in its own thread, and a thread closes when someone can confirm the work is done. A task without that end state produces an open-ended report, and the thread stays open while you decide what to do with it. @@ -58,7 +58,9 @@ When a mistake would be costly to undo, give Claude more detail. Write the detai @Claude migrate the export config to the new schema. Hard rules: no behavior change, don't touch the billing module, and every old config key keeps working as an alias. Done means the full test suite passes, not only the export tests. ``` -Constraints in a task steer Claude but don't restrict Claude from performing a specific action. Anything you type to Claude goes into its working context, where it can be forgotten or overridden. If there are actions Claude must not take, enforce them outside the conversation, with controls like repository permissions, branch protection rules, and required checks. +> [!WARNING] +> +> Constraints in a task steer Claude but don't restrict Claude from performing a specific action. Anything you type to Claude goes into its working context, where it can be forgotten or overridden. If there are actions Claude must not take, enforce them outside the conversation, with controls like repository permissions, branch protection rules, and required checks. ### Give every task a definition of done @@ -92,7 +94,9 @@ Tell Claude which decisions it can make on its own and which ones it must bring @Claude update the retry logic the way this thread decided. Handle test failures and lint yourself. Come back to me before changing any public interface, and for anything you're not sure is in scope. ``` -These instructions steer Claude but don't restrict Claude from deciding on its own. A decision that must come back to you needs an enforced control too, such as branch protection for merges. +> [!WARNING] +> +> These instructions steer Claude but don't restrict Claude from deciding on its own. A decision that must come back to you needs an enforced control too, such as branch protection for merges. Once you've seen and verified Claude's output over several tasks, you can let it make more decisions without checking in, the same way you widen [what it closes on its own](#give-every-task-a-definition-of-done). diff --git a/content/claude/claude-tag/users/group-dms.md b/content/claude/claude-tag/users/group-dms.md index 74768dee1f..6b24c08544 100644 --- a/content/claude/claude-tag/users/group-dms.md +++ b/content/claude/claude-tag/users/group-dms.md @@ -6,9 +6,9 @@ > Add Claude to a Slack group DM to share a task with a few people. See whose access and billing apply, when Claude replies, and what differs from a channel. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. A group DM is a Slack direct message among several people. Claude works in a group DM it has been added to, so a few people can share a task with Claude without creating a channel. @@ -57,21 +57,19 @@ Claude can't make the change in these cases: * **Channel-only access.** A guest is in the group DM, and Claude runs there with [channel-only access](/docs/claude-tag/admins/restrict-access#how-channel-only-works). * **Blocked member edits.** An admin set [**Channel member edits**](/docs/claude-tag/admins/attach-to-scope#restrict-who-can-set-channel-instructions) to **Block** for the workspace or the organization. - - - Mention `@Claude` at the top level of the group DM and ask it to reply only to mentions. +**1. Ask Claude** + +Mention `@Claude` at the top level of the group DM and ask it to reply only to mentions. + +```text wrap theme={null} +@Claude only reply here when someone mentions you. +``` - ```text wrap theme={null} - @Claude only reply here when someone mentions you. - ``` +Claude posts a card in the thread under your message, with **Confirm** and **Cancel** buttons. - Claude posts a card in the thread under your message, with **Confirm** and **Cancel** buttons. - +**2. Confirm the change** - - Select **Confirm** within 30 minutes. The card changes to a line that names the person who confirmed and says Claude now replies only when @mentioned. - - +Select **Confirm** within 30 minutes. The card changes to a line that names the person who confirmed and says Claude now replies only when @mentioned. After the change, Claude still answers a mention, and it still reads replies in a thread that started with an `@Claude` mention. diff --git a/content/claude/claude-tag/users/memory.md b/content/claude/claude-tag/users/memory.md index 3afb91d702..c345a41ae1 100644 --- a/content/claude/claude-tag/users/memory.md +++ b/content/claude/claude-tag/users/memory.md @@ -6,9 +6,9 @@ > Claude Tag memory belongs to the channel, not to you. See what each channel keeps, which notes are shared across the workspace, and how to check or correct them. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Claude keeps memory by channel. Each channel, public or private, has its own notes, and channel memory isn't organized by person. From a public channel Claude can also save workspace notes, which it reads in every channel in the workspace. In a one-to-one direct message, Claude keeps separate notes for its conversation with you; see [Channel and workspace memory](#channel-and-workspace-memory). diff --git a/content/claude/claude-tag/users/models.md b/content/claude/claude-tag/users/models.md index 08a7c53bdb..6f8abb2779 100644 --- a/content/claude/claude-tag/users/models.md +++ b/content/claude/claude-tag/users/models.md @@ -6,9 +6,9 @@ > Ask Claude to switch models in a Slack thread, set a channel's default model, pick the model for your direct messages, or run a thread in fast mode. See which models you can use and how to confirm which one replied. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Every Claude Tag reply in Slack comes from one Claude model, and you choose which one by asking Claude for it in plain language, the same way you hand it any other task. The footer of each reply names the model that handled it, so you can confirm a switch took effect. diff --git a/content/claude/claude-tag/users/proactivity.md b/content/claude/claude-tag/users/proactivity.md index d71d76c15e..aef609a323 100644 --- a/content/claude/claude-tag/users/proactivity.md +++ b/content/claude/claude-tag/users/proactivity.md @@ -6,9 +6,9 @@ > Claude Tag runs routines you set up from a channel. See scheduled jobs, channel watching, pull request subscriptions, where results post, and how to pause them. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. You can give Claude standing work from any channel it's in. This standing work is called a routine: a job that runs on a schedule, such as watching a channel, following a pull request, or posting status updates. You set a routine up in the channel where it should run, and it uses that channel's connections with the same permissions as a typed request. diff --git a/content/claude/claude-tag/users/prompt-library.md b/content/claude/claude-tag/users/prompt-library.md index de7c59943c..41566d47a4 100644 --- a/content/claude/claude-tag/users/prompt-library.md +++ b/content/claude/claude-tag/users/prompt-library.md @@ -6,9 +6,9 @@ > Copy-paste prompts for Claude Tag in Slack, each with why it works. See first messages, handoffs, channel rules, memory checks, routines, fan-out, and steering. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. These prompts are ready to copy, paste, and adapt: swap in your own channel names, services, and repositories. Each comes with the reason it works, so you can keep the mechanism when you change the words. diff --git a/content/claude/claude-tag/users/troubleshooting.md b/content/claude/claude-tag/users/troubleshooting.md index 4f163a75f3..c8af9b044a 100644 --- a/content/claude/claude-tag/users/troubleshooting.md +++ b/content/claude/claude-tag/users/troubleshooting.md @@ -6,9 +6,9 @@ > Fixes for common Claude Tag problems in Slack. See no reply after a reaction, queued or failed sessions, lost work, missing connections, blocked links and websites, and DM or account errors. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. When something goes wrong mid-conversation, the cause is usually one of a small set. Each entry below has the same three parts: what you see, what it means, and how to resolve it. For setup and credential errors, see the [admin troubleshooting page](/docs/claude-tag/admins/troubleshooting). @@ -72,7 +72,9 @@ A reaction or a working indicator without a reply usually means Claude is still 1. Send [`@Claude !status`](/docs/claude-tag/users/commands#check-whether-claude-is-still-working) in the same thread. Claude tells you, in a note only you can see, whether it's still working and for how long, without interrupting the work. If the note says Claude got disconnected, @-mention Claude in the thread and it picks up where it left off, with no restart needed. 2. If the silence has stretched well past what the task should need, send [`@Claude !restart`](/docs/claude-tag/users/commands#restart-a-stuck-or-wrong-context-session) in the thread; it archives the session and starts a fresh one that still reads the thread. Starting a new thread and restating the request also works. -Restarting abandons whatever the session was midway through, and there's no way to resume it. A silent session may still be working through a long task, so treat `!restart` as a last resort. +> [!WARNING] +> +> Restarting abandons whatever the session was midway through, and there's no way to resume it. A silent session may still be working through a long task, so treat `!restart` as a last resort. ### Claude says my session is queued or failed to start @@ -111,8 +113,6 @@ Editing a sent message to add a mention doesn't trigger a response; Claude only Send a new message with the mention included. - - ### Claude is silent in a channel shared with another company **What you see** diff --git a/content/claude/claude-tag/users/use-cases.md b/content/claude/claude-tag/users/use-cases.md index 00ce9ab675..ea8c40f5af 100644 --- a/content/claude/claude-tag/users/use-cases.md +++ b/content/claude/claude-tag/users/use-cases.md @@ -6,13 +6,15 @@ > Shapes of work teams hand Claude Tag in Slack, each with prompts to paste. See triage, catch-up, docs and tickets, project tracking, data, deals, monitoring, and bug fixes. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Each use case below links to a page with prompts to paste, what it needs connected, and how to set it up to [run on a schedule or watch the channel](/docs/claude-tag/users/proactivity) instead of asking each time. -If typing `@Claude` doesn't show **Claude** with an **APP** badge, the Claude app isn't installed in your Slack workspace; ask your Slack admin to install it. If the mention sends but Claude doesn't reply, ask your Claude organization admin to enable Claude Tag for the channel and send them the [setup guide](/docs/claude-tag/admins/setup-overview). +> [!NOTE] +> +> If typing `@Claude` doesn't show **Claude** with an **APP** badge, the Claude app isn't installed in your Slack workspace; ask your Slack admin to install it. If the mention sends but Claude doesn't reply, ask your Claude organization admin to enable Claude Tag for the channel and send them the [setup guide](/docs/claude-tag/admins/setup-overview). ## All use cases diff --git a/content/claude/claude-tag/users/use-cases/answer-data-questions.md b/content/claude/claude-tag/users/use-cases/answer-data-questions.md index 6b57650088..b72d0d7e42 100644 --- a/content/claude/claude-tag/users/use-cases/answer-data-questions.md +++ b/content/claude/claude-tag/users/use-cases/answer-data-questions.md @@ -6,9 +6,9 @@ > Claude Tag answers data questions in the Slack thread. See warehouse queries with charts, scheduled metric reports, and charts built from channel history alone. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. ## How data-question prompts work @@ -56,16 +56,14 @@ Anyone in the thread can ask for a different cut of the same data. ## Related resources - - - When the question is about systems, not metrics - +> **[Watch monitors and alerts](/docs/claude-tag/users/use-cases/watch-monitors)** +> +> When the question is about systems, not metrics - - Recurring reports - +> **[Set up routines](/docs/claude-tag/users/proactivity)** +> +> Recurring reports - - How Anthropic answers ad-hoc data questions in Slack with Claude - - +> **[Self-service data analytics](https://claude.com/blog/self-service-data-analytics-in-slack-how-anthropic-deploys-claude-tag-for-ad-hoc-questions)** +> +> How Anthropic answers ad-hoc data questions in Slack with Claude diff --git a/content/claude/claude-tag/users/use-cases/catch-up.md b/content/claude/claude-tag/users/use-cases/catch-up.md index 8b0b4d135e..05337a7084 100644 --- a/content/claude/claude-tag/users/use-cases/catch-up.md +++ b/content/claude/claude-tag/users/use-cases/catch-up.md @@ -6,9 +6,9 @@ > Claude Tag summarizes Slack threads and channels on demand. See one-off recaps, a scheduled morning rollup of open threads, and what's waiting on you. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. ## How catch-up prompts work @@ -50,12 +50,10 @@ If the first stretch of every morning goes to re-reading channels, schedule the ## Related resources - - - When the catch-up should become an artifact - +> **[Turn threads into docs and tickets](/docs/claude-tag/users/use-cases/create-artifacts)** +> +> When the catch-up should become an artifact - - Scheduling and triggers - - +> **[Set up routines](/docs/claude-tag/users/proactivity)** +> +> Scheduling and triggers diff --git a/content/claude/claude-tag/users/use-cases/create-artifacts.md b/content/claude/claude-tag/users/use-cases/create-artifacts.md index 1ff530e8c6..2b180935a9 100644 --- a/content/claude/claude-tag/users/use-cases/create-artifacts.md +++ b/content/claude/claude-tag/users/use-cases/create-artifacts.md @@ -6,9 +6,9 @@ > Claude Tag turns a Slack discussion into the artifact you name. See replies you can send, decision docs, status memos, filed tickets, hosted web pages, page comments that reach Claude, and a capture-channel pattern. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. ## How artifact prompts work @@ -77,12 +77,10 @@ Planning inputs arrive over a month, not in one sitting. Forward messages and id ## Related resources - - - When you need the summary, not the artifact - +> **[Catch up](/docs/claude-tag/users/use-cases/catch-up)** +> +> When you need the summary, not the artifact - - How to specify outputs that come back right - - +> **[Good habits](/docs/claude-tag/users/good-habits)** +> +> How to specify outputs that come back right diff --git a/content/claude/claude-tag/users/use-cases/find-answers.md b/content/claude/claude-tag/users/use-cases/find-answers.md index a6a2d76a50..e307e3ea23 100644 --- a/content/claude/claude-tag/users/use-cases/find-answers.md +++ b/content/claude/claude-tag/users/use-cases/find-answers.md @@ -6,9 +6,9 @@ > Claude Tag finds answers in connected docs and replies in the thread. See policy lookups, runbook checks, prior decisions, and answers from the Slack channel alone. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. ## How answer-finding prompts work @@ -64,12 +64,10 @@ Answers come from this channel's history and [memory](/docs/claude-tag/users/mem ## Related resources - - - The same mechanism pointed at "what did I miss" - +> **[Catch up](/docs/claude-tag/users/use-cases/catch-up)** +> +> The same mechanism pointed at "what did I miss" - - How channel knowledge accumulates - - +> **[What Claude Tag remembers](/docs/claude-tag/users/memory)** +> +> How channel knowledge accumulates diff --git a/content/claude/claude-tag/users/use-cases/fix-bugs.md b/content/claude/claude-tag/users/use-cases/fix-bugs.md index 866388f2be..01ad340a20 100644 --- a/content/claude/claude-tag/users/use-cases/fix-bugs.md +++ b/content/claude/claude-tag/users/use-cases/fix-bugs.md @@ -6,9 +6,9 @@ > Claude Tag takes a bug report from Slack to a draft pull request. See reproducing the issue, watching a bug channel, root-cause digs, and following CI to green. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. ## How bug-fix prompts work @@ -82,12 +82,10 @@ For repository conventions that should hold across every session that touches th ## Related resources - - - Catching the problem before the bug report - +> **[Watch monitors and alerts](/docs/claude-tag/users/use-cases/watch-monitors)** +> +> Catching the problem before the bug report - - Definitions of done for code tasks - - +> **[Good habits](/docs/claude-tag/users/good-habits)** +> +> Definitions of done for code tasks diff --git a/content/claude/claude-tag/users/use-cases/marketing-team.md b/content/claude/claude-tag/users/use-cases/marketing-team.md index 6e4c7f6937..03c78c912a 100644 --- a/content/claude/claude-tag/users/use-cases/marketing-team.md +++ b/content/claude/claude-tag/users/use-cases/marketing-team.md @@ -6,9 +6,9 @@ > Claude Tag recipes for marketing teams in Slack. See policy answers in an intake channel, campaign channel recaps and send-ready drafts, lead and campaign state from the CRM, a weekly metrics digest, and brand voice rules saved to channel memory. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. ## How marketing prompts work @@ -109,12 +109,10 @@ Keep saved entries short, since long entries crowd out everything else. For a fu ## Related resources - - - The full set of go-to-market prompts - +> **[Pull deal and account state](/docs/claude-tag/users/use-cases/pull-deal-state)** +> +> The full set of go-to-market prompts - - How the scheduled digest runs, and more recipes - - +> **[Set up routines](/docs/claude-tag/users/proactivity)** +> +> How the scheduled digest runs, and more recipes diff --git a/content/claude/claude-tag/users/use-cases/pull-deal-state.md b/content/claude/claude-tag/users/use-cases/pull-deal-state.md index d8ab9fb5f4..132136a206 100644 --- a/content/claude/claude-tag/users/use-cases/pull-deal-state.md +++ b/content/claude/claude-tag/users/use-cases/pull-deal-state.md @@ -6,9 +6,9 @@ > Claude Tag pulls account and deal state into the Slack channel. See in-thread account answers, pre-call briefs, and a scheduled weekly pipeline digest. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. ## How deal-state prompts work @@ -64,12 +64,10 @@ The three lines cover what moved, what's stuck, and what's coming due, so the di ## Related resources - - - When the question is metrics, not accounts - +> **[Answer data questions](/docs/claude-tag/users/use-cases/answer-data-questions)** +> +> When the question is metrics, not accounts - - Scheduled digests - - +> **[Set up routines](/docs/claude-tag/users/proactivity)** +> +> Scheduled digests diff --git a/content/claude/claude-tag/users/use-cases/review-documents.md b/content/claude/claude-tag/users/use-cases/review-documents.md index ca85fe9809..f2f642ee7b 100644 --- a/content/claude/claude-tag/users/use-cases/review-documents.md +++ b/content/claude/claude-tag/users/use-cases/review-documents.md @@ -6,9 +6,9 @@ > Claude Tag reviews documents in a connected tool against a checklist or policy and posts findings in the thread. See single-document checks, batch reviews, filing lists, comparisons with past reviews, and a scheduled weekly sweep. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. ## How document-review prompts work @@ -82,12 +82,10 @@ Keep the checklist as a document Claude can read, in the connected tool or linke ## Related resources - - - The same connections pointed at a single question - +> **[Find answers in your docs](/docs/claude-tag/users/use-cases/find-answers)** +> +> The same connections pointed at a single question - - How the recurring review runs on a schedule - - +> **[Set up routines](/docs/claude-tag/users/proactivity)** +> +> How the recurring review runs on a schedule diff --git a/content/claude/claude-tag/users/use-cases/track-projects.md b/content/claude/claude-tag/users/use-cases/track-projects.md index 2cb9e647eb..ccf41b913b 100644 --- a/content/claude/claude-tag/users/use-cases/track-projects.md +++ b/content/claude/claude-tag/users/use-cases/track-projects.md @@ -6,9 +6,9 @@ > Claude Tag posts project digests no one has to compile. See standing status updates and follow-ups on contracts, design reviews, and pull requests until they close. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. ## How project-tracking prompts work @@ -61,12 +61,10 @@ Code approvals need the code connection. Scheduled follow-ups on repositories us ## Related resources - - - Schedules and event triggers - +> **[Set up routines](/docs/claude-tag/users/proactivity)** +> +> Schedules and event triggers - - Definitions of done that close threads - - +> **[Good habits](/docs/claude-tag/users/good-habits)** +> +> Definitions of done that close threads diff --git a/content/claude/claude-tag/users/use-cases/triage-requests.md b/content/claude/claude-tag/users/use-cases/triage-requests.md index f47b66c2b6..ba2c777042 100644 --- a/content/claude/claude-tag/users/use-cases/triage-requests.md +++ b/content/claude/claude-tag/users/use-cases/triage-requests.md @@ -6,9 +6,9 @@ > Claude Tag triages a Slack request channel with two setup messages. See in-thread answers, duplicate flags, owner routing, weekly theme rollups, optional ticket filing, and runbooks of standing answers. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. ## How triage prompts work @@ -30,23 +30,21 @@ Check that the channel has the connections below. Ask `@Claude what can you acce Add Claude to the channel with `/invite @Claude` if it isn't there, then two messages set it up. - - - ```text wrap theme={null} - @Claude remember for this channel: when someone tags you on a request, check whether it duplicates something already reported, answer it directly if the answer exists, and otherwise route it to the right owner with a one-line summary. Track recurring themes. - ``` +**1. Give the channel a standing role** + +```text wrap theme={null} +@Claude remember for this channel: when someone tags you on a request, check whether it duplicates something already reported, answer it directly if the answer exists, and otherwise route it to the right owner with a one-line summary. Track recurring themes. +``` - "Remember for this channel" saves the role to [channel memory](/docs/claude-tag/users/memory), so it applies to everyone's threads, not just yours. Tell requesters to include `@Claude` when they post; pin the convention or add it to the channel topic. - +"Remember for this channel" saves the role to [channel memory](/docs/claude-tag/users/memory), so it applies to everyone's threads, not just yours. Tell requesters to include `@Claude` when they post; pin the convention or add it to the channel topic. - - ```text wrap theme={null} - @Claude every Friday at 3pm, post a summary of this week's requests: how many, top themes, and anything still unrouted, including posts that didn't tag you. - ``` +**2. Add a weekly rollup so nothing is missed** + +```text wrap theme={null} +@Claude every Friday at 3pm, post a summary of this week's requests: how many, top themes, and anything still unrouted, including posts that didn't tag you. +``` - "Including posts that didn't tag you" turns the recap into a sweep, so requests that arrived without a mention are still caught. To list or cancel scheduled work later, see [Manage standing work](/docs/claude-tag/users/proactivity#manage-standing-work). - - +"Including posts that didn't tag you" turns the recap into a sweep, so requests that arrived without a mention are still caught. To list or cancel scheduled work later, see [Manage standing work](/docs/claude-tag/users/proactivity#manage-standing-work). Answers draw on what the channel has already settled, meaning its [memory](/docs/claude-tag/users/memory) and its own past threads, and routing gets more accurate as corrections land in channel memory. @@ -80,12 +78,10 @@ When an answer changes, update the runbook where it lives. Edit the document, ed ## Related resources - - - How the weekly rollup runs on a schedule - +> **[Set up routines](/docs/claude-tag/users/proactivity)** +> +> How the weekly rollup runs on a schedule - - How the standing role persists and improves - - +> **[What Claude Tag remembers](/docs/claude-tag/users/memory)** +> +> How the standing role persists and improves diff --git a/content/claude/claude-tag/users/use-cases/watch-monitors.md b/content/claude/claude-tag/users/use-cases/watch-monitors.md index 9b871e4a3f..4c4be7a635 100644 --- a/content/claude/claude-tag/users/use-cases/watch-monitors.md +++ b/content/claude/claude-tag/users/use-cases/watch-monitors.md @@ -6,9 +6,9 @@ > Claude Tag watches dashboards and alert channels so you see one line per issue. See scheduled checks, alert investigation before anyone asks, and the prompts to set both up. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. ## How monitor-watch prompts work @@ -60,20 +60,18 @@ Open the channel's [**Configure** page](/docs/claude-tag/users/good-habits#confi ## Related resources - - - When the investigation should end in a pull request - +> **[Fix bugs](/docs/claude-tag/users/use-cases/fix-bugs)** +> +> When the investigation should end in a pull request - - Schedules and event triggers - +> **[Set up routines](/docs/claude-tag/users/proactivity)** +> +> Schedules and event triggers - - How Anthropic runs Claude as first responder for CI/CD failures - +> **[Claude on call](https://claude.com/blog/ai-ci-cd-on-call)** +> +> How Anthropic runs Claude as first responder for CI/CD failures - - Reference playbooks, templates, and guided setup for an on-call channel - - +> **[On-call kit](https://github.com/anthropics/oncall-kit)** +> +> Reference playbooks, templates, and guided setup for an on-call channel diff --git a/content/claude/claude-tag/users/use-cases/work-with-github.md b/content/claude/claude-tag/users/use-cases/work-with-github.md index 90d0f6385f..11828235e3 100644 --- a/content/claude/claude-tag/users/use-cases/work-with-github.md +++ b/content/claude/claude-tag/users/use-cases/work-with-github.md @@ -6,9 +6,9 @@ > Claude Tag works with your GitHub repositories from Slack: answer questions in-thread, subscribe to pull requests, and hand back chores as draft pull requests. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. ## How GitHub prompts work @@ -18,7 +18,9 @@ Each prompt below is a Slack message. Paste it in the channel or thread where th Name the repository in the first message. A session starts with no repositories checked out and clones one when the request names it. Anything Claude opens on GitHub is authored by the Claude GitHub App, so it appears in your review queue like any other pull request. -An admin [grants a repository to the channels that need it](/docs/claude-tag/admins/attach-to-scope), and questions about the code work only in those channels. By default anyone in those channels can ask, and an admin can [restrict who can use Claude](/docs/claude-tag/admins/restrict-access#control-who-can-invoke-claude-tag). +> [!NOTE] +> +> An admin [grants a repository to the channels that need it](/docs/claude-tag/admins/attach-to-scope), and questions about the code work only in those channels. By default anyone in those channels can ask, and an admin can [restrict who can use Claude](/docs/claude-tag/admins/restrict-access#control-who-can-invoke-claude-tag). ## Check the channel's connections @@ -100,7 +102,9 @@ Claude can watch a pull request and address CI failures, review comments, and ch @Claude watch your PR #562 in acme/data-pipeline. When CI fails, fix it and push. When a review comment arrives, address it and push. Post here after each push saying what changed and why. Done means CI is green and every comment is addressed. I do the approving and merging. ``` -If you don't want Claude to merge pull requests, turn on branch protection rules that restrict who can merge. These rules apply to Claude too. Claude can't approve a pull request it opened, but the person who asked for it can; to require a second approver, see [Require a second approval on Claude's pull requests](/docs/claude-tag/admins/configure-github#require-a-second-approval-on-claude%E2%80%99s-pull-requests). Also write "I do the approving and merging" into the task, as the example does. The task wording states your intent, but it's an instruction Claude can lose track of, not a control. The branch protection rule is what enforces it. +> [!WARNING] +> +> If you don't want Claude to merge pull requests, turn on branch protection rules that restrict who can merge. These rules apply to Claude too. Claude can't approve a pull request it opened, but the person who asked for it can; to require a second approver, see [Require a second approval on Claude's pull requests](/docs/claude-tag/admins/configure-github#require-a-second-approval-on-claude%E2%80%99s-pull-requests). Also write "I do the approving and merging" into the task, as the example does. The task wording states your intent, but it's an instruction Claude can lose track of, not a control. The branch protection rule is what enforces it. Ask for a post after each push so you can follow the pull request from the thread instead of opening GitHub. @@ -110,16 +114,16 @@ If your repository has conventions Claude should follow, such as file layout, pu Each session runs in an isolated sandbox with a standard set of preinstalled tools. Two threads are two sessions with two separate sandboxes. If the repository needs a tool that the standard set doesn't include, such as a language runtime or a database client, add the install commands to `CLAUDE.md`, and Claude [runs them when its work needs them](/docs/claude-tag/admins/configure-github#install-project-dependencies). -A `CLAUDE.md` is guidance rather than a gate. If a pull request must carry a label or pass a check, make that a repository rule. For where `CLAUDE.md` sits among channel memory, channel instructions, and skills, see [Teach Claude something that sticks](/docs/claude-tag/users/good-habits#teach-claude-something-that-sticks). +> [!NOTE] +> +> A `CLAUDE.md` is guidance rather than a gate. If a pull request must carry a label or pass a check, make that a repository rule. For where `CLAUDE.md` sits among channel memory, channel instructions, and skills, see [Teach Claude something that sticks](/docs/claude-tag/users/good-habits#teach-claude-something-that-sticks). ## Related resources - - - The full arc from a bug report to a draft pull request and green CI - +> **[Fix bugs](/docs/claude-tag/users/use-cases/fix-bugs)** +> +> The full arc from a bug report to a draft pull request and green CI - - Pull request subscriptions and other standing work - - +> **[Set up routines](/docs/claude-tag/users/proactivity)** +> +> Pull request subscriptions and other standing work diff --git a/content/claude/claude-tag/users/use-cases/your-own-channel.md b/content/claude/claude-tag/users/use-cases/your-own-channel.md index 864a6a6732..f1b73602f2 100644 --- a/content/claude/claude-tag/users/use-cases/your-own-channel.md +++ b/content/claude/claude-tag/users/use-cases/your-own-channel.md @@ -6,9 +6,9 @@ > Create a Slack channel for you and Claude Tag alone and run your work from it. See scratch questions, digests of channels you don't follow, a weekly status digest, follow-ups chased until they close, and a handoff that covers your time away. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. A channel with just you and Claude in it works the same way any other channel does. This page is for anyone who wants a place for work that doesn't belong in any specific team's channel, like half-formed questions, personal digests, and the things you said you'd do. @@ -112,12 +112,10 @@ The reply is one list of everything that happened here while you were away, orde ## Related resources - - - List, edit, or disable the standing work this page sets up - +> **[Set up routines](/docs/claude-tag/users/proactivity)** +> +> List, edit, or disable the standing work this page sets up - - Pick the right surface and write tasks that close - - +> **[Good habits](/docs/claude-tag/users/good-habits)** +> +> Pick the right surface and write tasks that close diff --git a/content/claude/claude-tag/users/when-claude-responds.md b/content/claude/claude-tag/users/when-claude-responds.md index 2cfb858bff..7163c1b395 100644 --- a/content/claude/claude-tag/users/when-claude-responds.md +++ b/content/claude/claude-tag/users/when-claude-responds.md @@ -6,9 +6,9 @@ > What Claude Tag does with a channel message nobody tagged it in, and how to turn unprompted replies off for a thread or a channel. Read this if Claude is replying too much, or went quiet. -export const BetaNote = () => Claude Tag is in public beta. Features and behavior described here may change before general availability.; - - +> [!NOTE] +> +> Claude Tag is in public beta. Features and behavior described here may change before general availability. Claude replies without an @-mention in one-to-one DMs, in any thread it's already part of, and to channel and group DM messages it judges warrant a reply. In a channel, Claude reads the messages and replies to some of them on its own, so an @-mention is how you guarantee a reply, not a requirement for one. This page covers how Claude decides whether to reply to a message nobody tagged it in, how to turn those replies off for a thread or a whole channel, and which messages never get a reply. Work Claude does on a schedule rather than in reply to a message is a [routine](/docs/claude-tag/users/proactivity), which has its own controls. @@ -61,9 +61,9 @@ The setting covers the channel's messages, not DMs. To quiet a single thread ins Until Claude has joined a channel, you see "@-mention Claude in this channel to activate" in place of the toggle, both on the Configure page and on the channel's page in Claude Tag admin settings. You see the same line in a channel shared across workspaces that all belong to your Claude organization, because Claude runs there with your organization's default settings only. [Messages that never get a reply](#messages-that-never-get-a-reply) covers shared channels in more detail. - - Separately from **Respond automatically**, an Owner or a Claude Tag admin can [turn Claude off in channels](/docs/claude-tag/admins/workspaces#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope). - +> [!NOTE] +> +> Separately from **Respond automatically**, an Owner or a Claude Tag admin can [turn Claude off in channels](/docs/claude-tag/admins/workspaces#turn-claude-tag-on-or-off-and-set-the-version-for-a-scope). ## Messages from other apps and bots diff --git a/content/claude/connectors/building.md b/content/claude/connectors/building.md index da59fb6662..cd12a3b008 100644 --- a/content/claude/connectors/building.md +++ b/content/claude/connectors/building.md @@ -10,19 +10,19 @@ An MCP server gives Claude access to your product or data, and people who use Cl This page is for developers building a remote MCP server for other people to use in Claude. It covers the decisions you make as you build, in the order you meet them, and what Claude's MCP client supports for each one. - - * If you're new to the protocol itself, see [Model Context Protocol (MCP)](/docs/connectors/building/mcp) for a short orientation - * If you want to build a minimal server first and watch Claude call it, see [Build your first MCP server for Claude](/docs/connectors/building/quickstart) - * If you're not sure your plugin needs an MCP server, see [Decide what to include in your plugin](/docs/connectors/building/what-to-build) - +> [!NOTE] +> +> * If you're new to the protocol itself, see [Model Context Protocol (MCP)](/docs/connectors/building/mcp) for a short orientation +> * If you want to build a minimal server first and watch Claude call it, see [Build your first MCP server for Claude](/docs/connectors/building/quickstart) +> * If you're not sure your plugin needs an MCP server, see [Decide what to include in your plugin](/docs/connectors/building/what-to-build) ## Plan your server Claude implements a subset of the MCP specification, with its own callback URL and its own size and timeout limits. - - To build with Claude's help, install the official [`mcp-server-dev` plugin](https://github.com/anthropics/claude-plugins-official/tree/main/plugins/mcp-server-dev) in Claude Code. It walks you through building, testing, and packaging an MCP server interactively, using these docs as its reference. - +> [!TIP] +> +> To build with Claude's help, install the official [`mcp-server-dev` plugin](https://github.com/anthropics/claude-plugins-official/tree/main/plugins/mcp-server-dev) in Claude Code. It walks you through building, testing, and packaging an MCP server interactively, using these docs as its reference. ### Choose where the server runs diff --git a/content/claude/connectors/building/after-publishing.md b/content/claude/connectors/building/after-publishing.md index 6c98383fd2..a3bbef21fd 100644 --- a/content/claude/connectors/building/after-publishing.md +++ b/content/claude/connectors/building/after-publishing.md @@ -10,9 +10,9 @@ Once your connector or plugin is listed in the directory, you keep it current fr This page is for the developer who owns a published listing. - - If your submission isn't live yet, see [Track your directory submission](/docs/directory/submission-status), which explains what each status in the portal means and who acts next. - +> [!NOTE] +> +> If your submission isn't live yet, see [Track your directory submission](/docs/directory/submission-status), which explains what each status in the portal means and who acts next. You can [update what you've published](#update-a-published-connector-or-plugin), [track how a published plugin is used](#track-published-plugin-usage), [share your listing's permanent URL](#directory-listing-urls-are-permanent), or [delist](#delist-a-connector-or-plugin). diff --git a/content/claude/connectors/building/authentication.md b/content/claude/connectors/building/authentication.md index fc8cc85bf5..9b8c1055b1 100644 --- a/content/claude/connectors/building/authentication.md +++ b/content/claude/connectors/building/authentication.md @@ -23,10 +23,10 @@ If you already know MCP authorization, these are the places where Claude's OAuth * Claude gives your discovery, registration, and token endpoints 10 seconds to respond and refresh requests 30 seconds, as [Endpoint latency](#endpoint-latency) describes * A machine-to-machine `client_credentials` grant isn't supported, and [Anthropic-held client credentials](#anthropic-held-client-credentials) are the consent-gated alternative - - - If some of your tools work without the user's account, see [Lazy authentication](/docs/connectors/building/lazy-authentication) to let people use those right away and sign in only when Claude reaches a tool that needs their account - - If you want enterprise users to connect through their organization's SSO without a consent screen, see [Enterprise Managed Auth](/docs/connectors/building/enterprise-managed-auth) - +> [!NOTE] +> +> * If some of your tools work without the user's account, see [Lazy authentication](/docs/connectors/building/lazy-authentication) to let people use those right away and sign in only when Claude reaches a tool that needs their account +> * If you want enterprise users to connect through their organization's SSO without a consent screen, see [Enterprise Managed Auth](/docs/connectors/building/enterprise-managed-auth) Use this page to [pick an authentication type](#supported-authentication-types), [register Claude as an OAuth client](#register-claude-as-an-oauth-client), [make discovery and redirects work](#oauth-discovery-and-redirect-uris), and [meet the token endpoint requirements](#token-endpoint-requirements). @@ -157,15 +157,15 @@ The `401` status is required, because Claude doesn't honor a `WWW-Authenticate` If your `401` doesn't include a `resource_metadata` pointer, Claude can still infer the metadata location by probing your MCP server's origin: `/.well-known/oauth-protected-resource/` first, then `/.well-known/oauth-protected-resource`. Treat this as a fallback, because it works only when your platform serves `/.well-known/*` paths. - - If your authorization server is Microsoft Entra ID, you must also register the MCP server URL as an Application ID URI on your Entra app registration, or the token request fails with `AADSTS9010010`. By default, Entra accepts that URL as an Application ID URI only when it's on a domain your tenant has verified, as described in [Microsoft's identifier URI restrictions](https://learn.microsoft.com/en-us/entra/identity-platform/identifier-uri-restrictions), so an MCP server on a platform hostname such as `*.azurewebsites.net` needs a custom domain first. See [the troubleshooting entry](/docs/connectors/building/troubleshooting#microsoft-entra-id-rejects-the-resource-value) for the fix. - +> [!NOTE] +> +> If your authorization server is Microsoft Entra ID, you must also register the MCP server URL as an Application ID URI on your Entra app registration, or the token request fails with `AADSTS9010010`. By default, Entra accepts that URL as an Application ID URI only when it's on a domain your tenant has verified, as described in [Microsoft's identifier URI restrictions](https://learn.microsoft.com/en-us/entra/identity-platform/identifier-uri-restrictions), so an MCP server on a platform hostname such as `*.azurewebsites.net` needs a custom domain first. See [the troubleshooting entry](/docs/connectors/building/troubleshooting#microsoft-entra-id-rejects-the-resource-value) for the fix. If you control both hosts, an alternative is to serve the MCP endpoint and the authorization server behind a single custom domain that can route both `/.well-known/*` and your MCP path. - - A common symptom of a discovery failure is that your MCP server receives the initial request but your authorization server sees no traffic at all. That happens when neither path works: there's no `WWW-Authenticate: Bearer resource_metadata=…` header on your `401`, and the well-known paths on your MCP server's origin return `404`. With no metadata to read, Claude never learns where your authorization server is, and the connection fails with "Couldn't reach the MCP server." See [troubleshooting](/docs/connectors/building/troubleshooting) for the full diagnostic flow. - +> [!TIP] +> +> A common symptom of a discovery failure is that your MCP server receives the initial request but your authorization server sees no traffic at all. That happens when neither path works: there's no `WWW-Authenticate: Bearer resource_metadata=…` header on your `401`, and the well-known paths on your MCP server's origin return `404`. With no metadata to read, Claude never learns where your authorization server is, and the connection fails with "Couldn't reach the MCP server." See [troubleshooting](/docs/connectors/building/troubleshooting) for the full diagnostic flow. ### Callback URLs diff --git a/content/claude/connectors/building/directory-vs-custom.md b/content/claude/connectors/building/directory-vs-custom.md index 367a8e9489..3412945ef5 100644 --- a/content/claude/connectors/building/directory-vs-custom.md +++ b/content/claude/connectors/building/directory-vs-custom.md @@ -10,9 +10,9 @@ A directory connector is an MCP server listed in Anthropic's directory after rev This page is for developers deciding whether to list a server in the directory, distribute it as a custom connector, or do both. It compares the two, shows the install link each one gets, and covers listing patterns for enterprise and multi-tenant servers. - - If you want to know what directory and custom connectors look like to a Claude user, including the Verified and Community labels, see [connector verification](/docs/connectors/verification). - +> [!NOTE] +> +> If you want to know what directory and custom connectors look like to a Claude user, including the Verified and Community labels, see [connector verification](/docs/connectors/verification). ## Compare directory and custom connectors @@ -66,9 +66,9 @@ https://claude.ai/customize/connectors?modal=add-custom-connector&connectorName= When a user follows the link, claude.ai opens the dialog with the name and URL prefilled and shows a notice that the values came from an external link. The user reviews the values and confirms before anything is added. A signed-out user is prompted to sign in first and then sees the prefilled dialog. - - Install links only prefill the form. They don't bypass review by the user, and they don't grant your server any permissions the user hasn't confirmed. - +> [!NOTE] +> +> Install links only prefill the form. They don't bypass review by the user, and they don't grant your server any permissions the user hasn't confirmed. Organization Owners can use the same parameters on the admin path to prefill the org-wide connector dialog: diff --git a/content/claude/connectors/building/enterprise-managed-auth.md b/content/claude/connectors/building/enterprise-managed-auth.md index 80365f0feb..2f5caa9e9b 100644 --- a/content/claude/connectors/building/enterprise-managed-auth.md +++ b/content/claude/connectors/building/enterprise-managed-auth.md @@ -6,9 +6,9 @@ > Accept identity assertions from enterprise SSO so users connect to your MCP server without a separate OAuth consent step. - - Enterprise Managed Auth is available on Claude Team and Enterprise plans. After your authorization server supports it, email `mcp-review@anthropic.com` to have [your directory listing](/docs/connectors/building/managing-your-listing) marked as supporting Enterprise Managed Auth. - +> [!NOTE] +> +> Enterprise Managed Auth is available on Claude Team and Enterprise plans. After your authorization server supports it, email `mcp-review@anthropic.com` to have [your directory listing](/docs/connectors/building/managing-your-listing) marked as supporting Enterprise Managed Auth. Enterprise Managed Auth (EMA) lets a user connect to your MCP server silently, using the single sign-on session they already have with their organization. Instead of showing each user an OAuth consent screen, Claude presents your authorization server with an identity assertion: a signed JSON Web Token (JWT), issued by the customer's identity provider, that vouches for the user's identity. @@ -20,9 +20,7 @@ This page is for connector developers who need their authorization server to acc When a user whose organization has Enterprise Managed Auth configured invokes your connector, Claude obtains a signed identity assertion for that user and exchanges it directly at your token endpoint for an access token. The user never sees a browser redirect or a consent screen, and your MCP server receives the same kind of bearer token it would after the interactive OAuth flow. The diagram shows the exchange between Claude, your authorization server, and your MCP server. -Sequence diagram with three participants: Claude, your authorization server, and your MCP server. The user is already signed in to Claude through their organization's single sign-on. 1, Claude sends POST /token to your authorization server with the jwt-bearer grant and the signed JWT assertion. 2, your authorization server fetches the issuer's JWKS and verifies the signature. 3, it validates iss, aud, exp, sub, and client_id. 4, it returns an access_token to Claude. 5, Claude sends the tool call to your MCP server with the Bearer access_token. 6, your MCP server returns the tool result to Claude. Requests are solid arrows and responses are dashed arrows. - -Sequence diagram with three participants: Claude, your authorization server, and your MCP server. The user is already signed in to Claude through their organization's single sign-on. 1, Claude sends POST /token to your authorization server with the jwt-bearer grant and the signed JWT assertion. 2, your authorization server fetches the issuer's JWKS and verifies the signature. 3, it validates iss, aud, exp, sub, and client_id. 4, it returns an access_token to Claude. 5, Claude sends the tool call to your MCP server with the Bearer access_token. 6, your MCP server returns the tool result to Claude. Requests are solid arrows and responses are dashed arrows. +![Sequence diagram with three participants: Claude, your authorization server, and your MCP server. The user is already signed in to Claude through their organization's single sign-on. 1, Claude sends POST /token to your authorization server with the jwt-bearer grant and the signed JWT assertion. 2, your authorization server fetches the issuer's JWKS and verifies the signature. 3, it validates iss, aud, exp, sub, and client\_id. 4, it returns an access\_token to Claude. 5, Claude sends the tool call to your MCP server with the Bearer access\_token. 6, your MCP server returns the tool result to Claude. Requests are solid arrows and responses are dashed arrows.](https://mintcdn.com/claude-ai/-njlLvrWxFCRdJVz/images/connectors/enterprise-managed-auth-exchange.svg?fit=max\&auto=format\&n=-njlLvrWxFCRdJVz\&q=85\&s=2bdd0b680bda337b37632516b8dc5e84) Two parties are involved in this exchange: the customer's identity provider signs the assertion, and your authorization server verifies it and issues the access token. Both roles are often served by commercial identity platforms, so the distinction here is about which tenant plays which role rather than about product type. The identity provider publishes its signing keys as a JSON Web Key Set, and your authorization server fetches that key set to verify each assertion. @@ -43,9 +41,9 @@ Before adding Enterprise Managed Auth, make sure the following are already in pl * Your MCP server implements [MCP authorization](https://modelcontextprotocol.io/specification/draft/basic/authorization), including Protected Resource Metadata (PRM) discovery, and follows the [MCP security best practices](https://modelcontextprotocol.io/docs/tutorials/security/security_best_practices). See the [authentication guide](/docs/connectors/building/authentication) for Claude-specific requirements * Your authorization server registers Claude using either [Anthropic-held client credentials](/docs/connectors/building/authentication#anthropic-held-client-credentials) or a [Client ID Metadata Document](/docs/connectors/building/authentication#dcr-and-cimd-details) - - Dynamic Client Registration (DCR) isn't supported with Enterprise Managed Auth. The identity provider stamps a fixed `client_id` into every assertion it issues, so your authorization server must already recognize that client before the first assertion arrives. A client created on the fly through DCR can't satisfy this requirement because its identifier never matches the value in the assertion. - +> [!WARNING] +> +> Dynamic Client Registration (DCR) isn't supported with Enterprise Managed Auth. The identity provider stamps a fixed `client_id` into every assertion it issues, so your authorization server must already recognize that client before the first assertion arrives. A client created on the fly through DCR can't satisfy this requirement because its identifier never matches the value in the assertion. ## Authorization server requirements @@ -53,59 +51,57 @@ Your authorization server must support the JWT bearer authorization grant ([RFC If your MCP server relies on a hosted identity platform, there is typically no code to write. Confirm that the platform supports the JWT bearer authorization grant and enable it for your tenant. Support varies by product, and some commercial authorization servers and identity platforms don't support it yet, so confirm that yours does and that the customer's identity provider can be registered as a trusted issuer. If you run your own authorization server, the steps in this section describe what it needs to support. - - - Your authorization server must accept `urn:ietf:params:oauth:grant-type:jwt-bearer` at its token endpoint and advertise it in the `grant_types_supported` array of its [authorization server metadata (RFC 8414)](https://datatracker.ietf.org/doc/html/rfc8414). In this example metadata, the highlighted entry is the one Claude looks for: - - ```json {7} theme={null} - { - "issuer": "https://auth.example.com", - "token_endpoint": "https://auth.example.com/token", - "grant_types_supported": [ - "authorization_code", - "refresh_token", - "urn:ietf:params:oauth:grant-type:jwt-bearer" - ] - } - ``` - - Claude reads this metadata to discover whether your server supports Enterprise Managed Auth. The grant type must be listed here for Claude to offer the feature to the customer, even if your token endpoint would already accept it silently. - - - - For each customer, your authorization server needs to trust that customer's identity provider as a JWT issuer. Your authorization server fetches the identity provider's JSON Web Key Set and uses it to verify the signature on every incoming assertion. - - Your authorization server is responsible for maintaining an explicit allowlist of trusted issuer URLs per tenant rather than accepting any well-formed JWT. It must reject an assertion whose `iss` isn't on the tenant's allowlist with `invalid_grant`, even if the signature is valid. - - - Never accept an identity assertion without full validation. Your authorization server must verify the signature, issuer, audience, expiry, and subject on every request. Use the JWT validation built into your authorization server product. If you need to inspect assertions in your own code, use the validation library or token introspection endpoint provided by your authorization server vendor rather than writing custom verification logic. - - - - - Claude sends a form-encoded `POST` to your authorization server's token endpoint. The highlighted parameters are the JWT bearer grant type, the signed assertion, and the `client_id` your server must already recognize: - - ```http {5-7} theme={null} - POST /token HTTP/1.1 - Host: auth.example.com - Content-Type: application/x-www-form-urlencoded - - grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer - &assertion=eyJhbGciOi... - &client_id=your-registered-client-id - &scope=openid profile - &resource=https://mcp.example.com - ``` - - The `assertion` parameter carries the signed JWT. The `client_id` is the value Claude is registered under at your authorization server. Claude also includes the `resource` parameter ([Resource Indicators, RFC 8707](https://www.rfc-editor.org/rfc/rfc8707)) set to your MCP server URL whenever the customer's identity provider supports forwarding it. Some identity provider configurations cannot pass a resource indicator through, so your authorization server should accept the request whether or not `resource` is present and use it for audience binding when it is. - - Your authorization server validates the assertion according to the [JWT bearer token processing rules (RFC 7523 section 3)](https://datatracker.ietf.org/doc/html/rfc7523#section-3) and returns a standard OAuth token response. Claude then presents the returned access token as a `Bearer` credential on calls to your MCP server, exactly as it does after the interactive flow. - - - Your authorization server sets the access token lifetime, and the customer's identity provider sets the assertion lifetime. Anthropic doesn't control either value. - - - +**1. Ensure the JWT bearer grant is supported** + +Your authorization server must accept `urn:ietf:params:oauth:grant-type:jwt-bearer` at its token endpoint and advertise it in the `grant_types_supported` array of its [authorization server metadata (RFC 8414)](https://datatracker.ietf.org/doc/html/rfc8414). In this example metadata, the highlighted entry is the one Claude looks for: + +```json {7} theme={null} +{ + "issuer": "https://auth.example.com", + "token_endpoint": "https://auth.example.com/token", + "grant_types_supported": [ + "authorization_code", + "refresh_token", + "urn:ietf:params:oauth:grant-type:jwt-bearer" + ] +} +``` + +Claude reads this metadata to discover whether your server supports Enterprise Managed Auth. The grant type must be listed here for Claude to offer the feature to the customer, even if your token endpoint would already accept it silently. + +**2. Register the trusted issuer** + +For each customer, your authorization server needs to trust that customer's identity provider as a JWT issuer. Your authorization server fetches the identity provider's JSON Web Key Set and uses it to verify the signature on every incoming assertion. + +Your authorization server is responsible for maintaining an explicit allowlist of trusted issuer URLs per tenant rather than accepting any well-formed JWT. It must reject an assertion whose `iss` isn't on the tenant's allowlist with `invalid_grant`, even if the signature is valid. + +> [!WARNING] +> +> Never accept an identity assertion without full validation. Your authorization server must verify the signature, issuer, audience, expiry, and subject on every request. Use the JWT validation built into your authorization server product. If you need to inspect assertions in your own code, use the validation library or token introspection endpoint provided by your authorization server vendor rather than writing custom verification logic. + +**3. Understand the token request** + +Claude sends a form-encoded `POST` to your authorization server's token endpoint. The highlighted parameters are the JWT bearer grant type, the signed assertion, and the `client_id` your server must already recognize: + +```http {5-7} theme={null} +POST /token HTTP/1.1 +Host: auth.example.com +Content-Type: application/x-www-form-urlencoded + +grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer +&assertion=eyJhbGciOi... +&client_id=your-registered-client-id +&scope=openid profile +&resource=https://mcp.example.com +``` + +The `assertion` parameter carries the signed JWT. The `client_id` is the value Claude is registered under at your authorization server. Claude also includes the `resource` parameter ([Resource Indicators, RFC 8707](https://www.rfc-editor.org/rfc/rfc8707)) set to your MCP server URL whenever the customer's identity provider supports forwarding it. Some identity provider configurations cannot pass a resource indicator through, so your authorization server should accept the request whether or not `resource` is present and use it for audience binding when it is. + +Your authorization server validates the assertion according to the [JWT bearer token processing rules (RFC 7523 section 3)](https://datatracker.ietf.org/doc/html/rfc7523#section-3) and returns a standard OAuth token response. Claude then presents the returned access token as a `Bearer` credential on calls to your MCP server, exactly as it does after the interactive flow. + +> [!NOTE] +> +> Your authorization server sets the access token lifetime, and the customer's identity provider sets the assertion lifetime. Anthropic doesn't control either value. ### Access token lifetime diff --git a/content/claude/connectors/building/lazy-authentication.md b/content/claude/connectors/building/lazy-authentication.md index e3064780d1..76a4e51522 100644 --- a/content/claude/connectors/building/lazy-authentication.md +++ b/content/claude/connectors/building/lazy-authentication.md @@ -21,9 +21,9 @@ A user of a lazy-auth connector goes through these steps: 3. They click **Connect** and sign in to your service in a popup. 4. Claude retries the same tool call automatically with the new token, and the turn continues with no context lost. - - If the user's organization has [Enterprise Managed Auth](/docs/connectors/building/enterprise-managed-auth) configured for your connector, the same refusal triggers a silent token exchange instead of the **Connect** card. Claude retries the tool call automatically and the user sees no prompt. - +> [!NOTE] +> +> If the user's organization has [Enterprise Managed Auth](/docs/connectors/building/enterprise-managed-auth) configured for your connector, the same refusal triggers a silent token exchange instead of the **Connect** card. Claude retries the tool call automatically and the user sees no prompt. ## Build lazy authentication on your server @@ -140,9 +140,9 @@ HTTP/1.1 200 OK {"jsonrpc":"2.0","result":{"isError":true,"content":[{"type":"text","text":"Please sign in"}]},"id":1} ``` - - A `200` with `isError: true` is an application-level tool failure. Claude passes the error text to the model as the tool result and moves on, and there is no auth prompt. Only a transport-level `401` causes Claude to pause the call, run the OAuth flow, and retry. A `403` triggers re-authentication only when accompanied by `WWW-Authenticate: Bearer error="insufficient_scope"` for [scope step-up](#ask-for-more-scope-with-403), and any other `403` is surfaced as a terminal error. If users are seeing "please sign in" text in the chat instead of a **Connect** button, the server is returning the wrong one. - +> [!WARNING] +> +> A `200` with `isError: true` is an application-level tool failure. Claude passes the error text to the model as the tool result and moves on, and there is no auth prompt. Only a transport-level `401` causes Claude to pause the call, run the OAuth flow, and retry. A `403` triggers re-authentication only when accompanied by `WWW-Authenticate: Bearer error="insufficient_scope"` for [scope step-up](#ask-for-more-scope-with-403), and any other `403` is surfaced as a terminal error. If users are seeing "please sign in" text in the chat instead of a **Connect** button, the server is returning the wrong one. ### Serve the discovery documents @@ -207,9 +207,9 @@ function authorizationServerMetadata() { } ``` - - Claude selects CIMD only when the authorization-server metadata advertises both `client_id_metadata_document_supported: true` and `"none"` in `token_endpoint_auth_methods_supported`. The second is required because Claude's CIMD client authenticates as a public client with `token_endpoint_auth_method: "none"`, so the token endpoint must accept [PKCE](https://datatracker.ietf.org/doc/html/rfc7636)-only requests without a client secret. If either property is missing, Claude falls back to looking for a `registration_endpoint`. - +> [!NOTE] +> +> Claude selects CIMD only when the authorization-server metadata advertises both `client_id_metadata_document_supported: true` and `"none"` in `token_endpoint_auth_methods_supported`. The second is required because Claude's CIMD client authenticates as a public client with `token_endpoint_auth_method: "none"`, so the token endpoint must accept [PKCE](https://datatracker.ietf.org/doc/html/rfc7636)-only requests without a client secret. If either property is missing, Claude falls back to looking for a `registration_endpoint`. If you move to a real issuer, keep `client_id_metadata_document_supported: true` in that issuer's metadata if you want registration-free onboarding for Claude clients. @@ -250,72 +250,70 @@ How the cache is keyed and refreshed decides when a change reaches your users: You can confirm the public and protected paths with `curl` and Claude Code against your own server before connecting it to Claude as a custom connector, then check the sign-in prompt in a conversation. The commands below use `http://localhost:3000/mcp` as the server URL and the example's tool names; substitute your own. - - - In a terminal, send a `tools/call` for a public tool with no `Authorization` header, with `-i` so the status line prints: +**1. Call a public tool without a token** - ```bash theme={null} - curl -si http://localhost:3000/mcp \ - -H 'Content-Type: application/json' \ - -H 'Accept: application/json, text/event-stream' \ - -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"list_products","arguments":{}}}' - ``` +In a terminal, send a `tools/call` for a public tool with no `Authorization` header, with `-i` so the status line prints: - The server answers `200 OK` with the JSON-RPC tool result and no `WWW-Authenticate` header. - +```bash theme={null} +curl -si http://localhost:3000/mcp \ + -H 'Content-Type: application/json' \ + -H 'Accept: application/json, text/event-stream' \ + -d '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"list_products","arguments":{}}}' +``` + +The server answers `200 OK` with the JSON-RPC tool result and no `WWW-Authenticate` header. + +**2. Call a protected tool without a token** + +Send the same request for a protected tool: + +```bash theme={null} +curl -si http://localhost:3000/mcp \ + -H 'Content-Type: application/json' \ + -H 'Accept: application/json, text/event-stream' \ + -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"get_my_orders","arguments":{}}}' +``` - - Send the same request for a protected tool: +The server answers `401 Unauthorized` with a `WWW-Authenticate` header carrying `resource_metadata`. If you see `200` with `isError: true` instead, your server is returning a tool error rather than failing the HTTP request. - ```bash theme={null} - curl -si http://localhost:3000/mcp \ - -H 'Content-Type: application/json' \ - -H 'Accept: application/json, text/event-stream' \ - -d '{"jsonrpc":"2.0","id":2,"method":"tools/call","params":{"name":"get_my_orders","arguments":{}}}' - ``` +**3. Check both paths from Claude Code** - The server answers `401 Unauthorized` with a `WWW-Authenticate` header carrying `resource_metadata`. If you see `200` with `isError: true` instead, your server is returning a tool error rather than failing the HTTP request. - +If you have [Claude Code](https://code.claude.com/docs/en/setup) installed and signed in, you can see how a Claude client treats each path before you set up a tunnel, because Claude Code connects to a `localhost` server directly. In your terminal, from your server's project folder, add the server: - - If you have [Claude Code](https://code.claude.com/docs/en/setup) installed and signed in, you can see how a Claude client treats each path before you set up a tunnel, because Claude Code connects to a `localhost` server directly. In your terminal, from your server's project folder, add the server: +```bash theme={null} +claude mcp add --transport http authtest http://localhost:3000/mcp +``` - ```bash theme={null} - claude mcp add --transport http authtest http://localhost:3000/mcp - ``` +Then check the connection: - Then check the connection: +```bash theme={null} +claude mcp list +``` - ```bash theme={null} - claude mcp list - ``` +The list shows `authtest: http://localhost:3000/mcp (HTTP) - ✔ Connected` with no sign-in, because connecting and listing tools never reach the gate. Next, have Claude call the public tool with [`claude -p`](https://code.claude.com/docs/en/headless), which sends one prompt and prints the answer: + +```bash theme={null} +claude -p "List the products from the authtest server." --allowedTools mcp__authtest__list_products +``` - The list shows `authtest: http://localhost:3000/mcp (HTTP) - ✔ Connected` with no sign-in, because connecting and listing tools never reach the gate. Next, have Claude call the public tool with [`claude -p`](https://code.claude.com/docs/en/headless), which sends one prompt and prints the answer: +Claude reports the products and no sign-in prompt appears. Run the same command asking for your orders with `--allowedTools mcp__authtest__get_my_orders`. The tool result Claude receives is `MCP server "authtest" needs you to sign in again (run /mcp to re-authenticate)` rather than order data. - ```bash theme={null} - claude -p "List the products from the authtest server." --allowedTools mcp__authtest__list_products - ``` +To sign in from Claude Code, run `/mcp` in an interactive session as [Authenticate with remote MCP servers](https://code.claude.com/docs/en/mcp#authenticate-with-remote-mcp-servers) describes. When you're done testing, run `claude mcp remove authtest`. - Claude reports the products and no sign-in prompt appears. Run the same command asking for your orders with `--allowedTools mcp__authtest__get_my_orders`. The tool result Claude receives is `MCP server "authtest" needs you to sign in again (run /mcp to re-authenticate)` rather than order data. +**4. Add the server to Claude as a custom connector** - To sign in from Claude Code, run `/mcp` in an interactive session as [Authenticate with remote MCP servers](https://code.claude.com/docs/en/mcp#authenticate-with-remote-mcp-servers) describes. When you're done testing, run `claude mcp remove authtest`. - +Claude reaches custom connectors from Anthropic's infrastructure, so `localhost` isn't reachable directly. To add a local server: - - Claude reaches custom connectors from Anthropic's infrastructure, so `localhost` isn't reachable directly. To add a local server: +1. Expose the server over a public HTTPS tunnel, such as `cloudflared tunnel --url http://localhost:3000` or `ngrok http 3000`. Keep the tunnel up only while you test, because it exposes your local server publicly and the example's `/authorize`, `/token`, and `isTokenValid()` are stubs that treat anyone as signed in. +2. In Claude, go to [**Customize > Connectors**](https://claude.ai/customize/connectors) and select **Add custom connector**. +3. Enter the tunnel's `/mcp` URL. - 1. Expose the server over a public HTTPS tunnel, such as `cloudflared tunnel --url http://localhost:3000` or `ngrok http 3000`. Keep the tunnel up only while you test, because it exposes your local server publicly and the example's `/authorize`, `/token`, and `isTokenValid()` are stubs that treat anyone as signed in. - 2. In Claude, go to [**Customize > Connectors**](https://claude.ai/customize/connectors) and select **Add custom connector**. - 3. Enter the tunnel's `/mcp` URL. +See [Test a local server](/docs/connectors/building/testing#test-a-local-server) for details. If your app comes from the SDK's `createMcpExpressApp()`, that section also shows the `allowedHosts` option you need before requests through the tunnel succeed. - See [Test a local server](/docs/connectors/building/testing#test-a-local-server) for details. If your app comes from the SDK's `createMcpExpressApp()`, that section also shows the `allowedHosts` option you need before requests through the tunnel succeed. - +**5. Try both paths in a conversation** - - 1. Ask Claude to list products. No sign-in prompt appears. - 2. Ask for your orders. The inline **Connect** card appears, and after you authenticate the same call completes. - - +1. Ask Claude to list products. No sign-in prompt appears. +2. Ask for your orders. The inline **Connect** card appears, and after you authenticate the same call completes. ## Next steps diff --git a/content/claude/connectors/building/managing-your-listing.md b/content/claude/connectors/building/managing-your-listing.md index ada4b00e20..ccc9eeb353 100644 --- a/content/claude/connectors/building/managing-your-listing.md +++ b/content/claude/connectors/building/managing-your-listing.md @@ -8,9 +8,9 @@ Organizations that submit a connector to the [directory](/docs/connectors/directory) get a submissions dashboard in the developer portal at [claude.ai/directory/manage](https://claude.ai/directory/manage). This page is for connector authors who have already [submitted a connector](/docs/connectors/building/submission). Use the dashboard to [track a submission through review](#track-submission-status), [monitor your published server's health and usage](#server-health-and-usage-metrics), and [edit your listing](#edit-your-listing). - - This page covers directory-listed remote MCP servers. The dashboard shows only your own organization's submissions. Custom connectors and local servers packaged as desktop extensions don't appear here. - +> [!NOTE] +> +> This page covers directory-listed remote MCP servers. The dashboard shows only your own organization's submissions. Custom connectors and local servers packaged as desktop extensions don't appear here. ## Access the dashboard @@ -26,9 +26,9 @@ A published connector is listed with the **Community** label by default. [Connec Once your server is published, its **Overview** and **Usage** tabs in the developer portal show a health badge, topline usage numbers, an error breakdown, and usage by product and by tool. - - Metrics are in beta. They're computed daily from directory usage and can lag by up to 24 hours. Time windows with fewer than 5 calls, per-tool rows with fewer than 5 calls, and per-product rows with fewer than 50 calls are omitted. - +> [!NOTE] +> +> Metrics are in beta. They're computed daily from directory usage and can lag by up to 24 hours. Time windows with fewer than 5 calls, per-tool rows with fewer than 5 calls, and per-product rows with fewer than 50 calls are omitted. ### Review what the metrics cover diff --git a/content/claude/connectors/building/mcp-apps/design-guidelines.md b/content/claude/connectors/building/mcp-apps/design-guidelines.md index 496ea93fd9..a55af8c429 100644 --- a/content/claude/connectors/building/mcp-apps/design-guidelines.md +++ b/content/claude/connectors/building/mcp-apps/design-guidelines.md @@ -8,15 +8,15 @@ MCP Apps are interactive interfaces that appear within Claude's conversational flow. These guidelines are for developers designing an MCP App's UI. - - If you haven't built and connected an MCP App yet, see [Get started with MCP Apps](/docs/connectors/building/mcp-apps/getting-started). - +> [!NOTE] +> +> If you haven't built and connected an MCP App yet, see [Get started with MCP Apps](/docs/connectors/building/mcp-apps/getting-started). Use the guidelines to [pick a display mode](#display-modes), [adapt to mobile](#mobile-guidelines), match Claude's [visual design](#visual-design) with the host's [style variables](#style-variables), and decide which [interactions](#interaction-patterns) belong in your app and which belong in chat. - - The [Figma UI kit](https://www.figma.com/community/file/1597641111449594397/mcp-apps-for-claude) has components and patterns to start from. - +> [!TIP] +> +> The [Figma UI kit](https://www.figma.com/community/file/1597641111449594397/mcp-apps-for-claude) has components and patterns to start from. ## Design for the conversation @@ -59,9 +59,9 @@ An inline card is a compact component embedded directly in the conversation. Kee * Brief summaries with optional expansion * Quick actions that continue the conversation -Inline card example showing a compact component +![Inline card example showing a compact component](https://mintcdn.com/claude-ai/IPtAfld1XUBVOx8m/images/mcp-apps/inline-card-1.png?fit=max\&auto=format\&n=IPtAfld1XUBVOx8m\&q=85\&s=0c7825c89be73ad56d0a90e4c979401d) -Inline card example showing a data display +![Inline card example showing a data display](https://mintcdn.com/claude-ai/IPtAfld1XUBVOx8m/images/mcp-apps/inline-card-2.png?fit=max\&auto=format\&n=IPtAfld1XUBVOx8m\&q=85\&s=344f114b1012838b4805b48d496201c0) Inline cards have these constraints: @@ -73,7 +73,7 @@ Inline cards have these constraints: On mobile, inline cards render full-width within the conversation. Make every tap target at least 44pt, and adapt content to narrower viewports without horizontal scrolling. -Inline card mobile examples +![Inline card mobile examples](https://mintcdn.com/claude-ai/sLZLADaApRAVEV6C/images/mcp-apps/inline-card-mobile.png?fit=max\&auto=format\&n=sLZLADaApRAVEV6C\&q=85\&s=3d2afa48da4f1d31cce9c0bb91a18807) ### Inline carousel @@ -84,7 +84,7 @@ An inline carousel shows items side by side for browsing options. Users swipe or * Media galleries * Any set of comparable items -Inline carousel example showing browsable items +![Inline carousel example showing browsable items](https://mintcdn.com/claude-ai/IPtAfld1XUBVOx8m/images/mcp-apps/inline-carousel-1.png?fit=max\&auto=format\&n=IPtAfld1XUBVOx8m\&q=85\&s=ef6b5615726ad25708ebdedf586226ae) Inline carousels have these constraints: @@ -96,7 +96,7 @@ Inline carousels have these constraints: On mobile, carousel cards are optimized for horizontal swipe. Design for thumb reach by keeping primary actions in the lower portion of cards, and let the next card peek into view to signal that the row scrolls. -Inline carousel mobile examples +![Inline carousel mobile examples](https://mintcdn.com/claude-ai/sLZLADaApRAVEV6C/images/mcp-apps/inline-carousel-mobile.png?fit=max\&auto=format\&n=sLZLADaApRAVEV6C\&q=85\&s=2bf64edd4fdefe8a37188ca4f2f32f4e) ### Full screen @@ -108,9 +108,9 @@ Full screen mode gives complex interactions an immersive interface. The conversa * Content that benefits from focused attention * Rich tasks requiring more space than inline allows -Full screen mode example +![Full screen mode example](https://mintcdn.com/claude-ai/IPtAfld1XUBVOx8m/images/mcp-apps/fullscreen-1.png?fit=max\&auto=format\&n=IPtAfld1XUBVOx8m\&q=85\&s=a4b491bb475bab8ed146c1bc953516ec) -Full screen mode with data visualization +![Full screen mode with data visualization](https://mintcdn.com/claude-ai/IPtAfld1XUBVOx8m/images/mcp-apps/fullscreen-2.png?fit=max\&auto=format\&n=IPtAfld1XUBVOx8m\&q=85\&s=8523c5ae46ab7492586044ff5fabea32) Full screen mode has these constraints: @@ -121,7 +121,7 @@ Full screen mode has these constraints: On mobile, your app fills the entire screen with the chat input and navigation bar overlaid on top, so keep critical UI within the safe area. Use the full viewport width, and support both portrait and landscape where it makes sense. -Full screen mobile examples +![Full screen mobile examples](https://mintcdn.com/claude-ai/sLZLADaApRAVEV6C/images/mcp-apps/fullscreen-mobile.png?fit=max\&auto=format\&n=sLZLADaApRAVEV6C\&q=85\&s=d2802346090fd1a7af6a1bdc1d7c3263) ## Mobile guidelines @@ -137,7 +137,7 @@ Render the interactive portion of your app inside the safe area so the mobile na Read `hostContext.safeAreaInsets.{top, right, bottom, left}`, which are pixel values, and apply them as padding on your root container, or as `scroll-padding` on scroll-snap containers so items come to rest inside the visible region. Safe areas aren't mobile-specific: on web and desktop the composer can overlay the bottom of an inline app, so avoid placing interactive controls flush against any edge. -Safe area insets in full screen mode on web and mobile +![Safe area insets in full screen mode on web and mobile](https://mintcdn.com/claude-ai/sLZLADaApRAVEV6C/images/mcp-apps/safe-area-fullscreen.png?fit=max\&auto=format\&n=sLZLADaApRAVEV6C\&q=85\&s=d789bcbba50a3bff53d677478421de30) #### Borderless inline content @@ -145,7 +145,7 @@ Set `_meta.ui.prefersBorder` to `true` or `false` to control whether your conten In borderless mode your content runs edge-to-edge with no host padding, so honoring `safeAreaInsets` becomes essential. The bordered card's built-in padding otherwise absorbs most of them. Borderless works well for carousels and other horizontally scrolling content that should bleed to the screen edges while in motion: apply `safeAreaInsets.left` and `.right` as `scroll-padding-inline` on the scroll container so items at rest sit clear of the device edges but can scroll underneath them. -Safe area insets for borderless inline apps on mobile +![Safe area insets for borderless inline apps on mobile](https://mintcdn.com/claude-ai/sLZLADaApRAVEV6C/images/mcp-apps/safe-area-borderless-mobile.png?fit=max\&auto=format\&n=sLZLADaApRAVEV6C\&q=85\&s=9936d8064beb2fc37e39b10ab1e727a9) ### Declare supported display modes @@ -178,7 +178,7 @@ The `frameDomains` field, for embedding third-party iframes, is restricted in Cl * Use full-width layouts, without side margins that waste mobile screen space * Let content reflow gracefully, and avoid fixed-width layouts -Viewport and layout do's and don'ts +![Viewport and layout do's and don'ts](https://mintcdn.com/claude-ai/IPtAfld1XUBVOx8m/images/mcp-apps/mobile-viewport-layout.png?fit=max\&auto=format\&n=IPtAfld1XUBVOx8m\&q=85\&s=d2244b6ff7e2d6c5e7b2c36fd2d901ed) ### Touch targets @@ -187,7 +187,7 @@ The `frameDomains` field, for embedding third-party iframes, is restricted in Cl * Larger, thumb-friendly buttons rather than small text links * Primary actions within natural thumb reach, in the lower portion of the screen -Touch target do's and don'ts +![Touch target do's and don'ts](https://mintcdn.com/claude-ai/IPtAfld1XUBVOx8m/images/mcp-apps/mobile-touch-targets.png?fit=max\&auto=format\&n=IPtAfld1XUBVOx8m\&q=85\&s=95bd5b4393d85a67b74e894331d5f4b0) ### Scrolling and gestures @@ -203,19 +203,19 @@ If your app needs its own vertically scrollable viewport, request fullscreen pre * Provide a clear visual affordance for expansion, such as a fullscreen button or tap-to-expand * Closing fullscreen returns to the conversation at the same scroll position -Transition from inline card to full screen +![Transition from inline card to full screen](https://mintcdn.com/claude-ai/IPtAfld1XUBVOx8m/images/mcp-apps/mobile-transitions.png?fit=max\&auto=format\&n=IPtAfld1XUBVOx8m\&q=85\&s=343fe75a1428c1874568c10e02de9aa8) ### Dark mode All views must support both light and dark themes. Use the host's style tokens, which adapt automatically, and never hardcode colors. Test both modes. -Dark mode examples on mobile +![Dark mode examples on mobile](https://mintcdn.com/claude-ai/IPtAfld1XUBVOx8m/images/mcp-apps/mobile-dark-mode.png?fit=max\&auto=format\&n=IPtAfld1XUBVOx8m\&q=85\&s=79df1abf42e75b052ad7c28ac71c4413) ### Loading states Show skeleton screens while content loads, and match the layout structure of the final content so the swap is smooth. Avoid spinners for inline content, because skeletons feel more native. -Loading state examples on mobile +![Loading state examples on mobile](https://mintcdn.com/claude-ai/IPtAfld1XUBVOx8m/images/mcp-apps/mobile-loading-states.png?fit=max\&auto=format\&n=IPtAfld1XUBVOx8m\&q=85\&s=9e7df0fa2294bbcbcc24bf079cbc5ff6) ## Visual design @@ -225,29 +225,29 @@ MCP Apps should feel native to their environment while maintaining consistent vi Use host tokens for all structural elements: backgrounds, text, borders, and icons. You can use your own brand colors for accents and identity, but the core UI should use the provided palette. -Color token examples for light and dark mode +![Color token examples for light and dark mode](https://mintcdn.com/claude-ai/IPtAfld1XUBVOx8m/images/mcp-apps/color-tokens.png?fit=max\&auto=format\&n=IPtAfld1XUBVOx8m\&q=85\&s=173ce1948ae87b9e72b0854b5d27f4e1) ### Typography Stick to the three-level size scale of heading, body, and caption, and the two weights of regular and emphasized. This creates clear hierarchy without visual noise. -Typography scale examples +![Typography scale examples](https://mintcdn.com/claude-ai/IPtAfld1XUBVOx8m/images/mcp-apps/typography.png?fit=max\&auto=format\&n=IPtAfld1XUBVOx8m\&q=85\&s=51ce152aab3d975ae57c5e5792dc6097) - - The Figma Community File uses Anthropic Sans and Anthropic Serif. When your app runs inside Claude, the host client provides Anthropic Sans at runtime through style variables. For local development, [download and install the fonts](https://brand.anthropic.com/typography). - +> [!NOTE] +> +> The Figma Community File uses Anthropic Sans and Anthropic Serif. When your app runs inside Claude, the host client provides Anthropic Sans at runtime through style variables. For local development, [download and install the fonts](https://brand.anthropic.com/typography). ### Borders Use a limited set of corner radii and border thicknesses to keep your app feeling native to the surrounding UI. -Border radius examples +![Border radius examples](https://mintcdn.com/claude-ai/IPtAfld1XUBVOx8m/images/mcp-apps/borders.png?fit=max\&auto=format\&n=IPtAfld1XUBVOx8m\&q=85\&s=1755cc995399c9d6bf25a1405ff139f4) ### Icons Use monochromatic, outlined icons that match the host's icon color tokens. Icons should support understanding rather than be essential to it. -Icon style examples +![Icon style examples](https://mintcdn.com/claude-ai/IXMfN0TT8kfXbN6T/images/mcp-apps/icons.png?fit=max\&auto=format\&n=IXMfN0TT8kfXbN6T\&q=85\&s=1454f1f3e5e13107cbe543e8d6d617df) ### Spacing diff --git a/content/claude/connectors/building/mcp-apps/external-links.md b/content/claude/connectors/building/mcp-apps/external-links.md index e0162e3e4d..e55b16ab69 100644 --- a/content/claude/connectors/building/mcp-apps/external-links.md +++ b/content/claude/connectors/building/mcp-apps/external-links.md @@ -59,9 +59,9 @@ Claude bypasses the modal only when the `ui/open-link` request follows a real us If your app sends `ui/open-link` without a preceding gesture, for example programmatically, on a timer, or after the browser's activation window has expired, Claude shows the modal so the user's confirmation click supplies the gesture the browser requires to open a new tab. - - A bypassed `ui/open-link` request resolves successfully once the open is attempted. It doesn't indicate whether the browser actually opened the tab, so don't treat the response as confirmation that the user reached the destination. - +> [!NOTE] +> +> A bypassed `ui/open-link` request resolves successfully once the open is attempted. It doesn't indicate whether the browser actually opened the tab, so don't treat the response as confirmation that the user reached the destination. ## Design for the modal diff --git a/content/claude/connectors/building/mcp-apps/getting-started.md b/content/claude/connectors/building/mcp-apps/getting-started.md index 59572b3f81..c610ec87d7 100644 --- a/content/claude/connectors/building/mcp-apps/getting-started.md +++ b/content/claude/connectors/building/mcp-apps/getting-started.md @@ -10,9 +10,9 @@ An MCP App is interactive UI that your MCP server renders inside a Claude conver This page is for developers who have an MCP server, or are building one, and want it to show UI in Claude. - - If you haven't built the server yet, see [Build an MCP server for Claude](/docs/connectors/building/index). - +> [!NOTE] +> +> If you haven't built the server yet, see [Build an MCP server for Claude](/docs/connectors/building/index). To see how an MCP App looks and behaves, [try an example in Claude Desktop](#try-an-example-mcp-app-in-claude-desktop) first, then [build your own](#build-your-own-mcp-app) from the SDK quickstart, the examples, or the agent skills. @@ -24,78 +24,74 @@ The MCP Apps repository publishes example servers that you run locally with `npx Connecting an example server means adding its entry to Claude Desktop's configuration file, so that the desktop app runs the server locally with `npx`. To connect one: - - - Install Claude Desktop and sign in. - - - - Go to [**Settings > Developer**](https://claude.ai/desktop/settings/desktop/developer) and click **Edit Config**. - - - - Add one of these example servers to your `claude_desktop_config.json`: - - | Example | Description | - | - | - | - | [Customer Segmentation](https://github.com/modelcontextprotocol/ext-apps/tree/main/examples/customer-segmentation-server) | Data visualization with scatter charts and clustering analysis | - | [Map](https://github.com/modelcontextprotocol/ext-apps/tree/main/examples/map-server) | Interactive 3D globe viewer using CesiumJS | - | [ShaderToy](https://github.com/modelcontextprotocol/ext-apps/tree/main/examples/shadertoy-server) | Real-time GLSL shader compilation and display | - | [Sheet Music](https://github.com/modelcontextprotocol/ext-apps/tree/main/examples/sheet-music-server) | ABC notation rendering with interactive audio playback | - - The MCP Apps repository has [more examples](https://github.com/modelcontextprotocol/ext-apps/tree/main/examples), each with a ready-to-use config snippet. The config entry for each example in the table runs its server with `npx`, which fetches the latest published version each time. Pin a version, such as `@modelcontextprotocol/server-map@2.0.1`, if you keep an entry beyond trying it out: - - - ```json Customer Segmentation theme={null} - { - "mcpServers": { - "customer-segmentation": { - "command": "npx", - "args": ["-y", "@modelcontextprotocol/server-customer-segmentation", "--stdio"] - } - } - } - ``` - - ```json Map theme={null} - { - "mcpServers": { - "map": { - "command": "npx", - "args": ["-y", "@modelcontextprotocol/server-map", "--stdio"] - } - } - } - ``` - - ```json ShaderToy theme={null} - { - "mcpServers": { - "shadertoy": { - "command": "npx", - "args": ["-y", "@modelcontextprotocol/server-shadertoy", "--stdio"] - } - } - } - ``` - - ```json Sheet Music theme={null} - { - "mcpServers": { - "sheet-music": { - "command": "npx", - "args": ["-y", "@modelcontextprotocol/server-sheet-music", "--stdio"] - } - } - } - ``` - - - - - Save the file and restart the desktop app to connect the server. - - +**1. Install Claude Desktop** + +Install Claude Desktop and sign in. + +**2. Open the configuration file** + +Go to [**Settings > Developer**](https://claude.ai/desktop/settings/desktop/developer) and click **Edit Config**. + +**3. Add an example server** + +Add one of these example servers to your `claude_desktop_config.json`: + +| Example | Description | +| - | - | +| [Customer Segmentation](https://github.com/modelcontextprotocol/ext-apps/tree/main/examples/customer-segmentation-server) | Data visualization with scatter charts and clustering analysis | +| [Map](https://github.com/modelcontextprotocol/ext-apps/tree/main/examples/map-server) | Interactive 3D globe viewer using CesiumJS | +| [ShaderToy](https://github.com/modelcontextprotocol/ext-apps/tree/main/examples/shadertoy-server) | Real-time GLSL shader compilation and display | +| [Sheet Music](https://github.com/modelcontextprotocol/ext-apps/tree/main/examples/sheet-music-server) | ABC notation rendering with interactive audio playback | + +The MCP Apps repository has [more examples](https://github.com/modelcontextprotocol/ext-apps/tree/main/examples), each with a ready-to-use config snippet. The config entry for each example in the table runs its server with `npx`, which fetches the latest published version each time. Pin a version, such as `@modelcontextprotocol/server-map@2.0.1`, if you keep an entry beyond trying it out: + +```json Customer Segmentation theme={null} +{ + "mcpServers": { + "customer-segmentation": { + "command": "npx", + "args": ["-y", "@modelcontextprotocol/server-customer-segmentation", "--stdio"] + } + } +} +``` + +```json Map theme={null} +{ + "mcpServers": { + "map": { + "command": "npx", + "args": ["-y", "@modelcontextprotocol/server-map", "--stdio"] + } + } +} +``` + +```json ShaderToy theme={null} +{ + "mcpServers": { + "shadertoy": { + "command": "npx", + "args": ["-y", "@modelcontextprotocol/server-shadertoy", "--stdio"] + } + } +} +``` + +```json Sheet Music theme={null} +{ + "mcpServers": { + "sheet-music": { + "command": "npx", + "args": ["-y", "@modelcontextprotocol/server-sheet-music", "--stdio"] + } + } +} +``` + +**4. Save and restart** + +Save the file and restart the desktop app to connect the server. ### Ask Claude to use the app @@ -112,7 +108,9 @@ To add an MCP App to your own MCP server, start from the SDK documentation and e * [SDK API documentation](https://modelcontextprotocol.github.io/ext-apps/api/index.html): full API reference * [Example implementations](https://github.com/modelcontextprotocol/ext-apps/tree/main/examples): vanilla JS, React, Vue, Svelte, and more -To test a remote MCP App locally, connect to it through a proxy such as [mcp-remote](https://www.npmjs.com/package/mcp-remote). +> [!TIP] +> +> To test a remote MCP App locally, connect to it through a proxy such as [mcp-remote](https://www.npmjs.com/package/mcp-remote). ### Register tools and resources once for every host diff --git a/content/claude/connectors/building/mcp-apps/quickstart.md b/content/claude/connectors/building/mcp-apps/quickstart.md index 81ea09a482..b148896108 100644 --- a/content/claude/connectors/building/mcp-apps/quickstart.md +++ b/content/claude/connectors/building/mcp-apps/quickstart.md @@ -10,11 +10,11 @@ An [MCP App](/docs/connectors/building/mcp-apps/getting-started) is interactive This quickstart is for developers who finished the first quickstart and have its server on their machine. It stops at what you can verify locally: seeing the UI render needs the server hosted where Claude can reach it, which the last section covers. - - * If you haven't built the quickstart server yet, start with [Build your first MCP server for Claude](/docs/connectors/building/quickstart) - * If you want to see finished MCP Apps running in Claude first, see [Try an example MCP App in Claude Desktop](/docs/connectors/building/mcp-apps/getting-started#try-an-example-mcp-app-in-claude-desktop) - * If you're adding UI to your own production server, see [Build your own MCP App](/docs/connectors/building/mcp-apps/getting-started#build-your-own-mcp-app) for the SDK documentation and full examples - +> [!NOTE] +> +> * If you haven't built the quickstart server yet, start with [Build your first MCP server for Claude](/docs/connectors/building/quickstart) +> * If you want to see finished MCP Apps running in Claude first, see [Try an example MCP App in Claude Desktop](/docs/connectors/building/mcp-apps/getting-started#try-an-example-mcp-app-in-claude-desktop) +> * If you're adding UI to your own production server, see [Build your own MCP App](/docs/connectors/building/mcp-apps/getting-started#build-your-own-mcp-app) for the SDK documentation and full examples ## Install the MCP Apps SDK @@ -43,103 +43,101 @@ On the server, an MCP App is a resource with a `ui://` URI whose content is the Make these edits to `server.mjs` in order. If you'd rather paste the whole file, it's in [The complete file](#the-complete-file) at the end of this section. - - - Add one import under the existing SDK imports at the top of `server.mjs`. `registerAppTool` and `registerAppResource` wrap the SDK's own `registerTool` and `registerResource` and fill in the UI metadata for you: - - ```js server.mjs {4} theme={null} - import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'; - import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js'; - import { createMcpExpressApp } from '@modelcontextprotocol/sdk/server/express.js'; - import { registerAppTool, registerAppResource, RESOURCE_MIME_TYPE } from '@modelcontextprotocol/ext-apps/server'; - import { z } from 'zod'; - ``` - - - - Below the imports and above `function buildServer()`, add the resource URI and the HTML the host will render. The HTML is ordinary markup plus one ` +`; +``` + +If you change the installed `ext-apps` version, change the version in the `unpkg.com` URL to match. + +**3. Link the tool to the UI** + +Inside `buildServer()`, replace the `server.registerTool(` call with `registerAppTool(server,` and make two additions, both highlighted: a `_meta.ui.resourceUri` entry that names the UI resource, and a `structuredContent` object in the result. The UI reads `structuredContent` to draw the dice, and the `content` text stays for hosts that don't render UI: + +```js server.mjs {1-2,11,17-18} theme={null} + registerAppTool( + server, + 'roll_dice', + { + title: 'Roll dice', + description: 'Roll `count` dice with `sides` sides each. Returns each roll and the total.', + inputSchema: { + sides: z.number().int().min(2).max(100).describe('Number of sides per die (2-100)'), + count: z.number().int().min(1).max(10).default(1).describe('How many dice to roll (1-10)'), + }, + _meta: { ui: { resourceUri: DICE_UI } }, // tells the host which resource renders this tool + }, + async ({ sides, count }) => { + const rolls = Array.from({ length: count }, () => 1 + Math.floor(Math.random() * sides)); + const total = rolls.reduce((a, b) => a + b, 0); + return { + content: [{ type: 'text', text: `Rolled ${count}d${sides}: [${rolls.join(', ')}] total=${total}` }], // text-only hosts read this + structuredContent: { sides, count, rolls, total }, // the UI reads this }; - // Set handlers before connect() so the first tool-input and tool-result notifications aren't missed. - app.ontoolinput = ({ arguments: args }) => { if (args) lastArgs = { ...lastArgs, ...args }; }; - app.ontoolresult = show; // the host pushes the tool result here; draw it - $("again").onclick = async () => show(await app.callServerTool({ name: "roll_dice", arguments: lastArgs })); - await app.connect(); // handshake with the host - - `; - ``` - - If you change the installed `ext-apps` version, change the version in the `unpkg.com` URL to match. - - - - Inside `buildServer()`, replace the `server.registerTool(` call with `registerAppTool(server,` and make two additions, both highlighted: a `_meta.ui.resourceUri` entry that names the UI resource, and a `structuredContent` object in the result. The UI reads `structuredContent` to draw the dice, and the `content` text stays for hosts that don't render UI: - - ```js server.mjs {1-2,11,17-18} theme={null} - registerAppTool( - server, - 'roll_dice', - { - title: 'Roll dice', - description: 'Roll `count` dice with `sides` sides each. Returns each roll and the total.', - inputSchema: { - sides: z.number().int().min(2).max(100).describe('Number of sides per die (2-100)'), - count: z.number().int().min(1).max(10).default(1).describe('How many dice to roll (1-10)'), - }, - _meta: { ui: { resourceUri: DICE_UI } }, // tells the host which resource renders this tool - }, - async ({ sides, count }) => { - const rolls = Array.from({ length: count }, () => 1 + Math.floor(Math.random() * sides)); - const total = rolls.reduce((a, b) => a + b, 0); - return { - content: [{ type: 'text', text: `Rolled ${count}d${sides}: [${rolls.join(', ')}] total=${total}` }], // text-only hosts read this - structuredContent: { sides, count, rolls, total }, // the UI reads this - }; - }, - ); - ``` - - - - Still inside `buildServer()`, before `return server;`, register the resource that serves the HTML. `registerAppResource` sets the MIME type an MCP App resource must have, `text/html;profile=mcp-app`, which the SDK exports as `RESOURCE_MIME_TYPE`. The highlighted `csp` line tells the host's sandbox to allow scripts from `unpkg.com`, because by default the frame only runs scripts that are inline or from its own origin, and the `App` import would be blocked. For production, serve the client script from your own origin, or bundle it into the HTML, and list only that origin in `resourceDomains`: - - ```js server.mjs {4,6} theme={null} - registerAppResource(server, 'Dice view', DICE_UI, { description: 'Interactive view for roll_dice' }, async () => ({ - contents: [{ - uri: DICE_UI, - mimeType: RESOURCE_MIME_TYPE, - text: DICE_HTML, - _meta: { ui: { csp: { resourceDomains: ['https://unpkg.com'] } } }, // let the sandbox load the App script - }], - })); - return server; - ``` - - + }, + ); +``` + +**4. Register the UI resource** + +Still inside `buildServer()`, before `return server;`, register the resource that serves the HTML. `registerAppResource` sets the MIME type an MCP App resource must have, `text/html;profile=mcp-app`, which the SDK exports as `RESOURCE_MIME_TYPE`. The highlighted `csp` line tells the host's sandbox to allow scripts from `unpkg.com`, because by default the frame only runs scripts that are inline or from its own origin, and the `App` import would be blocked. For production, serve the client script from your own origin, or bundle it into the HTML, and list only that origin in `resourceDomains`: + +```js server.mjs {4,6} theme={null} + registerAppResource(server, 'Dice view', DICE_UI, { description: 'Interactive view for roll_dice' }, async () => ({ + contents: [{ + uri: DICE_UI, + mimeType: RESOURCE_MIME_TYPE, + text: DICE_HTML, + _meta: { ui: { csp: { resourceDomains: ['https://unpkg.com'] } } }, // let the sandbox load the App script + }], + })); + return server; +``` Run `node --check server.mjs` to catch typos. It prints nothing when the file parses. @@ -147,169 +145,167 @@ Run `node --check server.mjs` to catch typos. It prints nothing when the file pa For reference, this is `server.mjs` with every edit applied. Everything below `buildServer()` is unchanged from the first quickstart. - - ```js server.mjs theme={null} - import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'; - import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js'; - import { createMcpExpressApp } from '@modelcontextprotocol/sdk/server/express.js'; - import { registerAppTool, registerAppResource, RESOURCE_MIME_TYPE } from '@modelcontextprotocol/ext-apps/server'; - import { z } from 'zod'; - - const DICE_UI = 'ui://quickstart/dice'; // MCP App resources use the ui:// scheme - - const DICE_HTML = ` - Dice - - -
Waiting for a roll…
-
- - - `; - - function buildServer() { - const server = new McpServer({ name: 'quickstart-server', version: '1.0.0' }); // the name Claude sees - - registerAppTool( - server, - 'roll_dice', - { - title: 'Roll dice', - description: 'Roll `count` dice with `sides` sides each. Returns each roll and the total.', - inputSchema: { - sides: z.number().int().min(2).max(100).describe('Number of sides per die (2-100)'), - count: z.number().int().min(1).max(10).default(1).describe('How many dice to roll (1-10)'), - }, - _meta: { ui: { resourceUri: DICE_UI } }, // tells the host which resource renders this tool - }, - async ({ sides, count }) => { - const rolls = Array.from({ length: count }, () => 1 + Math.floor(Math.random() * sides)); - const total = rolls.reduce((a, b) => a + b, 0); - return { - content: [{ type: 'text', text: `Rolled ${count}d${sides}: [${rolls.join(', ')}] total=${total}` }], // text-only hosts read this - structuredContent: { sides, count, rolls, total }, // the UI reads this - }; - }, - ); - - registerAppResource(server, 'Dice view', DICE_UI, { description: 'Interactive view for roll_dice' }, async () => ({ - contents: [{ - uri: DICE_UI, - mimeType: RESOURCE_MIME_TYPE, - text: DICE_HTML, - _meta: { ui: { csp: { resourceDomains: ['https://unpkg.com'] } } }, // let the sandbox load the App script - }], - })); - return server; - } - - // Streamable HTTP: every MCP message arrives as a POST to /mcp. Stateless, so each request gets a fresh server. - const app = createMcpExpressApp(); // Express app with JSON parsing and localhost protection built in - app.post('/mcp', async (req, res) => { - const server = buildServer(); - const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined }); // undefined = no sessions - res.on('close', () => { transport.close(); server.close(); }); - await server.connect(transport); - await transport.handleRequest(req, res, req.body); - }); - const notAllowed = (req, res) => res.status(405).json({ jsonrpc: '2.0', error: { code: -32000, message: 'Method not allowed.' }, id: null }); - app.get('/mcp', notAllowed); - app.delete('/mcp', notAllowed); - - const PORT = Number(process.env.PORT ?? 3000); - app.listen(PORT, '127.0.0.1', (err) => { // Express 5 reports a taken port here instead of throwing - if (err) { console.error(`failed to listen on ${PORT}: ${err.message}`); process.exit(1); } - console.log(`quickstart-server listening on http://localhost:${PORT}/mcp`); - }); - ``` - +> **server.mjs with the MCP App added** +> +> ```js server.mjs theme={null} +> import { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js'; +> import { StreamableHTTPServerTransport } from '@modelcontextprotocol/sdk/server/streamableHttp.js'; +> import { createMcpExpressApp } from '@modelcontextprotocol/sdk/server/express.js'; +> import { registerAppTool, registerAppResource, RESOURCE_MIME_TYPE } from '@modelcontextprotocol/ext-apps/server'; +> import { z } from 'zod'; +> +> const DICE_UI = 'ui://quickstart/dice'; // MCP App resources use the ui:// scheme +> +> const DICE_HTML = ` +> Dice +> +> +>
Waiting for a roll…
+>
+> +> +> `; +> +> function buildServer() { +> const server = new McpServer({ name: 'quickstart-server', version: '1.0.0' }); // the name Claude sees +> +> registerAppTool( +> server, +> 'roll_dice', +> { +> title: 'Roll dice', +> description: 'Roll `count` dice with `sides` sides each. Returns each roll and the total.', +> inputSchema: { +> sides: z.number().int().min(2).max(100).describe('Number of sides per die (2-100)'), +> count: z.number().int().min(1).max(10).default(1).describe('How many dice to roll (1-10)'), +> }, +> _meta: { ui: { resourceUri: DICE_UI } }, // tells the host which resource renders this tool +> }, +> async ({ sides, count }) => { +> const rolls = Array.from({ length: count }, () => 1 + Math.floor(Math.random() * sides)); +> const total = rolls.reduce((a, b) => a + b, 0); +> return { +> content: [{ type: 'text', text: `Rolled ${count}d${sides}: [${rolls.join(', ')}] total=${total}` }], // text-only hosts read this +> structuredContent: { sides, count, rolls, total }, // the UI reads this +> }; +> }, +> ); +> +> registerAppResource(server, 'Dice view', DICE_UI, { description: 'Interactive view for roll_dice' }, async () => ({ +> contents: [{ +> uri: DICE_UI, +> mimeType: RESOURCE_MIME_TYPE, +> text: DICE_HTML, +> _meta: { ui: { csp: { resourceDomains: ['https://unpkg.com'] } } }, // let the sandbox load the App script +> }], +> })); +> return server; +> } +> +> // Streamable HTTP: every MCP message arrives as a POST to /mcp. Stateless, so each request gets a fresh server. +> const app = createMcpExpressApp(); // Express app with JSON parsing and localhost protection built in +> app.post('/mcp', async (req, res) => { +> const server = buildServer(); +> const transport = new StreamableHTTPServerTransport({ sessionIdGenerator: undefined }); // undefined = no sessions +> res.on('close', () => { transport.close(); server.close(); }); +> await server.connect(transport); +> await transport.handleRequest(req, res, req.body); +> }); +> const notAllowed = (req, res) => res.status(405).json({ jsonrpc: '2.0', error: { code: -32000, message: 'Method not allowed.' }, id: null }); +> app.get('/mcp', notAllowed); +> app.delete('/mcp', notAllowed); +> +> const PORT = Number(process.env.PORT ?? 3000); +> app.listen(PORT, '127.0.0.1', (err) => { // Express 5 reports a taken port here instead of throwing +> if (err) { console.error(`failed to listen on ${PORT}: ${err.message}`); process.exit(1); } +> console.log(`quickstart-server listening on http://localhost:${PORT}/mcp`); +> }); +> ``` ## Check that the server advertises the UI A host discovers the UI from the `_meta` on the tool in `tools/list` and loads it from `resources/read`, and your server now returns both. You can see both with `curl` before any host is involved. - - - In the terminal where the server runs, press `Ctrl+C` to stop it, then start it again from the `mcp-quickstart` folder so it picks up your edits: +**1. Restart the server** - ```bash theme={null} - node server.mjs - ``` +In the terminal where the server runs, press `Ctrl+C` to stop it, then start it again from the `mcp-quickstart` folder so it picks up your edits: - It prints `quickstart-server listening on http://localhost:3000/mcp` as before. - +```bash theme={null} +node server.mjs +``` - - In your second terminal, list the tools again: +It prints `quickstart-server listening on http://localhost:3000/mcp` as before. - ```bash theme={null} - curl -sS -X POST http://localhost:3000/mcp \ - -H 'Content-Type: application/json' \ - -H 'Accept: application/json, text/event-stream' \ - -d '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}' - ``` +**2. Check the tool points at the UI** - The `roll_dice` entry now ends with a `_meta` object naming the resource. The helper also writes the same URI under the legacy flat key `ui/resourceUri`. The rest of the entry is shortened to `...` here: +In your second terminal, list the tools again: - ```text theme={null} - data: {"result":{"tools":[{"name":"roll_dice", ... ,"_meta":{"ui":{"resourceUri":"ui://quickstart/dice"},"ui/resourceUri":"ui://quickstart/dice"}}]},"jsonrpc":"2.0","id":2} - ``` - +```bash theme={null} +curl -sS -X POST http://localhost:3000/mcp \ + -H 'Content-Type: application/json' \ + -H 'Accept: application/json, text/event-stream' \ + -d '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}' +``` - - Fetch the resource the way a host does, by its `ui://` URI: +The `roll_dice` entry now ends with a `_meta` object naming the resource. The helper also writes the same URI under the legacy flat key `ui/resourceUri`. The rest of the entry is shortened to `...` here: - ```bash theme={null} - curl -sS -X POST http://localhost:3000/mcp \ - -H 'Content-Type: application/json' \ - -H 'Accept: application/json, text/event-stream' \ - -d '{"jsonrpc":"2.0","id":4,"method":"resources/read","params":{"uri":"ui://quickstart/dice"}}' - ``` +```text theme={null} +data: {"result":{"tools":[{"name":"roll_dice", ... ,"_meta":{"ui":{"resourceUri":"ui://quickstart/dice"},"ui/resourceUri":"ui://quickstart/dice"}}]},"jsonrpc":"2.0","id":2} +``` - The reply carries the MCP App MIME type and your HTML as `text`, shortened here after the opening tags: +**3. Read the UI resource** - ```text theme={null} - data: {"result":{"contents":[{"uri":"ui://quickstart/dice","mimeType":"text/html;profile=mcp-app","text":"\n ... - ``` - +Fetch the resource the way a host does, by its `ui://` URI: - - Call `roll_dice` once more: +```bash theme={null} +curl -sS -X POST http://localhost:3000/mcp \ + -H 'Content-Type: application/json' \ + -H 'Accept: application/json, text/event-stream' \ + -d '{"jsonrpc":"2.0","id":4,"method":"resources/read","params":{"uri":"ui://quickstart/dice"}}' +``` - ```bash theme={null} - curl -sS -X POST http://localhost:3000/mcp \ - -H 'Content-Type: application/json' \ - -H 'Accept: application/json, text/event-stream' \ - -d '{"jsonrpc":"2.0","id":5,"method":"tools/call","params":{"name":"roll_dice","arguments":{"sides":6,"count":4}}}' - ``` +The reply carries the MCP App MIME type and your HTML as `text`, shortened here after the opening tags: - The result has both the text block and the `structuredContent` object the UI draws from: +```text theme={null} +data: {"result":{"contents":[{"uri":"ui://quickstart/dice","mimeType":"text/html;profile=mcp-app","text":"\n ... +``` - ```text theme={null} - data: {"result":{"content":[{"type":"text","text":"Rolled 4d6: [1, 3, 1, 2] total=7"}],"structuredContent":{"sides":6,"count":4,"rolls":[1,3,1,2],"total":7}},"jsonrpc":"2.0","id":5} - ``` - - +**4. Call the tool and see the structured result** + +Call `roll_dice` once more: + +```bash theme={null} +curl -sS -X POST http://localhost:3000/mcp \ + -H 'Content-Type: application/json' \ + -H 'Accept: application/json, text/event-stream' \ + -d '{"jsonrpc":"2.0","id":5,"method":"tools/call","params":{"name":"roll_dice","arguments":{"sides":6,"count":4}}}' +``` + +The result has both the text block and the `structuredContent` object the UI draws from: + +```text theme={null} +data: {"result":{"content":[{"type":"text","text":"Rolled 4d6: [1, 3, 1, 2] total=7"}],"structuredContent":{"sides":6,"count":4,"rolls":[1,3,1,2],"total":7}},"jsonrpc":"2.0","id":5} +``` Claude Code still works with the server after these edits, as a text-only client: `claude mcp list` shows `quickstart` connected, and the same `claude -p` prompt from the first quickstart calls the tool and reports the rolls. One difference shows up in the `stream-json` output: because the tool now returns `structuredContent`, the `tool_result` Claude receives is that JSON object as a string, such as `{"sides":20,"count":3,"rolls":[7,11,12],"total":30}`, rather than your `content` text. diff --git a/content/claude/connectors/building/mcp-apps/transparent-theming.md b/content/claude/connectors/building/mcp-apps/transparent-theming.md index f7dbc86fcf..d51040000c 100644 --- a/content/claude/connectors/building/mcp-apps/transparent-theming.md +++ b/content/claude/connectors/building/mcp-apps/transparent-theming.md @@ -90,46 +90,44 @@ Keep the `` tag in your document head even though `app This example applies the theme, variables, and fonts on connect and again on every host context change: - - ```ts TypeScript theme={null} - import { - App, - applyDocumentTheme, - applyHostFonts, - applyHostStyleVariables, - type McpUiHostContext, - } from "@modelcontextprotocol/ext-apps"; - - function applyHostContext(ctx: Partial) { - if (ctx.theme) applyDocumentTheme(ctx.theme); - if (ctx.styles?.variables) applyHostStyleVariables(ctx.styles.variables); - if (ctx.styles?.css?.fonts) applyHostFonts(ctx.styles.css.fonts); - } - - const app = new App({ name: "my-app", version: "1.0.0" }); - - // Updates carry only the fields that changed. - app.addEventListener("hostcontextchanged", (changed) => applyHostContext(changed)); - - await app.connect(); - const initial = app.getHostContext(); - if (initial) applyHostContext(initial); - ``` - - ```tsx React theme={null} - import { useApp, useHostStyles } from "@modelcontextprotocol/ext-apps/react"; - - function Widget() { - const { app } = useApp({ - appInfo: { name: "my-app", version: "1.0.0" }, - capabilities: {}, - }); - // Applies theme + CSS variables + fonts, and re-applies on host-context-changed. - useHostStyles(app, app?.getHostContext()); - return
…
; - } - ``` - +```ts TypeScript theme={null} +import { + App, + applyDocumentTheme, + applyHostFonts, + applyHostStyleVariables, + type McpUiHostContext, +} from "@modelcontextprotocol/ext-apps"; + +function applyHostContext(ctx: Partial) { + if (ctx.theme) applyDocumentTheme(ctx.theme); + if (ctx.styles?.variables) applyHostStyleVariables(ctx.styles.variables); + if (ctx.styles?.css?.fonts) applyHostFonts(ctx.styles.css.fonts); +} + +const app = new App({ name: "my-app", version: "1.0.0" }); + +// Updates carry only the fields that changed. +app.addEventListener("hostcontextchanged", (changed) => applyHostContext(changed)); + +await app.connect(); +const initial = app.getHostContext(); +if (initial) applyHostContext(initial); +``` + +```tsx React theme={null} +import { useApp, useHostStyles } from "@modelcontextprotocol/ext-apps/react"; + +function Widget() { + const { app } = useApp({ + appInfo: { name: "my-app", version: "1.0.0" }, + capabilities: {}, + }); + // Applies theme + CSS variables + fonts, and re-applies on host-context-changed. + useHostStyles(app, app?.getHostContext()); + return
…
; +} +``` ### Reference the variables in your CSS @@ -146,9 +144,9 @@ body { } ``` - - Claude's token values use CSS `light-dark()`, so once `applyDocumentTheme` has set the root `color-scheme`, every `--color-*` variable resolves to the right variant without any `[data-theme]` selectors on your side. - +> [!NOTE] +> +> Claude's token values use CSS `light-dark()`, so once `applyDocumentTheme` has set the root `color-scheme`, every `--color-*` variable resolves to the right variant without any `[data-theme]` selectors on your side. ### Allow the host font origin in your CSP diff --git a/content/claude/connectors/building/mcp-apps/troubleshooting.md b/content/claude/connectors/building/mcp-apps/troubleshooting.md index b803619781..b7a1a6705d 100644 --- a/content/claude/connectors/building/mcp-apps/troubleshooting.md +++ b/content/claude/connectors/building/mcp-apps/troubleshooting.md @@ -16,21 +16,21 @@ Claude Desktop and the Claude iOS app both let you inspect a running MCP App wit Claude Desktop's Developer Tools can help you debug MCP Apps. To use them: - - - Open **Help > Troubleshooting** and click **Enable Developer Mode**. A new **Developer** menu appears in the menu bar. - +**1. Enable Developer Mode** - - Open Developer Tools by pressing `Cmd+Option+I` on Mac or `Ctrl+Shift+I` on Windows. - +Open **Help > Troubleshooting** and click **Enable Developer Mode**. A new **Developer** menu appears in the menu bar. - - Inspect the tool call element and look for an iframe nested inside another iframe. Your app is loaded as the content of the inner iframe. - - +**2. Open Developer Tools** -From the **Developer** menu, select **Reload MCP Configuration** after editing your `claude_desktop_config.json` to apply changes without restarting. +Open Developer Tools by pressing `Cmd+Option+I` on Mac or `Ctrl+Shift+I` on Windows. + +**3. Find your app's iframe** + +Inspect the tool call element and look for an iframe nested inside another iframe. Your app is loaded as the content of the inner iframe. + +> [!TIP] +> +> From the **Developer** menu, select **Reload MCP Configuration** after editing your `claude_desktop_config.json` to apply changes without restarting. ### iOS @@ -48,39 +48,39 @@ An invisible app under a visible tool call is the most common issue when develop Your app must call [`app.connect()`](https://modelcontextprotocol.github.io/ext-apps/api/classes/app.App.html#connect) in vanilla JS or [`useApp()`](https://modelcontextprotocol.github.io/ext-apps/api/functions/_modelcontextprotocol_ext-apps_react.useApp.html) in React to establish communication with Claude Desktop. Register your handlers before connecting: - - ```javascript Vanilla JS theme={null} - import { App } from "@modelcontextprotocol/ext-apps"; +```javascript Vanilla JS theme={null} +import { App } from "@modelcontextprotocol/ext-apps"; - const app = new App({ name: "My App", version: "1.0.0" }); +const app = new App({ name: "My App", version: "1.0.0" }); - // Register handlers before connecting - app.ontoolresult = (result) => { - // Handle tool results - }; +// Register handlers before connecting +app.ontoolresult = (result) => { + // Handle tool results +}; - await app.connect(); - ``` - - ```javascript React theme={null} - import { useApp } from "@modelcontextprotocol/ext-apps/react"; +await app.connect(); +``` - function MyComponent() { - // The useApp hook handles connection automatically - const { app } = useApp({ - appInfo: { name: "My App", version: "1.0.0" }, - capabilities: {}, - onAppCreated: (app) => { - app.ontoolresult = (result) => { - // Handle tool results - }; - } - }); - } - ``` - +```javascript React theme={null} +import { useApp } from "@modelcontextprotocol/ext-apps/react"; + +function MyComponent() { + // The useApp hook handles connection automatically + const { app } = useApp({ + appInfo: { name: "My App", version: "1.0.0" }, + capabilities: {}, + onAppCreated: (app) => { + app.ontoolresult = (result) => { + // Handle tool results + }; + } + }); +} +``` -Event handlers like `app.ontoolinput` and `app.ontoolresult` aren't invoked until the app is connected. +> [!WARNING] +> +> Event handlers like `app.ontoolinput` and `app.ontoolresult` aren't invoked until the app is connected. #### Iframe has zero height @@ -95,7 +95,9 @@ Check that your root element has explicit dimensions or content that gives it he When a tool result exceeds approximately 150,000 characters and Claude's code execution sandbox is active, Claude writes the result to the sandbox filesystem instead of passing it inline to the conversation. Your app receives a pointer to the stored file rather than the structured content it needs, so it never hydrates. -This \~150,000-character threshold is specific to claude.ai and Claude Desktop. Claude Code uses a separate 25,000-token default limit, configurable through `MAX_MCP_OUTPUT_TOKENS`. +> [!NOTE] +> +> This \~150,000-character threshold is specific to claude.ai and Claude Desktop. Claude Code uses a separate 25,000-token default limit, configurable through `MAX_MCP_OUTPUT_TOKENS`. To stay under the threshold, keep initial tool result payloads lean: @@ -111,7 +113,9 @@ WebKit on iOS, in both Safari and the Claude iOS app, omits the `Referer` header To fix the iOS failures, allowlist on the `Origin` header instead of `Referer`, because WebKit does send `Origin`. Requests from your app carry an `Origin` of `{hash}.claudemcpcontent.com`, and [Set `ui.domain` for Claude](/docs/connectors/building/mcp-apps/getting-started#set-ui-domain-for-claude) shows how to compute the hash for your server URL. Configure your infrastructure to allow requests whose `Origin` matches `*.claudemcpcontent.com` and return a corresponding `Access-Control-Allow-Origin` header. -The missing `Referer` header affects requests your app makes directly from the user's device, such as loading bundles and images or calling your own API from client-side code. MCP tool calls are proxied through Claude's backend and egress from Anthropic's published IP ranges, not the user's device. +> [!NOTE] +> +> The missing `Referer` header affects requests your app makes directly from the user's device, such as loading bundles and images or calling your own API from client-side code. MCP tool calls are proxied through Claude's backend and egress from Anthropic's published IP ranges, not the user's device. ### `ui.domain` validation fails diff --git a/content/claude/connectors/building/mcpb.md b/content/claude/connectors/building/mcpb.md index 59ea9023de..59fa6caaab 100644 --- a/content/claude/connectors/building/mcpb.md +++ b/content/claude/connectors/building/mcpb.md @@ -12,10 +12,10 @@ This page is for developers packaging a local MCP server for Claude Desktop, whe For a directory listing, build a remote MCP server, which reaches people on every surface, or include the local server in a plugin, as [Decide what to include in your plugin](/docs/connectors/building/what-to-build) explains. - - * If you're building a remote server, see [Build an MCP server for Claude](/docs/connectors/building/index) - * If you're deploying desktop extensions across a Team or Enterprise organization, see [Install a local connector in the desktop app](/docs/connectors/custom/add-unlisted#install-a-local-connector-in-the-desktop-app) - +> [!NOTE] +> +> * If you're building a remote server, see [Build an MCP server for Claude](/docs/connectors/building/index) +> * If you're deploying desktop extensions across a Team or Enterprise organization, see [Install a local connector in the desktop app](/docs/connectors/custom/add-unlisted#install-a-local-connector-in-the-desktop-app) ## Decide when to build an MCPB @@ -71,39 +71,37 @@ See the [manifest spec compatibility section](https://github.com/modelcontextpro The MCPB CLI generates the manifest and packs the bundle. - - - ```bash theme={null} - npm install -g @anthropic-ai/mcpb - ``` - - - - Build a stdio MCP server using the [MCP SDK](https://www.npmjs.com/package/@modelcontextprotocol/sdk). - - - - ```bash theme={null} - mcpb init - ``` - - - - ```bash theme={null} - mcpb pack - ``` - - - - Double-click the generated `.mcpb` file. - - +**1. Install the MCPB CLI** + +```bash theme={null} +npm install -g @anthropic-ai/mcpb +``` + +**2. Create your MCP server** + +Build a stdio MCP server using the [MCP SDK](https://www.npmjs.com/package/@modelcontextprotocol/sdk). + +**3. Generate the manifest** + +```bash theme={null} +mcpb init +``` + +**4. Bundle** + +```bash theme={null} +mcpb pack +``` + +**5. Install and test in Claude Desktop** + +Double-click the generated `.mcpb` file. For detailed implementation guidance, see the [MCPB repository](https://github.com/modelcontextprotocol/mcpb), the [examples directory](https://github.com/modelcontextprotocol/mcpb/tree/main/examples) including a Hello World, and the [README "For Bundle Developers" section](https://github.com/modelcontextprotocol/mcpb/blob/main/README.md). - - Before distributing your MCPB, review the testing and best-practices guidance in the MCPB README to ensure quality. - +> [!WARNING] +> +> Before distributing your MCPB, review the testing and best-practices guidance in the MCPB README to ensure quality. ## Configure manifest.json diff --git a/content/claude/connectors/building/quickstart.md b/content/claude/connectors/building/quickstart.md index 67b42804a5..f762683fb0 100644 --- a/content/claude/connectors/building/quickstart.md +++ b/content/claude/connectors/building/quickstart.md @@ -10,11 +10,11 @@ An MCP server is a program that gives Claude tools it can call, and people who u This quickstart is for developers who haven't built an MCP server before and want to see every piece working before they add authentication, hosting, and real tools. - - * If you already have a server and want to know what Claude's client supports, see [Build an MCP server for Claude](/docs/connectors/building/index) - * If your server is running and you want to try it in Claude, see [Test your connector](/docs/connectors/building/testing) - * If you want to package skills and an existing connector rather than write a server, see [Build your first plugin](/docs/plugins/quickstart) - +> [!NOTE] +> +> * If you already have a server and want to know what Claude's client supports, see [Build an MCP server for Claude](/docs/connectors/building/index) +> * If your server is running and you want to try it in Claude, see [Test your connector](/docs/connectors/building/testing) +> * If you want to package skills and an existing connector rather than write a server, see [Build your first plugin](/docs/plugins/quickstart) ## Before you begin @@ -29,43 +29,41 @@ Check that you have each of these: The project is a folder with a `package.json` and two dependencies: the [MCP TypeScript SDK](https://github.com/modelcontextprotocol/typescript-sdk), which also works from plain JavaScript, and `zod`, which the SDK uses to describe tool inputs. - - - In your terminal, create a folder named `mcp-quickstart` and move into it. Every later command on this page runs from this folder: +**1. Make a folder for the server** - ```bash theme={null} - mkdir mcp-quickstart - cd mcp-quickstart - ``` - +In your terminal, create a folder named `mcp-quickstart` and move into it. Every later command on this page runs from this folder: - - Create a default `package.json`, then set `"type": "module"` in it so Node.js treats the project's files as ES modules: +```bash theme={null} +mkdir mcp-quickstart +cd mcp-quickstart +``` + +**2. Create package.json** + +Create a default `package.json`, then set `"type": "module"` in it so Node.js treats the project's files as ES modules: + +```bash theme={null} +npm init -y +npm pkg set type=module +``` - ```bash theme={null} - npm init -y - npm pkg set type=module - ``` - +**3. Install the SDK** - - Install the SDK and `zod`. You don't install a web framework separately, because the SDK depends on Express and gives you a ready-made app for it: +Install the SDK and `zod`. You don't install a web framework separately, because the SDK depends on Express and gives you a ready-made app for it: - ```bash theme={null} - npm install @modelcontextprotocol/sdk zod - ``` +```bash theme={null} +npm install @modelcontextprotocol/sdk zod +``` - To confirm what installed, run `npm ls --depth=0`. The output lists the two packages and their versions: +To confirm what installed, run `npm ls --depth=0`. The output lists the two packages and their versions: - ```text theme={null} - mcp-quickstart@1.0.0 /path/to/mcp-quickstart - +-- @modelcontextprotocol/sdk@1.30.1 - `-- zod@4.6.5 - ``` +```text theme={null} +mcp-quickstart@1.0.0 /path/to/mcp-quickstart ++-- @modelcontextprotocol/sdk@1.30.1 +`-- zod@4.6.5 +``` - This page was verified with those versions. - - +This page was verified with those versions. ## Write the server @@ -135,135 +133,131 @@ Each part of the file has one job: Before you involve Claude, start the server and send it MCP requests yourself with `curl`, so you know it works on its own. - - - In your first terminal, from the `mcp-quickstart` folder, start the server: +**1. Start the server** - ```bash theme={null} - node server.mjs - ``` +In your first terminal, from the `mcp-quickstart` folder, start the server: - It prints the address it's listening on and keeps running: +```bash theme={null} +node server.mjs +``` - ```text theme={null} - quickstart-server listening on http://localhost:3000/mcp - ``` +It prints the address it's listening on and keeps running: - Leave this terminal open. If you see `failed to listen on 3000` instead, another program is using the port. Stop that program and run the command again. - +```text theme={null} +quickstart-server listening on http://localhost:3000/mcp +``` - - In your second terminal, ask the server what tools it has. This is the same `tools/list` request Claude sends when it connects. The `Accept` header is required, and the server answers `406 Not Acceptable` without it: +Leave this terminal open. If you see `failed to listen on 3000` instead, another program is using the port. Stop that program and run the command again. - ```bash theme={null} - curl -sS -X POST http://localhost:3000/mcp \ - -H 'Content-Type: application/json' \ - -H 'Accept: application/json, text/event-stream' \ - -d '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}' - ``` +**2. List the server's tools** - The reply is one server-sent event whose `data` line lists `roll_dice` with the title, description, and input schema you wrote. The `inputSchema` object is shortened to `...` here: +In your second terminal, ask the server what tools it has. This is the same `tools/list` request Claude sends when it connects. The `Accept` header is required, and the server answers `406 Not Acceptable` without it: + +```bash theme={null} +curl -sS -X POST http://localhost:3000/mcp \ + -H 'Content-Type: application/json' \ + -H 'Accept: application/json, text/event-stream' \ + -d '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}' +``` + +The reply is one server-sent event whose `data` line lists `roll_dice` with the title, description, and input schema you wrote. The `inputSchema` object is shortened to `...` here: + +```text theme={null} +event: message +data: {"result":{"tools":[{"name":"roll_dice","title":"Roll dice","description":"Roll `count` dice with `sides` sides each. Returns each roll and the total.","inputSchema":{...},"execution":{"taskSupport":"forbidden"}}]},"jsonrpc":"2.0","id":2} +``` - ```text theme={null} - event: message - data: {"result":{"tools":[{"name":"roll_dice","title":"Roll dice","description":"Roll `count` dice with `sides` sides each. Returns each roll and the total.","inputSchema":{...},"execution":{"taskSupport":"forbidden"}}]},"jsonrpc":"2.0","id":2} - ``` - +**3. Call the tool** - - Call `roll_dice` directly with three 20-sided dice, which is the `tools/call` request Claude sends when it uses the tool: +Call `roll_dice` directly with three 20-sided dice, which is the `tools/call` request Claude sends when it uses the tool: - ```bash theme={null} - curl -sS -X POST http://localhost:3000/mcp \ - -H 'Content-Type: application/json' \ - -H 'Accept: application/json, text/event-stream' \ - -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"roll_dice","arguments":{"sides":20,"count":3}}}' - ``` +```bash theme={null} +curl -sS -X POST http://localhost:3000/mcp \ + -H 'Content-Type: application/json' \ + -H 'Accept: application/json, text/event-stream' \ + -d '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"roll_dice","arguments":{"sides":20,"count":3}}}' +``` - The `data` line carries the text your handler returned, with your own random rolls: +The `data` line carries the text your handler returned, with your own random rolls: - ```text theme={null} - event: message - data: {"result":{"content":[{"type":"text","text":"Rolled 3d20: [16, 10, 20] total=46"}]},"jsonrpc":"2.0","id":3} - ``` - - +```text theme={null} +event: message +data: {"result":{"content":[{"type":"text","text":"Rolled 3d20: [16, 10, 20] total=46"}]},"jsonrpc":"2.0","id":3} +``` ## Connect the server to Claude Code With the server answering on its own, register it with Claude Code and have Claude call the tool from a prompt. Run these commands in your second terminal from the `mcp-quickstart` folder, because `claude mcp add` saves the server for the current project folder by default, and Claude Code only sees it when you run from that same folder. - - - Register the server under the name `quickstart`, with the HTTP transport and the local URL: +**1. Add the server to Claude Code** - ```bash theme={null} - claude mcp add --transport http quickstart http://localhost:3000/mcp - ``` +Register the server under the name `quickstart`, with the HTTP transport and the local URL: - Claude Code confirms where it saved the entry: +```bash theme={null} +claude mcp add --transport http quickstart http://localhost:3000/mcp +``` - ```text theme={null} - Added HTTP MCP server quickstart with URL: http://localhost:3000/mcp to local config - ``` - +Claude Code confirms where it saved the entry: - - List your servers. Claude Code connects to each one to check its health: +```text theme={null} +Added HTTP MCP server quickstart with URL: http://localhost:3000/mcp to local config +``` - ```bash theme={null} - claude mcp list - ``` +**2. Check the connection** - A working server shows as connected: +List your servers. Claude Code connects to each one to check its health: - ```text theme={null} - Checking MCP server health… +```bash theme={null} +claude mcp list +``` - quickstart: http://localhost:3000/mcp (HTTP) - ✔ Connected - ``` +A working server shows as connected: - If it shows an error instead, check that `node server.mjs` is still running in the first terminal. - +```text theme={null} +Checking MCP server health… - - Send Claude one prompt with [`claude -p`](https://code.claude.com/docs/en/headless), which runs a single prompt without opening an interactive session and prints the answer. Claude Code names MCP tools `mcp____`, so your tool is `mcp__quickstart__roll_dice`, and `--allowedTools` lets Claude call it without stopping to ask you: +quickstart: http://localhost:3000/mcp (HTTP) - ✔ Connected +``` - ```bash theme={null} - claude -p "Roll three 20-sided dice using the quickstart server and tell me each roll and the total." \ - --allowedTools "mcp__quickstart__roll_dice" - ``` +If it shows an error instead, check that `node server.mjs` is still running in the first terminal. - Claude calls your server and reports the rolls it got back: +**3. Ask Claude to roll dice** - ```text theme={null} - Rolled 3d20 via the quickstart server: +Send Claude one prompt with [`claude -p`](https://code.claude.com/docs/en/headless), which runs a single prompt without opening an interactive session and prints the answer. Claude Code names MCP tools `mcp____`, so your tool is `mcp__quickstart__roll_dice`, and `--allowedTools` lets Claude call it without stopping to ask you: - - Roll 1: **12** - - Roll 2: **4** - - Roll 3: **5** +```bash theme={null} +claude -p "Roll three 20-sided dice using the quickstart server and tell me each roll and the total." \ + --allowedTools "mcp__quickstart__roll_dice" +``` + +Claude calls your server and reports the rolls it got back: - **Total: 21** - ``` - +```text theme={null} +Rolled 3d20 via the quickstart server: - - To see the tool call itself rather than Claude's summary of it, run the same prompt with streaming JSON output. `--output-format stream-json` needs `--verbose` alongside it: +- Roll 1: **12** +- Roll 2: **4** +- Roll 3: **5** - ```bash theme={null} - claude -p "Roll three 20-sided dice using the quickstart server and tell me each roll and the total." \ - --allowedTools "mcp__quickstart__roll_dice" \ - --output-format stream-json --verbose - ``` +**Total: 21** +``` - The output is one JSON object per line, and other tool calls can appear before yours. Look for the `tool_use` block whose `name` is `mcp__quickstart__roll_dice`, carrying the arguments Claude chose, and the `tool_result` block after it carrying your server's text, shown here with the surrounding fields removed: +**4. Confirm the tool ran** - ```text theme={null} - {"type":"tool_use","name":"mcp__quickstart__roll_dice","input":{"count":3,"sides":20}, ...} - {"type":"tool_result","content":[{"type":"text","text":"Rolled 3d20: [9, 14, 5] total=28"}], ...} - ``` - - +To see the tool call itself rather than Claude's summary of it, run the same prompt with streaming JSON output. `--output-format stream-json` needs `--verbose` alongside it: + +```bash theme={null} +claude -p "Roll three 20-sided dice using the quickstart server and tell me each roll and the total." \ + --allowedTools "mcp__quickstart__roll_dice" \ + --output-format stream-json --verbose +``` + +The output is one JSON object per line, and other tool calls can appear before yours. Look for the `tool_use` block whose `name` is `mcp__quickstart__roll_dice`, carrying the arguments Claude chose, and the `tool_result` block after it carrying your server's text, shown here with the surrounding fields removed: + +```text theme={null} +{"type":"tool_use","name":"mcp__quickstart__roll_dice","input":{"count":3,"sides":20}, ...} +{"type":"tool_result","content":[{"type":"text","text":"Rolled 3d20: [9, 14, 5] total=28"}], ...} +``` In an interactive `claude` session you can ask the same thing in your own words. Without `--allowedTools`, Claude Code asks for your permission before it calls `roll_dice`. diff --git a/content/claude/connectors/building/review-criteria.md b/content/claude/connectors/building/review-criteria.md index 4c79780452..bae62335b6 100644 --- a/content/claude/connectors/building/review-criteria.md +++ b/content/claude/connectors/building/review-criteria.md @@ -8,9 +8,9 @@ This checklist covers what Anthropic checks on an MCP connector submitted to the directory, organized around the most common rejection reasons so you can correct them before you submit. It's for connector authors preparing a [directory submission](/docs/connectors/building/submission). For the full legal text behind these criteria, see the [Software Directory Policy](https://support.claude.com/en/articles/13145358-anthropic-software-directory-policy). - - If you're submitting a plugin, see the [plugin pre-submission checklist](/docs/plugins/pre-submission-checklist) instead. - +> [!NOTE] +> +> If you're submitting a plugin, see the [plugin pre-submission checklist](/docs/plugins/pre-submission-checklist) instead. Work through [tool design](#design-tools-that-pass-review), [server behavior](#server-behavior-and-scope), and [what to include with your submission](#gather-what-to-include-with-your-submission), then [test every tool](#test-before-you-submit) before you open the portal. [How Anthropic reviews connectors](#understand-how-anthropic-reviews-connectors) covers the Community and Verified labels. diff --git a/content/claude/connectors/building/submission.md b/content/claude/connectors/building/submission.md index b09bba3bed..9dcb183a5b 100644 --- a/content/claude/connectors/building/submission.md +++ b/content/claude/connectors/building/submission.md @@ -10,9 +10,9 @@ You submit a remote MCP server to the [Connectors Directory](/docs/connectors/di This page is for connector authors who are ready to submit. It starts with a [checklist](#pre-submission-checklist-for-connectors), then covers [where to submit your connector](#choose-where-to-submit-your-connector), the [requirements every submission must meet](#meet-the-submission-requirements), and [what to have ready for each step of the portal](#submit-through-the-developer-portal). [Connector review criteria](/docs/connectors/building/review-criteria) explains what reviewers look for in your tools and server, so read it alongside the checklist. - - If you're submitting a plugin rather than a connector, see [Submit a plugin](/docs/plugins/submit) instead. - +> [!NOTE] +> +> If you're submitting a plugin rather than a connector, see [Submit a plugin](/docs/plugins/submit) instead. ## Pre-submission checklist for connectors @@ -86,9 +86,9 @@ The privacy policy must cover: * Data retention * Contact information - - Missing or incomplete privacy policies result in immediate rejection. - +> [!WARNING] +> +> Missing or incomplete privacy policies result in immediate rejection. ### Allowed link URIs @@ -133,49 +133,47 @@ The developer portal at [claude.ai/directory/manage](https://claude.ai/directory Your progress saves automatically in your browser as you move between steps, so within a browser session you can return to earlier steps without losing work. Each step asks for the following: - - - Connect the server you're submitting, by pasting its `https://` URL or choosing a custom connector you've already added to Claude. If your users connect to different URLs, select **Users connect to different URLs** and choose **Multiple URLs** or **URL pattern**. - +**1. Connection** - - Your server's tools, prompts, and resources sync automatically from the connected server, grouped by whether their annotations declare them read-only or write. If any tools are flagged for missing titles or annotations, fix them on your server before submitting. - +Connect the server you're submitting, by pasting its `https://` URL or choosing a custom connector you've already added to Claude. If your users connect to different URLs, select **Users connect to different URLs** and choose **Multiple URLs** or **URL pattern**. - - The public-facing listing: server name up to 100 characters, one-liner up to 200 characters, description up to 2,000 characters, one to five categories, documentation URL, privacy policy URL, support contact, icon, and the URL slug for your listing page. The slug is permanent once published. - +**2. Tools** - - The primary use cases, what users need before they can connect, such as accounts, plans, or other setup, and whether the connector reads data, writes data, or both. - +Your server's tools, prompts, and resources sync automatically from the connected server, grouped by whether their annotations declare them read-only or write. If any tools are flagged for missing titles or annotations, fix them on your server before submitting. - - Company name and website, plus a primary contact for review updates. - +**3. Listing** - - How users authenticate: OAuth with dynamic client registration, client ID metadata documents, or Anthropic-held client credentials; a custom connection where users supply their own URL or credentials at connection time; or no authentication. [Authentication](/docs/connectors/building/authentication) covers which modes are supported directly and which need coordination with the review team. If your server starts without authentication and individual tools prompt for it on demand, you can flag that here. +The public-facing listing: server name up to 100 characters, one-liner up to 200 characters, description up to 2,000 characters, one to five categories, documentation URL, privacy policy URL, support contact, icon, and the URL slug for your listing page. The slug is permanent once published. - If you chose **URL pattern** in the Connection step, Anthropic-held client credentials can't be used. If you chose **Multiple URLs**, a custom connection can't be used. - +**4. Use cases** - - Whether the underlying API is your own, proxied from a partner with permission, or a third party's you don't control, and whether the connector handles personal health data or sponsored content. - +The primary use cases, what users need before they can connect, such as accounts, plans, or other setup, and whether the connector reads data, writes data, or both. - - Test-account setup and access instructions detailed enough for a reviewer to connect to your server and run its tools: every link, credential, and step, including credentials for a fully populated account where relevant. You also confirm you've run every tool yourself, either through MCP Inspector or as a custom connector in Claude. - +**5. Company** - - Seven policy acknowledgments covering the directory guidelines, first-party API usage, financial transactions, AI media generation, prompt injection, conversation data collection, and public documentation. All seven are required. - +Company name and website, plus a primary contact for review updates. - - Everything you've entered, for a final check before you submit. Any quality warnings, such as very short answers, appear here and are shared with the review team alongside your submission. - - +**6. Authentication** + +How users authenticate: OAuth with dynamic client registration, client ID metadata documents, or Anthropic-held client credentials; a custom connection where users supply their own URL or credentials at connection time; or no authentication. [Authentication](/docs/connectors/building/authentication) covers which modes are supported directly and which need coordination with the review team. If your server starts without authentication and individual tools prompt for it on demand, you can flag that here. + +If you chose **URL pattern** in the Connection step, Anthropic-held client credentials can't be used. If you chose **Multiple URLs**, a custom connection can't be used. + +**7. Data handling** + +Whether the underlying API is your own, proxied from a partner with permission, or a third party's you don't control, and whether the connector handles personal health data or sponsored content. + +**8. Test & launch** + +Test-account setup and access instructions detailed enough for a reviewer to connect to your server and run its tools: every link, credential, and step, including credentials for a fully populated account where relevant. You also confirm you've run every tool yourself, either through MCP Inspector or as a custom connector in Claude. + +**9. Compliance** + +Seven policy acknowledgments covering the directory guidelines, first-party API usage, financial transactions, AI media generation, prompt injection, conversation data collection, and public documentation. All seven are required. + +**10. Review and submit** + +Everything you've entered, for a final check before you submit. Any quality warnings, such as very short answers, appear here and are shared with the review team alongside your submission. ## After you submit diff --git a/content/claude/connectors/building/testing.md b/content/claude/connectors/building/testing.md index 304acae441..2eeaf8ac3c 100644 --- a/content/claude/connectors/building/testing.md +++ b/content/claude/connectors/building/testing.md @@ -30,9 +30,9 @@ If your server uses the TypeScript SDK's `createMcpExpressApp()`, as the [quicks const app = createMcpExpressApp({ allowedHosts: ['localhost', '127.0.0.1', 'abc123.example.com'] }); ``` - - A tunnel exposes your local server to the public internet. Keep authentication enabled on your server while tunneling, and shut the tunnel down when you're done testing. - +> [!WARNING] +> +> A tunnel exposes your local server to the public internet. Keep authentication enabled on your server while tunneling, and shut the tunnel down when you're done testing. ### Validate with MCP Inspector diff --git a/content/claude/connectors/building/troubleshooting.md b/content/claude/connectors/building/troubleshooting.md index 432bc32665..d5bfb614db 100644 --- a/content/claude/connectors/building/troubleshooting.md +++ b/content/claude/connectors/building/troubleshooting.md @@ -100,27 +100,25 @@ If your authorization server is Microsoft Entra ID and the token request fails w **How to fix:** Register the MCP server URL on the API app registration: - - - In the [Microsoft Entra admin center](https://entra.microsoft.com), open the app registration that represents your protected API. If you have separate registrations for the OAuth client and the API, this is the API registration, not the client. - +**1. Open the API app registration** - - Under **Expose an API**, add your MCP server URL as an additional [Application ID URI](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-configure-app-expose-web-apis). The value must match exactly, including the path, without a trailing slash. - +In the [Microsoft Entra admin center](https://entra.microsoft.com), open the app registration that represents your protected API. If you have separate registrations for the OAuth client and the API, this is the API registration, not the client. - - If your server validates the token audience, such as through Azure App Service Authentication, add the API app's Application (client) ID and its `api://` URI to the allowed token audiences so your server accepts tokens issued for the API. This is the **Allowed token audiences** setting, not **Allowed client applications**, which is a different list. - +**2. Add the MCP server URL as an Application ID URI** - - If the OAuth client and the API are separate app registrations, confirm the client has an admin-consented API permission for the scope your API exposes. - - +Under **Expose an API**, add your MCP server URL as an additional [Application ID URI](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-configure-app-expose-web-apis). The value must match exactly, including the path, without a trailing slash. - - By default, Microsoft Entra accepts a new Application ID URI only if it contains your tenant ID, your app ID, or a domain verified in your tenant, as described in [Microsoft's identifier URI restrictions](https://learn.microsoft.com/en-us/entra/identity-platform/identifier-uri-restrictions). If your MCP server runs on a platform hostname, such as `*.azurewebsites.net`, Entra rejects that URL when you add it under **Expose an API**, so serve the server from a custom domain that your tenant has verified and register that URL instead. A tenant administrator can also exempt your app registration from this policy so that Entra accepts a noncompliant URI. Microsoft notes that an `https://` URI can require a verified domain even then, which makes the custom domain the dependable fix. - +**3. Allow the API's token audiences** + +If your server validates the token audience, such as through Azure App Service Authentication, add the API app's Application (client) ID and its `api://` URI to the allowed token audiences so your server accepts tokens issued for the API. This is the **Allowed token audiences** setting, not **Allowed client applications**, which is a different list. + +**4. Confirm the client's API permission** + +If the OAuth client and the API are separate app registrations, confirm the client has an admin-consented API permission for the scope your API exposes. + +> [!NOTE] +> +> By default, Microsoft Entra accepts a new Application ID URI only if it contains your tenant ID, your app ID, or a domain verified in your tenant, as described in [Microsoft's identifier URI restrictions](https://learn.microsoft.com/en-us/entra/identity-platform/identifier-uri-restrictions). If your MCP server runs on a platform hostname, such as `*.azurewebsites.net`, Entra rejects that URL when you add it under **Expose an API**, so serve the server from a custom domain that your tenant has verified and register that URL instead. A tenant administrator can also exempt your app registration from this policy so that Entra accepts a noncompliant URI. Microsoft notes that an `https://` URI can require a verified domain even then, which makes the custom domain the dependable fix. If the OAuth flow completes successfully on your server, meaning you see the token issued in your logs, but the connection still fails, file a [GitHub issue](https://github.com/anthropics/claude-ai-mcp/issues) with the `ofid_` reference ID and the timestamps from your server's OAuth logs. @@ -130,15 +128,13 @@ This error, followed by the name of the tool, appears when your connector shows **How to check:** Compare the failing call inside and outside Claude: - - - Run the same tool call against your server in [MCP Inspector](https://modelcontextprotocol.io/docs/tools/inspector) and compare the result with the error Claude reports. - +**1. Run the call in MCP Inspector** - - Check your server's logs for the tool handler's error at the time of the failure, and whether the failure affects every user of your connector or one account. - - +Run the same tool call against your server in [MCP Inspector](https://modelcontextprotocol.io/docs/tools/inspector) and compare the result with the error Claude reports. + +**2. Check your server's logs** + +Check your server's logs for the tool handler's error at the time of the failure, and whether the failure affects every user of your connector or one account. If none of these is the cause, [report the problem](#report-the-problem-to-anthropic) with the tool name and the time of the failure. @@ -146,35 +142,33 @@ If none of these is the cause, [report the problem](#report-the-problem-to-anthr The checklist covers every cause on this page in the order Claude encounters them during a connection. Run through it before filing an issue. - - - From a network outside your own, confirm `dig +short your-server.example.com` returns a globally routable address. - +**1. Public DNS resolution** + +From a network outside your own, confirm `dig +short your-server.example.com` returns a globally routable address. + +**2. Public reachability** + +From a public network, confirm `curl -i https://your-server.example.com/your-mcp-path` returns a response. A `401` or `405` is fine, and a timeout or connection refused is not. + +**3. No redirect** + +Run `curl -sI https://your-server.example.com/your-mcp-path` and confirm the response is not a `3xx` redirect to a different host. If it is, register the redirect target instead. + +**4. No WAF block** + +Check your edge logs for `403` or `429` responses. Allowlist Anthropic's published egress range if needed. See the [IP address reference](https://platform.claude.com/docs/en/api/ip-addresses). - - From a public network, confirm `curl -i https://your-server.example.com/your-mcp-path` returns a response. A `401` or `405` is fine, and a timeout or connection refused is not. - +**5. Discovery metadata** - - Run `curl -sI https://your-server.example.com/your-mcp-path` and confirm the response is not a `3xx` redirect to a different host. If it is, register the redirect target instead. - +Confirm `/.well-known/oauth-protected-resource` returns `200` with valid JSON, and that one of `/.well-known/oauth-authorization-server` or `/.well-known/openid-configuration` does the same. Only one is needed. The authorization server metadata should include a `registration_endpoint` (DCR) or advertise `"client_id_metadata_document_supported": true` (CIMD), or you should be using pre-registered credentials, and it should advertise `"code_challenge_methods_supported": ["S256"]`. - - Check your edge logs for `403` or `429` responses. Allowlist Anthropic's published egress range if needed. See the [IP address reference](https://platform.claude.com/docs/en/api/ip-addresses). - +**6. Cross-host hint** - - Confirm `/.well-known/oauth-protected-resource` returns `200` with valid JSON, and that one of `/.well-known/oauth-authorization-server` or `/.well-known/openid-configuration` does the same. Only one is needed. The authorization server metadata should include a `registration_endpoint` (DCR) or advertise `"client_id_metadata_document_supported": true` (CIMD), or you should be using pre-registered credentials, and it should advertise `"code_challenge_methods_supported": ["S256"]`. - +If your authorization server is on a different host than your MCP server, confirm your protected resource metadata's `authorization_servers` field points at it, and that the authorization server's host is reachable from Anthropic's egress range and answers `/.well-known/openid-configuration` or `/.well-known/oauth-authorization-server`. See [Serve discovery metadata](/docs/connectors/building/authentication#serve-discovery-metadata). - - If your authorization server is on a different host than your MCP server, confirm your protected resource metadata's `authorization_servers` field points at it, and that the authorization server's host is reachable from Anthropic's egress range and answers `/.well-known/openid-configuration` or `/.well-known/oauth-authorization-server`. See [Serve discovery metadata](/docs/connectors/building/authentication#serve-discovery-metadata). - +**7. Collect the reference ID** - - Reproduce the failure and copy the `ofid_` value from the error URL, then [report the problem](#report-the-problem-to-anthropic) with it. - - +Reproduce the failure and copy the `ofid_` value from the error URL, then [report the problem](#report-the-problem-to-anthropic) with it. ## Report the problem to Anthropic diff --git a/content/claude/connectors/building/what-to-build.md b/content/claude/connectors/building/what-to-build.md index 8d4bf43118..423daa6b8b 100644 --- a/content/claude/connectors/building/what-to-build.md +++ b/content/claude/connectors/building/what-to-build.md @@ -17,10 +17,10 @@ A plugin with only a connector or only skills is complete. This page is for developers deciding which of those pieces their plugin needs. Once you've decided, [Plugin structure and testing](/docs/plugins/build), [Build an MCP server for Claude](/docs/connectors/building/index), and [Publish to the directory](/docs/directory/publish) cover the work. - - * If you're choosing what to add to your own Claude rather than what to build, see [Connectors, skills, and plugins](/docs/extend/overview), which compares the three from the user's side - * If you're building for your own organization and not listing publicly, the same decisions apply, and you distribute the result as a [custom connector](/docs/connectors/custom/add-unlisted#add-a-connector-by-url) and an [organization plugin](/docs/plugins/admin) instead of through the directory - +> [!NOTE] +> +> * If you're choosing what to add to your own Claude rather than what to build, see [Connectors, skills, and plugins](/docs/extend/overview), which compares the three from the user's side +> * If you're building for your own organization and not listing publicly, the same decisions apply, and you distribute the result as a [custom connector](/docs/connectors/custom/add-unlisted#add-a-connector-by-url) and an [organization plugin](/docs/plugins/admin) instead of through the directory ## Reach your product with an MCP connector @@ -54,9 +54,7 @@ When you list the plugin, submit the server too: the plugin as a plugin bundle a The diagram shows what the server and the plugin each give people. The server gives them your connector. The plugin adds your skills and points to that same server. -Diagram in two columns. Left, what you ship: 1, a remote MCP server you host, with your tools; 2, a plugin holding a connector entry with your server's URL and skills that teach Claude how to use your product. Right, what people get: your connector, so Claude can reach your product, and your skills, so Claude uses it the way you intend, in Chat, Cowork, and Claude Code. Three straight arrows: from the server across to your connector, labeled people connect to it; from the plugin's connector entry up to the server, labeled points to the same server; and from the plugin's skills across to your skills, labeled people add the plugin. - -Diagram in two columns. Left, what you ship: 1, a remote MCP server you host, with your tools; 2, a plugin holding a connector entry with your server's URL and skills that teach Claude how to use your product. Right, what people get: your connector, so Claude can reach your product, and your skills, so Claude uses it the way you intend, in Chat, Cowork, and Claude Code. Three straight arrows: from the server across to your connector, labeled people connect to it; from the plugin's connector entry up to the server, labeled points to the same server; and from the plugin's skills across to your skills, labeled people add the plugin. +![Diagram in two columns. Left, what you ship: 1, a remote MCP server you host, with your tools; 2, a plugin holding a connector entry with your server's URL and skills that teach Claude how to use your product. Right, what people get: your connector, so Claude can reach your product, and your skills, so Claude uses it the way you intend, in Chat, Cowork, and Claude Code. Three straight arrows: from the server across to your connector, labeled people connect to it; from the plugin's connector entry up to the server, labeled points to the same server; and from the plugin's skills across to your skills, labeled people add the plugin.](https://mintcdn.com/claude-ai/-njlLvrWxFCRdJVz/images/extend/what-you-ship.svg?fit=max\&auto=format\&n=-njlLvrWxFCRdJVz\&q=85\&s=532adf863a7d27314b67c68b561ee94d) In a plugin, you reference a remote MCP server by URL. If a user has both your directory connector and your plugin installed, Claude sees one set of tools, because the plugin and the connector point at the same server. diff --git a/content/claude/connectors/custom/add-unlisted.md b/content/claude/connectors/custom/add-unlisted.md index 8194927fdb..81c652618d 100644 --- a/content/claude/connectors/custom/add-unlisted.md +++ b/content/claude/connectors/custom/add-unlisted.md @@ -10,11 +10,11 @@ You can connect Claude to a [Model Context Protocol (MCP)](/docs/connectors/buil This page is for people adding a connector to their own Claude and for Team and Enterprise Owners adding one for their organization. - - * If you want a service that's already in the directory, see the [Connectors Directory](/docs/connectors/directory) and connect it from there - * If you're building the server yourself, see [Build an MCP server for Claude](/docs/connectors/building/index) - * If your server runs inside your private network, see [MCP tunnels](/docs/connectors/mcp-tunnels/overview) - +> [!NOTE] +> +> * If you want a service that's already in the directory, see the [Connectors Directory](/docs/connectors/directory) and connect it from there +> * If you're building the server yourself, see [Build an MCP server for Claude](/docs/connectors/building/index) +> * If your server runs inside your private network, see [MCP tunnels](/docs/connectors/mcp-tunnels/overview) If you have a server URL, go to [Add a connector by URL](#add-a-connector-by-url). If you have a desktop extension, go to [Install a local connector in the desktop app](#install-a-local-connector-in-the-desktop-app). @@ -31,9 +31,9 @@ A connector by URL suits internet-hosted services and public APIs. A desktop ext You can add any third-party connector as a custom connector as long as you have the URL of its remote MCP server. On Team and Enterprise plans, an Owner adds the connector for the organization, and members then connect with their own account. - - Custom connectors allow connections to unverified services. Claude can access and perform actions within these services, so review [Security and privacy](#security-and-privacy) before you add one. - +> [!WARNING] +> +> Custom connectors allow connections to unverified services. Claude can access and perform actions within these services, so review [Security and privacy](#security-and-privacy) before you add one. ### On a Team or Enterprise plan @@ -43,71 +43,65 @@ An Owner adds the connector for the organization. On Enterprise plans, a member Adding the connector in organization settings makes it appear under [**Customize > Connectors**](https://claude.ai/customize/connectors) for members, with the **Custom** label. To add it: - - - Go to [**Organization settings > Connectors**](https://claude.ai/admin-settings/connectors). - +**1. Open organization connectors** - - Select **Add**, then **Custom**. If Claude asks for the connector type, choose **Web**. - +Go to [**Organization settings > Connectors**](https://claude.ai/admin-settings/connectors). - - Enter the remote MCP server URL. - +**2. Add a custom connector** - - Optionally, enter an OAuth client ID and secret. See [Choose authentication settings](#choose-authentication-settings). - +Select **Add**, then **Custom**. If Claude asks for the connector type, choose **Web**. - - Click **Add**. - - +**3. Enter the server URL** + +Enter the remote MCP server URL. + +**4. Enter OAuth credentials if needed** + +Optionally, enter an OAuth client ID and secret. See [Choose authentication settings](#choose-authentication-settings). + +**5. Add the connector** + +Click **Add**. #### Connect as a member Once an Owner has added the connector, each member connects to it with their own account: - - - Go to **Customize > Connectors**. - +**1. Open Customize > Connectors** + +Go to **Customize > Connectors**. - - Find the connector with the **Custom** label. - +**2. Find the custom connector** - - Click **Connect** to authenticate. - - +Find the connector with the **Custom** label. + +**3. Connect** + +Click **Connect** to authenticate. ### On a Free, Pro, or Max plan You add custom connectors to your own account. On the Free plan, you can add one custom connector. - - - Go to **Customize > Connectors**. - +**1. Open Customize > Connectors** + +Go to **Customize > Connectors**. + +**2. Add a custom connector** + +Click **Add custom connector**. + +**3. Enter the server URL** - - Click **Add custom connector**. - +Enter the remote MCP server URL. - - Enter the remote MCP server URL. - +**4. Enter OAuth credentials if needed** - - Optionally, enter OAuth credentials. See [Choose authentication settings](#choose-authentication-settings). - +Optionally, enter OAuth credentials. See [Choose authentication settings](#choose-authentication-settings). - - Click **Add**. - - +**5. Add the connector** + +Click **Add**. ### Choose authentication settings @@ -133,9 +127,9 @@ Change **Advanced > Transport** only if the server's documentation says to. A UR ### Authenticate with request headers - - Request header authentication is in beta and available to a limited set of organizations. If you don't see the **Request headers** section in the **Add custom connector** dialog, your organization doesn't have access yet. - +> [!NOTE] +> +> Request header authentication is in beta and available to a limited set of organizations. If you don't see the **Request headers** section in the **Add custom connector** dialog, your organization doesn't have access yet. If your MCP server authenticates with an API key, bearer token, or other fixed credential instead of OAuth, configure it in the **Request headers** section of the **Add custom connector** dialog. Claude stores each header value securely, doesn't show it again after you save, and sends it on every request to your server. @@ -147,27 +141,25 @@ You can also use request headers in addition to OAuth, including OAuth with your A request header holds a fixed credential, such as an API key, that Claude stores and sends on every request to your server. To add one: - - - In the **Add custom connector** dialog, open **Request headers**. - +**1. Open Request headers** + +In the **Add custom connector** dialog, open **Request headers**. + +**2. Choose the header name** + +Select a header name from the list, or choose **Custom header** to enter a different name. The list offers standard authentication and routing header names such as `authorization`, `x-api-key`, and `x-auth-token`, which every connector can use. + +**3. Enter the value** + +Enter the header value exactly as your server expects to receive it. - - Select a header name from the list, or choose **Custom header** to enter a different name. The list offers standard authentication and routing header names such as `authorization`, `x-api-key`, and `x-auth-token`, which every connector can use. - +**4. Mark it required or optional** - - Enter the header value exactly as your server expects to receive it. - +Choose whether the header is **Required**. When a required header has no stored value at connection time, the connection fails. When an optional header has no value, Claude omits it from the request. - - Choose whether the header is **Required**. When a required header has no stored value at connection time, the connection fails. When an optional header has no value, Claude omits it from the request. - +**5. Add more headers and save** - - Repeat for any additional headers your server needs, then click **Add**. You can add up to four headers. - - +Repeat for any additional headers your server needs, then click **Add**. You can add up to four headers. Anthropic reviews and approves each custom header name before Claude sends it to a third-party server. This review prevents connector configuration from being used to send arbitrary header names. If you enter a header name that isn't approved, Claude rejects the save with an error. To request approval for a custom header name, contact [Claude support](https://support.claude.com/en/articles/9015913-how-to-get-support). @@ -190,19 +182,17 @@ You can turn each connector on or off for a single conversation. Click the **+** You can edit a connector's name or URL, or remove the connector: - - - Go to **Customize > Connectors**. If you're a Team or Enterprise Owner, go to **Organization settings > Connectors** instead. - +**1. Open your connectors** - - Click **Remove**, or select the three-dot menu. - +Go to **Customize > Connectors**. If you're a Team or Enterprise Owner, go to **Organization settings > Connectors** instead. - - Follow the prompts. - - +**2. Remove or open the menu** + +Click **Remove**, or select the three-dot menu. + +**3. Follow the prompts** + +Follow the prompts. You can't change authentication settings after you add a connector. That covers OAuth credentials and request headers. To change them, remove the connector and add it again with the new details. Members then need to reconnect. @@ -214,19 +204,17 @@ You can install a desktop extension in the Claude desktop app when you're signed To install an extension you have as a `.mcpb` file: - - - In the Claude desktop app, go to **Settings > Extensions**. - +**1. Open Settings > Extensions** + +In the Claude desktop app, go to **Settings > Extensions**. + +**2. Drag in the file** + +Drag the `.mcpb` file onto the page. Claude opens a preview of the extension. - - Drag the `.mcpb` file onto the page. Claude opens a preview of the extension. - +**3. Install** - - Select **Install**, then confirm. - - +Select **Install**, then confirm. The extension then appears in the list on the **Extensions** page. diff --git a/content/claude/connectors/directory.md b/content/claude/connectors/directory.md index 7b63f38f00..388777cbda 100644 --- a/content/claude/connectors/directory.md +++ b/content/claude/connectors/directory.md @@ -10,9 +10,9 @@ The Connectors Directory is a catalog of [MCP](/docs/connectors/building/mcp) se The directory contains both verified connectors and community connectors. Verification isn't a security audit. [Connector verification](/docs/connectors/verification) explains what each label means. - - All connectors in the directory are subject to the [Anthropic Software Directory Policy](https://support.claude.com/en/articles/13145358-anthropic-software-directory-policy) and the [Anthropic Software Directory Terms](https://support.claude.com/en/articles/13145338-anthropic-software-directory-terms). - +> [!NOTE] +> +> All connectors in the directory are subject to the [Anthropic Software Directory Policy](https://support.claude.com/en/articles/13145358-anthropic-software-directory-policy) and the [Anthropic Software Directory Terms](https://support.claude.com/en/articles/13145338-anthropic-software-directory-terms). ## Understand how the directory works @@ -58,19 +58,17 @@ To move to the new endpoint, remove the connector and re-add it from the directo Organizations can submit their MCP servers for review and inclusion in the directory: - - - Review the [submission guidelines](/docs/connectors/building/submission). - +**1. Review the submission guidelines** - - Ensure your server meets security and compatibility standards. - +Review the [submission guidelines](/docs/connectors/building/submission). - - Submit through the developer portal at [claude.ai/directory/manage](https://claude.ai/directory/manage). - - +**2. Meet the standards** + +Ensure your server meets security and compatibility standards. + +**3. Submit in the developer portal** + +Submit through the developer portal at [claude.ai/directory/manage](https://claude.ai/directory/manage). Anyone on a paid Claude plan can submit, and on Team and Enterprise an Owner submits; see [who can submit to the directory](/docs/directory/publish#confirm-you-can-submit-to-the-directory) for the role and organization requirements. After publication, the same dashboard shows your server's health and usage; see [Manage your directory listing](/docs/connectors/building/managing-your-listing). diff --git a/content/claude/connectors/getting-started.md b/content/claude/connectors/getting-started.md index 799e29f0d6..30229e523c 100644 --- a/content/claude/connectors/getting-started.md +++ b/content/claude/connectors/getting-started.md @@ -12,11 +12,11 @@ This page is for anyone who wants to add a connector to their own Claude account If you already know which connector you want, open [**Customize > Connectors**](https://claude.ai/customize/connectors) and follow [Add a connector from the directory](#add-a-connector-from-the-directory). - - * If the service you want isn't in the directory and you have its server URL, see [Add a connector that isn't in the directory](/docs/connectors/custom/add-unlisted#add-a-connector-by-url) - * If you're building a connector, see [Build an MCP server for Claude](/docs/connectors/building/index) - * If you're a Team or Enterprise Owner deciding which connectors your organization offers, see [Browse the directory](/docs/connectors/directory#browse-the-directory) to add them from organization settings and handle member requests - +> [!NOTE] +> +> * If the service you want isn't in the directory and you have its server URL, see [Add a connector that isn't in the directory](/docs/connectors/custom/add-unlisted#add-a-connector-by-url) +> * If you're building a connector, see [Build an MCP server for Claude](/docs/connectors/building/index) +> * If you're a Team or Enterprise Owner deciding which connectors your organization offers, see [Browse the directory](/docs/connectors/directory#browse-the-directory) to add them from organization settings and handle member requests ## Before you begin @@ -31,59 +31,55 @@ On Team and Enterprise plans, an Owner adds a connector for the organization, an The Connectors directory lists the connectors that Anthropic and other providers offer. You reach it from **Customize**, the page in claude.ai and the desktop app that holds your connectors, skills, and plugins. - - - Go to [**Customize > Connectors**](https://claude.ai/customize/connectors). In the desktop app, select **Customize** in the sidebar, then **Connectors**. - +**1. Open the Connectors page** - - Select **Discover** to browse the directory. Enter a service name in **Search connectors**, or look through the categories, then select a connector to open its page. +Go to [**Customize > Connectors**](https://claude.ai/customize/connectors). In the desktop app, select **Customize** in the sidebar, then **Connectors**. - Each listing carries a Verified or Community label. [Connector verification](/docs/connectors/verification) explains what each one means. - +**2. Find the connector** - - Select **Connect to Claude**. Some connectors first ask for details such as a server URL or the region your account is hosted in. Enter them and continue. +Select **Discover** to browse the directory. Enter a service name in **Search connectors**, or look through the categories, then select a connector to open its page. - On a Team or Enterprise plan, what you see depends on whether the connector has been added for your organization: +Each listing carries a Verified or Community label. [Connector verification](/docs/connectors/verification) explains what each one means. - * If it hasn't, you see **Request** or a note to ask an organization Owner instead of a connect button. [Request a connector on a Team plan](/docs/connectors/directory#request-a-connector-on-a-team-plan) covers what happens next - * If you're an Owner, the button reads **Connect for your team** and adds the connector for everyone in your organization. You then connect your own account with **Connect to Claude**. To try the connector without adding it for everyone, select the arrow next to **Connect for your team**, then **Connect just for me** - +**3. Start the connection** - - Claude takes you to the service's sign-in page: +Select **Connect to Claude**. Some connectors first ask for details such as a server URL or the region your account is hosted in. Enter them and continue. - * On claude.ai, the page opens in the same browser tab - * In the desktop app, the page opens in your browser +On a Team or Enterprise plan, what you see depends on whether the connector has been added for your organization: - Sign in, review the access Claude asks for, and approve it. +* If it hasn't, you see **Request** or a note to ask an organization Owner instead of a connect button. [Request a connector on a Team plan](/docs/connectors/directory#request-a-connector-on-a-team-plan) covers what happens next +* If you're an Owner, the button reads **Connect for your team** and adds the connector for everyone in your organization. You then connect your own account with **Connect to Claude**. To try the connector without adding it for everyone, select the arrow next to **Connect for your team**, then **Connect just for me** - A connector that doesn't use sign-in connects as soon as you select the button, with no page to visit. - +**4. Sign in to the service** - - When sign-in finishes and you're back on the **Connectors** page, the connector is listed under **Your connectors** with the status **Connected**. - - +Claude takes you to the service's sign-in page: + +* On claude.ai, the page opens in the same browser tab +* In the desktop app, the page opens in your browser + +Sign in, review the access Claude asks for, and approve it. + +A connector that doesn't use sign-in connects as soon as you select the button, with no page to visit. + +**5. Confirm the connection** + +When sign-in finishes and you're back on the **Connectors** page, the connector is listed under **Your connectors** with the status **Connected**. ## Use the connector in a conversation A connected connector is available in your conversations on the web, desktop, and mobile. You choose in each conversation whether Claude can use it. - - - In a new or existing chat, select **+** in the message box and select **Connectors**. The connector you connected is in the list with a toggle next to it. The toggle controls whether Claude can use the connector in this conversation. If it's off, turn it on. - +**1. Make sure the connector is on** + +In a new or existing chat, select **+** in the message box and select **Connectors**. The connector you connected is in the list with a toggle next to it. The toggle controls whether Claude can use the connector in this conversation. If it's off, turn it on. + +**2. Ask for something the service holds** + +Send a message that needs the service, such as "What's on my calendar tomorrow afternoon?" for a calendar connector or "Summarize the open issues assigned to me" for an issue tracker. - - Send a message that needs the service, such as "What's on my calendar tomorrow afternoon?" for a calendar connector or "Summarize the open issues assigned to me" for an issue tracker. - +**3. Approve the tool call** - - Claude can ask for your approval before it uses one of the connector's tools. Select **Allow once** to continue, or **Always allow** to skip the prompt for that tool from now on. You can change this later under the connector's [tool permissions](#manage-or-disconnect-a-connector). - - +Claude can ask for your approval before it uses one of the connector's tools. Select **Allow once** to continue, or **Always allow** to skip the prompt for that tool from now on. You can change this later under the connector's [tool permissions](#manage-or-disconnect-a-connector). To stop Claude from using a connector in a conversation, turn its toggle off in the same **+** menu. The connector stays connected: Claude is still signed in to the service on your account, and you can turn the toggle back on in any conversation. To sign Claude out of the service entirely, [disconnect the connector](#manage-or-disconnect-a-connector). diff --git a/content/claude/connectors/github.md b/content/claude/connectors/github.md index a9eaaaeed6..e253ac363f 100644 --- a/content/claude/connectors/github.md +++ b/content/claude/connectors/github.md @@ -10,77 +10,71 @@ The GitHub integration lets you add a GitHub repository to a conversation, or fi By the end of this page you have added repository content to a chat or a project and asked Claude about it. Claude reads file names and contents only: it doesn't see commit history, pull requests, or issues. - - If you want Claude to edit code, run commands, and open pull requests in your repository, see [Claude Code](https://code.claude.com/docs). - +> [!NOTE] +> +> If you want Claude to edit code, run commands, and open pull requests in your repository, see [Claude Code](https://code.claude.com/docs). ## Add repository content You can add repository content to a single conversation, or to a [project](https://support.claude.com/en/articles/9517075-what-are-projects), a workspace in Claude where a set of chats share the same background documents. Choose the tab below for where you want the content available. - - - In a chat, the **Add from GitHub** option appears only after your GitHub account is connected to Claude. To connect your GitHub account, follow these steps: +**In a chat** - 1. Go to [**Customize > Connectors**](https://claude.ai/customize/connectors). - 2. Select **GitHub Integration**. - 3. Select **Connect**. +In a chat, the **Add from GitHub** option appears only after your GitHub account is connected to Claude. To connect your GitHub account, follow these steps: - After your GitHub account is connected, add a repository to a chat: +1. Go to [**Customize > Connectors**](https://claude.ai/customize/connectors). +2. Select **GitHub Integration**. +3. Select **Connect**. - - - In the conversation, select **+** at the lower left of the message box. - +After your GitHub account is connected, add a repository to a chat: - - Select **Add from GitHub**. - +**1. Open the add menu** - - Search the repositories you have access to, or paste a repository URL. - +In the conversation, select **+** at the lower left of the message box. - - Select **Add repository**. Claude adds the repository's URL to your message. - +**2. Choose GitHub** - - Send your question. - - - +Select **Add from GitHub**. - - You can add repository content only to a private project, one you haven't shared with other people. In a shared project, the **GitHub** option is dimmed and shows **Only accessible from private projects**. +**3. Pick a repository** - If your GitHub account isn't connected to Claude yet, selecting **GitHub** sends you to GitHub to sign in before you continue. +Search the repositories you have access to, or paste a repository URL. - - - Open the project and, in its project knowledge section, select **+**. - +**4. Add the repository** - - Select **GitHub**. - +Select **Add repository**. Claude adds the repository's URL to your message. - - Search the repositories you have access to, or paste a repository URL. - +**5. Send your message** - - Use the file browser to select the files and folders you want Claude to read. - +Send your question. - - Select **Add files**. - - +**In a project** - The selected content is added to the project's knowledge. - - +You can add repository content only to a private project, one you haven't shared with other people. In a shared project, the **GitHub** option is dimmed and shows **Only accessible from private projects**. + +If your GitHub account isn't connected to Claude yet, selecting **GitHub** sends you to GitHub to sign in before you continue. + +**1. Open project knowledge** + +Open the project and, in its project knowledge section, select **+**. + +**2. Choose GitHub** + +Select **GitHub**. + +**3. Pick a repository** + +Search the repositories you have access to, or paste a repository URL. + +**4. Select files and folders** + +Use the file browser to select the files and folders you want Claude to read. + +**5. Add the files** + +Select **Add files**. + +The selected content is added to the project's knowledge. ## Grant Claude access to a private repository diff --git a/content/claude/connectors/google/calendar.md b/content/claude/connectors/google/calendar.md index 415ed02c59..546524afca 100644 --- a/content/claude/connectors/google/calendar.md +++ b/content/claude/connectors/google/calendar.md @@ -10,27 +10,25 @@ The Google Calendar connector lets Claude read your calendar so it can answer qu By the end of this page you have connected your Google account and asked Claude a first question about your schedule. Claude reads your calendar only; it can't create or change events or send invitations. - - If your organization uses Outlook or Teams calendars, see [Microsoft 365](/docs/connectors/microsoft/365) instead. - +> [!NOTE] +> +> If your organization uses Outlook or Teams calendars, see [Microsoft 365](/docs/connectors/microsoft/365) instead. ## Connect Google Calendar You connect Google Calendar once from your connector settings, and Claude can then read your calendar in any conversation where you turn the connector on. - - - Go to [**Customize > Connectors**](https://claude.ai/customize/connectors) in claude.ai. **Customize** is the page that holds your connectors, skills, and plugins. - +**1. Open your connectors** - - Find **Google Calendar** in the list and select **Connect**. - +Go to [**Customize > Connectors**](https://claude.ai/customize/connectors) in claude.ai. **Customize** is the page that holds your connectors, skills, and plugins. - - Sign in to your Google account and grant the requested permissions. - - +**2. Connect Google Calendar** + +Find **Google Calendar** in the list and select **Connect**. + +**3. Sign in to Google** + +Sign in to your Google account and grant the requested permissions. When the connection succeeds, the **Connect** button on the Google Calendar connector changes to **Disconnect**. diff --git a/content/claude/connectors/google/drive.md b/content/claude/connectors/google/drive.md index 9b89671b97..acf72e870f 100644 --- a/content/claude/connectors/google/drive.md +++ b/content/claude/connectors/google/drive.md @@ -10,27 +10,25 @@ The Google Drive connector lets Claude search your Google Drive, read the files To get going, [connect Google Drive](#connect-google-drive) and then [try a first question](#try-the-connector). - - If you want Claude to search your email or calendar rather than your files, see [Gmail](/docs/connectors/google/gmail) or [Google Calendar](/docs/connectors/google/calendar). - +> [!NOTE] +> +> If you want Claude to search your email or calendar rather than your files, see [Gmail](/docs/connectors/google/gmail) or [Google Calendar](/docs/connectors/google/calendar). ## Connect Google Drive You connect Google Drive once from your connector settings, and Claude can then use it in any conversation where you turn the connector on. - - - Go to [**Customize > Connectors**](https://claude.ai/customize/connectors) in claude.ai. **Customize** is the page that holds your connectors, skills, and plugins. - +**1. Open your connectors** - - Find **Google Drive** in the list and select **Connect**. - +Go to [**Customize > Connectors**](https://claude.ai/customize/connectors) in claude.ai. **Customize** is the page that holds your connectors, skills, and plugins. - - Sign in to your Google account and grant the requested permissions. - - +**2. Connect Google Drive** + +Find **Google Drive** in the list and select **Connect**. + +**3. Sign in to Google** + +Sign in to your Google account and grant the requested permissions. When the connection succeeds, the **Connect** button on the Google Drive connector changes to **Disconnect**. @@ -59,47 +57,41 @@ Two limits apply to every type: Besides letting Claude search on its own, you can pick specific Drive files yourself. A file you pick is attached to the conversation, or added to a [project](https://support.claude.com/en/articles/9517075-what-are-projects)'s knowledge so every chat in that project can use it. The picker lists your Google Docs, Sheets, and Slides. - - - - - In the conversation, select **+** at the lower left of the message box. - - - - Select **Add from Google Drive**. - - - - Search for the file by name, or select it from the list. - - - - Write your question and send it. Claude reads the file's current content from Drive each time you send a message, so later edits in Drive reach Claude too. - - - - - - You can add Drive files only to a private project, one you haven't shared with other people. In a shared project, the **Google Drive** option is dimmed and shows **Only accessible from private projects**. To add a file to a private project's knowledge: - - - - Open the project and, in its knowledge section, select **Add files**. - - - - Select **Google Drive**. - - - - Search for the file, paste its Google Drive URL, or select it from the list. - - - - The file appears in the project's knowledge and is available to Claude in every chat in that project. Its content refreshes from Drive periodically when you open the project. - - +**In a chat** + +**1. Open the add menu** + +In the conversation, select **+** at the lower left of the message box. + +**2. Choose Google Drive** + +Select **Add from Google Drive**. + +**3. Pick a file** + +Search for the file by name, or select it from the list. + +**4. Send your message** + +Write your question and send it. Claude reads the file's current content from Drive each time you send a message, so later edits in Drive reach Claude too. + +**In a project** + +You can add Drive files only to a private project, one you haven't shared with other people. In a shared project, the **Google Drive** option is dimmed and shows **Only accessible from private projects**. To add a file to a private project's knowledge: + +**1. Open the add menu** + +Open the project and, in its knowledge section, select **Add files**. + +**2. Choose Google Drive** + +Select **Google Drive**. + +**3. Pick a file** + +Search for the file, paste its Google Drive URL, or select it from the list. + +The file appears in the project's knowledge and is available to Claude in every chat in that project. Its content refreshes from Drive periodically when you open the project. Claude receives a text version of each file you add this way: diff --git a/content/claude/connectors/google/gmail.md b/content/claude/connectors/google/gmail.md index 49ddb522d5..72b48351cc 100644 --- a/content/claude/connectors/google/gmail.md +++ b/content/claude/connectors/google/gmail.md @@ -10,27 +10,25 @@ The Gmail connector lets Claude search your email and answer questions from what By the end of this page you have connected your Google account and asked Claude a first question about your email. Claude reads and searches email only; it can't create, send, or modify messages. - - If your organization uses Outlook, see [Microsoft 365](/docs/connectors/microsoft/365) instead. - +> [!NOTE] +> +> If your organization uses Outlook, see [Microsoft 365](/docs/connectors/microsoft/365) instead. ## Connect Gmail You connect Gmail once from your connector settings, and Claude can then search your email in any conversation where you turn the connector on. - - - Go to [**Customize > Connectors**](https://claude.ai/customize/connectors) in claude.ai. **Customize** is the page that holds your connectors, skills, and plugins. - +**1. Open your connectors** - - Find **Gmail** in the list and select **Connect**. - +Go to [**Customize > Connectors**](https://claude.ai/customize/connectors) in claude.ai. **Customize** is the page that holds your connectors, skills, and plugins. - - Sign in to your Google account and grant the requested permissions. - - +**2. Connect Gmail** + +Find **Gmail** in the list and select **Connect**. + +**3. Sign in to Google** + +Sign in to your Google account and grant the requested permissions. When the connection succeeds, the **Connect** button on the Gmail connector changes to **Disconnect**. diff --git a/content/claude/connectors/mcp-tunnels/oauth.md b/content/claude/connectors/mcp-tunnels/oauth.md index 1f86b8ed95..013db12384 100644 --- a/content/claude/connectors/mcp-tunnels/oauth.md +++ b/content/claude/connectors/mcp-tunnels/oauth.md @@ -6,15 +6,15 @@ > Make OAuth sign-in work for MCP servers reached through an MCP tunnel when the authorization server or identity provider is inside your network. - - MCP tunnels are in research preview and are available to organizations on the Claude Enterprise plan by request. To request access, [submit the MCP tunnels interest form](https://claude.com/form/mcp-tunnels) or contact your Anthropic account team. - +> [!NOTE] +> +> MCP tunnels are in research preview and are available to organizations on the Claude Enterprise plan by request. To request access, [submit the MCP tunnels interest form](https://claude.com/form/mcp-tunnels) or contact your Anthropic account team. An MCP tunnel carries Claude's requests to an MCP server inside your network, but it does not authenticate to that server. Each tunneled server should still require OAuth, as the [MCP authorization specification](https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization) describes, so that a member signs in with their own account before Claude can call the server's tools. This page is for the administrator adding a tunneled server as a custom connector, and explains what to configure when the OAuth authorization server is itself only reachable inside your network. - - If your authorization server is reachable from the public internet and its metadata advertises public URLs, you don't need anything on this page. Add the connector as described in [Set up an MCP tunnel](/docs/connectors/mcp-tunnels/setup#add-tunneled-servers-as-connectors), and members sign in as they would for any other connector. - +> [!NOTE] +> +> If your authorization server is reachable from the public internet and its metadata advertises public URLs, you don't need anything on this page. Add the connector as described in [Set up an MCP tunnel](/docs/connectors/mcp-tunnels/setup#add-tunneled-servers-as-connectors), and members sign in as they would for any other connector. ## Understand how OAuth works through a tunnel diff --git a/content/claude/connectors/mcp-tunnels/overview.md b/content/claude/connectors/mcp-tunnels/overview.md index 03a8cd4947..4c9c0f8fae 100644 --- a/content/claude/connectors/mcp-tunnels/overview.md +++ b/content/claude/connectors/mcp-tunnels/overview.md @@ -6,9 +6,9 @@ > Connect Claude to MCP servers inside your private network without opening inbound firewall ports or exposing the servers to the internet. - - MCP tunnels are in research preview and are available to organizations on the Claude Enterprise plan by request. To request access, [submit the MCP tunnels interest form](https://claude.com/form/mcp-tunnels) or contact your Anthropic account team. The preview is provided as-is, without uptime, support, or continuity commitments, and it depends on a third-party network provider (Cloudflare) that makes no availability commitment for the underlying transport. Anthropic may modify or discontinue MCP tunnels at any time. - +> [!NOTE] +> +> MCP tunnels are in research preview and are available to organizations on the Claude Enterprise plan by request. To request access, [submit the MCP tunnels interest form](https://claude.com/form/mcp-tunnels) or contact your Anthropic account team. The preview is provided as-is, without uptime, support, or continuity commitments, and it depends on a third-party network provider (Cloudflare) that makes no availability commitment for the underlying transport. Anthropic may modify or discontinue MCP tunnels at any time. MCP tunnels connect Claude to [Model Context Protocol (MCP)](/docs/connectors/building/mcp) servers that run inside your private network. You run a small tunnel stack on a host in your network, the stack opens an outbound-only connection to Anthropic, and Claude sends MCP requests to your servers over that connection. Your firewall needs no inbound rules and your MCP servers need no public endpoint. Members of your organization use the tunneled servers as [custom connectors](/docs/connectors/custom/add-unlisted#add-a-connector-by-url) in Claude, the same way they use any other remote MCP server. @@ -80,9 +80,9 @@ The tunnel carries traffic to your MCP servers but does not authenticate to them | | Restricting network access for the proxy hosts and MCP servers | | | Notifying Anthropic if you suspect a compromise | - - An attacker who obtains your tunnel token and one of your TLS private keys could impersonate your proxy and read MCP request payloads, including OAuth tokens. Store both with your organization's secrets-management controls, restrict file permissions, and rotate them on a schedule and immediately after any suspected exposure. See [Rotate credentials](/docs/connectors/mcp-tunnels/setup#rotate-credentials). - +> [!WARNING] +> +> An attacker who obtains your tunnel token and one of your TLS private keys could impersonate your proxy and read MCP request payloads, including OAuth tokens. Store both with your organization's secrets-management controls, restrict file permissions, and rotate them on a schedule and immediately after any suspected exposure. See [Rotate credentials](/docs/connectors/mcp-tunnels/setup#rotate-credentials). ## Limits diff --git a/content/claude/connectors/mcp-tunnels/setup.md b/content/claude/connectors/mcp-tunnels/setup.md index 5b75698f13..0b75e1cfc1 100644 --- a/content/claude/connectors/mcp-tunnels/setup.md +++ b/content/claude/connectors/mcp-tunnels/setup.md @@ -6,9 +6,9 @@ > Create a Tunnels API key, deploy the MCP tunnel stack with Helm or Docker Compose, verify the connection, and add tunneled MCP servers as custom connectors. - - MCP tunnels are in research preview and are available to organizations on the Claude Enterprise plan by request. To request access, [submit the MCP tunnels interest form](https://claude.com/form/mcp-tunnels) or contact your Anthropic account team. - +> [!NOTE] +> +> MCP tunnels are in research preview and are available to organizations on the Claude Enterprise plan by request. To request access, [submit the MCP tunnels interest form](https://claude.com/form/mcp-tunnels) or contact your Anthropic account team. This page covers the full setup of an MCP tunnel for a claude.ai Enterprise organization, from creating the API key that provisioning uses to members calling a tunneled MCP server from Claude. You need the Owner or Primary Owner role in claude.ai, and someone who can deploy containers to a Kubernetes cluster or a Docker host inside your network. Read [MCP tunnels](/docs/connectors/mcp-tunnels/overview) first if the tunnel stack, the tunnel domain, and routes are unfamiliar. @@ -16,19 +16,17 @@ This page covers the full setup of an MCP tunnel for a claude.ai Enterprise orga The setup component that runs alongside the tunnel stack needs a short-lived credential to create the tunnel, register its certificate authority (CA) certificate with Anthropic, and fetch the tunnel token. In claude.ai that credential is a Tunnels API key. - - - In claude.ai, go to **Organization settings > Tunnels**. This page appears once Anthropic has enabled MCP tunnels for your organization. - +**1. Open Organization settings > Tunnels** - - Open **Tunnels API** and create a key. - +In claude.ai, go to **Organization settings > Tunnels**. This page appears once Anthropic has enabled MCP tunnels for your organization. - - Copy the key somewhere safe for the next section. You pass it to the setup component once. - - +**2. Create a key** + +Open **Tunnels API** and create a key. + +**3. Copy the key** + +Copy the key somewhere safe for the next section. You pass it to the setup component once. The tunnel stack does not use the key at runtime. Revoke the key as soon as setup completes, and create a fresh one later when you rotate the tunnel token. @@ -40,246 +38,238 @@ Choose Helm if you run Kubernetes. The chart provisions the tunnel, stores the c Both the Helm and Docker Compose paths need at least one route. A route maps a subdomain of your tunnel domain to the internal URL of an MCP server, in the form `scheme://host:port` with no path. The examples use `docs` pointing at `http://docs-mcp.example.corp:8080`. Replace them with your own servers. - - - - - ```bash theme={null} - helm show values \ - oci://us-docker.pkg.dev/anthropic-public-registry/charts/mcp-tunnel \ - --version 2.0.2 > values.yaml - ``` - - The file includes comments explaining each field. - - - - Edit `values.yaml` and add a `routes` entry under `gateway.config` for each MCP server. Leave `tunnel.id` empty so the setup component creates the tunnel during install. - - ```yaml values.yaml theme={null} - tunnel: - id: "" - # Increment to rotate the tunnel token on a later upgrade. - tokenVersion: "1" - - gateway: - config: - routes: - docs: http://docs-mcp.example.corp:8080 - search: http://10.0.12.7:9000 - ``` - - With these routes, Claude reaches the servers at `docs.` and `search.`. If a route targets an address outside the RFC 1918 private ranges (some managed Kubernetes distributions allocate Service IPs elsewhere), add the range under `gateway.config.upstream.allowed_ips` as described in [Troubleshooting](/docs/connectors/mcp-tunnels/troubleshooting#proxy-logs-ip-validation-failed). - - - - Render the chart with a placeholder key and review the output according to your organization's practices for third-party manifests. Rendering makes no API calls. - - ```bash theme={null} - helm template mcp-tunnel \ - oci://us-docker.pkg.dev/anthropic-public-registry/charts/mcp-tunnel \ - --version 2.0.2 \ - -n mcp-tunnel \ - -f values.yaml \ - --set api.token=placeholder > rendered.yaml - ``` - - - - Read the Tunnels API key into an environment variable so it stays out of your shell history and values file, then install into a dedicated namespace. - - ```bash theme={null} - # Paste the Tunnels API key (input is hidden) - read -rs API_TOKEN && export API_TOKEN - - helm install mcp-tunnel \ - oci://us-docker.pkg.dev/anthropic-public-registry/charts/mcp-tunnel \ - --version 2.0.2 \ - --namespace mcp-tunnel --create-namespace \ - -f values.yaml \ - --set api.token="$API_TOKEN" - ``` - - The setup component runs as a pre-install hook, so `helm install` blocks until the tunnel is created, the CA is registered, and the credentials are stored in the `mcp-tunnel` Secret. If the install fails with a hook error, see [Troubleshooting](/docs/connectors/mcp-tunnels/troubleshooting#helm-install-fails-with-a-hook-error). - - - Revoke the Tunnels API key in **Organization settings > Tunnels > Tunnels API** as soon as the install completes. Helm records `--set` values in its release history Secrets, and Kubernetes Secrets are not encrypted at rest by default, so the key remains recoverable from the cluster until you revoke it. - - - - - You need the tunnel domain to add connectors later. - - ```bash theme={null} - kubectl -n mcp-tunnel get secret mcp-tunnel \ - -o jsonpath='{.data.tunnel-domain}' | base64 -d - ``` - - The value looks like `abc123.tunnel.anthropic.com`. - - - - To restrict the pod's egress at the network level, set `networkPolicy.enabled: true` in `values.yaml` and list your MCP servers under `networkPolicy.mcpServers`. The policy already allows cloudflared to reach the tunnel edge. Your cluster's network plugin must support NetworkPolicy. - - For later configuration changes such as routes or replica count, edit `values.yaml` and run `helm upgrade` with the same `--version` and `-f values.yaml`, without the API key. Keep a complete `values.yaml` rather than relying on `--reuse-values`, because Helm's deep merge can silently keep a route you deleted. - - - - - - ```bash theme={null} - mkdir -p mcp-tunnel/{config,data} - cd mcp-tunnel - sudo chown 65532:65532 data - ``` - - The containers run as the non-root user ID `65532` and need write access to `data/`. - - - - The compose file pins images by digest, runs every container as non-root with a read-only filesystem, drops all Linux capabilities, and disables privilege escalation. - - ```bash theme={null} - cat > docker-compose.yaml <<'EOF' - services: - # One-time provisioning. Run with: docker compose run --rm setup - setup: - image: us-docker.pkg.dev/anthropic-public-registry/images/mcp-proxy@sha256:efb27b299d627e4134815663cb8896641eeaee025d734c0f695582b4df38f013 - entrypoint: ["/setup"] - command: - - init - - --api-url=https://api.anthropic.com - - --output=dir:/data - - --token-version=1 - environment: - - API_TOKEN - volumes: - - ./data:/data - user: "65532:65532" - read_only: true - security_opt: - - no-new-privileges:true - cap_drop: - - ALL - profiles: ["setup"] - - cloudflared: - image: cloudflare/cloudflared@sha256:6b599ca3e974349ead3286d178da61d291961182ec3fe9c505e1dd02c8ac31b0 - command: tunnel --no-autoupdate run --url http://localhost:8080 - environment: - - TUNNEL_TOKEN - # Share the proxy's network namespace so localhost:8080 reaches it. - network_mode: "service:mcp-proxy" - restart: unless-stopped - user: "65532:65532" - read_only: true - security_opt: - - no-new-privileges:true - cap_drop: - - ALL - stop_grace_period: 30s - logging: - options: - max-size: "10m" - max-file: "3" - - mcp-proxy: - image: us-docker.pkg.dev/anthropic-public-registry/images/mcp-proxy@sha256:efb27b299d627e4134815663cb8896641eeaee025d734c0f695582b4df38f013 - volumes: - - ./config/mcp-proxy.yaml:/etc/mcp-gateway/config.yaml:ro - - ./data:/data:ro - restart: unless-stopped - user: "65532:65532" - read_only: true - security_opt: - - no-new-privileges:true - cap_drop: - - ALL - # Match shutdown_timeout in the proxy config - stop_grace_period: 30s - logging: - options: - max-size: "10m" - max-file: "3" - EOF - ``` - - - - Read the Tunnels API key into an environment variable, then run the setup component. It creates the tunnel, generates the CA and server certificate, registers the CA with Anthropic, fetches the tunnel token, and writes everything to `data/`. - - ```bash theme={null} - # Paste the Tunnels API key (input is hidden) - read -rs API_TOKEN && export API_TOKEN - - docker compose run --rm setup - ``` - - Read the tunnel domain and keep it for later steps. - - ```bash theme={null} - export TUNNEL_DOMAIN=$(sudo cat data/tunnel-domain) - echo "$TUNNEL_DOMAIN" - ``` - - - Revoke the Tunnels API key in **Organization settings > Tunnels > Tunnels API** before continuing, and run `unset API_TOKEN`. The stack does not need the key at runtime. - - - - - `tunnel_domain` is required so the proxy can strip the domain from incoming hostnames and look up the remaining subdomain in `routes`. `routes` is a map, not a list. - - ```bash theme={null} - cat > config/mcp-proxy.yaml < - - - ```bash theme={null} - export TUNNEL_TOKEN=$(sudo cat data/tunnel-token) - docker compose up -d - ``` - - The compose file reads `TUNNEL_TOKEN` from the host environment with no default, so repeat the export in every fresh shell and after a reboot. For a multi-host deployment, copy the `mcp-tunnel/` directory to each host and start it the same way. The same tunnel token and certificates work across all replicas. - - - - The `data/` directory now holds the tunnel ID, tunnel domain, tunnel token, CA key pair, and server key pair. Protect it with your organization's file-permission, encryption-at-rest, and secrets-management controls, and consider moving `ca.key` and `tunnel-token` to secure storage. - - +**Helm** + +**1. Fetch the default values** + +```bash theme={null} +helm show values \ + oci://us-docker.pkg.dev/anthropic-public-registry/charts/mcp-tunnel \ + --version 2.1.0 > values.yaml +``` + +The file includes comments explaining each field. + +**2. Configure routes** + +Edit `values.yaml` and add a `routes` entry under `gateway.config` for each MCP server. Leave `tunnel.id` empty so the setup component creates the tunnel during install. + +```yaml values.yaml theme={null} +tunnel: + id: "" + # Increment to rotate the tunnel token on a later upgrade. + tokenVersion: "1" + +gateway: + config: + routes: + docs: http://docs-mcp.example.corp:8080 + search: http://10.0.12.7:9000 +``` + +With these routes, Claude reaches the servers at `docs.` and `search.`. If a route targets an address outside the RFC 1918 private ranges (some managed Kubernetes distributions allocate Service IPs elsewhere), add the range under `gateway.config.upstream.allowed_ips` as described in [Troubleshooting](/docs/connectors/mcp-tunnels/troubleshooting#proxy-logs-ip-validation-failed). + +**3. Review the rendered manifests** + +Render the chart with a placeholder key and review the output according to your organization's practices for third-party manifests. Rendering makes no API calls. + +```bash theme={null} +helm template mcp-tunnel \ + oci://us-docker.pkg.dev/anthropic-public-registry/charts/mcp-tunnel \ + --version 2.1.0 \ + -n mcp-tunnel \ + -f values.yaml \ + --set api.token=placeholder > rendered.yaml +``` + +**4. Install** + +Read the Tunnels API key into an environment variable so it stays out of your shell history and values file, then install into a dedicated namespace. + +```bash theme={null} +# Paste the Tunnels API key (input is hidden) +read -rs API_TOKEN && export API_TOKEN + +helm install mcp-tunnel \ + oci://us-docker.pkg.dev/anthropic-public-registry/charts/mcp-tunnel \ + --version 2.1.0 \ + --namespace mcp-tunnel --create-namespace \ + -f values.yaml \ + --set api.token="$API_TOKEN" +``` + +The setup component runs as a pre-install hook, so `helm install` blocks until the tunnel is created, the CA is registered, and the credentials are stored in the `mcp-tunnel` Secret. If the install fails with a hook error, see [Troubleshooting](/docs/connectors/mcp-tunnels/troubleshooting#helm-install-fails-with-a-hook-error). + +> [!WARNING] +> +> Revoke the Tunnels API key in **Organization settings > Tunnels > Tunnels API** as soon as the install completes. Helm records `--set` values in its release history Secrets, and Kubernetes Secrets are not encrypted at rest by default, so the key remains recoverable from the cluster until you revoke it. + +**5. Read the tunnel domain** + +You need the tunnel domain to add connectors later. + +```bash theme={null} +kubectl -n mcp-tunnel get secret mcp-tunnel \ + -o jsonpath='{.data.tunnel-domain}' | base64 -d +``` + +The value looks like `abc123.tunnel.anthropic.com`. + +To restrict the pod's egress at the network level, set `networkPolicy.enabled: true` in `values.yaml` and list your MCP servers under `networkPolicy.mcpServers`. The policy already allows cloudflared to reach the tunnel edge. Your cluster's network plugin must support NetworkPolicy. + +For later configuration changes such as routes or replica count, edit `values.yaml` and run `helm upgrade` with the same `--version` and `-f values.yaml`, without the API key. Keep a complete `values.yaml` rather than relying on `--reuse-values`, because Helm's deep merge can silently keep a route you deleted. + +**Docker Compose** + +**1. Prepare the deployment directory** + +```bash theme={null} +mkdir -p mcp-tunnel/{config,data} +cd mcp-tunnel +sudo chown 65532:65532 data +``` + +The containers run as the non-root user ID `65532` and need write access to `data/`. + +**2. Write docker-compose.yaml** + +The compose file pins images by digest, runs every container as non-root with a read-only filesystem, drops all Linux capabilities, and disables privilege escalation. + +```bash theme={null} +cat > docker-compose.yaml <<'EOF' +services: + # One-time provisioning. Run with: docker compose run --rm setup + setup: + image: us-docker.pkg.dev/anthropic-public-registry/images/mcp-proxy@sha256:d243d30642d39857a0579e465cb3b9bf3ae7c1141e83143bb6856777a31467a5 + entrypoint: ["/setup"] + command: + - init + - --api-url=https://api.anthropic.com + - --output=dir:/data + - --token-version=1 + environment: + - API_TOKEN + volumes: + - ./data:/data + user: "65532:65532" + read_only: true + security_opt: + - no-new-privileges:true + cap_drop: + - ALL + profiles: ["setup"] + + cloudflared: + image: cloudflare/cloudflared@sha256:0e56c13c7058fcef9c4f0e7d83372f82330548dbf8f8b366f3d8b506526d93b2 + command: tunnel --no-autoupdate run --url http://localhost:8080 + environment: + - TUNNEL_TOKEN + # Share the proxy's network namespace so localhost:8080 reaches it. + network_mode: "service:mcp-proxy" + restart: unless-stopped + user: "65532:65532" + read_only: true + security_opt: + - no-new-privileges:true + cap_drop: + - ALL + stop_grace_period: 30s + logging: + options: + max-size: "10m" + max-file: "3" + + mcp-proxy: + image: us-docker.pkg.dev/anthropic-public-registry/images/mcp-proxy@sha256:d243d30642d39857a0579e465cb3b9bf3ae7c1141e83143bb6856777a31467a5 + volumes: + - ./config/mcp-proxy.yaml:/etc/mcp-gateway/config.yaml:ro + - ./data:/data:ro + restart: unless-stopped + user: "65532:65532" + read_only: true + security_opt: + - no-new-privileges:true + cap_drop: + - ALL + # Match shutdown_timeout in the proxy config + stop_grace_period: 30s + logging: + options: + max-size: "10m" + max-file: "3" +EOF +``` + +**3. Provision the tunnel** + +Read the Tunnels API key into an environment variable, then run the setup component. It creates the tunnel, generates the CA and server certificate, registers the CA with Anthropic, fetches the tunnel token, and writes everything to `data/`. + +```bash theme={null} +# Paste the Tunnels API key (input is hidden) +read -rs API_TOKEN && export API_TOKEN + +docker compose run --rm setup +``` + +Read the tunnel domain and keep it for later steps. + +```bash theme={null} +export TUNNEL_DOMAIN=$(sudo cat data/tunnel-domain) +echo "$TUNNEL_DOMAIN" +``` + +> [!WARNING] +> +> Revoke the Tunnels API key in **Organization settings > Tunnels > Tunnels API** before continuing, and run `unset API_TOKEN`. The stack does not need the key at runtime. + +**4. Write the proxy config** + +`tunnel_domain` is required so the proxy can strip the domain from incoming hostnames and look up the remaining subdomain in `routes`. `routes` is a map, not a list. + +```bash theme={null} +cat > config/mcp-proxy.yaml < - ```bash Helm theme={null} - kubectl -n mcp-tunnel logs deploy/mcp-tunnel -c cloudflared | grep "Registered tunnel connection" - kubectl -n mcp-tunnel logs deploy/mcp-tunnel -c mcp-proxy | grep "route configured" - ``` +```bash Helm theme={null} +kubectl -n mcp-tunnel logs deploy/mcp-tunnel -c cloudflared | grep "Registered tunnel connection" +kubectl -n mcp-tunnel logs deploy/mcp-tunnel -c mcp-proxy | grep "route configured" +``` - ```bash Docker Compose theme={null} - docker compose logs cloudflared | grep "Registered tunnel connection" - docker compose logs mcp-proxy | grep "route configured" - ``` - +```bash Docker Compose theme={null} +docker compose logs cloudflared | grep "Registered tunnel connection" +docker compose logs mcp-proxy | grep "route configured" +``` The containers take a few seconds to start, so rerun the commands if they come back empty. If cloudflared never registers, see [Troubleshooting](/docs/connectors/mcp-tunnels/troubleshooting#the-tunnel-stack-starts-but-cloudflared-never-connects). The end-to-end check happens from Claude, in the next section. @@ -287,27 +277,25 @@ The containers take a few seconds to start, so rerun the commands if they come b Each route becomes a custom connector for your organization. The connector URL is the route's tunnel hostname plus the path your MCP server serves. Many servers serve at `/mcp`, and the proxy forwards the path unchanged. - - - In claude.ai, go to **Organization settings > Connectors**. - +**1. Open organization connectors** + +In claude.ai, go to **Organization settings > Connectors**. + +**2. Add a custom connector** + +Select **Add**, then **Custom**. If Claude asks for the connector type, choose **Web**. + +**3. Enter the tunnel URL** - - Select **Add**, then **Custom**. If Claude asks for the connector type, choose **Web**. - +Enter the server URL, for example `https://docs.abc123.tunnel.anthropic.com/mcp`. - - Enter the server URL, for example `https://docs.abc123.tunnel.anthropic.com/mcp`. - +**4. Configure authentication** - - Configure authentication for the server. If its OAuth authorization server is also inside your network, turn on **Tunnel OAuth configuration** and follow [Authenticate to MCP servers behind a tunnel](/docs/connectors/mcp-tunnels/oauth). - +Configure authentication for the server. If its OAuth authorization server is also inside your network, turn on **Tunnel OAuth configuration** and follow [Authenticate to MCP servers behind a tunnel](/docs/connectors/mcp-tunnels/oauth). - - Select **Add**. - - +**5. Add the connector** + +Select **Add**. Members then find the connector in their own connector settings and select **Connect** to sign in, as described in [Add a connector by URL](/docs/connectors/custom/add-unlisted#add-a-connector-by-url). To confirm the tunnel end to end, connect the server yourself and ask Claude to use one of its tools while you watch the proxy logs for the request. @@ -315,35 +303,31 @@ Members then find the connector in their own connector settings and select **Con Adding another MCP server later takes a new route and a new connector. No certificate or cloudflared changes are needed, because the server certificate covers every subdomain of your tunnel domain. - - - Add a route for the new server. - - - - Apply the change: - - - ```bash Helm theme={null} - # After adding the route under gateway.config.routes in values.yaml - helm upgrade mcp-tunnel \ - oci://us-docker.pkg.dev/anthropic-public-registry/charts/mcp-tunnel \ - --version 2.0.2 \ - -n mcp-tunnel \ - -f values.yaml - ``` - - ```bash Docker Compose theme={null} - # After adding the route in config/mcp-proxy.yaml - docker compose restart mcp-proxy - ``` - - - - - Register the new hostname as another custom connector. - - +**1. Add a route** + +Add a route for the new server. + +**2. Apply the change** + +Apply the change: + +```bash Helm theme={null} +# After adding the route under gateway.config.routes in values.yaml +helm upgrade mcp-tunnel \ + oci://us-docker.pkg.dev/anthropic-public-registry/charts/mcp-tunnel \ + --version 2.1.0 \ + -n mcp-tunnel \ + -f values.yaml +``` + +```bash Docker Compose theme={null} +# After adding the route in config/mcp-proxy.yaml +docker compose restart mcp-proxy +``` + +**3. Register the connector** + +Register the new hostname as another custom connector. ## Rotate credentials @@ -357,144 +341,128 @@ The Tunnels API key is used only while the setup component runs. Revoke it after The tunnel token authenticates cloudflared's outbound connection. Rotate it on your regular schedule and immediately if you suspect exposure. Rotation does not sever connections that are already established, so you can rotate, restart cloudflared with the new value, and let the old connections drain. - - - - - Increment `tunnel.tokenVersion` in `values.yaml`. - - - - Create a fresh Tunnels API key. - - - - Upgrade. The setup component re-runs, rotates the token, and updates the Secret. - - ```bash theme={null} - read -rs API_TOKEN && export API_TOKEN - - helm upgrade mcp-tunnel \ - oci://us-docker.pkg.dev/anthropic-public-registry/charts/mcp-tunnel \ - --version 2.0.2 \ - -n mcp-tunnel \ - -f values.yaml \ - --set api.token="$API_TOKEN" \ - --set setup.force=true - ``` - - Revoke the API key once the upgrade completes. - - - - - - - - Edit `docker-compose.yaml` and increment the `--token-version` value in the `setup` service (for example from `1` to `2`), so the new value persists for future runs. - - - - Create a fresh Tunnels API key. - - - - Re-run setup, then restart cloudflared with the new token: - - ```bash theme={null} - read -rs API_TOKEN && export API_TOKEN - docker compose run --rm setup - - export TUNNEL_TOKEN=$(sudo cat data/tunnel-token) - docker compose up -d cloudflared - ``` - - - - Revoke the API key and run `unset API_TOKEN` once rotation completes. For a multi-host deployment, setup writes the new token only to the `data/` directory on the host where it ran, so copy the updated `data/` directory (at minimum `data/tunnel-token`) to every other host that runs a replica. Then repeat the last two commands on each of those hosts so every replica restarts with the new token. - - +**Helm** + +**1. Increment the token version** + +Increment `tunnel.tokenVersion` in `values.yaml`. + +**2. Create a Tunnels API key** + +Create a fresh Tunnels API key. + +**3. Upgrade** + +Upgrade. The setup component re-runs, rotates the token, and updates the Secret. + +```bash theme={null} +read -rs API_TOKEN && export API_TOKEN + +helm upgrade mcp-tunnel \ + oci://us-docker.pkg.dev/anthropic-public-registry/charts/mcp-tunnel \ + --version 2.1.0 \ + -n mcp-tunnel \ + -f values.yaml \ + --set api.token="$API_TOKEN" \ + --set setup.force=true +``` + +Revoke the API key once the upgrade completes. + +**Docker Compose** + +**1. Increment the token version** + +Edit `docker-compose.yaml` and increment the `--token-version` value in the `setup` service (for example from `1` to `2`), so the new value persists for future runs. + +**2. Create a Tunnels API key** + +Create a fresh Tunnels API key. + +**3. Re-run setup** + +Re-run setup, then restart cloudflared with the new token: + +```bash theme={null} +read -rs API_TOKEN && export API_TOKEN +docker compose run --rm setup + +export TUNNEL_TOKEN=$(sudo cat data/tunnel-token) +docker compose up -d cloudflared +``` + +Revoke the API key and run `unset API_TOKEN` once rotation completes. For a multi-host deployment, setup writes the new token only to the `data/` directory on the host where it ran, so copy the updated `data/` directory (at minimum `data/tunnel-token`) to every other host that runs a replica. Then repeat the last two commands on each of those hosts so every replica restarts with the new token. ### Renew the server certificate The server certificate the proxy presents is valid for 90 days, and you are responsible for renewing it before it expires. Renewal is local. It signs a new certificate with the CA already stored in your deployment, makes no API calls, and needs no API key. The proxy reloads the certificate file automatically, so no restart is required. - - - The chart deploys a CronJob that runs daily and renews the certificate once it is within 30 days of expiry. Monitor the CronJob and the certificate's expiry date to confirm renewal completes. - +**Helm** - - Run the renewal from the deployment directory. With `--renew-before=720h` the command does nothing while more than 30 days of validity remain, so it is safe to run on a schedule such as a daily cron entry. +The chart deploys a CronJob that runs daily and renews the certificate once it is within 30 days of expiry. Monitor the CronJob and the certificate's expiry date to confirm renewal completes. - ```bash theme={null} - docker compose run --rm setup renew-cert --output=dir:/data --renew-before=720h - ``` - - +**Docker Compose** + +Run the renewal from the deployment directory. With `--renew-before=720h` the command does nothing while more than 30 days of validity remain, so it is safe to run on a schedule such as a daily cron entry. + +```bash theme={null} +docker compose run --rm setup renew-cert --output=dir:/data --renew-before=720h +``` ## Remove a tunnel Decommission a tunnel when you no longer need it, or as the first steps of responding to a suspected compromise. Archiving a tunnel invalidates its token, detaches its domain, and is permanent. - - - - ```bash Helm theme={null} - TUNNEL_ID=$(kubectl -n mcp-tunnel get secret mcp-tunnel \ - -o jsonpath='{.data.tunnel-id}' | base64 -d) - ``` - - ```bash Docker Compose theme={null} - TUNNEL_ID=$(sudo cat data/tunnel-id) - ``` - - - - - - ```bash Helm theme={null} - helm uninstall mcp-tunnel -n mcp-tunnel - ``` - - ```bash Docker Compose theme={null} - docker compose down - ``` - - - If you are responding to a suspected compromise, use `docker compose down --timeout 0` to sever the connection immediately. - - - - In **Organization settings > Connectors**, remove each custom connector that points at the tunnel's hostnames. - - - - Create a fresh Tunnels API key and call the [archive endpoint](https://platform.claude.com/docs/en/api/beta/tunnels/archive) of the Tunnels API. Revoke the key when you are done. - - ```bash theme={null} - read -rs API_TOKEN && export API_TOKEN - - curl -X POST "https://api.anthropic.com/v1/tunnels/${TUNNEL_ID}/archive" \ - -H "Authorization: Bearer $API_TOKEN" \ - -H "anthropic-version: 2023-06-01" \ - -H "anthropic-beta: mcp-tunnels-2026-06-22" - ``` - - - - - ```bash Helm theme={null} - # The setup component created this Secret, so helm uninstall leaves it behind - kubectl -n mcp-tunnel delete secret mcp-tunnel - ``` - - ```bash Docker Compose theme={null} - sudo rm -rf data - ``` - - - +**1. Record the tunnel ID** + +```bash Helm theme={null} +TUNNEL_ID=$(kubectl -n mcp-tunnel get secret mcp-tunnel \ + -o jsonpath='{.data.tunnel-id}' | base64 -d) +``` + +```bash Docker Compose theme={null} +TUNNEL_ID=$(sudo cat data/tunnel-id) +``` + +**2. Stop the tunnel stack** + +```bash Helm theme={null} +helm uninstall mcp-tunnel -n mcp-tunnel +``` + +```bash Docker Compose theme={null} +docker compose down +``` + +If you are responding to a suspected compromise, use `docker compose down --timeout 0` to sever the connection immediately. + +**3. Remove the connectors** + +In **Organization settings > Connectors**, remove each custom connector that points at the tunnel's hostnames. + +**4. Archive the tunnel** + +Create a fresh Tunnels API key and call the [archive endpoint](https://platform.claude.com/docs/en/api/beta/tunnels/archive) of the Tunnels API. Revoke the key when you are done. + +```bash theme={null} +read -rs API_TOKEN && export API_TOKEN + +curl -X POST "https://api.anthropic.com/v1/tunnels/${TUNNEL_ID}/archive" \ + -H "Authorization: Bearer $API_TOKEN" \ + -H "anthropic-version: 2023-06-01" \ + -H "anthropic-beta: mcp-tunnels-2026-06-22" +``` + +**5. Delete the stored credentials** + +```bash Helm theme={null} +# The setup component created this Secret, so helm uninstall leaves it behind +kubectl -n mcp-tunnel delete secret mcp-tunnel +``` + +```bash Docker Compose theme={null} +sudo rm -rf data +``` If you archived the tunnel because of a suspected compromise, also notify your Anthropic account team, rotate any OAuth tokens or secrets your MCP servers issued, and review the proxy, cloudflared, and MCP server logs for the affected period before you provision a replacement tunnel. diff --git a/content/claude/connectors/mcp-tunnels/troubleshooting.md b/content/claude/connectors/mcp-tunnels/troubleshooting.md index 65e152e9f1..4203a4cacd 100644 --- a/content/claude/connectors/mcp-tunnels/troubleshooting.md +++ b/content/claude/connectors/mcp-tunnels/troubleshooting.md @@ -6,23 +6,21 @@ > Fix MCP tunnel problems: cloudflared won't connect, tools don't appear, routing and IP validation errors, TLS and certificate failures, and OAuth errors. - - MCP tunnels are in research preview and are available to organizations on the Claude Enterprise plan by request. To request access, [submit the MCP tunnels interest form](https://claude.com/form/mcp-tunnels) or contact your Anthropic account team. - +> [!NOTE] +> +> MCP tunnels are in research preview and are available to organizations on the Claude Enterprise plan by request. To request access, [submit the MCP tunnels interest form](https://claude.com/form/mcp-tunnels) or contact your Anthropic account team. A request through an [MCP tunnel](/docs/connectors/mcp-tunnels/overview) can fail at three points, and it helps to check them in order. First the outbound connection from cloudflared to the tunnel edge, then the inner TLS handshake between Anthropic and your proxy, then the proxy's routing to your MCP server. The cloudflared and proxy logs on your side show which point a request reached. If the proxy logs nothing at all for a request, it never arrived in your network. - - ```bash Helm theme={null} - kubectl -n mcp-tunnel logs deploy/mcp-tunnel -c cloudflared - kubectl -n mcp-tunnel logs deploy/mcp-tunnel -c mcp-proxy - ``` +```bash Helm theme={null} +kubectl -n mcp-tunnel logs deploy/mcp-tunnel -c cloudflared +kubectl -n mcp-tunnel logs deploy/mcp-tunnel -c mcp-proxy +``` - ```bash Docker Compose theme={null} - docker compose logs cloudflared - docker compose logs mcp-proxy - ``` - +```bash Docker Compose theme={null} +docker compose logs cloudflared +docker compose logs mcp-proxy +``` For proxy configuration fields and certificate rules referenced below, see the [MCP tunnels reference](https://platform.claude.com/docs/en/agents-and-tools/mcp-tunnels/reference). The [platform troubleshooting guide](https://platform.claude.com/docs/en/agents-and-tools/mcp-tunnels/troubleshooting) covers the same stack and applies to claude.ai tunnels as well, apart from its Console-specific steps. @@ -86,9 +84,9 @@ upstream: - 100.64.12.0/22 # example: a cluster Service range outside RFC 1918 ``` - - Don't set `0.0.0.0/0` or `disable_ip_validation` outside of isolated testing. IP validation is the proxy's protection against server-side request forgery. - +> [!WARNING] +> +> Don't set `0.0.0.0/0` or `disable_ip_validation` outside of isolated testing. IP validation is the proxy's protection against server-side request forgery. ### Proxy exits with `cannot unmarshal !!seq into map[string]string` @@ -108,23 +106,21 @@ Anthropic rejected the certificate the proxy presented. Check that the server ce Work through these checks in order. - - - Confirm the stack is connected, using the log checks in [Verify the connection](/docs/connectors/mcp-tunnels/setup#verify-the-connection). - +**1. Confirm the stack is connected** + +Confirm the stack is connected, using the log checks in [Verify the connection](/docs/connectors/mcp-tunnels/setup#verify-the-connection). + +**2. Confirm the tunnel's organization** + +Confirm the tunnel was created with a Tunnels API key from the same claude.ai organization where you are adding the connector. A tunnel created from another organization, including a Claude Console organization, is refused before any traffic reaches your network, and your proxy logs show nothing. + +**3. Confirm the connector URL's path** - - Confirm the tunnel was created with a Tunnels API key from the same claude.ai organization where you are adding the connector. A tunnel created from another organization, including a Claude Console organization, is refused before any traffic reaches your network, and your proxy logs show nothing. - +Confirm the connector URL includes the path your MCP server serves, such as `/mcp`. A request to the bare hostname reaches the proxy but the server may answer `404`. - - Confirm the connector URL includes the path your MCP server serves, such as `/mcp`. A request to the bare hostname reaches the proxy but the server may answer `404`. - +**4. Watch the proxy logs** - - Watch the proxy logs while you retry. `no route for host` and `IP validation failed` point to the sections above. An upstream connection error means the proxy can't reach the MCP server from where it runs. - - +Watch the proxy logs while you retry. `no route for host` and `IP validation failed` point to the sections above. An upstream connection error means the proxy can't reach the MCP server from where it runs. ## OAuth sign-in diff --git a/content/claude/connectors/microsoft/365.md b/content/claude/connectors/microsoft/365.md index 1283e14c64..eecb9393f8 100644 --- a/content/claude/connectors/microsoft/365.md +++ b/content/claude/connectors/microsoft/365.md @@ -10,10 +10,10 @@ The Microsoft 365 connector lets Claude search, analyze, and act on information By the end of this page you have the connector set up for your organization and your own account connected, and you have asked Claude a first question that draws on Microsoft 365. - - * If your organization runs Claude Desktop on third-party inference, see [Connect to Microsoft 365](/docs/third-party/claude-desktop/connectors-m365) instead - * If you're in a US government deployment, see [Set up the Microsoft 365 connector](/docs/government/connectors/microsoft-365) in the government section - +> [!NOTE] +> +> * If your organization runs Claude Desktop on third-party inference, see [Connect to Microsoft 365](/docs/third-party/claude-desktop/connectors-m365) instead +> * If you're in a US government deployment, see [Set up the Microsoft 365 connector](/docs/government/connectors/microsoft-365) in the government section ## Review what Claude can do @@ -45,23 +45,21 @@ Check these before you start: On Team and Enterprise plans, an Owner or Primary Owner adds the connector once for everyone. The steps below are the automatic setup, which is the recommended path. - - - In claude.ai, go to [**Organization settings > Connectors**](https://claude.ai/admin-settings/connectors). - +**1. Open organization connectors** - - Select **Add**, then **All available**. Find **Microsoft 365** and select **Add to your team**. - +In claude.ai, go to [**Organization settings > Connectors**](https://claude.ai/admin-settings/connectors). - - Connect your own account and grant the organization-wide permissions. - +**2. Add Microsoft 365** - - Restrict which users can use the connector, or revoke specific permission scopes. - - +Select **Add**, then **All available**. Find **Microsoft 365** and select **Add to your team**. + +**3. Connect and grant consent** + +Connect your own account and grant the organization-wide permissions. + +**4. Adjust access if needed** + +Restrict which users can use the connector, or revoke specific permission scopes. For the detailed administrator walkthrough, see [Set up the Microsoft 365 connector](https://support.claude.com/en/articles/12542951-set-up-the-microsoft-365-connector) in the help center. The [Microsoft 365 connector security guide](https://support.claude.com/en/articles/12684923-microsoft-365-connector-security-guide) covers the permission model. @@ -69,19 +67,17 @@ For the detailed administrator walkthrough, see [Set up the Microsoft 365 connec Once the connector is available to you, connect your own Microsoft 365 account. - - - Go to [**Customize > Connectors**](https://claude.ai/customize/connectors) in claude.ai. **Customize** is the page that holds your connectors, skills, and plugins. - +**1. Open your connectors** + +Go to [**Customize > Connectors**](https://claude.ai/customize/connectors) in claude.ai. **Customize** is the page that holds your connectors, skills, and plugins. + +**2. Connect Microsoft 365** + +Find **Microsoft 365** and select **Connect**. - - Find **Microsoft 365** and select **Connect**. - +**3. Sign in to Microsoft** - - Sign in with your work or school Microsoft credentials. - - +Sign in with your work or school Microsoft credentials. When the connection succeeds, the **Connect** button on the Microsoft 365 connector changes to **Disconnect**. For the member walkthrough, see [Connect to Microsoft 365](https://support.claude.com/en/articles/15183774-connect-to-microsoft-365) in the help center. @@ -111,19 +107,17 @@ If your tenant approved the connector before a write permission (mail, calendar, If write actions are off for your organization, administrators turn them on for all users in the Microsoft 365 connector configuration, or enable them for specific users with role-based access control (beta). Administrators also check the restriction on each tool that sends Teams messages. A per-tool restriction overrides the **Default restriction** row, so a tool that is blocked for all users stays unavailable until an administrator changes its restriction. To let users choose those tools: - - - Open the Microsoft 365 connector under **Organization settings > Connectors**. - +**1. Open the connector's configuration** - - Find **Tool permission restrictions**. - +Open the Microsoft 365 connector under **Organization settings > Connectors**. - - Set each Teams messaging tool so that users can choose it. - - +**2. Find Tool permission restrictions** + +Find **Tool permission restrictions**. + +**3. Allow each Teams messaging tool** + +Set each Teams messaging tool so that users can choose it. ## Permissions @@ -135,23 +129,21 @@ If your tenant approved the connector before Anthropic added a permission to it, A Global Administrator or Application Administrator approves the added permissions for the whole tenant by opening the admin consent link and accepting the list it shows. - - - Replace `YOUR_TENANT_ID` with the Directory (tenant) ID shown in **Entra admin center > Overview**, then open the link. The `client_id` value is the connector's Application ID, shown on the **M365 MCP Server for Claude** enterprise application's **Overview** page. +**1. Open the admin consent link** + +Replace `YOUR_TENANT_ID` with the Directory (tenant) ID shown in **Entra admin center > Overview**, then open the link. The `client_id` value is the connector's Application ID, shown on the **M365 MCP Server for Claude** enterprise application's **Overview** page. + +```text theme={null} +https://login.microsoftonline.com/YOUR_TENANT_ID/adminconsent?client_id=07c030f6-5743-41b7-ba00-0a6e85f37c17 +``` + +**2. Review the permissions and accept** - ```text theme={null} - https://login.microsoftonline.com/YOUR_TENANT_ID/adminconsent?client_id=07c030f6-5743-41b7-ba00-0a6e85f37c17 - ``` - +The consent screen lists every permission the connector requests, including any added since your tenant first approved it and the permissions that write actions need. The Teams tools use `Team.ReadBasic.All` to list teams, `People.Read` to look up people, and `ChatMessage.Send`, `ChannelMessage.Send`, and `Chat.Create` to send messages. Select **Accept**. - - The consent screen lists every permission the connector requests, including any added since your tenant first approved it and the permissions that write actions need. The Teams tools use `Team.ReadBasic.All` to list teams, `People.Read` to look up people, and `ChatMessage.Send`, `ChannelMessage.Send`, and `Chat.Create` to send messages. Select **Accept**. - +**3. Confirm the approval** - - Check the address bar of the page Microsoft sends you to. The approval succeeded when the address contains `admin_consent=True`, and the approved permissions then appear on the connector's **Permissions** page. - - +Check the address bar of the page Microsoft sends you to. The approval succeeded when the address contains `admin_consent=True`, and the approved permissions then appear on the connector's **Permissions** page. Selecting **Grant admin consent for \{your organization}** on the connector's **Permissions** page in the Entra admin center approves the same list as the admin consent link. @@ -161,34 +153,32 @@ The admin consent link is for the connector used from claude.ai. If the Applicat If something isn't working, start with the case that matches what you see. - - - If sign-in fails, work through these checks: - - * Confirm you're signing in with your work or school Microsoft 365 credentials, not a personal account - * Check that your Microsoft 365 license is active - * Review your organization's third-party app policies - * Try a different browser, or clear cookies and cache and sign in again - - - - If Claude can't find a document you know exists: - - * Confirm you can open the document directly in Microsoft 365 - * Make sure the document is stored in SharePoint or OneDrive, not only on your computer - * Wait and retry for recently uploaded documents, which can take time to index - * Name the specific SharePoint site, or search by the exact filename - - - - If results are partial or miss what you expected: - - * Be more specific about what you need - * Specify locations and date ranges - * Use exact phrases from the content - * Break a complex request into simpler questions - - +> **Authentication failures** +> +> If sign-in fails, work through these checks: +> +> * Confirm you're signing in with your work or school Microsoft 365 credentials, not a personal account +> * Check that your Microsoft 365 license is active +> * Review your organization's third-party app policies +> * Try a different browser, or clear cookies and cache and sign in again + +> **Documents not found** +> +> If Claude can't find a document you know exists: +> +> * Confirm you can open the document directly in Microsoft 365 +> * Make sure the document is stored in SharePoint or OneDrive, not only on your computer +> * Wait and retry for recently uploaded documents, which can take time to index +> * Name the specific SharePoint site, or search by the exact filename + +> **Incomplete search results** +> +> If results are partial or miss what you expected: +> +> * Be more specific about what you need +> * Specify locations and date ranges +> * Use exact phrases from the content +> * Break a complex request into simpler questions ## Next steps diff --git a/content/claude/connectors/slack.md b/content/claude/connectors/slack.md index e16cb70832..0569c37a65 100644 --- a/content/claude/connectors/slack.md +++ b/content/claude/connectors/slack.md @@ -10,9 +10,9 @@ You can use Claude with Slack in two ways. The Claude in Slack app puts Claude i By the end of this page you have installed the app, connected your account, and, if your plan includes it, turned on the connector and asked Claude a question that draws on Slack. - - This page covers the earlier per-user Claude in Slack app. The current product is [Claude Tag](/docs/claude-tag/overview), which gives your team one Claude identity set up by an admin. If your organization used the earlier app, see [Migrate from the earlier Claude in Slack](/docs/claude-tag/admins/migrate-from-earlier). - +> [!NOTE] +> +> This page covers the earlier per-user Claude in Slack app. The current product is [Claude Tag](/docs/claude-tag/overview), which gives your team one Claude identity set up by an admin. If your organization used the earlier app, see [Migrate from the earlier Claude in Slack](/docs/claude-tag/admins/migrate-from-earlier). ## Use the earlier Claude in Slack app @@ -28,45 +28,39 @@ Direct messages, the AI assistant panel, and threads all support the same Claude A Slack admin adds the app to the workspace first, and then each person connects their own Claude account. - - - - - Open the Claude app's listing in the Slack App Marketplace. - +**Slack admins** - - Select **Add to Slack**, then review and approve the app for your organization. - +**1. Find the app** - - Deploy the app org-wide or to specific workspaces. - - +Open the Claude app's listing in the Slack App Marketplace. - To add the app to more workspaces later, open your Slack management workspace, go to **Integrations > Installed apps > Add to more workspaces**, and turn on each workspace that should have it. - +**2. Add the app to Slack** - - - - Find **Claude** in your Slack apps list or in the Slack App Marketplace. - +Select **Add to Slack**, then review and approve the app for your organization. - - Select **Connect Account**, select your Claude organization, and then select **Authorize** to grant access. - +**3. Choose where to deploy** - - Return to Slack and select **+ New Chat**, or mention @Claude in a channel or thread. - - +Deploy the app org-wide or to specific workspaces. - If your company's Slack requires admin approval and you aren't an admin, you see a **Request to install** prompt instead. Ask a Slack admin to approve the app, then connect. +To add the app to more workspaces later, open your Slack management workspace, go to **Integrations > Installed apps > Add to more workspaces**, and turn on each workspace that should have it. - To pin Claude to your Slack header, open the app's three-dot menu in Slack and select **Add this app to header**. - - +**Individual users** + +**1. Find Claude** + +Find **Claude** in your Slack apps list or in the Slack App Marketplace. + +**2. Connect your account** + +Select **Connect Account**, select your Claude organization, and then select **Authorize** to grant access. + +**3. Start a conversation** + +Return to Slack and select **+ New Chat**, or mention @Claude in a channel or thread. + +If your company's Slack requires admin approval and you aren't an admin, you see a **Request to install** prompt instead. Ask a Slack admin to approve the app, then connect. + +To pin Claude to your Slack header, open the app's three-dot menu in Slack and select **Add this app to header**. ## Search Slack with the connector @@ -76,19 +70,17 @@ The Slack connector is available on Team and Enterprise plans. With it turned on An Owner enables the connector for the organization once, and then each member connects their own account. - - - An Owner goes to [**Organization settings > Connectors**](https://claude.ai/admin-settings/connectors) in claude.ai and enables the Slack connector. - +**1. Enable the connector for your organization** + +An Owner goes to [**Organization settings > Connectors**](https://claude.ai/admin-settings/connectors) in claude.ai and enables the Slack connector. + +**2. Open your connectors** + +Go to [**Customize > Connectors**](https://claude.ai/customize/connectors) in claude.ai. **Customize** is the page that holds your connectors, skills, and plugins. - - Go to [**Customize > Connectors**](https://claude.ai/customize/connectors) in claude.ai. **Customize** is the page that holds your connectors, skills, and plugins. - +**3. Connect Slack** - - Find **Slack** and select **Connect**. - - +Find **Slack** and select **Connect**. When the connection succeeds, the **Connect** button on the Slack connector changes to **Disconnect**. @@ -112,9 +104,9 @@ To disconnect, use the surface that matches what you want to remove: * **Claude in Slack app**: on the app's **Home** tab in Slack, select **Disconnect** * **Slack connector**: go to [**Customize > Connectors**](https://claude.ai/customize/connectors), find **Slack**, and select **Disconnect** - - Disconnecting removes your account connection and deletes past conversations within 30 days. - +> [!NOTE] +> +> Disconnecting removes your account connection and deletes past conversations within 30 days. ## Privacy and data diff --git a/content/claude/connectors/verification.md b/content/claude/connectors/verification.md index d2582a364e..15dc96b638 100644 --- a/content/claude/connectors/verification.md +++ b/content/claude/connectors/verification.md @@ -8,9 +8,9 @@ The [Connectors Directory](/docs/connectors/directory) lists connectors from Anthropic and from third-party developers, and each one shows how much Anthropic has reviewed it. Use this page to understand what those labels mean before you connect one. - - If you build connectors and want yours listed, see [List your own connector](#list-your-own-connector). - +> [!NOTE] +> +> If you build connectors and want yours listed, see [List your own connector](#list-your-own-connector). ## Connector labels diff --git a/content/claude/cowork/changelog.md b/content/claude/cowork/changelog.md index 616aeb274c..95d10de4ce 100644 --- a/content/claude/cowork/changelog.md +++ b/content/claude/cowork/changelog.md @@ -6,2102 +6,2157 @@ > Release notes for Claude Desktop - - Bundled Claude Code version: 2.1.299. - - **General** - - * No user-facing changes. - - **Code** - - * No user-facing changes. - - **Cowork** - - * No user-facing changes. - - **3P** - - * No user-facing changes. - - - - Bundled Claude Code version: 2.1.299. - - **General** - - * Changed the certificate that signs the bundled Claude Code helper (`claude.exe`) on Windows to the renewed one that the app and its installer have used since v2.37337.1. Rules that hold the certificate itself, such as a Microsoft Defender certificate indicator, need the new certificate added beside the old one. - * Changed the import from Claude (third-party) where device management turned it on: after the import, Claude now adds local MCP servers and starts those that were on, installs the desktop extensions and uploaded plugins that your organization allows, and, where your organization allows skill creation, uploads skills that grant tools or declare hooks, all without asking you to confirm. Before, each local MCP server waited for you to confirm its command and settings. Organizations under the HIPAA restriction get none of these. - * Improved the import from Claude (third-party): copied scheduled tasks keep their attached files, and your Instructions for Claude and Cowork global instructions can be added from Settings > Import. Where device management turned it on, copied scheduled tasks also keep their folders and, while a local MCP server is unchanged, the approvals you gave for its tools. - * Fixed Arabic and Hebrew text reading in the wrong order in chat titles, session titles, messages, plans, search results, file views, feedback dialogs and the Code tab. - * Fixed some plugins never installing after being enabled on claude.ai because one of their files is very repetitive, such as a long empty table. - * Fixed some Update buttons planning a restart with nothing on screen while sessions were still running; they now ask first and can be cancelled. - * Fixed the app sometimes starting with no window open, including after restarting from the Help menu on Windows and Linux when the app had started automatically at sign-in. - * Fixed tool approval prompts staying hidden behind a full-screen MCP app after the chat preview was closed. - - **Code** - - * Added a Context card to the session rail, to the right of the conversation. On plans with usage limits, the ring under the message box now shows plan usage, and context usage is in this card. If the rail is hidden, use the Show session rail button at top right (not yet in third-party deployments). - * Added a session rail to the right of the conversation, with cards including the session's environment, context, connectors, outputs, changes, servers, and background tasks. Right-click a card's header to choose which cards show (not yet in third-party deployments). - * Added environments: save a folder, SSH host, cloud environment, or Remote Control machine, with a worktree and branch setting for each folder, and pick one when you start a session. "Save as environment" at the top of a session saves where it started (not yet in third-party deployments). - * Added nested sessions in local and SSH sessions: Claude can start a task in a separate session, which appears under the original session in the sidebar and reports back to it. In Settings > Claude Code, choose what happens when you ask for an unrelated task (not yet in third-party deployments). - * Added a box at the end of the conversation in local and SSH sessions that shows Claude's plan while it works. When a turn ends, the box can show a short recap with buttons for what to do next (not yet in third-party deployments). - * Added Environment to the sidebar's Group by menu. It groups sessions by their saved local or SSH environment, or by folder or repository when they have none. Custom groups are now called sections (not yet in third-party deployments). - * Changed the New session page: choose where Claude runs and which folder to use in the row under the message box, or pick a recent environment from the card on the page. For a Git folder, Branch and Worktree are at the bottom of the folder menu (not yet in third-party deployments). - * Changed the sidebar's Filter button to Group and sort, which appears when you hover a group heading. Use it to change grouping or sorting, show routines or empty groups, or open View all for archived sessions (not yet in third-party deployments). - * Changed pull request controls to appear in the Changes card on the session rail, instead of in a bar above the message box. Each open pull request's menu has Auto-fix, Merge when ready, and auto-archive options (not yet in third-party deployments). - * Changed the folder and repository menu to appear in the Environment card on the session rail, next to the branch and Remote Control, instead of in the session's title bar (not yet in third-party deployments). - * Changed the row under the message box to hold the permission mode, one menu for model and effort, and the usage ring. The `+` menu and the microphone moved inside the message box (not yet in third-party deployments). - * Changed `/btw` in local sessions to open a side chat in a pane beside the session, with a tab for each side chat (not yet in third-party deployments). - * Changed permission requests and questions to appear in the conversation instead of above the message box. In local and SSH sessions, suggested tasks appear there too (not yet in third-party deployments). - * Changed the Git operations the app runs for you (the commit and stash around a branch switch, the in-folder branch switch, and the push behind "Continue in cloud") to no longer run repository Git hooks; push Git LFS objects from a terminal before continuing in the cloud. - * Removed the "Get started with Claude Code" checklist from the sidebar. - * Fixed "Rewind to here" failing with "Can’t rewind to this message." on any message but the latest in cloud and self-hosted sessions. - * Fixed deleting a session on an SSH host whose helper had not yet updated also deleting a branch holding unpushed commits. - * Fixed SSH sessions silently losing part of Claude's output, getting stuck reconnecting after another session on the same host failed to start, and ending the terminal on Windows computers when the host closed the connection. - * Fixed untracked files in a session's worktrees being deleted when the session was archived after Claude moved it to the cloud. - - **Cowork** - - * Changed computer use on macOS to no longer save files into hidden or protected folders, such as Homebrew's folders and shell start-up locations, or give a document a hidden or otherwise protected name. - * Changed Settings › Import to no longer offer the third-party app’s local MCP servers for organizations under the HIPAA restriction. - * Fixed computer use typing text twice into a busy web page in a background app. - * Fixed Enter selecting a slash menu item instead of sending the message when a "/" word, such as "/s", came after other words. - * Fixed the conversation sometimes jumping back to the bottom when you scroll up with Page Up, Shift+Space or the Up arrow key while Claude is responding. - * Fixed the workspace sometimes failing to start on Windows with a connection timeout error. - - **3P** - - * Added support in the macOS and Linux apps for SSH sessions carrying on across an app restart, and automatic recovery on every platform when Claude Code on the host is lost mid-task while the app is running: the app restarts it and continues the task, even with nobody at the computer. - * (breaking) Changed what a failed `PreToolUse` hook does on Windows computers without Git for Windows: if it sets none of `shell`, `args`, or `onFailure`, it now blocks the tool call. Such a hook runs in PowerShell there, where a command written for Bash can fail, so a hook that matches every tool can block every tool call. This includes hooks in plugins and in Claude Code's managed settings (`managed-settings.json` or the Windows policy registry value), such as one that other software adds. Either install Git for Windows in its default location and then quit and reopen Claude, or put the hook's program in `command` and its arguments in `args`. Add `"onFailure": "block"` if a failed hook should still block the call. - * Changed `claudeAiImport.automatic3pImport` to reinstall, without asking, the optional plugins that a user had switched on from any optional `allowedPluginMarketplaces` entry (GitHub, git, or a URL on any host) with the same source in the old and new organization, not only from the gateway or bootstrap origin. This includes computers that moved organizations before this version, at their first launch with it. - * Changed `mcpPersistentAlwaysAllowEnabled` to also apply to Code sessions on the device, in WSL and over SSH: when it is `false`, MCP tool prompts offer "Allow for this session" instead of "Always allow", and scheduled tasks offer no lasting approval unless `mcpScheduledTaskApprovalLifetimeDays` is one day or more. - * Changed Chat's file-analysis sandbox (`chatAdvancedFileAnalysisEnabled`) to reach the hosts in `coworkEgressAllowedHosts`, for example to install packages. As in Cowork, its commands run without an approval prompt. Before, it had no network access by default. With no list, or an empty one, it still has none. - * Changed session export in Settings > Import & export to cover everything by default instead of the last 30 days and to list what the file includes and leaves out; the import of a Claude Desktop export file also starts on everything. - * Fixed a message typed at the token limit being discarded in Cowork and Chat. The message shown at the limit now also says when the limit resets and, in Cowork and Chat, has a View usage button. - * Fixed Code tab SSH sessions on Windows hosts without Git for Windows refusing every shell command with "Enterprise policy requires sandboxing". The refusal stays for organizations that deny or ask on Bash commands by pattern, or whose `disabledBuiltinTools` holds `Bash` (with or without a pattern), `PowerShell` with a pattern, or a name the app does not recognize. - * Fixed connectors losing their saved sign-in when Claude starts while the macOS keychain is locked; the connector now says what to do. - - - - Bundled Claude Code version: 2.1.295. - - **General** - - * Added "Open in new window" for chats, so a conversation can stay open in its own window beside the main window. - * (breaking) Removed the former managed-configuration key names `isDxtEnabled`, `isDxtSignatureRequired`, and `isDxtDirectoryEnabled`. In a profile that still uses one, the name is now an unrecognized key: its setting no longer applies and the deprecation notice no longer appears, so unsigned extensions load and, on standard deployments, extensions are allowed and the extension directory shows. Set `isDesktopExtensionEnabled`, `isDesktopExtensionSignatureRequired`, and `isDesktopExtensionDirectoryEnabled` to the same values. This differs from earlier notes for third-party deployments, which said extensions would be disabled and only signed extensions would load. A macOS profile or Windows user policy that holds only former names is no longer read as managed configuration, so the device becomes unmanaged. A Windows machine policy or Linux managed settings file that holds only former names is reported as a configuration error, and local settings stay disabled. - * Changed the certificate that signs the Windows app and its installer to a renewed one from the same publisher. Rules that allow Claude by publisher are unaffected; rules that pin the certificate itself need the new certificate added beside the old one. - * Fixed a message that failed to send being lost when the page reloaded; it now stays in the chat with its Retry. - * Fixed chats losing access to this computer's files and apps when registering the computer took more than a few seconds. - * Fixed computer use in the background taking your keyboard: a dropdown menu that a click or key opens in a background app is now closed again at once instead of swallowing what you type. - * Fixed MCP servers and preview dev servers launched through npx or npm failing to start on Windows when Node is installed under Program Files or an argument contains a space. - * Fixed new Cowork tasks and Code sessions still connecting through the previous proxy after a proxy auto-config (PAC) file's answer changed, which failed with connection errors until the app was restarted. - * Fixed plugins loading without their skills and tools, scheduled tasks failing to load, folder reads, and "Open with Claude" failing when the Windows profile lives in an FSLogix or similar profile container. - - **Code** - - * Added Auto save to the Files pane editor, with an option in the pane menu to turn it off. - * Changed SSH on Windows to use only an `ssh.exe` found on `PATH`. A `.bat`, `.cmd` or `.ps1` wrapper named `ssh` is no longer run. - * Fixed Code sessions with hundreds of added folders failing to start on Windows. - * Fixed file edits being skipped in SSH sessions on Mac hosts that use a worktree while the app is closed or the computer is asleep. - * Fixed messages Claude wrote before a tool call disappearing into a collapsed group of tool calls. - * Fixed sessions failing to start when many sessions that each use a worktree of a large repository start at the same time. - * Fixed sessions that hold a very large prompt sometimes showing an error in place of the conversation. - * Fixed sessions with background agents not continuing on their own after the 5-hour usage limit resets. - * Fixed some Claude Code crashes on Windows that cut off a response showing "Session was interrupted" instead of the crash message with Try again. - - **Cowork** - - * Improved the "workspace disk full" prompt so cleaning up frees enough space to keep working. - * Fixed charts, tables, and diagrams in artifacts staying blank when offline or when the network blocked the site their libraries came from. The libraries now come with the app. - * Fixed Cowork tasks on a computer whose administrator turned off the local VM trying to start on that computer instead of in the cloud. - * Fixed messages that could not be sent sometimes appearing as sent, with no error shown. - * Fixed scheduled tasks on your computer that could not be edited after their first run ("Failed to update scheduled task"). - * Fixed the first message of a new task being lost when the app reloaded while the task was starting. - - **3P** - - * Added `developerModeEnabled`, which lets admins turn off Developer Mode and block installing extensions from a folder. It also applies on standard deployments. - * Added a "Not set" or "Allow none" choice to the empty `coworkEgressAllowedHosts` and `sshHostAllowlist` (beta) lists in the Setup window. "Allow none" saves and exports an empty list. - * Added a configuration warning for a `disabledBuiltinTools` entry spelled with underscores or hyphens, such as `web_fetch`; the warning gives the correct name, `WebFetch`. - * (breaking) Removed the deprecation notices for the spellings that stopped being accepted on October 7, 2026: header maps written as a string or list, `inferenceGatewayAuthScheme: "auto"`, the `ask-session` permission value, older `managedMcpServers` entry forms, and the `orgPluginSettings` record form. Such a value is now reported like any other invalid value; the replacements are listed under v1.40609.0. - * (breaking) Removed the former key names `enduserAttribution`, `trustBootstrapLocalExec`, and `inferenceGatewayHeaders`. In a configuration that still uses one, the name is now an unrecognized key: its setting no longer applies and the deprecation notice no longer appears. End-user attribution is then on, except in the Windows registry, where names ignore case and `enduserAttribution` still reads as `endUserAttribution`. A `bootstrapUrl` set by device management (on Windows, machine policy only) is trusted without asking each user. No custom inference headers are sent. Use `endUserAttribution`, `trustBootstrapDelivery`, and `inferenceCustomHeaders` instead. The former extension key names are under General. - * Changed `disabledBuiltinTools`: a `WebFetch` or bare `Bash` entry added by device management now also applies to Cowork and Chat conversations already open. - * Changed `disableNonessentialServices` so that it no longer turns off Chart.js, Grid.js, and Mermaid in artifacts, which now come with the app. - * Changed `managedMcpServers`: an entry whose `toolPolicy` is malformed is no longer dropped. It is kept with that tool, or every tool, blocked, and a configuration error is reported. - * Changed `sshTransport` (beta) on every platform: a value that cannot be read, such as a misspelling, now counts as `builtin` instead of the default engine. - * Changed OAuth-protected MCP connectors to ask you to sign in again once after this update, and again whenever a connector's URL changes. - * Changed the Setup window's `.reg` export to write machine policy (`HKEY_LOCAL_MACHINE`) instead of user policy (`HKEY_CURRENT_USER`); importing the file now needs administrator rights, and deploying it as user policy means replacing `HKEY_LOCAL_MACHINE` with `HKEY_CURRENT_USER` first. - * Changed which hosts the agent's tools reach automatically: your inference provider's, gateway's, and OTLP collector's hosts and `api.anthropic.com` are no longer added to `coworkEgressAllowedHosts` for you. List them if your agents' shell commands, web fetches, or http hooks call them. - * Fixed "Save image" and "Copy image" failing in the Code tab. - * Fixed a connection delay when Claude started before the configuration server was reachable; Claude now retries when you wake or unlock the computer, or return to the app. - * Fixed Auto permission mode being greyed out as "Not available for the selected model" in the Code tab for the Claude Haiku model that supports it, which caused new Code sessions to start in Accept edits. - * Fixed conversations disappearing from the sidebar and not opening when `coworkTabEnabled` is `false`. This affected Cowork tasks, including conversations started from the home screen while Unified Claude (beta) was on. They now stay listed and open read-only until Cowork is re-enabled. - * Fixed Cowork not starting a task when the organization's model list had not loaded. Cowork now waits a short time for the list, then starts the task or shows why it cannot. - * Fixed file edits in an SSH worktree session on a Linux host sometimes landing in the main checkout or another session's worktree. - * Fixed MCP connector sign-in failing through explicit OAuth endpoints for identity providers whose issuer has a path. - * Fixed model pickers showing no Effort control for newer models when `modelCatalogEnabled` is `false`; picker names, descriptions, and recommended effort levels now follow the catalog bundled with the app. - * Fixed scheduled Cowork tasks that never started on a computer where Claude's workspace fails to start; due tasks now start without the workspace after about ten minutes, with commands that need the workspace failing in those runs. - * Fixed the "Strict sandbox mode" switch under Settings › Claude Code, and the /status card's Sandbox row, showing strict mode as off when your organization's configuration already enforces it. - - - - Bundled Claude Code version: 2.1.295. - - **General** - - * No user-facing changes. - - **Code** - - * No user-facing changes. - - **Cowork** - - * No user-facing changes. - - **3P** - - * Changed MSIX installs on Windows so that programs started through Git Bash in a session end when the app updates instead of staying open. - * Fixed every request failing on a 1M-context model when the inference gateway or cloud provider refuses the 1M-context capability; the request is now resent without it. - - - - Bundled Claude Code version: 2.1.293. - - **General** - - * Added skills and local MCP servers to Settings > Import where importing this computer’s third-party history is on: skills saved in Claude (third-party) upload to your own skills automatically, and local MCP servers can be added and started after you confirm the command and settings each one runs with. - * Fixed chats showing "Page not found" when they could not be loaded because of a server or connection problem; the page now says the chat could not be loaded and offers a retry. - * Fixed dictation continuing to record after you let go of the microphone button, when holding it was the first microphone use since the app started. - * Fixed messages being sent under a different organization after the page switched organizations: a message held up by a sign-in prompt is no longer sent, one reported as not sent returns to the message box instead of sending later, and a stopped button or reply send now says why. - * Fixed programs that a session started, such as MCP servers, and the helper processes of local MCP servers staying running on Linux after the app crashed or was force-quit. - - **Code** - - * Changed environment variables to live on your saved environments: "This computer" starts clean, existing machine-wide variables are copied into the environments created for you, and the session’s Environment card shows the saved environment you started from. - * Changed SSH sessions to stop continuing an interrupted task on their own: select the session in the sidebar to resume it, a stopped task shows a message with Try again instead of nothing to press, and a task dropped when the host’s sign-in expired while the app was closed now says so. - * Fixed closing the window with the menu-bar icon turned off (Windows and Linux) stopping running sessions without the "Claude is still working" prompt. - * Fixed group delete of Code sessions: when uncommitted changes turn up partway through in a worktree folder the confirmation had not listed, that session is now kept with a notice. - * Fixed SSH sessions dropping their connection while idle or loading a large file, failing on hosts that print a notice before file transfer, staying at "Setting up plugins...", asking you to sign in when retrying was enough, and losing earlier messages on Windows hosts using cmd.exe or PowerShell. - * Fixed the Files pane losing unsaved edits: leaving the session with Auto save off now prompts first, and a file deleted, moved or changed on disk no longer discards your edits or mishandles the next key press. - - **Cowork** - - * Improved computer use on macOS: it no longer saves into hidden folders or types into an app that is not responding, menu commands are no longer reported as disabled after an app was briefly busy, screenshots show under the right step, and text is no longer reported as typed when nothing was. - * Fixed a scheduled task created while the task list was still loading overwriting the prompt of an existing task of the same name. - * Fixed Claude asking for access to a folder the session already had, which left scheduled runs waiting on an approval nobody was there to give. - * Fixed plugin installs, updates and marketplace refreshes sometimes failing or leaving a plugin missing from the list when started right after another, and a removed marketplace leaving an entry behind that could block adding another marketplace with the same name. - * Fixed scheduled tasks skipping a tool that an organization’s approval policy marks "ask": the run now shows the approval prompt and waits, and a newer run of the same task retires an earlier run’s unanswered prompt. - * Fixed the "Scheduled task failed" notification not appearing when a scheduled task’s sandbox could not start. +**v3.1623.0** - **3P** +Bundled Claude Code version: 2.1.304. + +**General** + +* Added Storage to Settings. It shows the disk space Claude uses and lets you free up space by removing inactive Cowork tasks and Code sessions; a low disk space warning opens it, and so does typing `/storage` in Cowork and Code. Not yet available on third-party deployments. +* Changed the minimum Windows version to Windows 10 version 2004 (build 19041). PCs on an older Windows keep the version of Claude they have, and the Microsoft Store version is unchanged. +* Removed the "Open external link" confirmation for most links to other websites. Third-party deployments keep it. +* Fixed messages that had not finished sending being lost after a reload: a failed or still-uploading first message now returns to New chat, an edited message that failed to send reopens in its edit box, and a notice says when a message wasn't sent. +* Fixed pop-out windows (Projects, Code sessions, side panes) closing for good when you sign in again or the app reloads its window; they now reopen. +* Fixed saving a skill failing, and sessions starting without skills, on Windows when the full path of the app's skills folder has 260 characters or more. +* Fixed the app freezing on macOS when Claude asked for permission to use an app and the system did not provide that app's icon. + +**Code** + +* (breaking) Changed `disableDesktopLocalSessions` in Claude Code's managed settings so that the text "true" turns off local sessions, as the boolean does; earlier versions ignored the text. +* (breaking) Changed `sshHostAllowlist` in claude.ai admin settings and in Claude Code's managed settings to also cover a session's jump hosts: each `ProxyJump` host, and the host in a `ProxyCommand` written `ssh -W %h:%p host`, must be on each list that is set, by its `HostName`. +* (breaking) Changed local sessions where claude.ai admin settings apply: a Claude Code managed-settings file on the computer that fails to load now keeps Code sessions from starting or resuming on that computer until it is fixed. +* (breaking) Changed local sessions where claude.ai admin settings apply: the local-session ban (`disableDesktopLocalSessions`) in the computer's own Claude Code managed settings now applies too, so Code sessions on that computer no longer start or resume; sessions already running continue. +* (breaking) Changed saved SSH passwords where claude.ai admin settings apply: the saved-password ban (`disableSshSavedPasswords`) in the computer's own Claude Code managed settings now applies too; passwords already saved are kept but are not offered or used. +* (breaking) Changed SSH where claude.ai admin settings apply: hosts missing from `sshHostAllowlist` in the computer's own Claude Code managed settings are refused, whatever admin settings allow. An empty or malformed list turns SSH off; with no list there, only the admin settings list applies. +* Removed "Download file" for script files such as .js, .bat and .ps1 shown as text in SSH, WSL, cloud and Remote Control sessions; Copy file contents remains. +* Fixed an app update or restart ending work on an SSH host: sessions in the Windows app now carry on with a task still running on the host instead of starting it afresh, and on macOS and Linux a restart after an update no longer ends a task, or drops a permission prompt, older than three days. +* Fixed messages queued or sent in a local session while Claude was working being lost when the app quit, updated or crashed; they now come back at the next launch, held until you send them. +* Fixed removing an inactive session's worktree, from Settings or through Claude, also deleting an archived session's worktree nested inside it, including uncommitted changes; both are now kept, and a worktree that gains uncommitted changes after a clean preview is kept too. +* Fixed SSH sessions in the macOS and Linux apps failing to connect to servers that allow only one session per connection (`MaxSessions 1`). The app now signs in separately for each connection it opens there, so a server that asks for a one-time code at every sign-in asks more than once. +* Fixed the automatic local cleanup deleting a session's Remote Control conversation on claude.ai, for organizations with the Claude Code + Cowork HIPAA configuration; the conversation is now archived. + +**Cowork** + +* Added a Hand off to Claude Code option to the menu under a design's name. It opens Claude Code with a prompt to build the design in your codebase, or gives you the prompt to paste. +* Changed the import from Claude (third-party) where device management turned it on: a copied Cowork task or project now keeps an attached home, Documents or `~/Claude` folder. Folders above home and system folders such as `~/Library` or `AppData` are still left out. +* Fixed global instructions sometimes reverting to an earlier version after an older task was archived, deleted, cleaned up or continued. +* Fixed recently opened tasks being removed by the automatic local cleanup after an app restart, for organizations with the Claude Code + Cowork HIPAA configuration. +* Fixed the folder picker sometimes showing "Couldn't load" until the page was reloaded. + +**3P** + +* Added `quickEntryDefaultShortcut`, which sets the Quick Entry shortcut, or `off` for none, for users who have not chosen their own in Settings. +* Added `releaseChannel`. Set it to `staggered` to have devices update to releases that Anthropic marks after they have fully rolled out on `stable`; those devices skip the releases in between, and fixes reach them later. +* Added an optional `icon` to remote and local `managedMcpServers` entries, a PNG or JPEG image as a base64 `data:` URI of up to 4,096 characters, shown so users can tell connectors apart. +* Added the new Code tab: the New session page with saved environments (folders and SSH hosts), the session rail, sidebar grouping by environment, and the pickers under the message box. Anthropic-hosted cloud environments, Remote Control, voice input and worktrees for extra folders remain unavailable. +* Added to Code tab sessions Claude's plan and a next-step box at the end of a turn, suggested next actions, `/btw` side chats in a pane, and permission requests, questions and suggested tasks shown in the conversation. +* (breaking) Changed `sshHostAllowlist` (beta) to also cover a session's jump hosts: each `ProxyJump` host, and the host in a `ProxyCommand` written `ssh -W %h:%p host`, must be on the list by its `HostName`. The error on a refused session names the host to add. +* Changed "Sign in with Claude Console" to keep your sign-in instead of creating an API key in your organization. The app keeps using a key created by an earlier version until you next sign in. +* Changed `builtinToolPolicy` to accept every built-in tool name Claude Code publishes, so an entry for a tool such as `CronCreate` or `LSP` is no longer dropped. +* Changed `isLocalDevMcpEnabled`: `false` also stops local MCP servers from plugins (your organization's marketplaces included), from Claude Code's `managed-mcp.json` if they use `${VAR}`, and in Code from Claude Code's own configuration files. Remote and org-plugins directory servers still run. +* Changed subagents in Code tab sessions to run in the background even when Claude asks for the foreground, so they keep running after Stop; Claude can also now start a fork of the conversation as a subagent. +* Changed the restart when a device-management profile that sets more than the app-behavior keys first applies while the app runs on a user's own saved configuration: the dialog appears right away, not after `relaunchEnforcementHours`. +* Fixed "Or sign in with Claude.ai" leaving "Couldn't connect to Claude" at every launch where claude.ai is blocked: a launch with nobody signed in to Claude.ai now returns to the organization's sign-in page. On managed devices the error screen also has a "Sign in with your organization" button. +* Fixed Claude in Cowork being told to save its work in a connected folder under an `allowedWorkspaceFolders` entry whose `mode` is `ro`. Claude is now told which folders are read-only and to save new files and edited copies in a writable connected folder or, if there is none, the outputs folder. +* Fixed importing the same folder or exported zip again from Settings > Import & export creating a second copy of every session. Repeating an import made with an earlier version still copies its sessions once more, and a folder on a network share or mapped drive is copied each time. +* Fixed the environment variables editor failing to open or save, plugin command permissions being forgotten at every restart, and adding a project's folders again not restoring Chat's access to them, after the app's data folder was moved to another computer or the system keychain was reset. + +**v2.42304.2** + +Bundled Claude Code version: 2.1.299. + +**General** + +* No user-facing changes. + +**Code** + +* No user-facing changes. + +**Cowork** + +* No user-facing changes. + +**3P** + +* No user-facing changes. + +**v2.42304.0** + +Bundled Claude Code version: 2.1.299. + +**General** + +* Changed the certificate that signs the bundled Claude Code helper (`claude.exe`) on Windows to the renewed one that the app and its installer have used since v2.37337.1. Rules that hold the certificate itself, such as a Microsoft Defender certificate indicator, need the new certificate added beside the old one. +* Changed the import from Claude (third-party) where device management turned it on: after the import, Claude now adds local MCP servers and starts those that were on, installs the desktop extensions and uploaded plugins that your organization allows, and, where your organization allows skill creation, uploads skills that grant tools or declare hooks, all without asking you to confirm. Before, each local MCP server waited for you to confirm its command and settings. Organizations under the HIPAA restriction get none of these. +* Improved the import from Claude (third-party): copied scheduled tasks keep their files and folders. Where device management turned it on and no HIPAA restriction applies, Settings > Import offers your instructions for Claude and Cowork, and tasks keep tool approvals for unchanged local MCP servers. +* Fixed Arabic and Hebrew text reading in the wrong order in chat titles, session titles, messages, plans, search results, file views, feedback dialogs and the Code tab. +* Fixed some plugins never installing after being enabled on claude.ai because one of their files is very repetitive, such as a long empty table. +* Fixed some Update buttons planning a restart with nothing on screen while sessions were still running; they now ask first and can be cancelled. +* Fixed the app sometimes starting with no window open, including after restarting from the Help menu on Windows and Linux when the app had started automatically at sign-in. +* Fixed tool approval prompts staying hidden behind a full-screen MCP app after the chat preview was closed. + +**Code** + +* Added a Context card to the session rail, to the right of the conversation. On plans with usage limits, the ring under the message box now shows plan usage, and context usage is in this card. If the rail is hidden, use the Show session rail button at top right (not yet in third-party deployments). +* Added a session rail to the right of the conversation, with cards including the session's environment, context, connectors, outputs, changes, servers, and background tasks. Right-click a card's header to choose which cards show (not yet in third-party deployments). +* Added environments: save a folder, SSH host, cloud environment, or Remote Control machine, with a worktree and branch setting for each folder, and pick one when you start a session. "Save as environment" at the top of a session saves where it started (not yet in third-party deployments). +* Added nested sessions in local and SSH sessions: Claude can start a task in a separate session, which appears under the original session in the sidebar and reports back to it. In Settings > Claude Code, choose what happens when you ask for an unrelated task (not yet in third-party deployments). +* Added a box at the end of the conversation in local and SSH sessions that shows Claude's plan while it works. When a turn ends, the box can show a short recap with buttons for what to do next (not yet in third-party deployments). +* Added Environment to the sidebar's Group by menu. It groups sessions by their saved local or SSH environment, or by folder or repository when they have none. Custom groups are now called sections (not yet in third-party deployments). +* Changed the New session page: choose where Claude runs and which folder to use in the row under the message box, or pick a recent environment from the card on the page. For a Git folder, Branch and Worktree are at the bottom of the folder menu (not yet in third-party deployments). +* Changed the sidebar's Filter button to Group and sort, which appears when you hover a group heading. Use it to change grouping or sorting, show routines or empty groups, or open View all for archived sessions (not yet in third-party deployments). +* Changed pull request controls to appear in the Changes card on the session rail, instead of in a bar above the message box. Each open pull request's menu has Auto-fix, Merge when ready, and auto-archive options (not yet in third-party deployments). +* Changed the folder and repository menu to appear in the Environment card on the session rail, next to the branch and Remote Control, instead of in the session's title bar (not yet in third-party deployments). +* Changed the row under the message box to hold the permission mode, one menu for model and effort, and the usage ring. The `+` menu and the microphone moved inside the message box (not yet in third-party deployments). +* Changed `/btw` in local sessions to open a side chat in a pane beside the session, with a tab for each side chat (not yet in third-party deployments). +* Changed permission requests and questions to appear in the conversation instead of above the message box. In local and SSH sessions, suggested tasks appear there too (not yet in third-party deployments). +* Changed the Git operations the app runs for you (the commit and stash around a branch switch, the in-folder branch switch, and the push behind "Continue in cloud") to no longer run repository Git hooks; push Git LFS objects from a terminal before continuing in the cloud. +* Removed the "Get started with Claude Code" checklist from the sidebar. +* Fixed "Rewind to here" failing with "Can’t rewind to this message." on any message but the latest in cloud and self-hosted sessions. +* Fixed deleting a session on an SSH host whose helper had not yet updated also deleting a branch holding unpushed commits. +* Fixed SSH sessions silently losing part of Claude's output, getting stuck reconnecting after another session on the same host failed to start, and ending the terminal on Windows computers when the host closed the connection. +* Fixed untracked files in a session's worktrees being deleted when the session was archived after Claude moved it to the cloud. + +**Cowork** + +* Changed computer use on macOS to no longer save files into hidden or protected folders, such as Homebrew's folders and shell start-up locations, or give a document a hidden or otherwise protected name. +* Changed Settings › Import to no longer offer the third-party app’s local MCP servers for organizations under the HIPAA restriction. +* Fixed computer use typing text twice into a busy web page in a background app. +* Fixed Enter selecting a slash menu item instead of sending the message when a "/" word, such as "/s", came after other words. +* Fixed the conversation sometimes jumping back to the bottom when you scroll up with Page Up, Shift+Space or the Up arrow key while Claude is responding. +* Fixed the workspace sometimes failing to start on Windows with a connection timeout error. + +**3P** + +* Added support in the macOS and Linux apps for SSH sessions carrying on across an app restart, and automatic recovery on every platform when Claude Code on the host is lost mid-task while the app is running: the app restarts it and continues the task, even with nobody at the computer. +* (breaking) Changed what a failed `PreToolUse` hook does on Windows computers without Git for Windows: if it sets none of `shell`, `args`, or `onFailure`, it now blocks the tool call. Such a hook runs in PowerShell there, where a command written for Bash can fail, so a hook that matches every tool can block every tool call. This includes hooks in plugins and in Claude Code's managed settings (`managed-settings.json` or the Windows policy registry value), such as one that other software adds. Either install Git for Windows in its default location and then quit and reopen Claude, or put the hook's program in `command` and its arguments in `args`. Add `"onFailure": "block"` if a failed hook should still block the call. +* Changed `claudeAiImport.automatic3pImport` to reinstall, without asking, the optional plugins that a user had switched on from any optional `allowedPluginMarketplaces` entry (GitHub, git, or a URL on any host) with the same source in the old and new organization, not only from the gateway or bootstrap origin. This includes computers that moved organizations before this version, at their first launch with it. +* Changed `mcpPersistentAlwaysAllowEnabled` to also apply to Code sessions on the device, in WSL and over SSH: when it is `false`, MCP tool prompts offer "Allow for this session" instead of "Always allow", and scheduled tasks offer no lasting approval unless `mcpScheduledTaskApprovalLifetimeDays` is one day or more. +* Changed Chat's file-analysis sandbox (`chatAdvancedFileAnalysisEnabled`) to reach the hosts in `coworkEgressAllowedHosts`, for example to install packages. As in Cowork, its commands run without an approval prompt. Before, it had no network access by default. With no list, or an empty one, it still has none. +* Changed session export in Settings > Import & export to cover everything by default instead of the last 30 days and to list what the file includes and leaves out; the import of a Claude Desktop export file also starts on everything. +* Fixed a message typed at the token limit being discarded in Cowork and Chat. The message shown at the limit now also says when the limit resets and, in Cowork and Chat, has a View usage button. +* Fixed Code tab SSH sessions on Windows hosts without Git for Windows refusing every shell command with "Enterprise policy requires sandboxing". The refusal stays for organizations that deny or ask on Bash commands by pattern, or whose `disabledBuiltinTools` holds `Bash` (with or without a pattern), `PowerShell` with a pattern, or a name the app does not recognize. +* Fixed connectors losing their saved sign-in when Claude starts while the macOS keychain is locked; the connector now says what to do. + +**v2.37337.1** + +Bundled Claude Code version: 2.1.295. + +**General** + +* Added "Open in new window" for chats, so a conversation can stay open in its own window beside the main window. +* (breaking) Removed the former managed-configuration key names `isDxtEnabled`, `isDxtSignatureRequired`, and `isDxtDirectoryEnabled`. In a profile that still uses one, the name is now an unrecognized key: its setting no longer applies and the deprecation notice no longer appears, so unsigned extensions load and, on standard deployments, extensions are allowed and the extension directory shows. Set `isDesktopExtensionEnabled`, `isDesktopExtensionSignatureRequired`, and `isDesktopExtensionDirectoryEnabled` to the same values. This differs from earlier notes for third-party deployments, which said extensions would be disabled and only signed extensions would load. A macOS profile or Windows user policy that holds only former names is no longer read as managed configuration, so the device becomes unmanaged. A Windows machine policy or Linux managed settings file that holds only former names is reported as a configuration error, and local settings stay disabled. +* Changed the certificate that signs the Windows app and its installer to a renewed one from the same publisher. Rules that allow Claude by publisher are unaffected; rules that pin the certificate itself need the new certificate added beside the old one. +* Fixed a message that failed to send being lost when the page reloaded; it now stays in the chat with its Retry. +* Fixed chats losing access to this computer's files and apps when registering the computer took more than a few seconds. +* Fixed computer use in the background taking your keyboard: a dropdown menu that a click or key opens in a background app is now closed again at once instead of swallowing what you type. +* Fixed MCP servers and preview dev servers launched through npx or npm failing to start on Windows when Node is installed under Program Files or an argument contains a space. +* Fixed new Cowork tasks and Code sessions still connecting through the previous proxy after a proxy auto-config (PAC) file's answer changed, which failed with connection errors until the app was restarted. +* Fixed plugins loading without their skills and tools, scheduled tasks failing to load, folder reads, and "Open with Claude" failing when the Windows profile lives in an FSLogix or similar profile container. - * Added `desktopHome` for Unified Claude (beta), which combines Chat and Cowork into one experience, with Cowork’s agentic capabilities: set it to `standard` to turn Unified Claude on, to `off` to turn Chat and Cowork off entirely (Code is not affected), or leave it out of your configuration to stay on the current Chat and Cowork split until November 10, when Unified Claude goes on for all orgs. While the key is set, `chatTabEnabled`, `chatAdvancedFileAnalysisEnabled` and `coworkTabEnabled` have no effect. A value the app does not recognize, such as `Standard`, reads as `off`. - * Added `otlpAttrMaxChars`, which sets the length at which Cowork tasks and Code sessions cut captured content, such as a raw API body, in the OpenTelemetry export (256 to 15,000,000 characters; 61,440 when unset). - * Added more to what `claudeAiImport.automatic3pImport` brings to a computer’s new organization: Cowork artifacts, projects, memory and global instructions, scheduled tasks from Cowork and Code, uploaded plugins, saved skills, and the optional plugins a user had on from the organization’s plugins directory or a marketplace served from its gateway’s or bootstrap server’s own address. - * Added two switches for `desktopHome` to the Setup window’s Allowed surfaces section: "Opt into the new Chat and Cowork unified view" and "Chat and Cowork unified view". While the key is set, Allow Chat, Allow Cowork and Advanced file analysis are hidden (their values are kept), and one "Chat and Cowork unified retention period" sets both retention periods. - * Changed `allowedWorkspaceFolders`: in SSH sessions Claude’s file tools can no longer modify a folder marked `ro`, as in a local Code session. Not enforced on Windows hosts, or on a host with Claude Code managed settings of its own; the key’s help text lists the other limits. - * Changed `inferenceModels[].prefer1m` and `modelPrefer1mContext`: each model that offers 1M and has the preference now shows as one model picker entry, with no standard entry beside it. New sessions on it use the 1M context window, also for people who had picked the standard entry; sessions already started keep theirs. Before, the preference only moved the starting selection, and only for the first model. - * Changed what `claudeAiImport.automatic3pImport` does without asking: the Cowork memory and global instructions it now brings over are used at once, and the scheduled tasks, plugins and skills arrive on or off as they were; only a brought-over project’s instructions wait for the user to accept them before new tasks use them. This can also reach computers that moved under an earlier release, at their first launch on this version. - * Removed the "Send to cloud" option from the Code tab’s suggested-task cards, which third-party deployments cannot use. - * Fixed a skill switched off in Customize still being offered to Claude and still running when asked for by name, and a skill deleted there still being offered in a Code session that was already running. - * Fixed Claude’s file edits in a worktree session sometimes landing in the main checkout or in another session’s worktree, except in SSH sessions on a Linux host over OpenSSH. - * Fixed Cowork tasks failing to start on Linux when the memory index is very long. - * Fixed the "Can’t reach" connection warning appearing when the inference provider is reachable but slow to respond. - * Fixed the command palette’s first row ("New chat" or "New session") not starting a conversation. - * Fixed the model picker showing identical rows when the model catalog or an administrator’s model list gives several model ids one name: each such row now shows the part of its id that differs, and its full id on hover. - * Fixed the OpenTelemetry export counting sessions nobody opened: background reads of the Code tab’s slash command and agent lists no longer send records or add to `claude_code.session.count`. - * Fixed tool calls to an OAuth-authenticated server in `managedMcpServers` failing until the next scheduled token refresh when the server rejected the token early, sometimes with a blank error, and failing for up to 30 minutes after the device came back online from a long offline period. - +**Code** - - Bundled Claude Code version: 2.1.293. +* Added Auto save to the Files pane editor, with an option in the pane menu to turn it off. +* Changed SSH on Windows to use only an `ssh.exe` found on `PATH`. A `.bat`, `.cmd` or `.ps1` wrapper named `ssh` is no longer run. +* Fixed Code sessions with hundreds of added folders failing to start on Windows. +* Fixed file edits being skipped in SSH sessions on Mac hosts that use a worktree while the app is closed or the computer is asleep. +* Fixed messages Claude wrote before a tool call disappearing into a collapsed group of tool calls. +* Fixed sessions failing to start when many sessions that each use a worktree of a large repository start at the same time. +* Fixed sessions that hold a very large prompt sometimes showing an error in place of the conversation. +* Fixed sessions with background agents not continuing on their own after the 5-hour usage limit resets. +* Fixed some Claude Code crashes on Windows that cut off a response showing "Session was interrupted" instead of the crash message with Try again. + +**Cowork** + +* Improved the "workspace disk full" prompt so cleaning up frees enough space to keep working. +* Fixed charts, tables, and diagrams in artifacts staying blank when offline or when the network blocked the site their libraries came from. The libraries now come with the app. +* Fixed Cowork tasks on a computer whose administrator turned off the local VM trying to start on that computer instead of in the cloud. +* Fixed messages that could not be sent sometimes appearing as sent, with no error shown. +* Fixed scheduled tasks on your computer that could not be edited after their first run ("Failed to update scheduled task"). +* Fixed the first message of a new task being lost when the app reloaded while the task was starting. + +**3P** + +* Added `developerModeEnabled`, which lets admins turn off Developer Mode and block installing extensions from a folder. It also applies on standard deployments. +* Added a "Not set" or "Allow none" choice to the empty `coworkEgressAllowedHosts` and `sshHostAllowlist` (beta) lists in the Setup window. "Allow none" saves and exports an empty list. +* Added a configuration warning for a `disabledBuiltinTools` entry spelled with underscores or hyphens, such as `web_fetch`; the warning gives the correct name, `WebFetch`. +* (breaking) Removed the deprecation notices for the spellings that stopped being accepted on October 7, 2026: header maps written as a string or list, `inferenceGatewayAuthScheme: "auto"`, the `ask-session` permission value, older `managedMcpServers` entry forms, and the `orgPluginSettings` record form. Such a value is now reported like any other invalid value; the replacements are listed under v1.40609.0. +* (breaking) Removed the former key names `enduserAttribution`, `trustBootstrapLocalExec`, and `inferenceGatewayHeaders`. In a configuration that still uses one, the name is now an unrecognized key: its setting no longer applies and the deprecation notice no longer appears. End-user attribution is then on, except in the Windows registry, where names ignore case and `enduserAttribution` still reads as `endUserAttribution`. A `bootstrapUrl` set by device management (on Windows, machine policy only) is trusted without asking each user. No custom inference headers are sent. Use `endUserAttribution`, `trustBootstrapDelivery`, and `inferenceCustomHeaders` instead. The former extension key names are under General. +* Changed `disabledBuiltinTools`: a `WebFetch` or bare `Bash` entry added by device management now also applies to Cowork and Chat conversations already open. +* Changed `disableNonessentialServices` so that it no longer turns off Chart.js, Grid.js, and Mermaid in artifacts, which now come with the app. +* Changed `managedMcpServers`: an entry whose `toolPolicy` is malformed is no longer dropped. It is kept with that tool, or every tool, blocked, and a configuration error is reported. +* Changed `sshTransport` (beta) on every platform: a value that cannot be read, such as a misspelling, now counts as `builtin` instead of the default engine. +* Changed OAuth-protected MCP connectors to ask you to sign in again once after this update, and again whenever a connector's URL changes. +* Changed the Setup window's `.reg` export to write machine policy (`HKEY_LOCAL_MACHINE`) instead of user policy (`HKEY_CURRENT_USER`); importing the file now needs administrator rights, and deploying it as user policy means replacing `HKEY_LOCAL_MACHINE` with `HKEY_CURRENT_USER` first. +* Changed which hosts the agent's tools reach automatically: your inference provider's, gateway's, and OTLP collector's hosts and `api.anthropic.com` are no longer added to `coworkEgressAllowedHosts` for you. List them if your agents' shell commands, web fetches, or http hooks call them. +* Fixed "Save image" and "Copy image" failing in the Code tab. +* Fixed a connection delay when Claude started before the configuration server was reachable; Claude now retries when you wake or unlock the computer, or return to the app. +* Fixed Auto permission mode being greyed out as "Not available for the selected model" in the Code tab for the Claude Haiku model that supports it, which caused new Code sessions to start in Accept edits. +* Fixed conversations disappearing from the sidebar and not opening when `coworkTabEnabled` is `false`. This affected Cowork tasks, including conversations started from the home screen while Unified Claude (beta) was on. They now stay listed and open read-only until Cowork is re-enabled. +* Fixed Cowork not starting a task when the organization's model list had not loaded. Cowork now waits a short time for the list, then starts the task or shows why it cannot. +* Fixed file edits in an SSH worktree session on a Linux host sometimes landing in the main checkout or another session's worktree. +* Fixed MCP connector sign-in failing through explicit OAuth endpoints for identity providers whose issuer has a path. +* Fixed model pickers showing no Effort control for newer models when `modelCatalogEnabled` is `false`; picker names, descriptions, and recommended effort levels now follow the catalog bundled with the app. +* Fixed scheduled Cowork tasks that never started on a computer where Claude's workspace fails to start; due tasks now start without the workspace after about ten minutes, with commands that need the workspace failing in those runs. +* Fixed the "Strict sandbox mode" switch under Settings › Claude Code, and the /status card's Sandbox row, showing strict mode as off when your organization's configuration already enforces it. + +**v2.31226.1** + +Bundled Claude Code version: 2.1.295. + +**General** - **General** +* No user-facing changes. - * No user-facing changes. +**Code** - **Code** +* No user-facing changes. - * No user-facing changes. +**Cowork** - **Cowork** +* No user-facing changes. - * No user-facing changes. +**3P** - **3P** +* Changed MSIX installs on Windows so that programs started through Git Bash in a session end when the app updates instead of staying open. +* Fixed every request failing on a 1M-context model when the inference gateway or cloud provider refuses the 1M-context capability; the request is now resent without it. - * No user-facing changes. - +**v2.31226.0** - - Bundled Claude Code version: 2.1.289. +Bundled Claude Code version: 2.1.293. - **General** +**General** - * Fixed a reply or tool step that fails to draw taking the whole chat down with it; the reply now shows as plain text, the step reads “Couldn’t load this.”, and the rest of the chat stays. - * Fixed editing a message spoken in voice mode, which could cut the conversation back to its first message; the edit now shows a notice and keeps your words instead. - * Fixed image and document attachments failing to load on Ubuntu 22.04, Debian 12 and other older Linux distributions. - * Fixed installed plugins disappearing after a plugin was uploaded at a moment when the app could not read its list of installed plugins. - * Fixed the app crashing shortly after launch for people with a very large number of Cowork tasks. - * Fixed the whole app closing when a built-in browser tab whose page had crashed was resized, reloaded, or switched to a device size. +* Added skills and local MCP servers to Settings > Import where importing this computer’s third-party history is on: skills saved in Claude (third-party) upload to your own skills automatically, and local MCP servers can be added and started after you confirm the command and settings each one runs with. +* Fixed chats showing "Page not found" when they could not be loaded because of a server or connection problem; the page now says the chat could not be loaded and offers a retry. +* Fixed dictation continuing to record after you let go of the microphone button, when holding it was the first microphone use since the app started. +* Fixed messages being sent under a different organization after the page switched organizations: a message held up by a sign-in prompt is no longer sent, one reported as not sent returns to the message box instead of sending later, and a stopped button or reply send now says why. +* Fixed programs that a session started, such as MCP servers, and the helper processes of local MCP servers staying running on Linux after the app crashed or was force-quit. - **Code** +**Code** - * Fixed a new session quietly switching to Local, and running the prompt on this computer, when the picked Remote Control computer or cloud environment went away while you were typing. - * Fixed Cmd+Q, the Quit menu item and the tray Quit skipping the “Claude is still working” prompt and stopping running sessions without asking. - * Fixed file edits being skipped in SSH sessions on Linux hosts that use a worktree while the app is closed or the computer is asleep. - * Fixed new sessions where Claude couldn’t take actions in the app, such as changing settings, opening files in your editor, or keeping your computer awake. - * Fixed SSH sessions stopping with no message, or sitting idle instead of picking up where they left off, after Claude Code restarted on the remote host; the session now shows an error with Try again and resumes when reopened. - * Fixed typed messages, pasted images and attached files being lost when a message failed to send, or when a new session failed to start or was stopped while starting. +* Changed environment variables to live on your saved environments: "This computer" starts clean, existing machine-wide variables are copied into the environments created for you, and the session’s Environment card shows the saved environment you started from. +* Changed SSH sessions to stop continuing an interrupted task on their own: select the session in the sidebar to resume it, a stopped task shows a message with Try again instead of nothing to press, and a task dropped when the host’s sign-in expired while the app was closed now says so. +* Fixed closing the window with the menu-bar icon turned off (Windows and Linux) stopping running sessions without the "Claude is still working" prompt. +* Fixed group delete of Code sessions: when uncommitted changes turn up partway through in a worktree folder the confirmation had not listed, that session is now kept with a notice. +* Fixed SSH sessions dropping their connection while idle or loading a large file, failing on hosts that print a notice before file transfer, staying at "Setting up plugins...", asking you to sign in when retrying was enough, and losing earlier messages on Windows hosts using cmd.exe or PowerShell. +* Fixed the Files pane losing unsaved edits: leaving the session with Auto save off now prompts first, and a file deleted, moved or changed on disk no longer discards your edits or mishandles the next key press. - **Cowork** +**Cowork** - * Changed computer use on macOS to no longer edit or save hidden files and folders in your home folder, such as `~/.vimrc` or `~/.aws`. - * Fixed a scheduled task that was moved to the cloud showing up as a separate paused task on this computer when cloud tasks failed to load, where turning it on could run the task twice. - * Fixed Claude being unable to use document menu commands, such as New Slide or Undo in Keynote, or to click and drag on some canvases while the app stays in the background. - * Fixed Cowork tasks failing to start in a second copy of the app running on the same Windows account. - * Fixed the app freezing when a second message was sent to a new task before the task had finished starting. +* Improved computer use on macOS: it no longer saves into hidden folders or types into an app that is not responding, menu commands are no longer reported as disabled after an app was briefly busy, screenshots show under the right step, and text is no longer reported as typed when nothing was. +* Fixed a scheduled task created while the task list was still loading overwriting the prompt of an existing task of the same name. +* Fixed Claude asking for access to a folder the session already had, which left scheduled runs waiting on an approval nobody was there to give. +* Fixed plugin installs, updates and marketplace refreshes sometimes failing or leaving a plugin missing from the list when started right after another, and a removed marketplace leaving an entry behind that could block adding another marketplace with the same name. +* Fixed scheduled tasks skipping a tool that an organization’s approval policy marks "ask": the run now shows the approval prompt and waits, and a newer run of the same task retires an earlier run’s unanswered prompt. +* Fixed the "Scheduled task failed" notification not appearing when a scheduled task’s sandbox could not start. - **3P** +**3P** - * Added `claudeAiImport.allowedOrganizationUuids`: the Claude.ai organizations users may import chat history from. When set, users can import only by signing in to Claude.ai, and only from an organization on the list; importing from a file is turned off. - * Added `microsoftAuthDefaultAccount`: when set to `enabled`, Connect on the Microsoft 365 connector on Windows signs in with the work account already signed in to Windows, with no account picker. Defaults to `disabled`. - * Added a “Use a different account” button and a line showing the signed-in account to the Microsoft 365 connector. - * Added an event sent to your OTLP collector when an SSH host isn’t running the sandbox your configuration asks for. - * Added the `desktop_claude_ai_import` event to the desktop OpenTelemetry export at log level `info`: it is logged for each Claude.ai history import made by sign-in or from a file, and for an import by the built-in Claude.ai sign-in it names the organization the history came from. - * Changed `inferenceGatewayAuthScheme: "sso"` to have no end date in this release and later: if `inferenceCredentialKind` is not set, they keep reading `sso` as `inferenceCredentialKind: "interactive"` after October 7, 2026. Earlier releases still stop accepting it on that date. - * Changed connectors on a computer login that several people share: each person now keeps their own built-in and OAuth connector sign-ins. A different person who signs in starts with their connectors disconnected, and the earlier person’s sign-ins are kept for when they sign in again. - * Changed Teams chat search in the Microsoft 365 connector to need the `ChannelMessage.Read.All` permission; without it, searches return a message with a consent link. Grant Entra admin consent, then set Access (`scope`) to the permissions the connector already uses plus this one, and have users reconnect. - * Fixed organization plugins a user installed disappearing after the admin’s plugin folder was redeployed. - * Fixed saving a skill with a very long description causing every skill kept on this computer to be removed. A description over 1,024 characters is now refused with the reason. - * Fixed the Microsoft 365 connector’s Access setting replacing the default permissions (mail, calendar, files) with a single permission when an administrator added one. Access now shows the defaults as selected, so adding one keeps the rest, and a custom list can be reset to the default. - +* Added `desktopHome` for Unified Claude (beta), which combines Chat and Cowork into one experience, with Cowork’s agentic capabilities: set it to `standard` to turn Unified Claude on, to `off` to turn Chat and Cowork off entirely (Code is not affected), or leave it out of your configuration to stay on the current Chat and Cowork split until November 10, when Unified Claude goes on for all orgs. While the key is set, `chatTabEnabled`, `chatAdvancedFileAnalysisEnabled` and `coworkTabEnabled` have no effect. A value the app does not recognize, such as `Standard`, reads as `off`. +* Added `otlpAttrMaxChars`, which sets the length at which Cowork tasks and Code sessions cut captured content, such as a raw API body, in the OpenTelemetry export (256 to 15,000,000 characters; 61,440 when unset). +* Added more to what `claudeAiImport.automatic3pImport` brings to a computer’s new organization: Cowork artifacts, projects, memory and global instructions, scheduled tasks from Cowork and Code, uploaded plugins, saved skills, and the optional plugins a user had on from the organization’s plugins directory or a marketplace served from its gateway’s or bootstrap server’s own address. +* Added two switches for `desktopHome` to the Setup window’s Allowed surfaces section: "Opt into the new Chat and Cowork unified view" and "Chat and Cowork unified view". While the key is set, Allow Chat, Allow Cowork and Advanced file analysis are hidden (their values are kept), and one "Chat and Cowork unified retention period" sets both retention periods. +* Changed `allowedWorkspaceFolders`: in SSH sessions Claude’s file tools can no longer modify a folder marked `ro`, as in a local Code session. Not enforced on Windows hosts, or on a host with Claude Code managed settings of its own; the key’s help text lists the other limits. +* Changed `inferenceModels[].prefer1m` and `modelPrefer1mContext`: each model that offers 1M and has the preference now shows as one model picker entry, with no standard entry beside it. New sessions on it use the 1M context window, also for people who had picked the standard entry; sessions already started keep theirs. Before, the preference only moved the starting selection, and only for the first model. +* Changed what `claudeAiImport.automatic3pImport` does without asking: the Cowork memory and global instructions it now brings over are used at once, and the scheduled tasks, plugins and skills arrive on or off as they were; only a brought-over project’s instructions wait for the user to accept them before new tasks use them. This can also reach computers that moved under an earlier release, at their first launch on this version. +* Removed the "Send to cloud" option from the Code tab’s suggested-task cards, which third-party deployments cannot use. +* Fixed a skill switched off in Customize still being offered to Claude and still running when asked for by name, and a skill deleted there still being offered in a Code session that was already running. +* Fixed Claude’s file edits in a worktree session sometimes landing in the main checkout or in another session’s worktree, except in SSH sessions on a Linux host over OpenSSH. +* Fixed Cowork tasks failing to start on Linux when the memory index is very long. +* Fixed the "Can’t reach" connection warning appearing when the inference provider is reachable but slow to respond. +* Fixed the command palette’s first row ("New chat" or "New session") not starting a conversation. +* Fixed the model picker showing identical rows when the model catalog or an administrator’s model list gives several model ids one name: each such row now shows the part of its id that differs, and its full id on hover. +* Fixed the OpenTelemetry export counting sessions nobody opened: background reads of the Code tab’s slash command and agent lists no longer send records or add to `claude_code.session.count`. +* Fixed tool calls to an OAuth-authenticated server in `managedMcpServers` failing until the next scheduled token refresh when the server rejected the token early, sometimes with a blank error, and failing for up to 30 minutes after the device came back online from a long offline period. - - Bundled Claude Code version: 2.1.288. - - **General** +**v2.26454.2** - * No user-facing changes. +Bundled Claude Code version: 2.1.293. - **Code** +**General** - * No user-facing changes. +* No user-facing changes. - **Cowork** +**Code** - * No user-facing changes. +* No user-facing changes. - **3P** +**Cowork** - * Added read-only access in Chat to folders you add to a project after this update; to use a folder added earlier, add it to the project again and start a new chat. - * Fixed skills uploaded as a `.zip` or `.skill` file keeping only their `SKILL.md`; the archive's other files are now saved, and renaming a skill keeps them. - * Fixed skills with names in other scripts or with punctuation not being found by Cowork and Code sessions, and skill uploads being refused when the zip holds very compressible files or keeps `SKILL.md` deep inside a repository download. - +* No user-facing changes. - - Bundled Claude Code version: 2.1.286. +**3P** - **General** +* No user-facing changes. - * Fixed a crash when opening a tool step whose details list a word such as "constructor". - * Fixed a message that failed to send sometimes looking sent, with Claude still working, or disappearing if you had already started typing the next one; a message that cannot be sent now offers Retry. - * Fixed conversations failing with a request error on every later message after a connector, tool or hook returned an unusually shaped result. - * Fixed Quick Entry on macOS discarding your message when an attached file had been moved, deleted, or could not be read before you sent it; the message is now sent without that file and a notice says so. - * Fixed the Windows app failing to start when the Google or Chrome folder under `LocalAppData` is a junction. - * Removed computer use on macOS 13 and earlier, where its screenshots could never be taken; it requires macOS 14 or later. The Computer use section in Settings now stays visible and explains why when computer use is unavailable. +**v2.26454.0** - **Code** +Bundled Claude Code version: 2.1.289. - * Added comments on lines of an open file in the Files pane: click the + beside a line, or select text and choose Add comment, and the comment is sent with your next message. - * Fixed a finished session showing as working again after a model switch, a built-in slash command such as `/plan`, or a `!` command Claude did not answer, which could hide the usage-limit notice, make Try again send an extra message, or count a resumed turn's time from the wrong point. - * Fixed a session preset's permission mode not being applied when the preset also changed the model. - * Fixed Claude not being able to run commands in the Terminal panel on Windows. - * Fixed new sessions in organizations with Claude Code zero data retention keeping their first few words as their name; they now get a generated title a few seconds after they start. - * Fixed Claude Code failing to start on some Macs right after a desktop update. +**General** - **Cowork** +* Fixed a reply or tool step that fails to draw taking the whole chat down with it; the reply now shows as plain text, the step reads “Couldn’t load this.”, and the rest of the chat stays. +* Fixed editing a message spoken in voice mode, which could cut the conversation back to its first message; the edit now shows a notice and keeps your words instead. +* Fixed image and document attachments failing to load on Ubuntu 22.04, Debian 12 and other older Linux distributions. +* Fixed installed plugins disappearing after a plugin was uploaded at a moment when the app could not read its list of installed plugins. +* Fixed the app crashing shortly after launch for people with a very large number of Cowork tasks. +* Fixed the whole app closing when a built-in browser tab whose page had crashed was resized, reloaded, or switched to a device size. - * Fixed a reply still showing as waiting on you after its sign-in request had expired. - * Fixed a tool request that was restored without its details being approvable before the details arrived; its card now waits for them and offers only Deny. - * Fixed Claude clicking the wrong item, missing an open menu, or bringing the app to the front in apps such as Slack while working in the background. - * Fixed network requests failing on corporate networks where the proxy is set by a one-word host name, and the sandbox being left without a proxy until the app restarted when the proxy auto-config (PAC) file failed to download, such as right after a VPN switch. - * Changed scheduled tasks that Claude creates for you to use "Automatically approve" by default where your organization allows it, so their runs use tools without asking first and pause only when something looks unsafe. +**Code** - **3P** +* Fixed a new session quietly switching to Local, and running the prompt on this computer, when the picked Remote Control computer or cloud environment went away while you were typing. +* Fixed Cmd+Q, the Quit menu item and the tray Quit skipping the “Claude is still working” prompt and stopping running sessions without asking. +* Fixed file edits being skipped in SSH sessions on Linux hosts that use a worktree while the app is closed or the computer is asleep. +* Fixed new sessions where Claude couldn’t take actions in the app, such as changing settings, opening files in your editor, or keeping your computer awake. +* Fixed SSH sessions stopping with no message, or sitting idle instead of picking up where they left off, after Claude Code restarted on the remote host; the session now shows an error with Try again and resumes when reopened. +* Fixed typed messages, pasted images and attached files being lost when a message failed to send, or when a new session failed to start or was stopped while starting. - * Added Excel, Word and PowerPoint previews in the Code tab when Claude's workspace isn't running yet: Excel opens in the document viewer, and opening a Word or PowerPoint file starts the workspace. - * Added the Linux spellcheck dictionary download to the Egress Requirements list; on Linux, `disableNonessentialServices` now also skips that download and turns spellcheck off. - * Changed the default context window for Opus 4.7 and later, Sonnet 5 and later, and Fable 5 and later to 1M tokens behind a gateway or custom base URL; previously 200K unless the "1M context" option was picked. - +**Cowork** - - Bundled Claude Code version: 2.1.284. +* Changed computer use on macOS to no longer edit or save hidden files and folders in your home folder, such as `~/.vimrc` or `~/.aws`. +* Fixed a scheduled task that was moved to the cloud showing up as a separate paused task on this computer when cloud tasks failed to load, where turning it on could run the task twice. +* Fixed Claude being unable to use document menu commands, such as New Slide or Undo in Keynote, or to click and drag on some canvases while the app stays in the background. +* Fixed Cowork tasks failing to start in a second copy of the app running on the same Windows account. +* Fixed the app freezing when a second message was sent to a new task before the task had finished starting. - **General** +**3P** - * Added creating a Google Doc, Sheet or Slides deck from the new chat's Output picker with a connected Google Drive, and fixed the Google pane showing "Owner unknown". - * Fixed a failed message reappearing over newer typing, dictated text dropped when a queued message sent, the first message after a voice conversation replying to an earlier response, and a new chat from the command palette sending into an open incognito chat or being lost. - * Fixed editing a sent message starting from text missing parts of what you sent, attached files disappearing when you typed a reply to Claude's question card, a removed text file still being kept among the chat's files, and large documents from a connected app blocking sending. - * Fixed problems while a chat was open in its own window: the conversation could jump during streaming when the main window was minimized, usage and credits buttons in the main window could stop working, and the browser, artifact, and file preview panes could go blank. - * Fixed Quick Entry: prompts sent while the app was still loading could be lost, files sent to an existing chat lost their names (leaving text, code, and Office documents unreadable to Claude), and using it right after an app update could crash the app. - * Fixed the whole chat being replaced by an error screen when one of Claude's cards (such as a weather or map card) failed to draw; the card's place now says "Couldn't load this." and the rest of the conversation stays open. - * Fixed `/docx`, `/pdf`, `/pptx` and `/xlsx` being rejected as unknown skills and missing from the Cowork slash menu, and removed Cowork-only skills from the Code tab slash menu, where they could not run. - - **Code** - - * Changed Max effort to apply to the current session only, as in the Claude Code CLI, so new sessions no longer start at Max, and fixed changing the effort level in an open session also changing which model new sessions start on. - * Changed worktree cleanup: a session's worktree is kept until the session is archived, however long it sits idle, and worktrees you or the CLI create under `.claude/worktrees` are never removed by the app. - * Fixed archiving a session deleting uncommitted work in a worktree created before the worktree location was changed, on macOS and Linux. - * Fixed Code sessions in a worktree being refused with "This workspace isn't trusted" and never showing the trust dialog, and forked sessions being stopped by a workspace-trust check on their own worktree after an app restart. - * Fixed SSH sessions reopening idle instead of continuing the interrupted task when Claude Code on the remote host had stopped while the app was closed, and SSH connections on Linux not using the ssh-agent from your shell startup files. - * Fixed the main window being replaced by an error screen when a popped-out session's chat hit an error; the chat now shows Try again instead. - * Changed worktree sessions on Claude Code 2.1.275 or later to read project settings, hooks and MCP servers from the project folder you opened instead of the worktree's checked-out branch, with that folder's `.claude` config and `.mcp.json` read-only where the session runs outside it; now also on Windows SSH hosts. - * Fixed a conversation staying on an out-of-date Claude Code after an app update; when the API refuses it, sending again now resumes the same conversation on the current version. - * Fixed SSH sessions being restarted, and their running turns killed, when the remote server was slow to answer the first contact after a reconnect. - * Fixed worktree sessions on Windows sometimes being refused in repositories with a folder named `claude` in their path. +* Added `claudeAiImport.allowedOrganizationUuids`: the Claude.ai organizations users may import chat history from. When set, users can import only by signing in to Claude.ai, and only from an organization on the list; importing from a file is turned off. +* Added `microsoftAuthDefaultAccount`: when set to `enabled`, Connect on the Microsoft 365 connector on Windows signs in with the work account already signed in to Windows, with no account picker. Defaults to `disabled`. +* Added a “Use a different account” button and a line showing the signed-in account to the Microsoft 365 connector. +* Added an event sent to your OTLP collector when an SSH host isn’t running the sandbox your configuration asks for. +* Added the `desktop_claude_ai_import` event to the desktop OpenTelemetry export at log level `info`: it is logged for each Claude.ai history import made by sign-in or from a file, and for an import by the built-in Claude.ai sign-in it names the organization the history came from. +* Changed `inferenceGatewayAuthScheme: "sso"` to have no end date in this release and later: if `inferenceCredentialKind` is not set, they keep reading `sso` as `inferenceCredentialKind: "interactive"` after October 7, 2026. Earlier releases still stop accepting it on that date. +* Changed connectors on a computer login that several people share: each person now keeps their own built-in and OAuth connector sign-ins. A different person who signs in starts with their connectors disconnected, and the earlier person’s sign-ins are kept for when they sign in again. +* Changed Teams chat search in the Microsoft 365 connector to need the `ChannelMessage.Read.All` permission; without it, searches return a message with a consent link. Grant Entra admin consent, then set Access (`scope`) to the permissions the connector already uses plus this one, and have users reconnect. +* Fixed organization plugins a user installed disappearing after the admin’s plugin folder was redeployed. +* Fixed saving a skill with a very long description causing every skill kept on this computer to be removed. A description over 1,024 characters is now refused with the reason. +* Fixed the Microsoft 365 connector’s Access setting replacing the default permissions (mail, calendar, files) with a single permission when an administrator added one. Access now shows the defaults as selected, so adding one keeps the rest, and a custom list can be reset to the default. - **Cowork** - - * Changed organization tool policies in tasks on your computer: a connector tool set to "Restrict to Ask" now asks for your approval, including in "Skip all approvals" mode (newly started tasks only), and an ask policy on a file tool shows an approval prompt instead of refusing the call. - * Fixed "Failed to start Claude's workspace" on Windows when Claude is installed on a drive other than the system drive. - * Fixed a message sent from another window or device being stopped or lost when you restarted from or edited an earlier message at the same time. - * Fixed Office file previews that kept failing until the app was restarted when Claude's workspace got stuck; the preview now says what failed (workspace not responding, no permission to the folder, file gone) and, on third-party deployments, can restart the workspace in place. - * Fixed skills that Claude proposes or writes in a conversation being saveable from the chat cards with no instructions, which saved an empty skill or emptied the one it updated; the cards now say why. - * Fixed the Cowork data export keeping hidden characters in file names. - * Added inline playback for video outputs in the file pane, with thumbnails in the chat. +**v2.19675.1** - **3P** +Bundled Claude Code version: 2.1.288. - * Added `deniedPluginMcpServers`: URL patterns for remote servers that plugins may not connect in Cowork, Chat and Code sessions (in Code sessions, matching servers from Claude Code's configuration files too). A match stays blocked even when `allowedPluginMcpServers` admits it; unset or empty blocks none. - * Changed `userPluginMarketplacesEnabled`: when set to `false`, plugin marketplaces the organization did not provision are hidden, installs and updates from them are refused, and Code and Cowork sessions are told not to load their plugins; previously only adding marketplaces was blocked. - * Removed `a-cdn.anthropic.com` and `a-api.anthropic.com` from the network requirements list under nonessential telemetry; the app has not contacted them since 2.110.0, so firewall allowlists may drop them, and leaving them in place is harmless. - * Updated the Code tab's composer to the redesigned card, with the + menu first in the row under the box, ahead of permission mode and model. - * Fixed the diagnostic report's network reachability check and the Setup window's connectivity test reporting a server on a non-default port as unreachable, and the firewall allowlist omitting that port. - * Fixed two model picker descriptions showing in English when the app is set to another language. - +**General** - - Bundled Claude Code version: 2.1.284. - - **General** - - * Added support for Claude Sonnet 5.5. - * Fixed sessions failing on every message with an API error caused by certain web search results or earlier extended thinking in the conversation's history. - - **Code** - - * Fixed the warning about a changed organization not appearing in sessions. - - **Cowork** - - * No user-facing changes. - - **3P** - - * No user-facing changes. - - - - Bundled Claude Code version: 2.1.281. - - **General** - - * Removed the Cmd+. (Ctrl+. on Windows and Linux) shortcut for showing and hiding the sidebar; Cmd+B (Ctrl+B) still does it. - * Fixed 1Password autofill filling the wrong browser tab when Claude works across several tabs. - * Fixed a message typed into a new chat or task being lost when you are asked to sign in again before sending. - * Fixed Arabic and Hebrew messages drawing quote bars and list bullets on the wrong side, and mirroring code and math. - * Fixed Code tab and Cowork sessions failing to start on some Macs that had updated to version 2.9939.1. - * Fixed copying part of a reply that contains math pasting scrambled text instead of the formula. - * Fixed plugins that contain a `.zip` file never installing in the app after being enabled on claude.ai. - * Fixed the app failing to start on some Windows machines after updating, with the error "Cannot create a stable subkey under a volatile parent key". - - **Code** - - * Changed session deletion to also remove the session's Claude Code transcript and related files from your computer, so `claude --resume` can no longer reopen it. - * Fixed a new session's first message failing with "does not support this model" right after an app update, while the Claude Code version its model needs was still downloading; the message now waits for the download. - * Fixed Auto mode sometimes denying a request you had just typed as if you had not asked for it. - * Fixed earlier messages sometimes not loading when you scroll up in a long session. - * Fixed SSH connections failing with "no route to host" to machines on your local network from a Mac where a Homebrew or other non-Apple `ssh` is first on `PATH`, and with "SSH master exited before the connection was established" from a Windows computer using the new connection engine to a Windows host whose login shell is `cmd.exe`. - * Fixed the app using a full CPU core on Windows after archived sessions' worktrees were cleaned up. - - **Cowork** - - * Fixed Download in the chat's file pane failing for a document Claude saved to your project. - * Fixed scheduled tasks with an empty description showing no prompt, with Run now disabled, edits failing, and Move to cloud blocked. - * Fixed sessions failing to start on Windows for accounts with many connected folders, on standard deployments; third-party deployments are covered only where Auto mode is offered in Cowork and no model's effort is capped. - * Fixed sessions failing to start with a "Claude Code crashed" error on some Windows MSIX (enterprise-packaged) installs. - * Fixed the new-task screen still offering a model an organization admin had turned off, which made the new task fail. - * Fixed the workspace on Windows failing to start with "VM service not running" until the computer was restarted, after its background service had stopped; the app now starts the service again itself. +* No user-facing changes. - **3P** +**Code** - * Added the extended-thinking switch beside the effort control in the Cowork message box. - * Changed `allowedPluginMarketplaces`: a `url` marketplace's `credentialHelper` can print a JSON object of HTTP headers (the form a managed MCP server's `headersHelper` prints), which are sent on every request to that marketplace, in addition to the existing token and credential-line forms. - * Changed `autoModeEnabled`: unless it is `false`, new Code tab sessions now start in Auto mode where the selected model supports it, and when the key is not set the Code tab now offers Auto mode (previously only when it was `true`). Cowork and Chat are unchanged: only `true` offers it in Cowork, where sessions still start by asking before each action. Set the key to `false`, or `disableAutoMode` to `"disable"` in Claude Code's `managed-settings.json`, to keep Auto mode off. - * Changed `deploymentDisplayName` to also stand in for your organization's name in dialogs and messages that otherwise show the inference provider's name. - * Changed `inferenceIdpOidc.resource` (and `inferenceGatewayOidc.resource` in existing gateway configurations) to also accept an identifier with a scheme of its own that is not a web address, such as an AD FS relying-party identifier (`urn:…`), which is sent exactly as written; URLs and values without a scheme behave as before. - * Changed Code and Cowork sessions on a gateway configured with `inferenceGatewayAuthScheme: "x-api-key"` to send no nonessential Claude Code traffic (usage telemetry, error reports, release-note and registry fetches) to `api.anthropic.com`, as when `disableNonessentialTelemetry` is `true`. - * Changed Code and Cowork sessions to start Claude Code with fast mode turned off; `/fast` now reports that fast mode is not available. - * Changed Code tab sessions to ignore every Claude Code provider-selection environment variable set in the user's own environment or in the app's Settings (most were already ignored); the managed configuration alone selects the inference provider. - * Changed connectors on a computer login that several people share: when a different person signs in to the app, the built-in and OAuth connectors now start disconnected and have to be connected again; signing out and back in as the same person keeps them connected. - * Changed managed MCP server connections (`managedMcpServers` and MCP servers from organization plugins) to no longer follow HTTP redirects: a server whose URL redirects now reports a configuration error, so give the server's final address. - * Changed the built-in browser under the default `builtinBrowserDefaultDomainPolicy: "allow"`: Claude now asks before each of its actions on a site that Anthropic's site-safety list flags for confirmation. Only a site listed in `builtinBrowserAllowedDomains`, which applies under `"block"`, skips that confirmation; sites the site-safety list blocks stay blocked under either policy. - * Fixed Code tab sessions on Windows computers without Git for Windows refusing every shell command with "Enterprise policy requires sandboxing". - * Fixed Cowork cost and token usage metrics sent to `otlpEndpoint` being dropped by some OpenTelemetry backends as too frequent; Cowork sessions now export once a minute, Claude Code's default, as the Code tab does. - * Fixed gateway and Bedrock `external-idp` sign-ins through your organization's identity provider running out with no warning when the provider issues no refresh token; the "Your session expires in …" notice now appears ahead of time. - * Fixed read-only tools from managed and built-in MCP servers showing the approval warning meant for tools that can modify data; they now offer "Always allow" unless `mcpPersistentAlwaysAllowEnabled` is `false`. - * Fixed republished plugins from a pinned organization marketplace reaching users only after a restart: a configuration change that only moves `manifestSha256` or a commit `ref` on existing `allowedPluginMarketplaces` entries now applies to the running app. - * Fixed the app's own OpenTelemetry events being rejected with a "401 missing\_token" error by a gateway that users sign in to directly and that is also the `otlpEndpoint`. - +* No user-facing changes. - - Bundled Claude Code version: 2.1.280. +**Cowork** - **General** +* No user-facing changes. - * Fixed a chat message sent with no network connection appearing to send for about a minute before failing; it now fails within a few seconds and says you went offline, and a connection that has gone quiet after your computer wakes or your network changes reconnects right away. - * Fixed a message sent while Claude is still working sometimes being ignored, and sometimes landing out of order in the transcript with the step before it looking unfinished. - * Fixed Claude becoming the default app for files such as .md and .docx, and Windows asking which app to use for files that already have a default app. Claude also no longer appears in the macOS "Open with" menu for Excel and PowerPoint files; "Other…" in that menu still opens them in Claude. - * Fixed editing a message while another reply is still running losing your edited text when the server refuses the edit; the editor now reopens with your words. - * Fixed the app freezing for a few seconds after launch or reload on some machines, most often on Windows. - * Fixed the whole window being replaced by a "Couldn't finish loading" screen when a chat's side panel failed to download; the chat now stays open and the panel's button shows the problem with a Retry button. +**3P** - **Code** +* Added read-only access in Chat to folders you add to a project after this update; to use a folder added earlier, add it to the project again and start a new chat. +* Fixed skills uploaded as a `.zip` or `.skill` file keeping only their `SKILL.md`; the archive's other files are now saved, and renaming a skill keeps them. +* Fixed skills with names in other scripts or with punctuation not being found by Cowork and Code sessions, and skill uploads being refused when the zip holds very compressible files or keeps `SKILL.md` deep inside a repository download. - * Changed SSH sessions on the new connection engine (the computer's own OpenSSH, the default on macOS and Linux) to run the MCP servers from your desktop settings under Claude Code on the remote machine, so their tools keep working while the app is closed; the session's MCP list says when one isn't installed there or the host already has its own. - * Fixed Claude asking for approval before every terminal command while Remote Control was on, even when you were typing at your computer; it now asks only when the work was started or steered from another device, and that card can turn Remote Control off for the session. - * Fixed long delays in large repositories when starting a new worktree session and when archiving or deleting a session, including the app freezing for up to half a minute on macOS when the repository has a very large `node_modules` folder. - * Fixed resuming a session failing with "this session's branch is checked out somewhere else" when only the session's own worktree, in the app's worktrees folder, had the branch checked out. - * Fixed sessions starting slowly, and already-open sessions briefly stalling, when many sessions are open. - * Fixed sessions that were waiting on your reply being auto-archived shortly after the app restarted, and the sidebar losing their needs-input marker on restart. - * Fixed SSH connections on some Windows computers failing with "spawn EPERM" or never asking for a password, and connections failing over a private key file that other accounts could read; the app now falls back to its built-in SSH engine, or makes the key file private, and connects. - * Fixed two causes of repeated requests to sign in again: a brief network interruption no longer signs the Code tab out while Chat stays signed in, and a sign-in renewal is no longer thrown away when the server's answer arrives just after a 30-second limit. +**v2.19675.0** - **Cowork** +Bundled Claude Code version: 2.1.286. - * Added the health-data consent dialog and the Microsoft 365 work-account notice before a connector is added from a chat suggestion or the suggested-connectors card. - * Fixed "Couldn't delete this task" on Windows when deleting a task that was running or had just finished. - * Fixed built-in and account skills loading without the Skill tool; they load through it again, as plugin skills do, so references to a skill's own folder resolve. - * Fixed connector suggestions in chat offering Connect for a connector your organization has not enabled, which then failed with a permissions message; the suggestion now offers Request where your organization accepts connector requests, and otherwise says to ask an organization owner. - * Fixed messages that start with a file path or file name, such as `/tmp/notes.txt`, being refused with an "Unknown skill" error instead of being sent. - * Fixed workspace setup failing on every launch after a corrupted download, including with the offline installer. +**General** - **3P** +* Fixed a crash when opening a tool step whose details list a word such as "constructor". +* Fixed a message that failed to send sometimes looking sent, with Claude still working, or disappearing if you had already started typing the next one; a message that cannot be sent now offers Retry. +* Fixed conversations failing with a request error on every later message after a connector, tool or hook returned an unusually shaped result. +* Fixed Quick Entry on macOS discarding your message when an attached file had been moved, deleted, or could not be read before you sent it; the message is now sent without that file and a notice says so. +* Fixed the Windows app failing to start when the Google or Chrome folder under `LocalAppData` is a junction. +* Removed computer use on macOS 13 and earlier, where its screenshots could never be taken; it requires macOS 14 or later. The Computer use section in Settings now stays visible and explains why when computer use is unavailable. - * Added `inferenceCredentialKind: "external-idp"` on the gateway and Bedrock providers: users sign in through your organization's OpenID Connect identity provider, configured with the shared `inferenceIdpOidc` and `inferenceIdpAuthFlow` keys (system browser by default, or the OS Microsoft Entra broker), and the user's token is sent as the Bearer credential on every inference request; on Bedrock it goes to a proxy that validates the token, so `inferenceBedrockBaseUrl` is required and the models must be listed in `inferenceModels` (no model discovery). The gateway-only spellings (`inferenceCredentialKind: "interactive"` with `inferenceGatewayOidc` and `inferenceGatewayOidcAuthFlow`) are deprecated with no end date and keep working. - * Added `keepAwakeEnabled`: set it to `false` so Claude never keeps the computer awake; the keep-awake switches in Settings, the Scheduled page and the Code tab are hidden. Scheduled tasks themselves stay on. - * Added `mcpScheduledTaskApprovalLifetimeDays`: limits how many days a scheduled task in Cowork or the Code tab may reuse a lasting MCP-tool approval before it asks again. The lasting option is offered even while persistent tool approvals are turned off, and `0` removes it. - * Changed performance timing telemetry (part of essential telemetry) to go to `claude.ai` first instead of straight to Datadog, so essential telemetry now also needs `claude.ai`: most configurations already have that host on their network requirements list under auto-updates or nonessential telemetry, and one that sets `updateViaUpdatesHost` or `disableAutoUpdates` together with `disableNonessentialTelemetry` now lists it under essential telemetry. Datadog's intake hosts stay on the list as the fallback route. - * Removed a temporary vendor-specific exception from custom connector validation: OAuth authorization server metadata that declares an issuer not matching the metadata URL now fails validation again. - * Fixed a crash on Windows that could close the app while the Microsoft 365 connector or another Microsoft Entra sign-in was talking to the Windows account broker. - * Fixed managed connectors configured with their own OAuth client connecting without credentials, instead of prompting for sign-in, when the server accepts unauthenticated connections. - * Fixed Microsoft 365 connector sign-in through Company Portal or the Windows account broker requesting only `offline_access` instead of the permissions in the connector's `scope` setting. Affected members may be asked to reconnect, and in tenants whose Entra admin consent doesn't cover every permission in `scope` they may see Microsoft's consent or admin-approval page until the missing permissions are consented. - * Fixed organization sign-in with Microsoft Entra ID asking users to sign in again after a restart when `bootstrapOidc.scopes` uses `/.default`. - * Fixed pop-out windows doing nothing: "Open in new window" and ⌘-click (or Ctrl+click on Windows and Linux) for Code tab sessions, side panes, the side chat, and Pop out on Cowork live artifacts. - - - - Bundled Claude Code version: 2.1.280. - - **General** - - * Added support for Claude Opus 5.5. - * Fixed sessions that could hang with no response after an internal error; the error is now shown. - * Fixed some conversations failing on every message with a "text content blocks must be non-empty" error, including after resuming. - - **Code** - - * Added `AGENTS.md` support: in a folder with no `CLAUDE.md`, Claude reads `AGENTS.md` for project instructions (not yet in third-party deployments). - * Fixed Claude being unable to read the output of its own background commands in sessions restricted by an administrator's allowed workspace folders. - - **Cowork** - - * No user-facing changes. - - **3P** - - * No user-facing changes. - - - - Bundled Claude Code version: 2.1.275. - - **General** - - * Fixed sessions failing to start or resume when their saved transcript contained a malformed entry. - - **Code** - - * Fixed rewinding in forked and background sessions sometimes restoring a corrupted or truncated file. - - **Cowork** - - * No user-facing changes. - - **3P** - - * No user-facing changes. - - - - Bundled Claude Code version: 2.1.274. - - **General** - - * Changed the sidebar's Pinned list to show its first 20 items, with a Show more link for the rest. - * Fixed connector and extension tools in Cowork and Code sessions failing with "expected nonoptional" when Claude left out an optional parameter that has a default. - * Fixed plugins past the first 100 in a marketplace not opening from Customize. - * Fixed Read Aloud continuing to play the old response after you regenerate, edit, or retry a reply, and cutting off early when a server error ended the read. - * Fixed some extensions that use the built-in Node.js runtime stopping with a "Server disconnected" error right after they start. - * Fixed the app closing and then failing to reopen on some Windows-on-ARM (Snapdragon) PCs installed from the Microsoft Store package. - * Fixed update restarts ending Code tab sessions and MCP servers abruptly instead of shutting them down the way quitting does. - * Fixed re-enabled plugins sometimes turning themselves back off, and new sessions sometimes starting without a plugin that was shown as enabled. +**Code** - **Code** +* Added comments on lines of an open file in the Files pane: click the + beside a line, or select text and choose Add comment, and the comment is sent with your next message. +* Fixed a finished session showing as working again after a model switch, a built-in slash command such as `/plan`, or a `!` command Claude did not answer, which could hide the usage-limit notice, make Try again send an extra message, or count a resumed turn's time from the wrong point. +* Fixed a session preset's permission mode not being applied when the preset also changed the model. +* Fixed Claude not being able to run commands in the Terminal panel on Windows. +* Fixed new sessions in organizations with Claude Code zero data retention keeping their first few words as their name; they now get a generated title a few seconds after they start. +* Fixed Claude Code failing to start on some Macs right after a desktop update. - * Added file viewing to cloud sessions, so file links in the transcript open in the app, the Files pane can search the session's files, and the Background tasks panel shows background command output. - * Fixed `!` commands and a code block's Run being dropped when the terminal was not ready; they now run within seconds, use the selected terminal tab when it is idle, show as terminal rows when sent while Claude is still working, and no longer leave the session marked as running after their output is sent. - * Fixed a case where a session could stop accepting messages after the app relaunched or the computer slept, until the app was restarted. - * Fixed a routine created with every connector removed still using all of your connectors. - * Fixed new sessions sometimes taking minutes to start while another session's worktree was being cleaned up or recycled. - * Fixed Plan mode skipping permission prompts when the Bypass permissions option is on and the session fell back to an older bundled Claude Code CLI while an update downloaded. - * Fixed turns failing with "OAuth token has expired" hours into a session; the token is now renewed in the background, and when a fresh sign-in is genuinely required the app asks before sending and keeps your message. - * Fixed sessions in large repositories starting slowly, including repositories that use a `.worktreeinclude` file, and worktrees occasionally starting without their local settings files. +**Cowork** - **Cowork** +* Fixed a reply still showing as waiting on you after its sign-in request had expired. +* Fixed a tool request that was restored without its details being approvable before the details arrived; its card now waits for them and offers only Deny. +* Fixed Claude clicking the wrong item, missing an open menu, or bringing the app to the front in apps such as Slack while working in the background. +* Fixed network requests failing on corporate networks where the proxy is set by a one-word host name, and the sandbox being left without a proxy until the app restarted when the proxy auto-config (PAC) file failed to download, such as right after a VPN switch. +* Changed scheduled tasks that Claude creates for you to use "Automatically approve" by default where your organization allows it, so their runs use tools without asking first and pause only when something looks unsafe. - * Fixed plugin skills that reference `${CLAUDE_PLUGIN_ROOT}` or `${CLAUDE_SKILL_DIR}` sometimes running their commands with those paths blank. - * Fixed preinstalled Node.js packages such as `pptxgenjs`, `docx`, `pdf-lib` and `sharp` not being found by `require()`. - * Fixed search and session loading crashing on very long conversations. - * Fixed stacked permission prompts sliding up under the mouse pointer right after one is answered, which could send the next click to the wrong prompt. - * Fixed workspace updates failing with "Not enough disk space" on computers that had enough room once the update replaced the previous version. +**3P** - **3P** +* Added Excel, Word and PowerPoint previews in the Code tab when Claude's workspace isn't running yet: Excel opens in the document viewer, and opening a Word or PowerPoint file starts the workspace. +* Added the Linux spellcheck dictionary download to the Egress Requirements list; on Linux, `disableNonessentialServices` now also skips that download and turns spellcheck off. +* Changed the default context window for Opus 4.7 and later, Sonnet 5 and later, and Fable 5 and later to 1M tokens behind a gateway or custom base URL; previously 200K unless the "1M context" option was picked. - * Added `allowedPluginMcpServers`: when set, Cowork, Chat and Code sessions connect only the plugin MCP servers whose URL matches an entry (an empty list allows none), in addition to `managedMcpServers` and organization plugins, even when `managedMcpServers` is empty; the app also stops starting plugin MCP servers on the device, except for organization plugins. The Setup window can now author an empty list for this key and for `allowedWorkspaceFolders`. - * Added `builtinBrowserEnabled` to offer a built-in browser in Cowork and Code sessions, with `builtinBrowserDefaultDomainPolicy`, `builtinBrowserAllowedDomains`, and `builtinBrowserBlockedDomains` to control which sites Claude may open in it. - * Added `inferenceCredentialHelperWindows`: the absolute path of the credential helper executable on Windows devices, used there instead of `inferenceCredentialHelper`, so one configuration can serve Windows and macOS or Linux devices. - * Added a Salesforce preset to the plugin marketplace picker in the Setup window. - * Changed `inferenceFoundryResource`: a value delivered by a bootstrap URL the user configured themselves (in Settings or a local configuration file) now asks that user to approve it before it takes effect, as the Foundry base URL and the other providers' endpoints already do, and declining quits the app. Because the resource name is required, each such Foundry install prompts once after updating. Values delivered through device management, or by a bootstrap URL that device management set or that `trustBootstrapDelivery: true` covers, are unchanged and never prompt. - * Updated Customize to a full page with redesigned Skills, Plugins and Connectors lists (search, an Add menu, a page per item) in place of the old tables in Settings; Memory moved under Settings. - * Fixed a `Bash` entry in `disabledBuiltinTools` or `builtinToolPolicy` not applying to PowerShell commands on Windows PCs without Git for Windows; a `Bash(**)` entry is now treated as `Bash`. - * Fixed Settings > Desktop app > General on macOS offering a Voice shortcut that could not work; a Caps Lock or custom shortcut chosen earlier no longer opens the dictation bar. - * Fixed the app continuously re-fetching its configuration from the configuration server and re-testing the inference connection while the inference provider rejects the configured API key. - * Fixed the Code tab's `/status` card showing a placeholder account; it now shows your signed-in identity and the deployment name. - * Fixed the model list, organization configuration, or an MCP server occasionally failing to load right after launch when `egressProxyUrl` is set and the network is reachable only through that proxy. - * Fixed the model picker listing a model twice when a gateway's `/v1/models` endpoint returns both `` and `[1m]`; the pair now shows as the model and its 1M-context row. - +**v2.16120.0** - - **General** +Bundled Claude Code version: 2.1.284. - * Added a `chromiumFlags` setting in `claude_desktop_config.json` for GPU-related switches such as `--disable-gpu`, applied before graphics start up, so users can work around GPU driver crashes and rendering issues on launch, including on Microsoft Store installs where command-line flags cannot be passed. - * Changed the error screen shown after repeated crashes or failed starts to say what happened and offer a Restart Claude button, and crash recovery now waits progressively longer between retries instead of retrying immediately. - * Fixed a new chat's first message sometimes being sent twice after a reload, failing repeatedly with "Missing files" over an attachment uploaded for an earlier chat attempt, or dropping you back to an empty new-chat page when the first reply was interrupted; also fixed an edited message being sent again each time Enter was pressed in the edit box that stays open after Save. - * Fixed the app freezing and then reloading on Windows (Microsoft Store and other MSIX installs) while an update downloaded in the background. - * Fixed the app sometimes failing to launch on Windows when its settings file briefly couldn't be opened. - * Fixed the Code tab's agent detection, output styles, and other desktop features sometimes needing you to sign in to your Claude account again after a single network or server error while that sign-in was being renewed. +**General** - **Code** +* Added creating a Google Doc, Sheet or Slides deck from the new chat's Output picker with a connected Google Drive, and fixed the Google pane showing "Owner unknown". +* Fixed a failed message reappearing over newer typing, dictated text dropped when a queued message sent, the first message after a voice conversation replying to an earlier response, and a new chat from the command palette sending into an open incognito chat or being lost. +* Fixed editing a sent message starting from text missing parts of what you sent, attached files disappearing when you typed a reply to Claude's question card, a removed text file still being kept among the chat's files, and large documents from a connected app blocking sending. +* Fixed problems while a chat was open in its own window: the conversation could jump during streaming when the main window was minimized, usage and credits buttons in the main window could stop working, and the browser, artifact, and file preview panes could go blank. +* Fixed Quick Entry: prompts sent while the app was still loading could be lost, files sent to an existing chat lost their names (leaving text, code, and Office documents unreadable to Claude), and using it right after an app update could crash the app. +* Fixed the whole chat being replaced by an error screen when one of Claude's cards (such as a weather or map card) failed to draw; the card's place now says "Couldn't load this." and the rest of the conversation stays open. +* Fixed `/docx`, `/pdf`, `/pptx` and `/xlsx` being rejected as unknown skills and missing from the Cowork slash menu, and removed Cowork-only skills from the Code tab slash menu, where they could not run. - * Changed SSH and WSL sessions to keep running when left idle in the background instead of being stopped, and fixed them stalling for up to 10 minutes after each reply while the desktop app was closed or the computer was asleep. - * Removed the calendar view from the Routines page; routines now always show as cards. - * Fixed messages sent to an SSH session around a disconnect being dropped, discarded with an error, or answered with a prompt to send them again; the app now checks whether the message arrived and delivers it once the session is restored. - * Fixed permission requests and questions not appearing in popped-out windows and split panes after the main window switched away from the Code tab. - * Fixed text typed in the prompt box sometimes disappearing, along with its undo history, while a session was open. - * Fixed the app freezing on launch or session switch when a very large unsent prompt had been saved; it now comes back as an editable "Saved draft" attachment. +**Code** - **Cowork** +* Changed Max effort to apply to the current session only, as in the Claude Code CLI, so new sessions no longer start at Max, and fixed changing the effort level in an open session also changing which model new sessions start on. +* Changed worktree cleanup: a session's worktree is kept until the session is archived, however long it sits idle, and worktrees you or the CLI create under `.claude/worktrees` are never removed by the app. +* Fixed archiving a session deleting uncommitted work in a worktree created before the worktree location was changed, on macOS and Linux. +* Fixed Code sessions in a worktree being refused with "This workspace isn't trusted" and never showing the trust dialog, and forked sessions being stopped by a workspace-trust check on their own worktree after an app restart. +* Fixed SSH sessions reopening idle instead of continuing the interrupted task when Claude Code on the remote host had stopped while the app was closed, and SSH connections on Linux not using the ssh-agent from your shell startup files. +* Fixed the main window being replaced by an error screen when a popped-out session's chat hit an error; the chat now shows Try again instead. +* Changed worktree sessions on Claude Code 2.1.275 or later to read project settings, hooks and MCP servers from the project folder you opened instead of the worktree's checked-out branch, with that folder's `.claude` config and `.mcp.json` read-only where the session runs outside it; now also on Windows SSH hosts. +* Fixed a conversation staying on an out-of-date Claude Code after an app update; when the API refuses it, sending again now resumes the same conversation on the current version. +* Fixed SSH sessions being restarted, and their running turns killed, when the remote server was slow to answer the first contact after a reconnect. +* Fixed worktree sessions on Windows sometimes being refused in repositories with a folder named `claude` in their path. - * Fixed browser, computer use, and website access permission prompts in Dispatch sometimes being denied on their own before you could answer. - * Fixed connected-folder issues: deleting a file failed with "Could not find mount for path" when two connected folders shared a name, and Claude could see the wrong files in a newly connected folder named `.claude`. - * Fixed Cowork tasks being unable to read or update existing artifacts. - * Fixed Cowork startup problems on Windows: some tasks failed to start, a task could appear to start when your drive couldn't be reached (it now stops with a clear error), mapped network drives no longer hold up startup, and projects now load and save on virtual desktops that use profile containers such as FSLogix. - * Fixed Reconnect on an enterprise-managed connector doing nothing when your SSO session had expired; it now signs you in with SSO again, and offers signing in with your own account after a failed attempt. +**Cowork** - **3P** +* Changed organization tool policies in tasks on your computer: a connector tool set to "Restrict to Ask" now asks for your approval, including in "Skip all approvals" mode (newly started tasks only), and an ask policy on a file tool shows an approval prompt instead of refusing the call. +* Fixed "Failed to start Claude's workspace" on Windows when Claude is installed on a drive other than the system drive. +* Fixed a message sent from another window or device being stopped or lost when you restarted from or edited an earlier message at the same time. +* Fixed Office file previews that kept failing until the app was restarted when Claude's workspace got stuck; the preview now says what failed (workspace not responding, no permission to the folder, file gone) and, on third-party deployments, can restart the workspace in place. +* Fixed skills that Claude proposes or writes in a conversation being saveable from the chat cards with no instructions, which saved an empty skill or emptied the one it updated; the cards now say why. +* Fixed the Cowork data export keeping hidden characters in file names. +* Added inline playback for video outputs in the file pane, with thumbnails in the chat. - * Added `inferenceCredentialHelperArgs`: a list of arguments passed in order to the `inferenceCredentialHelper` script, so one installed script can serve several environments; when unset the script runs with no arguments, as before. - * Added `inferenceFoundryBaseUrl`: routes Azure AI Foundry requests from Chat, Cowork, and Code through a gateway or proxy you run instead of the resource's own endpoint; it takes the same value as Claude Code's `ANTHROPIC_FOUNDRY_BASE_URL`. - * Added `redirectHost` to `bootstrapOidc`, to `inferenceGatewayOidc` (interactive gateway sign-in), and to `inferenceVertexWorkforceOidc` (Vertex workforce sign-in), so organizations whose identity provider only accepts `localhost` in a registered redirect URI can complete browser sign-in; the default remains `127.0.0.1`. - * Added `scheduledTasksEnabled`: set it to `false` to turn off scheduled tasks in Cowork and Code; the Scheduled page is hidden, existing tasks stop running, and Claude can no longer schedule new work. - * Added effort and default-model controls: `defaultModelEffort` sets the effort level the default model starts at, `maxEffort` on an `inferenceModels` entry hides that model's higher effort levels and holds Code sessions to the cap, and `alwaysStartWithDefaultModel` starts every new conversation or task on the default model and stops saving a person's model and effort changes as their default. The Code tab also now uses the standard model picker, with effort as its own control beside the model name. - * Added model catalog support: model names, descriptions, and thinking or effort options in the model picker now follow Anthropic's published Claude Code model catalog, matching what first-party users see, with your configured model list and order unchanged. By default the app fetches the signed catalog from `downloads.claude.ai` (the host it already uses for workspace and Claude Code downloads) every 5 to 15 minutes and keeps the last catalog it fetched, or the copy bundled with the app, when that host cannot be reached; set `modelCatalogEnabled` to `false` to keep the app's built-in labels and make no catalog request, or `modelCatalogUrl` to fetch the catalog and its signature file from a mirror inside your network instead (the document is still verified against the key built into the app). - * Changed Chat to stop asking for approval when Claude hands back a file it produced and, with advanced file analysis on (`chatAdvancedFileAnalysisEnabled`), at each step of analyzing an attached file, matching Cowork; connector actions still ask. To keep the per-step prompt in Chat and Cowork, add `"Bash": "ask"` to `builtinToolPolicy`. - * Changed the Cowork workspace's and other native log files on macOS to be written to `~/Library/Logs/Claude-3p` with the rest of the deployment's logs instead of `~/Library/Logs/Claude`. - * Changed MCP tool permissions: entries in `managedMcpServers` and `orgPluginSettings` now apply to MCP servers from any installed plugin, including ones that run locally, a `managedMcpServers` entry can use `transport: "policy-only"` to set tool permissions for a server a plugin provides without declaring how to launch it, and permission rules now also apply to tools whose names contain characters such as dots or spaces. - * Changed SSH connections in Code sessions on macOS and Linux to run through the OpenSSH `ssh` program on the device by default, so the organization's own SSH setup (for example Kerberos sign-in and `ssh_config` options) applies; set `sshTransport` (beta) to `builtin` to keep the app's built-in SSH library. - * Fixed "Instructions for Claude" in Settings appearing blank right after saving, and profile settings switching to a different saved copy after a launch that asked the user to sign in. - * Fixed Duplicate saving an empty copy of a configuration, and Claude API key sign-in overwriting a saved configuration, when the configuration's file could not be read, for example while another program briefly had it locked. - * Fixed sign-in guidance when the deployment's credential has no sign-in to repeat: authentication error cards now show that credential's own guidance instead of asking to sign in again, the sign-in card says what failed when sign-in succeeded but the organization's configuration could not be loaded, and a gateway 403 is reported as a provider error instead of a request to re-enter credentials. - * Fixed the model picker listing the same model name many times when a gateway returns several models under one display name; the extras now appear under More models, labelled by the part of the model ID that differs. - * Fixed scheduled tasks silently not running after the provider sign-in (such as AWS IAM Identity Center) had expired; they now wait and run once you sign in again, and the "Scheduled task failed" notification now appears when a task could not start. - +**3P** - - Microsoft has released a Windows update that fixes the issue where Cowork could not reach your files on Windows PCs. Install the latest Windows update and restart your PC. On Windows 11 24H2 and 25H2 the fix is [KB5129195](https://support.microsoft.com/en-us/servicing/os/windows-11/2026/09/kb5129195-windows-11-24h2-25h2-security-update). On Windows 11 23H2 the fix is [KB5129242](https://support.microsoft.com/en-us/servicing/os/windows-11/2026/09/kb5129242-windows-11-23h2-update). On Windows 10 21H2 and 22H2 the fix is [KB5129236](https://support.microsoft.com/en-us/servicing/os/windows-10/2026/09/kb5129236-windows-10-21h2-22h2-update). No Claude Desktop update is needed. - - - - **General** - - * Updated the bundled Claude Code CLI to version 2.1.270. - * Fixed organization plugins enabled through Claude Code's managed settings not loading; they load from the next session. - * Fixed sessions with a very large prompt getting permanently stuck on a "Prompt is too long" error. - - **Code** - - * Fixed users sometimes being told a model they have access to is restricted, and a running session silently switching to the organization's default model. - - **Cowork** - - * No user-facing changes. - - **3P** - - * No user-facing changes. - - - - **General** - - * No user-facing changes. - - **Code** - - * No user-facing changes. - - **Cowork** +* Added `deniedPluginMcpServers`: URL patterns for remote servers that plugins may not connect in Cowork, Chat and Code sessions (in Code sessions, matching servers from Claude Code's configuration files too). A match stays blocked even when `allowedPluginMcpServers` admits it; unset or empty blocks none. +* Changed `userPluginMarketplacesEnabled`: when set to `false`, plugin marketplaces the organization did not provision are hidden, installs and updates from them are refused, and Code and Cowork sessions are told not to load their plugins; previously only adding marketplaces was blocked. +* Removed `a-cdn.anthropic.com` and `a-api.anthropic.com` from the network requirements list under nonessential telemetry; the app has not contacted them since 2.110.0, so firewall allowlists may drop them, and leaving them in place is harmless. +* Updated the Code tab's composer to the redesigned card, with the + menu first in the row under the box, ahead of permission mode and model. +* Fixed the diagnostic report's network reachability check and the Setup window's connectivity test reporting a server on a non-default port as unreachable, and the firewall allowlist omitting that port. +* Fixed two model picker descriptions showing in English when the app is set to another language. - * Changed the automatic move of scheduled tasks to the cloud, for accounts where it has started: the app now waits about a minute after the computer wakes, and while offline checks again each minute, instead of trying at once and then waiting hours after a failed try. - * Fixed two problems with local projects that are moving to claude.ai, for accounts where that move has started: a project could refuse new tasks for hours while part of its memory copy waited on the server (it now accepts new tasks and the copy finishes in the background), and memory files shown in a moved project's earlier tasks would not open. +**v2.9939.4** - **3P** +Bundled Claude Code version: 2.1.284. - * No user-facing changes. - +**General** - - **General** +* Added support for Claude Sonnet 5.5. +* Fixed sessions failing on every message with an API error caused by certain web search results or earlier extended thinking in the conversation's history. - * Changed messages sent while Claude is still replying: they now wait in the conversation looking like sent messages, the first waiting message offers Send now, which stops the current reply and sends it next, and Cmd/Ctrl+Enter sends your message right away, interrupting the current turn. - * Fixed Claude's clicks, scrolls, screenshots, and page scripts in the built-in browser stalling, timing out, or failing while the browser pane was hidden or the window was minimized or in the background, and fixed elements picked with "Select element" reaching Claude without their styles or with a screenshot of the wrong part of the page. - * Fixed links that open a new tab to claude.ai or claude.com pages, like Upgrade buttons and some download links, doing nothing when clicked; they now open in your default browser. - * Fixed sites on a private network (VPN, Tailscale, or intranet hosts) loading without their styles, scripts, or data in the built-in browser, and URLs typed into the built-in browser in cloud sessions not reaching private-network sites. - * Fixed the app window resetting to its default size and position after an update or a display change. +**Code** - **Code** +* Fixed the warning about a changed organization not appearing in sessions. - * Added a default transcript view setting: choose whether new sessions open in the Normal, Thinking, or Verbose view from Settings > Claude Code, or make the current view the default from a session's Transcript view menu. The choice syncs between the desktop app and claude.ai. - * Fixed Code sessions failing to start on some Microsoft Store and MSIX installs on Windows. - * Fixed model changes being refused with a message saying organization-managed hooks could not be checked, for some organizations that manage Claude Code plugins; the session now restarts on the chosen model. - * Fixed sessions failing to start on Windows for accounts with many plugins installed. - * Fixed several SSH session issues: hosts slowly accumulating leftover background processes from older Claude versions until sessions there failed, sessions from one computer being ended when a second computer's Claude app cleaned up the same host, sessions permanently losing their connection after a saved connection's host or port was edited, and history missing its newest messages soon after launch or a reconnect. - * Fixed WSL sessions failing to start or reconnect, including background reconnects right after an app update, when WSL reported a momentary error. +**Cowork** - **Cowork** +* No user-facing changes. - * Changed what happens on Windows PCs where a Windows update released September 8, 2026 prevents Claude's workspace from reaching your files: the app now names that cause instead of deleting and reinstalling the workspace. This does not fix the underlying problem, and the workspace still can't reach your files on those PCs. - * Fixed a session appearing stuck running when an organization hook blocked a message; the reason the message was blocked is now shown. - * Fixed an Office file preview sometimes showing "Failed to load PDF document" instead of the spreadsheet or document view. - * Fixed long-running tasks failing with an authentication error after the app renewed your sign-in in the background; the running task now picks up the renewed sign-in and continues. +**3P** + +* No user-facing changes. + +**v2.9939.2** + +Bundled Claude Code version: 2.1.281. + +**General** - **3P** +* Removed the Cmd+. (Ctrl+. on Windows and Linux) shortcut for showing and hiding the sidebar; Cmd+B (Ctrl+B) still does it. +* Fixed 1Password autofill filling the wrong browser tab when Claude works across several tabs. +* Fixed a message typed into a new chat or task being lost when you are asked to sign in again before sending. +* Fixed Arabic and Hebrew messages drawing quote bars and list bullets on the wrong side, and mirroring code and math. +* Fixed Code tab and Cowork sessions failing to start on some Macs that had updated to version 2.9939.1. +* Fixed copying part of a reply that contains math pasting scrambled text instead of the formula. +* Fixed plugins that contain a `.zip` file never installing in the app after being enabled on claude.ai. +* Fixed the app failing to start on some Windows machines after updating, with the error "Cannot create a stable subkey under a volatile parent key". - * Added `coworkVmIpv6Enabled`, which gives the Cowork workspace VM an IPv6 address and route so the agent's tools can reach IPv6-only hosts through the device's own IPv6 connectivity. macOS and Windows; off by default. `coworkEgressAllowedHosts` still decides which hostnames the tools may reach. - * Added `sshTransport` (beta), which chooses the SSH engine that carries Code sessions: `system-openssh` runs the OpenSSH `ssh` program on the device, so connections can use the organization's own SSH setup (for example Kerberos sign-in, including on Windows), and `builtin` uses the app's built-in SSH library. Unset or `auto` keeps the build's default. - * Added a deprecation notice in the Setup window under any managed-configuration setting that is scheduled to stop being accepted, naming the date and what to use instead. - * Added organization-set session retention. `chatSessionRetentionDays`, `coworkSessionRetentionDays`, and `codeSessionRetentionDays` each delete that surface's idle sessions from the device, along with their files, after the set number of days (1 to 3650) without activity; unset deletes nothing. `sessionRetentionHold` suspends all automatic deletion for the users it is set for, as a legal hold. Projects, Spaces, and memory stay, and a Code session's uncommitted work stays on disk. - * Changed app launch to open the home composer on the last-used Chat or Cowork mode instead of always opening Cowork first. - * Changed hooks from organization plugins to also run in Chat, matching Cowork and Code. - * Deprecated an undocumented client-certificate fallback setting that releases from 1.49585.0 on no longer read, since the app now presents TLS client certificates natively. Deployments that still set it keep working unchanged, but their users see an in-app deprecation warning from November 3, 2026, and the setting stops being accepted on November 17, 2026; remove it once every device is on 1.49585.0 or later. - * Improved the connection test against gateways that require a TLS client certificate the device does not have: the result now says the device did not present a certificate the gateway accepts, so the connection could not be tested, instead of reporting the model as rejected. - * Fixed Claude Code's own settings on the device (a user's or project's settings file, or a `managed-settings.json`) being able to turn OpenTelemetry trace export back on after an administrator configured a collector with traces off; with `otlpEndpoint` set, Cowork and Code sessions now export traces only when `otlpTracesEnabled` is `true`. - * Fixed Amazon Bedrock and Google Vertex AI sessions retrying a failed request for several minutes when the AWS or Google Cloud credential on the machine had expired; the request now stops after one retry so the credential can be refreshed. - +**Code** - - **Resolved September 14, 2026.** Microsoft has released a Windows update that fixes this issue. Install the latest Windows update and restart your PC. +* Changed session deletion to also remove the session's Claude Code transcript and related files from your computer, so `claude --resume` can no longer reopen it. +* Fixed a new session's first message failing with "does not support this model" right after an app update, while the Claude Code version its model needs was still downloading; the message now waits for the download. +* Fixed Auto mode sometimes denying a request you had just typed as if you had not asked for it. +* Fixed earlier messages sometimes not loading when you scroll up in a long session. +* Fixed SSH connections failing with "no route to host" to machines on your local network from a Mac where a Homebrew or other non-Apple `ssh` is first on `PATH`, and with "SSH master exited before the connection was established" from a Windows computer using the new connection engine to a Windows host whose login shell is `cmd.exe`. +* Fixed the app using a full CPU core on Windows after archived sessions' worktrees were cleaned up. - A Windows update released September 8, 2026 (including KB5124008) stops Cowork from reaching your files when it runs on your Windows PC, so tasks fail or the workspace does not start. This affects Cowork on third-party inference deployments and Cowork sessions that run on your computer rather than in the cloud. Cloud sessions and Claude Code, including the Code tab, are not affected. Chat cloud sessions are not affected, but Chat sessions on third-party inference deployments are affected if using advanced file analysis. The cause is a change in Windows, so restarting or reinstalling Claude does not help. - +**Cowork** - - **General** +* Fixed Download in the chat's file pane failing for a document Claude saved to your project. +* Fixed scheduled tasks with an empty description showing no prompt, with Run now disabled, edits failing, and Move to cloud blocked. +* Fixed sessions failing to start on Windows for accounts with many connected folders, on standard deployments; third-party deployments are covered only where Auto mode is offered in Cowork and no model's effort is capped. +* Fixed sessions failing to start with a "Claude Code crashed" error on some Windows MSIX (enterprise-packaged) installs. +* Fixed the new-task screen still offering a model an organization admin had turned off, which made the new task fail. +* Fixed the workspace on Windows failing to start with "VM service not running" until the computer was restarted, after its background service had stopped; the app now starts the service again itself. - * Changed an invalid "Required organization" device-policy value to block sign-in with a configuration error, shown in the diagnostic report, instead of being ignored. - * Updated the app runtime to Electron 44 (Chromium 152); macOS 13 Ventura or later is now required. - * Fixed chats started from the menu bar or Quick Entry panel opening as an empty page for up to a minute before the reply appeared, and ignoring your instructions from Settings > Instructions for Claude. - * Fixed macOS sometimes showing repeated "bash would like to access data from other apps" prompts after quitting the app with sessions open. - * Fixed scheduled tasks around Mac sleep: a task that ran while the Mac was asleep was sometimes stopped as unresponsive when it woke, tasks missed during sleep sometimes started during a brief background wake and failed (they now start once the Mac is fully awake), and a one-time task occasionally started many sessions at once after wake. +**3P** - **Code** +* Added the extended-thinking switch beside the effort control in the Cowork message box. +* Changed `allowedPluginMarketplaces`: a `url` marketplace's `credentialHelper` can print a JSON object of HTTP headers (the form a managed MCP server's `headersHelper` prints), which are sent on every request to that marketplace, in addition to the existing token and credential-line forms. +* Changed `autoModeEnabled`: unless it is `false`, new Code tab sessions now start in Auto mode where the selected model supports it, and when the key is not set the Code tab now offers Auto mode (previously only when it was `true`). Cowork and Chat are unchanged: only `true` offers it in Cowork, where sessions still start by asking before each action. Set the key to `false`, or `disableAutoMode` to `"disable"` in Claude Code's `managed-settings.json`, to keep Auto mode off. +* Changed `deploymentDisplayName` to also stand in for your organization's name in dialogs and messages that otherwise show the inference provider's name. +* Changed `inferenceIdpOidc.resource` (and `inferenceGatewayOidc.resource` in existing gateway configurations) to also accept an identifier with a scheme of its own that is not a web address, such as an AD FS relying-party identifier (`urn:…`), which is sent exactly as written; URLs and values without a scheme behave as before. +* Changed Code and Cowork sessions on a gateway configured with `inferenceGatewayAuthScheme: "x-api-key"` to send no nonessential Claude Code traffic (usage telemetry, error reports, release-note and registry fetches) to `api.anthropic.com`, as when `disableNonessentialTelemetry` is `true`. +* Changed Code and Cowork sessions to start Claude Code with fast mode turned off; `/fast` now reports that fast mode is not available. +* Changed Code tab sessions to ignore every Claude Code provider-selection environment variable set in the user's own environment or in the app's Settings (most were already ignored); the managed configuration alone selects the inference provider. +* Changed connectors on a computer login that several people share: when a different person signs in to the app, the built-in and OAuth connectors now start disconnected and have to be connected again; signing out and back in as the same person keeps them connected. +* Changed managed MCP server connections (`managedMcpServers` and MCP servers from organization plugins) to no longer follow HTTP redirects: a server whose URL redirects now reports a configuration error, so give the server's final address. +* Changed the built-in browser under the default `builtinBrowserDefaultDomainPolicy: "allow"`: Claude now asks before each of its actions on a site that Anthropic's site-safety list flags for confirmation. Only a site listed in `builtinBrowserAllowedDomains`, which applies under `"block"`, skips that confirmation; sites the site-safety list blocks stay blocked under either policy. +* Fixed Code tab sessions on Windows computers without Git for Windows refusing every shell command with "Enterprise policy requires sandboxing". +* Fixed Cowork cost and token usage metrics sent to `otlpEndpoint` being dropped by some OpenTelemetry backends as too frequent; Cowork sessions now export once a minute, Claude Code's default, as the Code tab does. +* Fixed gateway and Bedrock `external-idp` sign-ins through your organization's identity provider running out with no warning when the provider issues no refresh token; the "Your session expires in …" notice now appears ahead of time. +* Fixed read-only tools from managed and built-in MCP servers showing the approval warning meant for tools that can modify data; they now offer "Always allow" unless `mcpPersistentAlwaysAllowEnabled` is `false`. +* Fixed republished plugins from a pinned organization marketplace reaching users only after a restart: a configuration change that only moves `manifestSha256` or a commit `ref` on existing `allowedPluginMarketplaces` entries now applies to the running app. +* Fixed the app's own OpenTelemetry events being rejected with a "401 missing\_token" error by a gateway that users sign in to directly and that is also the `otlpEndpoint`. - * Improved terminal tabs: they now show when a command is still running and ask before closing one that is, and a tab whose shell crashed or was killed stays open with a Restart option instead of closing silently with its output. - * Removed the Git requirement for local sessions that don't use a worktree; on Windows, Git for Windows (Git Bash) is no longer needed to start a session. - * Fixed the Files pane discarding unsaved edits without asking when you closed the pane, expanded another pane, or opened it in a new window; fixed the editor joining lines in files that mix Windows and Unix line endings; and a failed save now says the file couldn't be saved and offers Try again instead of claiming the file changed on disk. - * Fixed the selected model reverting or being refused when you switched models while a session was starting, restarting, or still answering; the session now uses the model you chose, and model changes in SSH and WSL sessions no longer fail with "plugin hooks could not be loaded". - * Added automatic sending for messages held after you hit your 5-hour limit: they now send when the limit resets, and you can still edit, cancel, or send them early. +**v2.7032.0** - **Cowork** +Bundled Claude Code version: 2.1.280. - * Fixed a conversation started from an artifact, or from an artifact comment's Send to Claude, not using your selected model. - * Fixed a task disappearing from the app while its files stayed on disk when one of them was in use during delete; the task is now kept so the delete can be retried. - * Fixed an issue where the app could quit at launch with a very large number of Cowork tasks. - * Fixed the "Can't reach the Claude API" warning staying on screen until the app was restarted even after the connection had recovered; it now clears on its own. +**General** - **3P** +* Fixed a chat message sent with no network connection appearing to send for about a minute before failing; it now fails within a few seconds and says you went offline, and a connection that has gone quiet after your computer wakes or your network changes reconnects right away. +* Fixed a message sent while Claude is still working sometimes being ignored, and sometimes landing out of order in the transcript with the step before it looking unfinished. +* Fixed Claude becoming the default app for files such as .md and .docx, and Windows asking which app to use for files that already have a default app. Claude also no longer appears in the macOS "Open with" menu for Excel and PowerPoint files; "Other…" in that menu still opens them in Claude. +* Fixed editing a message while another reply is still running losing your edited text when the server refuses the edit; the editor now reopens with your words. +* Fixed the app freezing for a few seconds after launch or reload on some machines, most often on Windows. +* Fixed the whole window being replaced by a "Couldn't finish loading" screen when a chat's side panel failed to download; the chat now stays open and the panel's button shows the problem with a Retry button. - * Added `continuousAccessEvaluation` to the Microsoft 365 entry in `managedMcpServers`: the bundled connector's sign-ins, through the OS sign-in broker as well as the browser, request Continuous Access Evaluation tokens from Microsoft, which can live up to about 28 hours but are revoked within minutes when an administrator revokes sessions or a tenant network policy no longer allows them; set it to `disabled` to keep standard one-hour tokens on every sign-in path. Defaults to `enabled`. - * Added each model's description from the gateway to the model picker for deployments that discover models from the gateway. - * Changed `microsoftAuthBroker`: a new `required` option makes Microsoft 365 sign-in fail when the OS sign-in broker is unavailable instead of falling back to the browser, so the refresh token always stays held by the broker, and removes the token cache an earlier browser sign-in left on disk. Earlier versions treat `required` as `disabled` (browser sign-in only), so set it once every device is on this version or later. - * Changed Claude API, Google Vertex AI, Amazon Bedrock, and Bedrock Mantle deployments that set no custom base URL to no longer suppress Claude Code's experimental features, so tool search is on by default there (on Vertex AI with Claude 4.5 and newer models) and `toolSearchEnabled` is no longer needed to turn it on; gateway and Foundry deployments, and those providers behind a custom base URL, are unchanged. - * Fixed Amazon Bedrock sessions that use IAM Identity Center sign-in showing an internal error or a bare "operation was aborted" message when AWS sign-in could not be reached at session start; the app now says whether IAM Identity Center was unreachable, temporarily unavailable, refused the account or role, or returned an unreadable response, and what to do next. - * Fixed find in page (⌘F) missing matches in messages scrolled out of view. - * Fixed Google Cloud (Vertex AI) sessions sometimes running under the computer's own Google login instead of the credential your organization configured, and the app not asking you to sign in again after your Google session expired. - * Fixed the app refreshing the sign-in token about once a second when an inference gateway answers 403 to the model list request. - * Fixed the built-in Microsoft 365 connector showing Connected before anyone had signed in; its first request in a conversation now offers the sign-in, and a cancelled sign-in no longer hides its tools; the bundled connector also gains a tool that reads Teams channel messages. - +**Code** - - **General** +* Changed SSH sessions on the new connection engine (the computer's own OpenSSH, the default on macOS and Linux) to run the MCP servers from your desktop settings under Claude Code on the remote machine, so their tools keep working while the app is closed; the session's MCP list says when one isn't installed there or the host already has its own. +* Fixed Claude asking for approval before every terminal command while Remote Control was on, even when you were typing at your computer; it now asks only when the work was started or steered from another device, and that card can turn Remote Control off for the session. +* Fixed long delays in large repositories when starting a new worktree session and when archiving or deleting a session, including the app freezing for up to half a minute on macOS when the repository has a very large `node_modules` folder. +* Fixed resuming a session failing with "this session's branch is checked out somewhere else" when only the session's own worktree, in the app's worktrees folder, had the branch checked out. +* Fixed sessions starting slowly, and already-open sessions briefly stalling, when many sessions are open. +* Fixed sessions that were waiting on your reply being auto-archived shortly after the app restarted, and the sidebar losing their needs-input marker on restart. +* Fixed SSH connections on some Windows computers failing with "spawn EPERM" or never asking for a password, and connections failing over a private key file that other accounts could read; the app now falls back to its built-in SSH engine, or makes the key file private, and connects. +* Fixed two causes of repeated requests to sign in again: a brief network interruption no longer signs the Code tab out while Chat stays signed in, and a sign-in renewal is no longer thrown away when the server's answer arrives just after a 30-second limit. - * No user-facing changes. +**Cowork** - **Code** +* Added the health-data consent dialog and the Microsoft 365 work-account notice before a connector is added from a chat suggestion or the suggested-connectors card. +* Fixed "Couldn't delete this task" on Windows when deleting a task that was running or had just finished. +* Fixed built-in and account skills loading without the Skill tool; they load through it again, as plugin skills do, so references to a skill's own folder resolve. +* Fixed connector suggestions in chat offering Connect for a connector your organization has not enabled, which then failed with a permissions message; the suggestion now offers Request where your organization accepts connector requests, and otherwise says to ask an organization owner. +* Fixed messages that start with a file path or file name, such as `/tmp/notes.txt`, being refused with an "Unknown skill" error instead of being sent. +* Fixed workspace setup failing on every launch after a corrupted download, including with the offline installer. - * No user-facing changes. +**3P** - **Cowork** +* Added `inferenceCredentialKind: "external-idp"` on the gateway and Bedrock providers: users sign in through your organization's OpenID Connect identity provider, configured with the shared `inferenceIdpOidc` and `inferenceIdpAuthFlow` keys (system browser by default, or the OS Microsoft Entra broker), and the user's token is sent as the Bearer credential on every inference request; on Bedrock it goes to a proxy that validates the token, so `inferenceBedrockBaseUrl` is required and the models must be listed in `inferenceModels` (no model discovery). The gateway-only spellings (`inferenceCredentialKind: "interactive"` with `inferenceGatewayOidc` and `inferenceGatewayOidcAuthFlow`) are deprecated with no end date and keep working. +* Added `keepAwakeEnabled`: set it to `false` so Claude never keeps the computer awake; the keep-awake switches in Settings, the Scheduled page and the Code tab are hidden. Scheduled tasks themselves stay on. +* Added `mcpScheduledTaskApprovalLifetimeDays`: limits how many days a scheduled task in Cowork or the Code tab may reuse a lasting MCP-tool approval before it asks again. The lasting option is offered even while persistent tool approvals are turned off, and `0` removes it. +* Changed performance timing telemetry (part of essential telemetry) to go to `claude.ai` first instead of straight to Datadog, so essential telemetry now also needs `claude.ai`: most configurations already have that host on their network requirements list under auto-updates or nonessential telemetry, and one that sets `updateViaUpdatesHost` or `disableAutoUpdates` together with `disableNonessentialTelemetry` now lists it under essential telemetry. Datadog's intake hosts stay on the list as the fallback route. +* Removed a temporary vendor-specific exception from custom connector validation: OAuth authorization server metadata that declares an issuer not matching the metadata URL now fails validation again. +* Fixed a crash on Windows that could close the app while the Microsoft 365 connector or another Microsoft Entra sign-in was talking to the Windows account broker. +* Fixed managed connectors configured with their own OAuth client connecting without credentials, instead of prompting for sign-in, when the server accepts unauthenticated connections. +* Fixed Microsoft 365 connector sign-in through Company Portal or the Windows account broker requesting only `offline_access` instead of the permissions in the connector's `scope` setting. Affected members may be asked to reconnect, and in tenants whose Entra admin consent doesn't cover every permission in `scope` they may see Microsoft's consent or admin-approval page until the missing permissions are consented. +* Fixed organization sign-in with Microsoft Entra ID asking users to sign in again after a restart when `bootstrapOidc.scopes` uses `/.default`. +* Fixed pop-out windows doing nothing: "Open in new window" and ⌘-click (or Ctrl+click on Windows and Linux) for Code tab sessions, side panes, the side chat, and Pop out on Cowork live artifacts. - * No user-facing changes. +**v2.2553.13** - **3P** +Bundled Claude Code version: 2.1.280. - * No user-facing changes. - +**General** - - **General** +* Added support for Claude Opus 5.5. +* Fixed sessions that could hang with no response after an internal error; the error is now shown. +* Fixed some conversations failing on every message with a "text content blocks must be non-empty" error, including after resuming. - * No user-facing changes. +**Code** - **Code** +* Added `AGENTS.md` support: in a folder with no `CLAUDE.md`, Claude reads `AGENTS.md` for project instructions (not yet in third-party deployments). +* Fixed Claude being unable to read the output of its own background commands in sessions restricted by an administrator's allowed workspace folders. - * No user-facing changes. +**Cowork** - **Cowork** +* No user-facing changes. - * Added support for attaching your home folder, Windows Documents, AppData, the macOS Library folder, and whole drives; Claude's own configuration and session data inside them stay off-limits, as do certain credential and shell-startup locations (for example SSH keys, AWS and Google Cloud credentials, and bash, zsh and PowerShell profile files). +**3P** - **3P** +* No user-facing changes. - * No user-facing changes. - +**v2.2553.1** - - **General** +Bundled Claude Code version: 2.1.275. - * No user-facing changes. +**General** - **Code** +* Fixed sessions failing to start or resume when their saved transcript contained a malformed entry. - * Fixed Code sessions started in a git worktree failing to initialize on Windows. +**Code** - **Cowork** +* Fixed rewinding in forked and background sessions sometimes restoring a corrupted or truncated file. - * No user-facing changes. +**Cowork** + +* No user-facing changes. - **3P** +**3P** - * No user-facing changes. - +* No user-facing changes. - - **General** +**v2.2553.0** - * Removed the "Mark as unread" action for chats. - * Fixed links between artifacts and shared-artifact links clicked inside the app opening in the browser or losing their share key; they now open in place, and a teammate without access sees the request-access screen instead of "not available". - * Fixed memory use on macOS growing steadily while working with files, which could end with the system reporting it had run out of application memory. - * Fixed new messages being queued instead of sent after reopening a chat whose last message had no reply yet. - * Fixed removing a file from the message box after stopping or losing a reply sometimes deleting that file from the message you had already sent, which made "Try again" on it fail. - * Fixed side chat, the slash-command picker, usage insights, and other quick actions failing silently on machines where an organization deploys a Claude Code `managed-mcp.json`. - * Fixed the dictation microphone button disappearing from the chat composer once a message had text, an attached file, or a quoted reply. +Bundled Claude Code version: 2.1.274. - **Code** +**General** - * Added a queue for messages sent while your 5-hour usage limit is reached: they wait above the composer instead of failing, and you can edit, cancel, or send them when you're ready. - * Added keep-awake while Claude works: the computer no longer idle-sleeps while Claude is working in the Code tab, with a "Keep computer awake while Claude works" setting (and a "Keep awake on battery power" option) under Settings > Claude Code, a "Keep computer awake for this session" item in the session menu, and a one-time notice after a long task. - * Removed the Summary transcript view from the session's Transcript view menu; sessions that had it selected open in the Normal view. - * Fixed Extra high and Max effort on Claude Opus 5 quietly running at High when thinking was turned off in your Claude Code settings; those efforts now run with thinking on for the session. - * Fixed organization-managed settings not loading, and Remote Control not connecting automatically, for some users until they signed out and back in. - * Fixed sessions failing to open: a "Couldn't load this" message now recovers on its own instead of needing a manual reload, sessions no longer show "No messages yet" on Windows hosts that use FSLogix or similar profile containers, and a transcript that can't be read shows the reason with a Retry button. - * Fixed SSH sessions being restarted after some reconnects, which could leave duplicate Claude Code processes on the remote machine, and fixed messages held for an unreachable host: they are retried after an app restart, and when the host comes back needing your password or an unlocked SSH agent the app asks you instead of marking the message "needs you". - * Fixed switching models in a session: a switch refused with a "plugin hooks could not be loaded" error now restarts that session's Claude Code on the model you picked, the model picker no longer shows a model Claude Code refused, and Remote Control sessions no longer offer models the connected Claude Code version can't run. - * Fixed switching models staying blocked for the rest of the session when an organization-managed plugin's marketplace or a plugin hook failed to load. - * Fixed the remembered folder sometimes getting mixed up with a remote machine's path, which made every local session launch fail with "working directory no longer exists". +* Changed the sidebar's Pinned list to show its first 20 items, with a Show more link for the rest. +* Fixed connector and extension tools in Cowork and Code sessions failing with "expected nonoptional" when Claude left out an optional parameter that has a default. +* Fixed plugins past the first 100 in a marketplace not opening from Customize. +* Fixed Read Aloud continuing to play the old response after you regenerate, edit, or retry a reply, and cutting off early when a server error ended the read. +* Fixed some extensions that use the built-in Node.js runtime stopping with a "Server disconnected" error right after they start. +* Fixed the app closing and then failing to reopen on some Windows-on-ARM (Snapdragon) PCs installed from the Microsoft Store package. +* Fixed update restarts ending Code tab sessions and MCP servers abruptly instead of shutting them down the way quitting does. +* Fixed re-enabled plugins sometimes turning themselves back off, and new sessions sometimes starting without a plugin that was shown as enabled. - **Cowork** +**Code** - * Added automatic re-runs (after 5, 15, and 30 minutes) for a scheduled task that could not reach the model at all, for example right after the computer wakes behind a VPN. - * Fixed Record a skill opening an unresponsive chooser window on Windows. - * Fixed saving a skill Claude proposes in a conversation: a name that matches one of your skills now offers to update that skill instead of failing with "Try again", and when saving is blocked until you sign in again the Save skill button opens the sign-in prompt instead of a generic error. - * Fixed scheduled tasks and other automatic ways of starting a session choosing a model the installed app version can't run, which made every turn fail. - * Fixed the row under the composer (Add folder, permission mode, model) disappearing after switching a session to automatic approvals. +* Added file viewing to cloud sessions, so file links in the transcript open in the app, the Files pane can search the session's files, and the Background tasks panel shows background command output. +* Fixed `!` commands and a code block's Run being dropped when the terminal was not ready; they now run within seconds, use the selected terminal tab when it is idle, show as terminal rows when sent while Claude is still working, and no longer leave the session marked as running after their output is sent. +* Fixed a case where a session could stop accepting messages after the app relaunched or the computer slept, until the app was restarted. +* Fixed a routine created with every connector removed still using all of your connectors. +* Fixed new sessions sometimes taking minutes to start while another session's worktree was being cleaned up or recycled. +* Fixed Plan mode skipping permission prompts when the Bypass permissions option is on and the session fell back to an older bundled Claude Code CLI while an update downloaded. +* Fixed turns failing with "OAuth token has expired" hours into a session; the token is now renewed in the background, and when a fresh sign-in is genuinely required the app asks before sending and keeps your message. +* Fixed sessions in large repositories starting slowly, including repositories that use a `.worktreeinclude` file, and worktrees occasionally starting without their local settings files. - **3P** +**Cowork** - * Added `blockReadsOutsideWorkingDirectories`: restricts Code sessions to reading files inside the session folder and `allowedWorkspaceFolders`; file tools refuse reads elsewhere, and sandboxed shell commands lose access to the home directory. - * Added `configRecheckIntervalMinutes`: how often a running app re-checks its managed configuration for changes, from 2 to 30 minutes; unset means 10 minutes, where the app previously checked every 30. A served value applies without a restart, and the key can also be set from device management. - * Added `disableBypassPermissionsMode`: removes bypass permissions mode from Code sessions and Cowork tasks, so Claude always follows the configured permission policy. - * Added `sshClientPath` (beta): the absolute path of the OpenSSH program the app runs for SSH sessions; when unset, the app uses the first `ssh` on the user's PATH. - * Added an Edit button to your most recent message in Cowork and Chat sessions, so you can revise and resend it, and fixed "Restart conversation from here" doing nothing in Chat sessions. - * Added the restart prompt, escalating to a required restart after `relaunchEnforcementHours`, when device-managed configuration (the managed plist, Windows policy registry, or Linux managed-settings file) changes while the app is running; previously only configuration changes served from a customer bootstrap endpoint prompted one. - * (breaking) Changed `relaunchEnforcementHours`: in served configuration the key moved from `bootstrap.relaunchEnforcementHours` to `lifecycle.relaunchEnforcementHours`; this release no longer reads the old path and earlier versions do not read the new one, so move the value under `lifecycle` (the flat-format and device-management key name is unchanged); the key can now also be set from device management; and the default window before a required restart is now 24 hours instead of 1. A device-management profile that sets any app-behavior key takes precedence over a served value for this key, so such a profile should set it too. - * (breaking) Changed how unreadable Claude Code managed settings are handled: if a device's `managed-settings.json` file, a drop-in, the device-management plist, or the Windows policy registry value cannot be parsed, Claude Code now refuses to start and names the source, so sessions on that device will not start until that file or value is fixed or removed; previously they ran without those settings. Check that these sources parse on managed devices before rolling out this version. - * Changed `allowedPluginMarketplaces` entries set to `auto_install` or `required` without a pinned commit SHA (or without `manifestSha256` for a `url` source) to show as available with a configuration warning, instead of being removed from the marketplace list. - * Changed Claude Code's `allowedMcpServers` setting (in its `managed-settings.json`, not the managed-configuration schema) to govern only servers users add themselves: a server from a `managed-mcp.json` file that the allowlist used to filter out now loads, and `deniedMcpServers` is the way to keep it off. - * Fixed chat search returning no results; searching finds chats by title and message content again. - * Fixed deployments without cloud features, or with the Cowork tab turned off, showing controls that could not work there, including Remote Control, automatic pull requests, the Cloud and Slack session filters, Add marketplace, and Cowork slash commands. - * Fixed organization plugins staying installed for users after an administrator removed the plugin's folder from the system `org-plugins` directory. - * Fixed remote MCP connectors whose `headersHelper` mints the credential continuing to fail for up to several minutes after the server rejected an expired credential; the helper now re-runs immediately and the rejected request is retried once. - +* Fixed plugin skills that reference `${CLAUDE_PLUGIN_ROOT}` or `${CLAUDE_SKILL_DIR}` sometimes running their commands with those paths blank. +* Fixed preinstalled Node.js packages such as `pptxgenjs`, `docx`, `pdf-lib` and `sharp` not being found by `require()`. +* Fixed search and session loading crashing on very long conversations. +* Fixed stacked permission prompts sliding up under the mouse pointer right after one is answered, which could send the next click to the wrong prompt. +* Fixed workspace updates failing with "Not enough disk space" on computers that had enough room once the update replaced the previous version. - - **General** +**3P** - * No user-facing changes. +* Added `allowedPluginMcpServers`: when set, Cowork, Chat and Code sessions connect only the plugin MCP servers whose URL matches an entry (an empty list allows none), in addition to `managedMcpServers` and organization plugins, even when `managedMcpServers` is empty; the app also stops starting plugin MCP servers on the device, except for organization plugins. The Setup window can now author an empty list for this key and for `allowedWorkspaceFolders`. +* Added `builtinBrowserEnabled` to offer a built-in browser in Cowork and Code sessions, with `builtinBrowserDefaultDomainPolicy`, `builtinBrowserAllowedDomains`, and `builtinBrowserBlockedDomains` to control which sites Claude may open in it. +* Added `inferenceCredentialHelperWindows`: the absolute path of the credential helper executable on Windows devices, used there instead of `inferenceCredentialHelper`, so one configuration can serve Windows and macOS or Linux devices. +* Added a Salesforce preset to the plugin marketplace picker in the Setup window. +* Changed `inferenceFoundryResource`: a value delivered by a bootstrap URL the user configured themselves (in Settings or a local configuration file) now asks that user to approve it before it takes effect, as the Foundry base URL and the other providers' endpoints already do, and declining quits the app. Because the resource name is required, each such Foundry install prompts once after updating. Values delivered through device management, or by a bootstrap URL that device management set or that `trustBootstrapDelivery: true` covers, are unchanged and never prompt. +* Updated Customize to a full page with redesigned Skills, Plugins and Connectors lists (search, an Add menu, a page per item) in place of the old tables in Settings; Memory moved under Settings. +* Fixed a `Bash` entry in `disabledBuiltinTools` or `builtinToolPolicy` not applying to PowerShell commands on Windows PCs without Git for Windows; a `Bash(**)` entry is now treated as `Bash`. +* Fixed Settings > Desktop app > General on macOS offering a Voice shortcut that could not work; a Caps Lock or custom shortcut chosen earlier no longer opens the dictation bar. +* Fixed the app continuously re-fetching its configuration from the configuration server and re-testing the inference connection while the inference provider rejects the configured API key. +* Fixed the Code tab's `/status` card showing a placeholder account; it now shows your signed-in identity and the deployment name. +* Fixed the model list, organization configuration, or an MCP server occasionally failing to load right after launch when `egressProxyUrl` is set and the network is reachable only through that proxy. +* Fixed the model picker listing a model twice when a gateway's `/v1/models` endpoint returns both `` and `[1m]`; the pair now shows as the model and its 1M-context row. - **Code** +**v2.110.0** - * No user-facing changes. +**General** - **Cowork** +* Added a `chromiumFlags` setting in `claude_desktop_config.json` for GPU-related switches such as `--disable-gpu`, applied before graphics start up, so users can work around GPU driver crashes and rendering issues on launch, including on Microsoft Store installs where command-line flags cannot be passed. +* Changed the error screen shown after repeated crashes or failed starts to say what happened and offer a Restart Claude button, and crash recovery now waits progressively longer between retries instead of retrying immediately. +* Fixed a new chat's first message sometimes being sent twice after a reload, failing repeatedly with "Missing files" over an attachment uploaded for an earlier chat attempt, or dropping you back to an empty new-chat page when the first reply was interrupted; also fixed an edited message being sent again each time Enter was pressed in the edit box that stays open after Save. +* Fixed the app freezing and then reloading on Windows (Microsoft Store and other MSIX installs) while an update downloaded in the background. +* Fixed the app sometimes failing to launch on Windows when its settings file briefly couldn't be opened. +* Fixed the Code tab's agent detection, output styles, and other desktop features sometimes needing you to sign in to your Claude account again after a single network or server error while that sign-in was being renewed. - * No user-facing changes. +**Code** - **3P** +* Changed SSH and WSL sessions to keep running when left idle in the background instead of being stopped, and fixed them stalling for up to 10 minutes after each reply while the desktop app was closed or the computer was asleep. +* Removed the calendar view from the Routines page; routines now always show as cards. +* Fixed messages sent to an SSH session around a disconnect being dropped, discarded with an error, or answered with a prompt to send them again; the app now checks whether the message arrived and delivers it once the session is restored. +* Fixed permission requests and questions not appearing in popped-out windows and split panes after the main window switched away from the Code tab. +* Fixed text typed in the prompt box sometimes disappearing, along with its undo history, while a session was open. +* Fixed the app freezing on launch or session switch when a very large unsent prompt had been saved; it now comes back as an editable "Saved draft" attachment. - * Added support in Chat for skills from organization-provided plugins, and Chat-only users can now see and manage those plugins under Customize, matching Cowork and Code. - * Fixed advanced file analysis in Chat failing with "Workspace unavailable" for users whose organization enables `chatAdvancedFileAnalysisEnabled` but turns Cowork off with `coworkTabEnabled: false`. - * Fixed managed OAuth connectors showing a connection error instead of prompting to sign in when the app starts without a usable sign-in (expired with no refresh token, or never signed in on this machine), including servers added by URL alone, where Connect could fail instead of opening the sign-in page. - * Fixed organization-configured URL plugin marketplaces failing to install or load plugins with "marketplace entry path does not stay inside the marketplace directory". - +**Cowork** - - **General** +* Fixed browser, computer use, and website access permission prompts in Dispatch sometimes being denied on their own before you could answer. +* Fixed connected-folder issues: deleting a file failed with "Could not find mount for path" when two connected folders shared a name, and Claude could see the wrong files in a newly connected folder named `.claude`. +* Fixed Cowork tasks being unable to read or update existing artifacts. +* Fixed Cowork startup problems on Windows: some tasks failed to start, a task could appear to start when your drive couldn't be reached (it now stops with a clear error), mapped network drives no longer hold up startup, and projects now load and save on virtual desktops that use profile containers such as FSLogix. +* Fixed Reconnect on an enterprise-managed connector doing nothing when your SSO session had expired; it now signs you in with SSO again, and offers signing in with your own account after a failed attempt. - * No user-facing changes. +**3P** - **Code** +* Added `inferenceCredentialHelperArgs`: a list of arguments passed in order to the `inferenceCredentialHelper` script, so one installed script can serve several environments; when unset the script runs with no arguments, as before. +* Added `inferenceFoundryBaseUrl`: routes Azure AI Foundry requests from Chat, Cowork, and Code through a gateway or proxy you run instead of the resource's own endpoint; it takes the same value as Claude Code's `ANTHROPIC_FOUNDRY_BASE_URL`. +* Added `redirectHost` to `bootstrapOidc`, to `inferenceGatewayOidc` (interactive gateway sign-in), and to `inferenceVertexWorkforceOidc` (Vertex workforce sign-in), so organizations whose identity provider only accepts `localhost` in a registered redirect URI can complete browser sign-in; the default remains `127.0.0.1`. +* Added `scheduledTasksEnabled`: set it to `false` to turn off scheduled tasks in Cowork and Code; the Scheduled page is hidden, existing tasks stop running, and Claude can no longer schedule new work. +* Added effort and default-model controls: `defaultModelEffort` sets the effort level the default model starts at, `maxEffort` on an `inferenceModels` entry hides that model's higher effort levels and holds Code sessions to the cap, and `alwaysStartWithDefaultModel` starts every new conversation or task on the default model and stops saving a person's model and effort changes as their default. The Code tab also now uses the standard model picker, with effort as its own control beside the model name. +* Added model catalog support: model names, descriptions, and thinking or effort options in the model picker now follow Anthropic's published Claude Code model catalog, matching what first-party users see, with your configured model list and order unchanged. By default the app fetches the signed catalog from `downloads.claude.ai` (the host it already uses for workspace and Claude Code downloads) every 5 to 15 minutes and keeps the last catalog it fetched, or the copy bundled with the app, when that host cannot be reached; set `modelCatalogEnabled` to `false` to keep the app's built-in labels and make no catalog request, or `modelCatalogUrl` to fetch the catalog and its signature file from a mirror inside your network instead (the document is still verified against the key built into the app). +* Changed Chat to stop asking for approval when Claude hands back a file it produced and, with advanced file analysis on (`chatAdvancedFileAnalysisEnabled`), at each step of analyzing an attached file, matching Cowork; connector actions still ask. To keep the per-step prompt in Chat and Cowork, add `"Bash": "ask"` to `builtinToolPolicy`. +* Changed the Cowork workspace's and other native log files on macOS to be written to `~/Library/Logs/Claude-3p` with the rest of the deployment's logs instead of `~/Library/Logs/Claude`. +* Changed MCP tool permissions: entries in `managedMcpServers` and `orgPluginSettings` now apply to MCP servers from any installed plugin, including ones that run locally, a `managedMcpServers` entry can use `transport: "policy-only"` to set tool permissions for a server a plugin provides without declaring how to launch it, and permission rules now also apply to tools whose names contain characters such as dots or spaces. +* Changed SSH connections in Code sessions on macOS and Linux to run through the OpenSSH `ssh` program on the device by default, so the organization's own SSH setup (for example Kerberos sign-in and `ssh_config` options) applies; set `sshTransport` (beta) to `builtin` to keep the app's built-in SSH library. +* Fixed "Instructions for Claude" in Settings appearing blank right after saving, and profile settings switching to a different saved copy after a launch that asked the user to sign in. +* Fixed Duplicate saving an empty copy of a configuration, and Claude API key sign-in overwriting a saved configuration, when the configuration's file could not be read, for example while another program briefly had it locked. +* Fixed sign-in guidance when the deployment's credential has no sign-in to repeat: authentication error cards now show that credential's own guidance instead of asking to sign in again, the sign-in card says what failed when sign-in succeeded but the organization's configuration could not be loaded, and a gateway 403 is reported as a provider error instead of a request to re-enter credentials. +* Fixed the model picker listing the same model name many times when a gateway returns several models under one display name; the extras now appear under More models, labelled by the part of the model ID that differs. +* Fixed scheduled tasks silently not running after the provider sign-in (such as AWS IAM Identity Center) had expired; they now wait and run once you sign in again, and the "Scheduled task failed" notification now appears when a task could not start. - * No user-facing changes. +**Resolved: Cowork on Windows** - **Cowork** +Microsoft has released a Windows update that fixes the issue where Cowork could not reach your files on Windows PCs. Install the latest Windows update and restart your PC. On Windows 11 24H2 and 25H2 the fix is [KB5129195](https://support.microsoft.com/en-us/servicing/os/windows-11/2026/09/kb5129195-windows-11-24h2-25h2-security-update). On Windows 11 23H2 the fix is [KB5129242](https://support.microsoft.com/en-us/servicing/os/windows-11/2026/09/kb5129242-windows-11-23h2-update). On Windows 10 21H2 and 22H2 the fix is [KB5129236](https://support.microsoft.com/en-us/servicing/os/windows-10/2026/09/kb5129236-windows-10-21h2-22h2-update). No Claude Desktop update is needed. - * Fixed sessions on Windows being unable to run commands or fetch web pages. This reverts the 1.44121.1 fix for sessions failing to start on Windows for accounts with many saved artifacts, scheduled tasks, or connected folders. +**v1.52386.6** - **3P** +**General** - * No user-facing changes. - +* Updated the bundled Claude Code CLI to version 2.1.270. +* Fixed organization plugins enabled through Claude Code's managed settings not loading; they load from the next session. +* Fixed sessions with a very large prompt getting permanently stuck on a "Prompt is too long" error. - - **General** +**Code** - * Added Claude to the "Open with" menu for common work files, including spreadsheets, PDFs, Word and PowerPoint documents, text files, and images, on macOS and on Windows (Microsoft Store and MSIX installs). - * Fixed a crash at launch when the app's settings file couldn't be read. - * Fixed a new chat's first message being dropped when you had to sign in again or verify this device; the chat now asks for that step in a dialog over your message. - * Fixed an issue where an invalid settings file could cause all app settings to be reset. - * Fixed Claude not finding files attached in Cowork and Chat, including pasted files and a re-attached file with the same name; attachments that can't be read now say so instead of being dropped silently. - * Fixed scheduled tasks failing with an error after a permission approval. - * Fixed the app reloading endlessly when it keeps crashing right after loading; it now stops and shows what to do next. - - **Code** - - * Added a Split View submenu to the View menu for opening a new session beside or below the current one, and side panes (diff, terminal, plan, preview, and others) can now open in a window of their own. - * Added Claude Code output styles: an "Output style" submenu in the session menu and a `/output-style` command for viewing and switching styles, a "New style…" option that drafts a custom style from a plain-language description, and a default style setting in Settings › Claude Code. - * Changed the Files pane to open files as tabs beside a collapsible file tree, with single-click preview tabs, multi-select, richer right-click menus, and inline previews for PDF, Word, Excel, and PowerPoint files. - * Fixed `/rewind` appearing undone when returning to a session after navigating away, which could also cause the next message to silently drop recent conversation history. - * Fixed Code sessions repeatedly failing to start after a corrupt Claude Code download on macOS, failing to start on Linux arm64, and SSH and WSL session setup failing on slow connections; the one-time install now shows progress and can fall back to uploading Claude Code from your computer. - * Fixed sessions failing to start on macOS 12 (Monterey). - * Fixed sessions getting stuck on "responding" when a message was queued near the end of a turn. - - **Cowork** - - * Changed live artifact sharing to follow your organization's Artifacts setting and sharing policies: members no longer see sharing options their organization has turned off, and already-shared artifacts keep Copy link and Unshare. - * Changed updating a skill from a file card or skill proposal to apply in one step with an Undo toast instead of a confirmation dialog; where a confirmation still appears, its Update button is the pre-selected action. - * Changed what happens when web fetch isn't available for your organization: Claude now says so instead of retrying and reporting failed fetches. - * Fixed a crash when previewing an image file that is empty or actually contains text. - * Fixed a message with an attachment that couldn't be read or was too large failing to send over and over with no explanation; Claude now marks the attachment with the problem, says what to do, and offers Retry where it can help. - * Fixed sessions failing to start on Windows for accounts with many saved artifacts, scheduled tasks, or connected folders. - * Fixed sessions that run Claude Code directly on the device failing to start for organizations that set `disableSideloadFlags` in Claude Code's managed settings (`managed-settings.json`, an MDM profile, or the registry); in those sessions Claude Code loads none of the desktop's plugins, so their commands, agents, and hooks are unavailable. - * Fixed the session page reloading after you connect a connector that signs in through the browser. +* Fixed users sometimes being told a model they have access to is restricted, and a running session silently switching to the organization's default model. - **3P** +**Cowork** - * Added `claudeAiImport.automatic3pImport` (beta): when `true` and `deploymentOrganizationUuid` is set, the app copies this computer's earlier third-party sessions stored before an organization ID was configured into that organization's session store, once per device and in the background, independently of `claudeAiImport.enabled`; a copy interrupted when the app quits resumes on the next launch. - * Added `egressProxyUrl` and `egressProxyPacUrl`: route the app's and the agent's traffic through a corporate HTTP proxy, or let a PAC file choose the proxy per request, instead of following the operating system's proxy settings; on macOS and Windows, Cowork's workspace follows the pinned proxy too. Both keys are read from device management or the local configuration file only, and the PAC file wins when both are set. - * Added `inferenceStreamIdleTimeoutSec`: how many extra seconds (300 to 1800, default 300) Chat, Cowork, and Code sessions wait for model output on a streaming response that is sending only keep-alive pings, for gateways that send keep-alives while the upstream model is silent. Gateway provider only. - * Added a Duplicates step to the import wizard when an imported Project has the same name as one you already have, with the option to merge the imported sessions into your Project and remove the duplicate; the Projects page offers the same merge. - * Added conversation titles to the OpenTelemetry export: a `desktop_session_title_set` event carries each Cowork and Code session's title plus the Claude Code session ID to join on, sent when `otlpDesktopLogLevel` is `info` or lower; the title text is included only when `otlpContentCapture` includes `userPrompts`. - * Added installing and updating plugins from admin-configured marketplaces on devices where Cowork isn't available, from the Code tab or the Cowork tab. - * Added local scheduled tasks to the Code tab, including the `/schedule` command and the Scheduled page, matching what Cowork already offered. - * Added the ability to attach files in SSH Code sessions. - * (breaking) Changed the Usage page cost estimate to require `inferenceModelPricingEnabled`; `inferenceModelPricingMultiplier` and `inferenceModelPricing` now refine the estimate only while it is on and no longer turn it on by themselves. - * Changed `HTTPS_PROXY`, `HTTP_PROXY`, and `NO_PROXY` set in the `env` block of Claude Code's managed settings (`managed-settings.json` or your organization's server-managed Claude Code settings) to apply to Chat, Cowork, and Code sessions even when the computer has a system proxy configured. - * Changed `isClaudeCodeForDesktopEnabled`: when it is `false`, the app no longer starts Code sessions even if asked directly, Preview no longer scans projects for a dev server, and the computer is no longer offered for Remote Control; a Code session requested anyway shows "Code sessions are turned off by your organization" instead of a retry prompt. - * Fixed Bedrock and Bedrock Mantle sessions being cut off by network idle timeouts during long thinking phases on Opus 4.7 and later models. - * Fixed Code tab sessions not prompting to re-authenticate when the deployment's credentials had expired; they now show the same sign-in prompt as Cowork. Also fixed Live Artifact `askClaude()` calls and the Code tab's "Detect dev server" failing on deployments that use SSO, credential helpers, Vertex, or Bedrock SSO. - * Fixed managed MCP connector sign-in staying permanently stuck when the identity provider no longer recognizes the OAuth client the app registered; the app now registers a new client automatically. - * Fixed MCP servers provided by plugins not connecting in Code and Cowork sessions when `managedMcpServers` is configured; in that case, with `isLocalDevMcpEnabled` set to `false`, plugins' remote MCP servers connect and their local (stdio) ones stay blocked. - * Fixed plugins distributed as a zip whose top level is a single component folder (for example `skills/` or `commands/`) installing with no skills, commands, or agents. - * Fixed the `allowedWorkspaceFolders` policy not always being applied to Code sessions over SSH. - * Fixed the Code tab home's usage stats reporting a favorite model, per-model breakdown, and activity from other Claude Code history on the same machine instead of this deployment's own sessions. - +* No user-facing changes. - - **General** +**3P** - * Updated the bundled Claude Code CLI to version 2.1.255. +* No user-facing changes. - **Code** +**v1.52386.3** - * No user-facing changes. +**General** - **Cowork** +* No user-facing changes. - * No user-facing changes. +**Code** - **3P** +* No user-facing changes. - * No user-facing changes. - +**Cowork** - - **General** +* Changed the automatic move of scheduled tasks to the cloud, for accounts where it has started: the app now waits about a minute after the computer wakes, and while offline checks again each minute, instead of trying at once and then waiting hours after a failed try. +* Fixed two problems with local projects that are moving to claude.ai, for accounts where that move has started: a project could refuse new tasks for hours while part of its memory copy waited on the server (it now accepts new tasks and the copy finishes in the background), and memory files shown in a moved project's earlier tasks would not open. - * Fixed Claude sometimes being unable to read or search a page in the built-in browser just after opening it or while it was still loading, and browser screenshots and interactions timing out or stalling on Windows and Linux while the browser pane was closed or another page was selected. - * Fixed the app failing to launch when one of its settings files had become corrupted, and settings files sometimes being left corrupt after an unexpected shutdown or power loss on Windows. - * Fixed the Share dialog: "Keep private" now takes effect immediately, and sharing a chat while offline shows an error instead of waiting indefinitely. - * Fixed typing with an IME (Japanese, Chinese, or Korean): confirming or cancelling a conversion with Enter, Escape, or a digit key no longer sends half-composed text, discards typed drafts, denies tool approvals, rejects plans, or stops Claude's response in Code sessions, and no longer commits or discards text in the browser pane's address field. - * Fixed scheduled tasks that run on this computer occasionally being marked as skipped without running; a run the app fails to pick up is now retried a few minutes later. +**3P** - **Code** +* No user-facing changes. - * Added side-task suggestions in cloud sessions: Claude can suggest follow-up tasks that you start on your machine, in the cloud, or in the same session with one click. - * Added `/resume`: search the Claude Code sessions started from your terminal on this computer and continue one in the app on the same transcript. - * Added a view of the session's MCP servers: type `/mcp` in a local session to see the servers from `.mcp.json`, `~/.claude.json`, plugins, and your claude.ai connectors, with live status and Connect, Reconnect, and Re-authenticate actions. - * Fixed "Import Claude Code CLI sessions" (Help > Troubleshooting): it again finds Code sessions whose sidebar entries were lost after a reinstall or repair, no longer rewrites a session file that a running Claude Code process is still using, and saves a backup of the original transcript when importing removes its thinking blocks. - * Fixed inline plan comments being silently lost when left after a plan was approved; the Plan pane now accepts comments in Plan mode or while Claude is asking you to approve the plan, and says when commenting opens otherwise. - * Fixed SSH sessions losing messages that were waiting to be sent when the remote host became unreachable or the app was quit, updated, or restarted; they are now kept and delivered automatically at the next connection, and Claude Code is restarted on the host when needed. - * Improved SSH session reconnects: high-latency links no longer drop their own connection, a network change mid-stream is noticed within seconds, an unreachable host is no longer re-dialed every few seconds in the background, and the session shows the specific connection error with a Try again button instead of a generic message or an indefinite "Reconnecting…". +**v1.52386.0** - **Cowork** +**General** - * Fixed files dropped onto the composer together with a folder being discarded; they now attach alongside the folder. - * Fixed shell commands that use plugin or skill file paths failing with "No such file or directory". - * Fixed the app running out of memory after many scheduled task runs. - * Fixed the Cowork readiness check appearing to hang for minutes when a network-redirected profile folder is unreachable, and reporting a computer as unsupported because of an encrypted leftover folder from an uninstalled Claude version. - * Fixed organization plugins failing to install or update on some Windows Store installs. - * Fixed a message that starts with a typed, pasted, or app-filled slash command for one of your enabled skills failing with "Unknown skill" in an existing task; it now sends. +* Changed messages sent while Claude is still replying: they now wait in the conversation looking like sent messages, the first waiting message offers Send now, which stops the current reply and sends it next, and Cmd/Ctrl+Enter sends your message right away, interrupting the current turn. +* Fixed Claude's clicks, scrolls, screenshots, and page scripts in the built-in browser stalling, timing out, or failing while the browser pane was hidden or the window was minimized or in the background, and fixed elements picked with "Select element" reaching Claude without their styles or with a screenshot of the wrong part of the page. +* Fixed links that open a new tab to claude.ai or claude.com pages, like Upgrade buttons and some download links, doing nothing when clicked; they now open in your default browser. +* Fixed sites on a private network (VPN, Tailscale, or intranet hosts) loading without their styles, scripts, or data in the built-in browser, and URLs typed into the built-in browser in cloud sessions not reaching private-network sites. +* Fixed the app window resetting to its default size and position after an update or a display change. - **3P** +**Code** - * Added `relaunchEnforcementHours` (served configuration only): when a served configuration change needs a restart, it sets how many hours (0 to 336) users may keep running on the previous configuration; at the deadline Claude shows a restart dialog and restarts on its own after 2 minutes of inactivity. Unset means 1 hour. - * Added `sshHostAllowlist` (beta): admins can turn on SSH remote sessions in the Code tab by listing the hosts users may connect to (`["*"]` allows any host). Unset keeps SSH sessions off unless a Claude Code managed-settings file on the device already allows hosts; an explicit `[]` keeps them off even then when the configuration is admin-delivered (device management or trusted remote delivery), while on a self-configured install the device allowlist still applies. Works with a gateway, Claude API key, or Foundry, and with Bedrock and Vertex when they use token-based credentials; file-based credential kinds are refused at session start with a message naming the kind. - * Added an estimated-cost view to the Usage page chart: when the organization has turned on cost estimates, the chart can switch between tokens and estimated cost per day (per week at 90 days), and days with turns that have no estimate show as gaps rather than \$0. - * Added an in-app warning when the organization's configuration uses a deprecated field: each user sees a dismissible notice from September 10, 2026 and once more in the 24 hours before the field stops being accepted, with a Details dialog naming each field, its replacement, the cut-off date and what changes then, plus a Copy report button that puts a plain-text summary for administrators on the clipboard. The new `disableConfigDeprecationWarnings` key hides the first showing; the final 24-hour reminder still appears. The warning also appears on standard deployments whose device-management profile uses one of these fields. - * Added Anthropic's Cowork and Claude Code plugin marketplaces as prefilled entries in the Setup window's `allowedPluginMarketplaces` Add menu. - * (breaking) Deprecated a set of older managed-configuration spellings, each accepted until October 7, 2026, 12:00 PM Pacific Time, with an in-app warning from September 10, 2026: `inferenceGatewayHeaders` (use `inferenceCustomHeaders`), `trustBootstrapLocalExec` (use `trustBootstrapDelivery`), `enduserAttribution` (use `endUserAttribution`), `inferenceGatewayAuthScheme` values `sso` (use `inferenceCredentialKind: "interactive"`) and `auto` (remove the key; `bearer` is the default), `isDxtEnabled` (use `isDesktopExtensionEnabled`) and `isDxtSignatureRequired` (use `isDesktopExtensionSignatureRequired`), header maps written as strings or lists in `inferenceCustomHeaders`, `otlpHeaders`, `otlpResourceAttributes` and `bootstrapHeaders` (use a JSON object), the `orgPluginSettings` record form (use the array form), the `ask-session` tool-permission value in `builtinToolPolicy`, `managedMcpServers[].toolPolicy` and `orgPluginSettings[].tools[].permission` (use `ask`), and in `managedMcpServers` entries the `scopes` list (use `scope`), `transport: "builtin"` (remove it), `authorityHost` (use `azureCloud: "us-gov-high"` for a GCC High tenant), `source` (remove it), `oauth` written as a number or string (use `true` or an `oauth` object), `oauth.scopes` or a list-valued `oauth.scope` (use `oauth.scope` as one space-separated string), and entries other than a built-in server with no `transport` (add `transport: "http"`, `"sse"` or `"stdio"`; a built-in Microsoft 365 or GitHub entry takes no `transport`). After the cut-off a renamed key's old name falls back to its fail-closed value or default, and an invalid `managedMcpServers` or `orgPluginSettings` entry makes that connector or tool policy unavailable until it is rewritten. - * Changed `inferenceVertexProjectId` and `inferenceVertexWorkforceUserProject`: a value delivered by a bootstrap URL the user configured themselves (in Settings or a local configuration file) now asks that user to approve it before it takes effect, and declining quits the app. Because the project ID is required, each such Vertex install prompts once after updating. Values delivered through device management, or by a bootstrap URL that device management set or that `trustBootstrapDelivery: true` covers, are unchanged and never prompt. Both keys must now match the Google Cloud project format. - * Changed `toolSearchEnabled` on gateway deployments to enable tool search alone; other experimental Claude Code betas stay suppressed. - * Changed how a managed-configuration value the app cannot read is handled: it now engages the restriction it belongs to instead of being ignored. Restriction keys such as `disabledBuiltinTools`, `builtinToolPolicy`, `coworkTabEnabled` and `disableBundledSkills` fall back to their restrictive value, an unreadable `managedMcpServers` keeps Code sessions restricted to managed MCP servers, an unreadable `isDesktopExtensionEnabled` or `isDesktopExtensionSignatureRequired` disables extensions or requires signed extensions, and a tool-permission value the app does not recognize is applied as the most restrictive setting (`ask` for a built-in tool, `blocked` for a plugin-delivered tool) and reported as a configuration error. `allowedPluginMarketplaces`, the built-in GitHub MCP preset and `otlpTracesEnabled` are no longer marked Beta. - * Changed the Setup window's configuration exports and the published bootstrap JSON schema to write `orgPluginSettings` in its array form; the app still accepts the older record form until October 7, 2026. Desktop versions before 1.15200.0 read only the record form and do not enforce plugin tool locks given the array, so update the fleet past 1.15200.0 before deploying an exported configuration that uses it. - * Changed the Vertex AI credential kind for Google sign-in to `inferenceCredentialKind: "interactive"`, matching other providers; `oauth` keeps working until October 7, 2026 (12:00 PM Pacific Time). If you deliver configuration as nested JSON (a self-hosted bootstrap server or a Setup JSON export), keep `oauth` until the whole fleet is on this release or later, because an older desktop drops the Google client ID from a nested `interactive` credential and Vertex sign-in stops working; flat MDM keys, .mobileconfig and .reg files are unaffected. Until October 7, 2026 a Vertex configuration that sets `interactive` together with `inferenceVertexWorkforceAudience` and no `inferenceVertexOAuthClientId` is still read as Workforce Identity; after that it means Google sign-in, so set `workforce` explicitly if that is the intent. - * Improved Cowork reliability when the workspace is slow to start or has been idle, and made switching back to a recently opened Code tab session faster. - * Fixed importing sessions from a previous Claude Desktop install: imported Cowork sessions keep their Project and its `~/Claude/Projects/` folder instead of getting a new empty one, an interrupted import now appears in Import history and its sessions are no longer imported twice on the next run, and the import wizard no longer re-creates a Project you had deleted (an imported Project that duplicates an existing name gets a "(1)" suffix). - * Fixed the Code tab's plugin directory and Customize > Plugins not listing plugins from marketplaces configured with `allowedPluginMarketplaces`; an admin-configured marketplace is now managed as the organization's in both tabs. - +* Added a default transcript view setting: choose whether new sessions open in the Normal, Thinking, or Verbose view from Settings > Claude Code, or make the current view the default from a session's Transcript view menu. The choice syncs between the desktop app and claude.ai. +* Fixed Code sessions failing to start on some Microsoft Store and MSIX installs on Windows. +* Fixed model changes being refused with a message saying organization-managed hooks could not be checked, for some organizations that manage Claude Code plugins; the session now restarts on the chosen model. +* Fixed sessions failing to start on Windows for accounts with many plugins installed. +* Fixed several SSH session issues: hosts slowly accumulating leftover background processes from older Claude versions until sessions there failed, sessions from one computer being ended when a second computer's Claude app cleaned up the same host, sessions permanently losing their connection after a saved connection's host or port was edited, and history missing its newest messages soon after launch or a reconnect. +* Fixed WSL sessions failing to start or reconnect, including background reconnects right after an app update, when WSL reported a momentary error. - - **General** +**Cowork** - * No user-facing changes. +* Changed what happens on Windows PCs where a Windows update released September 8, 2026 prevents Claude's workspace from reaching your files: the app now names that cause instead of deleting and reinstalling the workspace. This does not fix the underlying problem, and the workspace still can't reach your files on those PCs. +* Fixed a session appearing stuck running when an organization hook blocked a message; the reason the message was blocked is now shown. +* Fixed an Office file preview sometimes showing "Failed to load PDF document" instead of the spreadsheet or document view. +* Fixed long-running tasks failing with an authentication error after the app renewed your sign-in in the background; the running task now picks up the renewed sign-in and continues. - **Code** +**3P** - * No user-facing changes. +* Added `coworkVmIpv6Enabled`, which gives the Cowork workspace VM an IPv6 address and route so the agent's tools can reach IPv6-only hosts through the device's own IPv6 connectivity. macOS and Windows; off by default. `coworkEgressAllowedHosts` still decides which hostnames the tools may reach. +* Added `sshTransport` (beta), which chooses the SSH engine that carries Code sessions: `system-openssh` runs the OpenSSH `ssh` program on the device, so connections can use the organization's own SSH setup (for example Kerberos sign-in, including on Windows), and `builtin` uses the app's built-in SSH library. Unset or `auto` keeps the build's default. +* Added a deprecation notice in the Setup window under any managed-configuration setting that is scheduled to stop being accepted, naming the date and what to use instead. +* Added organization-set session retention. `chatSessionRetentionDays`, `coworkSessionRetentionDays`, and `codeSessionRetentionDays` each delete that surface's idle sessions from the device, along with their files, after the set number of days (1 to 3650) without activity; unset deletes nothing. `sessionRetentionHold` suspends all automatic deletion for the users it is set for, as a legal hold. Projects, Spaces, and memory stay, and a Code session's uncommitted work stays on disk. +* Changed app launch to open the home composer on the last-used Chat or Cowork mode instead of always opening Cowork first. +* Changed hooks from organization plugins to also run in Chat, matching Cowork and Code. +* Deprecated an undocumented client-certificate fallback setting that releases from 1.49585.0 on no longer read, since the app now presents TLS client certificates natively. Deployments that still set it keep working unchanged, but their users see an in-app deprecation warning from November 3, 2026, and the setting stops being accepted on November 17, 2026; remove it once every device is on 1.49585.0 or later. +* Improved the connection test against gateways that require a TLS client certificate the device does not have: the result now says the device did not present a certificate the gateway accepts, so the connection could not be tested, instead of reporting the model as rejected. +* Fixed Claude Code's own settings on the device (a user's or project's settings file, or a `managed-settings.json`) being able to turn OpenTelemetry trace export back on after an administrator configured a collector with traces off; with `otlpEndpoint` set, Cowork and Code sessions now export traces only when `otlpTracesEnabled` is `true`. +* Fixed Amazon Bedrock and Google Vertex AI sessions retrying a failed request for several minutes when the AWS or Google Cloud credential on the machine had expired; the request now stops after one retry so the credential can be refreshed. - **Cowork** +**Known issue: Cowork on Windows** - * No user-facing changes. +**Resolved September 14, 2026.** Microsoft has released a Windows update that fixes this issue. Install the latest Windows update and restart your PC. - **3P** +A Windows update released September 8, 2026 (including KB5124008) stops Cowork from reaching your files when it runs on your Windows PC, so tasks fail or the workspace does not start. This affects Cowork on third-party inference deployments and Cowork sessions that run on your computer rather than in the cloud. Cloud sessions and Claude Code, including the Code tab, are not affected. Chat cloud sessions are not affected, but Chat sessions on third-party inference deployments are affected if using advanced file analysis. The cause is a change in Windows, so restarting or reinstalling Claude does not help. - * No user-facing changes. - +**v1.49585.0** - - **General** +**General** - * No user-facing changes. +* Changed an invalid "Required organization" device-policy value to block sign-in with a configuration error, shown in the diagnostic report, instead of being ignored. +* Updated the app runtime to Electron 44 (Chromium 152); macOS 13 Ventura or later is now required. +* Fixed chats started from the menu bar or Quick Entry panel opening as an empty page for up to a minute before the reply appeared, and ignoring your instructions from Settings > Instructions for Claude. +* Fixed macOS sometimes showing repeated "bash would like to access data from other apps" prompts after quitting the app with sessions open. +* Fixed scheduled tasks around Mac sleep: a task that ran while the Mac was asleep was sometimes stopped as unresponsive when it woke, tasks missed during sleep sometimes started during a brief background wake and failed (they now start once the Mac is fully awake), and a one-time task occasionally started many sessions at once after wake. - **Code** +**Code** - * No user-facing changes. +* Improved terminal tabs: they now show when a command is still running and ask before closing one that is, and a tab whose shell crashed or was killed stays open with a Restart option instead of closing silently with its output. +* Removed the Git requirement for local sessions that don't use a worktree; on Windows, Git for Windows (Git Bash) is no longer needed to start a session. +* Fixed the Files pane discarding unsaved edits without asking when you closed the pane, expanded another pane, or opened it in a new window; fixed the editor joining lines in files that mix Windows and Unix line endings; and a failed save now says the file couldn't be saved and offers Try again instead of claiming the file changed on disk. +* Fixed the selected model reverting or being refused when you switched models while a session was starting, restarting, or still answering; the session now uses the model you chose, and model changes in SSH and WSL sessions no longer fail with "plugin hooks could not be loaded". +* Added automatic sending for messages held after you hit your 5-hour limit: they now send when the limit resets, and you can still edit, cancel, or send them early. - **Cowork** +**Cowork** - * No user-facing changes. +* Fixed a conversation started from an artifact, or from an artifact comment's Send to Claude, not using your selected model. +* Fixed a task disappearing from the app while its files stayed on disk when one of them was in use during delete; the task is now kept so the delete can be retried. +* Fixed an issue where the app could quit at launch with a very large number of Cowork tasks. +* Fixed the "Can't reach the Claude API" warning staying on screen until the app was restarted even after the connection had recovered; it now clears on its own. - **3P** +**3P** - * No user-facing changes. - +* Added `continuousAccessEvaluation` to the Microsoft 365 entry in `managedMcpServers`: the bundled connector's sign-ins, through the OS sign-in broker as well as the browser, request Continuous Access Evaluation tokens from Microsoft, which can live up to about 28 hours but are revoked within minutes when an administrator revokes sessions or a tenant network policy no longer allows them; set it to `disabled` to keep standard one-hour tokens on every sign-in path. Defaults to `enabled`. +* Added each model's description from the gateway to the model picker for deployments that discover models from the gateway. +* Changed `microsoftAuthBroker`: a new `required` option makes Microsoft 365 sign-in fail when the OS sign-in broker is unavailable instead of falling back to the browser, so the refresh token always stays held by the broker, and removes the token cache an earlier browser sign-in left on disk. Earlier versions treat `required` as `disabled` (browser sign-in only), so set it once every device is on this version or later. +* Changed Claude API, Google Vertex AI, Amazon Bedrock, and Bedrock Mantle deployments that set no custom base URL to no longer suppress Claude Code's experimental features, so tool search is on by default there (on Vertex AI with Claude 4.5 and newer models) and `toolSearchEnabled` is no longer needed to turn it on; gateway and Foundry deployments, and those providers behind a custom base URL, are unchanged. +* Fixed Amazon Bedrock sessions that use IAM Identity Center sign-in showing an internal error or a bare "operation was aborted" message when AWS sign-in could not be reached at session start; the app now says whether IAM Identity Center was unreachable, temporarily unavailable, refused the account or role, or returned an unreadable response, and what to do next. +* Fixed find in page (⌘F) missing matches in messages scrolled out of view. +* Fixed Google Cloud (Vertex AI) sessions sometimes running under the computer's own Google login instead of the credential your organization configured, and the app not asking you to sign in again after your Google session expired. +* Fixed the app refreshing the sign-in token about once a second when an inference gateway answers 403 to the model list request. +* Fixed the built-in Microsoft 365 connector showing Connected before anyone had signed in; its first request in a conversation now offers the sign-in, and a cancelled sign-in no longer hides its tools; the bundled connector also gains a tool that reads Teams channel messages. - - **General** +**v1.46388.4** - * Updated the bundled Claude Code CLI to version 2.1.246. +**General** - **Code** +* No user-facing changes. - * Fixed remote MCP servers never recovering after a dropped connection; they now reconnect automatically or report as failed. - * Fixed signing in to some MCP servers, such as Linear, failing with an "Invalid redirect URI" error. +**Code** - **Cowork** +* No user-facing changes. - * No user-facing changes. +**Cowork** - **3P** +* No user-facing changes. - * Added support for the `inferenceModelPricing` rates and the `inferenceModelPricingMultiplier` discount in the Usage page's cost estimate; in 1.37937.0 the estimate always used Anthropic list price. - +**3P** - - **General** +* No user-facing changes. - * Added support for legacy Word .doc files, which now open like .docx, and Excel .xlsx and .xls spreadsheets, which now attach as text where they used to be refused. - * Removed sharing of chat artifacts for members of organizations whose admin has turned Artifacts off; links already shared keep working. - * Fixed chat refusing new messages after the weekly Cowork limit was used up. - * Fixed scheduled tasks set to run on both a day of the month and a weekday (for example "the 1st and every Monday") only running when the two coincided; they now run on either day, as their schedule description says. - * Fixed several chat reliability issues: queued messages could disappear or send on their own, a send retried during a service overload could add repeated copies of a message, reopening a chat before the reply arrived could show a false "message wasn't sent" error, and a single failed response could show two error messages. - * Fixed the app sometimes signing you out right after an automatic update. +**v1.46388.3** - **Code** +**General** - * Improved SSH session reliability: fixed connections failing when the configured identity file is a public key (common with 1Password setups), messages sent while the host reconnects are delivered once it is back, a Claude Code upload to the host now rides out a brief network pause, idle sessions no longer show a false "Lost connection" card, reconnecting can ask for a password or one-time code when needed, and a reconnect no longer reports lost output unless it truly could not be recovered. - * Fixed all saved SSH connections disappearing when one stored connection entry was invalid. - * Fixed background cleanup of old session worktrees on Windows sometimes also deleting the contents of folders that NTFS junctions inside the worktree pointed to, such as the main checkout's `node_modules`. - * Fixed removing a claude.ai import run resetting uncommitted work in a session you had started from that import; the session's files are now kept on disk. - * Fixed sessions failing to start for organizations using the `disableSideloadFlags` setting in Claude Code's `managed-settings.json`; sessions now start without the desktop's bundled skills and plugins instead. - * Fixed very high memory use, and a blank or unresponsive window, when opening or reconnecting sessions with very large transcripts or many subagents. +* No user-facing changes. - **Cowork** +**Code** - * Added dictation in the Claude in Chrome side panel; allow the microphone once in the extension's settings. - * Fixed "upload failed" errors when staging Google Drive and other cloud-synced files that are not downloaded on your Mac yet; they now download automatically, and clearer messages explain when the sync app needs to be started. - * Fixed a Rename, Delete, or Move dialog left open in a task's header staying open when you switched to another task and acting on the task you switched to; it now closes on switch. - * Fixed only the last file staying attached when several files opened with Claude each needed confirmation. - * Fixed restored Cowork tabs showing a "Try again" error when the app restarted before sessions finished loading, such as right after an update. - * Fixed the tasks and files panel staying open as an empty pane after a restart. +* No user-facing changes. - **3P** +**Cowork** - * Added `mcpToolTimeoutSec`, which sets how long an MCP tool call may run before it times out. Defaults to 180 seconds. - * Added `organizationInstructions`: organization-wide instructions appended to Claude's system prompt in Chat, Cowork, and Code sessions (up to 3,000 characters); settable via device management, a local configuration file, or the bootstrap response. They are guidance the model follows, not an enforced control. - * Added `skipWebFetchPreflight`. When enabled, Code sessions no longer contact api.anthropic.com before fetching a web page, which fixes page fetches failing on networks that block that host. Off by default. - * Added `userPluginMarketplacesEnabled` and `userPluginUploadsEnabled`, which control whether members can add their own plugin marketplaces and upload their own plugins; when off, the add options are hidden and adds are refused. Unset keys change nothing. - * Added Code tab features already available in the standard app: the Files panel with Show in Files, emoji autocomplete and inline prompt suggestions in the composer, interactive MCP app widgets in the conversation, and letting Claude read output from the integrated terminal panel. - * Added cost estimates to the Usage page: `inferenceModelPricingEnabled` shows an estimated cost alongside token counts, priced at Anthropic list price; `inferenceModelPricing` supplies per-model rates and `inferenceModelPricingMultiplier` scales every estimate (a number between 0 and 1). The two rate keys take effect from 1.37937.1; in 1.37937.0 estimates use list price. Off by default. - * Added suggestions for plugins and skills from your organization's own library in chat. - * Added support for plugin marketplace credential helpers that return a username or `authtype=Bearer`, so marketplaces hosted on Bitbucket Data Center or behind GitLab deploy tokens can authenticate. - * Added the `disableDesktopLocalSessions` setting to Claude Code's `managed-settings.json`, which turns off Code sessions that run on the device itself so the Code tab offers only remote environments such as SSH; the environment menu shows Local greyed out with a "Disabled by your organization" explanation. - * Changed `allowedPluginMarketplaces` (beta): a `url` marketplace hosted on the bootstrap server's own origin can now use `credentialKind: "inferenceCredential"` and is fetched with the same sign-in the app already uses for its bootstrap configuration. - * Changed `builtinToolPolicy` to accept argument-scoped Claude Code permission rules such as `Bash(curl *)` in addition to bare tool names; `WebSearch` and `WebFetch` entries stay bare tool names, and entries that are not usable rules are rejected with a configuration error. - * Changed gateway device-code sign-in to show the signed-in account's email, when the gateway returns one, instead of the computer's login name. - * Changed the Code tab's file pane and git panel to follow the administrator's `allowedWorkspaceFolders` setting. - * Fixed Bedrock sessions behind a proxy that strips the response content type silently re-running every request without streaming, which billed each request twice. - * Fixed Cowork scheduled tasks running on the 200K-context model when the 1M-context row or "Default model" was selected in the task form; the form now labels the 1M row. - * Fixed the built-in Microsoft 365 connector publishing an invalid schema for updating a calendar event's end time. - * Fixed the Microsoft 365 local connector on Windows failing for users with more than one Microsoft work account on the PC. The Reconnect card now opens the Windows account picker and the chosen account is remembered; users of this connector will be asked to reconnect once after this update. - * Fixed the model picker showing a duplicate, mislabeled 1M-context row when `inferenceModels` lists a model both with and without the `[1m]` suffix. - +* Added support for attaching your home folder, Windows Documents, AppData, the macOS Library folder, and whole drives; Claude's own configuration and session data inside them stay off-limits, as do certain credential and shell-startup locations (for example SSH keys, AWS and Google Cloud credentials, and bash, zsh and PowerShell profile files). - - **General** +**3P** - * No user-facing changes. +* No user-facing changes. - **Code** +**v1.46388.2** - * No user-facing changes. +**General** - **Cowork** +* No user-facing changes. - * No user-facing changes. +**Code** - **3P** +* Fixed Code sessions started in a git worktree failing to initialize on Windows. - * Fixed prompt caching not being applied in sessions that use an inference gateway or custom endpoint. - +**Cowork** - - **General** +* No user-facing changes. - * Fixed a startup freeze on Macs that keep applications in iCloud Drive with Optimize Mac Storage turned on. - * Fixed scheduled task problems: "every N days/months" schedules ran on the wrong days (existing tasks move to the correct days on their next run), re-enabling a task or editing its schedule immediately started a catch-up run for a time slot that passed while it was off, and manually run tasks sometimes did not record when they last ran. - * Fixed the app crashing when signing in with Touch ID on macOS; Touch ID passkey sign-in is temporarily unavailable. - * Fixed the app quitting on macOS when the disk was full or when stopping dictation. +**3P** - **Code** +* No user-facing changes. - * Fixed archiving an SSH session discarding uncommitted or unmerged work in its remote worktree; the worktree is now kept, and unarchiving recreates it if it is missing so the session can pick up where it left off. - * Fixed session history no longer updating or appearing lost on macOS for sessions in folders whose names contain accented, Korean, or Japanese characters. - * Fixed sessions you hadn't opened for 30 days or more losing their conversation history even though the app was in regular use. - * Fixed SSH connections on slow or unstable networks failing on the first attempt and needing a manual retry. - * Fixed SSH sessions losing a task that was still running when the app reconnected after an app update. - * Fixed the side chat answering once and then failing with an authentication error for the rest of a long session. +**v1.46388.1** - **Cowork** +**General** - * Fixed conversations failing to open when a message contained a very long run of bracketed text, a very long line starting with an unclosed `[`, or a very long run of `>` characters. - * Fixed message ratings and "Send feedback" links sometimes appearing when your organization has product feedback turned off. - * Fixed sessions failing to start on managed Macs where the app's temporary directory is not writable. +* Removed the "Mark as unread" action for chats. +* Fixed links between artifacts and shared-artifact links clicked inside the app opening in the browser or losing their share key; they now open in place, and a teammate without access sees the request-access screen instead of "not available". +* Fixed memory use on macOS growing steadily while working with files, which could end with the system reporting it had run out of application memory. +* Fixed new messages being queued instead of sent after reopening a chat whose last message had no reply yet. +* Fixed removing a file from the message box after stopping or losing a reply sometimes deleting that file from the message you had already sent, which made "Try again" on it fail. +* Fixed side chat, the slash-command picker, usage insights, and other quick actions failing silently on machines where an organization deploys a Claude Code `managed-mcp.json`. +* Fixed the dictation microphone button disappearing from the chat composer once a message had text, an attached file, or a quoted reply. - **3P** +**Code** - * Changed gateway device-code sign-in to refresh silently when the gateway also issues a refresh token, instead of prompting you to sign in again each time the access token expires. - * Fixed an ended gateway device-code sign-in going unnoticed while the app was idle; the app now notices at its next periodic configuration check or shortly after the computer wakes from sleep and asks you to sign in again, and the Setup window says "Session expired" instead of "Denied". - * Fixed Cowork file previews showing "Preview unavailable" until the app was restarted once a preview pane had been closed for a few minutes. - +* Added a queue for messages sent while your 5-hour usage limit is reached: they wait above the composer instead of failing, and you can edit, cancel, or send them when you're ready. +* Added keep-awake while Claude works: the computer no longer idle-sleeps while Claude is working in the Code tab, with a "Keep computer awake while Claude works" setting (and a "Keep awake on battery power" option) under Settings > Claude Code, a "Keep computer awake for this session" item in the session menu, and a one-time notice after a long task. +* Removed the Summary transcript view from the session's Transcript view menu; sessions that had it selected open in the Normal view. +* Fixed Extra high and Max effort on Claude Opus 5 quietly running at High when thinking was turned off in your Claude Code settings; those efforts now run with thinking on for the session. +* Fixed organization-managed settings not loading, and Remote Control not connecting automatically, for some users until they signed out and back in. +* Fixed sessions failing to open: a "Couldn't load this" message now recovers on its own instead of needing a manual reload, sessions no longer show "No messages yet" on Windows hosts that use FSLogix or similar profile containers, and a transcript that can't be read shows the reason with a Retry button. +* Fixed SSH sessions being restarted after some reconnects, which could leave duplicate Claude Code processes on the remote machine, and fixed messages held for an unreachable host: they are retried after an app restart, and when the host comes back needing your password or an unlocked SSH agent the app asks you instead of marking the message "needs you". +* Fixed switching models in a session: a switch refused with a "plugin hooks could not be loaded" error now restarts that session's Claude Code on the model you picked, the model picker no longer shows a model Claude Code refused, and Remote Control sessions no longer offer models the connected Claude Code version can't run. +* Fixed switching models staying blocked for the rest of the session when an organization-managed plugin's marketplace or a plugin hook failed to load. +* Fixed the remembered folder sometimes getting mixed up with a remote machine's path, which made every local session launch fail with "working directory no longer exists". - - **General** +**Cowork** - * Added message queueing during Research: a message sent while a Research run is in progress is queued and sent when the report is ready. - * Fixed 1Password credential requests failing when Claude in Chrome is signed in from more than one browser profile. - * Fixed a crash on Windows when installing an update while a background update check was still running, and fixed update installs repeatedly failing after a newer update replaced one already staged. - * Fixed a message sent immediately after stopping a reply sometimes being put back into the input box instead of sending. - * Fixed reloading or reopening a temporary chat rebuilding the page a moment after it loads, which could discard text typed early. - * Fixed the computer-use permission prompts in Cowork and Claude Code sessions accepting a keyboard shortcut aimed at the message box or another surface, and added a brief delay so a send keystroke that lands just as the prompt appears cannot approve it. +* Added automatic re-runs (after 5, 15, and 30 minutes) for a scheduled task that could not reach the model at all, for example right after the computer wakes behind a VPN. +* Fixed Record a skill opening an unresponsive chooser window on Windows. +* Fixed saving a skill Claude proposes in a conversation: a name that matches one of your skills now offers to update that skill instead of failing with "Try again", and when saving is blocked until you sign in again the Save skill button opens the sign-in prompt instead of a generic error. +* Fixed scheduled tasks and other automatic ways of starting a session choosing a model the installed app version can't run, which made every turn fail. +* Fixed the row under the composer (Add folder, permission mode, model) disappearing after switching a session to automatic approvals. - **Code** +**3P** - * Fixed automatic continuation after a rate limit firing into the imported-session confirmation prompt or a stale sign-in state, and it now waits out the server's limit reset and sends a clearer continuation message. - * Fixed inline bash commands being silently captured as input by a previous command still waiting for a response, such as an interactive login; a stuck command is now noted in the transcript and cleared before the next command runs. - * Fixed messages sent from one session to another sometimes being silently dropped, which left the sending session showing a thinking state for many minutes. - * Fixed slow session starts for people with MCP servers configured in `~/.claude.json`. - * Fixed the Code tab wrongly asking you to install Git on Macs that have Apple's Command Line Tools but not Xcode. - * Fixed worktree sessions failing with a "path contains control characters" error when a `WorktreeCreate` hook prints status output before the path. +* Added `blockReadsOutsideWorkingDirectories`: restricts Code sessions to reading files inside the session folder and `allowedWorkspaceFolders`; file tools refuse reads elsewhere, and sandboxed shell commands lose access to the home directory. +* Added `configRecheckIntervalMinutes`: how often a running app re-checks its managed configuration for changes, from 2 to 30 minutes; unset means 10 minutes, where the app previously checked every 30. A served value applies without a restart, and the key can also be set from device management. +* Added `disableBypassPermissionsMode`: removes bypass permissions mode from Code sessions and Cowork tasks, so Claude always follows the configured permission policy. +* Added `sshClientPath` (beta): the absolute path of the OpenSSH program the app runs for SSH sessions; when unset, the app uses the first `ssh` on the user's PATH. +* Added an Edit button to your most recent message in Cowork and Chat sessions, so you can revise and resend it, and fixed "Restart conversation from here" doing nothing in Chat sessions. +* Added the restart prompt, escalating to a required restart after `relaunchEnforcementHours`, when device-managed configuration (the managed plist, Windows policy registry, or Linux managed-settings file) changes while the app is running; previously only configuration changes served from a customer bootstrap endpoint prompted one. +* (breaking) Changed `relaunchEnforcementHours`: in served configuration the key moved from `bootstrap.relaunchEnforcementHours` to `lifecycle.relaunchEnforcementHours`; this release no longer reads the old path and earlier versions do not read the new one, so move the value under `lifecycle` (the flat-format and device-management key name is unchanged); the key can now also be set from device management; and the default window before a required restart is now 24 hours instead of 1. A device-management profile that sets any app-behavior key takes precedence over a served value for this key, so such a profile should set it too. +* (breaking) Changed how unreadable Claude Code managed settings are handled: if a device's `managed-settings.json` file, a drop-in, the device-management plist, or the Windows policy registry value cannot be parsed, Claude Code now refuses to start and names the source, so sessions on that device will not start until that file or value is fixed or removed; previously they ran without those settings. Check that these sources parse on managed devices before rolling out this version. +* Changed `allowedPluginMarketplaces` entries set to `auto_install` or `required` without a pinned commit SHA (or without `manifestSha256` for a `url` source) to show as available with a configuration warning, instead of being removed from the marketplace list. +* Changed Claude Code's `allowedMcpServers` setting (in its `managed-settings.json`, not the managed-configuration schema) to govern only servers users add themselves: a server from a `managed-mcp.json` file that the allowlist used to filter out now loads, and `deniedMcpServers` is the way to keep it off. +* Fixed chat search returning no results; searching finds chats by title and message content again. +* Fixed deployments without cloud features, or with the Cowork tab turned off, showing controls that could not work there, including Remote Control, automatic pull requests, the Cloud and Slack session filters, Add marketplace, and Cowork slash commands. +* Fixed organization plugins staying installed for users after an administrator removed the plugin's folder from the system `org-plugins` directory. +* Fixed remote MCP connectors whose `headersHelper` mints the credential continuing to fail for up to several minutes after the server rejected an expired credential; the helper now re-runs immediately and the rejected request is retried once. - **Cowork** +**v1.44121.4** - * Fixed an occasional "Something went wrong" error when a session's question card from Claude changed to a new set of questions. - * Fixed Claude sometimes reporting a file as saved when it had been written to a temporary location you could not open. - * Fixed Cowork failing to start on Intel Macs. +**General** - **3P** +* No user-facing changes. - * Added `bootstrapHeaders` and `bootstrapHeadersHelper` for authenticating the bootstrap configuration fetch with a service-account credential, the supported replacement for embedding `user:password@` in `bootstrapUrl` (rejected since 1.32352.0): `bootstrapHeaders` is a set of static headers sent on every fetch, and `bootstrapHeadersHelper` is the absolute path of an executable that prints headers as JSON, for a rotating token; helper output is merged over the static headers. When either is set and no `bootstrapOidc` provider is configured, the headers count as sufficient authentication for the fetch and no per-user sign-in is required for it; a per-user sign-in bearer, when also present, still wins on `Authorization`. Header values are masked in diagnostics, and both keys are accepted only from device management or a local configuration file. - * Added the option to sign in to claude.ai directly from the import wizard to fetch your data export, with no manual zip download needed. - * Changed new Cowork sessions to store Claude Code transcripts under a short fixed folder name, now that the bundled Claude Code (2.1.234) supports it, further shortening file paths on Windows; existing sessions are unchanged. - * Changed organization plugin delivery: when the organization plugins endpoint is removed from your configuration, the plugins it had installed are removed from members' devices, as already happens for a removed plugin marketplace. - * Fixed admin-configured plugin marketplaces and organization plugins not re-syncing until the next periodic refresh after signing in or after a delayed configuration fetch applied. - +**Code** - - **General** +* No user-facing changes. - * Fixed a rare Windows startup failure where the first window could fail to initialize on a fresh install. +**Cowork** - **Code** +* No user-facing changes. - * No user-facing changes. +**3P** - **Cowork** +* Added support in Chat for skills from organization-provided plugins, and Chat-only users can now see and manage those plugins under Customize, matching Cowork and Code. +* Fixed advanced file analysis in Chat failing with "Workspace unavailable" for users whose organization enables `chatAdvancedFileAnalysisEnabled` but turns Cowork off with `coworkTabEnabled: false`. +* Fixed managed OAuth connectors showing a connection error instead of prompting to sign in when the app starts without a usable sign-in (expired with no refresh token, or never signed in on this machine), including servers added by URL alone, where Connect could fail instead of opening the sign-in page. +* Fixed organization-configured URL plugin marketplaces failing to install or load plugins with "marketplace entry path does not stay inside the marketplace directory". - * No user-facing changes. +**v1.44121.2** - **3P** +**General** - * No user-facing changes. - +* No user-facing changes. - - **General** +**Code** - * Fixed Windows updates sometimes leaving the app half installed, with later updates failing too. - * Fixed the app staying on "Couldn't connect to Claude" when a network proxy blocked its first connection; it now keeps retrying for a few minutes and again when you return to the window. - * Fixed the composer staying disabled after a usage-limit notice when your organization has extra usage turned off or not set up; sending works again once your admin turns it on. - * Fixed settings and connector links in chat doing nothing, or opening your web browser, when clicked in the app; they now open the app's own settings. - * Fixed text typed on the new chat page sometimes disappearing when turning on incognito. - * Fixed the chat showing an error screen instead of the conversation when Claude created or linked a file whose name contains a percent sign. +* No user-facing changes. - **Code** +**Cowork** - * Changed auto-continue after the 5-hour usage limit to be on by default: sessions left open resume when the limit resets. Uncheck "Auto-continue when limits reset" in the limit banner to turn it off for your account. - * Fixed sessions sometimes hanging after resume, either showing "The session stopped responding" after the first message or never starting when a file system or MCP server stalled. - * Fixed undo (Cmd+Z, or Ctrl+Z on Windows and Linux) in the message composer sometimes failing with an error and then no longer working. - * Fixed a brand-new cloud session losing its first message when you navigated away within a few seconds of sending it. - * Fixed sessions started right after the app opened sometimes running in a more permissive mode than your saved permission mode. - * Fixed Remote Control sessions staying stuck at "connecting" after you completed the sign-in or device-check prompt, and file links not opening when the session was viewed from another computer. +* Fixed sessions on Windows being unable to run commands or fetch web pages. This reverts the 1.44121.1 fix for sessions failing to start on Windows for accounts with many saved artifacts, scheduled tasks, or connected folders. - **Cowork** +**3P** - * Removed the "Allow all browser actions" option from Claude in Chrome permission cards; allow each website instead. The switch in Settings is unchanged. - * Fixed the workspace startup error suggesting a restart or reinstall when the computer was low on disk space; it now asks you to free up space and retry. - * Fixed a tool call hanging for a full minute when its local MCP server crashed mid-call; it now fails right away. - * Fixed computer use on macOS refusing every click after you had taken a screenshot or while a screen recording was running. - * Fixed the approval mode still showing "Skip all approvals" when your organization's policy had blocked it; switching back to "Manually approve" now asks again before Claude fetches web pages it visited while approvals were off. - * Fixed the activity panel button doing nothing while a file was open beside the chat; it now closes the file and shows the panel. +* No user-facing changes. - **3P** +**v1.44121.1** - * **Breaking:** Managed-config URL settings now reject values that embed credentials (`https://user:password@host…`). Configurations that relied on this fail to load until the credentials are removed; use `bootstrapHeaders` / `bootstrapHeadersHelper` (available from 1.32885.1) to send authentication instead. - * Added `claudeAiImport.exportEnabled`. With it and `claudeAiImport.enabled` both `true`, users can export this computer's chats, Cowork tasks, and Code sessions from Settings > Import & export as a zip that another install can import. Off by default. - * Added a `url` source for `allowedPluginMarketplaces` (beta): a hosted `marketplace.json` that delivers plugins as zip archives over HTTPS, with no git on the device. Set `manifestSha256` to pin the exact manifest; it is required for automatically installed plugins. - * Added `inferenceCredential` as a `credentialKind` for `allowedPluginMarketplaces` (beta): a `url` marketplace hosted on your inference gateway is fetched with the same credential the app already uses for inference. - * Changed `coworkEgressAllowedHosts`: a `:port` suffix now also applies to shell commands and package installs in Cowork sessions, which previously could not reach a port-scoped host at all. - * Changed settings from a locally configured (not device-managed) bootstrap URL that need user approval to apply all or nothing: nothing takes effect until the user chooses Allow; Quit closes the app and asks again next launch. - * Changed a served configuration with an invalid connection value to report that field by name and keep the organization's other settings in force; a non-Anthropic model entry is now skipped with a warning instead of invalidating the whole configuration. - * Changed admin-configured plugin marketplaces (`allowedPluginMarketplaces`, beta), including automatically installed and required plugins, to apply to Code sessions as well as Cowork. - * Changed new Cowork sessions to use much shorter folder names on disk so file paths are less likely to exceed Windows path-length limits; existing sessions keep their folders, and tooling that matches the `local_` prefix should also match the new names. - * Fixed Settings > Import & export saying import isn't enabled on deployments that provision the sign-in import without setting `claudeAiImport.enabled`; that key now governs only file and earlier-session import, the import prompt, and session export. - * Fixed the Setup window accepting a mis-typed inference region, Azure AI Foundry resource name, blank Vertex AI project ID, or non-Anthropic model ID that was only rejected later on the device; these are now flagged before saving. - * Fixed imported project instructions arriving as a loose file instead of the project's editable Instructions; they are now shown for review on the project page and apply once you accept them. - +**General** - - **General** +* Added Claude to the "Open with" menu for common work files, including spreadsheets, PDFs, Word and PowerPoint documents, text files, and images, on macOS and on Windows (Microsoft Store and MSIX installs). +* Fixed a crash at launch when the app's settings file couldn't be read. +* Fixed a new chat's first message being dropped when you had to sign in again or verify this device; the chat now asks for that step in a dialog over your message. +* Fixed an issue where an invalid settings file could cause all app settings to be reset. +* Fixed Claude not finding files attached in Cowork and Chat, including pasted files and a re-attached file with the same name; attachments that can't be read now say so instead of being dropped silently. +* Fixed scheduled tasks failing with an error after a permission approval. +* Fixed the app reloading endlessly when it keeps crashing right after loading; it now stops and shows what to do next. - * No user-facing changes. +**Code** - **Code** +* Added a Split View submenu to the View menu for opening a new session beside or below the current one, and side panes (diff, terminal, plan, preview, and others) can now open in a window of their own. +* Added Claude Code output styles: an "Output style" submenu in the session menu and a `/output-style` command for viewing and switching styles, a "New style…" option that drafts a custom style from a plain-language description, and a default style setting in Settings › Claude Code. +* Changed the Files pane to open files as tabs beside a collapsible file tree, with single-click preview tabs, multi-select, richer right-click menus, and inline previews for PDF, Word, Excel, and PowerPoint files. +* Fixed `/rewind` appearing undone when returning to a session after navigating away, which could also cause the next message to silently drop recent conversation history. +* Fixed Code sessions repeatedly failing to start after a corrupt Claude Code download on macOS, failing to start on Linux arm64, and SSH and WSL session setup failing on slow connections; the one-time install now shows progress and can fall back to uploading Claude Code from your computer. +* Fixed sessions failing to start on macOS 12 (Monterey). +* Fixed sessions getting stuck on "responding" when a message was queued near the end of a turn. - * No user-facing changes. +**Cowork** - **Cowork** +* Changed live artifact sharing to follow your organization's Artifacts setting and sharing policies: members no longer see sharing options their organization has turned off, and already-shared artifacts keep Copy link and Unshare. +* Changed updating a skill from a file card or skill proposal to apply in one step with an Undo toast instead of a confirmation dialog; where a confirmation still appears, its Update button is the pre-selected action. +* Changed what happens when web fetch isn't available for your organization: Claude now says so instead of retrying and reporting failed fetches. +* Fixed a crash when previewing an image file that is empty or actually contains text. +* Fixed a message with an attachment that couldn't be read or was too large failing to send over and over with no explanation; Claude now marks the attachment with the problem, says what to do, and offers Retry where it can help. +* Fixed sessions failing to start on Windows for accounts with many saved artifacts, scheduled tasks, or connected folders. +* Fixed sessions that run Claude Code directly on the device failing to start for organizations that set `disableSideloadFlags` in Claude Code's managed settings (`managed-settings.json`, an MDM profile, or the registry); in those sessions Claude Code loads none of the desktop's plugins, so their commands, agents, and hooks are unavailable. +* Fixed the session page reloading after you connect a connector that signs in through the browser. - * No user-facing changes. +**3P** - **3P** +* Added `claudeAiImport.automatic3pImport` (beta): when `true` and `deploymentOrganizationUuid` is set, the app copies this computer's earlier third-party sessions stored before an organization ID was configured into that organization's session store, once per device and in the background, independently of `claudeAiImport.enabled`; a copy interrupted when the app quits resumes on the next launch. +* Added `egressProxyUrl` and `egressProxyPacUrl`: route the app's and the agent's traffic through a corporate HTTP proxy, or let a PAC file choose the proxy per request, instead of following the operating system's proxy settings; on macOS and Windows, Cowork's workspace follows the pinned proxy too. Both keys are read from device management or the local configuration file only, and the PAC file wins when both are set. +* Added `inferenceStreamIdleTimeoutSec`: how many extra seconds (300 to 1800, default 300) Chat, Cowork, and Code sessions wait for model output on a streaming response that is sending only keep-alive pings, for gateways that send keep-alives while the upstream model is silent. Gateway provider only. +* Added a Duplicates step to the import wizard when an imported Project has the same name as one you already have, with the option to merge the imported sessions into your Project and remove the duplicate; the Projects page offers the same merge. +* Added conversation titles to the OpenTelemetry export: a `desktop_session_title_set` event carries each Cowork and Code session's title plus the Claude Code session ID to join on, sent when `otlpDesktopLogLevel` is `info` or lower; the title text is included only when `otlpContentCapture` includes `userPrompts`. +* Added installing and updating plugins from admin-configured marketplaces on devices where Cowork isn't available, from the Code tab or the Cowork tab. +* Added local scheduled tasks to the Code tab, including the `/schedule` command and the Scheduled page, matching what Cowork already offered. +* Added the ability to attach files in SSH Code sessions. +* (breaking) Changed the Usage page cost estimate to require `inferenceModelPricingEnabled`; `inferenceModelPricingMultiplier` and `inferenceModelPricing` now refine the estimate only while it is on and no longer turn it on by themselves. +* Changed `HTTPS_PROXY`, `HTTP_PROXY`, and `NO_PROXY` set in the `env` block of Claude Code's managed settings (`managed-settings.json` or your organization's server-managed Claude Code settings) to apply to Chat, Cowork, and Code sessions even when the computer has a system proxy configured. +* Changed `isClaudeCodeForDesktopEnabled`: when it is `false`, the app no longer starts Code sessions even if asked directly, Preview no longer scans projects for a dev server, and the computer is no longer offered for Remote Control; a Code session requested anyway shows "Code sessions are turned off by your organization" instead of a retry prompt. +* Fixed Bedrock and Bedrock Mantle sessions being cut off by network idle timeouts during long thinking phases on Opus 4.7 and later models. +* Fixed Code tab sessions not prompting to re-authenticate when the deployment's credentials had expired; they now show the same sign-in prompt as Cowork. Also fixed Live Artifact `askClaude()` calls and the Code tab's "Detect dev server" failing on deployments that use SSO, credential helpers, Vertex, or Bedrock SSO. +* Fixed managed MCP connector sign-in staying permanently stuck when the identity provider no longer recognizes the OAuth client the app registered; the app now registers a new client automatically. +* Fixed MCP servers provided by plugins not connecting in Code and Cowork sessions when `managedMcpServers` is configured; in that case, with `isLocalDevMcpEnabled` set to `false`, plugins' remote MCP servers connect and their local (stdio) ones stay blocked. +* Fixed plugins distributed as a zip whose top level is a single component folder (for example `skills/` or `commands/`) installing with no skills, commands, or agents. +* Fixed the `allowedWorkspaceFolders` policy not always being applied to Code sessions over SSH. +* Fixed the Code tab home's usage stats reporting a favorite model, per-model breakdown, and activity from other Claude Code history on the same machine instead of this deployment's own sessions. - * No user-facing changes. - +**v1.40609.1** - - **General** +**General** - * Fixed Find (Cmd+F) doing nothing the first time it was pressed after launch. - * Fixed right-to-left text in the composer scrambling around embedded left-to-right words; code blocks stay left-to-right. - * Fixed the Artifacts entry missing from the sidebar on Windows machines that can't run local Cowork; it now opens the Artifacts gallery. - * Fixed macOS asking for notification permission as soon as the app launched, instead of when the first notification is about to appear. - * Fixed the app crashing at launch, or on a system theme change, on some Linux installs (most often repackaged builds); it now falls back to a default tray icon. +* Updated the bundled Claude Code CLI to version 2.1.255. - **Code** +**Code** - * Added Rewind to cloud sessions (message menu, Esc Esc, or `/rewind`), and fixed rewound-away messages reappearing when a rewound cloud or Remote Control session was reopened. - * Fixed an interrupted Claude Code download (for example, after a crash or power loss mid-install) leaving Code sessions on that computer unable to start, most often on Windows. - * Fixed an unanswered permission or plan-approval prompt in a cloud session sometimes being treated as approved after the session's environment disconnected. - * Fixed cloud sessions marked as needing input sometimes opening without the question or approval prompt. - * Fixed Remote Control sessions sometimes never connecting when opened while idle, staying off your other devices after a stop or interruption until turned back on by hand, and looking idle instead of reporting that the host computer is offline. - * Fixed copy and paste problems: transcript text pasted into rich-text apps lost the spaces around inline code, bold, and italics and mangled code blocks, and Cmd+C after selecting text in the Plan view copied nothing. +* No user-facing changes. - **Cowork** +**Cowork** - * Fixed the earlier conversation being discarded when you chose Go back after a failed task resume, or edited a message right after the app restarted. - * Fixed memory saves failing when the Claude Code `managed-settings.json` policy sets `allowManagedPermissionRulesOnly`. - * Fixed Cowork on Windows failing on every launch with "VM service not running" after its background service had stopped; the service is now restarted automatically, and otherwise the error explains that restarting the computer restores it. - * Fixed Cowork sometimes pulling you back to the bottom of a task after you had scrolled up, for example when a sub-agent step finished. +* No user-facing changes. - **3P** - - * Added `otlpAuthMode` and `otlpHeadersHelper`, two ways to authenticate telemetry exports without static `otlpHeaders`: set `otlpAuthMode` to `inference-credential` to reuse the signed-in user's inference token, or point `otlpHeadersHelper` at an executable that prints the collector headers as JSON. - * Added an optional `inferenceGatewayOidc.resource` subfield that sends an RFC 8707 resource indicator on gateway sign-in and token refresh, for identity providers that audience-restrict access tokens. - * Changed `inferenceBedrockBaseUrl` and `inferenceVertexBaseUrl`: only affects users who entered the bootstrap server URL themselves (in Settings or a local config file). Those users are now asked once to allow a Bedrock or Vertex endpoint that server delivers before it takes effect, the same prompt `inferenceGatewayBaseUrl` already shows. Managed deployments (bootstrap URL set by device management, or `trustBootstrapDelivery: true`) see no change. - * Changed `claudeAiImport`: an imported session now asks the user to confirm once (Trust and resume) before Claude continues it for the first time; this also applies to sessions imported before this update. - * Fixed a single malformed `allowedPluginMarketplaces` (beta) entry disabling every configured marketplace; the entry is now skipped and reported. - * Fixed sending messages failing when a bootstrap server turned Cowork off (`coworkTabEnabled` set to `false`); the home screen now opens directly into Chat. - * Fixed OpenTelemetry exports being rejected when the configured gateway also serves as the telemetry collector endpoint. - - - - **General** - - * Added the standard macOS full-screen keyboard shortcut, with an Enter Full Screen and Exit Full Screen item in the View menu. - * Fixed a startup error on some Linux systems, most often repackaged or containerized installs, that left the app without a tray icon and recurred on every system theme change. - * Fixed commands in the built-in terminal failing with error -1743 when controlling other apps on macOS, instead of showing the Automation permission prompt. - * Fixed sign-in on macOS repeatedly failing with "Failed to login, it may have been cancelled"; Claude now opens the sign-in page in your default browser when the system sign-in sheet is unavailable. - * Fixed some Windows installs (MSIX packages and enterprise-managed roaming profiles) failing to save chat history, settings, and scheduled tasks, and Cowork failing to start with "Download failed" after an app update. - * Fixed the app's memory use growing without bound during long-running sessions. - - **Code** - - * Removed the ability for scheduled-task runs and other unattended sessions to start dev servers in the Browser preview; other sessions now approve each distinct dev server command once rather than on every start. - * Fixed app settings, and the app's record of session worktrees, being discarded when those files had been re-saved with a UTF-8 byte-order mark by an external editor. - * Fixed forked sessions starting from the original base branch instead of the parent session's current branch. - * Fixed importing Claude Code CLI sessions changing the order of existing sessions in `claude --resume`. - * Fixed sessions failing to resume, reporting their conversation history as missing, after Claude had moved the session into a worktree. - * Fixed file uploads through Claude in Chrome from a Code session failing with "Invalid arguments for tool file\_upload". - - **Cowork** - - * Fixed a follow-up message sent while Claude was still writing a reply sometimes being dropped, with the reply cut off. - - **3P** - - * Added history import. When `claudeAiImport.enabled` is `true`, users can bring a Claude.ai data export, Cowork, Code, and Chat sessions from other Claude installs on the same computer or from an app data folder they choose, and terminal Claude Code sessions into the app from Settings > Import. `claudeAiImport.bannerBehavior` controls an optional banner on new tasks that offers it: `off` (default), `detect` (only when earlier sessions are found on the computer), or `show` (everyone, until dismissed or imported). - * Added `modelPrefer1mContext`. When `true`, a user who has not yet chosen a model starts on the 1M-context variant of the default model whenever the deployment marks or reports that model as 1M-capable, including auto-discovered models. Saved selections are never changed. Defaults to `false`. - * Added the gateway address, `inferenceGatewayBaseUrl`, to the one-time bootstrap consent prompt. When a bootstrap server delivers it and the bootstrap URL was not set through device management, each user is asked once at launch to allow the address, and again if it later changes; the app does not connect to the gateway until they choose Allow. Existing installs prompt the first time they start this version. Set `trustBootstrapDelivery` to `true` in your device-management profile or local configuration file to accept it for everyone in advance. - * Changed the Code tab to be hidden entirely, rather than shown greyed out, when an administrator has disabled Code. - * Fixed a session opened in a new window on Windows having no title bar, window controls, or drag area. - * Fixed stored sign-ins being lost when the system keychain was temporarily locked. - * Fixed the Chat tab ignoring `toolSearchEnabled`, which sent every connector's tool definitions with each request and could exceed the context window when many connectors were configured; Chat now loads them on demand when the key is `true`, as Cowork and Code do. - * Fixed the credential-expired notice and the session error banners in Cowork and Code offering no way to sign in again when the credential comes from a helper script (`inferenceCredentialHelper`); they now show "Sign in again", which re-runs the helper. - * Fixed the model picker reverting to the standard-context variant in new sessions, after relaunch, and when switching between Chat and Cowork once the 1M-context variant had been chosen. - - - - **General** - - * Added a "Start a new project" option to the "Add to project" menu, which opens the create-project dialog. - * Added Esc as a way to end voice mode in the chat composer. - * Added the ability to add suggested skills in local sessions, and plugins from your personal marketplaces, directly from their suggestion cards. - * Fixed Claude Desktop on Linux entering a crash-and-relaunch loop that consumed heavy processor time when automatic session restore ran into persistent graphics failures. - * Fixed starting a chat inside a project showing a blank screen until the response finished, and leaving the chat without its project name or title. - * Fixed the scheduled-task prompt editor not being announced to screen readers as a labeled multiline text box. +**3P** - **Code** +* No user-facing changes. - * Added session-window restore: Claude Code session windows that were open when you quit now reopen the next time you launch the app. - * Changed permission-mode picks so they apply to the folder where you made them instead of becoming a machine-wide default. - * Removed the "Always allow" option when approving dev server starts in the Browser preview; each new server start now asks, and a server that has crashed asks again instead of restarting silently. - * Fixed "Try again" on session-error cards sometimes doing nothing, and a failed send's retry card and prompt text now survive an app relaunch. - * Fixed leftover session workspaces building up on disk until new sessions could fail with a disk-space error. - * Fixed repository pickers in project settings and scheduled tasks timing out or omitting repositories in large organizations; they now load quickly, can search every repository, and can load more results. +**v1.40609.0** - **Cowork** +**General** - * Added a ⋮ menu to scheduled tasks in the sidebar, including Mark as unread for the latest run. - * Added a confirmation before a link in a live artifact opens in your browser, with a per-site "Don't ask again" option. +* Fixed Claude sometimes being unable to read or search a page in the built-in browser just after opening it or while it was still loading, and browser screenshots and interactions timing out or stalling on Windows and Linux while the browser pane was closed or another page was selected. +* Fixed the app failing to launch when one of its settings files had become corrupted, and settings files sometimes being left corrupt after an unexpected shutdown or power loss on Windows. +* Fixed the Share dialog: "Keep private" now takes effect immediately, and sharing a chat while offline shows an error instead of waiting indefinitely. +* Fixed typing with an IME (Japanese, Chinese, or Korean): confirming or cancelling a conversion with Enter, Escape, or a digit key no longer sends half-composed text, discards typed drafts, denies tool approvals, rejects plans, or stops Claude's response in Code sessions, and no longer commits or discards text in the browser pane's address field. +* Fixed scheduled tasks that run on this computer occasionally being marked as skipped without running; a run the app fails to pick up is now retried a few minutes later. - **3P** +**Code** - * Added `updateViaUpdatesHost`. Set it to `true` to read the update feed from `releases.claude.com`, a host that serves only the desktop update check and carries no model API, so networks that block `api.anthropic.com` can still receive updates. Installer downloads continue to come from `downloads.claude.ai`. Defaults to `false`. - * Added an access mode to each `allowedWorkspaceFolders` entry. Set `mode` to `ro` to let Claude read and search a folder without changing it: in Cowork, writes are blocked and Claude is directed to put modified copies in the session outputs folder. In the Code tab this covers Claude's file tools only; Bash in the Code tab and SSH sessions do not yet enforce it. Entries without `mode` stay read-write, so existing configurations are unchanged. - * Added optional `:port` suffixes to `coworkEgressAllowedHosts` entries, for example `internal.corp.com:8443` or `*.corp.com:8443`, restricting that entry to the named port. This applies to the sandbox's web fetch now, and to shell egress once the updated virtual machine image ships; on the Code tab, a port-scoped entry is treated as its bare host (any port). Entries without a port keep allowing any port, and an invalid entry is dropped on its own with a warning in the logs. - * Added settings that decide where users sign in for inference to the one-time bootstrap consent prompt: the Azure AI Foundry Entra tenant and client, Bedrock IAM Identity Center, the Vertex OAuth client and workforce identity, and gateway OIDC. Set `trustBootstrapDelivery` to `true` in your device-management profile to accept these for everyone in advance. - * Added the merged Chat and Cowork home as the default. The "New" button starts a chat or a task from one composer, and the sidebar shows Home, which lists chats and tasks together, alongside Code. - * Changed the `trustBootstrapLocalExec` key name to `trustBootstrapDelivery`, reflecting that it now covers sign-in targets as well as helper scripts and connectors. The previous name continues to work in existing profiles. - * Fixed chats started inside a Project not picking up the Project's Instructions and Context links, including reading the files linked there. - * Fixed Code sessions on a custom gateway endpoint ending with an idle-timeout error while the gateway was still sending keep-alive responses. - * Fixed Code tab sessions on gateway and direct API key deployments still sending nonessential traffic to `api.anthropic.com` after an administrator turned off nonessential telemetry. - * Fixed model selections provided by your deployment being overridden by an out-of-date Claude Code `managed-settings.json` left on the device. - * Fixed the published `bootstrap-config-v2.schema.json` describing flat keys instead of the nested shape the app's own configuration export uses. - - - - **General** - - * Added a chevron next to the composer's microphone button that switches between dictation and voice mode and keeps your choice; clicking the microphone now starts dictation right away. - * Fixed `⌘K` (or `Ctrl+K` on Windows and Linux) search missing results from tool output and archived sessions. - * Fixed a crash on macOS during passkey and Touch ID prompts when the system language is German, Spanish, French, Hindi, Indonesian, Italian, Japanese, or Korean. - * Fixed automatic and menu-triggered update restarts interrupting an in-progress Claude Code or Cowork task. - * Fixed the app being left with no usable window: a failure during startup now shows an error dialog and records the details to a file, and a window the system shut down under low memory reloads instead of staying blank. - - **Code** - - * Added automatic resume for sessions interrupted when your computer goes to sleep. A banner with a manual Continue button appears only when resuming isn't safe, and you can continue the session in the cloud instead. - * Added capture and annotation for the page the Browser pane is showing, including external sites, so you can mark up what you see and attach the image to chat. - * Fixed a crash while using the in-app browser on pages with heavy console or network activity. - * Fixed messages sent while Claude was working disappearing from a session after it was reloaded from disk. - * Fixed sessions sometimes becoming permanently unopenable, showing "No messages yet" while their conversation history was still on disk. - * Fixed starting a session and swapping repositories stalling in organizations with very large repository lists: the pickers now load repositories page by page, find the rest as you type, say when more are available by searching, and report a failed search instead of showing empty results. - - **Cowork** - - * Added pasted and attached images to the session's uploads folder, so Claude can open and edit the actual file. - * Fixed "Allow for this task" not appearing for connector tools when your organization has turned off persistent "Always allow". - * Fixed documents showing an internal file id instead of their title, including in export filenames and approval prompts. - * Fixed long-running workspace shell commands, such as large database queries, being cut off too early. - * Fixed scheduled task problems: a cron expression using `7` for Sunday never ran, stalled runs kept running in the background until the app was restarted, and "Allow for all scheduled runs" appeared on prompts where the choice could not be saved, so the task asked again on every run. - - **3P** - - * Added Projects for organizing Chat conversations: create a project, start a chat inside it, or move existing chats in. Projects stays available even when your administrator has turned the Cowork tab off. - * Added `inferenceGatewayOidcAuthFlow` and `inferenceVertexWorkforceAuthFlow`, which choose whether identity-provider sign-in for gateway and Vertex workforce-identity credentials runs in the system browser (the default) or through the operating system's Microsoft account broker on Windows and macOS, so sign-in can satisfy Conditional Access policies that require a managed device. - * Added `managedMcpServers[].oauth.authFlow`, which lets a managed connector sign in through the operating system's Microsoft Entra account broker on Windows and macOS, so Conditional Access policies that require a managed device no longer block it. Devices without a broker keep using browser sign-in. - * Added `skillCreationEnabled`, which controls whether users can create and upload their own skills. It defaults to on; setting it to `false` hides the creation and upload surfaces and turns off Claude's skill-creation tools. It appears in the Setup window under workspace restrictions. - * Added `trustBootstrapLocalExec`. Each user is now asked once for consent when the bootstrap configuration includes settings that run local commands, such as credential helpers and local connectors. Set this key to `true` to accept them for everyone in advance. It defaults to `false` and is accepted only from MDM or a local configuration file. - * Added a built-in GitHub connector to `managedMcpServers`: set `server` to `github` and supply your own GitHub OAuth app client ID with the device flow enabled. The new `host`, `toolsets`, and `readOnly` subfields point the connector at a GitHub Enterprise Server instance, choose which toolsets load, and offer read tools only. The connector is also configurable from the Setup window. - * Added support for mounting Windows mapped network drives into the Cowork sandbox, so shell commands and document processing can work with files on network drives, and fixed adding a mapped network-drive folder mid-session being rejected with a message to use the folder picker. - * (breaking) Changed the nested v2 bootstrap response: `deploymentDisplayName` and `deploymentDisplaySubtitle` now sit under `appearance`, and `endUserAttribution` and `userContentRendererUrl` under `workspace`. The flat MDM key names are unchanged. - * Changed `managedMcpServers` and `microsoftAuthBroker` to be supported on standard deployments as well, so an administrator can enable the built-in Microsoft 365 connector by adding it to `managedMcpServers` through MDM. It stays off unless configured. - * Changed where several keys can be delivered from: `claudeAiImport`, `deploymentDisplayName`, and `deploymentDisplaySubtitle` now accept values from MDM and a local configuration file as well as a bootstrap server, and `disableDeepLinkRegistration`, `microsoftAuthBroker`, `userContentRendererUrl`, `inferenceFoundryTenantId`, `inferenceFoundryClientId`, `inferenceCredentialHelper` (with its TTL, timeout, and silent-refresh keys), `inferenceBedrockProfile`, `inferenceBedrockAwsDir`, `inferenceBedrockAwsCliPath`, and `inferenceVertexCredentialsFile` can now be delivered by a bootstrap server. The keys that name a local executable go through the consent prompt above. - * Deprecated `organizationPluginsUrl` and removed it from the configuration reference. The key is still honored, but organization plugins are better configured with `allowedPluginMarketplaces`. - * Updated `enduserAttribution` to the corrected spelling `endUserAttribution`. The previous spelling is still accepted and now records a configuration warning. - * Fixed connector sign-in recovery: connectors no longer ask you to sign in again after a slow startup when the credentials are still valid, and the GitHub connector shows its Reconnect card on the next tool call after its token is revoked on github.com instead of staying stuck. - * Fixed tasks failing with "Couldn't start this task" for the rest of the session when the app launched while the network or the sign-in credential was unavailable. - * Fixed the app losing administrator-enabled features, such as the Chat tab, for the rest of the session when the organization's configuration server was unreachable at launch. It now retries in the background and recovers. - * Fixed the home composer and sidebar still offering Cowork when an administrator has turned the Cowork tab off; Cowork is now hidden instead of greyed out, while Chat and Projects remain available. - +* Added side-task suggestions in cloud sessions: Claude can suggest follow-up tasks that you start on your machine, in the cloud, or in the same session with one click. +* Added `/resume`: search the Claude Code sessions started from your terminal on this computer and continue one in the app on the same transcript. +* Added a view of the session's MCP servers: type `/mcp` in a local session to see the servers from `.mcp.json`, `~/.claude.json`, plugins, and your claude.ai connectors, with live status and Connect, Reconnect, and Re-authenticate actions. +* Fixed "Import Claude Code CLI sessions" (Help > Troubleshooting): it again finds Code sessions whose sidebar entries were lost after a reinstall or repair, no longer rewrites a session file that a running Claude Code process is still using, and saves a backup of the original transcript when importing removes its thinking blocks. +* Fixed inline plan comments being silently lost when left after a plan was approved; the Plan pane now accepts comments in Plan mode or while Claude is asking you to approve the plan, and says when commenting opens otherwise. +* Fixed SSH sessions losing messages that were waiting to be sent when the remote host became unreachable or the app was quit, updated, or restarted; they are now kept and delivered automatically at the next connection, and Claude Code is restarted on the host when needed. +* Improved SSH session reconnects: high-latency links no longer drop their own connection, a network change mid-stream is noticed within seconds, an unreachable host is no longer re-dialed every few seconds in the background, and the session shows the specific connection error with a Try again button instead of a generic message or an indefinite "Reconnecting…". - - **General** - - * No user-facing changes. - - **Code** - - * No user-facing changes. +**Cowork** - **Cowork** +* Fixed files dropped onto the composer together with a folder being discarded; they now attach alongside the folder. +* Fixed shell commands that use plugin or skill file paths failing with "No such file or directory". +* Fixed the app running out of memory after many scheduled task runs. +* Fixed the Cowork readiness check appearing to hang for minutes when a network-redirected profile folder is unreachable, and reporting a computer as unsupported because of an encrypted leftover folder from an uninstalled Claude version. +* Fixed organization plugins failing to install or update on some Windows Store installs. +* Fixed a message that starts with a typed, pasted, or app-filled slash command for one of your enabled skills failing with "Unknown skill" in an existing task; it now sends. - * No user-facing changes. +**3P** - **3P** +* Added `relaunchEnforcementHours` (served configuration only): when a served configuration change needs a restart, it sets how many hours (0 to 336) users may keep running on the previous configuration; at the deadline Claude shows a restart dialog and restarts on its own after 2 minutes of inactivity. Unset means 1 hour. +* Added `sshHostAllowlist` (beta): admins can turn on SSH remote sessions in the Code tab by listing the hosts users may connect to (`["*"]` allows any host). Unset keeps SSH sessions off unless a Claude Code managed-settings file on the device already allows hosts; an explicit `[]` keeps them off even then when the configuration is admin-delivered (device management or trusted remote delivery), while on a self-configured install the device allowlist still applies. Works with a gateway, Claude API key, or Foundry, and with Bedrock and Vertex when they use token-based credentials; file-based credential kinds are refused at session start with a message naming the kind. +* Added an estimated-cost view to the Usage page chart: when the organization has turned on cost estimates, the chart can switch between tokens and estimated cost per day (per week at 90 days), and days with turns that have no estimate show as gaps rather than \$0. +* Added an in-app warning when the organization's configuration uses a deprecated field: each user sees a dismissible notice from September 10, 2026 and once more in the 24 hours before the field stops being accepted, with a Details dialog naming each field, its replacement, the cut-off date and what changes then, plus a Copy report button that puts a plain-text summary for administrators on the clipboard. The new `disableConfigDeprecationWarnings` key hides the first showing; the final 24-hour reminder still appears. The warning also appears on standard deployments whose device-management profile uses one of these fields. +* Added Anthropic's Cowork and Claude Code plugin marketplaces as prefilled entries in the Setup window's `allowedPluginMarketplaces` Add menu. +* (breaking) Deprecated a set of older managed-configuration spellings, each accepted until October 7, 2026, 12:00 PM Pacific Time, with an in-app warning from September 10, 2026: `inferenceGatewayHeaders` (use `inferenceCustomHeaders`), `trustBootstrapLocalExec` (use `trustBootstrapDelivery`), `enduserAttribution` (use `endUserAttribution`), `inferenceGatewayAuthScheme` values `sso` (use `inferenceCredentialKind: "interactive"`) and `auto` (remove the key; `bearer` is the default), `isDxtEnabled` (use `isDesktopExtensionEnabled`) and `isDxtSignatureRequired` (use `isDesktopExtensionSignatureRequired`), header maps written as strings or lists in `inferenceCustomHeaders`, `otlpHeaders`, `otlpResourceAttributes` and `bootstrapHeaders` (use a JSON object), the `orgPluginSettings` record form (use the array form), the `ask-session` tool-permission value in `builtinToolPolicy`, `managedMcpServers[].toolPolicy` and `orgPluginSettings[].tools[].permission` (use `ask`), and in `managedMcpServers` entries the `scopes` list (use `scope`), `transport: "builtin"` (remove it), `authorityHost` (use `azureCloud: "us-gov-high"` for a GCC High tenant), `source` (remove it), `oauth` written as a number or string (use `true` or an `oauth` object), `oauth.scopes` or a list-valued `oauth.scope` (use `oauth.scope` as one space-separated string), and entries other than a built-in server with no `transport` (add `transport: "http"`, `"sse"` or `"stdio"`; a built-in Microsoft 365 or GitHub entry takes no `transport`). After the cut-off a renamed key's old name falls back to its fail-closed value or default, and an invalid `managedMcpServers` or `orgPluginSettings` entry makes that connector or tool policy unavailable until it is rewritten. +* Changed `inferenceVertexProjectId` and `inferenceVertexWorkforceUserProject`: a value delivered by a bootstrap URL the user configured themselves (in Settings or a local configuration file) now asks that user to approve it before it takes effect, and declining quits the app. Because the project ID is required, each such Vertex install prompts once after updating. Values delivered through device management, or by a bootstrap URL that device management set or that `trustBootstrapDelivery: true` covers, are unchanged and never prompt. Both keys must now match the Google Cloud project format. +* Changed `toolSearchEnabled` on gateway deployments to enable tool search alone; other experimental Claude Code betas stay suppressed. +* Changed how a managed-configuration value the app cannot read is handled: it now engages the restriction it belongs to instead of being ignored. Restriction keys such as `disabledBuiltinTools`, `builtinToolPolicy`, `coworkTabEnabled` and `disableBundledSkills` fall back to their restrictive value, an unreadable `managedMcpServers` keeps Code sessions restricted to managed MCP servers, an unreadable `isDesktopExtensionEnabled` or `isDesktopExtensionSignatureRequired` disables extensions or requires signed extensions, and a tool-permission value the app does not recognize is applied as the most restrictive setting (`ask` for a built-in tool, `blocked` for a plugin-delivered tool) and reported as a configuration error. `allowedPluginMarketplaces`, the built-in GitHub MCP preset and `otlpTracesEnabled` are no longer marked Beta. +* Changed the Setup window's configuration exports and the published bootstrap JSON schema to write `orgPluginSettings` in its array form; the app still accepts the older record form until October 7, 2026. Desktop versions before 1.15200.0 read only the record form and do not enforce plugin tool locks given the array, so update the fleet past 1.15200.0 before deploying an exported configuration that uses it. +* Changed the Vertex AI credential kind for Google sign-in to `inferenceCredentialKind: "interactive"`, matching other providers; `oauth` keeps working until October 7, 2026 (12:00 PM Pacific Time). If you deliver configuration as nested JSON (a self-hosted bootstrap server or a Setup JSON export), keep `oauth` until the whole fleet is on this release or later, because an older desktop drops the Google client ID from a nested `interactive` credential and Vertex sign-in stops working; flat MDM keys, .mobileconfig and .reg files are unaffected. Until October 7, 2026 a Vertex configuration that sets `interactive` together with `inferenceVertexWorkforceAudience` and no `inferenceVertexOAuthClientId` is still read as Workforce Identity; after that it means Google sign-in, so set `workforce` explicitly if that is the intent. +* Improved Cowork reliability when the workspace is slow to start or has been idle, and made switching back to a recently opened Code tab session faster. +* Fixed importing sessions from a previous Claude Desktop install: imported Cowork sessions keep their Project and its `~/Claude/Projects/` folder instead of getting a new empty one, an interrupted import now appears in Import history and its sessions are no longer imported twice on the next run, and the import wizard no longer re-creates a Project you had deleted (an imported Project that duplicates an existing name gets a "(1)" suffix). +* Fixed the Code tab's plugin directory and Customize > Plugins not listing plugins from marketplaces configured with `allowedPluginMarketplaces`; an admin-configured marketplace is now managed as the organization's in both tabs. - * Fixed sessions started while configured MCP servers were still connecting having no connector tools until a new conversation was started. - * Fixed the Microsoft 365 connector not appearing after first-time sign-in until the app was restarted. - +**v1.37937.3** - - **General** +**General** - * No user-facing changes. +* No user-facing changes. - **Code** +**Code** - * No user-facing changes. +* No user-facing changes. - **Cowork** +**Cowork** - * Fixed plugin hooks silently doing nothing on Windows. +* No user-facing changes. - **3P** +**3P** - * Added the `mcpPersistentAlwaysAllowEnabled` managed configuration key, letting admins disable the persistent "Always allow" approvals for MCP tools while keeping session-scoped approvals available. - * Added the five-level effort selector for Claude Opus 5 in the model picker. Extended thinking is always on for Opus 5. - +* No user-facing changes. - - **General** - - * Added an option to keep custom plugin marketplaces up to date automatically, and fixed a marketplace refresh reporting success before the sync ran and re-adding an existing marketplace not refreshing its contents. - * Improved keyboard and screen reader support across the app: settings tabs and share-visibility choices respond to arrow keys, dialogs announce meaningful titles, decorative graphics no longer clutter screen reader output, and the find bar, search fields, and pane resize handles show a visible focus outline and announce their size. - * Fixed failed uploads being reported as corrupted or unsupported files, and retries showing a "Server is busy" message for unrelated errors. - * Fixed safety-block notices suggesting you switch models when no alternative model was available for that topic. - * Fixed the app failing to launch when its settings file or logs folder was corrupted, and saved sessions disappearing after a relaunch when one session's stored data was invalid. - * Fixed the app window resizing abruptly and losing its saved size and position when signing in or out; it now animates smoothly in place. +**v1.37937.2** - **Code** +**General** - * Added iOS Simulator support: Claude Code can build your iOS app, launch the simulator, and verify the result without leaving the session. - * Added an iOS Simulator button to the session titlebar when the agent launches an app in the simulator, so the pane is one click to reopen. - * Added Pause Project, which pauses a project's coordinator and new session spawning from settings and shows a Resume banner above the composer. - * Added screenshot annotation in the composer: click a staged image, open the pencil, and draw with pen, shapes, text, and colors before sending. - * Improved how large sessions open: the newest messages paint first while older history loads in the background. - * Fixed Code sessions affecting the wrong files: background worktree cleanup could switch or reset the main repository checkout when a worktree folder was only partially removed, and new sessions could copy uncommitted files from the original folder. - * Fixed session list problems: finished sessions still showing as running, deleted sessions reappearing as empty "Session not found on disk" entries after an update, archived sessions still appearing active on claude.ai and other devices, and sessions started from claude.ai missing Rename, Archive, and Delete in the sidebar menu. - * Fixed the app freezing when Claude Code updated its configuration file during concurrent use, and web pages in the Browser pane freezing the app with alert and confirm dialogs. +* No user-facing changes. - **Cowork** +**Code** - * Added /usage and /cost to Cowork tasks: an inline card shows your plan limits and the session's usage without sending anything to the model. - * Improved background computer use so it types faster and no longer leaves menus stuck open on screen. - * Updated folder access prompts for cloud Cowork tasks to note that files Claude uses leave your device and are processed on Anthropic's servers. - * Fixed changes to Instructions for Claude sometimes not applying to new sessions, and edits reverting to an earlier version while a session was running, including after an app restart. - * Fixed Cowork workspace problems: the Windows workspace failing to start when its virtual disk files were compressed, a backgrounded shell command leaving a session stuck reporting "already running", and bash commands failing when several subtasks ran them at once. - * Fixed the message input staying stuck in a sending state when a folder access dialog went unanswered. +* No user-facing changes. - **3P** +**Cowork** - * Added `deploymentDisplayName` and `deploymentDisplaySubtitle` to customize the deployment name and an optional subtitle shown in the account menu and sidebar. - * Added `enduserAttribution`, which shows the signed-in user's identity in the sidebar, account menu, and Code tab, and includes it as the OpenTelemetry `enduser.id` attribute on telemetry sent to your configured collector. Administrators can turn it off, and an existing static `enduser.id` is kept. - * Added `oauth.authorizationUrl` and `oauth.tokenUrl` to managed MCP servers for identity providers that do not serve a discovery document, and `oauth.additionalRedirectReferrerHosts` to allow sign-in callbacks from hosts other than the authorization URL's. - * Added `userContentRendererUrl`, which sets the HTTPS origin that renders artifact and file previews; leave it unset to use the default Anthropic-hosted renderer. - * Added a `broker` option to `inferenceFoundryAuthFlow` that signs in to Azure AI Foundry through the operating system's native account broker on Windows or Company Portal on macOS, so sign-in can satisfy Conditional Access policies that require a compliant device. Windows and macOS only. - * Added a Usage page in Settings for custom deployments, showing token usage across Chat, Cowork, and Code. - * Added Microsoft 365 Teams tools (send to a chat, channel, or thread; create a chat; @mention people) and formatted-body support for Outlook reply drafts. - * Added the 1M context option in the model picker for gateway-discovered models that report the capability in `/v1/models`, without requiring an `inferenceModels` entry. - * Changed telemetry on bootstrap-server deployments to default to disabled until the server explicitly enables it (previously only FedRAMP hosts), and added the ability to disable error and usage reporting through bootstrap configuration. - * Fixed managed MCP connectors: a server that requires authentication now opens a sign-in window even when its configuration does not explicitly enable OAuth, and an `oauth` entry with sign-in fields but a missing or empty `clientId` is now rejected at load with a clear error instead of silently attempting automatic registration. - * Fixed managed MCP tool policies that block all tools by default with per-tool exceptions denying the excepted tools in Claude Code sessions. - * Fixed sessions, skills, and plugins intermittently disappearing after sign-in or configuration changes. - * Fixed the Claude.ai sign-in option being hidden on deployments configured with a bootstrap URL; it is now hidden only when the administrator explicitly disables the deployment mode chooser. - * Fixed the bundled Microsoft 365 connector showing only an opaque tool error when its sign-in expired; it now shows an inline Reconnect card. - * Fixed the token-cap setup fields so the maximum tokens per window and the token cap window hours are required together; setting only one previously produced a cap that enforced nothing. - +* No user-facing changes. - - **General** +**3P** - * Fixed sessions on Windows failing on every turn with a "Socket is closed" error when traffic passed through a corporate proxy that inspects encrypted connections, by updating the bundled Claude Code CLI to 2.1.215. Interrupted responses now retry on a fresh connection instead of ending the turn. +* No user-facing changes. - **Code** +**v1.37937.1** - * No user-facing changes. +**General** - **Cowork** +* Updated the bundled Claude Code CLI to version 2.1.246. - * No user-facing changes. +**Code** - **3P** +* Fixed remote MCP servers never recovering after a dropped connection; they now reconnect automatically or report as failed. +* Fixed signing in to some MCP servers, such as Linear, failing with an "Invalid redirect URI" error. - * No user-facing changes. - +**Cowork** - - **General** +* No user-facing changes. - * Improved responsiveness while artifacts generate, so typing and scrolling stay smooth during generation. - * Improved the "Add to project" menu to show only projects you can move into, with your own projects listed first. - * Fixed rare freezes when a transcript contained very large whitespace-padded messages or tool output. - * Fixed tool errors blaming an organization policy when a site was actually blocked by your own site permissions or settings. +**3P** - **Code** +* Added support for the `inferenceModelPricing` rates and the `inferenceModelPricingMultiplier` discount in the Usage page's cost estimate; in 1.37937.0 the estimate always used Anthropic list price. - * Added controls for project owners to remove members from a shared project and copy an invite link from the members dialog. - * Added per-row actions to queued messages (Edit in composer, Send now, and Remove), with right-click support. - * Fixed a new session sometimes taking over the directory another session was still working in. - * Fixed Code sessions hanging at startup when skill syncing was slow, and tools on your shell `PATH` staying undetected when shell environment detection timed out at startup. - * Fixed freezes, a stuck "loading earlier messages" spinner, and blank rendering when scrolling back through very large session transcripts or when a running task's output grew very large. - * Fixed the New session button, `⌘N` (or `Ctrl+N` on Windows and Linux), and the project header "+" discarding an unsent composer draft. +**v1.37937.0** - **Cowork** +**General** - * Improved writing drafts to consistently appear as preview cards before being staged in a connected app such as Slack. - * Fixed documents Claude creates not reliably opening in the editor. - * Fixed files edited by Claude sometimes reading back stale or truncated content on Windows. - * Fixed the chat window freezing and not updating while Claude uses your computer. - * Fixed the document editor sometimes attributing your own typing to Claude while autosaving. - * Fixed working documents disappearing from the Documents panel after a temporary disk error. +* Added support for legacy Word .doc files, which now open like .docx, and Excel .xlsx and .xls spreadsheets, which now attach as text where they used to be refused. +* Removed sharing of chat artifacts for members of organizations whose admin has turned Artifacts off; links already shared keep working. +* Fixed chat refusing new messages after the weekly Cowork limit was used up. +* Fixed scheduled tasks set to run on both a day of the month and a weekday (for example "the 1st and every Monday") only running when the two coincided; they now run on either day, as their schedule description says. +* Fixed several chat reliability issues: queued messages could disappear or send on their own, a send retried during a service overload could add repeated copies of a message, reopening a chat before the reply arrived could show a false "message wasn't sent" error, and a single failed response could show two error messages. +* Fixed the app sometimes signing you out right after an automatic update. - **3P** - - * Added `disableBrowserExternalNavigation`, which admins can set to `true` in Claude Code's `managed-settings.json` to keep the Code tab's Browser pane limited to localhost for both users and Claude. Local dev servers and file previews are unaffected. - * Added `otlpTracesEnabled` (beta), which also exports OpenTelemetry traces from Cowork tasks and Code sessions to your configured collector. - * Updated the allowed workspace folders policy to also apply to Code sessions on SSH hosts, evaluated against the folders on the remote host. - * Fixed enforcement of the managed Auto mode opt-out. - * Fixed plugins being treated as required by your organization when their marketplace name merely resolved under a required marketplace entry; only the exact entry a name resolves to now applies, so affected plugins can be uninstalled again. - * Fixed saving a skill created in chat failing; skills now save to the app's local skill storage. - * Fixed tools without a configured `toolPolicy` offering only Allow once and Deny; they now show the full set of approval options (Allow for this task, Allow for all tasks) and the prompt-injection warning. Explicit `ask` policies still prompt on every call. - - - - **General** - - * Fixed installed extensions failing to load and showing an endless loading state. - - **Code** - - * No user-facing changes. - - **Cowork** - - * Fixed a status indicator that stayed on after a conversation finished. - - **3P** - - * No user-facing changes. - - - - **General** - - * Changed the web-fetch permission prompt to default to "Allow all for this website" when that grant is available; "Allow once" stays the default otherwise, and pressing Enter always answers "Allow once". - * Updated the embedded Claude Code engine to the latest version. - * Fixed a crash on launch when Claude's worktree bookkeeping file couldn't be read or written. - * Fixed brief app freezes when opening terminals or switching sessions on Windows, and when the @ mention menu refreshed the list of open windows. - * Fixed scheduled tasks and routines: editing a routine no longer deletes its one-time schedule, "Run now" no longer silently does nothing until the app restarts, and you can now rename routines and scheduled tasks from the edit dialog. - * Fixed session exports that could produce an archive without the transcript; the transcript is now always included as `transcript.jsonl`, and the export shows a clear error when it can't be included. - * Fixed the "Sign in again" prompt not appearing when a background session was blocked for session freshness, including while the desktop was idle. - - **Code** +**Code** - * Added a browser-style address bar to the preview pane, and a clear message, with the option to open the site in your browser, when a page can't be displayed instead of showing a blank page. - * Added the ability to pin artifacts from the gallery or the artifact viewer, and to filter the gallery to your pinned artifacts. - * Improved SSH session connection handling: messages no longer hang after the computer wakes from sleep, sessions recover from repeated disconnects, and a reconnecting indicator appears while the connection is restored. - * Fixed `permissions.defaultMode` in Claude Code settings being ignored for new sessions after a per-folder permission mode had been chosen. - * Fixed branch switches on large repositories failing after an uncommitted-changes stash timed out, and restored your stashed changes when a switch fails. - * Fixed several session reliability problems: a session could get stuck showing "running" and queue new messages forever, a just-started session could disappear from the sidebar or show "session could not be found" during startup, and streamed responses could break or show a literal "undefined". +* Improved SSH session reliability: fixed connections failing when the configured identity file is a public key (common with 1Password setups), messages sent while the host reconnects are delivered once it is back, a Claude Code upload to the host now rides out a brief network pause, idle sessions no longer show a false "Lost connection" card, reconnecting can ask for a password or one-time code when needed, and a reconnect no longer reports lost output unless it truly could not be recovered. +* Fixed all saved SSH connections disappearing when one stored connection entry was invalid. +* Fixed background cleanup of old session worktrees on Windows sometimes also deleting the contents of folders that NTFS junctions inside the worktree pointed to, such as the main checkout's `node_modules`. +* Fixed removing a claude.ai import run resetting uncommitted work in a session you had started from that import; the session's files are now kept on disk. +* Fixed sessions failing to start for organizations using the `disableSideloadFlags` setting in Claude Code's `managed-settings.json`; sessions now start without the desktop's bundled skills and plugins instead. +* Fixed very high memory use, and a blank or unresponsive window, when opening or reconnecting sessions with very large transcripts or many subagents. - **Cowork** +**Cowork** - * Added a live word count and a copy button to each document bar above the composer. - * Changed Markdown files Claude delivers to open in the document editor instead of a plain-text preview, without flashing the old viewer first. - * Changed the composer to keep the standard Send button while a response is running: it appears when you type, and sending mid-response queues your message instead of showing a separate Queue button. - * Fixed Claude's mid-task replies not appearing in the conversation; they now show under a collapsed "Working notes" row. - * Fixed screenshots from connected browsers and computer use not being saved to the task folder. - * Fixed text typed in one conversation appearing in other conversations' composers when switching between sessions. - - **3P** - - * Added `envHelper` and `envHelperTtlSec` subfields to `managedMcpServers`, letting a managed stdio server load environment variables from an admin-provided helper executable. - * Added an All tab to organization plugins that browses and searches every configured marketplace at once, and labeled plugins with their source marketplace so they can be filtered when more than one is configured. - * Added support for the `eu` and `us` multi-region Vertex AI endpoints, required for the newest models with EU and US data residency. - * Added the `disableFeatureDiscovery` key, which hides unprompted feature announcements such as the post-update "What's new" nudge and new-feature tips. Release notes remain available from the menu. - * Fixed remote MCP connectors whose `headersHelper` mints short-lived credentials failing one token-lifetime after connecting: the helper now re-runs before expiry and the refreshed headers are applied to the live connection. The new `headersHelperRefreshBufferSec` subfield of `managedMcpServers` tunes how far ahead of expiry the refresh runs. - * Added the `prefer1m` subfield to `inferenceModels`, which makes a model's 1M-context variant the default picker selection when paired with `supports1m`. - * Added the `toolSearchEnabled` key. When enabled, Code and Cowork sessions load MCP tool schemas on demand instead of placing every schema in context up front, which helps when many configured tools would otherwise crowd the context window. Requires an inference endpoint that forwards `anthropic-beta` request headers. - * Bootstrap-delivered model configuration is now forwarded to Claude Code sessions in third-party deployments. - * Changed the projects environment picker to respect an organization policy that hides Anthropic-managed environments. - * Removed the Beta designation from the `chatTabEnabled` and `chatAdvancedFileAnalysisEnabled` keys; the Chat tab and advanced file analysis are now generally available. Availability is unchanged, and both remain opt-in. - * Fixed a bug affecting third-party plugins installed from external sources (GitHub, URL, or npm). - - - - **General** - - * Fixed an issue where permission prompts and in-session questions could silently stop appearing after an input-handling error — if Claude asked a question or requested permission and the prompt never showed up, this release fixes that. (Updates the bundled Claude Code CLI to 2.1.209.) - - - - **General** +* Added dictation in the Claude in Chrome side panel; allow the microphone once in the extension's settings. +* Fixed "upload failed" errors when staging Google Drive and other cloud-synced files that are not downloaded on your Mac yet; they now download automatically, and clearer messages explain when the sync app needs to be started. +* Fixed a Rename, Delete, or Move dialog left open in a task's header staying open when you switched to another task and acting on the task you switched to; it now closes on switch. +* Fixed only the last file staying attached when several files opened with Claude each needed confirmation. +* Fixed restored Cowork tabs showing a "Try again" error when the app restarted before sessions finished loading, such as right after an update. +* Fixed the tasks and files panel staying open as an empty pane after a restart. - * Fixed `claude://` deep links being ignored when opening one launched the app from a closed state, including on Windows and Linux. - * Fixed device attestation failing on Windows when sending several messages at once. - * Fixed garbled tool summaries in the transcript: descriptions that don't start with a recognized verb (for example "Final verification") now appear as written instead of being mis-conjugated. - * Fixed skill proposal and skill-file cards failing to save with "Couldn't save this skill" when a skill of that name already exists; they now offer "Update skill" and a replace confirmation. - * Fixed the app forgetting your last-used tab (for example Code) after an update or re-login. - * Fixed the menu bar usage menu showing an empty progress bar for extra usage when the spend cap is unlimited. - - **Code** +**3P** - * Added a Troubleshooting option to import Claude Code CLI sessions found on this computer into the session list. - * Fixed a typed `` turn rendering as a spoofable "Message from `{server}`" card instead of as your own text. - * Fixed cross-session messages going missing in the transcript: messages from another session no longer disappear when they arrive in the same turn as other content or when their envelope can't be fully parsed. - * Fixed file links to files outside the working directory, including reports Claude writes to its scratchpad, showing "This file is outside the working directory" instead of opening. - * Fixed the context window indicator and token count staying at the pre-compaction value after compacting a conversation. - - **Cowork** - - * Fixed admin-configured plugin marketplace sync failing behind corporate proxies on macOS. - * Fixed plugin connectors sometimes missing from the Connectors list and tool permission prompts when they were slow to start. - * Fixed skills saved in a remote session sometimes still returning "Unknown command" right after saving. - * Fixed the "Run this task while your Mac sleeps" setting turning itself off after an app update. - - **3P** - - * Added `*` wildcard matching for managed MCP `toolPolicy` keys; partial wildcard keys such as `"outlook_*"` in existing configurations now take effect, including any `allow` wildcards, which pre-approve the tools they match. Exact keys and the standalone `"*"` key behave as before. - * Added support for exporting Cowork task telemetry over `otlpProtocol: grpc` on macOS and Linux when no network proxy is configured. - * Fixed Azure AI Foundry sessions failing with an authentication error on every message after interactive Microsoft Entra ID sign-in. - * Fixed gateway-SSO bootstrap dropping cross-origin `managedMcpServers` entries, so admin-provisioned third-party connectors reach the app under device-code sign-in. - * Fixed MCP connectors failing to connect through gateways that optionally request a TLS client certificate, even though the connection test passed. - * Fixed sign-in timing out with identity providers (such as PingFederate) that redirect via a rendered page after authentication. - * Fixed third-party settings ignoring managed configuration: the Claude Code pane now follows `isClaudeCodeForDesktopEnabled`, the Developer tab hides when `isLocalDevMcpEnabled` is off, and the Capabilities and Voice settings no longer appear. - +* Added `mcpToolTimeoutSec`, which sets how long an MCP tool call may run before it times out. Defaults to 180 seconds. +* Added `organizationInstructions`: organization-wide instructions appended to Claude's system prompt in Chat, Cowork, and Code sessions (up to 3,000 characters); settable via device management, a local configuration file, or the bootstrap response. They are guidance the model follows, not an enforced control. +* Added `skipWebFetchPreflight`. When enabled, Code sessions no longer contact api.anthropic.com before fetching a web page, which fixes page fetches failing on networks that block that host. Off by default. +* Added `userPluginMarketplacesEnabled` and `userPluginUploadsEnabled`, which control whether members can add their own plugin marketplaces and upload their own plugins; when off, the add options are hidden and adds are refused. Unset keys change nothing. +* Added Code tab features already available in the standard app: the Files panel with Show in Files, emoji autocomplete and inline prompt suggestions in the composer, interactive MCP app widgets in the conversation, and letting Claude read output from the integrated terminal panel. +* Added cost estimates to the Usage page: `inferenceModelPricingEnabled` shows an estimated cost alongside token counts, priced at Anthropic list price; `inferenceModelPricing` supplies per-model rates and `inferenceModelPricingMultiplier` scales every estimate (a number between 0 and 1). The two rate keys take effect from 1.37937.1; in 1.37937.0 estimates use list price. Off by default. +* Added suggestions for plugins and skills from your organization's own library in chat. +* Added support for plugin marketplace credential helpers that return a username or `authtype=Bearer`, so marketplaces hosted on Bitbucket Data Center or behind GitLab deploy tokens can authenticate. +* Added the `disableDesktopLocalSessions` setting to Claude Code's `managed-settings.json`, which turns off Code sessions that run on the device itself so the Code tab offers only remote environments such as SSH; the environment menu shows Local greyed out with a "Disabled by your organization" explanation. +* Changed `allowedPluginMarketplaces` (beta): a `url` marketplace hosted on the bootstrap server's own origin can now use `credentialKind: "inferenceCredential"` and is fetched with the same sign-in the app already uses for its bootstrap configuration. +* Changed `builtinToolPolicy` to accept argument-scoped Claude Code permission rules such as `Bash(curl *)` in addition to bare tool names; `WebSearch` and `WebFetch` entries stay bare tool names, and entries that are not usable rules are rejected with a configuration error. +* Changed gateway device-code sign-in to show the signed-in account's email, when the gateway returns one, instead of the computer's login name. +* Changed the Code tab's file pane and git panel to follow the administrator's `allowedWorkspaceFolders` setting. +* Fixed Bedrock sessions behind a proxy that strips the response content type silently re-running every request without streaming, which billed each request twice. +* Fixed Cowork scheduled tasks running on the 200K-context model when the 1M-context row or "Default model" was selected in the task form; the form now labels the 1M row. +* Fixed the built-in Microsoft 365 connector publishing an invalid schema for updating a calendar event's end time. +* Fixed the Microsoft 365 local connector on Windows failing for users with more than one Microsoft work account on the PC. The Reconnect card now opens the Windows account picker and the chosen account is remembered; users of this connector will be asked to reconnect once after this update. +* Fixed the model picker showing a duplicate, mislabeled 1M-context row when `inferenceModels` lists a model both with and without the `[1m]` suffix. - - **General** +**v1.34493.1** - * Added automatic updates on Linux through the Anthropic apt repository, so new versions arrive with `apt upgrade` (and unattended upgrades where enabled). - * Added the ability to archive or delete the current chat, project, task, or coding session directly from the command palette (`⌘K`, or `Ctrl+K` on Windows and Linux). - * Fixed bank payment-verification (3DS) pages not loading during checkout. - * Fixed MCP connectors in artifacts being silently dropped; approving a connector now reliably grants its tools to the artifact, and a previously stuck approval heals itself the next time you approve. - * Fixed repeated crashes on Linux caused by unstable graphics acceleration; the app now turns acceleration off automatically and tells you. - * Fixed the app becoming unresponsive when a session folder is on a slow or disconnected network drive. +**General** - **Code** +* No user-facing changes. - * Added descriptive branch names for local Code sessions, derived from your first message, in place of the random adjective-noun names. - * Changed the default transcript and composer width to a narrower, more readable column; a width you already chose in Settings → Appearance is preserved. - * Fixed "Open in Finder", "Open in editor", and "Attach to chat" doing nothing, or using the wrong path, for files in the diff panel when the session folder differs from the repo folder. - * Fixed freezes and stalls: while restoring a large number of sessions at startup, while builds or file syncs churned files inside a watched folder, and while the diff panel refreshed during a response. - * Fixed newly trusted folders sometimes failing to start a session with a "workspace is not trusted" error. - * Fixed security-key and phone sign-ins not completing in preview tabs. +**Code** - **Cowork** +* No user-facing changes. - * Added a copyright-access notice in the session timeline when Claude in Chrome first operates on certain news publisher sites. - * Added keyboard access to the preview pane: Tab reaches a "Preview page" control, Enter moves focus into the loaded page, and `F6` (or `Ctrl+F6`) moves it back out. - * Fixed Cowork offering terminal access, and showing an impossible fix suggestion, on devices whose operating system cannot provide the virtualization its isolated environment needs (such as ChromeOS), where every command immediately failed. +**Cowork** - **3P** +* No user-facing changes. - * Added `inferenceFoundryAuthFlow` to choose how interactive Microsoft Entra ID sign-in for Azure AI Foundry runs: `device-code` (the default, which shows a code to enter at `microsoft.com/devicelogin`) or `browser`, which opens the system browser for an authorization-code (PKCE) sign-in. - * Added `microsoftAuthBroker`; set it to `disabled` to force browser-based Microsoft 365 sign-in instead of the native Company Portal or Windows account broker. - * Added a "session expires soon" warning for Bedrock SSO and AWS-profile sign-in so you can re-authenticate before hitting an error. - * Added a `startupTimeoutSec` option for managed local (stdio) MCP servers and raised the default startup timeout from 10 to 120 seconds, fixing connection failures when a server command downloads packages on first run (for example `uvx` or `npx`). - * Added support for background agents: long-running tasks now stay signed in after your identity provider's access token expires. - * Added the ability for administrators to grant Microsoft 365 write scopes (send mail; edit calendars and files; send Teams chat; mailbox settings) through managed configuration. - * (breaking) Changed the default for Desktop Extensions (`.dxt` and `.mcpb`): they no longer load unless you set `isDesktopExtensionEnabled` to `true` in managed configuration. Previously they loaded by default and only the install UI was blocked. - * Updated `allowedPluginMarketplaces` (beta) so it can be delivered per-user through the bootstrap server; a response that omits the key leaves MDM-provisioned marketplaces in place. - * Fixed a one-time loss of sign-ins on some managed Windows machines after app data moved to a new location. - * Fixed AWS credentials not reaching the Code tab's terminal for Amazon Bedrock configurations that use IAM Identity Center. - * Fixed bundled Microsoft 365 and other MCP connectors failing to connect on networks with corporate TLS inspection (custom root CA). - * Fixed connection tests reporting false failures: the test now runs MCP helper scripts and checks managed configurations exactly as saved, and uses the same Azure AI Foundry endpoint that sessions use. - * Fixed managed MCP connectors failing with a credential-storage error when the server allows anonymous access. - * Fixed the Microsoft 365 connector failing to sign in on Macs enrolled with Microsoft Company Portal. - * Fixed the setup form incorrectly showing "Blocked address" for internal MCP or OAuth servers on IPv6 enterprise networks. - +**3P** - - **General** +* Fixed prompt caching not being applied in sessions that use an inference gateway or custom endpoint. - * Updated the embedded Claude Code engine to the latest version. +**v1.34493.0** - **Code** +**General** - * No user-facing changes. +* Fixed a startup freeze on Macs that keep applications in iCloud Drive with Optimize Mac Storage turned on. +* Fixed scheduled task problems: "every N days/months" schedules ran on the wrong days (existing tasks move to the correct days on their next run), re-enabling a task or editing its schedule immediately started a catch-up run for a time slot that passed while it was off, and manually run tasks sometimes did not record when they last ran. +* Fixed the app crashing when signing in with Touch ID on macOS; Touch ID passkey sign-in is temporarily unavailable. +* Fixed the app quitting on macOS when the disk was full or when stopping dictation. - **Cowork** +**Code** - * No user-facing changes. +* Fixed archiving an SSH session discarding uncommitted or unmerged work in its remote worktree; the worktree is now kept, and unarchiving recreates it if it is missing so the session can pick up where it left off. +* Fixed session history no longer updating or appearing lost on macOS for sessions in folders whose names contain accented, Korean, or Japanese characters. +* Fixed sessions you hadn't opened for 30 days or more losing their conversation history even though the app was in regular use. +* Fixed SSH connections on slow or unstable networks failing on the first attempt and needing a manual retry. +* Fixed SSH sessions losing a task that was still running when the app reconnected after an app update. +* Fixed the side chat answering once and then failing with an authentication error for the rest of a long session. - **3P** +**Cowork** - * No user-facing changes. - +* Fixed conversations failing to open when a message contained a very long run of bracketed text, a very long line starting with an unclosed `[`, or a very long run of `>` characters. +* Fixed message ratings and "Send feedback" links sometimes appearing when your organization has product feedback turned off. +* Fixed sessions failing to start on managed Macs where the app's temporary directory is not writable. - - **General** +**3P** - * Fixed `apt update` failing on Linux after uninstalling a Claude that was installed from the apt repository. - * Fixed being asked to sign in repeatedly after a session expired while you were using the app; your in-progress message draft now returns when you sign back in within 10 minutes, and signing out still clears it. - * Fixed being unable to disable, delete, or uninstall plugins from GitHub-connected marketplaces, or to remove those marketplaces. - * Fixed pressing Enter not sending your message when an @mention had no matching results. - * Fixed remote SSH sessions getting stuck in a reconnect loop on very large messages, being lost when the computer woke from sleep mid-reconnect, and occasionally sending the same input twice after reconnecting. - * Fixed setup on Windows getting stuck retrying a download when the download folder was locked or inaccessible. - * Fixed the file-open spinner on Linux staying up after the download completed. +* Changed gateway device-code sign-in to refresh silently when the gateway also issues a refresh token, instead of prompting you to sign in again each time the access token expires. +* Fixed an ended gateway device-code sign-in going unnoticed while the app was idle; the app now notices at its next periodic configuration check or shortly after the computer wakes from sleep and asks you to sign in again, and the Setup window says "Session expired" instead of "Denied". +* Fixed Cowork file previews showing "Preview unavailable" until the app was restarted once a preview pane had been closed for a few minutes. - **Code** +**v1.32885.1** - * Added a "Choose folder" option to recover a session whose working folder is missing: the conversation forks into the folder you pick and the stuck session is archived. - * Added a "Switch organization" option on the "session not found" page so you can reopen a session link under the right organization. - * Added drag-to-reorder for queued messages, and Steer now works for messages that include images. - * Improved the Code tab's live preview: it now reports honest connection and loading status (including when a page arrives but never finishes loading, or a server overloads itself with requests), adds browser-style Back, Forward, and Reload/Stop controls, and lets you close other preview tabs. - * Fixed background tasks and workflows continuing to show as running after they finished, the session restarted, or the session was stopped. - * Fixed Remote Control sessions spinning forever with no error after you sent a message when the hosting computer was no longer connected. - * Fixed the sidebar project + button opening an empty prompt (or pointing at github.com) for GitHub Enterprise repositories. +**General** - **Cowork** +* Added message queueing during Research: a message sent while a Research run is in progress is queued and sent when the report is ready. +* Fixed 1Password credential requests failing when Claude in Chrome is signed in from more than one browser profile. +* Fixed a crash on Windows when installing an update while a background update check was still running, and fixed update installs repeatedly failing after a newer update replaced one already staged. +* Fixed a message sent immediately after stopping a reply sometimes being put back into the input box instead of sending. +* Fixed reloading or reopening a temporary chat rebuilding the page a moment after it loads, which could discard text typed early. +* Fixed the computer-use permission prompts in Cowork and Claude Code sessions accepting a keyboard shortcut aimed at the message box or another surface, and added a brief delay so a send keystroke that lands just as the prompt appears cannot approve it. - * Added click-to-zoom and drag-to-pan to the fullscreen image viewer. - * Fixed Computer Use teach mode where the Next and Exit buttons sometimes stopped responding until you switched apps and back, and cleared up teach-mode visuals so the screen-edge glow no longer flickers and the status indicator no longer sticks after you exit a guide. - * Fixed dictation dropping back to the text box when started from the mic button in existing sessions. - * Fixed document tools in cloud sessions acting on your local files instead of the session's files. +**Code** - **3P** +* Fixed automatic continuation after a rate limit firing into the imported-session confirmation prompt or a stale sign-in state, and it now waits out the server's limit reset and sends a clearer continuation message. +* Fixed inline bash commands being silently captured as input by a previous command still waiting for a response, such as an interactive login; a stuck command is now noted in the transcript and cleared before the next command runs. +* Fixed messages sent from one session to another sometimes being silently dropped, which left the sending session showing a thinking state for many minutes. +* Fixed slow session starts for people with MCP servers configured in `~/.claude.json`. +* Fixed the Code tab wrongly asking you to install Git on Macs that have Apple's Command Line Tools but not Xcode. +* Fixed worktree sessions failing with a "path contains control characters" error when a `WorktreeCreate` hook prints status output before the path. - * Added a usage breakdown by model family, source attribution, and usage tips to the `/usage` card. - * Removed automatic addition of Anthropic's default plugin marketplace on third-party deployments, and removed the `disableDefaultPlugins` managed configuration key (which had no effect there). Provision marketplaces via `allowedPluginMarketplaces` (beta). - +**Cowork** - - **General** +* Fixed an occasional "Something went wrong" error when a session's question card from Claude changed to a new set of questions. +* Fixed Claude sometimes reporting a file as saved when it had been written to a temporary location you could not open. +* Fixed Cowork failing to start on Intel Macs. - * No user-facing changes. +**3P** - **Code** +* Added `bootstrapHeaders` and `bootstrapHeadersHelper` for authenticating the bootstrap configuration fetch with a service-account credential, the supported replacement for embedding `user:password@` in `bootstrapUrl` (rejected since 1.32352.0): `bootstrapHeaders` is a set of static headers sent on every fetch, and `bootstrapHeadersHelper` is the absolute path of an executable that prints headers as JSON, for a rotating token; helper output is merged over the static headers. When either is set and no `bootstrapOidc` provider is configured, the headers count as sufficient authentication for the fetch and no per-user sign-in is required for it; a per-user sign-in bearer, when also present, still wins on `Authorization`. Header values are masked in diagnostics, and both keys are accepted only from device management or a local configuration file. +* Added the option to sign in to claude.ai directly from the import wizard to fetch your data export, with no manual zip download needed. +* Changed new Cowork sessions to store Claude Code transcripts under a short fixed folder name, now that the bundled Claude Code (2.1.234) supports it, further shortening file paths on Windows; existing sessions are unchanged. +* Changed organization plugin delivery: when the organization plugins endpoint is removed from your configuration, the plugins it had installed are removed from members' devices, as already happens for a removed plugin marketplace. +* Fixed admin-configured plugin marketplaces and organization plugins not re-syncing until the next periodic refresh after signing in or after a delayed configuration fetch applied. - * No user-facing changes. +**v1.32352.1** - **Cowork** +**General** - * No user-facing changes. +* Fixed a rare Windows startup failure where the first window could fail to initialize on a fresh install. - **3P** +**Code** - * Added Claude Fable 5 to the model picker for organizations with access. - +* No user-facing changes. - - **General** +**Cowork** - * Added Linux support: Claude Desktop is now available for Debian and Ubuntu on x64 and arm64, installable as a .deb package. - * Updated the plugin Directory to show admin-configured marketplaces under the Organization tab and refresh them automatically when the source repository updates. - * Fixed plugin and skill downloads stalling for several minutes on a dead connection before retrying; stalled downloads now retry sooner. - * Fixed prompt and tool-detail content missing from OpenTelemetry exports for standard deployments that have not set an explicit content-capture policy; third-party deployments are unchanged. - * Changed zoom in and out to use smaller steps for finer control. +* No user-facing changes. - **Code** +**3P** - * Added an integrated terminal pane and inline image previews in the transcript for SSH sessions. - * Added step-by-step progress and a Stop button while a session's worktree is being set up, so a long checkout on a large repository can be cancelled. - * Added a right-click menu in the Terminal pane with Copy, Paste, and Attach selection as context. - * Updated the transcript to mask API keys and tokens by default; click the eye icon to reveal them. - * Fixed folder access and cross-session requests being rejected after you approved them when permission mode was Auto or Bypass permissions. - * Fixed failed mid-turn message sends (for example, while offline) dropping your text instead of returning it to the input. - * Fixed new session worktrees branching from the currently checked-out branch instead of the repository's default branch, and archived sessions leaving their worktree folders on disk. +* No user-facing changes. - **Cowork** +**v1.32352.0** - * Fixed a crash when resuming sessions with malformed remote connector data on disk. - * Fixed the workspace download restarting from zero after a network interruption; it now resumes from where it left off and retries automatically. - * Fixed folder and file names containing a dollar sign being misread, which broke file references. - * Fixed dictation immediately dropping back to the text input in existing sessions. - * Fixed an error caused by Claude trying to read a document creation skill that was not available. - * Fixed clicking a built-in workflow (such as `deep-research`) in the activity panel's Skills section showing an empty drawer instead of its name and source. +**General** - **3P** +* Fixed Windows updates sometimes leaving the app half installed, with later updates failing too. +* Fixed the app staying on "Couldn't connect to Claude" when a network proxy blocked its first connection; it now keeps retrying for a few minutes and again when you return to the window. +* Fixed the composer staying disabled after a usage-limit notice when your organization has extra usage turned off or not set up; sending works again once your admin turns it on. +* Fixed settings and connector links in chat doing nothing, or opening your web browser, when clicked in the app; they now open the app's own settings. +* Fixed text typed on the new chat page sometimes disappearing when turning on incognito. +* Fixed the chat showing an error screen instead of the conversation when Claude created or linked a file whose name contains a percent sign. - * Added the `allowedPluginMarketplaces` managed configuration key. Configured git repositories appear under the Directory's Organization tab. - * Added an optional `omitOfflineAccess` subfield to the `inferenceVertexWorkforceOidc` configuration. Enable it when an identity provider rejects the `offline_access` scope; the app then prompts for sign-in each time the identity provider token expires instead of refreshing silently. - * Added managed configuration support on Linux: administrators can provision settings in a root-owned `/etc/claude-desktop/managed-settings.json`, validated against the same schema as the macOS and Windows sources. - * Fixed claude.ai sign-in never completing on Windows when an enterprise inference provider is configured. - * Fixed subagents failing with an invalid model error on third-party inference providers. - * Fixed `inferenceModels[].supports1m` being ignored, restoring the 1M-context option in the model picker for Bedrock, Vertex, Foundry, and gateway providers. - * Fixed the Microsoft 365 connector showing an unexpected admin-consent prompt after updating on tenants with restrictive consent policies when the connector's Access setting was blank. Also updated the bundled connector with tools to read the signed-in user's profile and draft reply-all emails. - * Improved expired sign-in handling for third-party inference providers and connectors: a sign-in prompt now appears whichever credential type expired, connector authentication errors are shown in Settings and inline in chat with a Reconnect action, and background Code sessions stay signed in across a credential refresh. - * Fixed several connector reliability issues: connectors silently stopping mid-session after an OAuth refresh failed instead of prompting to reconnect, connectors configured with both OAuth sign-in and custom headers failing to connect, and admin-configured connectors not appearing in a session until they were signed in. - +**Code** - - **General** +* Changed auto-continue after the 5-hour usage limit to be on by default: sessions left open resume when the limit resets. Uncheck "Auto-continue when limits reset" in the limit banner to turn it off for your account. +* Fixed sessions sometimes hanging after resume, either showing "The session stopped responding" after the first message or never starting when a file system or MCP server stalled. +* Fixed undo (Cmd+Z, or Ctrl+Z on Windows and Linux) in the message composer sometimes failing with an error and then no longer working. +* Fixed a brand-new cloud session losing its first message when you navigated away within a few seconds of sending it. +* Fixed sessions started right after the app opened sometimes running in a more permissive mode than your saved permission mode. +* Fixed Remote Control sessions staying stuck at "connecting" after you completed the sign-in or device-check prompt, and file links not opening when the session was viewed from another computer. - * Updated the embedded Claude Code engine to the latest version. +**Cowork** - **Code** +* Removed the "Allow all browser actions" option from Claude in Chrome permission cards; allow each website instead. The switch in Settings is unchanged. +* Fixed the workspace startup error suggesting a restart or reinstall when the computer was low on disk space; it now asks you to free up space and retry. +* Fixed a tool call hanging for a full minute when its local MCP server crashed mid-call; it now fails right away. +* Fixed computer use on macOS refusing every click after you had taken a screenshot or while a screen recording was running. +* Fixed the approval mode still showing "Skip all approvals" when your organization's policy had blocked it; switching back to "Manually approve" now asks again before Claude fetches web pages it visited while approvals were off. +* Fixed the activity panel button doing nothing while a file was open beside the chat; it now closes the file and shows the panel. - * No user-facing changes. +**3P** - **Cowork** +* **Breaking:** Managed-config URL settings now reject values that embed credentials (`https://user:password@host…`). Configurations that relied on this fail to load until the credentials are removed; use `bootstrapHeaders` / `bootstrapHeadersHelper` (available from 1.32885.1) to send authentication instead. +* Added `claudeAiImport.exportEnabled`. With it and `claudeAiImport.enabled` both `true`, users can export this computer's chats, Cowork tasks, and Code sessions from Settings > Import & export as a zip that another install can import. Off by default. +* Added a `url` source for `allowedPluginMarketplaces` (beta): a hosted `marketplace.json` that delivers plugins as zip archives over HTTPS, with no git on the device. Set `manifestSha256` to pin the exact manifest; it is required for automatically installed plugins. +* Added `inferenceCredential` as a `credentialKind` for `allowedPluginMarketplaces` (beta): a `url` marketplace hosted on your inference gateway is fetched with the same credential the app already uses for inference. +* Changed `coworkEgressAllowedHosts`: a `:port` suffix now also applies to shell commands and package installs in Cowork sessions, which previously could not reach a port-scoped host at all. +* Changed settings from a locally configured (not device-managed) bootstrap URL that need user approval to apply all or nothing: nothing takes effect until the user chooses Allow; Quit closes the app and asks again next launch. +* Changed a served configuration with an invalid connection value to report that field by name and keep the organization's other settings in force; a non-Anthropic model entry is now skipped with a warning instead of invalidating the whole configuration. +* Changed admin-configured plugin marketplaces (`allowedPluginMarketplaces`, beta), including automatically installed and required plugins, to apply to Code sessions as well as Cowork. +* Changed new Cowork sessions to use much shorter folder names on disk so file paths are less likely to exceed Windows path-length limits; existing sessions keep their folders, and tooling that matches the `local_` prefix should also match the new names. +* Fixed Settings > Import & export saying import isn't enabled on deployments that provision the sign-in import without setting `claudeAiImport.enabled`; that key now governs only file and earlier-session import, the import prompt, and session export. +* Fixed the Setup window accepting a mis-typed inference region, Azure AI Foundry resource name, blank Vertex AI project ID, or non-Anthropic model ID that was only rejected later on the device; these are now flagged before saving. +* Fixed imported project instructions arriving as a loose file instead of the project's editable Instructions; they are now shown for review on the project page and apply once you accept them. - * No user-facing changes. +**v1.30096.5** - **3P** +**General** - * No user-facing changes. - +* No user-facing changes. - - **General** +**Code** - * No user-facing changes. +* No user-facing changes. - **Code** +**Cowork** - * No user-facing changes. +* No user-facing changes. - **Cowork** +**3P** - * No user-facing changes. +* No user-facing changes. - **3P** +**v1.30096.1** - * Fixed locally-configured stdio MCP servers being refused in third-party deployments that don't use MDM. - * Fixed third-party MCP connectors disconnecting on every app restart when the OAuth provider returns a non-standard refresh response. - * Fixed Microsoft 365 brokered sign-in failing with "No reply address provided" on managed Macs. - +**General** - - **General** +* Fixed Find (Cmd+F) doing nothing the first time it was pressed after launch. +* Fixed right-to-left text in the composer scrambling around embedded left-to-right words; code blocks stay left-to-right. +* Fixed the Artifacts entry missing from the sidebar on Windows machines that can't run local Cowork; it now opens the Artifacts gallery. +* Fixed macOS asking for notification permission as soon as the app launched, instead of when the first notification is about to appear. +* Fixed the app crashing at launch, or on a system theme change, on some Linux installs (most often repackaged builds); it now falls back to a default tray icon. - * Fixed a crash on launch caused by an unusually large saved session. - * Fixed the conversation jumping and the Progress panel flashing when opening a completed task. - * Improved keyboard navigation: a message's action buttons are now a single Tab stop, with arrow keys to move between them. +**Code** - **Code** +* Added Rewind to cloud sessions (message menu, Esc Esc, or `/rewind`), and fixed rewound-away messages reappearing when a rewound cloud or Remote Control session was reopened. +* Fixed an interrupted Claude Code download (for example, after a crash or power loss mid-install) leaving Code sessions on that computer unable to start, most often on Windows. +* Fixed an unanswered permission or plan-approval prompt in a cloud session sometimes being treated as approved after the session's environment disconnected. +* Fixed cloud sessions marked as needing input sometimes opening without the question or approval prompt. +* Fixed Remote Control sessions sometimes never connecting when opened while idle, staying off your other devices after a stop or interruption until turned back on by hand, and looking idle instead of reporting that the host computer is offline. +* Fixed copy and paste problems: transcript text pasted into rich-text apps lost the spaces around inline code, bold, and italics and mangled code blocks, and Cmd+C after selecting text in the Plan view copied nothing. - * Fixed high background CPU usage when several Code sessions were open in the same large repository. - * Fixed people without a Claude Code seat being sent to the marketing site from `/code`; they now see an in-app organization switcher. - * Added support for custom cron expressions when scheduling local routines. - * Added "Open in VS Code", "Open in Cursor", and similar actions to the file panel, file tree, plan panel, titlebar, and sidebar in SSH sessions. - * Fixed attachment cards for files that exist only inside a session doing nothing when clicked; they now open in the File pane, lightbox, Preview pane, or Files browser. - * Added a "Load more" button to the All sessions list for people with many sessions. +**Cowork** - **Cowork** +* Fixed the earlier conversation being discarded when you chose Go back after a failed task resume, or edited a message right after the app restarted. +* Fixed memory saves failing when the Claude Code `managed-settings.json` policy sets `allowManagedPermissionRulesOnly`. +* Fixed Cowork on Windows failing on every launch with "VM service not running" after its background service had stopped; the service is now restarted automatically, and otherwise the error explains that restarting the computer restores it. +* Fixed Cowork sometimes pulling you back to the bottom of a task after you had scrolled up, for example when a sub-agent step finished. - * Fixed workspace setup repeatedly failing with the same checksum error after a corrupted download, until the cache was cleared. - * Fixed Cowork sessions losing their project after restarting the app. - * Added a one-time prompt before Claude runs a dynamic workflow, explaining what workflows do. - * Improved the time it takes to start a session. +**3P** - **3P** +* Added `otlpAuthMode` and `otlpHeadersHelper`, two ways to authenticate telemetry exports without static `otlpHeaders`: set `otlpAuthMode` to `inference-credential` to reuse the signed-in user's inference token, or point `otlpHeadersHelper` at an executable that prints the collector headers as JSON. +* Added an optional `inferenceGatewayOidc.resource` subfield that sends an RFC 8707 resource indicator on gateway sign-in and token refresh, for identity providers that audience-restrict access tokens. +* Changed `inferenceBedrockBaseUrl` and `inferenceVertexBaseUrl`: only affects users who entered the bootstrap server URL themselves (in Settings or a local config file). Those users are now asked once to allow a Bedrock or Vertex endpoint that server delivers before it takes effect, the same prompt `inferenceGatewayBaseUrl` already shows. Managed deployments (bootstrap URL set by device management, or `trustBootstrapDelivery: true`) see no change. +* Changed `claudeAiImport`: an imported session now asks the user to confirm once (Trust and resume) before Claude continues it for the first time; this also applies to sessions imported before this update. +* Fixed a single malformed `allowedPluginMarketplaces` (beta) entry disabling every configured marketplace; the entry is now skipped and reported. +* Fixed sending messages failing when a bootstrap server turned Cowork off (`coworkTabEnabled` set to `false`); the home screen now opens directly into Chat. +* Fixed OpenTelemetry exports being rejected when the configured gateway also serves as the telemetry collector endpoint. - * Added a managed `websearch` built-in tool so self-hosted deployments can search the web. Admins configure Brave, Tavily, Exa, or a custom endpoint in managed config, and it is available in both the Cowork and Code tabs. - * Added an `otlpContentCapture` managed setting that lets admins opt in to sending specific categories of unredacted content — user prompts, assistant responses, tool inputs, tool outputs, and raw API request/response bodies — to their OTLP collector. - * Updated the Microsoft 365 built-in connector's `scope` field to accept `MailboxSettings.Read`. - * Fixed managed connectors that lost their connection staying broken with failing tool calls; they now reconnect automatically on the next tool call, including from newly started conversations, and show a message if reconnecting fails. - * Fixed Microsoft 365 connector sign-in failing on Windows because of a broker error. - * Fixed a sign-in loop when your organization's gateway denies access; the app now shows "Access denied" and points you to your administrator. - * Fixed the selected model reverting after restarting the app and resuming a session. - * Added a `disableBundledSkills` managed config key that turns off Claude Code's bundled skills and workflows (such as `deep-research`) on that device. - +**v1.28929.0** - - **General** +**General** - * No user-facing changes. +* Added the standard macOS full-screen keyboard shortcut, with an Enter Full Screen and Exit Full Screen item in the View menu. +* Fixed a startup error on some Linux systems, most often repackaged or containerized installs, that left the app without a tray icon and recurred on every system theme change. +* Fixed commands in the built-in terminal failing with error -1743 when controlling other apps on macOS, instead of showing the Automation permission prompt. +* Fixed sign-in on macOS repeatedly failing with "Failed to login, it may have been cancelled"; Claude now opens the sign-in page in your default browser when the system sign-in sheet is unavailable. +* Fixed some Windows installs (MSIX packages and enterprise-managed roaming profiles) failing to save chat history, settings, and scheduled tasks, and Cowork failing to start with "Download failed" after an app update. +* Fixed the app's memory use growing without bound during long-running sessions. - **Code** +**Code** - * Added an inline card for multiple-choice questions from Claude, so you can pick an option and step through each question before your choices are sent as a single reply. - * Fixed the app crashing shortly after opening the Code tab when local session history files are very large. - * Fixed the integrated terminal eventually failing to open new shells after the app had been running for several days on macOS. - * Fixed forked sessions not carrying over pull requests from the original conversation, and pull request rows staying marked as closed after being reopened on GitHub. - * Fixed the @-mention dropdown, side-chat panel, and plan-comment popover rendering, resizing, and dismissing in the wrong window when a session is opened in its own window. - * Fixed an extra tab opening in the system browser when navigating with the Artifacts pane open. +* Removed the ability for scheduled-task runs and other unattended sessions to start dev servers in the Browser preview; other sessions now approve each distinct dev server command once rather than on every start. +* Fixed app settings, and the app's record of session worktrees, being discarded when those files had been re-saved with a UTF-8 byte-order mark by an external editor. +* Fixed forked sessions starting from the original base branch instead of the parent session's current branch. +* Fixed importing Claude Code CLI sessions changing the order of existing sessions in `claude --resume`. +* Fixed sessions failing to resume, reporting their conversation history as missing, after Claude had moved the session into a worktree. +* Fixed file uploads through Claude in Chrome from a Code session failing with "Invalid arguments for tool file\_upload". + +**Cowork** - **Cowork** +* Fixed a follow-up message sent while Claude was still writing a reply sometimes being dropped, with the reply cut off. - * Added the ability to delete Cowork sessions from the sidebar, recents, and Spaces views. +**3P** - **3P** +* Added history import. When `claudeAiImport.enabled` is `true`, users can bring a Claude.ai data export, Cowork, Code, and Chat sessions from other Claude installs on the same computer or from an app data folder they choose, and terminal Claude Code sessions into the app from Settings > Import. `claudeAiImport.bannerBehavior` controls an optional banner on new tasks that offers it: `off` (default), `detect` (only when earlier sessions are found on the computer), or `show` (everyone, until dismissed or imported). +* Added `modelPrefer1mContext`. When `true`, a user who has not yet chosen a model starts on the 1M-context variant of the default model whenever the deployment marks or reports that model as 1M-capable, including auto-discovered models. Saved selections are never changed. Defaults to `false`. +* Added the gateway address, `inferenceGatewayBaseUrl`, to the one-time bootstrap consent prompt. When a bootstrap server delivers it and the bootstrap URL was not set through device management, each user is asked once at launch to allow the address, and again if it later changes; the app does not connect to the gateway until they choose Allow. Existing installs prompt the first time they start this version. Set `trustBootstrapDelivery` to `true` in your device-management profile or local configuration file to accept it for everyone in advance. +* Changed the Code tab to be hidden entirely, rather than shown greyed out, when an administrator has disabled Code. +* Fixed a session opened in a new window on Windows having no title bar, window controls, or drag area. +* Fixed stored sign-ins being lost when the system keychain was temporarily locked. +* Fixed the Chat tab ignoring `toolSearchEnabled`, which sent every connector's tool definitions with each request and could exceed the context window when many connectors were configured; Chat now loads them on demand when the key is `true`, as Cowork and Code do. +* Fixed the credential-expired notice and the session error banners in Cowork and Code offering no way to sign in again when the credential comes from a helper script (`inferenceCredentialHelper`); they now show "Sign in again", which re-runs the helper. +* Fixed the model picker reverting to the standard-context variant in new sessions, after relaunch, and when switching between Chat and Cowork once the 1M-context variant had been chosen. - * Published the v2 bootstrap-response JSON schema (nested format). The v1 flat schema remains supported. - * Removed support for installing connector extensions from local `.mcpb` and `.dxt` files. - * Fixed the Setup panel being locked when only the auto-update policy was deployed via MDM. - * Fixed connectors configured by your organization not appearing until restart after first sign-in. - * Fixed the model picker dropping to "Default model" mid-session when a gateway's model-list response was temporarily degraded. - +**v1.26832.0** - - **General** +**General** - * Fixed the app prompting you to sign in again every day when your claude.ai session was more than a day old. - * Fixed Claude Design links in chat navigating the app in place instead of opening Claude Design. - * Fixed the app showing a blank window when a network proxy redirects the connection to Claude. +* Added a "Start a new project" option to the "Add to project" menu, which opens the create-project dialog. +* Added Esc as a way to end voice mode in the chat composer. +* Added the ability to add suggested skills in local sessions, and plugins from your personal marketplaces, directly from their suggestion cards. +* Fixed Claude Desktop on Linux entering a crash-and-relaunch loop that consumed heavy processor time when automatic session restore ran into persistent graphics failures. +* Fixed starting a chat inside a project showing a blank screen until the response finished, and leaving the chat without its project name or title. +* Fixed the scheduled-task prompt editor not being announced to screen readers as a labeled multiline text box. - **Code** +**Code** - * Changed routines to count against your regular usage limits instead of a separate daily included-run limit, and removed the included-runs indicator. - * Updated the model picker to show restricted models as non-selectable with an explanatory badge, and to reflect your organization's allowed default model. - * Fixed HTML and SVG file previews showing black text on a dark background in dark mode. - * Fixed menus and popovers opening behind the preview panel. +* Added session-window restore: Claude Code session windows that were open when you quit now reopen the next time you launch the app. +* Changed permission-mode picks so they apply to the folder where you made them instead of becoming a machine-wide default. +* Removed the "Always allow" option when approving dev server starts in the Browser preview; each new server start now asks, and a server that has crashed asks again instead of restarting silently. +* Fixed "Try again" on session-error cards sometimes doing nothing, and a failed send's retry card and prompt text now survive an app relaunch. +* Fixed leftover session workspaces building up on disk until new sessions could fail with a disk-space error. +* Fixed repository pickers in project settings and scheduled tasks timing out or omitting repositories in large organizations; they now load quickly, can search every repository, and can load more results. - **Cowork** +**Cowork** - * Fixed Claude in Chrome file uploads failing for files in the session's shared folders and outputs. - * Fixed scheduled tasks leaving earlier processes running after each scheduled run. - * Fixed Windows file paths showing garbled characters in the folder access approval card, and reduced unnecessary folder access denials when allowed workspace folders are configured. +* Added a ⋮ menu to scheduled tasks in the sidebar, including Mark as unread for the latest run. +* Added a confirmation before a link in a live artifact opens in your browser, with a per-site "Don't ask again" option. - **3P** +**3P** - * (breaking) Changed the `chatCodeExecutionEnabled` managed configuration key to `chatAdvancedFileAnalysisEnabled`. It still lets Claude analyze attached files such as spreadsheets and presentations by running code in a sandbox scoped to the session's attachments, and remains off by default. Update any managed configuration that sets the old key. - * Deprecated the `betaFeaturesEnabled` managed configuration key; use the per-feature keys `chatTabEnabled` and `chatAdvancedFileAnalysisEnabled` instead. The Beta label in the Setup window is now informational only, and the Beta label has been removed from the built-in Microsoft 365 connector presets. - * Added the `inferenceSessionLifetimeSec` managed configuration key. Set it to your identity provider's session lifetime to show users a re-authenticate reminder before their sign-in expires. - * Added `~` and environment variable expansion (such as `%APPDATA%` and `%OneDriveCommercial%`) to the `allowedWorkspaceFolders` setting, so folder paths can vary per user. - * Added a per-folder pre-select option to `allowedWorkspaceFolders` so an administrator-configured folder can appear as a ready chip when users start a new task, and removed the "Create workspace folder?" prompt for administrator-configured folders. - +* Added `updateViaUpdatesHost`. Set it to `true` to read the update feed from `releases.claude.com`, a host that serves only the desktop update check and carries no model API, so networks that block `api.anthropic.com` can still receive updates. Installer downloads continue to come from `downloads.claude.ai`. Defaults to `false`. +* Added an access mode to each `allowedWorkspaceFolders` entry. Set `mode` to `ro` to let Claude read and search a folder without changing it: in Cowork, writes are blocked and Claude is directed to put modified copies in the session outputs folder. In the Code tab this covers Claude's file tools only; Bash in the Code tab and SSH sessions do not yet enforce it. Entries without `mode` stay read-write, so existing configurations are unchanged. +* Added optional `:port` suffixes to `coworkEgressAllowedHosts` entries, for example `internal.corp.com:8443` or `*.corp.com:8443`, restricting that entry to the named port. This applies to the sandbox's web fetch now, and to shell egress once the updated virtual machine image ships; on the Code tab, a port-scoped entry is treated as its bare host (any port). Entries without a port keep allowing any port, and an invalid entry is dropped on its own with a warning in the logs. +* Added settings that decide where users sign in for inference to the one-time bootstrap consent prompt: the Azure AI Foundry Entra tenant and client, Bedrock IAM Identity Center, the Vertex OAuth client and workforce identity, and gateway OIDC. Set `trustBootstrapDelivery` to `true` in your device-management profile to accept these for everyone in advance. +* Added the merged Chat and Cowork home as the default. The "New" button starts a chat or a task from one composer, and the sidebar shows Home, which lists chats and tasks together, alongside Code. +* Changed the `trustBootstrapLocalExec` key name to `trustBootstrapDelivery`, reflecting that it now covers sign-in targets as well as helper scripts and connectors. The previous name continues to work in existing profiles. +* Fixed chats started inside a Project not picking up the Project's Instructions and Context links, including reading the files linked there. +* Fixed Code sessions on a custom gateway endpoint ending with an idle-timeout error while the gateway was still sending keep-alive responses. +* Fixed Code tab sessions on gateway and direct API key deployments still sending nonessential traffic to `api.anthropic.com` after an administrator turned off nonessential telemetry. +* Fixed model selections provided by your deployment being overridden by an out-of-date Claude Code `managed-settings.json` left on the device. +* Fixed the published `bootstrap-config-v2.schema.json` describing flat keys instead of the nested shape the app's own configuration export uses. - - **General** +**v1.25927.0** - * Improved find-in-page to search the entire session transcript instead of only the text scrolled into view, and the find bar now reliably takes keyboard focus when opened. - * Added a unified Artifacts view that lists your chat, Code, and Cowork artifacts in one searchable place, with a "New artifact" menu and a "Filter by" control to narrow the list by source. - * Fixed keyboard shortcut conflicts failing silently. Assigning a shortcut already held by another app now tells you and keeps your previous shortcut working, and Quick Entry registration errors now appear in Settings. - * Fixed the first-run notification explaining that Claude keeps running in the notification area never appearing on Windows. +**General** - **Code** +* Added a chevron next to the composer's microphone button that switches between dictation and voice mode and keeps your choice; clicking the microphone now starts dictation right away. +* Fixed `⌘K` (or `Ctrl+K` on Windows and Linux) search missing results from tool output and archived sessions. +* Fixed a crash on macOS during passkey and Touch ID prompts when the system language is German, Spanish, French, Hindi, Indonesian, Italian, Japanese, or Korean. +* Fixed automatic and menu-triggered update restarts interrupting an in-progress Claude Code or Cowork task. +* Fixed the app being left with no usable window: a failure during startup now shows an error dialog and records the details to a file, and a window the system shut down under low memory reloads instead of staying blank. - * Added running dev servers to the Background tasks panel, with stop and open-preview actions. - * Improved the Code file viewer: images, video, and audio now play inline instead of showing as text, and Markdown, CSV, and image files refresh automatically when Claude edits them. - * Updated the model picker. The three headline models appear at the top level with older models and context-size variants under "More models", each model shows a capability description, and currently-unavailable models appear disabled instead of failing when selected. - * Updated the in-session artifact panel: switch between a session's published artifacts from the title dropdown, see when an artifact was last updated, copy a share link, and open, share, or delete the artifact from the overflow menu. - * Changed the Code sessions tab from "Projects" to "All sessions". It now lists your non-project sessions alongside project sessions and adds a multi-select Environment filter. - * Fixed pull request status checks. Failures now show a small warning indicator on the branch row instead of repeated error popups, the "status couldn't be checked" warning appears less often and can always be dismissed, and only GitHub CLI sign-in problems still raise a notification. +**Code** - **Cowork** +* Added automatic resume for sessions interrupted when your computer goes to sleep. A banner with a manual Continue button appears only when resuming isn't safe, and you can continue the session in the cloud instead. +* Added capture and annotation for the page the Browser pane is showing, including external sites, so you can mark up what you see and attach the image to chat. +* Fixed a crash while using the in-app browser on pages with heavy console or network activity. +* Fixed messages sent while Claude was working disappearing from a session after it was reloaded from disk. +* Fixed sessions sometimes becoming permanently unopenable, showing "No messages yet" while their conversation history was still on disk. +* Fixed starting a session and swapping repositories stalling in organizations with very large repository lists: the pickers now load repositories page by page, find the rest as you type, say when more are available by searching, and report a failed search instead of showing empty results. - * Fixed corrupt plugin downloads crashing or hanging the app. - * Fixed skills sometimes staying on an older version after being edited until toggled off and on. +**Cowork** - **3P** +* Added pasted and attached images to the session's uploads folder, so Claude can open and edit the actual file. +* Fixed "Allow for this task" not appearing for connector tools when your organization has turned off persistent "Always allow". +* Fixed documents showing an internal file id instead of their title, including in export filenames and approval prompts. +* Fixed long-running workspace shell commands, such as large database queries, being cut off too early. +* Fixed scheduled task problems: a cron expression using `7` for Sunday never ran, stalled runs kept running in the background until the app was restarted, and "Allow for all scheduled runs" appeared on prompts where the choice could not be saved, so the task asked again on every run. - * Added the Chat tab as a beta feature controlled by the `chatTabEnabled` managed configuration key. The separate `chatCodeExecutionEnabled` key lets Claude analyze attachments and create files such as spreadsheets and presentations by running code in an isolated sandbox scoped to the session's attachments, and is off by default. - * Added the `betaFeaturesEnabled` managed configuration key. Setting it to false disables every beta feature in the deployment, including the Chat tab. - * Added Bedrock Mantle as an inference provider option. It reuses the existing `inferenceBedrockRegion` and `inferenceBedrockBaseUrl` managed configuration keys and authenticates with a bearer token or a credential helper. - * Added `anthropicFamilyTier` and `isFamilyDefault` to managed `inferenceModels` entries. Tag each configured model with the Claude tier it stands in for so tier shortcuts like opus and sonnet resolve to your configured model IDs instead of the canonical names your provider may not route. - * Added the `inferenceBedrockAwsCliPath` managed configuration key to set the AWS CLI's absolute path. This fixes aws sso login failing when the app is launched from Finder on macOS and the CLI is not on the default search path. - * Fixed Google Workspace connectors never starting their OAuth sign-in. The MCP client identifier the app sends to connected servers is now `claude-desktop-3p`, changed from `custom3p-desktop`, so update any MCP server allowlists or log filters that match the old value. - * Fixed the managed Tool policy `*` entry being ignored. It now applies as the default for any tool not listed by name. - * Fixed organization plugins sometimes not opening from the Directory right after launch or update. - * Fixed several connection and sign-in issues: Bedrock sessions now prompt to sign in again after AWS IAM Identity Center expires instead of failing with repeated credential errors, remote MCP connectors no longer stay Connected after a non-refreshable access token expires, the connection test now passes against gateways that optionally request a TLS client certificate, signing in after signing out no longer needs a double click, and sign-in recovery no longer uses stale configuration after a server-side update or leaves the model picker empty until restart. - +**3P** - - **General** +* Added Projects for organizing Chat conversations: create a project, start a chat inside it, or move existing chats in. Projects stays available even when your administrator has turned the Cowork tab off. +* Added `inferenceGatewayOidcAuthFlow` and `inferenceVertexWorkforceAuthFlow`, which choose whether identity-provider sign-in for gateway and Vertex workforce-identity credentials runs in the system browser (the default) or through the operating system's Microsoft account broker on Windows and macOS, so sign-in can satisfy Conditional Access policies that require a managed device. +* Added `managedMcpServers[].oauth.authFlow`, which lets a managed connector sign in through the operating system's Microsoft Entra account broker on Windows and macOS, so Conditional Access policies that require a managed device no longer block it. Devices without a broker keep using browser sign-in. +* Added `skillCreationEnabled`, which controls whether users can create and upload their own skills. It defaults to on; setting it to `false` hides the creation and upload surfaces and turns off Claude's skill-creation tools. It appears in the Setup window under workspace restrictions. +* Added `trustBootstrapLocalExec`. Each user is now asked once for consent when the bootstrap configuration includes settings that run local commands, such as credential helpers and local connectors. Set this key to `true` to accept them for everyone in advance. It defaults to `false` and is accepted only from MDM or a local configuration file. +* Added a built-in GitHub connector to `managedMcpServers`: set `server` to `github` and supply your own GitHub OAuth app client ID with the device flow enabled. The new `host`, `toolsets`, and `readOnly` subfields point the connector at a GitHub Enterprise Server instance, choose which toolsets load, and offer read tools only. The connector is also configurable from the Setup window. +* Added support for mounting Windows mapped network drives into the Cowork sandbox, so shell commands and document processing can work with files on network drives, and fixed adding a mapped network-drive folder mid-session being rejected with a message to use the folder picker. +* (breaking) Changed the nested v2 bootstrap response: `deploymentDisplayName` and `deploymentDisplaySubtitle` now sit under `appearance`, and `endUserAttribution` and `userContentRendererUrl` under `workspace`. The flat MDM key names are unchanged. +* Changed `managedMcpServers` and `microsoftAuthBroker` to be supported on standard deployments as well, so an administrator can enable the built-in Microsoft 365 connector by adding it to `managedMcpServers` through MDM. It stays off unless configured. +* Changed where several keys can be delivered from: `claudeAiImport`, `deploymentDisplayName`, and `deploymentDisplaySubtitle` now accept values from MDM and a local configuration file as well as a bootstrap server, and `disableDeepLinkRegistration`, `microsoftAuthBroker`, `userContentRendererUrl`, `inferenceFoundryTenantId`, `inferenceFoundryClientId`, `inferenceCredentialHelper` (with its TTL, timeout, and silent-refresh keys), `inferenceBedrockProfile`, `inferenceBedrockAwsDir`, `inferenceBedrockAwsCliPath`, and `inferenceVertexCredentialsFile` can now be delivered by a bootstrap server. The keys that name a local executable go through the consent prompt above. +* Deprecated `organizationPluginsUrl` and removed it from the configuration reference. The key is still honored, but organization plugins are better configured with `allowedPluginMarketplaces`. +* Updated `enduserAttribution` to the corrected spelling `endUserAttribution`. The previous spelling is still accepted and now records a configuration warning. +* Fixed connector sign-in recovery: connectors no longer ask you to sign in again after a slow startup when the credentials are still valid, and the GitHub connector shows its Reconnect card on the next tool call after its token is revoked on github.com instead of staying stuck. +* Fixed tasks failing with "Couldn't start this task" for the rest of the session when the app launched while the network or the sign-in credential was unavailable. +* Fixed the app losing administrator-enabled features, such as the Chat tab, for the rest of the session when the organization's configuration server was unreachable at launch. It now retries in the background and recovers. +* Fixed the home composer and sidebar still offering Cowork when an administrator has turned the Cowork tab off; Cowork is now hidden instead of greyed out, while Chat and Projects remain available. - * Added Find Next and Find Previous keyboard shortcuts to in-app search. - * Fixed preview panes stealing keyboard focus from the chat input when they reloaded or navigated. - * Fixed sessions failing to start after your sign-in expired — the app now prompts you to sign in again. +**v1.24012.11** - **Code** +**General** - * Added the Files panel to remote and SSH sessions — search the session's files and open them in the viewer — plus a Show in Files button in the file viewer. - * Added a running-tasks button to the activity indicator that opens the Tasks panel, and Bash rows in the Background tasks panel now open to show their output, including a live tail while the command runs. - * Fixed SSH sessions: forking no longer opens an empty conversation, and connections no longer fail with "Failed to upload file" errors on remotes first set up by early-2026 versions of the app. - * Fixed renaming a session while its title was still generating — the generated title no longer overwrites the name you set. - * Fixed the Pull Requests view showing "No open pull requests" when GitHub isn't connected — it now prompts you to connect. - * Added model-picker memory — the picker now remembers your last model choice. +* No user-facing changes. - **Cowork** +**Code** - * Fixed scheduled tasks firing many duplicate runs at once when the computer wakes from sleep. - * Fixed remote sessions re-prompting for access to folders you had already trusted. - * Fixed plugins becoming corrupted when they synced while you switched accounts. +* No user-facing changes. - **3P** +**Cowork** - * Added the built-in Microsoft 365 connector — admins can configure it from the Setup window's server presets. Users sign in through their browser, and Claude can search and read Microsoft 365 mail, calendar, OneDrive, and SharePoint. It requests read-only access by default; admins can grant additional read scopes, such as Teams channel messages and meeting transcripts, with the managed server entry's scope setting. - * Deprecated the "sso" value for the inferenceGatewayAuthScheme managed configuration key in favor of inferenceCredentialKind "interactive" — existing configurations keep working and log a deprecation warning. - * Added the inferenceVertexOAuthLoginHint managed configuration key to pre-fill the Google account chooser when signing in to Vertex AI, so users in organizations federated to a third-party identity provider land on the right account automatically. - +* No user-facing changes. - - **General** +**3P** - * Fixed Clear Cache and Restart signing you out instead of just clearing caches. - * Fixed mouse back and forward buttons not navigating on macOS for mice managed by driver software like Logitech Options+, and added trackpad swipe navigation. - * Fixed organization plugins sometimes failing to open right after app launch, and the plugin directory now offers Install again after an uninstall. - * Fixed connector, Chrome extension, and plugin toggles in the composer's "+" menu not responding when you click directly on the switch. - * Fixed an issue where signing in could leave the app unable to start sessions until it was restarted. - * Fixed shell-exported custom request headers not reaching Claude Code sessions. +* Fixed sessions started while configured MCP servers were still connecting having no connector tools until a new conversation was started. +* Fixed the Microsoft 365 connector not appearing after first-time sign-in until the app was restarted. - **Code** +**v1.24012.9** - * Fixed Claude losing its coding instructions, file-link formatting, and worktree context after a session resumed from idle. - * Fixed the preview pane sometimes connecting to an unrelated dev server that was already using the configured port, and it now reopens the dev server you last picked for each project. - * Improved responsiveness in Code sessions: smoother streaming of long code blocks, quicker side-panel shortcuts, and less delay opening cloud sessions with many screenshots. - * Fixed popovers, dialogs, and the rewind picker not appearing — and typed characters jumping to the end of the composer — when a Code session is opened in its own window. - * Fixed the slash-command menu opening behind the side chat panel. - * Fixed the source-branch picker showing nothing for SSH sessions with worktree enabled. +**General** - **Cowork** +* No user-facing changes. - * Added a "Free Up Cowork Disk Space" option under Help > Troubleshooting, and Cowork now cleans up caches and old temporary files automatically when its workspace disk runs low. - * Improved the read/unread toggle on sidebar sessions: it now works on the currently open session, has a larger click target, and shows a tooltip describing what a click will do. +**Code** - **3P** +* No user-facing changes. - * Added support for the Fable model family, and for Mythos where your organization has access. - * Fixed sign-in failing with external identity providers that reject the offline\_access scope — admins can now disable the automatic append. - +**Cowork** - - **General** +* Fixed plugin hooks silently doing nothing on Windows. - * Fixed reinstalling Claude on Windows failing after an uninstall when IT had installed it for all users. - * Fixed the app not starting automatically at login on Windows. - * Added a banner when an update fails to install, instead of failing silently. - * Fixed built-in connectors staying disconnected after a crash — existing sessions now reconnect them automatically, and disconnecting a built-in connector now signs it out and keeps it disconnected across restarts. +**3P** - **Code** +* Added the `mcpPersistentAlwaysAllowEnabled` managed configuration key, letting admins disable the persistent "Always allow" approvals for MCP tools while keeping session-scoped approvals available. +* Added the five-level effort selector for Claude Opus 5 in the model picker. Extended thinking is always on for Opus 5. - * Added math rendering for inline and block expressions in Claude Code transcripts. - * Added Ultracode to the effort slider, which selects the highest effort level and turns on dynamic workflows for the session. - * Added drag-to-reorder and A→Z sorting for projects in the Claude Code sidebar. - * Added triple-click to select a whole code block, plus right-click menu actions to copy a code block or inline code, in Claude Code transcripts. - * Fixed resuming Code sessions when the working folder had moved or been deleted — sessions saved with a \~ path no longer show as missing or re-prompt for trust, and a deleted remote folder now reports clearly and offers a Fork session button instead of retrying in a loop. +**v1.24012.0** - **Cowork** +**General** - * Added a low-disk-space warning before Cowork downloads the files it needs to run. - * Added in-session effort and thinking controls for local Cowork projects. - * Updated the New project folder picker to default to your Claude data folder (\~/Claude/Projects) instead of \~/Documents. - * Fixed Claude reporting that a skill was updated when the change was never saved to your account. - * Fixed the /schedule command in Cowork showing as unavailable. +* Added an option to keep custom plugin marketplaces up to date automatically, and fixed a marketplace refresh reporting success before the sync ran and re-adding an existing marketplace not refreshing its contents. +* Improved keyboard and screen reader support across the app: settings tabs and share-visibility choices respond to arrow keys, dialogs announce meaningful titles, decorative graphics no longer clutter screen reader output, and the find bar, search fields, and pane resize handles show a visible focus outline and announce their size. +* Fixed failed uploads being reported as corrupted or unsupported files, and retries showing a "Server is busy" message for unrelated errors. +* Fixed safety-block notices suggesting you switch models when no alternative model was available for that topic. +* Fixed the app failing to launch when its settings file or logs folder was corrupted, and saved sessions disappearing after a relaunch when one session's stored data was invalid. +* Fixed the app window resizing abruptly and losing its saved size and position when signing in or out; it now animates smoothly in place. - **3P** +**Code** - * Fixed managed connectors and SSO sign-in requesting broader OAuth scopes than the administrator configured. - * Fixed three Bedrock sign-in and session issues: SSO sign-in failing behind corporate proxies that intercept secure traffic, expired SSO tokens prompting a new sign-in every hour instead of refreshing automatically, and resumed sessions failing on their first message. - +* Added iOS Simulator support: Claude Code can build your iOS app, launch the simulator, and verify the result without leaving the session. +* Added an iOS Simulator button to the session titlebar when the agent launches an app in the simulator, so the pane is one click to reopen. +* Added Pause Project, which pauses a project's coordinator and new session spawning from settings and shows a Resume banner above the composer. +* Added screenshot annotation in the composer: click a staged image, open the pencil, and draw with pen, shapes, text, and colors before sending. +* Improved how large sessions open: the newest messages paint first while older history loads in the background. +* Fixed Code sessions affecting the wrong files: background worktree cleanup could switch or reset the main repository checkout when a worktree folder was only partially removed, and new sessions could copy uncommitted files from the original folder. +* Fixed session list problems: finished sessions still showing as running, deleted sessions reappearing as empty "Session not found on disk" entries after an update, archived sessions still appearing active on claude.ai and other devices, and sessions started from claude.ai missing Rename, Archive, and Delete in the sidebar menu. +* Fixed the app freezing when Claude Code updated its configuration file during concurrent use, and web pages in the Browser pane freezing the app with alert and confirm dialogs. + +**Cowork** + +* Added /usage and /cost to Cowork tasks: an inline card shows your plan limits and the session's usage without sending anything to the model. +* Improved background computer use so it types faster and no longer leaves menus stuck open on screen. +* Updated folder access prompts for cloud Cowork tasks to note that files Claude uses leave your device and are processed on Anthropic's servers. +* Fixed changes to Instructions for Claude sometimes not applying to new sessions, and edits reverting to an earlier version while a session was running, including after an app restart. +* Fixed Cowork workspace problems: the Windows workspace failing to start when its virtual disk files were compressed, a backgrounded shell command leaving a session stuck reporting "already running", and bash commands failing when several subtasks ran them at once. +* Fixed the message input staying stuck in a sending state when a folder access dialog went unanswered. + +**3P** + +* Added `deploymentDisplayName` and `deploymentDisplaySubtitle` to customize the deployment name and an optional subtitle shown in the account menu and sidebar. +* Added `enduserAttribution`, which shows the signed-in user's identity in the sidebar, account menu, and Code tab, and includes it as the OpenTelemetry `enduser.id` attribute on telemetry sent to your configured collector. Administrators can turn it off, and an existing static `enduser.id` is kept. +* Added `oauth.authorizationUrl` and `oauth.tokenUrl` to managed MCP servers for identity providers that do not serve a discovery document, and `oauth.additionalRedirectReferrerHosts` to allow sign-in callbacks from hosts other than the authorization URL's. +* Added `userContentRendererUrl`, which sets the HTTPS origin that renders artifact and file previews; leave it unset to use the default Anthropic-hosted renderer. +* Added a `broker` option to `inferenceFoundryAuthFlow` that signs in to Azure AI Foundry through the operating system's native account broker on Windows or Company Portal on macOS, so sign-in can satisfy Conditional Access policies that require a compliant device. Windows and macOS only. +* Added a Usage page in Settings for custom deployments, showing token usage across Chat, Cowork, and Code. +* Added Microsoft 365 Teams tools (send to a chat, channel, or thread; create a chat; @mention people) and formatted-body support for Outlook reply drafts. +* Added the 1M context option in the model picker for gateway-discovered models that report the capability in `/v1/models`, without requiring an `inferenceModels` entry. +* Changed telemetry on bootstrap-server deployments to default to disabled until the server explicitly enables it (previously only FedRAMP hosts), and added the ability to disable error and usage reporting through bootstrap configuration. +* Fixed managed MCP connectors: a server that requires authentication now opens a sign-in window even when its configuration does not explicitly enable OAuth, and an `oauth` entry with sign-in fields but a missing or empty `clientId` is now rejected at load with a clear error instead of silently attempting automatic registration. +* Fixed managed MCP tool policies that block all tools by default with per-tool exceptions denying the excepted tools in Claude Code sessions. +* Fixed sessions, skills, and plugins intermittently disappearing after sign-in or configuration changes. +* Fixed the Claude.ai sign-in option being hidden on deployments configured with a bootstrap URL; it is now hidden only when the administrator explicitly disables the deployment mode chooser. +* Fixed the bundled Microsoft 365 connector showing only an opaque tool error when its sign-in expired; it now shows an inline Reconnect card. +* Fixed the token-cap setup fields so the maximum tokens per window and the token cap window hours are required together; setting only one previously produced a cap that enforced nothing. + +**v1.22209.3** + +**General** + +* Fixed sessions on Windows failing on every turn with a "Socket is closed" error when traffic passed through a corporate proxy that inspects encrypted connections, by updating the bundled Claude Code CLI to 2.1.215. Interrupted responses now retry on a fresh connection instead of ending the turn. + +**Code** + +* No user-facing changes. + +**Cowork** + +* No user-facing changes. + +**3P** + +* No user-facing changes. + +**v1.22209.0** + +**General** + +* Improved responsiveness while artifacts generate, so typing and scrolling stay smooth during generation. +* Improved the "Add to project" menu to show only projects you can move into, with your own projects listed first. +* Fixed rare freezes when a transcript contained very large whitespace-padded messages or tool output. +* Fixed tool errors blaming an organization policy when a site was actually blocked by your own site permissions or settings. + +**Code** + +* Added controls for project owners to remove members from a shared project and copy an invite link from the members dialog. +* Added per-row actions to queued messages (Edit in composer, Send now, and Remove), with right-click support. +* Fixed a new session sometimes taking over the directory another session was still working in. +* Fixed Code sessions hanging at startup when skill syncing was slow, and tools on your shell `PATH` staying undetected when shell environment detection timed out at startup. +* Fixed freezes, a stuck "loading earlier messages" spinner, and blank rendering when scrolling back through very large session transcripts or when a running task's output grew very large. +* Fixed the New session button, `⌘N` (or `Ctrl+N` on Windows and Linux), and the project header "+" discarding an unsent composer draft. + +**Cowork** + +* Improved writing drafts to consistently appear as preview cards before being staged in a connected app such as Slack. +* Fixed documents Claude creates not reliably opening in the editor. +* Fixed files edited by Claude sometimes reading back stale or truncated content on Windows. +* Fixed the chat window freezing and not updating while Claude uses your computer. +* Fixed the document editor sometimes attributing your own typing to Claude while autosaving. +* Fixed working documents disappearing from the Documents panel after a temporary disk error. + +**3P** + +* Added `disableBrowserExternalNavigation`, which admins can set to `true` in Claude Code's `managed-settings.json` to keep the Code tab's Browser pane limited to localhost for both users and Claude. Local dev servers and file previews are unaffected. +* Added `otlpTracesEnabled` (beta), which also exports OpenTelemetry traces from Cowork tasks and Code sessions to your configured collector. +* Updated the allowed workspace folders policy to also apply to Code sessions on SSH hosts, evaluated against the folders on the remote host. +* Fixed enforcement of the managed Auto mode opt-out. +* Fixed plugins being treated as required by your organization when their marketplace name merely resolved under a required marketplace entry; only the exact entry a name resolves to now applies, so affected plugins can be uninstalled again. +* Fixed saving a skill created in chat failing; skills now save to the app's local skill storage. +* Fixed tools without a configured `toolPolicy` offering only Allow once and Deny; they now show the full set of approval options (Allow for this task, Allow for all tasks) and the prompt-injection warning. Explicit `ask` policies still prompt on every call. + +**v1.21459.3** + +**General** + +* Fixed installed extensions failing to load and showing an endless loading state. + +**Code** + +* No user-facing changes. + +**Cowork** + +* Fixed a status indicator that stayed on after a conversation finished. + +**3P** + +* No user-facing changes. + +**v1.21459.0** + +**General** + +* Changed the web-fetch permission prompt to default to "Allow all for this website" when that grant is available; "Allow once" stays the default otherwise, and pressing Enter always answers "Allow once". +* Updated the embedded Claude Code engine to the latest version. +* Fixed a crash on launch when Claude's worktree bookkeeping file couldn't be read or written. +* Fixed brief app freezes when opening terminals or switching sessions on Windows, and when the @ mention menu refreshed the list of open windows. +* Fixed scheduled tasks and routines: editing a routine no longer deletes its one-time schedule, "Run now" no longer silently does nothing until the app restarts, and you can now rename routines and scheduled tasks from the edit dialog. +* Fixed session exports that could produce an archive without the transcript; the transcript is now always included as `transcript.jsonl`, and the export shows a clear error when it can't be included. +* Fixed the "Sign in again" prompt not appearing when a background session was blocked for session freshness, including while the desktop was idle. + +**Code** + +* Added a browser-style address bar to the preview pane, and a clear message, with the option to open the site in your browser, when a page can't be displayed instead of showing a blank page. +* Added the ability to pin artifacts from the gallery or the artifact viewer, and to filter the gallery to your pinned artifacts. +* Improved SSH session connection handling: messages no longer hang after the computer wakes from sleep, sessions recover from repeated disconnects, and a reconnecting indicator appears while the connection is restored. +* Fixed `permissions.defaultMode` in Claude Code settings being ignored for new sessions after a per-folder permission mode had been chosen. +* Fixed branch switches on large repositories failing after an uncommitted-changes stash timed out, and restored your stashed changes when a switch fails. +* Fixed several session reliability problems: a session could get stuck showing "running" and queue new messages forever, a just-started session could disappear from the sidebar or show "session could not be found" during startup, and streamed responses could break or show a literal "undefined". + +**Cowork** + +* Added a live word count and a copy button to each document bar above the composer. +* Changed Markdown files Claude delivers to open in the document editor instead of a plain-text preview, without flashing the old viewer first. +* Changed the composer to keep the standard Send button while a response is running: it appears when you type, and sending mid-response queues your message instead of showing a separate Queue button. +* Fixed Claude's mid-task replies not appearing in the conversation; they now show under a collapsed "Working notes" row. +* Fixed screenshots from connected browsers and computer use not being saved to the task folder. +* Fixed text typed in one conversation appearing in other conversations' composers when switching between sessions. + +**3P** + +* Added `envHelper` and `envHelperTtlSec` subfields to `managedMcpServers`, letting a managed stdio server load environment variables from an admin-provided helper executable. +* Added an All tab to organization plugins that browses and searches every configured marketplace at once, and labeled plugins with their source marketplace so they can be filtered when more than one is configured. +* Added support for the `eu` and `us` multi-region Vertex AI endpoints, required for the newest models with EU and US data residency. +* Added the `disableFeatureDiscovery` key, which hides unprompted feature announcements such as the post-update "What's new" nudge and new-feature tips. Release notes remain available from the menu. +* Fixed remote MCP connectors whose `headersHelper` mints short-lived credentials failing one token-lifetime after connecting: the helper now re-runs before expiry and the refreshed headers are applied to the live connection. The new `headersHelperRefreshBufferSec` subfield of `managedMcpServers` tunes how far ahead of expiry the refresh runs. +* Added the `prefer1m` subfield to `inferenceModels`, which makes a model's 1M-context variant the default picker selection when paired with `supports1m`. +* Added the `toolSearchEnabled` key. When enabled, Code and Cowork sessions load MCP tool schemas on demand instead of placing every schema in context up front, which helps when many configured tools would otherwise crowd the context window. Requires an inference endpoint that forwards `anthropic-beta` request headers. +* Bootstrap-delivered model configuration is now forwarded to Claude Code sessions in third-party deployments. +* Changed the projects environment picker to respect an organization policy that hides Anthropic-managed environments. +* Removed the Beta designation from the `chatTabEnabled` and `chatAdvancedFileAnalysisEnabled` keys; the Chat tab and advanced file analysis are now generally available. Availability is unchanged, and both remain opt-in. +* Fixed a bug affecting third-party plugins installed from external sources (GitHub, URL, or npm). + +**v1.20186.9** + +**General** + +* Fixed an issue where permission prompts and in-session questions could silently stop appearing after an input-handling error — if Claude asked a question or requested permission and the prompt never showed up, this release fixes that. (Updates the bundled Claude Code CLI to 2.1.209.) + +**v1.20186.0** + +**General** + +* Fixed `claude://` deep links being ignored when opening one launched the app from a closed state, including on Windows and Linux. +* Fixed device attestation failing on Windows when sending several messages at once. +* Fixed garbled tool summaries in the transcript: descriptions that don't start with a recognized verb (for example "Final verification") now appear as written instead of being mis-conjugated. +* Fixed skill proposal and skill-file cards failing to save with "Couldn't save this skill" when a skill of that name already exists; they now offer "Update skill" and a replace confirmation. +* Fixed the app forgetting your last-used tab (for example Code) after an update or re-login. +* Fixed the menu bar usage menu showing an empty progress bar for extra usage when the spend cap is unlimited. + +**Code** + +* Added a Troubleshooting option to import Claude Code CLI sessions found on this computer into the session list. +* Fixed a typed `` turn rendering as a spoofable "Message from `{server}`" card instead of as your own text. +* Fixed cross-session messages going missing in the transcript: messages from another session no longer disappear when they arrive in the same turn as other content or when their envelope can't be fully parsed. +* Fixed file links to files outside the working directory, including reports Claude writes to its scratchpad, showing "This file is outside the working directory" instead of opening. +* Fixed the context window indicator and token count staying at the pre-compaction value after compacting a conversation. + +**Cowork** + +* Fixed admin-configured plugin marketplace sync failing behind corporate proxies on macOS. +* Fixed plugin connectors sometimes missing from the Connectors list and tool permission prompts when they were slow to start. +* Fixed skills saved in a remote session sometimes still returning "Unknown command" right after saving. +* Fixed the "Run this task while your Mac sleeps" setting turning itself off after an app update. + +**3P** + +* Added `*` wildcard matching for managed MCP `toolPolicy` keys; partial wildcard keys such as `"outlook_*"` in existing configurations now take effect, including any `allow` wildcards, which pre-approve the tools they match. Exact keys and the standalone `"*"` key behave as before. +* Added support for exporting Cowork task telemetry over `otlpProtocol: grpc` on macOS and Linux when no network proxy is configured. +* Fixed Azure AI Foundry sessions failing with an authentication error on every message after interactive Microsoft Entra ID sign-in. +* Fixed gateway-SSO bootstrap dropping cross-origin `managedMcpServers` entries, so admin-provisioned third-party connectors reach the app under device-code sign-in. +* Fixed MCP connectors failing to connect through gateways that optionally request a TLS client certificate, even though the connection test passed. +* Fixed sign-in timing out with identity providers (such as PingFederate) that redirect via a rendered page after authentication. +* Fixed third-party settings ignoring managed configuration: the Claude Code pane now follows `isClaudeCodeForDesktopEnabled`, the Developer tab hides when `isLocalDevMcpEnabled` is off, and the Capabilities and Voice settings no longer appear. + +**v1.19367.0** + +**General** + +* Added automatic updates on Linux through the Anthropic apt repository, so new versions arrive with `apt upgrade` (and unattended upgrades where enabled). +* Added the ability to archive or delete the current chat, project, task, or coding session directly from the command palette (`⌘K`, or `Ctrl+K` on Windows and Linux). +* Fixed bank payment-verification (3DS) pages not loading during checkout. +* Fixed MCP connectors in artifacts being silently dropped; approving a connector now reliably grants its tools to the artifact, and a previously stuck approval heals itself the next time you approve. +* Fixed repeated crashes on Linux caused by unstable graphics acceleration; the app now turns acceleration off automatically and tells you. +* Fixed the app becoming unresponsive when a session folder is on a slow or disconnected network drive. + +**Code** + +* Added descriptive branch names for local Code sessions, derived from your first message, in place of the random adjective-noun names. +* Changed the default transcript and composer width to a narrower, more readable column; a width you already chose in Settings → Appearance is preserved. +* Fixed "Open in Finder", "Open in editor", and "Attach to chat" doing nothing, or using the wrong path, for files in the diff panel when the session folder differs from the repo folder. +* Fixed freezes and stalls: while restoring a large number of sessions at startup, while builds or file syncs churned files inside a watched folder, and while the diff panel refreshed during a response. +* Fixed newly trusted folders sometimes failing to start a session with a "workspace is not trusted" error. +* Fixed security-key and phone sign-ins not completing in preview tabs. + +**Cowork** + +* Added a copyright-access notice in the session timeline when Claude in Chrome first operates on certain news publisher sites. +* Added keyboard access to the preview pane: Tab reaches a "Preview page" control, Enter moves focus into the loaded page, and `F6` (or `Ctrl+F6`) moves it back out. +* Fixed Cowork offering terminal access, and showing an impossible fix suggestion, on devices whose operating system cannot provide the virtualization its isolated environment needs (such as ChromeOS), where every command immediately failed. + +**3P** + +* Added `inferenceFoundryAuthFlow` to choose how interactive Microsoft Entra ID sign-in for Azure AI Foundry runs: `device-code` (the default, which shows a code to enter at `microsoft.com/devicelogin`) or `browser`, which opens the system browser for an authorization-code (PKCE) sign-in. +* Added `microsoftAuthBroker`; set it to `disabled` to force browser-based Microsoft 365 sign-in instead of the native Company Portal or Windows account broker. +* Added a "session expires soon" warning for Bedrock SSO and AWS-profile sign-in so you can re-authenticate before hitting an error. +* Added a `startupTimeoutSec` option for managed local (stdio) MCP servers and raised the default startup timeout from 10 to 120 seconds, fixing connection failures when a server command downloads packages on first run (for example `uvx` or `npx`). +* Added support for background agents: long-running tasks now stay signed in after your identity provider's access token expires. +* Added the ability for administrators to grant Microsoft 365 write scopes (send mail; edit calendars and files; send Teams chat; mailbox settings) through managed configuration. +* (breaking) Changed the default for Desktop Extensions (`.dxt` and `.mcpb`): they no longer load unless you set `isDesktopExtensionEnabled` to `true` in managed configuration. Previously they loaded by default and only the install UI was blocked. +* Updated `allowedPluginMarketplaces` (beta) so it can be delivered per-user through the bootstrap server; a response that omits the key leaves MDM-provisioned marketplaces in place. +* Fixed a one-time loss of sign-ins on some managed Windows machines after app data moved to a new location. +* Fixed AWS credentials not reaching the Code tab's terminal for Amazon Bedrock configurations that use IAM Identity Center. +* Fixed bundled Microsoft 365 and other MCP connectors failing to connect on networks with corporate TLS inspection (custom root CA). +* Fixed connection tests reporting false failures: the test now runs MCP helper scripts and checks managed configurations exactly as saved, and uses the same Azure AI Foundry endpoint that sessions use. +* Fixed managed MCP connectors failing with a credential-storage error when the server allows anonymous access. +* Fixed the Microsoft 365 connector failing to sign in on Macs enrolled with Microsoft Company Portal. +* Fixed the setup form incorrectly showing "Blocked address" for internal MCP or OAuth servers on IPv6 enterprise networks. + +**v1.18286.2** + +**General** + +* Updated the embedded Claude Code engine to the latest version. + +**Code** + +* No user-facing changes. + +**Cowork** + +* No user-facing changes. + +**3P** + +* No user-facing changes. + +**v1.18286.0** + +**General** + +* Fixed `apt update` failing on Linux after uninstalling a Claude that was installed from the apt repository. +* Fixed being asked to sign in repeatedly after a session expired while you were using the app; your in-progress message draft now returns when you sign back in within 10 minutes, and signing out still clears it. +* Fixed being unable to disable, delete, or uninstall plugins from GitHub-connected marketplaces, or to remove those marketplaces. +* Fixed pressing Enter not sending your message when an @mention had no matching results. +* Fixed remote SSH sessions getting stuck in a reconnect loop on very large messages, being lost when the computer woke from sleep mid-reconnect, and occasionally sending the same input twice after reconnecting. +* Fixed setup on Windows getting stuck retrying a download when the download folder was locked or inaccessible. +* Fixed the file-open spinner on Linux staying up after the download completed. + +**Code** + +* Added a "Choose folder" option to recover a session whose working folder is missing: the conversation forks into the folder you pick and the stuck session is archived. +* Added a "Switch organization" option on the "session not found" page so you can reopen a session link under the right organization. +* Added drag-to-reorder for queued messages, and Steer now works for messages that include images. +* Improved the Code tab's live preview: it now reports honest connection and loading status (including when a page arrives but never finishes loading, or a server overloads itself with requests), adds browser-style Back, Forward, and Reload/Stop controls, and lets you close other preview tabs. +* Fixed background tasks and workflows continuing to show as running after they finished, the session restarted, or the session was stopped. +* Fixed Remote Control sessions spinning forever with no error after you sent a message when the hosting computer was no longer connected. +* Fixed the sidebar project + button opening an empty prompt (or pointing at github.com) for GitHub Enterprise repositories. + +**Cowork** + +* Added click-to-zoom and drag-to-pan to the fullscreen image viewer. +* Fixed Computer Use teach mode where the Next and Exit buttons sometimes stopped responding until you switched apps and back, and cleared up teach-mode visuals so the screen-edge glow no longer flickers and the status indicator no longer sticks after you exit a guide. +* Fixed dictation dropping back to the text box when started from the mic button in existing sessions. +* Fixed document tools in cloud sessions acting on your local files instead of the session's files. + +**3P** + +* Added a usage breakdown by model family, source attribution, and usage tips to the `/usage` card. +* Removed automatic addition of Anthropic's default plugin marketplace on third-party deployments, and removed the `disableDefaultPlugins` managed configuration key (which had no effect there). Provision marketplaces via `allowedPluginMarketplaces` (beta). + +**v1.17377.2** + +**General** + +* No user-facing changes. + +**Code** + +* No user-facing changes. + +**Cowork** + +* No user-facing changes. + +**3P** + +* Added Claude Fable 5 to the model picker for organizations with access. + +**v1.17377.1** + +**General** + +* Added Linux support: Claude Desktop is now available for Debian and Ubuntu on x64 and arm64, installable as a .deb package. +* Updated the plugin Directory to show admin-configured marketplaces under the Organization tab and refresh them automatically when the source repository updates. +* Fixed plugin and skill downloads stalling for several minutes on a dead connection before retrying; stalled downloads now retry sooner. +* Fixed prompt and tool-detail content missing from OpenTelemetry exports for standard deployments that have not set an explicit content-capture policy; third-party deployments are unchanged. +* Changed zoom in and out to use smaller steps for finer control. + +**Code** + +* Added an integrated terminal pane and inline image previews in the transcript for SSH sessions. +* Added step-by-step progress and a Stop button while a session's worktree is being set up, so a long checkout on a large repository can be cancelled. +* Added a right-click menu in the Terminal pane with Copy, Paste, and Attach selection as context. +* Updated the transcript to mask API keys and tokens by default; click the eye icon to reveal them. +* Fixed folder access and cross-session requests being rejected after you approved them when permission mode was Auto or Bypass permissions. +* Fixed failed mid-turn message sends (for example, while offline) dropping your text instead of returning it to the input. +* Fixed new session worktrees branching from the currently checked-out branch instead of the repository's default branch, and archived sessions leaving their worktree folders on disk. + +**Cowork** + +* Fixed a crash when resuming sessions with malformed remote connector data on disk. +* Fixed the workspace download restarting from zero after a network interruption; it now resumes from where it left off and retries automatically. +* Fixed folder and file names containing a dollar sign being misread, which broke file references. +* Fixed dictation immediately dropping back to the text input in existing sessions. +* Fixed an error caused by Claude trying to read a document creation skill that was not available. +* Fixed clicking a built-in workflow (such as `deep-research`) in the activity panel's Skills section showing an empty drawer instead of its name and source. + +**3P** + +* Added the `allowedPluginMarketplaces` managed configuration key. Configured git repositories appear under the Directory's Organization tab. +* Added an optional `omitOfflineAccess` subfield to the `inferenceVertexWorkforceOidc` configuration. Enable it when an identity provider rejects the `offline_access` scope; the app then prompts for sign-in each time the identity provider token expires instead of refreshing silently. +* Added managed configuration support on Linux: administrators can provision settings in a root-owned `/etc/claude-desktop/managed-settings.json`, validated against the same schema as the macOS and Windows sources. +* Fixed claude.ai sign-in never completing on Windows when an enterprise inference provider is configured. +* Fixed subagents failing with an invalid model error on third-party inference providers. +* Fixed `inferenceModels[].supports1m` being ignored, restoring the 1M-context option in the model picker for Bedrock, Vertex, Foundry, and gateway providers. +* Fixed the Microsoft 365 connector showing an unexpected admin-consent prompt after updating on tenants with restrictive consent policies when the connector's Access setting was blank. Also updated the bundled connector with tools to read the signed-in user's profile and draft reply-all emails. +* Improved expired sign-in handling for third-party inference providers and connectors: a sign-in prompt now appears whichever credential type expired, connector authentication errors are shown in Settings and inline in chat with a Reconnect action, and background Code sessions stay signed in across a credential refresh. +* Fixed several connector reliability issues: connectors silently stopping mid-session after an OAuth refresh failed instead of prompting to reconnect, connectors configured with both OAuth sign-in and custom headers failing to connect, and admin-configured connectors not appearing in a session until they were signed in. + +**v1.15962.2** + +**General** + +* Updated the embedded Claude Code engine to the latest version. + +**Code** + +* No user-facing changes. + +**Cowork** + +* No user-facing changes. + +**3P** + +* No user-facing changes. + +**v1.15962.1** + +**General** + +* No user-facing changes. + +**Code** + +* No user-facing changes. + +**Cowork** + +* No user-facing changes. + +**3P** + +* Fixed locally-configured stdio MCP servers being refused in third-party deployments that don't use MDM. +* Fixed third-party MCP connectors disconnecting on every app restart when the OAuth provider returns a non-standard refresh response. +* Fixed Microsoft 365 brokered sign-in failing with "No reply address provided" on managed Macs. + +**v1.15962.0** + +**General** + +* Fixed a crash on launch caused by an unusually large saved session. +* Fixed the conversation jumping and the Progress panel flashing when opening a completed task. +* Improved keyboard navigation: a message's action buttons are now a single Tab stop, with arrow keys to move between them. + +**Code** + +* Fixed high background CPU usage when several Code sessions were open in the same large repository. +* Fixed people without a Claude Code seat being sent to the marketing site from `/code`; they now see an in-app organization switcher. +* Added support for custom cron expressions when scheduling local routines. +* Added "Open in VS Code", "Open in Cursor", and similar actions to the file panel, file tree, plan panel, titlebar, and sidebar in SSH sessions. +* Fixed attachment cards for files that exist only inside a session doing nothing when clicked; they now open in the File pane, lightbox, Preview pane, or Files browser. +* Added a "Load more" button to the All sessions list for people with many sessions. + +**Cowork** + +* Fixed workspace setup repeatedly failing with the same checksum error after a corrupted download, until the cache was cleared. +* Fixed Cowork sessions losing their project after restarting the app. +* Added a one-time prompt before Claude runs a dynamic workflow, explaining what workflows do. +* Improved the time it takes to start a session. + +**3P** + +* Added a managed `websearch` built-in tool so self-hosted deployments can search the web. Admins configure Brave, Tavily, Exa, or a custom endpoint in managed config, and it is available in both the Cowork and Code tabs. +* Added an `otlpContentCapture` managed setting that lets admins opt in to sending specific categories of unredacted content — user prompts, assistant responses, tool inputs, tool outputs, and raw API request/response bodies — to their OTLP collector. +* Updated the Microsoft 365 built-in connector's `scope` field to accept `MailboxSettings.Read`. +* Fixed managed connectors that lost their connection staying broken with failing tool calls; they now reconnect automatically on the next tool call, including from newly started conversations, and show a message if reconnecting fails. +* Fixed Microsoft 365 connector sign-in failing on Windows because of a broker error. +* Fixed a sign-in loop when your organization's gateway denies access; the app now shows "Access denied" and points you to your administrator. +* Fixed the selected model reverting after restarting the app and resuming a session. +* Added a `disableBundledSkills` managed config key that turns off Claude Code's bundled skills and workflows (such as `deep-research`) on that device. + +**v1.15200.0** + +**General** + +* No user-facing changes. + +**Code** + +* Added an inline card for multiple-choice questions from Claude, so you can pick an option and step through each question before your choices are sent as a single reply. +* Fixed the app crashing shortly after opening the Code tab when local session history files are very large. +* Fixed the integrated terminal eventually failing to open new shells after the app had been running for several days on macOS. +* Fixed forked sessions not carrying over pull requests from the original conversation, and pull request rows staying marked as closed after being reopened on GitHub. +* Fixed the @-mention dropdown, side-chat panel, and plan-comment popover rendering, resizing, and dismissing in the wrong window when a session is opened in its own window. +* Fixed an extra tab opening in the system browser when navigating with the Artifacts pane open. + +**Cowork** + +* Added the ability to delete Cowork sessions from the sidebar, recents, and Spaces views. + +**3P** + +* Published the v2 bootstrap-response JSON schema (nested format). The v1 flat schema remains supported. +* Removed support for installing connector extensions from local `.mcpb` and `.dxt` files. +* Fixed the Setup panel being locked when only the auto-update policy was deployed via MDM. +* Fixed connectors configured by your organization not appearing until restart after first sign-in. +* Fixed the model picker dropping to "Default model" mid-session when a gateway's model-list response was temporarily degraded. + +**v1.14271.0** + +**General** + +* Fixed the app prompting you to sign in again every day when your claude.ai session was more than a day old. +* Fixed Claude Design links in chat navigating the app in place instead of opening Claude Design. +* Fixed the app showing a blank window when a network proxy redirects the connection to Claude. + +**Code** + +* Changed routines to count against your regular usage limits instead of a separate daily included-run limit, and removed the included-runs indicator. +* Updated the model picker to show restricted models as non-selectable with an explanatory badge, and to reflect your organization's allowed default model. +* Fixed HTML and SVG file previews showing black text on a dark background in dark mode. +* Fixed menus and popovers opening behind the preview panel. + +**Cowork** + +* Fixed Claude in Chrome file uploads failing for files in the session's shared folders and outputs. +* Fixed scheduled tasks leaving earlier processes running after each scheduled run. +* Fixed Windows file paths showing garbled characters in the folder access approval card, and reduced unnecessary folder access denials when allowed workspace folders are configured. + +**3P** + +* (breaking) Changed the `chatCodeExecutionEnabled` managed configuration key to `chatAdvancedFileAnalysisEnabled`. It still lets Claude analyze attached files such as spreadsheets and presentations by running code in a sandbox scoped to the session's attachments, and remains off by default. Update any managed configuration that sets the old key. +* Deprecated the `betaFeaturesEnabled` managed configuration key; use the per-feature keys `chatTabEnabled` and `chatAdvancedFileAnalysisEnabled` instead. The Beta label in the Setup window is now informational only, and the Beta label has been removed from the built-in Microsoft 365 connector presets. +* Added the `inferenceSessionLifetimeSec` managed configuration key. Set it to your identity provider's session lifetime to show users a re-authenticate reminder before their sign-in expires. +* Added `~` and environment variable expansion (such as `%APPDATA%` and `%OneDriveCommercial%`) to the `allowedWorkspaceFolders` setting, so folder paths can vary per user. +* Added a per-folder pre-select option to `allowedWorkspaceFolders` so an administrator-configured folder can appear as a ready chip when users start a new task, and removed the "Create workspace folder?" prompt for administrator-configured folders. + +**v1.13576.0** + +**General** + +* Improved find-in-page to search the entire session transcript instead of only the text scrolled into view, and the find bar now reliably takes keyboard focus when opened. +* Added a unified Artifacts view that lists your chat, Code, and Cowork artifacts in one searchable place, with a "New artifact" menu and a "Filter by" control to narrow the list by source. +* Fixed keyboard shortcut conflicts failing silently. Assigning a shortcut already held by another app now tells you and keeps your previous shortcut working, and Quick Entry registration errors now appear in Settings. +* Fixed the first-run notification explaining that Claude keeps running in the notification area never appearing on Windows. + +**Code** + +* Added running dev servers to the Background tasks panel, with stop and open-preview actions. +* Improved the Code file viewer: images, video, and audio now play inline instead of showing as text, and Markdown, CSV, and image files refresh automatically when Claude edits them. +* Updated the model picker. The three headline models appear at the top level with older models and context-size variants under "More models", each model shows a capability description, and currently-unavailable models appear disabled instead of failing when selected. +* Updated the in-session artifact panel: switch between a session's published artifacts from the title dropdown, see when an artifact was last updated, copy a share link, and open, share, or delete the artifact from the overflow menu. +* Changed the Code sessions tab from "Projects" to "All sessions". It now lists your non-project sessions alongside project sessions and adds a multi-select Environment filter. +* Fixed pull request status checks. Failures now show a small warning indicator on the branch row instead of repeated error popups, the "status couldn't be checked" warning appears less often and can always be dismissed, and only GitHub CLI sign-in problems still raise a notification. + +**Cowork** + +* Fixed corrupt plugin downloads crashing or hanging the app. +* Fixed skills sometimes staying on an older version after being edited until toggled off and on. + +**3P** + +* Added the Chat tab as a beta feature controlled by the `chatTabEnabled` managed configuration key. The separate `chatCodeExecutionEnabled` key lets Claude analyze attachments and create files such as spreadsheets and presentations by running code in an isolated sandbox scoped to the session's attachments, and is off by default. +* Added the `betaFeaturesEnabled` managed configuration key. Setting it to false disables every beta feature in the deployment, including the Chat tab. +* Added Bedrock Mantle as an inference provider option. It reuses the existing `inferenceBedrockRegion` and `inferenceBedrockBaseUrl` managed configuration keys and authenticates with a bearer token or a credential helper. +* Added `anthropicFamilyTier` and `isFamilyDefault` to managed `inferenceModels` entries. Tag each configured model with the Claude tier it stands in for so tier shortcuts like opus and sonnet resolve to your configured model IDs instead of the canonical names your provider may not route. +* Added the `inferenceBedrockAwsCliPath` managed configuration key to set the AWS CLI's absolute path. This fixes aws sso login failing when the app is launched from Finder on macOS and the CLI is not on the default search path. +* Fixed Google Workspace connectors never starting their OAuth sign-in. The MCP client identifier the app sends to connected servers is now `claude-desktop-3p`, changed from `custom3p-desktop`, so update any MCP server allowlists or log filters that match the old value. +* Fixed the managed Tool policy `*` entry being ignored. It now applies as the default for any tool not listed by name. +* Fixed organization plugins sometimes not opening from the Directory right after launch or update. +* Fixed several connection and sign-in issues: Bedrock sessions now prompt to sign in again after AWS IAM Identity Center expires instead of failing with repeated credential errors, remote MCP connectors no longer stay Connected after a non-refreshable access token expires, the connection test now passes against gateways that optionally request a TLS client certificate, signing in after signing out no longer needs a double click, and sign-in recovery no longer uses stale configuration after a server-side update or leaves the model picker empty until restart. + +**v1.12603.1** + +**General** + +* Added Find Next and Find Previous keyboard shortcuts to in-app search. +* Fixed preview panes stealing keyboard focus from the chat input when they reloaded or navigated. +* Fixed sessions failing to start after your sign-in expired — the app now prompts you to sign in again. + +**Code** + +* Added the Files panel to remote and SSH sessions — search the session's files and open them in the viewer — plus a Show in Files button in the file viewer. +* Added a running-tasks button to the activity indicator that opens the Tasks panel, and Bash rows in the Background tasks panel now open to show their output, including a live tail while the command runs. +* Fixed SSH sessions: forking no longer opens an empty conversation, and connections no longer fail with "Failed to upload file" errors on remotes first set up by early-2026 versions of the app. +* Fixed renaming a session while its title was still generating — the generated title no longer overwrites the name you set. +* Fixed the Pull Requests view showing "No open pull requests" when GitHub isn't connected — it now prompts you to connect. +* Added model-picker memory — the picker now remembers your last model choice. + +**Cowork** + +* Fixed scheduled tasks firing many duplicate runs at once when the computer wakes from sleep. +* Fixed remote sessions re-prompting for access to folders you had already trusted. +* Fixed plugins becoming corrupted when they synced while you switched accounts. + +**3P** + +* Added the built-in Microsoft 365 connector — admins can configure it from the Setup window's server presets. Users sign in through their browser, and Claude can search and read Microsoft 365 mail, calendar, OneDrive, and SharePoint. It requests read-only access by default; admins can grant additional read scopes, such as Teams channel messages and meeting transcripts, with the managed server entry's scope setting. +* Deprecated the "sso" value for the inferenceGatewayAuthScheme managed configuration key in favor of inferenceCredentialKind "interactive" — existing configurations keep working and log a deprecation warning. +* Added the inferenceVertexOAuthLoginHint managed configuration key to pre-fill the Google account chooser when signing in to Vertex AI, so users in organizations federated to a third-party identity provider land on the right account automatically. + +**v1.11847.5** + +**General** + +* Fixed Clear Cache and Restart signing you out instead of just clearing caches. +* Fixed mouse back and forward buttons not navigating on macOS for mice managed by driver software like Logitech Options+, and added trackpad swipe navigation. +* Fixed organization plugins sometimes failing to open right after app launch, and the plugin directory now offers Install again after an uninstall. +* Fixed connector, Chrome extension, and plugin toggles in the composer's "+" menu not responding when you click directly on the switch. +* Fixed an issue where signing in could leave the app unable to start sessions until it was restarted. +* Fixed shell-exported custom request headers not reaching Claude Code sessions. + +**Code** + +* Fixed Claude losing its coding instructions, file-link formatting, and worktree context after a session resumed from idle. +* Fixed the preview pane sometimes connecting to an unrelated dev server that was already using the configured port, and it now reopens the dev server you last picked for each project. +* Improved responsiveness in Code sessions: smoother streaming of long code blocks, quicker side-panel shortcuts, and less delay opening cloud sessions with many screenshots. +* Fixed popovers, dialogs, and the rewind picker not appearing — and typed characters jumping to the end of the composer — when a Code session is opened in its own window. +* Fixed the slash-command menu opening behind the side chat panel. +* Fixed the source-branch picker showing nothing for SSH sessions with worktree enabled. + +**Cowork** + +* Added a "Free Up Cowork Disk Space" option under Help > Troubleshooting, and Cowork now cleans up caches and old temporary files automatically when its workspace disk runs low. +* Improved the read/unread toggle on sidebar sessions: it now works on the currently open session, has a larger click target, and shows a tooltip describing what a click will do. + +**3P** + +* Added support for the Fable model family, and for Mythos where your organization has access. +* Fixed sign-in failing with external identity providers that reject the offline\_access scope — admins can now disable the automatic append. + +**v1.11187.4** + +**General** + +* Fixed reinstalling Claude on Windows failing after an uninstall when IT had installed it for all users. +* Fixed the app not starting automatically at login on Windows. +* Added a banner when an update fails to install, instead of failing silently. +* Fixed built-in connectors staying disconnected after a crash — existing sessions now reconnect them automatically, and disconnecting a built-in connector now signs it out and keeps it disconnected across restarts. + +**Code** + +* Added math rendering for inline and block expressions in Claude Code transcripts. +* Added Ultracode to the effort slider, which selects the highest effort level and turns on dynamic workflows for the session. +* Added drag-to-reorder and A→Z sorting for projects in the Claude Code sidebar. +* Added triple-click to select a whole code block, plus right-click menu actions to copy a code block or inline code, in Claude Code transcripts. +* Fixed resuming Code sessions when the working folder had moved or been deleted — sessions saved with a \~ path no longer show as missing or re-prompt for trust, and a deleted remote folder now reports clearly and offers a Fork session button instead of retrying in a loop. + +**Cowork** + +* Added a low-disk-space warning before Cowork downloads the files it needs to run. +* Added in-session effort and thinking controls for local Cowork projects. +* Updated the New project folder picker to default to your Claude data folder (\~/Claude/Projects) instead of \~/Documents. +* Fixed Claude reporting that a skill was updated when the change was never saved to your account. +* Fixed the /schedule command in Cowork showing as unavailable. + +**3P** + +* Fixed managed connectors and SSO sign-in requesting broader OAuth scopes than the administrator configured. +* Fixed three Bedrock sign-in and session issues: SSO sign-in failing behind corporate proxies that intercept secure traffic, expired SSO tokens prompting a new sign-in every hour instead of refreshing automatically, and resumed sessions failing on their first message. diff --git a/content/claude/cowork/guide/dispatch.md b/content/claude/cowork/guide/dispatch.md index 6f30a3c701..81793ef674 100644 --- a/content/claude/cowork/guide/dispatch.md +++ b/content/claude/cowork/guide/dispatch.md @@ -18,23 +18,21 @@ Dispatch requires a Pro or Max plan and the latest Claude Desktop app on macOS o The Dispatch agent appears as **Dispatch** in the left sidebar. Selecting it opens a single conversation with the agent. - - - Select **Dispatch** in the left side panel. - - - - Tell the agent what you want done, the same way you'd brief a colleague. For - example: "Summarize the open Linear issues tagged reliability and draft a - status update for the team channel." - - - - The agent decides how to split the work and starts one or more child tasks. - Each child task appears under the Dispatch group in the sidebar with its own - status. - - +**1. Open Dispatch from the sidebar** + +Select **Dispatch** in the left side panel. + +**2. Describe the outcome** + +Tell the agent what you want done, the same way you'd brief a colleague. For +example: "Summarize the open Linear issues tagged reliability and draft a +status update for the team channel." + +**3. Let Dispatch plan and run** + +The agent decides how to split the work and starts one or more child tasks. +Each child task appears under the Dispatch group in the sidebar with its own +status. You converse with one Dispatch agent, but it can run many child tasks beneath that conversation. Child tasks don't spawn further children of their own. @@ -76,21 +74,19 @@ Select any child task in the sidebar to open its session. You can read the trans When Claude Desktop is running, your computer registers as a Dispatch host. From the Claude mobile app, you can start a Dispatch conversation that runs on your desktop, then check results from either device. - - - Leave Claude Desktop open with your computer awake and online. - - - - In the Claude mobile app, open Dispatch and describe the task. The work runs - on your desktop. - - - - Progress and results appear in the Dispatch sidebar on desktop and in the - mobile app. - - +**1. Keep your desktop ready** + +Leave Claude Desktop open with your computer awake and online. + +**2. Open Dispatch on mobile** + +In the Claude mobile app, open Dispatch and describe the task. The work runs +on your desktop. + +**3. Review on either device** + +Progress and results appear in the Dispatch sidebar on desktop and in the +mobile app. ## Related diff --git a/content/claude/cowork/guide/plugins.md b/content/claude/cowork/guide/plugins.md index 920989acaf..5ecc574e8f 100644 --- a/content/claude/cowork/guide/plugins.md +++ b/content/claude/cowork/guide/plugins.md @@ -29,24 +29,22 @@ After installing, open the plugin to see what it provides. Skills and agents app You browse, install, and upload plugins from the **Plugins** page. Open **Customize** in the sidebar, then select **Plugins**. - - - Select **Discover** to see available plugins. The default marketplace is - Anthropic's official catalog; you can add other marketplaces by URL. - - - - Select a plugin and click **Install**. Installing doesn't add or sign you in - to any connector. If the plugin includes connectors, open its **Connectors** - tab afterward to add or connect each one. - - - - Open the installed plugin to see its skills, connectors, agents, and hooks. - Select **Disable plugin** to turn the whole plugin off, and connect or - disconnect each connector on its own from the **Connectors** tab. - - +**1. Browse the marketplace** + +Select **Discover** to see available plugins. The default marketplace is +Anthropic's official catalog; you can add other marketplaces by URL. + +**2. Install** + +Select a plugin and click **Install**. Installing doesn't add or sign you in +to any connector. If the plugin includes connectors, open its **Connectors** +tab afterward to add or connect each one. + +**3. Review components** + +Open the installed plugin to see its skills, connectors, agents, and hooks. +Select **Disable plugin** to turn the whole plugin off, and connect or +disconnect each connector on its own from the **Connectors** tab. To install from a file instead, select the upload option on the Plugins page and select the plugin package. @@ -54,18 +52,16 @@ To install from a file instead, select the upload option on the Plugins page and A Git repository that contains plugin packages can serve as a marketplace, which lets you share plugins without publishing to the public catalog. For a marketplace you add yourself, repositories on GitHub, including GitHub Enterprise, are supported, and public repositories on GitLab and Bitbucket also work. To distribute plugins to everyone in a Team or Enterprise organization, an Owner syncs the repository from organization settings instead, as [Manage plugins for your organization](/docs/plugins/admin#add-your-own-plugins) describes. - - - On the Plugins page, select **Add marketplace** and enter the repository's - URL. Cowork accepts the standard `https://github.com/owner/repo` form and - the `owner/repo` shorthand for GitHub. - - - - Plugins defined in the repository appear alongside plugins from other - marketplaces. Install them the same way. - - +**1. Add the repository** + +On the Plugins page, select **Add marketplace** and enter the repository's +URL. Cowork accepts the standard `https://github.com/owner/repo` form and +the `owner/repo` shorthand for GitHub. + +**2. Install plugins from it** + +Plugins defined in the repository appear alongside plugins from other +marketplaces. Install them the same way. Select **Check for updates** on a marketplace to pull the latest plugins from its repository, or turn on **Sync automatically**. diff --git a/content/claude/cowork/guide/projects.md b/content/claude/cowork/guide/projects.md index 953e588b9b..7715c8cc79 100644 --- a/content/claude/cowork/guide/projects.md +++ b/content/claude/cowork/guide/projects.md @@ -27,23 +27,21 @@ Each project bundles the following, and you can change any of it after creation. Open **Projects** in the left navigation and choose the **+** button to start. You're offered three starting points. - - - Select **Start from scratch** to create an empty project with a new folder, - **Import a project** to bring an existing claude.ai project into Cowork, or - **Use an existing folder** to point at a folder you already work from. - - - - Give the project a name and a short description so you can tell it apart in - the sidebar. - - - - Attach the local folders Claude should have access to, and write any - standing instructions you want applied to every session. - - +**1. Choose a starting point** + +Select **Start from scratch** to create an empty project with a new folder, +**Import a project** to bring an existing claude.ai project into Cowork, or +**Use an existing folder** to point at a folder you already work from. + +**2. Name and describe it** + +Give the project a name and a short description so you can tell it apart in +the sidebar. + +**3. Add folders and instructions** + +Attach the local folders Claude should have access to, and write any +standing instructions you want applied to every session. You can attach more folders, links, or projects from Chat at any time from the project's settings. diff --git a/content/claude/cowork/hipaa-setup.md b/content/claude/cowork/hipaa-setup.md index 64758ea696..e0b45a1836 100644 --- a/content/claude/cowork/hipaa-setup.md +++ b/content/claude/cowork/hipaa-setup.md @@ -8,15 +8,15 @@ The HIPAA configuration is an organization setting on Claude Enterprise plans, for organizations that handle protected health information (PHI) and have a [Business Associate Agreement (BAA)](https://support.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers) with Anthropic. It applies to Claude Code (local mode) and Cowork (local mode), and it restricts features in both products. - - "(local mode)" means a local session, not a session that runs in the cloud. Local sessions run in one of these places: - - * Claude Code in the terminal - * Claude Code in the Code tab of Claude Desktop - * Cowork in Claude Desktop - - The Claude Code extensions for VS Code and JetBrains aren't part of (local mode). They keep working with the HIPAA configuration applied, but your BAA doesn't cover them. See the [Implementation Guide](https://trust.anthropic.com/resources?s=l1wrssd9hsbi4gak0tp5a6\&name=%5Banthropic%5D-hipaa-ready-offering-implementation-guide) for the full list of Eligible Services. - +> [!NOTE] +> +> "(local mode)" means a local session, not a session that runs in the cloud. Local sessions run in one of these places: +> +> * Claude Code in the terminal +> * Claude Code in the Code tab of Claude Desktop +> * Cowork in Claude Desktop +> +> The Claude Code extensions for VS Code and JetBrains aren't part of (local mode). They keep working with the HIPAA configuration applied, but your BAA doesn't cover them. See the [Implementation Guide](https://trust.anthropic.com/resources?s=l1wrssd9hsbi4gak0tp5a6\&name=%5Banthropic%5D-hipaa-ready-offering-implementation-guide) for the full list of Eligible Services. This page is for the IT or security administrator who manages the macOS and Windows computers where members run [Cowork](/docs/cowork/overview) in Claude Desktop. Other readers start on a different page: @@ -72,42 +72,40 @@ The policy in this section is a sample that we recommend as a starting point. Yo The following sample sets four keys that you could add to the Claude Desktop policy your organization deploys. If your organization doesn't deploy one yet, [Enterprise configuration](https://support.claude.com/en/articles/12622667-enterprise-configuration) explains how to deliver a policy with your device management tool. - - - Add these keys to a configuration profile for the `com.anthropic.claudefordesktop` preference domain: - - ```xml theme={null} - forceLoginOrgUUID - xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx - isLocalDevMcpEnabled - false - isDesktopExtensionEnabled - false - otlpContentCapture - [] - ``` - - - - Write these values under `HKLM\SOFTWARE\Policies\Claude`: - - ```reg theme={null} - Windows Registry Editor Version 5.00 - - [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Claude] - "forceLoginOrgUUID"="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" - "isLocalDevMcpEnabled"="false" - "isDesktopExtensionEnabled"="false" - "otlpContentCapture"="[]" - ``` - - +**macOS** + +Add these keys to a configuration profile for the `com.anthropic.claudefordesktop` preference domain: + +```xml theme={null} +forceLoginOrgUUID +xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx +isLocalDevMcpEnabled +false +isDesktopExtensionEnabled +false +otlpContentCapture +[] +``` + +**Windows** + +Write these values under `HKLM\SOFTWARE\Policies\Claude`: + +```reg theme={null} +Windows Registry Editor Version 5.00 + +[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Claude] +"forceLoginOrgUUID"="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" +"isLocalDevMcpEnabled"="false" +"isDesktopExtensionEnabled"="false" +"otlpContentCapture"="[]" +``` The sample writes every value as a string, including `false` and `[]`. [Value types](/docs/third-party/claude-desktop/configuration#value-types) lists the other encodings Claude Desktop accepts. - - The Claude Desktop policy is separate from Claude Code's managed settings, which [also apply to Cowork](#check-which-claude-code-managed-settings-apply-in-cowork). - +> [!NOTE] +> +> The Claude Desktop policy is separate from Claude Code's managed settings, which [also apply to Cowork](#check-which-claude-code-managed-settings-apply-in-cowork). #### What each Claude Desktop key does @@ -122,12 +120,12 @@ The table shows what to set each key to and what Claude Desktop enforces for it. Cowork monitoring sends events to the OpenTelemetry collector that your organization sets up. When `otlpContentCapture` isn't set, those events can include prompt text, model responses, and tool inputs. - - Check these values before you deploy: - - * **`otlpContentCapture`**: write the two characters `[]`. Claude Desktop reads an empty string as if the key weren't set, and Cowork monitoring events can then include prompt text, model responses, and tool inputs. - * **`forceLoginOrgUUID`**: if you deploy a value that Claude Desktop can't read as an organization ID, nobody can use the app on that computer. Members see "Sign-in is blocked by this device’s configuration". - +> [!WARNING] +> +> Check these values before you deploy: +> +> * **`otlpContentCapture`**: write the two characters `[]`. Claude Desktop reads an empty string as if the key weren't set, and Cowork monitoring events can then include prompt text, model responses, and tool inputs. +> * **`forceLoginOrgUUID`**: if you deploy a value that Claude Desktop can't read as an organization ID, nobody can use the app on that computer. Members see "Sign-in is blocked by this device’s configuration". #### Confirm the Claude Desktop policy loaded @@ -194,52 +192,48 @@ Web search in Cowork follows your organization's web search setting. Applying th The `disabledBuiltinTools` key takes a list of tool names, written as a string: - - - Add the key to the profile for the `com.anthropic.claudefordesktop` preference domain: +**macOS** + +Add the key to the profile for the `com.anthropic.claudefordesktop` preference domain: - ```xml theme={null} - disabledBuiltinTools - ["WebSearch"] - ``` - +```xml theme={null} +disabledBuiltinTools +["WebSearch"] +``` - - Add the value under `HKLM\SOFTWARE\Policies\Claude`: +**Windows** - ```reg theme={null} - "disabledBuiltinTools"="[\"WebSearch\"]" - ``` - - +Add the value under `HKLM\SOFTWARE\Policies\Claude`: + +```reg theme={null} +"disabledBuiltinTools"="[\"WebSearch\"]" +``` After a member restarts Claude Desktop, Claude can't search the web in Cowork tasks or Code tab sessions on that computer. - - If you deploy a `disabledBuiltinTools` value that Claude Desktop can't read as a list, Claude Desktop turns off every built-in tool. - +> [!WARNING] +> +> If you deploy a `disabledBuiltinTools` value that Claude Desktop can't read as a list, Claude Desktop turns off every built-in tool. ## Confirm the HIPAA configuration in Claude Desktop Run this check on one managed computer after the Primary Owner applies the HIPAA configuration. - - - Applying the HIPAA configuration turns Cowork off for your organization. Ask an Owner to go to [**Organization settings > Cowork**](https://claude.ai/admin-settings/cowork) and turn on the **Enable for your organization** toggle. - +**1. Ask an Owner to turn Cowork back on** + +Applying the HIPAA configuration turns Cowork off for your organization. Ask an Owner to go to [**Organization settings > Cowork**](https://claude.ai/admin-settings/cowork) and turn on the **Enable for your organization** toggle. + +**2. Restart Claude Desktop** + +Quit Claude Desktop and open it again. + +**3. Check the title bar** - - Quit Claude Desktop and open it again. - +Confirm that the title bar shows a **HIPAA configured** label. On a Mac, open the sidebar to see it. - - Confirm that the title bar shows a **HIPAA configured** label. On a Mac, open the sidebar to see it. - +**4. Check your monitoring events** - - If your organization uses [Cowork monitoring](/docs/cowork/monitoring), run a Cowork task. Confirm that the events your collector receives contain no prompt text, model responses, or tool inputs. - - +If your organization uses [Cowork monitoring](/docs/cowork/monitoring), run a Cowork task. Confirm that the events your collector receives contain no prompt text, model responses, or tool inputs. The [HIPAA feature availability table](https://support.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers) lists which Cowork features are off with the HIPAA configuration applied, and which ones an Owner can turn back on. diff --git a/content/claude/cowork/monitoring.md b/content/claude/cowork/monitoring.md index 4503ee7814..5e56c501a3 100644 --- a/content/claude/cowork/monitoring.md +++ b/content/claude/cowork/monitoring.md @@ -8,9 +8,9 @@ Track Cowork usage and activity across your organization by exporting events through [OpenTelemetry](https://opentelemetry.io/) (OTel). Cowork exports events via the OTel logs/events protocol, giving you visibility into user prompts, model responses, API requests, tool usage, and errors. - - Monitoring is available for Team and Enterprise plans. OTel monitoring requires Claude desktop app version 1.1.4173 or later. - +> [!NOTE] +> +> Monitoring is available for Team and Enterprise plans. OTel monitoring requires Claude desktop app version 1.1.4173 or later. ## Setup @@ -30,9 +30,9 @@ Configure monitoring from the Cowork admin settings: 4. Start a new Cowork session — settings are loaded at session start, so existing sessions won't pick up the new configuration - - The OTel exporter runs inside the Cowork VM, so it is subject to the session's egress rules. If your organization restricts network egress, Cowork automatically adds your collector's hostname to the session's egress allowlist. You don't need to add it at **Admin settings > Capabilities > Network egress**. - +> [!NOTE] +> +> The OTel exporter runs inside the Cowork VM, so it is subject to the session's egress rules. If your organization restricts network egress, Cowork automatically adds your collector's hostname to the session's egress allowlist. You don't need to add it at **Admin settings > Capabilities > Network egress**. ## Events @@ -83,9 +83,9 @@ All events include these attributes: | `workspace.host_paths` | Paths of the folders the user connected to the task (string array) | | `terminal.type` | Terminal type (`non-interactive` for Cowork) | - - The account attributes — `organization.id`, `user.account_uuid`, `user.account_id`, and `user.email` — are populated from the user's Anthropic account, so they appear on first-party deployments only. On [third-party deployments](/docs/third-party/claude-desktop/overview) there is no Anthropic account and these attributes are absent; instead, the export carries the signed-in user's identity as the `enduser.id` resource attribute, described under [User attribution](/docs/third-party/claude-desktop/telemetry#user-attribution). The `process.owner` resource attribute (the operating-system login name) is standard OpenTelemetry process metadata and is present on all deployments. - +> [!NOTE] +> +> The account attributes — `organization.id`, `user.account_uuid`, `user.account_id`, and `user.email` — are populated from the user's Anthropic account, so they appear on first-party deployments only. On [third-party deployments](/docs/third-party/claude-desktop/overview) there is no Anthropic account and these attributes are absent; instead, the export carries the signed-in user's identity as the `enduser.id` resource attribute, described under [User attribution](/docs/third-party/claude-desktop/telemetry#user-attribution). The `process.owner` resource attribute (the operating-system login name) is standard OpenTelemetry process metadata and is present on all deployments. ### User prompt event @@ -222,9 +222,9 @@ The exported events support a range of analyses: **Performance monitoring** — Track API request durations and tool execution times to identify performance bottlenecks. - - Cost values from events are approximations. For official billing data, refer to your billing dashboard. - +> [!NOTE] +> +> Cost values from events are approximations. For official billing data, refer to your billing dashboard. ## Backend considerations diff --git a/content/claude/cowork/overview.md b/content/claude/cowork/overview.md index e9aff819a0..761e6db755 100644 --- a/content/claude/cowork/overview.md +++ b/content/claude/cowork/overview.md @@ -19,22 +19,20 @@ Cowork uses the same agentic architecture that powers Claude Code, accessible wi Cowork supports the same extensibility features available across Claude products: - - - Connect Claude to your tools and data sources using MCP. - - - - Teach Claude reusable workflows with custom instructions. - - - - Bundle skills, connectors, and more into shareable packages. - - - - Track usage and activity across your organization. - - +> **[Connectors](/docs/connectors/overview)** +> +> Connect Claude to your tools and data sources using MCP. + +> **[Skills](/docs/skills/overview)** +> +> Teach Claude reusable workflows with custom instructions. + +> **[Plugins](/docs/plugins/overview)** +> +> Bundle skills, connectors, and more into shareable packages. + +> **[Monitoring](/docs/cowork/monitoring)** +> +> Track usage and activity across your organization. You manage connectors, skills, and plugins from **Customize** in the sidebar. Cowork loads the ones enabled for your claude.ai account, synced at session start, and doesn't read the [Claude Code](https://code.claude.com/docs/en/skills) CLI's `~/.claude` directory on your machine. To use a skill or plugin that exists only in `~/.claude`, add it in **Customize**. diff --git a/content/claude/directory/publish.md b/content/claude/directory/publish.md index 29b143c2b1..a6f5b586db 100644 --- a/content/claude/directory/publish.md +++ b/content/claude/directory/publish.md @@ -12,12 +12,12 @@ This page is for developers who have built a plugin, or the MCP server behind on If you're ready to submit, open the [developer portal](https://claude.ai/directory/manage) or jump to [Start a submission in the developer portal](#start-a-submission-in-the-developer-portal). - - * If you're still deciding what goes in your plugin, see [Decide what to include in your plugin](/docs/connectors/building/what-to-build) - * If you want to build a small example plugin and submit it, see [Build your first plugin](/docs/plugins/quickstart) - * If you want to share a plugin without a public listing, use [your own marketplace](https://code.claude.com/docs/en/plugins/publish) for Claude Code or [roll it out to your whole organization](/docs/plugins/org-rollout) - * If you came here from [Claude Marketplace](https://claude.com/marketplace), the website where you browse plugins, connectors, partner products, and service partners, you're in the right place: there's no separate Claude Marketplace submission, and you submit to the directory instead - +> [!NOTE] +> +> * If you're still deciding what goes in your plugin, see [Decide what to include in your plugin](/docs/connectors/building/what-to-build) +> * If you want to build a small example plugin and submit it, see [Build your first plugin](/docs/plugins/quickstart) +> * If you want to share a plugin without a public listing, use [your own marketplace](https://code.claude.com/docs/en/plugins/publish) for Claude Code or [roll it out to your whole organization](/docs/plugins/org-rollout) +> * If you came here from [Claude Marketplace](https://claude.com/marketplace), the website where you browse plugins, connectors, partner products, and service partners, you're in the right place: there's no separate Claude Marketplace submission, and you submit to the directory instead ## Before you submit to the directory @@ -40,22 +40,20 @@ You submit and maintain listings in the developer portal at [claude.ai/directory To start a submission: - - - In the developer portal at [claude.ai/directory/manage](https://claude.ai/directory/manage), select **Submit new**. - +**1. Select Submit new** - - Under **What would you like to submit?**, choose **Plugin bundle** or **MCP connector**. - +In the developer portal at [claude.ai/directory/manage](https://claude.ai/directory/manage), select **Submit new**. - - Work through the checklist and submit pages for that kind: +**2. Choose the submission type** - * [Plugin pre-submission checklist](/docs/plugins/pre-submission-checklist), then [Submit a plugin](/docs/plugins/submit): for a plugin bundle - * [Connector pre-submission checklist](/docs/connectors/building/review-criteria), then [Submit a connector](/docs/connectors/building/submission): for an MCP connector - - +Under **What would you like to submit?**, choose **Plugin bundle** or **MCP connector**. + +**3. Follow the checklist and submit pages** + +Work through the checklist and submit pages for that kind: + +* [Plugin pre-submission checklist](/docs/plugins/pre-submission-checklist), then [Submit a plugin](/docs/plugins/submit): for a plugin bundle +* [Connector pre-submission checklist](/docs/connectors/building/review-criteria), then [Submit a connector](/docs/connectors/building/submission): for an MCP connector ## Submit your plugin, and your MCP server as a connector diff --git a/content/claude/directory/submission-status.md b/content/claude/directory/submission-status.md index 066798d820..c91b4e39be 100644 --- a/content/claude/directory/submission-status.md +++ b/content/claude/directory/submission-status.md @@ -10,9 +10,9 @@ After you submit to the directory, the developer portal at [claude.ai/directory/ This page is for anyone with a submission in the portal. Review time isn't fixed. - - If you haven't submitted yet, see [Publish to the directory](/docs/directory/publish). - +> [!NOTE] +> +> If you haven't submitted yet, see [Publish to the directory](/docs/directory/publish). Find your status in the table for your submission's kind: [plugin bundle](#plugin-bundle-statuses) or [MCP connector](#mcp-connector-statuses). If nothing is waiting on you and you still need an answer, see [Contact Anthropic about a submission](#contact-anthropic-about-a-submission). diff --git a/content/claude/extend/overview.md b/content/claude/extend/overview.md index 5b3da8292b..977700c6b2 100644 --- a/content/claude/extend/overview.md +++ b/content/claude/extend/overview.md @@ -10,31 +10,29 @@ You can customize Claude with [MCP connectors](/docs/connectors/getting-started) You add all three from the [**Customize**](https://claude.ai/customize) page in claude.ai or the Claude desktop app. [Plugin feature support across platforms](/docs/plugins/platform-support) lists which parts of a plugin work in chat, Cowork, and Claude Code. - - If you want to make a connector or plugin for other people to install, see [Build for Claude](/docs/build/overview). Anyone on a paid Claude plan can submit one to Anthropic's directory for review without applying to a partner program first; on Team and Enterprise, an Owner submits it. - +> [!NOTE] +> +> If you want to make a connector or plugin for other people to install, see [Build for Claude](/docs/build/overview). Anyone on a paid Claude plan can submit one to Anthropic's directory for review without applying to a partner program first; on Team and Enterprise, an Owner submits it. ## Choose plugins, connectors, or skills Each card below leads to the setup page for one of the three. The last card is for Owners who manage plugins for a Team or Enterprise organization. - - - Add a set of connectors, skills, and commands with one install, such as everything for one tool, or your team's standard setup. - +> **[Plugins](/docs/plugins/overview)** +> +> Add a set of connectors, skills, and commands with one install, such as everything for one tool, or your team's standard setup. - - Give Claude access to a tool or data source, such as your files, calendar, issue tracker, or an internal API. - +> **[MCP connectors](/docs/connectors/getting-started)** +> +> Give Claude access to a tool or data source, such as your files, calendar, issue tracker, or an internal API. - - Have Claude do a task a particular way, such as your release-note format, your contract checklist, or your weekly report. - +> **[Skills](/docs/skills/how-to)** +> +> Have Claude do a task a particular way, such as your release-note format, your contract checklist, or your weekly report. - - If you're an Owner on a Team or Enterprise plan, choose which plugins members can add, install some for everyone, and add your organization's own. - - +> **[Plugins for your organization](/docs/plugins/admin)** +> +> If you're an Owner on a Team or Enterprise plan, choose which plugins members can add, install some for everyone, and add your organization's own. ## Compare connectors, skills, and plugins @@ -46,9 +44,7 @@ When a plugin exists for a product you use, it bundles that product's connector The diagram shows where each of the three acts when you send one request. -Diagram read left to right. You ask in chat, Cowork, or Claude Code, and the request goes to Claude. A skill, written instructions with your steps, format, or checklist, feeds into Claude, which reads it when your request needs it. Claude calls a connector, a connection to the service's MCP server, which reads and acts in a service you use: your tools and data, such as files, calendar, chat, an issue tracker, internal APIs, and more. A dashed wrapper labeled plugin, optional, encloses the skill and the connector, captioned one package for both. - -Diagram read left to right. You ask in chat, Cowork, or Claude Code, and the request goes to Claude. A skill, written instructions with your steps, format, or checklist, feeds into Claude, which reads it when your request needs it. Claude calls a connector, a connection to the service's MCP server, which reads and acts in a service you use: your tools and data, such as files, calendar, chat, an issue tracker, internal APIs, and more. A dashed wrapper labeled plugin, optional, encloses the skill and the connector, captioned one package for both. +![Diagram read left to right. You ask in chat, Cowork, or Claude Code, and the request goes to Claude. A skill, written instructions with your steps, format, or checklist, feeds into Claude, which reads it when your request needs it. Claude calls a connector, a connection to the service's MCP server, which reads and acts in a service you use: your tools and data, such as files, calendar, chat, an issue tracker, internal APIs, and more. A dashed wrapper labeled plugin, optional, encloses the skill and the connector, captioned one package for both.](https://mintcdn.com/claude-ai/-njlLvrWxFCRdJVz/images/extend/how-connectors-skills-plugins-fit.svg?fit=max\&auto=format\&n=-njlLvrWxFCRdJVz\&q=85\&s=372738e15abde6a69704ebf43b5472f0) ## Where your connectors, skills, and plugins are available diff --git a/content/claude/government/account/overview.md b/content/claude/government/account/overview.md index d964aeff87..1912868568 100644 --- a/content/claude/government/account/overview.md +++ b/content/claude/government/account/overview.md @@ -16,27 +16,25 @@ Every user has access to this portal regardless of what role they hold. If you a ## What's here - -
refused managed settings for this account (403): Claude Code may not be enabled for your organization` | The **Claude Code** switch is off at a level that applies to the user (tenant, organization, or directory group) | Turn on the **Claude Code** switch under [Product availability](/docs/government/config/settings#product-availability) at that level (at the tenant level, **Reset to default** instead lets each organization's own switch decide), then have the user start Claude Code again. [**Compare config across levels**](/docs/government/config/overview#comparing-settings-across-levels) on the **Config** page shows which level turns it off for a user | | When it starts or right after sign-in, Claude Code exits with `Couldn't load settings from Cloud gateway
` | Claude Code could not reach the gateway while loading the organization's settings | Confirm the device reaches the gateway over HTTPS on port 443, then have the user start Claude Code again. If it persists on a connected device, contact your Anthropic representative | -| In a session that was working, every request fails with a 403 error saying the product is not available for the organization | The **Claude Code** switch was turned off while Claude Code was running | Turn the switch back on at the level that turned it off; the next request then succeeds | +| In a session that was working, every request fails with a 403 error saying Claude Code is not turned on for the organization | The **Claude Code** switch was turned off while Claude Code was running | Turn the switch back on at the level that turned it off; the next request then succeeds | | Before the user has signed in, Claude Code exits with `Administrator policy requires a Cloud gateway sign-in on this machine` | A credential from earlier use is present: `ANTHROPIC_API_KEY` or `ANTHROPIC_AUTH_TOKEN` in the environment, an `apiKeyHelper` in the user's settings, or a saved Claude Console key | Remove the variable or the `apiKeyHelper` entry, or have the user run `claude auth logout`, then start `claude` and sign in | | Claude Code says the gateway's TLS certificate changed and asks the user to run `/login` | The gateway certificate was renewed | Confirm the new fingerprint with your Anthropic representative, send it to users, and have them run `/login` and accept it | ## Things to know -* Only the gateway sign-in described on this page delivers the organization's settings to the Claude Code command-line tool. Once a user is signed in, those settings replace the Claude Code policy in these managed settings, hooks and permission rules included, apart from the two sign-in keys, any `env` variables the organization's settings leave unset, and the [keys Claude Code reads from every admin source](https://code.claude.com/docs/en/managed-settings#keys-read-from-every-admin-source). +* Only a gateway sign-in delivers the organization's settings to the Claude Code command-line tool. Once a user is signed in, those settings replace the Claude Code policy in these managed settings, hooks and permission rules included, apart from the two sign-in keys, any `env` variables the organization's settings leave unset, and the [keys Claude Code reads from every admin source](https://code.claude.com/docs/en/managed-settings#keys-read-from-every-admin-source). * A claude.ai sign-in left on a device from earlier use is ignored once these settings are in place. A leftover `ANTHROPIC_API_KEY`, `ANTHROPIC_AUTH_TOKEN`, `apiKeyHelper`, or saved Claude Console key is not: until the user has signed in through the gateway, Claude Code stops and asks for its removal, as [Troubleshooting](#troubleshooting) describes. +* A cloud provider selected earlier in a user's environment or Claude Code settings, such as Amazon Bedrock, still applies whenever Claude Code has no gateway sign-in for the user, for example before the first sign-in or after one expires: Claude Code then uses that provider instead of requiring the gateway sign-in. Remove that provider selection from devices you set up for Claude for Government. * Where the Claude Code extension for VS Code is used, have users remove an earlier claude.ai sign-in with `claude auth logout` or the extension's **Claude Code: Logout** command before they sign in through the gateway, not after: both commands clear every credential Claude Code has stored, the gateway sign-in included. * To take a device out of this setup, have its users sign out with `claude auth logout` before you remove the settings. * After sign-in, the organization's settings turn off the Claude Code settings that run a helper command (`apiKeyHelper`, `proxyAuthHelper`, `awsAuthRefresh`, `awsCredentialExport`, `gcpAuthRefresh`, `otelHeadersHelper`), wherever it is set. If your devices reach the network through a proxy that needs a helper command to authenticate, raise this with your Anthropic representative before you deploy. -* Claude Code connects to Claude for Government through a user's [sign-in](#sign-in) rather than an API key or service account. A CI pipeline or other unattended run therefore works only on a device where a user has signed in, until that sign-in ends. * With Claude for Government, the command-line tool has no access to Claude Code features that [require a claude.ai account](https://code.claude.com/docs/en/feature-availability#features-that-require-a-claude-subscription), such as cloud sessions, Remote Control, and routines. [Fast mode](https://code.claude.com/docs/en/fast-mode) isn't available either. * With these settings Claude Code does not check for or install updates in the background. Distribute new versions through your software deployment tooling, or have users run `claude update` (standard installer) or their package manager. * Code sessions inside Claude Desktop sign in through Claude Desktop, not through these settings, but the `env` block applies to them too. For the other settings that govern them on a device that also has these managed settings, see [Code in Claude Desktop](/docs/government/security/security-and-data-handling#code-in-claude-desktop). diff --git a/content/claude/government/deploy-desktop/configure.md b/content/claude/government/deploy-desktop/configure.md index 64677330a5..950bd6322c 100644 --- a/content/claude/government/deploy-desktop/configure.md +++ b/content/claude/government/deploy-desktop/configure.md @@ -75,91 +75,85 @@ The configuration that the app downloads for a user includes the following setti ## Configure a single machine - - \[1] This happens with any heavy task in Office, with +responding.[\[1\]](#cite-note-1) This happens with any heavy task in Office, with or without Claude. ## Office runs one step at a time Claude sends each step to Office and waits for Office to finish it. While -Office is busy, other actions can stall too.\[1] +Office is busy, other actions can stall too.[\[1\]](#cite-note-1) -Claude sends a step and waits. Office runs the step, for example a recalculation, a large read, or a big slide edit. At the wait limit, Claude reports a timeout, but Office is still running the step. The wait limit is 90 seconds for steps where Claude runs code, 5 minutes for other steps, and 2 minutes on the web. Stop and a timeout end Claude's wait, not the step Office already started. +![Claude sends a step and waits. Office runs the step, for example a recalculation, a large read, or a big slide edit. At the wait limit, Claude reports a timeout, but Office is still running the step. The wait limit is 90 seconds for steps where Claude runs code, 5 minutes for other steps, and 2 minutes on the web. Stop and a timeout end Claude's wait, not the step Office already started.](https://mintcdn.com/claude-ai/_Xjykq_jOPUQ7vjH/images/office-agents/performance/perf-one-step.png?fit=max\&auto=format\&n=_Xjykq_jOPUQ7vjH\&q=85\&s=86e807e77450672873ddcbd4e16578d3) Four habits reduce slowdowns. * **Let each step finish**: do not click, type, edit, run macros, or start a data refresh while Claude works. If a refresh is already running, wait for - it or stop it with Esc or Stop Refresh.\[2] If Office asks whether to - keep running the add-in, continue.\[3] + it or stop it with Esc or Stop Refresh.[\[2\]](#cite-note-2) If Office asks whether to + keep running the add-in, continue.[\[3\]](#cite-note-3) * **Give Claude only what the task needs**: name the sheet and range, or copy the sheets you need into a new workbook. * **Ask for large changes one step at a time**: split a big job into @@ -41,11 +41,11 @@ These limits come from Claude for M365 and from Office itself. | Wait for other steps, such as writing cells | 5 minutes on the desktop, 2 minutes on the web | A heavy step can time out | | Wait for a Word text edit | 30 seconds | A heavy edit can time out | | Cells returned by one Claude read in Excel | 2,000 cells with data | Claude reads a large sheet in several steps | -| Cells Office reads from one range | 5,000,000\[3] | A larger read can fail | -| One request in Excel on the web | 5 MB\[3] | Large reads and writes can fail on the web | -| Command batches waiting in Office | 50\[4] | More batches cause errors | -| Workbook opened in a browser | Up to 100 MB, depending on your subscription\[5] | Open larger files in Excel on the desktop | -| Memory for 32-bit Excel | Up to 4 GB on 64-bit Windows\[6] | Use 64-bit Office for large workbooks | +| Cells Office reads from one range | 5,000,000[\[3\]](#cite-note-3) | A larger read can fail | +| One request in Excel on the web | 5 MB[\[3\]](#cite-note-3) | Large reads and writes can fail on the web | +| Command batches waiting in Office | 50[\[4\]](#cite-note-4) | More batches cause errors | +| Workbook opened in a browser | Up to 100 MB, depending on your subscription[\[5\]](#cite-note-5) | Open larger files in Excel on the desktop | +| Memory for 32-bit Excel | Up to 4 GB on 64-bit Windows[\[6\]](#cite-note-6) | Use 64-bit Office for large workbooks | ## File size and risk @@ -54,7 +54,7 @@ This is how Claude for M365 detects an Office crash, a force quit, or a reload. Larger files also mean longer sessions. The chart is directional, based on what Claude for M365 usage shows. -Directional chart of risk by file size. In Excel, measured by total used cells across all sheets, risk is lowest under 1 million cells, higher from 1 to 5 million, and highest over 5 million. In PowerPoint, measured by slides, risk is lowest under 100 slides, higher from 100 to 199, and highest at 200 or more. The chart shows direction, not measured values. +![Directional chart of risk by file size. In Excel, measured by total used cells across all sheets, risk is lowest under 1 million cells, higher from 1 to 5 million, and highest over 5 million. In PowerPoint, measured by slides, risk is lowest under 100 slides, higher from 100 to 199, and highest at 200 or more. The chart shows direction, not measured values.](https://mintcdn.com/claude-ai/_Xjykq_jOPUQ7vjH/images/office-agents/performance/perf-risk.png?fit=max\&auto=format\&n=_Xjykq_jOPUQ7vjH\&q=85\&s=c018954e584a7b8fe3712b69b226f106) The risk rises steadily, without a sharp threshold. Treat the bands as guides. @@ -64,35 +64,35 @@ The risk rises steadily, without a sharp threshold. Treat the bands as guides. | PowerPoint, slides | Under 100 | 100 to 199 | 200 or more | To estimate the total for a workbook, go to each sheet and press Ctrl+End to -move to its last cell.\[7] Multiply the number of the last row by the +move to its last cell.[\[7\]](#cite-note-7) Multiply the number of the last row by the number of the last column, then add the results for all sheets. A last cell of Z100000 is column 26 and row 100,000, about 2.6 million cells. Formatting on empty cells moves the last cell, so a sheet can count as larger than its -data.\[7] +data.[\[7\]](#cite-note-7) A single sheet above 5 million cells also passes the limit for one Office -read.\[3] +read.[\[3\]](#cite-note-3) ## Limit what is open at once Workbooks that you open in the same instance of Excel share one Excel -process, and each workbook has its own Claude pane.\[8] Every pane +process, and each workbook has its own Claude pane.[\[8\]](#cite-note-8) Every pane sends its commands to that process. Office queues the command batches it -receives, up to 50 at a time.\[4] When the computer is short of CPU +receives, up to 50 at a time.[\[4\]](#cite-note-4) When the computer is short of CPU or memory, the wait grows, and Excel can stall or crash. -One Excel process contains three workbooks, each with its own Claude pane. The commands from all three panes go into a single command queue in the same process. The process runs on a computer with limited CPU and memory. When CPU and memory run short, waits grow and Excel can stall or crash. Keep only the files you need open. +![One Excel process contains three workbooks, each with its own Claude pane. The commands from all three panes go into a single command queue in the same process. The process runs on a computer with limited CPU and memory. When CPU and memory run short, waits grow and Excel can stall or crash. Keep only the files you need open.](https://mintcdn.com/claude-ai/_Xjykq_jOPUQ7vjH/images/office-agents/performance/perf-shared-process.png?fit=max\&auto=format\&n=_Xjykq_jOPUQ7vjH\&q=85\&s=524e1317ae5b08f66fe51b4dcf8373ae) Other Office apps run in their own processes, but they share the same CPU and memory. Office starts to monitor add-in memory when the device passes 80% -memory use.\[3] +memory use.[\[3\]](#cite-note-3) * Close the files you are not working in. * For large files, work in one file at a time. * When Claude works across Office apps, ask it to finish in one app before it moves to the next. See [Work across M365 apps](/docs/office-agents/work-across-apps). * If Excel runs out of memory with several workbooks open, open Excel in a new - instance.\[8] + instance.[\[8\]](#cite-note-8) ## Lighter files respond faster @@ -105,16 +105,16 @@ Excel has built-in tools that show what makes a workbook heavy. | Task | Where in Excel | | - | - | -| See counts of cells, formulas, and objects | Review, Workbook Statistics\[9] | -| Remove formatting from empty cells | Review, Check Performance\[10] | -| Find hidden shapes and pictures | Home, Find & Select, Selection Pane\[11] | +| See counts of cells, formulas, and objects | Review, Workbook Statistics[\[9\]](#cite-note-9) | +| Remove formatting from empty cells | Review, Check Performance[\[10\]](#cite-note-10) | +| Find hidden shapes and pictures | Home, Find & Select, Selection Pane[\[11\]](#cite-note-11) | Save a copy of the workbook before you run Check Performance. It removes formatting from cells that look empty, including cells used for pixel -art.\[10] +art.[\[10\]](#cite-note-10) If the workbook is still too large, copy the sheets you need into a new -workbook.\[11] +workbook.[\[11\]](#cite-note-11) ### Ask for formulas that calculate fast @@ -122,60 +122,58 @@ Some formulas make Excel recalculate far more cells than others. Ask Claude for these forms. * **Conditional sums and counts**: SUMIFS, COUNTIFS, and AVERAGEIFS. They - calculate much faster than array formulas.\[12] + calculate much faster than array formulas.[\[12\]](#cite-note-12) * **Today's date**: TODAY in one cell, with other cells that refer to - it.\[11] + it.[\[11\]](#cite-note-11) * **Direct references**: cell references in place of OFFSET and INDIRECT, - which recalculate at each recalculation.\[13] + which recalculate at each recalculation.[\[13\]](#cite-note-13) ### Pause calculation during large changes Excel recalculates dependent formulas after every change. For large formula changes, pause recalculation until Claude is done. - - - On the Formulas tab, select Calculation Options, Manual.\[14] - The option Automatic except for Data Tables skips only data tables. - Ordinary formulas still recalculate after every change. - - - - Claude writes the formulas without a recalculation after each one. - - - - Press F9 when Claude is done. In Manual mode, formula results stay out of - date until you press F9. - - - - Ask Claude to verify the formulas after the recalculation. - - - - Select Calculation Options, Automatic. - - - - - Manual calculation applies to every open workbook in Excel on the desktop.\[15] - In Excel on the web it applies only to the current workbook. In Manual mode, - saving can recalculate the workbook.\[14] - +**1. Set calculation to manual** + +On the Formulas tab, select Calculation Options, Manual.[\[14\]](#cite-note-14) +The option Automatic except for Data Tables skips only data tables. +Ordinary formulas still recalculate after every change. + +**2. Ask Claude for the changes** + +Claude writes the formulas without a recalculation after each one. + +**3. Recalculate** + +Press F9 when Claude is done. In Manual mode, formula results stay out of +date until you press F9. + +**4. Check the results** + +Ask Claude to verify the formulas after the recalculation. + +**5. Turn automatic calculation back on** + +Select Calculation Options, Automatic. + +> [!NOTE] +> +> Manual calculation applies to every open workbook in Excel on the desktop.[\[15\]](#cite-note-15) +> In Excel on the web it applies only to the current workbook. In Manual mode, +> saving can recalculate the workbook.[\[14\]](#cite-note-14) ### Make large presentations lighter -Large pictures and media make a presentation larger.\[16] Compress them +Large pictures and media make a presentation larger.[\[16\]](#cite-note-16) Compress them before you ask Claude for large changes. | Task | Where in PowerPoint | | - | - | -| Compress pictures | Picture Format, Compress Pictures, with "Apply only to this picture" cleared\[16] | -| Compress audio and video | File, Info, Compress Media, in PowerPoint on Windows\[17] | +| Compress pictures | Picture Format, Compress Pictures, with "Apply only to this picture" cleared[\[16\]](#cite-note-16) | +| Compress audio and video | File, Info, Compress Media, in PowerPoint on Windows[\[17\]](#cite-note-17) | Save a copy of the presentation before you compress. Deleting cropped picture -areas and discarding editing data cannot be undone.\[16] +areas and discarding editing data cannot be undone.[\[16\]](#cite-note-16) Ask Claude to change a few slides at a time. @@ -187,27 +185,25 @@ Use this table when Office stops responding during a request. | - | - | | Claude waits on a step | Wait. Do not click repeatedly. | | Claude reports a timeout | Wait until Office responds, save, then ask for a smaller step. The step can still be running in Office. | -| Office closes | Reopen the file and look for the Document Recovery pane.\[18] Start a new chat with a smaller request. | +| Office closes | Reopen the file and look for the Document Recovery pane.[\[18\]](#cite-note-18) Start a new chat with a smaller request. | | It happens often | Send your IT admin the transcript and the time of the problem. | When something goes wrong, keep your work and the chat for your admin. - - - Reopen the app and look for the Document Recovery pane.\[18] - In Excel, you can also go to File, Info, Manage Document, Recover Unsaved - Workbooks.\[19] - +**1. Recover your work** + +Reopen the app and look for the Document Recovery pane.[\[18\]](#cite-note-18) +In Excel, you can also go to File, Info, Manage Document, Recover Unsaved +Workbooks.[\[19\]](#cite-note-19) + +**2. Download the chat** + +In the Claude pane, select More options, then Download Transcript. - - In the Claude pane, select More options, then Download Transcript. - +**3. Send it to IT** - - Send the file and the time of the problem through your usual support - channel. The file contains your chat. - - +Send the file and the time of the problem through your usual support +channel. The file contains your chat. ## Investigate a crash or hang @@ -215,7 +211,7 @@ Windows, Office, and Claude each keep a record of what happened. Start with the time of the problem, then check the records below in order. The Windows and Office records exist on Windows only. -Four sources of records, in order. First, the user: the time of the problem, which is the key to every record, and the transcript of what Claude was doing. Second, Windows only: Reliability Monitor with a daily crash and hang timeline, Event Viewer with event 1000 for a crash and 1002 for a hang, and Windows Error Reporting files for crashes and hangs. Third, Office: the Telemetry Log with add-in CPU and error events, which stays off until an admin enables it. Fourth, your collector: an OpenTelemetry trace for every user turn. +![Four sources of records, in order. First, the user: the time of the problem, which is the key to every record, and the transcript of what Claude was doing. Second, Windows only: Reliability Monitor with a daily crash and hang timeline, Event Viewer with event 1000 for a crash and 1002 for a hang, and Windows Error Reporting files for crashes and hangs. Third, Office: the Telemetry Log with add-in CPU and error events, which stays off until an admin enables it. Fourth, your collector: an OpenTelemetry trace for every user turn.](https://mintcdn.com/claude-ai/_Xjykq_jOPUQ7vjH/images/office-agents/performance/perf-where-to-look.png?fit=max\&auto=format\&n=_Xjykq_jOPUQ7vjH\&q=85\&s=d62ef0be87cdd199fb375df256ef2642) ### Collect the user's report @@ -230,7 +226,7 @@ started. Reliability Monitor shows a daily timeline of app crashes and hangs. Use it to confirm that the problem happened and to see how often it repeats. -Press Windows+R and run this command.\[20] +Press Windows+R and run this command.[\[20\]](#cite-note-20) ```text theme={null} perfmon /rel @@ -243,13 +239,13 @@ Windows Logs, then Application. Look for events from `EXCEL.EXE`, `POWERPNT.EXE`, `WINWORD.EXE`, or `OUTLOOK.EXE` near the time of the problem. -* **Event 1000**: a crash. The event names the faulting module.\[21] -* **Event 1002**: a hang.\[22] +* **Event 1000**: a crash. The event names the faulting module.[\[21\]](#cite-note-21) +* **Event 1002**: a hang.[\[22\]](#cite-note-22) ### Find Windows Error Reporting files Windows Error Reporting keeps a report for each crash or hang. The reports -are in one of two folders.\[23] +are in one of two folders.[\[23\]](#cite-note-23) The folder for the signed-in user: @@ -266,9 +262,9 @@ C:\ProgramData\Microsoft\Windows\WER\ReportArchive ### Check the Office Telemetry Log The Office Telemetry Log can list add-in CPU and runtime error -events.\[24] It records events only after you turn on the -`EnableLogging` policy.\[25] Microsoft no longer supports the -Office Telemetry Dashboard but keeps the log.\[26] +events.[\[24\]](#cite-note-24) It records events only after you turn on the +`EnableLogging` policy.[\[25\]](#cite-note-25) Microsoft no longer supports the +Office Telemetry Dashboard but keeps the log.[\[26\]](#cite-note-26) After you turn on the policy, open this folder: @@ -287,30 +283,30 @@ Search your collector for traces at the time of the problem. See Microsoft documentation for the limits, steps, and file locations on this page.
    -
  1. ↑ a b “Excel not responding, hangs, freezes or stops working”. Microsoft Support. “If you try to perform other actions while Excel is in use, Excel may not respond.” The page also lists whole-column references, many hidden objects, excessive styles, and large numbers of shapes as causes of slowness.
    2. -
  2. ↑ “Refresh an external data connection in Excel”. Microsoft Support.
    3. -
  3. ↑ a b c d e “Resource limits and performance optimization for Office Add-ins”. Microsoft Learn.
    4. -
  4. ↑ a b “Avoid using the context.sync method in loops”. Microsoft Learn. “Office supports no more than 50 batch jobs in the queue. Any more triggers errors.”
    5. -
  5. ↑ “File size limits for workbooks in SharePoint”. Microsoft Support.
    6. -
  6. ↑ “Large Address Aware capability change for Excel”. Microsoft Learn.
    7. -
  7. ↑ a b “Locate and reset the last cell on a worksheet”. Microsoft Support.
    8. -
  8. ↑ a b “Tips for improving Excel's performance”. Microsoft Support. The page advises opening Excel in a new instance when several workbooks in one instance run out of memory.
    9. -
  9. ↑ “Check Workbook Statistics”. Microsoft Support.
    10. -
  10. ↑ a b “Cleanup cells in your workbook”. Microsoft Support.
    11. -
  11. ↑ a b c “Clean up an Excel workbook so that it uses less memory”. Microsoft Learn.
    12. -
  12. ↑ “Excel performance: Tips for optimizing performance obstructions”. Microsoft Learn. “You should always use the SUMIFS, COUNTIFS, and AVERAGEIFS functions instead of array formulas where you can because they are much faster to calculate.”
    13. -
  13. ↑ “Excel performance: Improving calculation performance”. Microsoft Learn. “A volatile function is always recalculated at each recalculation even if it does not seem to have any changed precedents.”
    14. -
  14. ↑ a b “Change formula recalculation, iteration, or precision in Excel”. Microsoft Support. The page covers the Manual and Automatic except for Data Tables options, the desktop and web scope, and the "Recalculate workbook before saving" setting that Manual turns on.
    15. -
  15. ↑ “How Excel determines the current mode of calculation”. Microsoft Learn. “Changing the calculation mode of one open document changes the mode for all open documents.”
    16. -
  16. ↑ a b c “Reduce the file size of your PowerPoint presentations”. Microsoft Support. “if you delete the cropped picture data, you won't be able to restore it.” Discarding editing data also cannot be restored.
    17. -
  17. ↑ “Compress your media files”. Microsoft Support.
    18. -
  18. ↑ a b “Help protect your files in case of a crash”. Microsoft Support.
    19. -
  19. ↑ “Recover an earlier version of an Office file”. Microsoft Support.
    20. -
  20. ↑ “perfmon”. Microsoft Learn. “/rel | Starts the Reliability Monitor.”
    21. -
  21. ↑ “Troubleshoot application or service crashing behavior”. Microsoft Learn. “The Event ID 1000 with the Error level is the actual application crashing event.”
    22. -
  22. ↑ “Excel freeze: Application Hang error”. Microsoft Q\&A. This is a community answer. Microsoft has no official page that names event 1002.
    23. -
  23. ↑ “Troubleshooting a failover cluster using Windows Error Reporting”. Microsoft Learn. “Windows Error Reporting Reports are stored in %ProgramData%\Microsoft\Windows\WER”. The per-user folder comes from “Windows Error Reporting (WER) for developers”. Microsoft Learn, archived. “The reports are usually saved at %localAppData%\Microsoft\Windows\WER”.
    24. -
  24. ↑ “Troubleshooting Office files and custom solutions with the telemetry log”. Microsoft Learn. , which lists the add-in events "Add-in used too much CPU" and "Add-in encountered runtime error".
    25. -
  25. ↑ “Deploy Office Telemetry Dashboard”. Microsoft Learn. “By default, data collection is disabled in Office.” The page gives the %localappdata%\Microsoft\Office\16.0\Telemetry path and the EnableLogging setting.
    26. -
  26. ↑ “Removal of Office Telemetry Dashboard from Microsoft 365 Apps for enterprise”. Microsoft Learn. “Office Telemetry Log isn't being removed and is still available on client devices running Windows.”
    27. +
  27. ↑ [a](#cite-ref-1-a) [b](#cite-ref-1-b) “[Excel not responding, hangs, freezes or stops working](https://support.microsoft.com/en-us/excel/excel-not-responding-hangs-freezes-or-stops-working)”. *Microsoft Support*. “If you try to perform other actions while Excel is in use, Excel may not respond.” The page also lists whole-column references, many hidden objects, excessive styles, and large numbers of shapes as causes of slowness.
    28. +
  28. [↑](#cite-ref-2) “[Refresh an external data connection in Excel](https://support.microsoft.com/en-us/office/refresh-an-external-data-connection-in-excel-1524175f-777a-48fc-8fc7-c8514b984440)”. *Microsoft Support*.
    29. +
  29. ↑ [a](#cite-ref-3-a) [b](#cite-ref-3-b) [c](#cite-ref-3-c) [d](#cite-ref-3-d) [e](#cite-ref-3-e) “[Resource limits and performance optimization for Office Add-ins](https://learn.microsoft.com/en-us/office/dev/add-ins/concepts/resource-limits-and-performance-optimization)”. *Microsoft Learn*.
    30. +
  30. ↑ [a](#cite-ref-4-a) [b](#cite-ref-4-b) “[Avoid using the context.sync method in loops](https://learn.microsoft.com/en-us/office/dev/add-ins/concepts/correlated-objects-pattern)”. *Microsoft Learn*. “Office supports no more than 50 batch jobs in the queue. Any more triggers errors.”
    31. +
  31. [↑](#cite-ref-5) “[File size limits for workbooks in SharePoint](https://support.microsoft.com/en-us/office/file-size-limits-for-workbooks-in-sharepoint-9e5bc6f8-018f-415a-b890-5452687b325e)”. *Microsoft Support*.
    32. +
  32. [↑](#cite-ref-6) “[Large Address Aware capability change for Excel](https://learn.microsoft.com/en-us/troubleshoot/microsoft-365-apps/excel/laa-capability-change)”. *Microsoft Learn*.
    33. +
  33. ↑ [a](#cite-ref-7-a) [b](#cite-ref-7-b) “[Locate and reset the last cell on a worksheet](https://support.microsoft.com/en-us/excel/locate-and-reset-the-last-cell-on-a-worksheet)”. *Microsoft Support*.
    34. +
  34. ↑ [a](#cite-ref-8-a) [b](#cite-ref-8-b) “[Tips for improving Excel's performance](https://support.microsoft.com/en-us/excel/tips-for-improving-excel-s-performance)”. *Microsoft Support*. The page advises opening Excel in a new instance when several workbooks in one instance run out of memory.
    35. +
  35. [↑](#cite-ref-9) “[Check Workbook Statistics](https://support.microsoft.com/en-us/office/check-workbook-statistics-afa12d4b-9584-4826-99a8-33228467e006)”. *Microsoft Support*.
    36. +
  36. ↑ [a](#cite-ref-10-a) [b](#cite-ref-10-b) “[Cleanup cells in your workbook](https://support.microsoft.com/en-us/office/cleanup-cells-in-your-workbook-edcc579f-b82f-495b-8d31-e786cd11717b)”. *Microsoft Support*.
    37. +
  37. ↑ [a](#cite-ref-11-a) [b](#cite-ref-11-b) [c](#cite-ref-11-c) “[Clean up an Excel workbook so that it uses less memory](https://learn.microsoft.com/en-us/troubleshoot/microsoft-365-apps/excel/clean-workbook-less-memory)”. *Microsoft Learn*.
    38. +
  38. [↑](#cite-ref-12) “[Excel performance: Tips for optimizing performance obstructions](https://learn.microsoft.com/en-us/office/vba/excel/concepts/excel-performance/excel-tips-for-optimizing-performance-obstructions)”. *Microsoft Learn*. “You should always use the SUMIFS, COUNTIFS, and AVERAGEIFS functions instead of array formulas where you can because they are much faster to calculate.”
    39. +
  39. [↑](#cite-ref-13) “[Excel performance: Improving calculation performance](https://learn.microsoft.com/en-us/office/vba/excel/concepts/excel-performance/excel-improving-calculation-performance)”. *Microsoft Learn*. “A volatile function is always recalculated at each recalculation even if it does not seem to have any changed precedents.”
    40. +
  40. ↑ [a](#cite-ref-14-a) [b](#cite-ref-14-b) “[Change formula recalculation, iteration, or precision in Excel](https://support.microsoft.com/en-us/office/change-formula-recalculation-iteration-or-precision-in-excel-73fc7dac-91cf-4d36-86e8-67124f6bcce4)”. *Microsoft Support*. The page covers the Manual and Automatic except for Data Tables options, the desktop and web scope, and the "Recalculate workbook before saving" setting that Manual turns on.
    41. +
  41. [↑](#cite-ref-15) “[How Excel determines the current mode of calculation](https://learn.microsoft.com/en-us/troubleshoot/microsoft-365-apps/excel/current-mode-of-calculation)”. *Microsoft Learn*. “Changing the calculation mode of one open document changes the mode for all open documents.”
    42. +
  42. ↑ [a](#cite-ref-16-a) [b](#cite-ref-16-b) [c](#cite-ref-16-c) “[Reduce the file size of your PowerPoint presentations](https://support.microsoft.com/en-us/powerpoint/reduce-the-file-size-of-your-powerpoint-presentations)”. *Microsoft Support*. “if you delete the cropped picture data, you won't be able to restore it.” Discarding editing data also cannot be restored.
    43. +
  43. [↑](#cite-ref-17) “[Compress your media files](https://support.microsoft.com/en-us/powerpoint/compress-your-media-files)”. *Microsoft Support*.
    44. +
  44. ↑ [a](#cite-ref-18-a) [b](#cite-ref-18-b) “[Help protect your files in case of a crash](https://support.microsoft.com/en-us/office/collab-files/help-protect-your-files-in-case-of-a-crash)”. *Microsoft Support*.
    45. +
  45. [↑](#cite-ref-19) “[Recover an earlier version of an Office file](https://support.microsoft.com/en-us/office/collab-files/recover-an-earlier-version-of-an-office-file)”. *Microsoft Support*.
    46. +
  46. [↑](#cite-ref-20) “[perfmon](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/perfmon)”. *Microsoft Learn*. “/rel | Starts the Reliability Monitor.”
    47. +
  47. [↑](#cite-ref-21) “[Troubleshoot application or service crashing behavior](https://learn.microsoft.com/en-us/troubleshoot/windows-server/performance/troubleshoot-application-service-crashing-behavior)”. *Microsoft Learn*. “The Event ID 1000 with the Error level is the actual application crashing event.”
    48. +
  48. [↑](#cite-ref-22) “[Excel freeze: Application Hang error](https://learn.microsoft.com/en-us/answers/questions/5132051/excel-freeze-application-hang-error)”. *Microsoft Q\&A*. This is a community answer. Microsoft has no official page that names event 1002.
    49. +
  49. [↑](#cite-ref-23) “[Troubleshooting a failover cluster using Windows Error Reporting](https://learn.microsoft.com/en-us/windows-server/failover-clustering/troubleshooting-using-wer-reports)”. *Microsoft Learn*. “Windows Error Reporting Reports are stored in %ProgramData%\Microsoft\Windows\WER”. The per-user folder comes from “[Windows Error Reporting (WER) for developers](https://learn.microsoft.com/en-us/archive/blogs/oanapl/windows-error-reporting-wer-for-developers)”. *Microsoft Learn, archived*. “The reports are usually saved at %localAppData%\Microsoft\Windows\WER”.
    50. +
  50. [↑](#cite-ref-24) “[Troubleshooting Office files and custom solutions with the telemetry log](https://learn.microsoft.com/en-us/office/client-developer/shared/troubleshooting-office-files-and-custom-solutions-with-the-telemetry-log)”. *Microsoft Learn*. , which lists the add-in events "Add-in used too much CPU" and "Add-in encountered runtime error".
    51. +
  51. [↑](#cite-ref-25) “[Deploy Office Telemetry Dashboard](https://learn.microsoft.com/en-us/office/compatibility/deploy-telemetry-dashboard)”. *Microsoft Learn*. “By default, data collection is disabled in Office.” The page gives the `%localappdata%\Microsoft\Office\16.0\Telemetry` path and the `EnableLogging` setting.
    52. +
  52. [↑](#cite-ref-26) “[Removal of Office Telemetry Dashboard from Microsoft 365 Apps for enterprise](https://learn.microsoft.com/en-us/office/compatibility/telemetry-dashboard-removal)”. *Microsoft Learn*. “Office Telemetry Log isn't being removed and is still available on client devices running Windows.”
diff --git a/content/claude/office-agents/powerpoint.md b/content/claude/office-agents/powerpoint.md index 8090b622ab..92af2480e6 100644 --- a/content/claude/office-agents/powerpoint.md +++ b/content/claude/office-agents/powerpoint.md @@ -11,10 +11,10 @@ Build decks from scratch, edit specific slides without regenerating everything, convert bullets into diagrams and native charts, and iterate on feedback while preserving template compliance. - - Claude for PowerPoint is generally available to Pro, Max, - Team, and Enterprise plans. - +> [!NOTE] +> +> Claude for PowerPoint is generally available to Pro, Max, +> Team, and Enterprise plans. ## What you can do @@ -41,101 +41,95 @@ Claude for PowerPoint runs on the following PowerPoint builds. ### Install for yourself - - - Go to the [Claude for Microsoft 365 listing on Microsoft AppSource](https://marketplace.microsoft.com/en-us/product/office/WA200010725?tab=Overview). - +**1. Open the marketplace listing** - - Select "Get it now" to install. - +Go to the [Claude for Microsoft 365 listing on Microsoft AppSource](https://marketplace.microsoft.com/en-us/product/office/WA200010725?tab=Overview). - - Open PowerPoint, activate the add-in, and sign in with your Claude - account. - - +**2. Install the add-in** + +Select "Get it now" to install. + +**3. Sign in** + +Open PowerPoint, activate the add-in, and sign in with your Claude +account. ### Deploy to your organization Organization admins can deploy Claude for PowerPoint through the Microsoft 365 Admin Center. - - - In the [Microsoft 365 Admin Center](https://admin.microsoft.com), go - to Settings, Org Settings, User owned apps and services, and turn on - ["Let users access the Office Store"](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-addins-in-the-admin-center). - - - - Go to Settings, Integrated apps, Add-ins. - - - - Search for "Claude for Microsoft 365" in Microsoft AppSource. - - - - Assign the add-in to your organization or to specific users or - groups. Share [Microsoft's deployment guide](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-deployment-of-add-ins) - with your team for activation steps. - - - - - If your organization uses Microsoft Entra Privileged Identity - Management (PIM) for admin roles, the Integrated apps page does not - recognize roles activated through PIM, so deployment fails. This is a - [known Microsoft issue](https://learn.microsoft.com/en-us/office/dev/add-ins/resources/resources-office-add-in-known-issues), - tracking ID 11126536. To work around it, deploy from an admin account - with the required role assigned as permanently active rather than - PIM-eligible. See - [Microsoft's troubleshooting guidance](https://learn.microsoft.com/en-us/troubleshoot/microsoft-365/admin/miscellaneous/cannot-deploy-add-in-integrated-apps-menu). - Individual users can still - [install the add-in themselves](#install-for-yourself). - +**1. Allow Office Store access** + +In the [Microsoft 365 Admin Center](https://admin.microsoft.com), go +to Settings, Org Settings, User owned apps and services, and turn on +["Let users access the Office Store"](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-addins-in-the-admin-center). + +**2. Open Integrated apps** + +Go to Settings, Integrated apps, Add-ins. + +**3. Find the add-in** + +Search for "Claude for Microsoft 365" in Microsoft AppSource. + +**4. Deploy** + +Assign the add-in to your organization or to specific users or +groups. Share [Microsoft's deployment guide](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-deployment-of-add-ins) +with your team for activation steps. + +> [!NOTE] +> +> If your organization uses Microsoft Entra Privileged Identity +> Management (PIM) for admin roles, the Integrated apps page does not +> recognize roles activated through PIM, so deployment fails. This is a +> [known Microsoft issue](https://learn.microsoft.com/en-us/office/dev/add-ins/resources/resources-office-add-in-known-issues), +> tracking ID 11126536. To work around it, deploy from an admin account +> with the required role assigned as permanently active rather than +> PIM-eligible. See +> [Microsoft's troubleshooting guidance](https://learn.microsoft.com/en-us/troubleshoot/microsoft-365/admin/miscellaneous/cannot-deploy-add-in-integrated-apps-menu). +> Individual users can still +> [install the add-in themselves](#install-for-yourself). After deployment, users can activate the Claude add-in from Tools, Add-ins on Mac or Home, Add-ins on Windows, sign in, and start working. - - Organizations that have disabled "Let users access the Office Store" may - find that admin-deployed add-ins don't appear for users. To work around - this, deploy using the manifest XML file described below. - +> [!WARNING] +> +> Organizations that have disabled "Let users access the Office Store" may +> find that admin-deployed add-ins don't appear for users. To work around +> this, deploy using the manifest XML file described below. ### Deploy with a custom manifest For IT administrators deploying to multiple users when the Office Store is disabled: - - - Download the [custom manifest XML file](https://pivot.claude.ai/manifest-powerpoint.xml) - and save it to a secure location. - - - - Go to [https://admin.microsoft.com](https://admin.microsoft.com), - sign in, and open Settings, Integrated apps. - - - - Select "Upload custom apps", choose "Office Add-in", then - "I have a manifest file on this device". Upload the manifest. - - - - Choose entire organization, specific users, specific groups, or just - yourself for admin testing. - - - - Review settings and select "Deploy". The add-in is available within - minutes. Full organization rollout can take up to 24 hours. - - +**1. Download the manifest** + +Download the [custom manifest XML file](https://pivot.claude.ai/manifest-powerpoint.xml) +and save it to a secure location. + +**2. Open the Admin Center** + +Go to [https://admin.microsoft.com](https://admin.microsoft.com), +sign in, and open Settings, Integrated apps. + +**3. Upload the custom add-in** + +Select "Upload custom apps", choose "Office Add-in", then +"I have a manifest file on this device". Upload the manifest. + +**4. Assign users** + +Choose entire organization, specific users, specific groups, or just +yourself for admin testing. + +**5. Deploy** + +Review settings and select "Deploy". The add-in is available within +minutes. Full organization rollout can take up to 24 hours. After deployment, users see Claude in PowerPoint's Home ribbon and sign in with their Claude credentials on first use. @@ -298,11 +292,11 @@ The add-in does not run on these PowerPoint versions. ## Prompt injection risk - - Only use Claude for PowerPoint with trusted files. Files from external - sources can contain hidden instructions that manipulate the add-in into - extracting data, modifying records, or performing destructive actions. - +> [!WARNING] +> +> Only use Claude for PowerPoint with trusted files. Files from external +> sources can contain hidden instructions that manipulate the add-in into +> extracting data, modifying records, or performing destructive actions. External files such as downloaded templates, vendor files, collaborative documents, and data imports can contain prompt injections that try to trick diff --git a/content/claude/office-agents/third-party-platforms.md b/content/claude/office-agents/third-party-platforms.md index e37cc3a66f..20f12e2848 100644 --- a/content/claude/office-agents/third-party-platforms.md +++ b/content/claude/office-agents/third-party-platforms.md @@ -51,12 +51,12 @@ The add-in requires access to specific domains. The required domains differ depending on whether your organization uses the Anthropic API directly (1P) or a third-party platform (3P). - - In all configurations, prompts and responses travel only to your chosen - inference provider. Domains pointing to Anthropic (such as - `pivot.claude.ai`) serve the add-in's interface, feature configuration, - and operational telemetry, not prompt or response content. - +> [!NOTE] +> +> In all configurations, prompts and responses travel only to your chosen +> inference provider. Domains pointing to Anthropic (such as +> `pivot.claude.ai`) serve the add-in's interface, feature configuration, +> and operational telemetry, not prompt or response content. ### Anthropic API (1P) @@ -184,11 +184,11 @@ The wizard walks you through the path you chose: When complete, the add-in is ready for tenant-wide deployment. - - Bedrock and Vertex AI paths require Node.js for manifest generation and - validation. The wizard checks for it and prompts installation if - missing. - +> [!NOTE] +> +> Bedrock and Vertex AI paths require Node.js for manifest generation and +> validation. The wizard checks for it and prompts installation if +> missing. ### Available commands @@ -235,9 +235,7 @@ attributes, then manifest parameters. Per-user attributes override the manifest defaults, so one deployed manifest can serve teams with different settings. - - The add-in resolves each configuration key from a bootstrap endpoint, then Entra ID extension attributes, then manifest parameters. - +![The add-in resolves each configuration key from a bootstrap endpoint, then Entra ID extension attributes, then manifest parameters.](https://mintcdn.com/claude-ai/-4jzPa4NasvobarI/images/office-agents/architecture/config-discovery.png?fit=max\&auto=format\&n=-4jzPa4NasvobarI\&q=85\&s=b6c750272cf3ad9765ec2563af436806) ### Keep credentials out of the manifest URL query string @@ -317,35 +315,33 @@ application with the same delegated Graph permissions and provide its client ID to the setup wizard as `graph_client_id`. See [Use your own Entra app instead](/docs/office-agents/outlook#use-your-own-entra-app-instead). - - Claude for Outlook on third-party platforms supports Claude Opus 4.7 and - later and Claude Sonnet 5 and later. Earlier model generations are not - available on the Outlook surface. - +> [!NOTE] +> +> Claude for Outlook on third-party platforms supports Claude Opus 4.7 and +> later and Claude Sonnet 5 and later. Earlier model generations are not +> available on the Outlook surface. ### Deploy to Microsoft 365 After the wizard generates your manifest files: - - - Open the Microsoft 365 Admin Center and go to Settings, Integrated - apps, Upload custom apps. Select "Office Add-in" as the app type, - then upload the `manifest.xml` file. If you are deploying Outlook, - repeat this step with `manifest-outlook.xml` as a second custom app. - - - - If all users share the same configuration, select "Entire - organization". If you wrote per-user attributes, assign to "Specific - users/groups" matching exactly who was configured. Others would open - the add-in with no configuration. - - - - Accept permissions and finish deployment. - - +**1. Upload the manifest** + +Open the Microsoft 365 Admin Center and go to Settings, Integrated +apps, Upload custom apps. Select "Office Add-in" as the app type, +then upload the `manifest.xml` file. If you are deploying Outlook, +repeat this step with `manifest-outlook.xml` as a second custom app. + +**2. Choose who gets the add-in** + +If all users share the same configuration, select "Entire +organization". If you wrote per-user attributes, assign to "Specific +users/groups" matching exactly who was configured. Others would open +the add-in with no configuration. + +**3. Finish deployment** + +Accept permissions and finish deployment. Propagation to users takes up to 24 hours, usually faster. The add-in appears under Tools, Add-ins on Mac or Home, Add-ins on Windows in @@ -357,10 +353,10 @@ not appear, users see old configuration after an update, or sign-in fails. Run `/claude-for-msft-365-install:debug` to diagnose these, or to sideload and validate a manifest locally before a tenant-wide upload. - - Start with a pilot group to confirm functionality, then widen - assignment. You can change assignment later without redeploying. - +> [!NOTE] +> +> Start with a pilot group to confirm functionality, then widen +> assignment. You can change assignment later without redeploying. ## Serve add-in settings from your Claude organization @@ -468,57 +464,53 @@ select "Log in" again. Use these steps if your IT team told you to sign in with your Claude account and your organization's settings are served by Anthropic. - - - Open Excel, PowerPoint, Word, or Outlook and launch the Claude add-in. - - - - On the sign-in screen, select "Log in", then approve the sign-in in - the browser window that opens. The task pane reloads when the - sign-in is accepted. - - - - The connection screen opens with your organization's values filled - in. If a field such as the gateway token is empty, enter the value - your IT team provided, then connect. If every value was served, the - add-in connects on its own. - - +**1. Open the add-in** + +Open Excel, PowerPoint, Word, or Outlook and launch the Claude add-in. + +**2. Log in with your Claude account** + +On the sign-in screen, select "Log in", then approve the sign-in in +the browser window that opens. The task pane reloads when the +sign-in is accepted. + +**3. Review the connection and connect** + +The connection screen opens with your organization's values filled +in. If a field such as the gateway token is empty, enter the value +your IT team provided, then connect. If every value was served, the +add-in connects on its own. If another Claude task pane was already open, it shows "Reload to finish signing in". Select Reload in that pane. ### LLM gateway - - - Open Excel, PowerPoint, Word, or Outlook and launch the Claude add-in. - - - - On the sign-in screen, select "Cloud provider or gateway". Then - choose your connection: Gateway, Vertex, Bedrock, or Azure. Contact - your IT team for connection details if you're unsure which one to - select. - - - - For Gateway, enter the gateway URL (HTTPS base URL of your LLM - proxy, for example - `https://llm-gateway.example.com`) and the API token your IT team - provided. By default the add-in sends the token in the `x-api-key` - header with every request. If your admin set - `gateway_auth_header: authorization` in the manifest, the add-in - sends `Authorization: Bearer ` instead. - - - - The add-in checks the connection by sending a test request to the - gateway. On success, you see the main add-in experience. - - +**1. Open the add-in** + +Open Excel, PowerPoint, Word, or Outlook and launch the Claude add-in. + +**2. Select your connection mode** + +On the sign-in screen, select "Cloud provider or gateway". Then +choose your connection: Gateway, Vertex, Bedrock, or Azure. Contact +your IT team for connection details if you're unsure which one to +select. + +**3. Enter your credentials** + +For Gateway, enter the gateway URL (HTTPS base URL of your LLM +proxy, for example +`https://llm-gateway.example.com`) and the API token your IT team +provided. By default the add-in sends the token in the `x-api-key` +header with every request. If your admin set +`gateway_auth_header: authorization` in the manifest, the add-in +sends `Authorization: Bearer ` instead. + +**4. Connect** + +The add-in checks the connection by sending a test request to the +gateway. On success, you see the main add-in experience. Your credentials are stored locally in your browser's localStorage within the add-in's sandboxed iframe and are not synced to Anthropic's @@ -530,36 +522,32 @@ credentials. In this path, every request travels from the add-in to your gateway, which forwards it to the provider you configured. - - Requests flow from the add-in to your LLM gateway, which forwards them to the configured model provider. - +![Requests flow from the add-in to your LLM gateway, which forwards them to the configured model provider.](https://mintcdn.com/claude-ai/-4jzPa4NasvobarI/images/office-agents/architecture/gateway.png?fit=max\&auto=format\&n=-4jzPa4NasvobarI\&q=85\&s=287ef25266391992109b8673f97e3f93) ### Bedrock, Vertex AI, or Foundry direct - - - Open Excel, PowerPoint, Word, or Outlook and launch the Claude add-in. - - - - For Bedrock (Excel, PowerPoint, and Word only), sign in with your - Microsoft work account. The add-in uses your Entra ID token to - assume the AWS role your admin - configured, so no separate AWS credentials are needed. - For Vertex AI, sign in with the Google account your admin authorized - via the Google OAuth client created during setup. - For Foundry, the add-in connects automatically if your admin - pre-filled the Azure resource name and API key. If your admin enabled - keyless sign-in, the add-in uses your Microsoft work account and no - key is involved. Otherwise, enter the values your IT team provided - and select Connect. - - - - The add-in reads the configuration your admin provisioned and - connects to Bedrock, Vertex AI, or Foundry directly. - - +**1. Open the add-in** + +Open Excel, PowerPoint, Word, or Outlook and launch the Claude add-in. + +**2. Authenticate** + +For Bedrock (Excel, PowerPoint, and Word only), sign in with your +Microsoft work account. The add-in uses your Entra ID token to +assume the AWS role your admin +configured, so no separate AWS credentials are needed. +For Vertex AI, sign in with the Google account your admin authorized +via the Google OAuth client created during setup. +For Foundry, the add-in connects automatically if your admin +pre-filled the Azure resource name and API key. If your admin enabled +keyless sign-in, the add-in uses your Microsoft work account and no +key is involved. Otherwise, enter the values your IT team provided +and select Connect. + +**3. Start working** + +The add-in reads the configuration your admin provisioned and +connects to Bedrock, Vertex AI, or Foundry directly. If you see an error at sign-in, confirm with your IT team that your account is in the group assigned to the add-in. @@ -571,16 +559,12 @@ The flow differs by provider. Bedrock direct uses your Microsoft Entra ID token to assume an AWS role, then calls Amazon Bedrock. - - The add-in uses a Microsoft Entra ID token to assume an AWS role and call Amazon Bedrock directly. - +![The add-in uses a Microsoft Entra ID token to assume an AWS role and call Amazon Bedrock directly.](https://mintcdn.com/claude-ai/-4jzPa4NasvobarI/images/office-agents/architecture/bedrock-direct.png?fit=max\&auto=format\&n=-4jzPa4NasvobarI\&q=85\&s=51c8233f704717f0ff1c3897356621cd) Vertex AI direct authenticates through Google OAuth, then calls Vertex AI. - - The add-in authenticates through Google OAuth and calls Google Cloud Vertex AI directly. - +![The add-in authenticates through Google OAuth and calls Google Cloud Vertex AI directly.](https://mintcdn.com/claude-ai/-4jzPa4NasvobarI/images/office-agents/architecture/vertex-direct.png?fit=max\&auto=format\&n=-4jzPa4NasvobarI\&q=85\&s=a33063abcecbfc36e346621f735453ef) ### Foundry direct without an API key @@ -810,12 +794,12 @@ rotates. ## Example gateway configuration with LiteLLM - - LiteLLM PyPI versions 1.82.7 and 1.82.8 contained credential-stealing - malware. Do not install those versions. If already installed, remove the - package, rotate all credentials on affected systems, and follow - remediation steps in [BerriAI/litellm#24518](https://github.com/BerriAI/litellm/issues/24518). - +> [!WARNING] +> +> LiteLLM PyPI versions 1.82.7 and 1.82.8 contained credential-stealing +> malware. Do not install those versions. If already installed, remove the +> package, rotate all credentials on affected systems, and follow +> remediation steps in [BerriAI/litellm#24518](https://github.com/BerriAI/litellm/issues/24518). LiteLLM is a third-party proxy service. Anthropic does not endorse, maintain, or audit LiteLLM's security or functionality. This section is diff --git a/content/claude/office-agents/word.md b/content/claude/office-agents/word.md index eb140276d4..5f0c6e1009 100644 --- a/content/claude/office-agents/word.md +++ b/content/claude/office-agents/word.md @@ -12,10 +12,10 @@ passages while preserving formatting, review counterparty redlines, work through comment threads, and fill templates in your document's styles. - - Claude for Word is generally available to Pro, Max, Team, - and Enterprise plans. - +> [!NOTE] +> +> Claude for Word is generally available to Pro, Max, Team, +> and Enterprise plans. ## What you can do @@ -49,101 +49,95 @@ Claude for Word runs on the following Word builds. ### Install for yourself - - - Go to the [Claude for Microsoft 365 listing on Microsoft AppSource](https://marketplace.microsoft.com/en-us/product/office/WA200010725?tab=Overview). - +**1. Open the marketplace listing** - - Select "Get it now" to install. - +Go to the [Claude for Microsoft 365 listing on Microsoft AppSource](https://marketplace.microsoft.com/en-us/product/office/WA200010725?tab=Overview). - - Open Word, activate the add-in, and sign in with your Claude - account. - - +**2. Install the add-in** + +Select "Get it now" to install. + +**3. Sign in** + +Open Word, activate the add-in, and sign in with your Claude +account. ### Deploy to your organization Organization admins can deploy Claude for Word through the Microsoft 365 Admin Center. - - - In the [Microsoft 365 Admin Center](https://admin.microsoft.com), go - to Settings, Org Settings, User owned apps and services, and turn on - ["Let users access the Office Store"](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-addins-in-the-admin-center). - - - - Go to Settings, Integrated apps, Add-ins. - - - - Search for "Claude for Microsoft 365" in Microsoft AppSource. - - - - Assign the add-in to your organization or to specific users or - groups. Share [Microsoft's deployment guide](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-deployment-of-add-ins) - with your team for activation steps. - - - - - If your organization uses Microsoft Entra Privileged Identity - Management (PIM) for admin roles, the Integrated apps page does not - recognize roles activated through PIM, so deployment fails. This is a - [known Microsoft issue](https://learn.microsoft.com/en-us/office/dev/add-ins/resources/resources-office-add-in-known-issues), - tracking ID 11126536. To work around it, deploy from an admin account - with the required role assigned as permanently active rather than - PIM-eligible. See - [Microsoft's troubleshooting guidance](https://learn.microsoft.com/en-us/troubleshoot/microsoft-365/admin/miscellaneous/cannot-deploy-add-in-integrated-apps-menu). - Individual users can still - [install the add-in themselves](#install-for-yourself). - +**1. Allow Office Store access** + +In the [Microsoft 365 Admin Center](https://admin.microsoft.com), go +to Settings, Org Settings, User owned apps and services, and turn on +["Let users access the Office Store"](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-addins-in-the-admin-center). + +**2. Open Integrated apps** + +Go to Settings, Integrated apps, Add-ins. + +**3. Find the add-in** + +Search for "Claude for Microsoft 365" in Microsoft AppSource. + +**4. Deploy** + +Assign the add-in to your organization or to specific users or +groups. Share [Microsoft's deployment guide](https://learn.microsoft.com/en-us/microsoft-365/admin/manage/manage-deployment-of-add-ins) +with your team for activation steps. + +> [!NOTE] +> +> If your organization uses Microsoft Entra Privileged Identity +> Management (PIM) for admin roles, the Integrated apps page does not +> recognize roles activated through PIM, so deployment fails. This is a +> [known Microsoft issue](https://learn.microsoft.com/en-us/office/dev/add-ins/resources/resources-office-add-in-known-issues), +> tracking ID 11126536. To work around it, deploy from an admin account +> with the required role assigned as permanently active rather than +> PIM-eligible. See +> [Microsoft's troubleshooting guidance](https://learn.microsoft.com/en-us/troubleshoot/microsoft-365/admin/miscellaneous/cannot-deploy-add-in-integrated-apps-menu). +> Individual users can still +> [install the add-in themselves](#install-for-yourself). After deployment, users can activate the Claude add-in from Tools, Add-ins on Mac or Home, Add-ins on Windows, sign in, and start working. - - Organizations that have disabled "Let users access the Office Store" may - find that admin-deployed add-ins don't appear for users. To work around - this, deploy using the manifest XML file described below. - +> [!WARNING] +> +> Organizations that have disabled "Let users access the Office Store" may +> find that admin-deployed add-ins don't appear for users. To work around +> this, deploy using the manifest XML file described below. ### Deploy with a custom manifest For IT administrators deploying to multiple users when the Office Store is disabled: - - - Download the [custom manifest XML file](https://pivot.claude.ai/manifest-word.xml) - and save it to a secure location. - - - - Go to [https://admin.microsoft.com](https://admin.microsoft.com), - sign in, and open Settings, Integrated apps. - - - - Select "Upload custom apps", choose "Office Add-in", then - "I have a manifest file on this device". Upload the manifest. - - - - Choose entire organization, specific users, specific groups, or just - yourself for admin testing. - - - - Review settings and select "Deploy". The add-in is available within - minutes. Full organization rollout can take up to 24 hours. - - +**1. Download the manifest** + +Download the [custom manifest XML file](https://pivot.claude.ai/manifest-word.xml) +and save it to a secure location. + +**2. Open the Admin Center** + +Go to [https://admin.microsoft.com](https://admin.microsoft.com), +sign in, and open Settings, Integrated apps. + +**3. Upload the custom add-in** + +Select "Upload custom apps", choose "Office Add-in", then +"I have a manifest file on this device". Upload the manifest. + +**4. Assign users** + +Choose entire organization, specific users, specific groups, or just +yourself for admin testing. + +**5. Deploy** + +Review settings and select "Deploy". The add-in is available within +minutes. Full organization rollout can take up to 24 hours. After deployment, users see Claude in Word's Home ribbon and sign in with their Claude credentials on first use. @@ -163,12 +157,12 @@ Ask Claude questions about specific sections, clauses, or defined terms in your document. Claude provides answers with clickable citations that navigate directly to the referenced section. - - Claude recognizes common document patterns including multi-level legal - numbering, defined terms, cross-references, and standard contract - structures. Verify that outputs match your specific requirements and - your firm's standard positions. - +> [!NOTE] +> +> Claude recognizes common document patterns including multi-level legal +> numbering, defined terms, cross-references, and standard contract +> structures. Verify that outputs match your specific requirements and +> your firm's standard positions. Example prompts: @@ -355,13 +349,13 @@ The add-in does not run on these Word versions. ## Prompt injection risk - - Only use Claude for Word with trusted documents. Documents from external - sources such as downloaded templates, counterparty files, or files - shared via email can contain hidden instructions that manipulate the - add-in into extracting data, modifying records, or performing - destructive actions. - +> [!WARNING] +> +> Only use Claude for Word with trusted documents. Documents from external +> sources such as downloaded templates, counterparty files, or files +> shared via email can contain hidden instructions that manipulate the +> add-in into extracting data, modifying records, or performing +> destructive actions. Prompt injection attacks hide malicious instructions in document content such as text, comments, tracked changes, headers, and footers diff --git a/content/claude/office-agents/work-across-apps.md b/content/claude/office-agents/work-across-apps.md index a28d89967d..b0b817ead2 100644 --- a/content/claude/office-agents/work-across-apps.md +++ b/content/claude/office-agents/work-across-apps.md @@ -11,11 +11,11 @@ add-ins in your Microsoft 365 suite. Instead of switching between apps and re-providing context each time, Claude can read from one app and make changes in another. - - Working across apps is available when you sign in with your Claude - account directly. It is not supported when connecting through Amazon - Bedrock, Google Cloud Vertex AI, Azure AI Foundry, or an LLM gateway. - +> [!NOTE] +> +> Working across apps is available when you sign in with your Claude +> account directly. It is not supported when connecting through Amazon +> Bedrock, Google Cloud Vertex AI, Azure AI Foundry, or an LLM gateway. ## Requirements @@ -34,20 +34,18 @@ on cross-app mode. ## Enable cross-app mode - - - Install Claude for Excel, PowerPoint, Word, and Outlook from the - Microsoft AppSource. Open each app and activate the add-in at - least once before using cross-app features. - - - - Open Settings in each add-in and turn on "Let Claude work across - files". Pro and Max plans have this on by default; Team and - Enterprise plans default to off. The toggle is per-device, so enable - it in every host you want to coordinate from. - - +**1. Install each add-in** + +Install Claude for Excel, PowerPoint, Word, and Outlook from the +Microsoft AppSource. Open each app and activate the add-in at +least once before using cross-app features. + +**2. Enable per add-in** + +Open Settings in each add-in and turn on "Let Claude work across +files". Pro and Max plans have this on by default; Team and +Enterprise plans default to off. The toggle is per-device, so enable +it in every host you want to coordinate from. Once enabled, connected-app indicators appear in the sidebar when other Excel, PowerPoint, Word, or Outlook sessions are linked. @@ -106,15 +104,13 @@ For more on Skills, see Team and Enterprise organization owners can control whether team members can access this capability. - - - Go to Organization settings, Office agents. - +**1. Open organization settings** + +Go to Organization settings, Office agents. + +**2. Toggle the setting** - - Turn "Let Claude work across apps" on or off. - - +Turn "Let Claude work across apps" on or off. Admins can also manage member access to the Claude for Excel, PowerPoint, Word, and Outlook add-ins through the Microsoft 365 Admin diff --git a/content/claude/plugins/admin.md b/content/claude/plugins/admin.md index edc6d74245..65ba12cf66 100644 --- a/content/claude/plugins/admin.md +++ b/content/claude/plugins/admin.md @@ -10,11 +10,11 @@ Owners of a Team or Enterprise organization decide which plugins members can use This page is for Owners, and for Enterprise members whose role includes managing the organization's plugins. - - * If you set plugin policy for the Claude Code command line, see [managed settings](https://code.claude.com/docs/en/plugins/org) in the Claude Code docs - * If you want one plugin to reach members in claude.ai and Cowork and developers in the Claude Code command line, and need to decide between this page and managed settings, or use the two together, see [Roll out a plugin to your whole organization](/docs/plugins/org-rollout) - * If you run Claude Desktop on your own model provider, see [MCP, plugins, skills, and hooks](/docs/third-party/claude-desktop/extensions) - +> [!NOTE] +> +> * If you set plugin policy for the Claude Code command line, see [managed settings](https://code.claude.com/docs/en/plugins/org) in the Claude Code docs +> * If you want one plugin to reach members in claude.ai and Cowork and developers in the Claude Code command line, and need to decide between this page and managed settings, or use the two together, see [Roll out a plugin to your whole organization](/docs/plugins/org-rollout) +> * If you run Claude Desktop on your own model provider, see [MCP, plugins, skills, and hooks](/docs/third-party/claude-desktop/extensions) To start, go to [**Organization settings > Plugins & skills**](https://claude.ai/admin-settings/skills?tab=inventory). From there you can [review what your organization has](#review-your-organization%E2%80%99s-inventory), [set each plugin's availability](#set-availability), or [add your organization's own plugins](#add-your-own-plugins). @@ -83,23 +83,21 @@ For an item a member created for themselves, the page shows who created it, who For an item your organization uploads, you can make any earlier version the one members get: - - - On the [**Inventory**](https://claude.ai/admin-settings/skills?tab=inventory) tab, select the item's row to open its page. - +**1. Open the item's page** - - Go to **Version history**. The version members get now is marked **Current**. - +On the [**Inventory**](https://claude.ai/admin-settings/skills?tab=inventory) tab, select the item's row to open its page. - - To see what an earlier version changes, open that version's menu and select **Compare with current**. - +**2. Go to Version history** - - Open the menu of the version you want, select **Revert to this version**, and confirm. - - +Go to **Version history**. The version members get now is marked **Current**. + +**3. Compare the earlier version** + +To see what an earlier version changes, open that version's menu and select **Compare with current**. + +**4. Revert to the version** + +Open the menu of the version you want, select **Revert to this version**, and confirm. Members then get that version, and **Current** moves to it. Reverting deletes nothing, so every version stays in the list. To go forward again, open a newer version's menu and select **Make this the current version**. @@ -115,23 +113,21 @@ You set a plugin's availability, add your own plugins, manage synced marketplace A plugin's availability decides whether members can see the plugin, install it if they want it, get it installed automatically, or must keep it on. In the plugin's row menu, this setting is labeled **Default access**. To set it: - - - Go to [**Organization settings > Plugins & skills**](https://claude.ai/admin-settings/skills?tab=inventory) and stay on the **Inventory** tab. - +**1. Open the Inventory tab** + +Go to [**Organization settings > Plugins & skills**](https://claude.ai/admin-settings/skills?tab=inventory) and stay on the **Inventory** tab. + +**2. Open the plugin's menu** + +Open the menu at the end of the plugin's row. - - Open the menu at the end of the plugin's row. - +**3. Select Default access** - - Select **Default access**. - +Select **Default access**. - - Choose **Not available**, **Available to install**, **Installed by default**, or **Required**. - - +**4. Choose a value** + +Choose **Not available**, **Available to install**, **Installed by default**, or **Required**. The product shows the availability setting under other labels too: **Distribution** on the item's page, **Audience** in the table, and **Group access…** for a user group. @@ -154,21 +150,19 @@ In Claude Code sessions that sync the member's account plugins, a required plugi Adding a plugin or skill of your own puts it on the **Inventory** tab, private to your organization, where you then [set its availability](#set-availability) for members. To add one: - - - Go to [**Organization settings > Plugins & skills**](https://claude.ai/admin-settings/skills?tab=inventory). - +**1. Open Plugins & skills** + +Go to [**Organization settings > Plugins & skills**](https://claude.ai/admin-settings/skills?tab=inventory). + +**2. Select Add and choose the source** - - Select **Add**, then choose where the plugin or skill comes from. The menu groups these items under **Skills** and **Plugins**: +Select **Add**, then choose where the plugin or skill comes from. The menu groups these items under **Skills** and **Plugins**: - * **Upload a skill** or **Create a skill**: one skill for your organization - * **Upload a plugin**: a plugin zip - * **Create a plugin**: a plugin you write in the browser - * **Sync from GitHub** or **Sync from GitLab**: a [plugin marketplace](https://code.claude.com/docs/en/plugins/create-marketplace) repository that contains your plugins - * **Add marketplace**: another source of plugins, such as one of Anthropic's catalogs - - +* **Upload a skill** or **Create a skill**: one skill for your organization +* **Upload a plugin**: a plugin zip +* **Create a plugin**: a plugin you write in the browser +* **Sync from GitHub** or **Sync from GitLab**: a [plugin marketplace](https://code.claude.com/docs/en/plugins/create-marketplace) repository that contains your plugins +* **Add marketplace**: another source of plugins, such as one of Anthropic's catalogs A marketplace you add appears on the **Marketplaces** tab, and its plugins appear on the **Inventory** tab. Adding plugins here doesn't publish them anywhere. @@ -188,23 +182,21 @@ If a sync fails, the marketplace's page shows the date and the reason, with a ** You can remove a catalog source, such as Anthropic's directory or a partner catalog, so that members no longer see plugins from it: - - - Open the [**Marketplaces**](https://claude.ai/admin-settings/skills?tab=marketplaces) tab. - +**1. Open the Marketplaces tab** + +Open the [**Marketplaces**](https://claude.ai/admin-settings/skills?tab=marketplaces) tab. + +**2. Find the catalog's row** + +Find the row that shows **Catalog** under its name. Its **Sync** column reads **Managed by Anthropic**, or **Managed by** the partner's name for a partner catalog. - - Find the row that shows **Catalog** under its name. Its **Sync** column reads **Managed by Anthropic**, or **Managed by** the partner's name for a partner catalog. - +**3. Remove it from the organization** - - Open the menu at the end of the row and select **Remove from organization**. - +Open the menu at the end of the row and select **Remove from organization**. - - In **Remove source**, select **Remove**. - - +**4. Confirm** + +In **Remove source**, select **Remove**. To add the source back, select **Add**, then **Add marketplace**, then **Browse Anthropic sources**, and select **Add** next to the source. @@ -220,15 +212,13 @@ For the Claude Code command line, the counterpart is managed settings. [Restrict You can turn plugins and skills off for your whole organization. This also stops Claude Code from loading the plugins it syncs from members' claude.ai accounts. - - - Go to [**Organization settings > Plugins & skills > Policy**](https://claude.ai/admin-settings/skills?tab=policy). - +**1. Open the Policy tab** + +Go to [**Organization settings > Plugins & skills > Policy**](https://claude.ai/admin-settings/skills?tab=policy). - - Turn off **Skills**. - - +**2. Turn off Skills** + +Turn off **Skills**. Members then see **Skills must be enabled in order to use plugins.** on **Customize > Plugins**, and they can't add or use plugins there. The organization's own skills are off as well. @@ -242,19 +232,17 @@ Members can share a plugin they made with specific people without involving you. When someone leaves your organization, the items they shared keep working for the people they shared them with. The **Inventory** tab shows a notice with the number of former members who still share items. To end that sharing: - - - On the [**Inventory**](https://claude.ai/admin-settings/skills?tab=inventory) tab, select **Review** in the notice. - +**1. Open the review** + +On the [**Inventory**](https://claude.ai/admin-settings/skills?tab=inventory) tab, select **Review** in the notice. - - Select **Stop sharing** for an item, or stop sharing all of one former member's items at once. - +**2. Stop sharing** - - Confirm. Everyone the item is shared with loses access right away. - - +Select **Stop sharing** for an item, or stop sharing all of one former member's items at once. + +**3. Confirm** + +Confirm. Everyone the item is shared with loses access right away. You can also open a former member's item from the table. Its page has an **Owner has left** section with **Stop sharing** and **Delete**. @@ -285,21 +273,19 @@ Requests to publish wait in [**Organization settings > Plugins & skills > Reques To review a request: - - - Open the request to see what the member submitted. - +**1. Open the request** + +Open the request to see what the member submitted. - - Select **Approve** or **Deny**. - +**2. Approve or deny** - - If you approve, choose the plugin's availability, as [Set availability](#set-availability) describes. +Select **Approve** or **Deny**. - If you deny, enter a reason, which the member receives by email and sees on their plugin's page. A denial closes that request, and the member can revise the plugin and submit a new one. - - +**3. Set availability or give a reason** + +If you approve, choose the plugin's availability, as [Set availability](#set-availability) describes. + +If you deny, enter a reason, which the member receives by email and sees on their plugin's page. A denial closes that request, and the member can revise the plugin and submit a new one. A plugin that a member published appears on the **Inventory** tab with your organization's other plugins. You [set its availability](#set-availability) there, and you can delete it from its menu. @@ -311,23 +297,21 @@ User groups are the ones listed at **Organization settings > Groups**. They sync To set availability for a group, you need to be an Owner or Primary Owner, or hold a custom role with **Libraries** set to **Can manage** and **Identity & Access** set to **Can view**. Then: - - - Go to [**Organization settings > Plugins & skills**](https://claude.ai/admin-settings/skills?tab=inventory) and stay on the **Inventory** tab. - +**1. Open the Inventory tab** + +Go to [**Organization settings > Plugins & skills**](https://claude.ai/admin-settings/skills?tab=inventory) and stay on the **Inventory** tab. + +**2. Open the plugin's menu** + +Open the menu at the end of the plugin's row. **Default access** is the availability for the whole organization. + +**3. Select Group access** - - Open the menu at the end of the plugin's row. **Default access** is the availability for the whole organization. - +Select **Group access…**. - - Select **Group access…**. - +**4. Choose the group and its availability** - - Choose a group and the availability for it. - - +Choose a group and the availability for it. When a member falls under more than one setting for a plugin, these rules decide which one applies: diff --git a/content/claude/plugins/build.md b/content/claude/plugins/build.md index 48e439043b..5bf459ca12 100644 --- a/content/claude/plugins/build.md +++ b/content/claude/plugins/build.md @@ -6,374 +6,15 @@ > Reference for the plugin folder: what each file is, the manifest fields every app reads, bundling an MCP connector with its skill, and testing on each app. -export const Piece = ({id, children}) =>
{children}
; - -export const PluginExplorer = ({children, variant}) => { - const SKILL_PIECES = [{ - id: 'skillmd', - required: 'Required', - name: 'SKILL.md', - path: 'brand-guidelines/SKILL.md', - lines: [{ - depth: 0, - kind: 'file', - text: 'SKILL.md' - }], - href: 'https://agentskills.io/specification', - linkText: 'Go to the Agent Skills specification' - }, { - id: 'references', - name: 'Reference file', - path: 'brand-guidelines/references/voice-and-tone.md', - lines: [{ - depth: 0, - kind: 'folder', - text: 'references/' - }, { - depth: 1, - kind: 'file', - text: 'voice-and-tone.md' - }], - href: 'https://agentskills.io/specification', - linkText: 'Go to the Agent Skills specification' - }, { - id: 'assets', - name: 'Asset', - path: 'brand-guidelines/assets/slide-template.md', - lines: [{ - depth: 0, - kind: 'folder', - text: 'assets/' - }, { - depth: 1, - kind: 'file', - text: 'slide-template.md' - }], - href: 'https://agentskills.io/specification', - linkText: 'Go to the Agent Skills specification' - }, { - id: 'scripts', - name: 'Script', - path: 'brand-guidelines/scripts/check_contrast.py', - lines: [{ - depth: 0, - kind: 'folder', - text: 'scripts/' - }, { - depth: 1, - kind: 'file', - text: 'check_contrast.py' - }], - href: 'https://code.claude.com/docs/en/skills', - linkText: 'Go to Skills in Claude Code' - }]; - const PLUGIN_PIECES = [{ - id: 'manifest', - required: 'Required', - name: 'Manifest', - path: '.claude-plugin/plugin.json', - lines: [{ - depth: 0, - kind: 'folder', - text: '.claude-plugin/' - }, { - depth: 1, - kind: 'file', - text: 'plugin.json' - }], - href: '/plugins/build#write-the-manifest', - linkText: 'Go to Write the manifest' - }, { - id: 'skills', - name: 'Skill', - path: 'skills/file-expense/SKILL.md', - lines: [{ - depth: 0, - kind: 'folder', - text: 'skills/' - }, { - depth: 1, - kind: 'folder', - text: 'file-expense/' - }, { - depth: 2, - kind: 'file', - text: 'SKILL.md' - }], - href: '/skills/how-to', - linkText: 'Go to Create custom skills' - }, { - id: 'references', - name: 'Skill reference file', - path: 'skills/file-expense/references/categories.md', - lines: [{ - depth: 2, - kind: 'folder', - text: 'references/' - }, { - depth: 3, - kind: 'file', - text: 'categories.md' - }], - href: '/skills/how-to#add-resources', - linkText: 'Go to Add resources' - }, { - id: 'scripts', - name: 'Skill script', - path: 'skills/file-expense/scripts/total.py', - lines: [{ - depth: 2, - kind: 'folder', - text: 'scripts/' - }, { - depth: 3, - kind: 'file', - text: 'total.py' - }], - href: '/skills/how-to#add-scripts', - linkText: 'Go to Add scripts' - }, { - id: 'commands', - name: 'Command', - path: 'commands/summarize.md', - lines: [{ - depth: 0, - kind: 'folder', - text: 'commands/' - }, { - depth: 1, - kind: 'file', - text: 'summarize.md' - }], - href: '/plugins/platform-support#compare-component-support-by-app', - linkText: 'Go to component support by app' - }, { - id: 'mcp', - name: 'MCP connector', - path: '.mcp.json', - lines: [{ - depth: 0, - kind: 'file', - text: '.mcp.json' - }], - href: '/plugins/build#bundle-an-mcp-connector-with-its-skill', - linkText: 'Go to Bundle an MCP connector with its skill' - }, { - id: 'readme', - required: 'Required to publish', - name: 'README', - path: 'README.md', - lines: [{ - depth: 0, - kind: 'file', - text: 'README.md' - }], - href: '/plugins/pre-submission-checklist#readme-and-license', - linkText: 'Go to README and license checks' - }, { - id: 'license', - required: 'Required to publish', - name: 'License', - path: 'LICENSE', - lines: [{ - depth: 0, - kind: 'file', - text: 'LICENSE' - }], - href: '/plugins/pre-submission-checklist#readme-and-license', - linkText: 'Go to README and license checks' - }]; - const isSkill = variant === 'skill'; - const PIECES = isSkill ? SKILL_PIECES : PLUGIN_PIECES; - const rootLabel = isSkill ? 'brand-guidelines/' : 'expense-reports/'; - const title = isSkill ? 'What goes in the skill folder' : 'What goes in the plugin folder'; - const treeCaption = isSkill ? 'Skill folder' : 'Plugin folder'; - const [selectedId, setSelectedId] = useState(isSkill ? 'skillmd' : 'manifest'); - const [isFullscreen, setIsFullscreen] = useState(false); - const rootRef = useRef(null); - useEffect(() => { - const onFsChange = () => setIsFullscreen(!!document.fullscreenElement); - document.addEventListener('fullscreenchange', onFsChange); - return () => document.removeEventListener('fullscreenchange', onFsChange); - }, []); - const toggleFullscreen = () => { - if (!rootRef.current) return; - if (document.fullscreenElement) document.exitFullscreen(); else rootRef.current.requestFullscreen().catch(() => {}); - }; - const selected = PIECES.find(p => p.id === selectedId) || PIECES[0]; - const onTreeKeyDown = e => { - const keys = ['ArrowDown', 'ArrowUp', 'Home', 'End']; - if (keys.indexOf(e.key) === -1) return; - const i = PIECES.findIndex(p => p.id === selectedId); - let next = i; - if (e.key === 'ArrowDown') next = Math.min(PIECES.length - 1, i + 1); - if (e.key === 'ArrowUp') next = Math.max(0, i - 1); - if (e.key === 'Home') next = 0; - if (e.key === 'End') next = PIECES.length - 1; - e.preventDefault(); - if (next === i) return; - const id = PIECES[next].id; - setSelectedId(id); - const el = document.getElementById('pe-node-' + id); - if (el) el.focus(); - }; - const FolderIcon = () => ; - const FileIcon = () => ; - return
- - -
-
-
{title}
- {isSkill ?
This example skill, brand-guidelines, has one of each kind of file a skill can carry. Select a file to read what it's for and see a minimal example.
:
This example plugin, expense-reports, has one of each file that chat, Cowork, and Claude Code all load, plus the README and license the directory requires. Select a file to read what it’s for and see a minimal example.
} -
- -
- -
-
-
{treeCaption}
-
-
{rootLabel}
- {PIECES.map(p => )} -
-
- -
-
Selected file
-
{selected.name}{selected.required ? {selected.required} : null}
-
{selected.path}
- -
{children}
- - {selected.linkText} -
-
-
; -}; - A plugin is a folder that packages skills, MCP connectors, commands, and agents, in any combination, so that people add them together. This page is the reference for that folder: what each file is and contains, the manifest fields every app reads, how an MCP connector and its skill fit together, and how to test the plugin on claude.ai, in Cowork, and in Claude Code. [Build your first plugin](/docs/plugins/quickstart) walks you through making one end to end. - - * If you want a plugin for your own use without writing files, see [Create a plugin with Claude](/docs/plugins/create-with-claude), which makes one from a conversation - * If you're building for Claude Code only, see its [plugin authoring docs](https://code.claude.com/docs/en/plugins/create). Claude Code supports more component types than the other surfaces, and those docs are the full reference for anything Claude Code-only - * If you're deciding which pieces your plugin needs, see [Decide what to include in your plugin](/docs/connectors/building/what-to-build) - +> [!NOTE] +> +> * If you want a plugin for your own use without writing files, see [Create a plugin with Claude](/docs/plugins/create-with-claude), which makes one from a conversation +> * If you're building for Claude Code only, see its [plugin authoring docs](https://code.claude.com/docs/en/plugins/create). Claude Code supports more component types than the other surfaces, and those docs are the full reference for anything Claude Code-only +> * If you're deciding which pieces your plugin needs, see [Decide what to include in your plugin](/docs/connectors/building/what-to-build) ## Lay out the plugin folder @@ -385,153 +26,145 @@ Put only the manifest inside `.claude-plugin/`. Everything else goes at the plug Select a file to see what it's for and a minimal example; components that only some apps load, such as agents and hooks, are listed after the explorer. - - -

The manifest identifies the plugin to every app and to Anthropic's directory. Without any `plugin.json`, the directory accepts only a folder whose `skills/` directory holds at least one `/SKILL.md`, and lists that plugin for Claude Code only, not for claude.ai or Cowork. To publish the plugin in Anthropic's directory you also need [a README and a license](/docs/plugins/pre-submission-checklist#readme-and-license); select those files in the tree to see what each needs.

+What goes in the plugin folder -

Its `name` is the plugin's permanent identity: people install and refer to the plugin by this value, so make it specific to your product and never change it after release. Change `displayName` when you want a different label.

+This example plugin, `expense-reports`, has one of each file that chat, Cowork, and Claude Code all load, plus the README and license the directory requires. Select a file to read what it’s for and see a minimal example. -

This manifest has the fields that every app and the directory read:

+Plugin folder - ```json theme={null} - { - "name": "expense-reports", - "displayName": "Expense Reports", - "version": "1.0.0", - "description": "File, track, and approve expense reports from a conversation, using your finance system's connector and your company's approval rules.", - "author": { "name": "Example Corp", "url": "https://example.com" }, - "license": "MIT" - } - ``` - +expense-reports/ + +Selected file - -

A skill is a `SKILL.md` file in its own folder under `skills/`, and the folder name matches the skill's `name` field. Claude decides when to load the skill from its `description`, so write the description as the situations a user would be in. Skills load in chat, Cowork, and Claude Code.

+The manifest identifies the plugin to every app and to Anthropic's directory. Without any `plugin.json`, the directory accepts only a folder whose `skills/` directory holds at least one `/SKILL.md`, and lists that plugin for Claude Code only, not for claude.ai or Cowork. To publish the plugin in Anthropic's directory you also need [a README and a license](/docs/plugins/pre-submission-checklist#readme-and-license); select those files in the tree to see what each needs. -

This skill files an expense from a receipt:

+Its `name` is the plugin's permanent identity: people install and refer to the plugin by this value, so make it specific to your product and never change it after release. Change `displayName` when you want a different label. - ```markdown theme={null} - --- - name: file-expense - description: File an expense report. Use when the user mentions a receipt, reimbursement, or expense, or asks to submit spending for approval. - --- +This manifest has the fields that every app and the directory read: + +```json theme={null} +{ + "name": "expense-reports", + "displayName": "Expense Reports", + "version": "1.0.0", + "description": "File, track, and approve expense reports from a conversation, using your finance system's connector and your company's approval rules.", + "author": { "name": "Example Corp", "url": "https://example.com" }, + "license": "MIT" +} +``` + +A skill is a `SKILL.md` file in its own folder under `skills/`, and the folder name matches the skill's `name` field. Claude decides when to load the skill from its `description`, so write the description as the situations a user would be in. Skills load in chat, Cowork, and Claude Code. + +This skill files an expense from a receipt: + +```markdown theme={null} +--- +name: file-expense +description: File an expense report. Use when the user mentions a receipt, reimbursement, or expense, or asks to submit spending for approval. +--- - To file an expense: +To file an expense: - 1. Read the amount, date, merchant, and currency from the receipt. - 2. Call the expenses connector's `create_report` tool with those fields. - 3. Reply with the report number and its approval status. - ``` - +1. Read the amount, date, merchant, and currency from the receipt. +2. Call the expenses connector's `create_report` tool with those fields. +3. Reply with the report number and its approval status. +``` - -

A skill folder can hold [supporting files](/docs/skills/how-to#add-resources) that are too detailed for `SKILL.md`:

+A skill folder can hold [supporting files](/docs/skills/how-to#add-resources) that are too detailed for `SKILL.md`: -
    -
  • `references/` for documentation Claude reads when needed
    • -
  • `assets/` for templates, images, and data files
    • -
  • `scripts/` for code
    • -
+
    +
  • `references/` for documentation Claude reads when needed
    • +
  • `assets/` for templates, images, and data files
    • +
  • `scripts/` for code
    • +
-

Mention each file in `SKILL.md` so Claude knows when to load it, for example "Pick the category from `references/categories.md`".

+Mention each file in `SKILL.md` so Claude knows when to load it, for example "Pick the category from `references/categories.md`". -

This reference file lists the expense categories:

+This reference file lists the expense categories: - ```markdown theme={null} - # Expense categories +```markdown theme={null} +# Expense categories - - Travel: flights, hotels, taxis, and mileage - - Meals: client meals and team events - - Software: subscriptions and licenses - ``` - +- Travel: flights, hotels, taxis, and mileage +- Meals: client meals and team events +- Software: subscriptions and licenses +``` - -

A skill can include scripts in a `scripts/` folder next to `SKILL.md`.

+A skill can include scripts in a `scripts/` folder next to `SKILL.md`. -

In `SKILL.md`, refer to a script by its path under `${CLAUDE_SKILL_DIR}`, for example `python3 ${CLAUDE_SKILL_DIR}/scripts/total.py receipts.csv`. [Add scripts](/docs/skills/how-to#add-scripts) explains how each app resolves that path.

+In `SKILL.md`, refer to a script by its path under `${CLAUDE_SKILL_DIR}`, for example `python3 ${CLAUDE_SKILL_DIR}/scripts/total.py receipts.csv`. [Add scripts](/docs/skills/how-to#add-scripts) explains how each app resolves that path. -

This script totals the amounts in a CSV file of receipts:

+This script totals the amounts in a CSV file of receipts: - ```python theme={null} - import csv - import sys +```python theme={null} +import csv +import sys - with open(sys.argv[1], newline="") as f: - total = sum(float(row["amount"]) for row in csv.DictReader(f)) - print(f"{total:.2f}") - ``` - +with open(sys.argv[1], newline="") as f: + total = sum(float(row["amount"]) for row in csv.DictReader(f)) +print(f"{total:.2f}") +``` - -

A command is a single Markdown file under `commands/` with a `description` in its frontmatter. In Cowork and Claude Code, you run it by typing its name, here `/expense-reports:summarize`. In chat, a command loads as a skill, and Claude applies it when the task fits.

+A command is a single Markdown file under `commands/` with a `description` in its frontmatter. In Cowork and Claude Code, you run it by typing its name, here `/expense-reports:summarize`. In chat, a command loads as a skill, and Claude applies it when the task fits. -

This command summarizes a month's expenses:

+This command summarizes a month's expenses: - ```markdown theme={null} - --- - description: Summarize this month's expense reports - --- +```markdown theme={null} +--- +description: Summarize this month's expense reports +--- - List this month's expense reports with their totals and approval status, then summarize them in three sentences. - ``` - +List this month's expense reports with their totals and approval status, then summarize them in three sentences. +``` - -

`.mcp.json` at the plugin root references your remote MCP server by URL. On claude.ai and in Cowork, the entry is listed on the plugin's **Connectors** tab, where each user adds or connects it and signs in through your server's OAuth flow. Claude Code loads it with the plugin.

+`.mcp.json` at the plugin root references your remote MCP server by URL. On claude.ai and in Cowork, the entry is listed on the plugin's **Connectors** tab, where each user adds or connects it and signs in through your server's OAuth flow. Claude Code loads it with the plugin. -

Don't put API keys or other secrets in this file, because every person who installs the plugin receives its files.

+Don't put API keys or other secrets in this file, because every person who installs the plugin receives its files. -

This one points at the expenses server:

+This one points at the expenses server: - ```json theme={null} - { - "mcpServers": { - "expenses": { - "type": "http", - "url": "https://mcp.example.com/mcp" - } - } +```json theme={null} +{ + "mcpServers": { + "expenses": { + "type": "http", + "url": "https://mcp.example.com/mcp" } - ``` - + } +} +``` - -

A plugin loads without a README, but you need one to publish it: Anthropic's directory shows the README as the listing's description, and [validation](/docs/plugins/pre-submission-checklist#readme-and-license) blocks a submission that has none.

+A plugin loads without a README, but you need one to publish it: Anthropic's directory shows the README as the listing's description, and [validation](/docs/plugins/pre-submission-checklist#readme-and-license) blocks a submission that has none. -

Write at least 40 words, not counting words inside code blocks, and say what the plugin does, how to use it, and what data it sends.

+Write at least 40 words, not counting words inside code blocks, and say what the plugin does, how to use it, and what data it sends. -

This README covers those three points:

+This README covers those three points: - ```markdown theme={null} - # Expense Reports +```markdown theme={null} +# Expense Reports - File, track, and approve expense reports from a conversation with Claude. +File, track, and approve expense reports from a conversation with Claude. - ## Use it +## Use it - Attach a receipt and ask Claude to file it. Claude reads the amount, date, - and merchant, files the report through the Expense Reports connector, and - replies with the report number. Ask what's waiting on you to list the - reports that need your approval. +Attach a receipt and ask Claude to file it. Claude reads the amount, date, +and merchant, files the report through the Expense Reports connector, and +replies with the report number. Ask what's waiting on you to list the +reports that need your approval. - ## Data +## Data - The plugin sends receipt details and report fields to your Example Corp - account through mcp.example.com. It stores nothing itself. - ``` - +The plugin sends receipt details and report fields to your Example Corp +account through mcp.example.com. It stores nothing itself. +``` - -

A plugin loads without a license, but you need one to publish it: Anthropic's directory doesn't list a plugin until it has a license, and [validation](/docs/plugins/pre-submission-checklist#readme-and-license) blocks a submission that has neither a `LICENSE` file nor a `license` field.

+A plugin loads without a license, but you need one to publish it: Anthropic's directory doesn't list a plugin until it has a license, and [validation](/docs/plugins/pre-submission-checklist#readme-and-license) blocks a submission that has neither a `LICENSE` file nor a `license` field. -

Add a `LICENSE` file to the plugin folder, or set `license` in `plugin.json`.

- - +Add a `LICENSE` file to the plugin folder, or set `license` in `plugin.json`. - - The explorer is the scaled-down set: the pieces that chat, Cowork, and Claude Code all load, plus the README and license that Anthropic's directory requires. For every other folder and field a plugin can contain, including the pieces only Claude Code loads, see [Plugin components](https://code.claude.com/docs/en/plugins/components) and the [manifest reference](https://code.claude.com/docs/en/plugins/manifest-reference) in the Claude Code docs. - +> [!NOTE] +> +> The explorer is the scaled-down set: the pieces that chat, Cowork, and Claude Code all load, plus the README and license that Anthropic's directory requires. For every other folder and field a plugin can contain, including the pieces only Claude Code loads, see [Plugin components](https://code.claude.com/docs/en/plugins/components) and the [manifest reference](https://code.claude.com/docs/en/plugins/manifest-reference) in the Claude Code docs. ### Check what each app loads diff --git a/content/claude/plugins/create-with-claude.md b/content/claude/plugins/create-with-claude.md index a2350c7b18..a577567591 100644 --- a/content/claude/plugins/create-with-claude.md +++ b/content/claude/plugins/create-with-claude.md @@ -10,10 +10,10 @@ A [plugin](/docs/plugins/overview) packages skills, commands, and connectors. Yo A plugin you create this way is for you. It lives on your account, and on a Team or Enterprise plan you can [share it](/docs/plugins/share) with specific people or your whole organization from its page in Customize. It isn't a directory listing; if you later want that, see [Submit a plugin you created with Claude](#submit-a-plugin-you-created-with-claude) at the end of this page. - - * If you'd rather write the files yourself, see [Plugin structure and testing](/docs/plugins/build) - * If you want to make a plugin available to everyone in your organization, see [Publish a plugin to your organization](/docs/plugins/share#publish-a-plugin-to-your-organization) - +> [!NOTE] +> +> * If you'd rather write the files yourself, see [Plugin structure and testing](/docs/plugins/build) +> * If you want to make a plugin available to everyone in your organization, see [Publish a plugin to your organization](/docs/plugins/share#publish-a-plugin-to-your-organization) To begin, [start a new plugin from the Add menu](#start-from-the-add-menu), [describe it to Claude and save it](#describe-and-save-the-plugin), then [review the plugin Claude made](#review-what-claude-made). @@ -25,18 +25,16 @@ When you create a plugin with Claude, you start a conversation from the **Add** To start a new plugin: - - - Go to [**Customize > Plugins**](https://claude.ai/customize/plugins) in claude.ai or the desktop app and select **Add**. - +**1. Open the Add menu** - - Choose one of these: +Go to [**Customize > Plugins**](https://claude.ai/customize/plugins) in claude.ai or the desktop app and select **Add**. - * **Create with Claude**: start a new conversation, or a new Cowork task in the desktop app, with a request to create a plugin already filled in for you to send. Choose this when you can describe the task you want the plugin to handle but don't want to write skill files - * **Create a plugin**: fill in a form with the plugin's name and what it helps with, then write its skills, commands, and connectors in an editor. Choose this when you already know what each piece should say - - +**2. Choose how to create it** + +Choose one of these: + +* **Create with Claude**: start a new conversation, or a new Cowork task in the desktop app, with a request to create a plugin already filled in for you to send. Choose this when you can describe the task you want the plugin to handle but don't want to write skill files +* **Create a plugin**: fill in a form with the plugin's name and what it helps with, then write its skills, commands, and connectors in an editor. Choose this when you already know what each piece should say If neither item appears in the **Add** menu, plugin creation isn't available on your account. Your organization can turn it off, and so can your IT department's configuration of the desktop app. [Manage plugins for your organization](/docs/plugins/admin#control-what-members-add-themselves) covers the organization setting. @@ -44,41 +42,37 @@ If neither item appears in the **Add** menu, plugin creation isn't available on After you choose **Create with Claude**, a conversation opens where you tell Claude what the plugin is for, and Claude assembles it as a `.plugin` file that you save to your account: - - - Tell Claude the job the plugin should help with, in the same words you'd use to explain it to a colleague: the task, when it comes up, and what a good result looks like. - +**1. Describe what the plugin is for** + +Tell Claude the job the plugin should help with, in the same words you'd use to explain it to a colleague: the task, when it comes up, and what a good result looks like. - - Answer Claude's follow-up questions, such as which of your connectors the plugin should use. You can change any of it later. - +**2. Answer Claude's questions** - - Claude writes the skills and commands, includes the connectors you chose, and shows the result as a file card in the conversation. Select **Save plugin** on that card to add it to your account. It's then listed under **Customize > Plugins**, on the **Yours** view. - - +Answer Claude's follow-up questions, such as which of your connectors the plugin should use. You can change any of it later. + +**3. Save the plugin Claude assembles** + +Claude writes the skills and commands, includes the connectors you chose, and shows the result as a file card in the conversation. Select **Save plugin** on that card to add it to your account. It's then listed under **Customize > Plugins**, on the **Yours** view. ### Review what Claude made Check the plugin before you rely on it: - - - Open **Customize > Plugins** and select the new plugin. - +**1. Open the plugin** + +Open **Customize > Plugins** and select the new plugin. - - Read the skills, commands, and connectors it contains. - +**2. Read what it contains** - - Sign in to any bundled connector from the plugin's page. - +Read the skills, commands, and connectors it contains. - - Start a chat, or a Cowork task in the desktop app, with the kind of request the plugin is for, and check that Claude follows the plugin's skills. - - +**3. Sign in to its connectors** + +Sign in to any bundled connector from the plugin's page. + +**4. Try it on a real request** + +Start a chat, or a Cowork task in the desktop app, with the kind of request the plugin is for, and check that Claude follows the plugin's skills. ## Use, disable, or remove your plugin @@ -95,19 +89,17 @@ To give the plugin to other people in your organization, see [Share a plugin wit Anthropic's directory reads plugins from a GitHub repository, so a plugin that lives only on your account can't be submitted as it is. If you decide you want it listed, get its files from the same conversation and go through the normal submission route: - - - In the conversation where Claude made the plugin, ask for it "as a plugin folder I can push to GitHub for the directory", download the zip Claude produces, and check that it has `.claude-plugin/plugin.json`, the `skills/` folder, a `README.md`, and a `LICENSE`. - +**1. Ask Claude for the plugin as a folder** + +In the conversation where Claude made the plugin, ask for it "as a plugin folder I can push to GitHub for the directory", download the zip Claude produces, and check that it has `.claude-plugin/plugin.json`, the `skills/` folder, a `README.md`, and a `LICENSE`. + +**2. Check the manifest and README** + +Unzip the folder and compare `plugin.json` with [Write the manifest](/docs/plugins/build#write-the-manifest). Claude may include fields the manifest doesn't use and leaves placeholders such as your name for you to fill in. If you have Claude Code installed, run `claude plugin validate` on the folder, as [Check the plugin on your machine](/docs/plugins/pre-submission-checklist#check-the-plugin-on-your-machine-optional) describes. - - Unzip the folder and compare `plugin.json` with [Write the manifest](/docs/plugins/build#write-the-manifest). Claude may include fields the manifest doesn't use and leaves placeholders such as your name for you to fill in. If you have Claude Code installed, run `claude plugin validate` on the folder, as [Check the plugin on your machine](/docs/plugins/pre-submission-checklist#check-the-plugin-on-your-machine-optional) describes. - +**3. Push and submit** - - Push the folder to a public GitHub repository, then follow [Submit a plugin](/docs/plugins/submit). - - +Push the folder to a public GitHub repository, then follow [Submit a plugin](/docs/plugins/submit). ## Next steps diff --git a/content/claude/plugins/org-rollout.md b/content/claude/plugins/org-rollout.md index 11e27d48b5..5c65a9261f 100644 --- a/content/claude/plugins/org-rollout.md +++ b/content/claude/plugins/org-rollout.md @@ -13,10 +13,10 @@ You can get your organization's own plugin to every member two ways, and each re This page is for the person rolling out a plugin their organization built, on a Team or Enterprise plan. - - * If you want to list a plugin publicly, see [Publish to the directory](/docs/directory/publish) - * If you haven't built the plugin yet, see [Build your first plugin](/docs/plugins/quickstart) and [Plugin structure and testing](/docs/plugins/build) - +> [!NOTE] +> +> * If you want to list a plugin publicly, see [Publish to the directory](/docs/directory/publish) +> * If you haven't built the plugin yet, see [Build your first plugin](/docs/plugins/quickstart) and [Plugin structure and testing](/docs/plugins/build) ## Choose a rollout route @@ -37,28 +37,26 @@ A plugin on a member's account reaches Claude Code as a synced plugin in Cowork Use both routes when the plugin is for people in chat and Cowork and also for developers whose Claude Code sessions don't sync from a claude.ai account. - - - Put the plugin in a Git repository with a `.claude-plugin/marketplace.json` that lists it. You use the same repository for both routes. [Create a marketplace](https://code.claude.com/docs/en/plugins/create-marketplace) in the Claude Code docs covers the format. - +**1. Lay out the repository as a marketplace** - - Organization sync is stricter than Claude Code about the repository's visibility and about which plugin source types it accepts, and it rejects a plugin with a top-level `bin/` directory. Check [the plugin sources that organization sync accepts](/docs/plugins/org-sync#plugin-sources-that-organization-sync-accepts) before you continue. - +Put the plugin in a Git repository with a `.claude-plugin/marketplace.json` that lists it. You use the same repository for both routes. [Create a marketplace](https://code.claude.com/docs/en/plugins/create-marketplace) in the Claude Code docs covers the format. - - In [**Organization settings > Plugins & skills**](https://claude.ai/admin-settings/skills?tab=inventory), add the repository as [Add your own plugins](/docs/plugins/admin#add-your-own-plugins) describes, then [set each plugin's availability](/docs/plugins/admin#set-availability). - +**2. Check the repository against the organization sync rules** - - Set `extraKnownMarketplaces` and `enabledPlugins` as [Pre-install and require plugins](https://code.claude.com/docs/en/plugins/org#pre-install-and-require-plugins) describes. To limit developers to your marketplace, see [Restrict what users can install](https://code.claude.com/docs/en/plugins/org#restrict-what-users-can-install). - +Organization sync is stricter than Claude Code about the repository's visibility and about which plugin source types it accepts, and it rejects a plugin with a top-level `bin/` directory. Check [the plugin sources that organization sync accepts](/docs/plugins/org-sync#plugin-sources-that-organization-sync-accepts) before you continue. - - * **In claude.ai**: as a member, open [**Customize > Plugins**](https://claude.ai/customize/plugins) and check that the plugin appears there - * **On a developer's machine**: start Claude Code and run `/plugin`, which lists the marketplace and the plugin - - +**3. Sync the repository from organization settings** + +In [**Organization settings > Plugins & skills**](https://claude.ai/admin-settings/skills?tab=inventory), add the repository as [Add your own plugins](/docs/plugins/admin#add-your-own-plugins) describes, then [set each plugin's availability](/docs/plugins/admin#set-availability). + +**4. Register the same marketplace in managed settings** + +Set `extraKnownMarketplaces` and `enabledPlugins` as [Pre-install and require plugins](https://code.claude.com/docs/en/plugins/org#pre-install-and-require-plugins) describes. To limit developers to your marketplace, see [Restrict what users can install](https://code.claude.com/docs/en/plugins/org#restrict-what-users-can-install). + +**5. Confirm on each surface** + +* **In claude.ai**: as a member, open [**Customize > Plugins**](https://claude.ai/customize/plugins) and check that the plugin appears there +* **On a developer's machine**: start Claude Code and run `/plugin`, which lists the marketplace and the plugin ### If a developer has the plugin from both routes @@ -78,19 +76,17 @@ Organization sync reads the repository's default branch, and members get the new **Re-sync** syncs the marketplace now, so members get the version on the default branch without waiting for a push. To re-sync: - - - Go to [**Organization settings > Plugins & skills > Marketplaces**](https://claude.ai/admin-settings/skills?tab=marketplaces). - +**1. Open the Marketplaces tab** + +Go to [**Organization settings > Plugins & skills > Marketplaces**](https://claude.ai/admin-settings/skills?tab=marketplaces). + +**2. Re-sync the marketplace** + +Open the menu in the marketplace's row and select **Re-sync**. - - Open the menu in the marketplace's row and select **Re-sync**. - +**3. Retry if you synced recently** - - If you see **You synced recently**, wait the number of seconds the message gives, then select **Re-sync** again. - - +If you see **You synced recently**, wait the number of seconds the message gives, then select **Re-sync** again. ### Update through managed settings diff --git a/content/claude/plugins/org-sync.md b/content/claude/plugins/org-sync.md index 11b8760ea4..a1ceabf100 100644 --- a/content/claude/plugins/org-sync.md +++ b/content/claude/plugins/org-sync.md @@ -10,10 +10,10 @@ You can distribute your organization's own plugins by syncing a Git repository t This page is for the Owner who adds the repository and for the engineer who maintains it. It covers the requirements the repository and its plugin entries must meet for the sync to accept them. - - * If you're choosing who gets each plugin once the repository syncs, see [Manage plugins for your organization](/docs/plugins/admin#set-availability) - * If you're writing the `marketplace.json` file, see [Create a marketplace](https://code.claude.com/docs/en/plugins/create-marketplace) in the Claude Code docs - +> [!NOTE] +> +> * If you're choosing who gets each plugin once the repository syncs, see [Manage plugins for your organization](/docs/plugins/admin#set-availability) +> * If you're writing the `marketplace.json` file, see [Create a marketplace](https://code.claude.com/docs/en/plugins/create-marketplace) in the Claude Code docs To get started, check [how organization sync gets access to your repository](#give-organization-sync-access-to-your-repository) for your Git host, then check your `marketplace.json` against [the plugin sources that organization sync accepts](#plugin-sources-that-organization-sync-accepts). @@ -29,39 +29,37 @@ Members don't need access to the repository themselves, and their Git credential When you sync a marketplace from github.com, organization sync reads the repository through the Claude GitHub App, and you choose the availability its plugins start with as you add it. To sync a marketplace from a private or internal repository on github.com: - - - Go to [**Organization settings > Plugins & skills**](https://claude.ai/admin-settings/skills?tab=inventory). - +**1. Open Plugins & skills** - - Select **Add**, then **Sync from GitHub**. - +Go to [**Organization settings > Plugins & skills**](https://claude.ai/admin-settings/skills?tab=inventory). - - If the dialog shows **Connect to GitHub**, select it and authorize. GitHub returns you to the dialog. - +**2. Select Sync from GitHub** - - Search for the repository or enter it as `owner/repo`. The list shows private and internal repositories. - +Select **Add**, then **Sync from GitHub**. - - If the repository isn't in the list, select **Install the Claude GitHub App** under **Repository missing?**, grant the app access to the repository on GitHub, and return to the dialog. - +**3. Connect to GitHub** - - Leave **Sync automatically** on to sync each time someone pushes to the default branch. Claude creates the webhook on the repository for you. - +If the dialog shows **Connect to GitHub**, select it and authorize. GitHub returns you to the dialog. - - Choose the **Default access** for the plugins in this marketplace. - +**4. Choose the repository** - - Select **Create**. - - +Search for the repository or enter it as `owner/repo`. The list shows private and internal repositories. + +**5. Install the Claude GitHub App if needed** + +If the repository isn't in the list, select **Install the Claude GitHub App** under **Repository missing?**, grant the app access to the repository on GitHub, and return to the dialog. + +**6. Leave automatic sync on** + +Leave **Sync automatically** on to sync each time someone pushes to the default branch. Claude creates the webhook on the repository for you. + +**7. Choose the default access** + +Choose the **Default access** for the plugins in this marketplace. + +**8. Create the marketplace** + +Select **Create**. The marketplace's page opens, and **Last synced** shows **Syncing...** until the first sync finishes. If the dialog says **The Claude GitHub App is not installed on** the repository, grant the Claude GitHub App access to the repository on GitHub and try again. @@ -71,15 +69,13 @@ To turn on automatic sync later, open the marketplace from the [**Marketplaces** Syncing a marketplace from GitLab needs a GitLab configuration for the host first, which holds the access token that organization sync reads the repository with. To sync a marketplace from gitlab.com or a self-managed GitLab instance: - - - As an [Owner](https://code.claude.com/docs/en/server-managed-settings#access-control), add a GitLab configuration for that host at [**Organization settings > Git providers**](https://claude.ai/admin-settings/source-control#gitlab). GitLab configurations are in public beta and apply only to plugin marketplace sync. - +**1. Add a GitLab configuration** + +As an [Owner](https://code.claude.com/docs/en/server-managed-settings#access-control), add a GitLab configuration for that host at [**Organization settings > Git providers**](https://claude.ai/admin-settings/source-control#gitlab). GitLab configurations are in public beta and apply only to plugin marketplace sync. + +**2. Sync from GitLab** - - In [**Organization settings > Plugins & skills**](https://claude.ai/admin-settings/skills?tab=inventory), select **Add**, then **Sync from GitLab**, as [Add your own plugins](/docs/plugins/admin#add-your-own-plugins) describes. When you add it, enter the project's HTTPS URL, such as `https://gitlab.example.com/platform/claude-plugins`. - - +In [**Organization settings > Plugins & skills**](https://claude.ai/admin-settings/skills?tab=inventory), select **Add**, then **Sync from GitLab**, as [Add your own plugins](/docs/plugins/admin#add-your-own-plugins) describes. When you add it, enter the project's HTTPS URL, such as `https://gitlab.example.com/platform/claude-plugins`. Organization sync reads the project's default branch. If you turn on **Sync automatically**, only pushes to the default branch start a sync. diff --git a/content/claude/plugins/overview.md b/content/claude/plugins/overview.md index 307e8c3a96..93cabc47e2 100644 --- a/content/claude/plugins/overview.md +++ b/content/claude/plugins/overview.md @@ -10,11 +10,11 @@ A plugin packages [skills](/docs/skills/overview), [MCP connectors](/docs/connec This page is for people using plugins in claude.ai, the Claude desktop app, and Cowork. - - * If you want to build a plugin or submit one to the directory, see [Plugin structure and testing](/docs/plugins/build) and [Publish to the directory](/docs/directory/publish) - * If you install and manage plugins from the Claude Code command line, see [Install plugins](https://code.claude.com/docs/en/plugins/install) in the Claude Code docs - * If you have a `.mcpb` file to install into the Claude desktop app, see [Install a local connector in the desktop app](/docs/connectors/custom/add-unlisted#install-a-local-connector-in-the-desktop-app) - +> [!NOTE] +> +> * If you want to build a plugin or submit one to the directory, see [Plugin structure and testing](/docs/plugins/build) and [Publish to the directory](/docs/directory/publish) +> * If you install and manage plugins from the Claude Code command line, see [Install plugins](https://code.claude.com/docs/en/plugins/install) in the Claude Code docs +> * If you have a `.mcpb` file to install into the Claude desktop app, see [Install a local connector in the desktop app](/docs/connectors/custom/add-unlisted#install-a-local-connector-in-the-desktop-app) To get started, [find and add a plugin](#find-and-add-a-plugin), then see [how to use it in each app](#use-a-plugin) and [where it becomes available on your account](#find-the-plugin-in-each-app). diff --git a/content/claude/plugins/platform-support.md b/content/claude/plugins/platform-support.md index 9925543a5f..f755d5bc48 100644 --- a/content/claude/plugins/platform-support.md +++ b/content/claude/plugins/platform-support.md @@ -10,12 +10,12 @@ You can install the same plugin folder everywhere you use Claude, but chat, Cowo This page is for anyone checking a component or behavior before relying on it, whether you're installing a plugin, building one, or submitting one to the directory. - - * If you want to install and manage plugins, see [Plugins](/docs/plugins/overview) - * If you're building a plugin, see [Plugin structure and testing](/docs/plugins/build) - * If you run Claude Desktop on your own model provider, see its [Feature matrix](/docs/third-party/claude-desktop/feature-matrix) for feature availability - * If you want to know where MCP Apps render, see [Add interactive UI with MCP Apps](/docs/connectors/building/mcp-apps/getting-started) - +> [!NOTE] +> +> * If you want to install and manage plugins, see [Plugins](/docs/plugins/overview) +> * If you're building a plugin, see [Plugin structure and testing](/docs/plugins/build) +> * If you run Claude Desktop on your own model provider, see its [Feature matrix](/docs/third-party/claude-desktop/feature-matrix) for feature availability +> * If you want to know where MCP Apps render, see [Add interactive UI with MCP Apps](/docs/connectors/building/mcp-apps/getting-started) ## Compare component support by app diff --git a/content/claude/plugins/pre-submission-checklist.md b/content/claude/plugins/pre-submission-checklist.md index 5d5d68402c..f611092eef 100644 --- a/content/claude/plugins/pre-submission-checklist.md +++ b/content/claude/plugins/pre-submission-checklist.md @@ -36,27 +36,25 @@ The `claude plugin validate` command only checks that your files are well-formed The portal's **Validate** button runs every check in this page's tables against your repository and gives you a report before you submit anything. - - - Open the [developer portal](https://claude.ai/directory/manage) and select **Submit new**. - +**1. Start a submission** - - When the portal asks **What would you like to submit?**, select **Plugin bundle**. - +Open the [developer portal](https://claude.ai/directory/manage) and select **Submit new**. - - On the **Source** step, enter the repository. [Submit your plugin](/docs/plugins/submit#submit-a-plugin) describes each field. - +**2. Choose Plugin bundle** - - Select **Validate**. The report lists each finding with its result and, for many findings, a fix. - +When the portal asks **What would you like to submit?**, select **Plugin bundle**. - - The report covers only the commit that validation read, so it doesn't change when you push a fix. Push the fix, then select **Re-validate** on the **Source** step of the same form. When the new report has no findings with the **Blocks** result, continue through the form to submit the plugin. - - +**3. Enter the repository** + +On the **Source** step, enter the repository. [Submit your plugin](/docs/plugins/submit#submit-a-plugin) describes each field. + +**4. Validate** + +Select **Validate**. The report lists each finding with its result and, for many findings, a fix. + +**5. Fix blocking findings and validate again** + +The report covers only the commit that validation read, so it doesn't change when you push a fix. Push the fix, then select **Re-validate** on the **Source** step of the same form. When the new report has no findings with the **Blocks** result, continue through the form to submit the plugin. ### Read a validation result @@ -185,15 +183,13 @@ To prepare, make the plugin's behavior visible in its README and its source: Validation and the scan check how the plugin is built. They don't check whether the plugin helps the people who install it. Before you submit, test the plugin's output and how it loads on the surfaces your users will use: - - - Run the plugin's skills on real prompts and compare the output with what Claude produces without the plugin. [`claude plugin eval`](https://code.claude.com/docs/en/plugin-evals) runs that comparison for the whole plugin in Claude Code, and [Measure whether the skill improves the output](/docs/skills/how-to#measure-whether-the-skill-improves-the-output) covers one skill at a time. - +**1. Compare output with and without the plugin** + +Run the plugin's skills on real prompts and compare the output with what Claude produces without the plugin. [`claude plugin eval`](https://code.claude.com/docs/en/plugin-evals) runs that comparison for the whole plugin in Claude Code, and [Measure whether the skill improves the output](/docs/skills/how-to#measure-whether-the-skill-improves-the-output) covers one skill at a time. + +**2. Load the plugin on each surface** - - Load the plugin on each surface your users will use, as [Test the plugin on each surface](/docs/plugins/build#test-the-plugin-on-each-surface) describes. - - +Load the plugin on each surface your users will use, as [Test the plugin on each surface](/docs/plugins/build#test-the-plugin-on-each-surface) describes. ## Next steps diff --git a/content/claude/plugins/quickstart.md b/content/claude/plugins/quickstart.md index 61fadfa346..913c3166dd 100644 --- a/content/claude/plugins/quickstart.md +++ b/content/claude/plugins/quickstart.md @@ -10,11 +10,11 @@ By the end of this quickstart, you have a working example plugin with one skill This quickstart is for developers who have Claude Code installed and want to learn the plugin format by building one. You can follow it with a product that has a remote MCP server, or with only a skill. - - * If you want to make a plugin from a conversation without writing files, see [Create a plugin with Claude](/docs/plugins/create-with-claude) - * If you want to distribute a plugin only inside your own organization, see [Roll out a plugin to your whole organization](/docs/plugins/org-rollout) - * If you want to look up the folder layout, the manifest fields, or what each surface loads, see [Plugin structure and testing](/docs/plugins/build) - +> [!NOTE] +> +> * If you want to make a plugin from a conversation without writing files, see [Create a plugin with Claude](/docs/plugins/create-with-claude) +> * If you want to distribute a plugin only inside your own organization, see [Roll out a plugin to your whole organization](/docs/plugins/org-rollout) +> * If you want to look up the folder layout, the manifest fields, or what each surface loads, see [Plugin structure and testing](/docs/plugins/build) ## Before you create the plugin @@ -27,93 +27,91 @@ Check that you have each of these before you create the plugin: The steps in this section build a plugin named `expense-reports` for a fictional finance product whose MCP server is at `mcp.example.com`. Replace the names and values with your own. - - - Create a folder named `expense-reports`, and create `.claude-plugin/plugin.json` inside it. Put only the manifest inside `.claude-plugin/`. Everything else goes at the plugin's top level. +**1. Write the manifest** - The example has the fields that every surface and the directory read: +Create a folder named `expense-reports`, and create `.claude-plugin/plugin.json` inside it. Put only the manifest inside `.claude-plugin/`. Everything else goes at the plugin's top level. - ```json theme={null} - { - "name": "expense-reports", - "displayName": "Expense Reports", - "version": "1.0.0", - "description": "File, track, and approve expense reports from a conversation, using your finance system's connector and your company's approval rules.", - "author": { "name": "Example Corp", "url": "https://example.com" }, - "license": "MIT" - } - ``` - - People install and refer to the plugin by its `name`. Use lowercase words joined by hyphens, make the name specific to your product, and never change it after release. [Manifest and plugin name](/docs/plugins/pre-submission-checklist#manifest-and-plugin-name) lists the directory's checks on the name. - - - - Create `skills/file-expense/SKILL.md`. A skill tells Claude when and how to do a task. The example calls tools from the MCP connector that you add in the next step, so leave the tool calls out of your own skill if your plugin has no connector: - - ```markdown theme={null} - --- - name: file-expense - description: File an expense report. Use when the user mentions a receipt, reimbursement, or expense, or asks to submit spending for approval. - --- - - To file an expense: - - 1. Ask for the receipt if the user hasn't attached one, and read the amount, date, merchant, and currency from it. - 2. Call the expenses connector's `create_report` tool with those fields. Default the category from the merchant type; ask only if it's ambiguous. - 3. If the amount is over the user's approval limit (check with `get_policy`), add their manager as approver before submitting. - 4. Reply with the report number and its approval status. Don't paste the full API response. - ``` - - Claude decides when to load the skill from the `description` line, so write it as the situations a user would be in. [Create custom skills](/docs/skills/how-to) covers the frontmatter fields, resource files, scripts, and testing. - - - - Skip this step if your plugin has only a skill. If your product has a remote MCP server, create `.mcp.json` at the plugin root and reference the server by URL: - - ```json theme={null} - { - "mcpServers": { - "expenses": { - "type": "http", - "url": "https://mcp.example.com/mcp" - } - } +The example has the fields that every surface and the directory read: + +```json theme={null} +{ + "name": "expense-reports", + "displayName": "Expense Reports", + "version": "1.0.0", + "description": "File, track, and approve expense reports from a conversation, using your finance system's connector and your company's approval rules.", + "author": { "name": "Example Corp", "url": "https://example.com" }, + "license": "MIT" +} +``` + +People install and refer to the plugin by its `name`. Use lowercase words joined by hyphens, make the name specific to your product, and never change it after release. [Manifest and plugin name](/docs/plugins/pre-submission-checklist#manifest-and-plugin-name) lists the directory's checks on the name. + +**2. Add a skill** + +Create `skills/file-expense/SKILL.md`. A skill tells Claude when and how to do a task. The example calls tools from the MCP connector that you add in the next step, so leave the tool calls out of your own skill if your plugin has no connector: + +```markdown theme={null} +--- +name: file-expense +description: File an expense report. Use when the user mentions a receipt, reimbursement, or expense, or asks to submit spending for approval. +--- + +To file an expense: + +1. Ask for the receipt if the user hasn't attached one, and read the amount, date, merchant, and currency from it. +2. Call the expenses connector's `create_report` tool with those fields. Default the category from the merchant type; ask only if it's ambiguous. +3. If the amount is over the user's approval limit (check with `get_policy`), add their manager as approver before submitting. +4. Reply with the report number and its approval status. Don't paste the full API response. +``` + +Claude decides when to load the skill from the `description` line, so write it as the situations a user would be in. [Create custom skills](/docs/skills/how-to) covers the frontmatter fields, resource files, scripts, and testing. + +**3. Add an MCP connector** + +Skip this step if your plugin has only a skill. If your product has a remote MCP server, create `.mcp.json` at the plugin root and reference the server by URL: + +```json theme={null} +{ + "mcpServers": { + "expenses": { + "type": "http", + "url": "https://mcp.example.com/mcp" } - ``` + } +} +``` + +There is no server at `mcp.example.com`, so this example connector fails to connect when you test the plugin. Replace the URL with your own server's, or leave `.mcp.json` out. - There is no server at `mcp.example.com`, so this example connector fails to connect when you test the plugin. Replace the URL with your own server's, or leave `.mcp.json` out. +Don't put API keys or other secrets in this file, because every person who installs the plugin receives its files. On claude.ai and in Cowork, the entry is listed on the plugin's **Connectors** tab, where the user [adds or connects it](/docs/plugins/overview#bundled-connectors) and signs in through your server's OAuth flow. On Team and Enterprise plans, an Owner adds the connector for the organization, and members then connect with their own account. - Don't put API keys or other secrets in this file, because every person who installs the plugin receives its files. On claude.ai and in Cowork, the entry is listed on the plugin's **Connectors** tab, where the user [adds or connects it](/docs/plugins/overview#bundled-connectors) and signs in through your server's OAuth flow. On Team and Enterprise plans, an Owner adds the connector for the organization, and members then connect with their own account. - +**4. Write the README** - - Create `README.md` in the plugin folder with at least 40 words. Words inside code blocks don't count. Say what the plugin does, how to use it, and what data it sends. The directory shows your README as the listing's description, and [README and license](/docs/plugins/pre-submission-checklist#readme-and-license) lists what validation checks. +Create `README.md` in the plugin folder with at least 40 words. Words inside code blocks don't count. Say what the plugin does, how to use it, and what data it sends. The directory shows your README as the listing's description, and [README and license](/docs/plugins/pre-submission-checklist#readme-and-license) lists what validation checks. - This README covers those three points for the example plugin: +This README covers those three points for the example plugin: - ```markdown theme={null} - # Expense Reports +```markdown theme={null} +# Expense Reports - File, track, and approve expense reports from a conversation with Claude. +File, track, and approve expense reports from a conversation with Claude. - ## Use it +## Use it - Attach a receipt and ask Claude to file it. Claude reads the amount, date, - and merchant, files the report through the Expense Reports connector, and - replies with the report number. Ask what's waiting on you to list the - reports that need your approval. +Attach a receipt and ask Claude to file it. Claude reads the amount, date, +and merchant, files the report through the Expense Reports connector, and +replies with the report number. Ask what's waiting on you to list the +reports that need your approval. - ## Data +## Data + +The plugin sends receipt details and report fields to your Example Corp +account through mcp.example.com. It stores nothing itself. +``` - The plugin sends receipt details and report fields to your Example Corp - account through mcp.example.com. It stores nothing itself. - ``` - +**5. Check the license** - - The directory requires a `LICENSE` file in the plugin folder or `license` in `plugin.json`, and validation blocks a plugin that has neither. The example manifest sets `license`, which meets the requirement. If you remove that field, add a `LICENSE` file to the plugin folder instead. - - +The directory requires a `LICENSE` file in the plugin folder or `license` in `plugin.json`, and validation blocks a plugin that has neither. The example manifest sets `license`, which meets the requirement. If you remove that field, add a `LICENSE` file to the plugin folder instead. ## Test the plugin in Claude Code @@ -151,29 +149,27 @@ The [Plugin pre-submission checklist](/docs/plugins/pre-submission-checklist) li The directory reads plugins from repositories on github.com, so the plugin folder goes in a GitHub repository. - - - Create an empty repository on github.com for the plugin. The repository must be public before the listing goes live. - - - - Remove `.DS_Store`, `Thumbs.db`, `desktop.ini`, and `__MACOSX` entries from the plugin folder, and add them to `.gitignore`. Validation blocks a plugin that contains them. - - - - From inside the `expense-reports` folder, commit the files and push them. The example pushes to a repository named `example-corp/expense-reports`, so replace that name with your own: - - ```bash theme={null} - git init -b main - git add . - git commit -m "Add the expense-reports plugin" - git remote add origin https://github.com/example-corp/expense-reports.git - git push -u origin main - ``` - - The repository's page on github.com now shows `.claude-plugin/`, `skills/`, and the other plugin files at the repository root. - - +**1. Create the repository** + +Create an empty repository on github.com for the plugin. The repository must be public before the listing goes live. + +**2. Remove system files** + +Remove `.DS_Store`, `Thumbs.db`, `desktop.ini`, and `__MACOSX` entries from the plugin folder, and add them to `.gitignore`. Validation blocks a plugin that contains them. + +**3. Commit and push** + +From inside the `expense-reports` folder, commit the files and push them. The example pushes to a repository named `example-corp/expense-reports`, so replace that name with your own: + +```bash theme={null} +git init -b main +git add . +git commit -m "Add the expense-reports plugin" +git remote add origin https://github.com/example-corp/expense-reports.git +git push -u origin main +``` + +The repository's page on github.com now shows `.claude-plugin/`, `skills/`, and the other plugin files at the repository root. ## Submit your own plugin diff --git a/content/claude/plugins/share.md b/content/claude/plugins/share.md index d021ecf711..0baaa665e1 100644 --- a/content/claude/plugins/share.md +++ b/content/claude/plugins/share.md @@ -10,10 +10,10 @@ On a Team or Enterprise plan, you can get a [plugin](/docs/plugins/overview) you This page is for someone on a Team or Enterprise plan who created or uploaded a plugin, for example with [Create a plugin with Claude](/docs/plugins/create-with-claude). - - * If you're an Owner reviewing what members publish, see [Manage plugins for your organization](/docs/plugins/admin) - * If you want a wider audience than your organization, see [Plugin structure and testing](/docs/plugins/build) and [Publish to the directory](/docs/directory/publish) - +> [!NOTE] +> +> * If you're an Owner reviewing what members publish, see [Manage plugins for your organization](/docs/plugins/admin) +> * If you want a wider audience than your organization, see [Plugin structure and testing](/docs/plugins/build) and [Publish to the directory](/docs/directory/publish) To give the plugin to people you name, go to [Share a plugin with specific people](#share-a-plugin-with-specific-people). To reach the whole organization, go to [Publish a plugin to your organization](#publish-a-plugin-to-your-organization). @@ -34,15 +34,13 @@ You can get the plugin to specific people, to your organization's library, to so Sharing gives the people you name your plugin in their **Customize > Plugins** list, turned off until they turn it on. To share with specific people: - - - Go to [**Customize > Plugins**](https://claude.ai/customize/plugins) in claude.ai or the desktop app and open the plugin. Select **Share** at the top of its page. The plugin's menu in your **Your plugins** list has the same **Share** item. - +**1. Open the plugin and select Share** - - Add each person by name or email address, then confirm the share. - - +Go to [**Customize > Plugins**](https://claude.ai/customize/plugins) in claude.ai or the desktop app and open the plugin. Select **Share** at the top of its page. The plugin's menu in your **Your plugins** list has the same **Share** item. + +**2. Add people** + +Add each person by name or email address, then confirm the share. ### What the people you share with get diff --git a/content/claude/plugins/submit.md b/content/claude/plugins/submit.md index b77b2cd251..0d02c2fc8e 100644 --- a/content/claude/plugins/submit.md +++ b/content/claude/plugins/submit.md @@ -10,11 +10,11 @@ To list a plugin in [Anthropic's directory](/docs/directory/publish), you submit Use this page if your plugin is already in a GitHub repository and you want it listed. If the plugin references a remote MCP server you run, submit that server as an MCP connector too, as [Submit your plugin, and your MCP server as a connector](/docs/directory/publish#submit-your-plugin-and-your-mcp-server-as-a-connector) explains. - - * To build the plugin first, see [Plugin structure and testing](/docs/plugins/build) - * To share it without a public listing, see [Share a plugin with teammates](/docs/plugins/share) or [Roll out a plugin to your whole organization](/docs/plugins/org-rollout) - * If you submitted through the earlier Claude Console form, see [Move an earlier submission to the developer portal](/docs/directory/publish#move-an-earlier-submission-to-the-developer-portal) - +> [!NOTE] +> +> * To build the plugin first, see [Plugin structure and testing](/docs/plugins/build) +> * To share it without a public listing, see [Share a plugin with teammates](/docs/plugins/share) or [Roll out a plugin to your whole organization](/docs/plugins/org-rollout) +> * If you submitted through the earlier Claude Console form, see [Move an earlier submission to the developer portal](/docs/directory/publish#move-an-earlier-submission-to-the-developer-portal) ## Before you submit a plugin @@ -31,61 +31,59 @@ Before you open the portal, work through the [plugin pre-submission checklist](/ Each plugin folder is its own submission in the developer portal at [claude.ai/directory/manage](https://claude.ai/directory/manage), so a repository that holds several plugins needs one submission for each. - - - 1. Open the [developer portal](https://claude.ai/directory/manage) and select **Submit new**. - 2. When the portal asks **What would you like to submit?**, select **Plugin bundle**. +**1. Open the portal** - - The other option, **MCP connector**, submits one remote MCP server as its own connector listing. If your plugin references an MCP server you built and you haven't submitted that server yet, submit it separately with **MCP connector** by following [Submit your connector](/docs/connectors/building/submission). [Submit your plugin, and your MCP server as a connector](/docs/directory/publish#submit-your-plugin-and-your-mcp-server-as-a-connector) explains why you submit both. - - +1. Open the [developer portal](https://claude.ai/directory/manage) and select **Submit new**. +2. When the portal asks **What would you like to submit?**, select **Plugin bundle**. - - On the **Source** step, fill in the fields: +> [!NOTE] +> +> The other option, **MCP connector**, submits one remote MCP server as its own connector listing. If your plugin references an MCP server you built and you haven't submitted that server yet, submit it separately with **MCP connector** by following [Submit your connector](/docs/connectors/building/submission). [Submit your plugin, and your MCP server as a connector](/docs/directory/publish#submit-your-plugin-and-your-mcp-server-as-a-connector) explains why you submit both. - * **Repository**: the GitHub repository's URL, or `owner/repo`. If you paste a link to a folder on a branch, the portal fills in the path and branch for you - * **Plugin path (optional)**: the folder that holds `.claude-plugin/plugin.json`, if the plugin isn't at the repository root - * **Branch or tag (optional)**: the branch or tag that the directory follows for new versions. The portal calls this the tracked branch or tag. Leave the field empty to follow the repository's default branch. A tag stays on its commit until you change the tag. If the branch name contains a slash, type the name in this field or enter `owner/repo@branch` in **Repository**, instead of pasting a folder link +**2. Enter the source and validate** - Then validate the plugin: +On the **Source** step, fill in the fields: - 1. Select **Validate** to run the directory's validation checks on the plugin. - 2. If a finding blocks submission, fix it in the repository and push the fix. - 3. Validate again. +* **Repository**: the GitHub repository's URL, or `owner/repo`. If you paste a link to a folder on a branch, the portal fills in the path and branch for you +* **Plugin path (optional)**: the folder that holds `.claude-plugin/plugin.json`, if the plugin isn't at the repository root +* **Branch or tag (optional)**: the branch or tag that the directory follows for new versions. The portal calls this the tracked branch or tag. Leave the field empty to follow the repository's default branch. A tag stays on its commit until you change the tag. If the branch name contains a slash, type the name in this field or enter `owner/repo@branch` in **Repository**, instead of pasting a folder link - The [plugin pre-submission checklist](/docs/plugins/pre-submission-checklist) explains what each kind of finding means. +Then validate the plugin: - A validation result applies to one commit. If you push to the branch after validating, validate again before you continue. - +1. Select **Validate** to run the directory's validation checks on the plugin. +2. If a finding blocks submission, fix it in the repository and push the fix. +3. Validate again. - - The **Listing details** step shows how the plugin appears in the directory, read from `plugin.json` and the README. To change a field before you submit, edit `plugin.json` or the README in the repository and validate again. Once the plugin is listed, its name and short description follow the version that's live, so to change them later, edit `plugin.json` or the README and publish a new version. - +The [plugin pre-submission checklist](/docs/plugins/pre-submission-checklist) explains what each kind of finding means. - - On the **Data handling** step, answer each question: whether the plugin reads or stores personal data, whether it sends data to services other than its declared connectors, how long it keeps data, and whether it's intended for people under 18. - +A validation result applies to one commit. If you push to the branch after validating, validate again before you continue. - - On the **Compliance** step, check the contact email and select the acknowledgements: +**3. Check the listing details** - 1. Check that the contact email is an address where Anthropic can reach you about the submission. - 2. Select all four acknowledgements. - +The **Listing details** step shows how the plugin appears in the directory, read from `plugin.json` and the README. To change a field before you submit, edit `plugin.json` or the README in the repository and validate again. Once the plugin is listed, its name and short description follow the version that's live, so to change them later, edit `plugin.json` or the README and publish a new version. - - On the **Review and submit** step, confirm the details, choose how new versions arrive, and submit: +**4. Answer the data handling questions** - 1. Confirm the details. - 2. Under **How new versions reach the directory**, choose **GitHub push webhook**, which is selected by default, or **Scheduled check only**. With either option, the directory also checks the tracked branch or tag for new commits on a schedule. - 3. Select **Submit for review**. +On the **Data handling** step, answer each question: whether the plugin reads or stores personal data, whether it sends data to services other than its declared connectors, how long it keeps data, and whether it's intended for people under 18. - If you kept **GitHub push webhook**, the **Plugin submitted for review** page offers **Set up push updates**. You need admin access to the repository on GitHub to set up the webhook. +**5. Complete the compliance step** - To set it up later, open the plugin from **Submissions** in the developer portal and select **Set up** under **Updates** on the **Settings** tab. - - +On the **Compliance** step, check the contact email and select the acknowledgements: + +1. Check that the contact email is an address where Anthropic can reach you about the submission. +2. Select all four acknowledgements. + +**6. Review and submit** + +On the **Review and submit** step, confirm the details, choose how new versions arrive, and submit: + +1. Confirm the details. +2. Under **How new versions reach the directory**, choose **GitHub push webhook**, which is selected by default, or **Scheduled check only**. With either option, the directory also checks the tracked branch or tag for new commits on a schedule. +3. Select **Submit for review**. + +If you kept **GitHub push webhook**, the **Plugin submitted for review** page offers **Set up push updates**. You need admin access to the repository on GitHub to set up the webhook. + +To set it up later, open the plugin from **Submissions** in the developer portal and select **Set up** under **Updates** on the **Settings** tab. ### Submission limits and duplicates diff --git a/content/claude/skills/how-to.md b/content/claude/skills/how-to.md index 89f65c9982..473c44ac74 100644 --- a/content/claude/skills/how-to.md +++ b/content/claude/skills/how-to.md @@ -6,372 +6,13 @@ > Create a custom skill for Claude: write the SKILL.md file, add resources and scripts, package the skill, and test it. -export const Piece = ({id, children}) =>
{children}
; - -export const PluginExplorer = ({children, variant}) => { - const SKILL_PIECES = [{ - id: 'skillmd', - required: 'Required', - name: 'SKILL.md', - path: 'brand-guidelines/SKILL.md', - lines: [{ - depth: 0, - kind: 'file', - text: 'SKILL.md' - }], - href: 'https://agentskills.io/specification', - linkText: 'Go to the Agent Skills specification' - }, { - id: 'references', - name: 'Reference file', - path: 'brand-guidelines/references/voice-and-tone.md', - lines: [{ - depth: 0, - kind: 'folder', - text: 'references/' - }, { - depth: 1, - kind: 'file', - text: 'voice-and-tone.md' - }], - href: 'https://agentskills.io/specification', - linkText: 'Go to the Agent Skills specification' - }, { - id: 'assets', - name: 'Asset', - path: 'brand-guidelines/assets/slide-template.md', - lines: [{ - depth: 0, - kind: 'folder', - text: 'assets/' - }, { - depth: 1, - kind: 'file', - text: 'slide-template.md' - }], - href: 'https://agentskills.io/specification', - linkText: 'Go to the Agent Skills specification' - }, { - id: 'scripts', - name: 'Script', - path: 'brand-guidelines/scripts/check_contrast.py', - lines: [{ - depth: 0, - kind: 'folder', - text: 'scripts/' - }, { - depth: 1, - kind: 'file', - text: 'check_contrast.py' - }], - href: 'https://code.claude.com/docs/en/skills', - linkText: 'Go to Skills in Claude Code' - }]; - const PLUGIN_PIECES = [{ - id: 'manifest', - required: 'Required', - name: 'Manifest', - path: '.claude-plugin/plugin.json', - lines: [{ - depth: 0, - kind: 'folder', - text: '.claude-plugin/' - }, { - depth: 1, - kind: 'file', - text: 'plugin.json' - }], - href: '/plugins/build#write-the-manifest', - linkText: 'Go to Write the manifest' - }, { - id: 'skills', - name: 'Skill', - path: 'skills/file-expense/SKILL.md', - lines: [{ - depth: 0, - kind: 'folder', - text: 'skills/' - }, { - depth: 1, - kind: 'folder', - text: 'file-expense/' - }, { - depth: 2, - kind: 'file', - text: 'SKILL.md' - }], - href: '/skills/how-to', - linkText: 'Go to Create custom skills' - }, { - id: 'references', - name: 'Skill reference file', - path: 'skills/file-expense/references/categories.md', - lines: [{ - depth: 2, - kind: 'folder', - text: 'references/' - }, { - depth: 3, - kind: 'file', - text: 'categories.md' - }], - href: '/skills/how-to#add-resources', - linkText: 'Go to Add resources' - }, { - id: 'scripts', - name: 'Skill script', - path: 'skills/file-expense/scripts/total.py', - lines: [{ - depth: 2, - kind: 'folder', - text: 'scripts/' - }, { - depth: 3, - kind: 'file', - text: 'total.py' - }], - href: '/skills/how-to#add-scripts', - linkText: 'Go to Add scripts' - }, { - id: 'commands', - name: 'Command', - path: 'commands/summarize.md', - lines: [{ - depth: 0, - kind: 'folder', - text: 'commands/' - }, { - depth: 1, - kind: 'file', - text: 'summarize.md' - }], - href: '/plugins/platform-support#compare-component-support-by-app', - linkText: 'Go to component support by app' - }, { - id: 'mcp', - name: 'MCP connector', - path: '.mcp.json', - lines: [{ - depth: 0, - kind: 'file', - text: '.mcp.json' - }], - href: '/plugins/build#bundle-an-mcp-connector-with-its-skill', - linkText: 'Go to Bundle an MCP connector with its skill' - }, { - id: 'readme', - required: 'Required to publish', - name: 'README', - path: 'README.md', - lines: [{ - depth: 0, - kind: 'file', - text: 'README.md' - }], - href: '/plugins/pre-submission-checklist#readme-and-license', - linkText: 'Go to README and license checks' - }, { - id: 'license', - required: 'Required to publish', - name: 'License', - path: 'LICENSE', - lines: [{ - depth: 0, - kind: 'file', - text: 'LICENSE' - }], - href: '/plugins/pre-submission-checklist#readme-and-license', - linkText: 'Go to README and license checks' - }]; - const isSkill = variant === 'skill'; - const PIECES = isSkill ? SKILL_PIECES : PLUGIN_PIECES; - const rootLabel = isSkill ? 'brand-guidelines/' : 'expense-reports/'; - const title = isSkill ? 'What goes in the skill folder' : 'What goes in the plugin folder'; - const treeCaption = isSkill ? 'Skill folder' : 'Plugin folder'; - const [selectedId, setSelectedId] = useState(isSkill ? 'skillmd' : 'manifest'); - const [isFullscreen, setIsFullscreen] = useState(false); - const rootRef = useRef(null); - useEffect(() => { - const onFsChange = () => setIsFullscreen(!!document.fullscreenElement); - document.addEventListener('fullscreenchange', onFsChange); - return () => document.removeEventListener('fullscreenchange', onFsChange); - }, []); - const toggleFullscreen = () => { - if (!rootRef.current) return; - if (document.fullscreenElement) document.exitFullscreen(); else rootRef.current.requestFullscreen().catch(() => {}); - }; - const selected = PIECES.find(p => p.id === selectedId) || PIECES[0]; - const onTreeKeyDown = e => { - const keys = ['ArrowDown', 'ArrowUp', 'Home', 'End']; - if (keys.indexOf(e.key) === -1) return; - const i = PIECES.findIndex(p => p.id === selectedId); - let next = i; - if (e.key === 'ArrowDown') next = Math.min(PIECES.length - 1, i + 1); - if (e.key === 'ArrowUp') next = Math.max(0, i - 1); - if (e.key === 'Home') next = 0; - if (e.key === 'End') next = PIECES.length - 1; - e.preventDefault(); - if (next === i) return; - const id = PIECES[next].id; - setSelectedId(id); - const el = document.getElementById('pe-node-' + id); - if (el) el.focus(); - }; - const FolderIcon = () => ; - const FileIcon = () => ; - return
- - -
-
-
{title}
- {isSkill ?
This example skill, brand-guidelines, has one of each kind of file a skill can carry. Select a file to read what it's for and see a minimal example.
:
This example plugin, expense-reports, has one of each file that chat, Cowork, and Claude Code all load, plus the README and license the directory requires. Select a file to read what it’s for and see a minimal example.
} -
- -
- -
-
-
{treeCaption}
-
-
{rootLabel}
- {PIECES.map(p => )} -
-
- -
-
Selected file
-
{selected.name}{selected.required ? {selected.required} : null}
-
{selected.path}
- -
{children}
- - {selected.linkText} -
-
-
; -}; - A custom skill is a folder with a `SKILL.md` file of instructions, and optionally scripts and reference files, that Claude loads when a task matches the skill's description. This guide is for anyone writing a skill of their own. It explains how to create, structure, and test one. If you already know what the skill should do, start with the [directory structure](#directory-structure). If you're not sure a skill is the right tool, read [Decide what skill to create](#decide-what-skill-to-create) first. - - Skills follow the [Agent Skills specification](https://agentskills.io/specification). See the specification for more in-depth information. - +> [!NOTE] +> +> Skills follow the [Agent Skills specification](https://agentskills.io/specification). See the specification for more in-depth information. ## Decide what skill to create @@ -389,69 +30,65 @@ To start, write down the task in one sentence and what a good result looks like. A skill is a folder named after the skill. The only required file is `SKILL.md`; the other folders are optional and hold material that `SKILL.md` points Claude to. Select a file in the explorer to see what goes in it and what Claude does with it. - - -

The one required file. Its frontmatter names and describes the skill, and Claude reads the description to decide when the skill applies. The body holds the instructions Claude follows once it does.

-

In this example, the skill applies Acme's brand guidelines and tells Claude where the supporting files are:

- - ```markdown SKILL.md theme={null} - --- - name: brand-guidelines - description: Apply Acme Corp brand guidelines to presentations and documents, including official colors, fonts, and logo usage. - --- - Use these guidelines whenever you produce a document or deck for Acme. - - 1. Use the colors and fonts in the sections below. - 2. For wording, follow `references/voice-and-tone.md`. - 3. For slides, start from `assets/slide-template.md`. - 4. Before you finish, run `python3 ${CLAUDE_SKILL_DIR}/scripts/check_contrast.py` on any color pairs you chose. - ``` - - - -

Longer background that Claude reads only when a step calls for it, so it doesn't crowd SKILL.md. Mention the file by path at the step where Claude needs it.

-

In this example, the file holds the writing rules the instructions point to in step 2:

- - ```markdown references/voice-and-tone.md theme={null} - # Voice and tone - - Write in the second person and the present tense. - - Prefer short sentences. Avoid exclamation marks. - - Product names are always capitalized: Acme Cloud, Acme Sync. - ``` - - - -

Templates, images, and data files that Claude copies or fills in rather than reads for guidance.

-

In this example, the asset is the slide outline that step 3 tells Claude to start from:

- - ```markdown assets/slide-template.md theme={null} - # [Deck title] - ## Agenda - ## [Section 1] - ## [Section 2] - ## Next steps - ``` - - - -

Code that Claude runs while following the skill, for work that is more reliable as a program than as instructions. Reference it from `SKILL.md` with `${CLAUDE_SKILL_DIR}` so the path resolves wherever the skill is installed.

-

In this example, the script checks that a text and background color pair has enough contrast:

- - ```python scripts/check_contrast.py theme={null} - import sys - - def luminance(hex_color): - r, g, b = (int(hex_color[i:i+2], 16) / 255 for i in (1, 3, 5)) - f = lambda c: c / 12.92 if c <= 0.03928 else ((c + 0.055) / 1.055) ** 2.4 - return 0.2126 * f(r) + 0.7152 * f(g) + 0.0722 * f(b) - - fg, bg = sys.argv[1], sys.argv[2] - l1, l2 = sorted((luminance(fg), luminance(bg)), reverse=True) - ratio = (l1 + 0.05) / (l2 + 0.05) - print(f"{ratio:.2f}", "OK" if ratio >= 4.5 else "LOW") - ``` - - +What goes in the skill folder + +This example skill, `brand-guidelines`, has one of each kind of file a skill can carry. Select a file to read what it's for and see a minimal example. + +Skill folder + +brand-guidelines/ + +Selected file + +The one required file. Its frontmatter names and describes the skill, and Claude reads the `description` to decide when the skill applies. The body holds the instructions Claude follows once it does.In this example, the skill applies Acme's brand guidelines and tells Claude where the supporting files are: + +```markdown SKILL.md theme={null} +--- +name: brand-guidelines +description: Apply Acme Corp brand guidelines to presentations and documents, including official colors, fonts, and logo usage. +--- +Use these guidelines whenever you produce a document or deck for Acme. + +1. Use the colors and fonts in the sections below. +2. For wording, follow `references/voice-and-tone.md`. +3. For slides, start from `assets/slide-template.md`. +4. Before you finish, run `python3 ${CLAUDE_SKILL_DIR}/scripts/check_contrast.py` on any color pairs you chose. +``` + +Longer background that Claude reads only when a step calls for it, so it doesn't crowd `SKILL.md`. Mention the file by path at the step where Claude needs it.In this example, the file holds the writing rules the instructions point to in step 2: + +```markdown references/voice-and-tone.md theme={null} +# Voice and tone +- Write in the second person and the present tense. +- Prefer short sentences. Avoid exclamation marks. +- Product names are always capitalized: Acme Cloud, Acme Sync. +``` + +Templates, images, and data files that Claude copies or fills in rather than reads for guidance.In this example, the asset is the slide outline that step 3 tells Claude to start from: + +```markdown assets/slide-template.md theme={null} +# [Deck title] +## Agenda +## [Section 1] +## [Section 2] +## Next steps +``` + +Code that Claude runs while following the skill, for work that is more reliable as a program than as instructions. Reference it from `SKILL.md` with `${CLAUDE_SKILL_DIR}` so the path resolves wherever the skill is installed.In this example, the script checks that a text and background color pair has enough contrast: + +```python scripts/check_contrast.py theme={null} +import sys + +def luminance(hex_color): + r, g, b = (int(hex_color[i:i+2], 16) / 255 for i in (1, 3, 5)) + f = lambda c: c / 12.92 if c <= 0.03928 else ((c + 0.055) / 1.055) ** 2.4 + return 0.2126 * f(r) + 0.7152 * f(g) + 0.0722 * f(b) + +fg, bg = sys.argv[1], sys.argv[2] +l1, l2 = sorted((luminance(fg), luminance(bg)), reverse=True) +ratio = (l1 + 0.05) / (l2 + 0.05) +print(f"{ratio:.2f}", "OK" if ratio >= 4.5 else "LOW") +``` As a plain tree, the same skill looks like this. The directory name must match the `name` field in your `SKILL.md`, and everything except `SKILL.md` is optional: @@ -579,31 +216,29 @@ my-skill.zip └── scripts/ ``` - - - Make sure the directory name matches the `name` field in `SKILL.md`. - +**1. Check the directory name** + +Make sure the directory name matches the `name` field in `SKILL.md`. + +**2. Zip the directory from its parent folder** + +Where the `zip` command is available, such as on macOS and Linux, run it from the folder that contains the skill directory, so the directory becomes the top level of the archive: - - Where the `zip` command is available, such as on macOS and Linux, run it from the folder that contains the skill directory, so the directory becomes the top level of the archive: +```bash theme={null} +zip -r my-skill.zip my-skill/ +``` - ```bash theme={null} - zip -r my-skill.zip my-skill/ - ``` +If you use another tool to create the ZIP, compress the skill folder itself rather than the files inside it. - If you use another tool to create the ZIP, compress the skill folder itself rather than the files inside it. - +**3. Confirm the structure** - - List the archive and check that every entry starts with `my-skill/`: +List the archive and check that every entry starts with `my-skill/`: - ```bash theme={null} - unzip -l my-skill.zip - ``` +```bash theme={null} +unzip -l my-skill.zip +``` - If `SKILL.md` appears without the `my-skill/` prefix, you zipped the contents instead of the folder; zip again from the parent folder. - - +If `SKILL.md` appears without the `my-skill/` prefix, you zipped the contents instead of the folder; zip again from the parent folder. To check the skill's contents rather than the archive shape, [validate it before uploading](#before-uploading) with `skills-ref validate` or `claude plugin validate`, or ask Claude to review the folder against the [Agent Skills specification](https://agentskills.io/specification). @@ -615,31 +250,29 @@ Test the skill's files before you upload it, try it in Claude Code if you have i Before you upload the ZIP, check the skill's files: - - - Review `SKILL.md` for clarity. - +**1. Review SKILL.md** + +Review `SKILL.md` for clarity. + +**2. Check the description** + +Verify the description accurately reflects when Claude should use the skill. - - Verify the description accurately reflects when Claude should use the skill. - +**3. Check referenced files** - - Check that all referenced files exist. - +Check that all referenced files exist. - - Check the frontmatter against the Agent Skills specification with the [`skills-ref` reference tool](https://github.com/agentskills/agentskills/tree/main/skills-ref). It isn't preinstalled: clone that repository and install it into a Python virtual environment as its README describes, which puts `skills-ref` on your `PATH` while the environment is active. Then, from the folder that contains the skill directory, run: +**4. Validate the skill** - ```bash theme={null} - skills-ref validate ./my-skill - ``` +Check the frontmatter against the Agent Skills specification with the [`skills-ref` reference tool](https://github.com/agentskills/agentskills/tree/main/skills-ref). It isn't preinstalled: clone that repository and install it into a Python virtual environment as its README describes, which puts `skills-ref` on your `PATH` while the environment is active. Then, from the folder that contains the skill directory, run: - A skill that passes prints `Valid skill: ./my-skill`. Otherwise the command lists each problem, such as a `name` that doesn't match the directory or a frontmatter field the specification doesn't define. +```bash theme={null} +skills-ref validate ./my-skill +``` + +A skill that passes prints `Valid skill: ./my-skill`. Otherwise the command lists each problem, such as a `name` that doesn't match the directory or a frontmatter field the specification doesn't define. - If the skill is inside a plugin folder, running `claude plugin validate ./my-plugin` in your terminal also parses each skill's frontmatter: it reports a `SKILL.md` whose frontmatter doesn't parse, and prints `✔ Validation passed` when the plugin passes. - - +If the skill is inside a plugin folder, running `claude plugin validate ./my-plugin` in your terminal also parses each skill's frontmatter: it reports a `SKILL.md` whose frontmatter doesn't parse, and prints `✔ Validation passed` when the plugin passes. ### In Claude Code @@ -649,19 +282,17 @@ If you use [Claude Code](https://code.claude.com/docs/en/overview), you can try After you upload, confirm that Claude loads the skill when it should: - - - Go to [**Customize > Skills**](https://claude.ai/customize/skills) in claude.ai or the desktop app and turn the skill on. - +**1. Turn the skill on** + +Go to [**Customize > Skills**](https://claude.ai/customize/skills) in claude.ai or the desktop app and turn the skill on. + +**2. Try prompts that should trigger it** + +Send prompts that should trigger the skill, and review Claude's thinking to confirm it's loading the skill. - - Send prompts that should trigger the skill, and review Claude's thinking to confirm it's loading the skill. - +**3. Iterate on the description** - - Iterate on the description if Claude isn't using it when expected. - - +Iterate on the description if Claude isn't using it when expected. ### Measure whether the skill improves the output diff --git a/content/claude/skills/overview.md b/content/claude/skills/overview.md index 2fa2badaae..68b9fba160 100644 --- a/content/claude/skills/overview.md +++ b/content/claude/skills/overview.md @@ -10,10 +10,10 @@ Skills are directories containing instructions, scripts, and resources that Clau This page is for people who want to find, turn on, and use skills in Claude. - - * Skills are available on Pro, Max, Team, and Enterprise plans. They run in Claude's code sandbox, so **Code execution and file creation** must be on: turn it on under [**Settings > Capabilities**](https://claude.ai/settings/capabilities), or on Team and Enterprise plans ask an Owner to turn it on under **Organization settings > Capabilities** - * If you want to write a skill of your own, see [Create custom skills](/docs/skills/how-to) - +> [!NOTE] +> +> * Skills are available on Pro, Max, Team, and Enterprise plans. They run in Claude's code sandbox, so **Code execution and file creation** must be on: turn it on under [**Settings > Capabilities**](https://claude.ai/settings/capabilities), or on Team and Enterprise plans ask an Owner to turn it on under **Organization settings > Capabilities** +> * If you want to write a skill of your own, see [Create custom skills](/docs/skills/how-to) For the steps, go to [Find, turn on, and use skills](#find-turn-on-and-use-skills). @@ -31,19 +31,17 @@ A skill's description matters because it's the only part Claude sees before deci All of your skills are listed at [**Customize > Skills**](https://claude.ai/customize/skills) in claude.ai and the desktop app, including skills that came inside a plugin. - - - The **Your skills** tab lists the skills you have, grouped by where they came from: **Created by you**, **From your organization**, **Shared with you**, and **From Anthropic & Partners**. The **Discover** tab lists skills you can add. - +**1. Open Customize > Skills** - - Select **Turn on** on the skill's row, or open the skill and use the switch at the top of its page. A skill's instructions and any scripts it carries run as part of your conversation, and skills someone shares with you or that you upload yourself aren't reviewed by Anthropic, so open the skill and read its `SKILL.md` and files before you turn it on. - +The **Your skills** tab lists the skills you have, grouped by where they came from: **Created by you**, **From your organization**, **Shared with you**, and **From Anthropic & Partners**. The **Discover** tab lists skills you can add. - - Describe your task, and Claude loads a skill that's turned on when the task matches the skill's description. To pick one yourself, type `/` in the message box and select the skill. - - +**2. Turn a skill on** + +Select **Turn on** on the skill's row, or open the skill and use the switch at the top of its page. A skill's instructions and any scripts it carries run as part of your conversation, and skills someone shares with you or that you upload yourself aren't reviewed by Anthropic, so open the skill and read its `SKILL.md` and files before you turn it on. + +**3. Use it in a conversation** + +Describe your task, and Claude loads a skill that's turned on when the task matches the skill's description. To pick one yourself, type `/` in the message box and select the skill. A plugin's skills appear on **Your skills** too, labeled with the plugin's name. They turn on and off with the plugin, which you manage from [**Customize > Plugins**](/docs/plugins/overview#manage-installed-plugins). diff --git a/content/claude/third-party/claude-desktop/admin-console.md b/content/claude/third-party/claude-desktop/admin-console.md index e2cd8b6f9d..339bfa6f1e 100644 --- a/content/claude/third-party/claude-desktop/admin-console.md +++ b/content/claude/third-party/claude-desktop/admin-console.md @@ -6,11 +6,15 @@ > Manage your organization's Claude Desktop 3P configuration centrally with the Enterprise Admin Console, hosted by Anthropic - - The Enterprise Admin Console for Desktop 3P is in beta. Contact your Anthropic representative to have an organization provisioned. - +> [!NOTE] +> +> The Enterprise Admin Console for Desktop 3P is generally available. -With the Enterprise Admin Console, Anthropic hosts your organization's [Claude Desktop 3P](/docs/third-party/claude-desktop/overview) configuration, and your administrators manage it centrally instead of pushing files to each device. You sign in to the console in a browser and choose your inference provider, the app's settings, and which groups of users get which settings, rather than authoring an [MDM](/docs/third-party/claude-desktop/mdm) profile or running a [bootstrap server](/docs/third-party/claude-desktop/bootstrap). Your users sign in to Claude Desktop once with their work account, through your single sign-on if you connect it. The app then downloads the settings that apply to them and sends every model request to your provider. +> [!NOTE] +> +> To use the Enterprise Admin Console, contact your Anthropic representative to have an organization provisioned. + +With the Enterprise Admin Console, Anthropic hosts your organization's [Claude Desktop 3P](/docs/third-party/claude-desktop/overview) configuration, and your administrators manage it centrally instead of pushing files to each device. You sign in to the console in a browser and choose your inference provider, the app's settings, and which groups of users get which settings, rather than authoring an [MDM](/docs/third-party/claude-desktop/mdm) profile or running a [bootstrap server](/docs/third-party/claude-desktop/bootstrap). Your users sign in to Claude Desktop with their work account, through your single sign-on if you connect it. The app then downloads the settings that apply to them and sends every model request to your provider. Prompts, responses, and files go to your inference provider, as they do with MDM or a bootstrap server. Anthropic holds your user list and the settings you save. If you turn on usage analytics, Anthropic also holds token and session counts from your users' apps. Anthropic never holds provider credentials such as API keys or your users' tokens. For the full list of what Anthropic stores, see [Where your data goes](#where-your-data-goes). @@ -18,7 +22,7 @@ Prompts, responses, and files go to your inference provider, as they do with MDM Anthropic creates a Claude Enterprise organization for your deployment and invites a Primary Owner. Your administrators sign in to that organization at [claude.ai](https://claude.ai) and open **Organization settings**. There they add users and groups, connect single sign-on, assign administrator roles, and edit the Claude Desktop configuration for the whole organization and for individual groups. -On each device, the user signs in to Claude Desktop once. The app recognizes that the account belongs to a third-party deployment, downloads the configuration that applies to that user, and asks the user to restart. After the restart, the app runs in third-party mode. It sends model requests to your inference provider, as it does with MDM or bootstrap delivery. +On each device, the user signs in to Claude Desktop. The app recognizes that the account belongs to a third-party deployment, downloads the configuration that applies to that user, and asks the user to restart. After the restart, the app runs in third-party mode. It sends model requests to your inference provider, as it does with MDM or bootstrap delivery. While the app runs, it re-checks the configuration on a timer. When you save a change, the app downloads it at the next check and, for most settings, asks the user to relaunch, as described under [Configuration updates](#configuration-updates). You don't push an MDM profile or run a bootstrap server. @@ -41,7 +45,9 @@ Anthropic stores your organization's user accounts and the configuration you sav | Essential telemetry (crash and error reports) and non-essential telemetry (product analytics) | **Yes**, unless you turn them off on the **Telemetry & updates** page. Neither contains prompt or response content. [Telemetry and egress](/docs/third-party/claude-desktop/telemetry) describes what each category contains. | | Usage analytics: session, token, and estimated-cost counts per user, conversation, and model | **Yes**, if you turn on the **Report desktop usage to this organization** switch on the **Telemetry & updates** page. The switch is off by default. Users' apps report new counts only while the switch is on, and turning the switch off doesn't delete counts that Anthropic has already received. The counts contain no prompt, response, or file content. [Usage analytics](#usage-analytics) lists exactly what each report contains. | -The app contacts `api.anthropic.com` at every launch to check the user's sign-in and download the configuration. While the app runs, it contacts `api.anthropic.com` again every 10 minutes by default to check for configuration changes. The app contacts `claude.ai` when the user signs in. Both hosts are in addition to the hosts listed on [Telemetry and egress](/docs/third-party/claude-desktop/telemetry). While usage analytics is on, the app also sends its token and session counts to `api.anthropic.com` every few minutes during use and when it quits, so usage analytics needs no additional firewall entry. +The app contacts `api.anthropic.com` at every launch to check the user's sign-in and download the configuration. While the app runs, it contacts `api.anthropic.com` again every 10 minutes by default to check for configuration changes. The app contacts `claude.ai` when the user signs in, and the `claude.ai` sign-in and approval pages run a browser check from `hcaptcha.com` and `*.hcaptcha.com`. If those two hosts are blocked, signing in can fail with a message that the browser couldn't be verified, whichever sign-in method your organization uses. + +`api.anthropic.com`, `claude.ai`, `hcaptcha.com`, and `*.hcaptcha.com` are in addition to the hosts listed on [Telemetry and egress](/docs/third-party/claude-desktop/telemetry). While usage analytics is on, the app also sends its token and session counts to `api.anthropic.com` every few minutes during use and when it quits, so usage analytics needs no additional firewall entry. ## Get set up @@ -57,15 +63,15 @@ A new organization starts set to **Invite only**, so only people you invite can When the new organization shares your existing organization's single sign-on connection, as described under [Get set up](#get-set-up), you still choose, separately for each organization, how people join it and which groups from your identity provider it uses. Groups synced from your identity provider through SCIM appear among the organization's groups and can carry their own settings, as described under [Per-group permission policies](#per-group-permission-policies). -The Claude sign-in is separate from the sign-in to your inference provider or gateway, and the app never sends Claude account credentials or tokens to your provider. Users sign in to Claude once to receive their settings. They then authenticate to your provider the same way they do with MDM or bootstrap delivery. +The Claude sign-in is separate from the sign-in to your inference provider or gateway, and the app never sends Claude account credentials or tokens to your provider. Users sign in to Claude to receive their settings. They then authenticate to your provider the same way they do with MDM or bootstrap delivery. ## Configure Claude Desktop Sign in at [claude.ai](https://claude.ai), switch to the organization, and open **Organization settings**. The **Desktop 3P** section in the left navigation has one page per settings area, listed under [What you can configure](#what-you-can-configure). Each field sets one of the documented [configuration keys](/docs/third-party/claude-desktop/configuration), and the console checks values as you type and again when you click **Save changes**. - - Save the **Connection** page, where you choose your inference provider, before the other pages. The console doesn't accept **Save changes** on any other page until a connection is saved. A user who signs in to Claude Desktop and clicks **Restart** before a connection is saved stays in standard Claude Desktop instead of switching to your configuration. After you save the connection, ask those users to quit and reopen Claude Desktop, then restart when prompted. - +> [!NOTE] +> +> Save the **Connection** page, where you choose your inference provider, before the other pages. The console doesn't accept **Save changes** on any other page until a connection is saved. A user who signs in to Claude Desktop and clicks **Restart** before a connection is saved stays in standard Claude Desktop instead of switching to your configuration. After you save the connection, ask those users to quit and reopen Claude Desktop, then restart when prompted. ### Start from an existing configuration file @@ -100,13 +106,15 @@ From the console you can set the same [configuration keys](/docs/third-party/cla The console refuses API keys, tokens, and secrets anywhere in the configuration, including in request headers and MCP server settings. The one exception is the client secret of a Google Desktop-app OAuth client, for [Google sign-in to your inference provider](#choose-how-users-authenticate-to-your-provider) or a [managed MCP server that signs in with Google](/docs/third-party/claude-desktop/mcp-sign-in#where-the-client-secret-goes), which Google doesn't treat as confidential. Users authenticate to your provider on the device, as described under [Choose how users authenticate to your provider](#choose-how-users-authenticate-to-your-provider). +A setting takes effect only on Claude Desktop releases that support it, so a device on an earlier release gets a new restriction only after it updates. The [configuration changelog](/docs/third-party/claude-desktop/configuration-changelog) lists the release that added each key. + Most of these settings can also differ per group of users, on the **Permission policies** page under **People**, as described under [Per-group permission policies](#per-group-permission-policies). ### Choose how users authenticate to your provider - - Choose an interactive sign-in wherever your provider offers one. It is the recommended credential kind for a deployment managed from the console. Users sign in inside the app with their own accounts, and there is no shared credential to distribute to devices or rotate. - +> [!TIP] +> +> Choose an interactive sign-in wherever your provider offers one. It is the recommended credential kind for a deployment managed from the console. Users sign in inside the app with their own accounts, and there is no shared credential to distribute to devices or rotate. The console never holds a provider credential. The **Credential kind** field on the **Connection** page tells Claude Desktop how each user's device obtains one, and offers the kinds your provider supports: **Interactive sign-in** in the app, **Identity provider sign-in (OIDC)** (for example, for [Amazon Bedrock behind an authenticating proxy](/docs/third-party/claude-desktop/bedrock#sign-in-with-your-identity-provider)), **Workforce Identity** (Google Cloud's Agent Platform only), **Cloud vendor profile** (an AWS profile or Google Cloud credentials file already on the device), or **Helper script** (a [credential helper](/docs/third-party/claude-desktop/credential-helper) on the device). Static API keys and bearer tokens aren't offered, because the console refuses to store them. The same **Connection** settings go to every user, so a credential kind that depends on something present on each device works only if your device management puts it there. @@ -160,33 +168,31 @@ Unified Claude is in beta. In an organization with no saved configuration, the c While Unified Claude is on, it overrides the **Chat**, [**Advanced file analysis**](/docs/third-party/claude-desktop/chat#advanced-file-analysis), and **Cowork** switches, including where you turned one of them off. - - While Unified Claude is on for your organization, it is on for every group. That includes a group whose policy turns Chat or Cowork off. You can't return a group to separate Chat and Cowork until you turn Unified Claude off for your organization. - - To keep Chat, advanced file analysis, and Cowork off for a group, turn off the **Chat and Cowork unified view** switch in the group's policy. Where Unified Claude is still off for your organization, set the group's switches before you turn Unified Claude on. Turn on the group's **Opt into the new Chat and Cowork unified view** switch. If the **Chat and Cowork unified view** switch under it is on, turn it off. To keep a group's own **Chat** and **Cowork** switches in effect, keep Unified Claude off for your organization. Turn it on only in the policies of the groups that should have it. For a member of several groups, Unified Claude comes from the highest-ranked of their policies that sets it, even when a higher-ranked policy turns Chat or Cowork off. - +> [!WARNING] +> +> While Unified Claude is on for your organization, it is on for every group. That includes a group whose policy turns Chat or Cowork off. You can't return a group to separate Chat and Cowork until you turn Unified Claude off for your organization. +> +> To keep Chat, advanced file analysis, and Cowork off for a group, turn off the **Chat and Cowork unified view** switch in the group's policy. Where Unified Claude is still off for your organization, set the group's switches before you turn Unified Claude on. Turn on the group's **Opt into the new Chat and Cowork unified view** switch. If the **Chat and Cowork unified view** switch under it is on, turn it off. To keep a group's own **Chat** and **Cowork** switches in effect, keep Unified Claude off for your organization. Turn it on only in the policies of the groups that should have it. For a member of several groups, Unified Claude comes from the highest-ranked of their policies that sets it, even when a higher-ranked policy turns Chat or Cowork off. To turn on Unified Claude for your whole organization, open **Organization settings** and go to the **Capabilities** page under **Desktop 3P**. Under **Allowed surfaces**, turn on the **Opt into the new Chat and Cowork unified view** switch. If the **Chat and Cowork unified view** switch under it is off, turn it on. Click **Save changes**. To turn on Unified Claude for some groups only: - - - Open **Organization settings** and go to the **Capabilities** page under **Desktop 3P**. If the **Opt into the new Chat and Cowork unified view** switch under **Allowed surfaces** is off, continue with the next step. If the switch is on, turn it off, set the **Chat** and **Cowork** switches that reappear, and click **Save changes**. - +**1. Make sure Unified Claude is off for your organization** + +Open **Organization settings** and go to the **Capabilities** page under **Desktop 3P**. If the **Opt into the new Chat and Cowork unified view** switch under **Allowed surfaces** is off, continue with the next step. If the switch is on, turn it off, set the **Chat** and **Cowork** switches that reappear, and click **Save changes**. + +**2. Open the group's policy** - - Go to the **Permission policies** page under **People**. Open the group's policy, or click **Add permission policy** and pick the group, as described under [Per-group permission policies](#per-group-permission-policies). - +Go to the **Permission policies** page under **People**. Open the group's policy, or click **Add permission policy** and pick the group, as described under [Per-group permission policies](#per-group-permission-policies). - - In the policy's **Capabilities** section, turn on the **Opt into the new Chat and Cowork unified view** switch. If the **Chat and Cowork unified view** switch under it is off, turn it on. - +**3. Turn on Unified Claude for the group** - - Click **Save changes**. - - +In the policy's **Capabilities** section, turn on the **Opt into the new Chat and Cowork unified view** switch. If the **Chat and Cowork unified view** switch under it is off, turn it on. + +**4. Save the policy** + +Click **Save changes**. Turn off Unified Claude for your organization or for a group: @@ -218,18 +224,16 @@ When you turn on the switch, a running app trims its copy at its next configurat Usage analytics lets your administrators see how much each user uses Chat, Cowork, and Code in Claude Desktop. Usage analytics is off by default. A member with the Owner or Primary Owner role can turn it on: open **Organization settings**, go to the **Telemetry & updates** page under **Desktop 3P**, and turn on the **Report desktop usage to this organization** switch. -As a beta feature, usage analytics hasn't yet been reviewed for HIPAA compliance. Anthropic will provide guidance on HIPAA compliance at general availability. For now, if your organization needs HIPAA compliance, don't turn on the switch. - Claude Desktop 1.46388.1 and later report usage. While the switch is on, each user's app counts its Chat, Cowork, and Code activity. The app sends the counts to Anthropic every few minutes during use and when it quits. A running app starts or stops reporting at its next configuration check (every 10 minutes by default), without a relaunch. Anthropic stores the counts for your organization and ties each report to the user's Claude account. The counts appear on the **Desktop usage** page. To open the page, click **Analytics** in the user menu on claude.ai, or **Desktop usage** under **Desktop 3P** in **Organization settings**. The page includes the following: -* Sessions and tokens for Chat, Cowork, and Code (the page labels Code **Claude Code**). -* A daily chart. +* Sessions and tokens for Chat, Cowork, and Code (the page labels Code **Claude Code**). Token totals leave out cached tokens, which your provider also bills. The counts are approximate. For example, an app that stops unexpectedly can lose its last few minutes of counts. +* A daily chart. Days and months on the page are in UTC. * A chart of tokens by model. * A **Team** table with one row for each member who reported usage that month. Each row shows the member's name and email from your member list, their sessions, their tokens, and their last active day. -Click a member's row in the **Team** table to show only that member's sessions and tokens. When the month's reports include cost estimates, switch the control at the top of the page from **Tokens** to **Cost** to show estimated cost in US dollars instead of tokens. Estimated cost and the chart of tokens by model cover the whole organization, and the page doesn't show them while a single member is selected. +Click a member's row in the **Team** table to show only that member's sessions and tokens. When the month's reports include cost estimates, switch the control at the top of the page from **Tokens** to **Cost** to show estimated cost in US dollars instead of tokens. In the **Cost** view, the **Team** table shows each member's estimated cost. While a single member is selected, the page doesn't show estimated cost or the chart of tokens by model. To download a CSV file, click the **Export** button above the **Team** table. The file has one row for each member who matches the table's search, including the member's input, output, cache read, and cache write tokens and, when the month has estimates, their estimated cost. @@ -262,30 +266,30 @@ Before the first user signs in, confirm the following: * Single sign-on is connected, if you use it, and the users you want on this deployment are invited or provisioned, as described under [Connect your identity provider](#connect-your-identity-provider) * Devices run the latest Claude Desktop release, installed as described in [Installation and setup](/docs/third-party/claude-desktop/installation) * Devices carry no MDM-delivered Claude Desktop configuration other than the [app-behavior keys](/docs/third-party/claude-desktop/mdm#update-keys-and-managed-precedence) (the update, configuration re-check, relaunch window, and network proxy keys). For a device that keeps a managed profile or registry policy with any other key, see [Devices with a managed profile](#devices-with-a-managed-profile). -* Devices can reach `api.anthropic.com` at every launch and while the app runs, and `claude.ai` when users sign in, in addition to the hosts on [Telemetry and egress](/docs/third-party/claude-desktop/telemetry) +* Devices can reach `api.anthropic.com` at every launch and while the app runs, and `claude.ai`, `hcaptcha.com`, and `*.hcaptcha.com` when users sign in, in addition to the hosts on [Telemetry and egress](/docs/third-party/claude-desktop/telemetry) A device picks up the configuration from the admin console the first time the user signs in to Claude in the app. Walk through it on a test device first. - - - Open Claude Desktop and sign in on the standard sign-in screen with your work email address, through your organization's single sign-on if you use it. - +**1. Sign in to Claude** + +Open Claude Desktop and sign in on the standard sign-in screen with your work email address, through your organization's single sign-on if you use it. + +**2. Restart when prompted** + +The app shows a dialog titled with your organization's name that reads "Your organization's Claude settings have changed. Restart to apply them." You can't dismiss the dialog. Click **Restart**, and the app relaunches in third-party mode with your configuration. An account that also belongs to another Claude organization sees a **Switch and restart** prompt instead, as described under [Users in more than one Claude organization](#users-in-more-than-one-claude-organization). - - The app shows a dialog titled with your organization's name that reads "Your organization's Claude settings have changed. Restart to apply them." You can't dismiss the dialog. Click **Restart**, and the app relaunches in third-party mode with your configuration. An account that also belongs to another Claude organization sees a **Switch and restart** prompt instead, as described under [Users in more than one Claude organization](#users-in-more-than-one-claude-organization). - +**3. Sign in to the inference provider** - - If your connection uses an interactive sign-in, sign in to your inference provider or gateway next, as with MDM or bootstrap delivery. - +If your connection uses an interactive sign-in, sign in to your inference provider or gateway next, as with MDM or bootstrap delivery. - - The account menu at the bottom of the sidebar shows your organization's name and an **Inference configuration** item marked **Managed by your organization**, and **Settings → Privacy** names your inference provider. On a device whose managed profile sets any key other than the [app-behavior keys](/docs/third-party/claude-desktop/mdm#update-keys-and-managed-precedence), the account menu shows your organization's name without the **Inference configuration** item. - - +**4. Check the result** + +The account menu at the bottom of the sidebar shows your organization's name and an **Inference configuration** item marked **Managed by your organization**, and **Settings → Privacy** names your inference provider. On a device whose managed profile sets any key other than the [app-behavior keys](/docs/third-party/claude-desktop/mdm#update-keys-and-managed-precedence), the account menu shows your organization's name without the **Inference configuration** item. If something looks wrong, **Help → Troubleshooting → Generate Diagnostic Report** produces a report that shows where the app read its configuration from. You can share it with your Anthropic representative. +Give each user their own computer login. Claude Desktop keeps conversation history for each computer login and organization, not for each Claude account, and **Sign out** doesn't delete it. Members of your organization who share a computer login see each other's conversations. If people must share a login, ask each person to choose **Sign out** from the account menu when they finish, so that the next person signs in with their own Claude account. + ### Users in more than one Claude organization A user's Claude account can belong to your deployment's organization and to other Claude organizations, and the user can move between them in Claude Desktop. When such a user signs in, the app opens in their other organization and asks whether to switch to yours, with **Switch and restart** and **Not now** buttons. A user who chooses **Not now** isn't asked again on that device and can switch later by choosing your organization from the account menu. Each move into or out of your organization restarts the app, because third-party mode runs as a separate app configuration. To go back, the user chooses **Sign out** and signs in to Claude again after the restart. From Claude Desktop 1.49585.0, they can instead pick their other organization from the account menu, which also restarts the app and asks them to sign in. @@ -304,38 +308,43 @@ An app that isn't running picks up the change at its next launch. Connection and If a setting is changed that affects where users' apps connect or sign in, or what can run on their devices (including when permission policies are added, removed, or reordered), Owners receive an email alert with the identity of the administrator who made the change. +### When the Claude sign-in expires + +About once a month, a user's sign-in to Claude on a device expires. + +* **App not running**: the app asks the user to sign in again at its next launch. +* **App running**: the app keeps its current settings, and conversations continue. Until the user signs in again, the app doesn't download [configuration changes](#configuration-updates) or report [usage analytics](#usage-analytics). From Claude Desktop 2.42304.0, the app shows a **Your session has expired** banner with a **Sign in again** button. The banner appears in places such as the home screen and Code, but not in an open chat or Cowork task. Earlier releases show no message, and the user quits and reopens the app to sign in again. + ## Migrate an existing fleet to the admin console If your fleet gets its Claude Desktop configuration from [MDM](/docs/third-party/claude-desktop/mdm), a [bootstrap server](/docs/third-party/claude-desktop/bootstrap), or the [in-app configuration window](/docs/third-party/claude-desktop/in-app-configuration), you can move it to the admin console and keep your inference provider, unless that provider is the [Claude API](#limitations). Users' earlier work [stays on each device](#where-your-data-goes). The app copies that work on the same device so it appears under your organization. Try these steps on a test device first. - - - Upload your current configuration, as described under [Start from an existing configuration file](#start-from-an-existing-configuration-file). Put settings that differ between groups of users in [per-group permission policies](#per-group-permission-policies). - +**1. Import your configuration** + +Upload your current configuration, as described under [Start from an existing configuration file](#start-from-an-existing-configuration-file). Put settings that differ between groups of users in [per-group permission policies](#per-group-permission-policies). - - Set every setting you rely on in the console, because the console's configuration replaces the profile's. Add your [plugin marketplaces](#plugin-marketplaces) on the **Plugins** page. To migrate users' work, check that the **Automatically import earlier third-party sessions** switch under **Claude.ai data import** on the **Connectors** page is on (the default). To skip the migration, turn it off. Devices that already migrated keep their items. +**2. Finish the configuration before users sign in** - - The app migrates users' work once on each device, the next time it starts after the user signs in to your organization. It skips uploaded plugins, saved skills, and scheduled tasks if the console has turned that feature off, and optional plugins that your organization doesn't offer yet. Changing those settings later doesn't migrate the skipped items. - - +Set every setting you rely on in the console, because the console's configuration replaces the profile's. Add your [plugin marketplaces](#plugin-marketplaces) on the **Plugins** page. To migrate users' work, check that the **Automatically import earlier third-party sessions** switch under **Claude.ai data import** on the **Connectors** page is on (the default). To skip the migration, turn it off. Devices that already migrated keep their items. - - Update devices to Claude Desktop 2.42304.0 or later. Earlier releases migrate fewer items. - +> [!WARNING] +> +> The app migrates users' work once on each device, the next time it starts after the user signs in to your organization. It skips uploaded plugins, saved skills, and scheduled tasks if the console has turned that feature off, and optional plugins that your organization doesn't offer yet. Changing those settings later doesn't migrate the skipped items. - - Remove the Claude Desktop configuration profile or registry policy, including one that carries only bootstrap keys. You can keep a profile that sets only the [app-behavior keys](/docs/third-party/claude-desktop/mdm#update-keys-and-managed-precedence). +**3. Update Claude Desktop** - * **Devices that keep a profile with any other key**: see [Devices with a managed profile](#devices-with-a-managed-profile) - * **Devices configured in the app**: the user signs out and chooses the Anthropic sign-in option, as described under [Single-machine setup](/docs/third-party/claude-desktop/installation#single-machine-setup) - +Update devices to Claude Desktop 2.42304.0 or later. Earlier releases migrate fewer items. - - Have users sign in to Claude with their work email address and restart the app when asked, as described under [Onboard users](#onboard-users). - - +**4. Remove the managed profile** + +Remove the Claude Desktop configuration profile or registry policy, including one that carries only bootstrap keys. You can keep a profile that sets only the [app-behavior keys](/docs/third-party/claude-desktop/mdm#update-keys-and-managed-precedence). + +* **Devices that keep a profile with any other key**: see [Devices with a managed profile](#devices-with-a-managed-profile) +* **Devices configured in the app**: the user signs out and chooses the Anthropic sign-in option, as described under [Single-machine setup](/docs/third-party/claude-desktop/installation#single-machine-setup) + +**5. Have users sign in** + +Have users sign in to Claude with their work email address and restart the app when asked, as described under [Onboard users](#onboard-users). ### What is migrated @@ -413,9 +422,9 @@ You can use `forceLoginOrgUUID` to help prevent shadow IT, which here means peop For the macOS and Windows locations where the app reads a managed profile's keys, see [Deploy the configuration](/docs/third-party/claude-desktop/mdm#4-deploy-the-configuration). - - On a device that uses the admin console, adding either key to a profile that sets only [app-behavior keys](/docs/third-party/claude-desktop/mdm#update-keys-and-managed-precedence) changes which settings apply. See [Which settings apply on a device with a managed profile](#which-settings-apply-on-a-device-with-a-managed-profile). With `disableDeploymentModeChooser` set to `true`, the profile becomes the device's whole configuration, and the device stops using the admin console. To require members who also belong to another organization to switch to yours, leave such a profile as it is and turn on [**Require this organization in Claude Desktop**](#users-in-more-than-one-claude-organization). - +> [!WARNING] +> +> On a device that uses the admin console, adding either key to a profile that sets only [app-behavior keys](/docs/third-party/claude-desktop/mdm#update-keys-and-managed-precedence) changes which settings apply. See [Which settings apply on a device with a managed profile](#which-settings-apply-on-a-device-with-a-managed-profile). With `disableDeploymentModeChooser` set to `true`, the profile becomes the device's whole configuration, and the device stops using the admin console. To require members who also belong to another organization to switch to yours, leave such a profile as it is and turn on [**Require this organization in Claude Desktop**](#users-in-more-than-one-claude-organization). ## Remove users or return to MDM @@ -423,13 +432,17 @@ A user returns a device to standard Claude Desktop by choosing **Sign out** from When you remove a user from the organization, Anthropic revokes their Claude Desktop sign-in to that organization. A running app isn't interrupted. At its next launch the app can no longer download the organization's configuration. It shows either your organization's sign-in screen, where **Return to Claude.ai sign-in** returns the device to standard Claude Desktop, or a **Restart required** prompt whose **Restart** button does the same. -To return a whole fleet to [MDM](/docs/third-party/claude-desktop/mdm) or [bootstrap](/docs/third-party/claude-desktop/bootstrap) delivery, deploy the profile again with [`disableDeploymentModeChooser`](/docs/third-party/claude-desktop/configuration#disabledeploymentmodechooser) set to `true`. The device returns to the profile's configuration at the app's next launch. From Claude Desktop 1.46388.1, a running app also notices the profile or policy at its next configuration re-check and asks the user to relaunch. To move a fleet to standard Claude Desktop instead, deploy a profile of standard Claude Desktop keys that sets [`forceLoginOrgUUID`](/docs/cowork/hipaa-setup#what-each-claude-desktop-key-does) to another organization's ID, the one your users move to. +> [!NOTE] +> +> Removing a user doesn't end their access to your inference provider. To stop model requests from an app that is still running, also end their access at your provider or identity provider. - - Keep `disableDeploymentModeChooser` (or, for standard Claude Desktop, `forceLoginOrgUUID`) in the profile. On Claude Desktop 2.37337.0 or later, without the key the device goes back to the admin console's configuration at its next launch, without asking the user. If the user's sign-in to your organization has expired or you removed the user, the app shows your organization's sign-in screen or a **Restart required** prompt instead. +To return a whole fleet to [MDM](/docs/third-party/claude-desktop/mdm) or [bootstrap](/docs/third-party/claude-desktop/bootstrap) delivery, deploy the profile again with [`disableDeploymentModeChooser`](/docs/third-party/claude-desktop/configuration#disabledeploymentmodechooser) set to `true`. The device returns to the profile's configuration at the app's next launch. From Claude Desktop 1.46388.1, a running app also notices the profile or policy at its next configuration re-check and asks the user to relaunch. To move a fleet to standard Claude Desktop instead, deploy a profile of standard Claude Desktop keys that sets [`forceLoginOrgUUID`](/docs/cowork/hipaa-setup#what-each-claude-desktop-key-does) to another organization's ID, the one your users move to. - A device that left the admin console's configuration on an earlier release goes back too, so add `disableDeploymentModeChooser` to the profile before devices update. A key that you add later takes effect at the device's next launch. - +> [!WARNING] +> +> Keep `disableDeploymentModeChooser` (or, for standard Claude Desktop, `forceLoginOrgUUID`) in the profile. On Claude Desktop 2.37337.0 or later, without the key the device goes back to the admin console's configuration at its next launch, without asking the user. If the user's sign-in to your organization has expired or you removed the user, the app shows your organization's sign-in screen or a **Restart required** prompt instead. +> +> A device that left the admin console's configuration on an earlier release goes back too, so add `disableDeploymentModeChooser` to the profile before devices update. A key that you add later takes effect at the device's next launch. Conversations created under the admin console's configuration stay on the device but no longer appear in the app's history after the device returns to the profile. Users can bring them into the app's history from **Settings → Import & export** in the app, as described under [Open the import wizard](/docs/third-party/claude-desktop/import#open-the-import-wizard), after you set the [`claudeAiImport`](/docs/third-party/claude-desktop/configuration#claudeaiimport) key with `enabled` set to `true` in the profile or policy you deploy. @@ -487,9 +500,9 @@ Header values you save are never returned. In every `headers` or `customHeaders` A write goes through the same server checks as a save in the admin console, but the console checks more before it saves, for example that the connection to your inference provider is complete. A write can therefore store a connection that users' apps can't use. Put every setting your provider requires in `config`, including [how users authenticate](#choose-how-users-authenticate-to-your-provider), so that users' apps can pick up the change as described under [Configuration updates](#configuration-updates). Owners receive the email alert described there when a write changes where users' apps connect or sign in, what can run on their devices, or the `status`. In place of an administrator, the alert names the key by its ID (`apikey_…`). - - Setting `status` to `disabled` stops serving the configuration to users' apps, as if none had been saved. A running app isn't interrupted. At its next launch it shows a **Restart required** prompt whose **Restart** button returns the device to standard Claude Desktop, signed out. New sign-ins also stay in standard Claude Desktop. To serve the configuration again, set `status` back to `active` with another API write, or open **Organization settings**, go to the **Connection** page under **Desktop 3P**, and click **Turn on** in the banner at the top of the page. After that, users who clicked **Restart** sign in again as described under [Onboard users](#onboard-users). - +> [!WARNING] +> +> Setting `status` to `disabled` stops serving the configuration to users' apps, as if none had been saved. A running app isn't interrupted. At its next launch it shows a **Restart required** prompt whose **Restart** button returns the device to standard Claude Desktop, signed out. New sign-ins also stay in standard Claude Desktop. To serve the configuration again, set `status` back to `active` with another API write, or open **Organization settings**, go to the **Connection** page under **Desktop 3P**, and click **Turn on** in the banner at the top of the page. After that, users who clicked **Restart** sign in again as described under [Onboard users](#onboard-users). ### Admin API errors @@ -507,3 +520,4 @@ A write goes through the same server checks as a save in the admin console, but * The [Claude API](/docs/third-party/claude-desktop/claude-api) is not available as the inference provider with the admin console. * If a device can't reach `api.anthropic.com` at launch, the app opens with a **Configuration sync issue** warning and can't connect to your inference provider until it downloads the configuration. It keeps retrying in the background and loads the configuration when a retry succeeds, without a relaunch. Quitting and reopening the app retries immediately. An app that is already running keeps working if the connection to Anthropic drops. * Bootstrap keys and settings that only make sense on the device, such as disabling claude.ai sign-in, are not available in the console. +* The console has no field for [`modelCatalogEnabled`](/docs/third-party/claude-desktop/configuration#modelcatalogenabled), [`modelCatalogUrl`](/docs/third-party/claude-desktop/configuration#modelcatalogurl), or [`deploymentDisplaySubtitle`](/docs/third-party/claude-desktop/configuration#deploymentdisplaysubtitle). An app managed from the console never fetches the model catalog, so it doesn't need the two catalog keys. diff --git a/content/claude/third-party/claude-desktop/bedrock.md b/content/claude/third-party/claude-desktop/bedrock.md index bd5d9c9bc7..32f16edbd5 100644 --- a/content/claude/third-party/claude-desktop/bedrock.md +++ b/content/claude/third-party/claude-desktop/bedrock.md @@ -28,50 +28,48 @@ When more than one credential is configured, the app uses the first one present These steps are performed once per AWS organization, regardless of which authentication approach you chose. You need an AWS account with permission to manage Amazon Bedrock model access and IAM Identity Center. - - - In the [Amazon Bedrock console](https://console.aws.amazon.com/bedrock/), open **Model access** and request access to the Claude models you intend to deploy. Access is granted per region, so enable the models in the same region you will set as `inferenceBedrockRegion`. - - - - Skip this step if you chose the bearer-token or identity provider sign-in approach. The named-profile and in-app AWS sign-in approaches both use IAM Identity Center to issue per-user AWS credentials. - - In the [IAM Identity Center console](https://console.aws.amazon.com/singlesignon/), create a permission set with an inline policy that allows Amazon Bedrock inference. The minimal policy is: - - ```json theme={null} - { - "Version": "2012-10-17", - "Statement": [{ - "Effect": "Allow", - "Action": [ - "bedrock:InvokeModel", - "bedrock:InvokeModelWithResponseStream" - ], - "Resource": "*" - }] - } - ``` - - Set the permission set's **Session duration** to between 8 and 12 hours. This value sets how long each set of temporary AWS credentials lasts before the app requests a new set from IAM Identity Center. It does not control how often users sign in. Sign-in frequency follows the access portal session duration, described under [What users experience](#what-users-experience). - - - - If your organization uses Microsoft Entra ID, Okta, or another SAML identity provider, you can configure it as the identity source for IAM Identity Center so users sign in with their existing corporate credentials. The per-device steps on this page are unchanged. See [Connect to an external identity provider](https://docs.aws.amazon.com/singlesignon/latest/userguide/manage-your-identity-source-idp.html) in the AWS documentation. - - - - In IAM Identity Center, assign the permission set to the AWS account that hosts Amazon Bedrock, and add the users or groups who should have access. - - - - From the IAM Identity Center **Settings** page, note: - - * **AWS access portal URL**: of the form `https://d-xxxxxxxxxx.awsapps.com/start` (or your custom subdomain) - * **Identity Center region**: the region where Identity Center is enabled, which may differ from your Amazon Bedrock region - * **AWS account ID**: the 12-digit ID of the account where you enabled Amazon Bedrock - * **Permission set name**: the name you gave the permission set above - - +**1. Enable Claude models in Amazon Bedrock** + +In the [Amazon Bedrock console](https://console.aws.amazon.com/bedrock/), open **Model access** and request access to the Claude models you intend to deploy. Access is granted per region, so enable the models in the same region you will set as `inferenceBedrockRegion`. + +**2. Create an IAM Identity Center permission set** + +Skip this step if you chose the bearer-token or identity provider sign-in approach. The named-profile and in-app AWS sign-in approaches both use IAM Identity Center to issue per-user AWS credentials. + +In the [IAM Identity Center console](https://console.aws.amazon.com/singlesignon/), create a permission set with an inline policy that allows Amazon Bedrock inference. The minimal policy is: + +```json theme={null} +{ + "Version": "2012-10-17", + "Statement": [{ + "Effect": "Allow", + "Action": [ + "bedrock:InvokeModel", + "bedrock:InvokeModelWithResponseStream" + ], + "Resource": "*" + }] +} +``` + +Set the permission set's **Session duration** to between 8 and 12 hours. This value sets how long each set of temporary AWS credentials lasts before the app requests a new set from IAM Identity Center. It does not control how often users sign in. Sign-in frequency follows the access portal session duration, described under [What users experience](#what-users-experience). + +**3. Federate Identity Center to your IdP (optional)** + +If your organization uses Microsoft Entra ID, Okta, or another SAML identity provider, you can configure it as the identity source for IAM Identity Center so users sign in with their existing corporate credentials. The per-device steps on this page are unchanged. See [Connect to an external identity provider](https://docs.aws.amazon.com/singlesignon/latest/userguide/manage-your-identity-source-idp.html) in the AWS documentation. + +**4. Assign users to the permission set** + +In IAM Identity Center, assign the permission set to the AWS account that hosts Amazon Bedrock, and add the users or groups who should have access. + +**5. Record the values you need for device configuration** + +From the IAM Identity Center **Settings** page, note: + +* **AWS access portal URL**: of the form `https://d-xxxxxxxxxx.awsapps.com/start` (or your custom subdomain) +* **Identity Center region**: the region where Identity Center is enabled, which may differ from your Amazon Bedrock region +* **AWS account ID**: the 12-digit ID of the account where you enabled Amazon Bedrock +* **Permission set name**: the name you gave the permission set above ## Prepare devices @@ -194,23 +192,21 @@ The full set of `inferenceBedrock*` keys is below. Set `inferenceProvider` to `b | Setting | Type | Availability | Default | Description | | - | - | - | - | - | -| AWS region
`inferenceBedrockRegion` | `string` | MDM + Bootstrap
Added in 1.2581.0 | — | AWS region for the Bedrock runtime endpoint. | -| Bedrock base URL
`inferenceBedrockBaseUrl` | `string` | MDM + Bootstrap
Added in 1.2581.0 | — | For VPC endpoints or gateway proxies. Host origin only. | -| Bedrock service tier
`inferenceBedrockServiceTier` | `enum` | MDM + Bootstrap
Added in 1.5186.0 | — | Sent as the X-Amzn-Bedrock-Service-Tier header. Leave unset for on-demand. One of: `flex`, `priority`. | -| AWS bearer token
`inferenceBedrockBearerToken` | `string` | MDM + Bootstrap
Added in 1.2581.0 | — | Static bearer token for inference. For providers that support profile or helper-script credentials, prefer those. | -| AWS SSO start URL
`inferenceBedrockSsoStartUrl` | `string` | MDM + Bootstrap
Added in 1.6259.0 | — | Enables in-app AWS sign-in (no AWS CLI needed). Set with the three SSO fields below. | -| AWS SSO region
`inferenceBedrockSsoRegion` | `string` | MDM + Bootstrap
Added in 1.6259.0 | — | IAM Identity Center home region. | -| AWS SSO account ID
`inferenceBedrockSsoAccountId` | `string` | MDM + Bootstrap
Added in 1.6259.0 | — | 12-digit AWS account ID assigned to users in IAM Identity Center. | -| AWS SSO role name
`inferenceBedrockSsoRoleName` | `string` | MDM + Bootstrap
Added in 1.6259.0 | — | IAM Identity Center permission-set name granting bedrock:InvokeModel\* on the account above. | -| AWS profile name
`inferenceBedrockProfile` | `string` | MDM + Bootstrap
Added in 1.2581.0 | — | AWS named profile to use for Bedrock inference credentials. | -| AWS config directory
`inferenceBedrockAwsDir` | `string` | MDM + Bootstrap
Added in 1.2581.0 | — | Folder with AWS config/credentials. Defaults to \~/.aws when no bearer token is set. | -| AWS CLI path
`inferenceBedrockAwsCliPath` | `string` | MDM + Bootstrap
Added in 1.13576.0 | — | Absolute path to the aws executable. Leave unset to find it on PATH. | - - - - Tier availability varies by model and region. Reserved capacity uses a provisioned-throughput ARN as the model ID instead of this setting. Older bundled Claude Code CLI versions ignore this key. - - +| AWS region `inferenceBedrockRegion` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | AWS region for the Bedrock runtime endpoint. | +| Bedrock base URL `inferenceBedrockBaseUrl` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | For VPC endpoints or gateway proxies. Host origin only. | +| Bedrock service tier `inferenceBedrockServiceTier` | `enum` | MDM + Bootstrap Added in 1.5186.0 | — | Sent as the X-Amzn-Bedrock-Service-Tier header. Leave unset for on-demand. One of: `flex`, `priority`. | +| AWS bearer token `inferenceBedrockBearerToken` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | Static bearer token for inference. For providers that support profile or helper-script credentials, prefer those. | +| AWS SSO start URL `inferenceBedrockSsoStartUrl` | `string` | MDM + Bootstrap Added in 1.6259.0 | — | Enables in-app AWS sign-in (no AWS CLI needed). Set with the three SSO fields below. | +| AWS SSO region `inferenceBedrockSsoRegion` | `string` | MDM + Bootstrap Added in 1.6259.0 | — | IAM Identity Center home region. | +| AWS SSO account ID `inferenceBedrockSsoAccountId` | `string` | MDM + Bootstrap Added in 1.6259.0 | — | 12-digit AWS account ID assigned to users in IAM Identity Center. | +| AWS SSO role name `inferenceBedrockSsoRoleName` | `string` | MDM + Bootstrap Added in 1.6259.0 | — | IAM Identity Center permission-set name granting bedrock:InvokeModel\* on the account above. | +| AWS profile name `inferenceBedrockProfile` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | AWS named profile to use for Bedrock inference credentials. | +| AWS config directory `inferenceBedrockAwsDir` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | Folder with AWS config/credentials. Defaults to \~/.aws when no bearer token is set. | +| AWS CLI path `inferenceBedrockAwsCliPath` | `string` | MDM + Bootstrap Added in 1.13576.0 | — | Absolute path to the aws executable. Leave unset to find it on PATH. | + +> **inferenceBedrockServiceTier details** +> +> Tier availability varies by model and region. Reserved capacity uses a provisioned-throughput ARN as the model ID instead of this setting. Older bundled Claude Code CLI versions ignore this key. Set `inferenceModels` to a list of Amazon Bedrock inference-profile IDs, for example `us.anthropic.claude-sonnet-5`. When using a bearer token or credential helper, Claude Desktop auto-discovers available Claude models from your account if this is unset; otherwise the list is required. Application-inference-profile ARNs and provisioned-throughput ARNs are also accepted; pair them with a [`labelOverride`](/docs/third-party/claude-desktop/configuration#inferencemodels) so the picker shows a readable name instead of the raw ARN. See the [Configuration reference](/docs/third-party/claude-desktop/configuration#inferencemodels). diff --git a/content/claude/third-party/claude-desktop/bootstrap.md b/content/claude/third-party/claude-desktop/bootstrap.md index 2c4ab5a191..4524eeabc6 100644 --- a/content/claude/third-party/claude-desktop/bootstrap.md +++ b/content/claude/third-party/claude-desktop/bootstrap.md @@ -6,17 +6,17 @@ > Host an HTTPS endpoint that returns each user's configuration, for organizations without MDM or with role-based configuration too complex for per-group profiles - - Requires Claude Desktop **1.10628.0** or later. Earlier builds ignore the `bootstrapUrl` keys. - +> [!NOTE] +> +> Requires Claude Desktop **1.10628.0** or later. Earlier builds ignore the `bootstrapUrl` keys. A **bootstrap server** is an HTTPS endpoint you host that authenticates each user against your identity provider and returns that user's configuration as JSON. Use it when your organization doesn't have MDM, or when configuration varies too widely for per-group profiles: per-user gateway credentials, per-team model allowlists, or per-user OpenTelemetry attribution. When one configuration or a few group-scoped profiles cover your fleet, [deploying with MDM](/docs/third-party/claude-desktop/mdm) is simpler; most MDMs support role-based distribution. When a bootstrap response is available, it **is** the effective configuration. The MDM profile supplies the trust anchor (`bootstrapUrl`, optional `bootstrapOidc` or `bootstrapHeaders`/`bootstrapHeadersHelper`, and the `bootstrapEnabled` opt-out), and Claude Desktop does not consult MDM for any key the bootstrap server is permitted to set. A bootstrap-settable key that your response **omits** is treated as unset, not inherited from MDM, so return every key you want applied. - - Your bootstrap server is fully trusted. Its response can set inference credentials, the egress allowlist, MCP servers, and every other key in the [published schema](#response-schema). Treat compromise of this endpoint as credential compromise: restrict who can deploy it, log every response, and harden it as you would any secrets-issuing service. - +> [!WARNING] +> +> Your bootstrap server is fully trusted. Its response can set inference credentials, the egress allowlist, MCP servers, and every other key in the [published schema](#response-schema). Treat compromise of this endpoint as credential compromise: restrict who can deploy it, log every response, and harden it as you would any secrets-issuing service. Before the server can take over, each device needs the bootstrap keys that point at it. There are two ways to get them onto a device: @@ -149,56 +149,54 @@ The bootstrap request is always authenticated: either each user signs in and the ### Separate identity provider (PKCE) - - - Register a native or public application with a loopback redirect URI and no client secret. The registration is identical to the one used for [gateway single sign-on](/docs/third-party/claude-desktop/gateway#set-up-single-sign-on); if you already have that, reuse it. See the [provider notes](#provider-notes) below for redirect-URI specifics. +**1. Register a public client in your identity provider** - For Microsoft Entra ID, also set an **Application ID URI** on the registration (App registration → **Expose an API** → **Set**; accept the default `api://CLIENT_ID`). The `CLIENT_ID/.default` scope in the next step does not resolve without it. - +Register a native or public application with a loopback redirect URI and no client secret. The registration is identical to the one used for [gateway single sign-on](/docs/third-party/claude-desktop/gateway#set-up-single-sign-on); if you already have that, reuse it. See the [provider notes](#provider-notes) below for redirect-URI specifics. - - The app sends the OAuth **access token** as the bearer. Your server validates that token's `aud`, so the scope you request must produce a token whose audience your server accepts. This is provider-specific: +For Microsoft Entra ID, also set an **Application ID URI** on the registration (App registration → **Expose an API** → **Set**; accept the default `api://CLIENT_ID`). The `CLIENT_ID/.default` scope in the next step does not resolve without it. - | Provider | Scope to request | Resulting `aud` | - | - | - | - | - | Microsoft Entra ID | `openid offline_access CLIENT_ID/.default` | your client ID | - | Okta (custom authorization server) | `openid offline_access YOUR_API_SCOPE` | your authorization server's audience | - | Generic OIDC | `openid offline_access` plus your API's resource scope | provider-specific | +**2. Choose the scope your server will validate** - Include `offline_access` so the app receives a refresh token and can renew silently between launches. +The app sends the OAuth **access token** as the bearer. Your server validates that token's `aud`, so the scope you request must produce a token whose audience your server accepts. This is provider-specific: - - For Entra, use the bare-GUID form `CLIENT_ID/.default`, **not** `api://CLIENT_ID/.default`. The `api://` form works on the initial authorize but fails on the refresh grant with `AADSTS90009` when the client and resource are the same application. - - +| Provider | Scope to request | Resulting `aud` | +| - | - | - | +| Microsoft Entra ID | `openid offline_access CLIENT_ID/.default` | your client ID | +| Okta (custom authorization server) | `openid offline_access YOUR_API_SCOPE` | your authorization server's audience | +| Generic OIDC | `openid offline_access` plus your API's resource scope | provider-specific | + +Include `offline_access` so the app receives a refresh token and can renew silently between launches. + +> [!WARNING] +> +> For Entra, use the bare-GUID form `CLIENT_ID/.default`, **not** `api://CLIENT_ID/.default`. The `api://` form works on the initial authorize but fails on the refresh grant with `AADSTS90009` when the client and resource are the same application. - - See [Server responsibilities](#server-responsibilities). What the token's `iss` and `aud` look like depends on your provider: +**3. Validate the token in your server** - | Provider | `iss` to expect | `aud` to expect | JWKS URL | - | - | - | - | - | - | Microsoft Entra ID (token version `2`) | `https://login.microsoftonline.com/TENANT/v2.0` | your client ID | `https://login.microsoftonline.com/TENANT/discovery/v2.0/keys` | - | Okta (custom authorization server) | `https://YOUR_DOMAIN.okta.com/oauth2/AUTH_SERVER_ID` | the audience configured on that authorization server | `/v1/keys` | +See [Server responsibilities](#server-responsibilities). What the token's `iss` and `aud` look like depends on your provider: - **Entra token version.** A new Entra app registration emits v1-format access tokens by default, with `iss` = `https://sts.windows.net/TENANT/` and `aud` = `api://CLIENT_ID`. Set the accepted-token-version field in the registration's **Manifest** to `2` so tokens match the table above. The portal shows this field as either `accessTokenAcceptedVersion` or `api.requestedAccessTokenVersion` depending on the manifest view; set whichever you see. If you cannot change it, your server must accept both the v1 and v2 forms. +| Provider | `iss` to expect | `aud` to expect | JWKS URL | +| - | - | - | - | +| Microsoft Entra ID (token version `2`) | `https://login.microsoftonline.com/TENANT/v2.0` | your client ID | `https://login.microsoftonline.com/TENANT/discovery/v2.0/keys` | +| Okta (custom authorization server) | `https://YOUR_DOMAIN.okta.com/oauth2/AUTH_SERVER_ID` | the audience configured on that authorization server | `/v1/keys` | + +**Entra token version.** A new Entra app registration emits v1-format access tokens by default, with `iss` = `https://sts.windows.net/TENANT/` and `aud` = `api://CLIENT_ID`. Set the accepted-token-version field in the registration's **Manifest** to `2` so tokens match the table above. The portal shows this field as either `accessTokenAcceptedVersion` or `api.requestedAccessTokenVersion` depending on the manifest view; set whichever you see. If you cannot change it, your server must accept both the v1 and v2 forms. - **Group and role claims.** Entra does not emit `groups` or `roles` in access tokens by default. Enable the groups claim under App registration → **Token configuration**, or define **App roles** and assign users via **Enterprise applications**. The `oid` claim is always present. For Okta, add a `groups` claim on your custom authorization server with a group filter. - +**Group and role claims.** Entra does not emit `groups` or `roles` in access tokens by default. Enable the groups claim under App registration → **Token configuration**, or define **App roles** and assign users via **Enterprise applications**. The `oid` claim is always present. For Okta, add a `groups` claim on your custom authorization server with a group filter. - - Install Claude Desktop on an admin workstation (see [Installation](/docs/third-party/claude-desktop/installation)). From the menu bar, open **Developer → Configure Third-Party Inference…**. In the **Source** section, fill in the **Bootstrap config URL** card: +**4. Configure and export from Claude Desktop** - | Field | Value | - | - | - | - | Bootstrap config URL | `https://YOUR_BOOTSTRAP_HOST/user/bootstrap` | - | Bootstrap OIDC parameters → Client ID | `YOUR_CLIENT_ID` | - | Bootstrap OIDC parameters → Issuer URL | `https://login.microsoftonline.com/YOUR_TENANT_ID/v2.0` | - | Bootstrap OIDC parameters → Scopes | `openid offline_access YOUR_CLIENT_ID/.default` | - | Bootstrap OIDC parameters → Redirect port | leave empty for Entra; set for Okta | +Install Claude Desktop on an admin workstation (see [Installation](/docs/third-party/claude-desktop/installation)). From the menu bar, open **Developer → Configure Third-Party Inference…**. In the **Source** section, fill in the **Bootstrap config URL** card: - Click **Sign in** to test against your typed values. Once authenticated, the card shows the keys your server supplied. Click **Export** and choose the template format your MDM expects (such as `.mobileconfig`, ADMX, or `.reg`). See [Deploy the configuration](/docs/third-party/claude-desktop/mdm#4-deploy-the-configuration) for per-platform instructions. - - +| Field | Value | +| - | - | +| Bootstrap config URL | `https://YOUR_BOOTSTRAP_HOST/user/bootstrap` | +| Bootstrap OIDC parameters → Client ID | `YOUR_CLIENT_ID` | +| Bootstrap OIDC parameters → Issuer URL | `https://login.microsoftonline.com/YOUR_TENANT_ID/v2.0` | +| Bootstrap OIDC parameters → Scopes | `openid offline_access YOUR_CLIENT_ID/.default` | +| Bootstrap OIDC parameters → Redirect port | leave empty for Entra; set for Okta | + +Click **Sign in** to test against your typed values. Once authenticated, the card shows the keys your server supplied. Click **Export** and choose the template format your MDM expects (such as `.mobileconfig`, ADMX, or `.reg`). See [Deploy the configuration](/docs/third-party/claude-desktop/mdm#4-deploy-the-configuration) for per-platform instructions. #### Provider notes @@ -216,56 +214,54 @@ This page covers only the bootstrap sign-in. Authentication for inference is ind Set only `bootstrapUrl` in MDM. The app discovers your authorization endpoints via RFC 8414 and runs an RFC 8628 device-code grant. The bearer is reused for inference when `inferenceGatewayBaseUrl` shares the `bootstrapUrl` origin and `inferenceCredentialKind` is `interactive`, so the user signs in once for both. - - - Serve a metadata document under the `bootstrapUrl` path. If `bootstrapUrl` ends in `/bootstrap` or `/user/bootstrap`, that suffix is stripped to form the issuer base. +**1. Publish RFC 8414 discovery metadata** + +Serve a metadata document under the `bootstrapUrl` path. If `bootstrapUrl` ends in `/bootstrap` or `/user/bootstrap`, that suffix is stripped to form the issuer base. + +```text theme={null} +GET https://YOUR_BOOTSTRAP_HOST/.well-known/oauth-authorization-server +``` + +```json theme={null} +{ + "issuer": "https://YOUR_BOOTSTRAP_HOST", + "token_endpoint": "https://YOUR_BOOTSTRAP_HOST/oauth/token", + "device_authorization_endpoint": "https://YOUR_BOOTSTRAP_HOST/oauth/device" +} +``` - ```text theme={null} - GET https://YOUR_BOOTSTRAP_HOST/.well-known/oauth-authorization-server - ``` +Every endpoint URL must share the `bootstrapUrl` origin. Metadata that points off-origin is rejected. - ```json theme={null} - { - "issuer": "https://YOUR_BOOTSTRAP_HOST", - "token_endpoint": "https://YOUR_BOOTSTRAP_HOST/oauth/token", - "device_authorization_endpoint": "https://YOUR_BOOTSTRAP_HOST/oauth/device" - } - ``` +**2. Implement the device-code grant** - Every endpoint URL must share the `bootstrapUrl` origin. Metadata that points off-origin is rejected. - +`POST` to `device_authorization_endpoint` returns: - - `POST` to `device_authorization_endpoint` returns: +```json theme={null} +{ + "device_code": "EXAMPLE-DEVICE-CODE-OPAQUE-TO-CLIENT", + "user_code": "ABCD-EFGH", + "verification_uri": "https://YOUR_BOOTSTRAP_HOST/activate", + "verification_uri_complete": "https://YOUR_BOOTSTRAP_HOST/activate?user_code=ABCD-EFGH", + "interval": 5, + "expires_in": 600 +} +``` - ```json theme={null} - { - "device_code": "EXAMPLE-DEVICE-CODE-OPAQUE-TO-CLIENT", - "user_code": "ABCD-EFGH", - "verification_uri": "https://YOUR_BOOTSTRAP_HOST/activate", - "verification_uri_complete": "https://YOUR_BOOTSTRAP_HOST/activate?user_code=ABCD-EFGH", - "interval": 5, - "expires_in": 600 - } - ``` +`verification_uri` and `verification_uri_complete` must share the `bootstrapUrl` origin; federate behind your own pages rather than returning an upstream provider's URL directly. The app opens the verification URL in the user's browser and shows the user code. - `verification_uri` and `verification_uri_complete` must share the `bootstrapUrl` origin; federate behind your own pages rather than returning an upstream provider's URL directly. The app opens the verification URL in the user's browser and shows the user code. +The app polls `token_endpoint` with `grant_type=urn:ietf:params:oauth:grant-type:device_code` and the `device_code`. Return `{"error":"authorization_pending"}` until the user approves, then: - The app polls `token_endpoint` with `grant_type=urn:ietf:params:oauth:grant-type:device_code` and the `device_code`. Return `{"error":"authorization_pending"}` until the user approves, then: +```json theme={null} +{ "access_token": "eyJhbGciOiJSUzI1NiIs...", "expires_in": 3600 } +``` - ```json theme={null} - { "access_token": "eyJhbGciOiJSUzI1NiIs...", "expires_in": 3600 } - ``` +The polling interval is clamped between 1 and 30 seconds; the grant times out after 5 minutes; the token lifetime you return is clamped between 5 minutes and 30 days (24 hours before 1.17377.1). - The polling interval is clamped between 1 and 30 seconds; the grant times out after 5 minutes; the token lifetime you return is clamped between 5 minutes and 30 days (24 hours before 1.17377.1). +When `inferenceGatewayBaseUrl` shares the `bootstrapUrl` origin, so the same sign-in also serves inference, you may also return a `refresh_token` (optionally with `refresh_token_expires_in` in seconds): as the access token nears expiry during use, Claude Desktop 1.34493.0 and later renews it with an RFC 6749 `grant_type=refresh_token` POST to your `token_endpoint` rather than interrupting the user. The configuration fetch at launch still asks the user to sign in if the access token itself has already expired. Answer `400` with `{"error":"invalid_grant"}` to revoke the refresh token and require a fresh sign-in. - When `inferenceGatewayBaseUrl` shares the `bootstrapUrl` origin, so the same sign-in also serves inference, you may also return a `refresh_token` (optionally with `refresh_token_expires_in` in seconds): as the access token nears expiry during use, Claude Desktop 1.34493.0 and later renews it with an RFC 6749 `grant_type=refresh_token` POST to your `token_endpoint` rather than interrupting the user. The configuration fetch at launch still asks the user to sign in if the access token itself has already expired. Answer `400` with `{"error":"invalid_grant"}` to revoke the refresh token and require a fresh sign-in. - +**3. Serve the configuration endpoint** - - On `GET ` with a valid bearer, look up the user from the token claims and return their configuration (see [the HTTP contract](#the-http-contract)). - - +On `GET ` with a valid bearer, look up the user from the token claims and return their configuration (see [the HTTP contract](#the-http-contract)). ### Request headers (no per-user sign-in) @@ -310,9 +306,9 @@ Return `200 OK` with `Content-Type: application/json` and a JSON object whose ke | `401`, `403` | Discard the cached token and prompt the user to sign in again. A `401` on a background refresh keeps the running configuration. When the same sign-in also serves inference, the app treats it as an ended session and asks the user to sign in again (1.34493.0 and later); otherwise it retries at the next check without prompting. Return `401` when the token is missing, expired, or the wrong audience; return `403` when the token is valid but the caller is not entitled. | | Other non-2xx, or `3xx` | Fetch error. Falls back to the last good response from this session if one exists; otherwise the app stays in the degraded sign-in state. | - - A `200` that is not a JSON object (an empty body, an HTML page from a captive portal or load balancer, or a JSON array) is a parse error. Make sure intermediate proxies do not rewrite the response. - +> [!WARNING] +> +> A `200` that is not a JSON object (an empty body, an HTML page from a captive portal or load balancer, or a JSON array) is a parse error. Make sure intermediate proxies do not rewrite the response. ### Response schema @@ -327,9 +323,9 @@ Each configuration key in both schemas carries an `x-availableInVersion` annotat The response can supply any key in that schema, including inference credentials, model allowlists, MCP servers, the egress allowlist, telemetry endpoints, and the organization banner. - - Organization plugins and skills can be delivered over the network by returning `allowedPluginMarketplaces` in the bootstrap response (see [Plugin marketplaces](/docs/third-party/claude-desktop/extensions#plugin-marketplaces-admin)), or through the filesystem `org-plugins/` directory described in [Connectors and extensions](/docs/third-party/claude-desktop/extensions). - +> [!NOTE] +> +> Organization plugins and skills can be delivered over the network by returning `allowedPluginMarketplaces` in the bootstrap response (see [Plugin marketplaces](/docs/third-party/claude-desktop/extensions#plugin-marketplaces-admin)), or through the filesystem `org-plugins/` directory described in [Connectors and extensions](/docs/third-party/claude-desktop/extensions). A small set of keys are **structurally excluded** and ignored if returned: @@ -365,17 +361,15 @@ Consent gates only bootstrap-delivered values. The same keys delivered through d | `$schemaVersion` | `integer` | Wire-format marker: `2` for the nested format (bootstrap-config-v2, what the app's own JSON export writes), `1` for the flat format (bootstrap-config-v1). Optional: the client infers the format from the document shape; set it to state the format explicitly. | | `expiresAt` | `number` | Unix epoch (seconds or milliseconds) after which the client should re-fetch this document. Optional; when absent the client uses its default refresh interval. | - - - Omitted → the client infers the version from the document shape (any cluster key present → 2, otherwise 1). - - - - Omitted → cache for 1 hour. A number ≥ 10¹² is read as Unix epoch **milliseconds**; below that, **seconds**. +> **\$schemaVersion details** +> +> Omitted → the client infers the version from the document shape (any cluster key present → 2, otherwise 1). - A failed re-fetch keeps the last good response from the current session and retries; the app only enters the degraded state when there has never been a usable response this session. - - +> **expiresAt details** +> +> Omitted → cache for 1 hour. A number ≥ 10¹² is read as Unix epoch **milliseconds**; below that, **seconds**. +> +> A failed re-fetch keeps the last good response from the current session and retries; the app only enters the degraded state when there has never been a usable response this session. ### Origin pinning @@ -387,39 +381,37 @@ When you supply `bootstrapOidc`, your configuration server and gateway are indep | Setting | Type | Availability | Default | Description | | - | - | - | - | - | -| Use bootstrap config
`bootstrapEnabled` | `boolean` | MDM only
Added in 1.10628.0 | `true` | Fetch and apply the URL above at launch. Turn off to keep the URL saved but skip the fetch. Defaults to `true`. | -| Bootstrap config URL
`bootstrapUrl` | `string` | MDM only
Added in 1.10628.0 | — | HTTPS endpoint that returns a per-user JSON config overlay. Values from the response override local settings and become read-only. | -| Bootstrap OIDC parameters
`bootstrapOidc` | `object` | MDM only
Added in 1.10628.0 | — | When set, the bootstrap request sends a Bearer token from a browser sign-in (authorization-code-with-PKCE). | -| Bootstrap request headers
`bootstrapHeaders` | `object` | MDM only
Added in 1.32885.1 | — | HTTP headers sent on every bootstrap config fetch. Use this instead of embedding user:pass@ in the URL. | -| Bootstrap headers helper script
`bootstrapHeadersHelper` | `string` | MDM only
Added in 1.32885.1 | — | Absolute path to an executable that prints a JSON object of bootstrap request headers. Merged over the static headers; the helper wins. | -| Trust bootstrap-delivered settings
`trustBootstrapDelivery` | `boolean` | MDM only
Added in 1.26832.0 | `false` | Skip the per-user consent prompt for sign-in targets, inference endpoints, helper scripts, and connectors the bootstrap server delivers. Defaults to `false`. | - - - - Set this to use a separate identity provider (Microsoft Entra ID, Okta, Ping, or any compliant OIDC provider) for the bootstrap sign-in. The app runs an authorization-code-with-PKCE flow in the system browser. Omit to use device-code mode against the bootstrap server's own origin. - - This is an **object-typed key** — in an MDM profile it is a single JSON-string value, not separate keys with dotted names like `bootstrapOidc.clientId`. Writing the sub-fields as separate registry values causes the app to silently fall through to device-code mode. - - | Field | Type | Default | Description | - | - | - | - | - | - | `clientId` | `string` | — | OAuth client ID of the desktop app registration at your identity provider (public client, PKCE). | - | `issuer` | `string` | — | HTTPS issuer with OIDC discovery. Set this, or set the authorization and token URLs instead. | - | `authorizationUrl` | `string` | — | HTTPS authorization endpoint. Used with the token URL when no issuer is set. | - | `tokenUrl` | `string` | — | HTTPS token endpoint. Used with the authorization URL when no issuer is set. | - | `scopes` | `string` | — | Space-separated; the token’s audience must match what your bootstrap server validates. | - | `redirectPort` | `integer` | — | Fixed loopback port for the sign-in redirect. Leave unset to use a free port each time. | - | `redirectHost` | `enum` | — | Use localhost only if your IdP’s registered redirect URI specifies it. One of: `127.0.0.1`, `localhost`. | - | `additionalRedirectReferrerHosts` | `string` | — | Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host. | - - - - Static headers sent on every request to the bootstrap config URL — for a service-account credential (`Authorization: Basic …`, an API key header) or a routing/tenant header. When either this or the headers helper script is set and no separate `bootstrapOidc` provider is configured, the app treats the headers as sufficient auth and does not require a per-user sign-in for the bootstrap fetch. These headers (and the helper script's below) also accompany requests to a plugin marketplace this server hosts on its own origin (`allowedPluginMarketplaces` with `credentialKind: "inferenceCredential"`). Header values are masked in diagnostics and telemetry. For a rotating token, use the headers helper script instead. - - - - Absolute path to an executable that prints a single JSON object of HTTP headers on stdout, e.g. `{"Authorization": "Bearer …"}`. The app runs it (no arguments; output cached for a few minutes) before each bootstrap config fetch and merges the result over **Bootstrap request headers** (the helper wins on conflict). Use this instead of embedding `user:pass@` in the bootstrap URL, or when the bootstrap server needs a rotating token from a secrets manager. When either this or the static headers are set and no separate `bootstrapOidc` provider is configured, the app treats them as sufficient auth and does not require a per-user sign-in for the bootstrap fetch. If a per-user sign-in also runs (`bootstrapOidc` or the server’s own device-code flow), that Bearer token wins on `Authorization`. - - +| Use bootstrap config `bootstrapEnabled` | `boolean` | MDM only Added in 1.10628.0 | `true` | Fetch and apply the URL above at launch. Turn off to keep the URL saved but skip the fetch. Defaults to `true`. | +| Bootstrap config URL `bootstrapUrl` | `string` | MDM only Added in 1.10628.0 | — | HTTPS endpoint that returns a per-user JSON config overlay. Values from the response override local settings and become read-only. | +| Bootstrap OIDC parameters `bootstrapOidc` | `object` | MDM only Added in 1.10628.0 | — | When set, the bootstrap request sends a Bearer token from a browser sign-in (authorization-code-with-PKCE). | +| Bootstrap request headers `bootstrapHeaders` | `object` | MDM only Added in 1.32885.1 | — | HTTP headers sent on every bootstrap config fetch. Use this instead of embedding user:pass@ in the URL. | +| Bootstrap headers helper script `bootstrapHeadersHelper` | `string` | MDM only Added in 1.32885.1 | — | Absolute path to an executable that prints a JSON object of bootstrap request headers. Merged over the static headers; the helper wins. | +| Trust bootstrap-delivered settings `trustBootstrapDelivery` | `boolean` | MDM only Added in 1.26832.0 | `false` | Skip the per-user consent prompt for sign-in targets, inference endpoints, helper scripts, and connectors the bootstrap server delivers. Defaults to `false`. | + +> **bootstrapOidc details** +> +> Set this to use a separate identity provider (Microsoft Entra ID, Okta, Ping, or any compliant OIDC provider) for the bootstrap sign-in. The app runs an authorization-code-with-PKCE flow in the system browser. Omit to use device-code mode against the bootstrap server's own origin. +> +> This is an **object-typed key** — in an MDM profile it is a single JSON-string value, not separate keys with dotted names like `bootstrapOidc.clientId`. Writing the sub-fields as separate registry values causes the app to silently fall through to device-code mode. +> +> | Field | Type | Default | Description | +> | - | - | - | - | +> | `clientId` | `string` | — | OAuth client ID of the desktop app registration at your identity provider (public client, PKCE). | +> | `issuer` | `string` | — | HTTPS issuer with OIDC discovery. Set this, or set the authorization and token URLs instead. | +> | `authorizationUrl` | `string` | — | HTTPS authorization endpoint. Used with the token URL when no issuer is set. | +> | `tokenUrl` | `string` | — | HTTPS token endpoint. Used with the authorization URL when no issuer is set. | +> | `scopes` | `string` | — | Space-separated; the token’s audience must match what your bootstrap server validates. | +> | `redirectPort` | `integer` | — | Fixed loopback port for the sign-in redirect. Leave unset to use a free port each time. | +> | `redirectHost` | `enum` | — | Use localhost only if your IdP’s registered redirect URI specifies it. One of: `127.0.0.1`, `localhost`. | +> | `additionalRedirectReferrerHosts` | `string` | — | Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host. | + +> **bootstrapHeaders details** +> +> Static headers sent on every request to the bootstrap config URL — for a service-account credential (`Authorization: Basic …`, an API key header) or a routing/tenant header. When either this or the headers helper script is set and no separate `bootstrapOidc` provider is configured, the app treats the headers as sufficient auth and does not require a per-user sign-in for the bootstrap fetch. These headers (and the helper script's below) also accompany requests to a plugin marketplace this server hosts on its own origin (`allowedPluginMarketplaces` with `credentialKind: "inferenceCredential"`). Header values are masked in diagnostics and telemetry. For a rotating token, use the headers helper script instead. + +> **bootstrapHeadersHelper details** +> +> Absolute path to an executable that prints a single JSON object of HTTP headers on stdout, e.g. `{"Authorization": "Bearer …"}`. The app runs it (no arguments; output cached for a few minutes) before each bootstrap config fetch and merges the result over **Bootstrap request headers** (the helper wins on conflict). Use this instead of embedding `user:pass@` in the bootstrap URL, or when the bootstrap server needs a rotating token from a secrets manager. When either this or the static headers are set and no separate `bootstrapOidc` provider is configured, the app treats them as sufficient auth and does not require a per-user sign-in for the bootstrap fetch. If a per-user sign-in also runs (`bootstrapOidc` or the server’s own device-code flow), that Bearer token wins on `Authorization`. No `inferenceProvider` is needed in the MDM profile when using bootstrap; the response supplies it. diff --git a/content/claude/third-party/claude-desktop/built-in-connectors.md b/content/claude/third-party/claude-desktop/built-in-connectors.md index 57cd837ca7..701fd49db0 100644 --- a/content/claude/third-party/claude-desktop/built-in-connectors.md +++ b/content/claude/third-party/claude-desktop/built-in-connectors.md @@ -20,9 +20,9 @@ A built-in entry names the bundled server in a `server` field, in place of the ` Each guide covers its server in full, including how the built-in server compares with the remote alternative where one exists. - - In the in-app configuration window, the **Add server** menu lists built-in servers separately from remote templates. A remote template (Box, or the Microsoft 365 remote connector) only pre-fills the form for a server that runs outside the app. The servers on this page are the ones bundled inside the app. - +> [!NOTE] +> +> In the in-app configuration window, the **Add server** menu lists built-in servers separately from remote templates. A remote template (Box, or the Microsoft 365 remote connector) only pre-fills the form for a server that runs outside the app. The servers on this page are the ones bundled inside the app. ## How built-in servers behave diff --git a/content/claude/third-party/claude-desktop/chat.md b/content/claude/third-party/claude-desktop/chat.md index 13f70be595..09f80eda33 100644 --- a/content/claude/third-party/claude-desktop/chat.md +++ b/content/claude/third-party/claude-desktop/chat.md @@ -6,9 +6,9 @@ > What Chat can and cannot do in Claude Desktop on 3P, and how to configure it - - When [Unified Claude](/docs/third-party/claude-desktop/unified-claude) is on, a message sent from the home screen starts a Cowork session on a device that can run Cowork. - +> [!NOTE] +> +> When [Unified Claude](/docs/third-party/claude-desktop/unified-claude) is on, a message sent from the home screen starts a Cowork session on a device that can run Cowork. Chat in Claude Desktop on third-party (3P) is a conversational surface for quick questions and drafting. Unlike [Cowork](/docs/cowork/overview) and [Code](/docs/third-party/claude-desktop/code), which run agentic sessions with access to folders you grant and a code-execution environment, a Chat conversation runs with a deliberately small tool surface: it can search and fetch the web under your admin configuration, read files attached to the conversation, read and update the project's memory and read the files in the project's folders when the conversation is inside a project, write files into a scratch space of its own, and use skills from the plugins you provision, and nothing else on the machine. Chat is off by default and is enabled with a single configuration key. @@ -35,7 +35,7 @@ Chat conversations run against your configured inference provider, and their his For a conversation inside a project, Claude can list and read files in folders added to the project in Claude Desktop, and can't change them. -* **Folders the user adds.** To have Claude read a folder, the user adds it to the project in Claude Desktop and starts a new conversation. For a folder that an [import](/docs/third-party/claude-desktop/import) put on the project, or that was on the project before Chat could read folders, the user adds it to the project again. +* **Folders the user adds.** To have Claude read a folder, the user adds it to the project in Claude Desktop and starts a new conversation. For a folder that an [import](/docs/third-party/claude-desktop/import) put on the project, or that was on the project before Chat could read folders, the user adds it to the project again. For the steps, see [Make an imported project folder readable in Chat](/docs/third-party/claude-desktop/import#make-an-imported-project-folder-readable-in-chat). * **Folders you allow.** If you set [`allowedWorkspaceFolders`](/docs/third-party/claude-desktop/configuration#allowedworkspacefolders), the list also limits which of a project's folders Claude reads. ## What a Chat conversation cannot do @@ -65,9 +65,9 @@ The execution environment is intentionally narrower than the Cowork sandbox: The data flow end to end: an attached file is copied into the conversation's local uploads directory, mounted read-only into the sandbox when analysis runs, and any outputs are written to the conversation's scratch directory on local disk. File content leaves the device only as conversation context sent to your configured inference provider, in web search queries to your configured search backend, through web fetches your egress allowlist permits, through [sandbox network access](#sandbox-network-access), in a connector tool call permitted by your `toolPolicy` configuration and the user's approvals, or, if you have enabled [content capture](/docs/third-party/claude-desktop/telemetry#content-capture), in telemetry to your own collector. - - Advanced file analysis uses the same shell tool as Cowork's sandbox, so adding `"Bash"` to `disabledBuiltinTools` disables it even when `chatAdvancedFileAnalysisEnabled` is `true`. Running it requires the sandbox VM bundle, which the app downloads from Anthropic unless you deployed the offline installer (see [required egress paths](/docs/third-party/claude-desktop/telemetry#required-egress-paths)). - +> [!NOTE] +> +> Advanced file analysis uses the same shell tool as Cowork's sandbox, so adding `"Bash"` to `disabledBuiltinTools` disables it even when `chatAdvancedFileAnalysisEnabled` is `true`. Running it requires the sandbox VM bundle, which the app downloads from Anthropic unless you deployed the offline installer (see [required egress paths](/docs/third-party/claude-desktop/telemetry#required-egress-paths)). ### Sandbox network access @@ -76,16 +76,16 @@ Commands that Claude runs in the advanced file analysis sandbox can reach the ho * **Other hosts.** A web request to any other host gets a `403 Forbidden` response with the header `X-Proxy-Error: blocked-by-allowlist`. `pip install` reports this as `Tunnel connection failed: 403 Forbidden`. * **Package installs.** Package managers contact their default index, so list its hosts. For pip, list `pypi.org` and `files.pythonhosted.org`. To install from a private mirror, list its host. The command must name the mirror, for example with pip's `--index-url`. - - By default, commands in the sandbox run without an approval prompt. A command can upload anything the sandbox can read to a listed host, and can run what it downloads from one. [Web fetch](/docs/third-party/claude-desktop/web-tools#web-fetch) in Chat uses the same list, so a host you list for web fetch is also open to sandbox commands. With `"*"` in the list, network filtering in the sandbox is off, so commands can reach any host. +> [!WARNING] +> +> By default, commands in the sandbox run without an approval prompt. A command can upload anything the sandbox can read to a listed host, and can run what it downloads from one. [Web fetch](/docs/third-party/claude-desktop/web-tools#web-fetch) in Chat uses the same list, so a host you list for web fetch is also open to sandbox commands. With `"*"` in the list, network filtering in the sandbox is off, so commands can reach any host. +> +> * **To have Claude ask before each command**, set `"Bash"` to `"ask"` in [`builtinToolPolicy`](/docs/third-party/claude-desktop/configuration#builtintoolpolicy). That policy also applies to Cowork and Code sessions. +> * **To keep web fetch but turn off sandbox commands**, set [`chatAdvancedFileAnalysisEnabled`](#configuration) to `false`. - * **To have Claude ask before each command**, set `"Bash"` to `"ask"` in [`builtinToolPolicy`](/docs/third-party/claude-desktop/configuration#builtintoolpolicy). That policy also applies to Cowork and Code sessions. - * **To keep web fetch but turn off sandbox commands**, set [`chatAdvancedFileAnalysisEnabled`](#configuration) to `false`. - - - - Sandbox network access requires Claude Desktop 2.42304.0 or later. On earlier versions, requests to listed hosts get a `403 Forbidden` response. After a device updates, commands can reach the listed hosts with no change to your configuration, in existing conversations too. If Claude says in an existing conversation that the sandbox has no network access, ask the user to start a new conversation. - +> [!NOTE] +> +> Sandbox network access requires Claude Desktop 2.42304.0 or later. On earlier versions, requests to listed hosts get a `403 Forbidden` response. After a device updates, commands can reach the listed hosts with no change to your configuration, in existing conversations too. If Claude says in an existing conversation that the sandbox has no network access, ask the user to start a new conversation. ## Configuration @@ -98,9 +98,9 @@ While the `desktopHome` key for [Unified Claude](/docs/third-party/claude-deskto When `chatTabEnabled` is `true`, Claude Desktop presents Chat and Cowork together as **Home** in its sidebar, next to **Code**. From Home, the user chooses **Chat** or **Cowork** in the message box, and the sidebar lists chats and tasks together. When the key is unset or `false`, the sidebar shows **Cowork** in place of Home and the message box offers no choice. If [`coworkTabEnabled`](/docs/third-party/claude-desktop/configuration#coworktabenabled) is `false` while Chat is enabled, the message box offers Chat only. - - This layout applies to Claude Desktop 1.26832.0 and later. Earlier versions show **Chat** (when enabled), **Cowork**, and **Code** as separate tabs, controlled by the same keys. - +> [!NOTE] +> +> This layout applies to Claude Desktop 1.26832.0 and later. Earlier versions show **Chat** (when enabled), **Cowork**, and **Code** as separate tabs, controlled by the same keys. Enforcement of `chatTabEnabled` happens in the app's main process: when the key is unset or `false`, Chat does not appear in the app, and the app additionally refuses to start or continue a Chat conversation, including conversations created before an admin turned the key off. diff --git a/content/claude/third-party/claude-desktop/claude-api.md b/content/claude/third-party/claude-desktop/claude-api.md index 55552533bd..7d4274e0a6 100644 --- a/content/claude/third-party/claude-desktop/claude-api.md +++ b/content/claude/third-party/claude-desktop/claude-api.md @@ -6,15 +6,19 @@ > Configure Claude Desktop on 3P to send inference directly to Anthropic's Claude API instead of a cloud-provider-hosted Claude deployment -To use Anthropic's Claude API directly as the inference provider, set [`inferenceProvider`](/docs/third-party/claude-desktop/configuration#inferenceprovider) to `anthropic` and supply an API key as described below. This is the first-party path: inference goes straight to Anthropic rather than to a Claude deployment on Google Cloud's Agent Platform, Amazon Bedrock, or Microsoft Foundry. +To use Anthropic's Claude API directly as the inference provider, set [`inferenceProvider`](/docs/third-party/claude-desktop/configuration#inferenceprovider) to `anthropic` and choose how users authenticate, as described in [Choose an authentication approach](#choose-an-authentication-approach). This is the first-party path: inference goes straight to Anthropic rather than to a Claude deployment on Google Cloud's Agent Platform, Amazon Bedrock, or Microsoft Foundry. - - When `inferenceProvider` is `anthropic`, inference traffic goes to Anthropic's API endpoints rather than staying within your cloud provider. The data-residency and compliance statements on these pages do not apply to this option. - +> [!NOTE] +> +> When `inferenceProvider` is `anthropic`, inference traffic goes to Anthropic's API endpoints rather than staying within your cloud provider. The data-residency and compliance statements on these pages do not apply to this option. ## Choose an authentication approach -There are three options. With neither a static key nor a credential helper configured, each user sees **Sign in with Claude Console** on first launch: the app opens the browser, the user signs in and selects a Claude Console (API) organization, and the app creates a personal API key for them and stores it encrypted on the device until it is revoked in Console; usage is billed to that Console organization. Alternatively, place a static API key in the managed configuration as `inferenceAnthropicApiKey`, or, where static keys aren't permitted, set [`inferenceCredentialHelper`](/docs/third-party/claude-desktop/configuration#inferencecredentialhelper) to an executable that fetches a short-lived credential at runtime; see [Write a credential helper](/docs/third-party/claude-desktop/credential-helper). Browser sign-in reaches `platform.claude.com` in addition to `api.anthropic.com`. +There are three options. With neither a static key nor a credential helper configured, each user sees **Sign in with Claude Console** on first launch: the app opens the browser, the user signs in and selects a Claude Console (API) organization, and the app keeps that sign-in encrypted on the device and renews it as needed, without creating an API key. Usage is billed to that Console organization, and about a month after a user signs in, the app asks them to sign in again. Alternatively, place a static API key in the managed configuration as `inferenceAnthropicApiKey`, or, where static keys aren't permitted, set [`inferenceCredentialHelper`](/docs/third-party/claude-desktop/configuration#inferencecredentialhelper) to an executable that fetches a short-lived credential at runtime; see [Write a credential helper](/docs/third-party/claude-desktop/credential-helper). Browser sign-in reaches `platform.claude.com`, `hcaptcha.com`, and `*.hcaptcha.com` in addition to `api.anthropic.com`. + +Claude Desktop versions before 3.1623.0 created a personal API key in the Console organization when a user signed in with Claude Console, and the app doesn't delete those keys. A device that signed in that way and then updates to 3.1623.0 or later keeps using its key until you revoke the key in Claude Console or the user signs out. The device's next sign-in creates no key. + +[Code](/docs/third-party/claude-desktop/code) sessions also ask Anthropic for the Claude Code [server-managed settings](https://code.claude.com/docs/en/server-managed-settings) of the organization that owns the credential. See [Interaction with Claude Code's own managed settings](/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings) for how they combine with your Claude Desktop configuration. ## Configure the app @@ -22,4 +26,4 @@ There are three options. With neither a static key nor a credential helper confi | Setting | Type | Availability | Default | Description | | - | - | - | - | - | -| Claude API key
`inferenceAnthropicApiKey` | `string` | MDM + Bootstrap
Added in 1.8089.0 | — | Leave blank to fetch a key via browser sign-in, or to supply the key via a credential helper. | +| Claude API key `inferenceAnthropicApiKey` | `string` | MDM + Bootstrap Added in 1.8089.0 | — | Leave blank to sign in with your browser, or to supply the key via a credential helper. | diff --git a/content/claude/third-party/claude-desktop/code.md b/content/claude/third-party/claude-desktop/code.md index 1c9b5af9a3..6f3db40fca 100644 --- a/content/claude/third-party/claude-desktop/code.md +++ b/content/claude/third-party/claude-desktop/code.md @@ -55,9 +55,9 @@ These keys are translated into Claude Code [managed settings](https://code.claud The network and filesystem sandboxes apply on macOS, and on Linux devices and [SSH hosts](/docs/third-party/claude-desktop/ssh-remote-sessions#managed-configuration-on-the-remote-host) with Claude Code's [sandbox dependencies](https://code.claude.com/docs/en/sandboxing) installed. Claude Code doesn't sandbox shell commands on Windows devices, and on a Linux device or SSH host without the dependencies commands run unsandboxed. In those cases, and when `coworkEgressAllowedHosts` contains `*` and `allowedWorkspaceFolders` is unset, `blockReadsOutsideWorkingDirectories` still confines Claude's file tools but can only ask the user to approve shell commands that read outside the working directories or that Claude Code can't verify. For what a remote session shows, see [Sandbox status on the remote host](/docs/third-party/claude-desktop/ssh-remote-sessions#sandbox-status-on-the-remote-host). - - Shell commands that run unsandboxed can reach hosts outside `coworkEgressAllowedHosts` and change files outside `allowedWorkspaceFolders`. Where the sandbox runs, a command that matches [`sandbox.excludedCommands`](https://code.claude.com/docs/en/sandboxing#run-commands-outside-the-sandbox-with-excludedcommands) in the user's own Claude Code settings also runs outside it, after Claude Code's regular permission flow. To keep Code off devices where the sandbox can't run, [turn off Code](#disabling-code) in the configuration you deploy to them. For SSH hosts, see [Sandbox status on the remote host](/docs/third-party/claude-desktop/ssh-remote-sessions#sandbox-status-on-the-remote-host). - +> [!WARNING] +> +> Shell commands that run unsandboxed can reach hosts outside `coworkEgressAllowedHosts` and change files outside `allowedWorkspaceFolders`. Where the sandbox runs, a command that matches [`sandbox.excludedCommands`](https://code.claude.com/docs/en/sandboxing#run-commands-outside-the-sandbox-with-excludedcommands) in the user's own Claude Code settings also runs outside it, after Claude Code's regular permission flow. To keep Code off devices where the sandbox can't run, [turn off Code](#disabling-code) in the configuration you deploy to them. For SSH hosts, see [Sandbox status on the remote host](/docs/third-party/claude-desktop/ssh-remote-sessions#sandbox-status-on-the-remote-host). Under `blockReadsOutsideWorkingDirectories`, sandboxed shell commands can still read system locations such as `/usr`, the session's plugin and attachment folders (which become read-only), and the user's git configuration files (`~/.gitconfig` and the `config`, `ignore`, and `attributes` files under `~/.config/git`), which can themselves hold credentials such as tokens in remote URLs. Other files under the home folder outside the working directories are hidden from them, including `~/.ssh`, stored git credentials, included git configuration files, signing keys, and the target of a symlinked git configuration file, so git operations that need those files fail in the session until the user re-opens the paths. In a local session Claude also cannot read a file attached or `@`-mentioned from outside the working directories, so users should move such files into the session's folder or an allowed folder first. @@ -65,7 +65,7 @@ An allowed root that is or contains the home directory, such as `~` or `/Users`, ## Interaction with Claude Code's own managed settings -Claude Code can also be configured directly by deploying a [`managed-settings.json` file](https://code.claude.com/docs/en/settings#settings-files), an OS configuration profile for Claude Code, or (with Anthropic authentication) server-managed settings. If a device has any of these, Claude Code treats it as the administrator policy and, by default, **ignores** the policy values Claude Desktop supplies from the [Applied as managed policy](#applied-as-managed-policy) table. The [Always applied](#always-applied) keys are unaffected. +Claude Code can also be configured directly by deploying a [`managed-settings.json` file](https://code.claude.com/docs/en/settings#settings-files), an OS configuration profile for Claude Code, or, with the Claude API as the inference provider, [server-managed settings](https://code.claude.com/docs/en/server-managed-settings). If a Code session has any of these, Claude Code treats it as the administrator policy and, by default, **ignores** the policy values Claude Desktop supplies from the [Applied as managed policy](#applied-as-managed-policy) table. The [Always applied](#always-applied) keys are unaffected. To have Claude Desktop's restrictions apply on top of your Claude Code policy, set `parentSettingsBehavior` to `"merge"` in the Claude Code managed settings you deploy: @@ -79,9 +79,11 @@ With `"merge"`, Claude Desktop's policy values are layered under your Claude Cod With `"merge"`, two Claude Code policy keys weaken `blockReadsOutsideWorkingDirectories`. `sandbox.filesystem.allowManagedReadPathsOnly` limits the block to Claude's file tools, so a shell command that reads outside the working directories asks for approval instead of failing, and `allowManagedPermissionRulesOnly` removes the session's read access to its plugin and attachment folders, so skills that read their own files stop working. Leave both out of your Claude Code policy if you rely on the block. - - In a third-party deployment there is no Anthropic authentication, so Claude Code's server-managed settings tier is never present. If you have not separately deployed a Claude Code `managed-settings.json` or OS profile, Claude Desktop's policy applies automatically and you do not need to set `parentSettingsBehavior`. - +> [!NOTE] +> +> With the [Claude API](/docs/third-party/claude-desktop/claude-api) as the inference provider, Code sessions ask Anthropic for the server-managed settings of [the organization that owns the credential](https://code.claude.com/docs/en/server-managed-settings#platform-availability). This holds for an API key in your configuration, an API key from a credential helper, and **Sign in with Claude Console**. If that organization has server-managed settings, set [`parentSettingsBehavior`](https://code.claude.com/docs/en/managed-settings#let-an-embedding-host-add-policy) to `"merge"` in them to keep Claude Desktop's [policy values](#applied-as-managed-policy). While server-managed settings apply, Claude Code by default [ignores most keys](https://code.claude.com/docs/en/managed-settings#how-claude-code-combines-managed-sources) in a file or OS profile on the device, and a `"merge"` set there has no effect. +> +> Without a Claude Code `managed-settings.json` file, OS profile, or server-managed settings, Claude Desktop's policy applies automatically and you don't need to set `parentSettingsBehavior`. ## Claude Code mods diff --git a/content/claude/third-party/claude-desktop/configuration-changelog.md b/content/claude/third-party/claude-desktop/configuration-changelog.md index a12034facb..b429d07edb 100644 --- a/content/claude/third-party/claude-desktop/configuration-changelog.md +++ b/content/claude/third-party/claude-desktop/configuration-changelog.md @@ -8,1354 +8,1300 @@ Configuration keys by Claude Desktop release. Each section lists keys added in that release, with the MDM key name (for plist/registry deployment) and the equivalent JSON shape (for local-file or bootstrap remote configuration). - - No configuration changes in this release. - - - - **Changed:** - - * `chatAdvancedFileAnalysisEnabled` and `coworkEgressAllowedHosts`: commands in Chat's file-analysis sandbox can now reach the listed hosts. With no list, or an empty one, they have no network access. - * `mcpPersistentAlwaysAllowEnabled`: `false` now also applies to Code sessions on the device, in WSL and over SSH. - * `claudeAiImport.automatic3pImport` now also reinstalls, without asking, the optional plugins that a user had switched on from any optional `allowedPluginMarketplaces` entry with the same source in the old and new organization. - - - -
- | MDM key | Type | Description | - | - | - | - | - | [`developerModeEnabled`](/docs/third-party/claude-desktop/configuration#developermodeenabled) | `boolean` | Allow Developer Mode | -
- - **JSON (e.g. for non-MDM users or Bootstrap):** - - ```json theme={null} - { - "workspace": { - "developerModeEnabled": "" - } +**v3.1623.0** + +| MDM key | Type | Description | +| - | - | - | +| [`releaseChannel`](/docs/third-party/claude-desktop/configuration#releasechannel) | `enum` | Release channel | +| [`quickEntryDefaultShortcut`](/docs/third-party/claude-desktop/configuration#quickentrydefaultshortcut) | `string` | Default Quick Entry shortcut | + +**JSON (e.g. for non-MDM users or Bootstrap):** + +```json theme={null} +{ + "autoUpdate": { + "releaseChannel": "" + }, + "workspace": { + "quickEntryDefaultShortcut": "" } - ``` - - **Changed:** - - * `coworkEgressAllowedHosts`: your inference provider's, gateway's, and OTLP collector's hosts and `api.anthropic.com` are no longer added automatically. List them if tools call them. - * `managedMcpServers[].toolPolicy`: a value other than `allow`, `ask`, or `blocked` now blocks that tool, and a `toolPolicy` that is not a map of tool names blocks every tool. The entry is kept, with a configuration error, instead of being dropped. - * `sshTransport` (beta): a value that cannot be read now counts as `builtin`. - * `disableNonessentialServices` no longer turns off Chart.js, Grid.js, and Mermaid in artifacts, which now come with the app. - * `modelCatalogEnabled`: with `false`, picker names, descriptions, and effort options now come from the catalog bundled with the app. - * `coworkTabEnabled`: with `false`, Cowork tasks now stay listed in the sidebar and open read-only instead of disappearing. - * `disabledBuiltinTools`: a `WebFetch` or bare `Bash` entry added by device management now also applies to open Cowork and Chat conversations, and a tool name spelled with underscores or hyphens raises a configuration warning. - - **Removed:** - - The former key names below are now unrecognized keys: the setting no longer applies and the deprecation notice no longer appears. This replaces what the v1.40609.0 entry says these names do after the cut-off. - - * `isDxtEnabled`: use `isDesktopExtensionEnabled` instead. Until then extensions are off on third-party deployments and allowed on standard deployments. - * `isDxtSignatureRequired`: use `isDesktopExtensionSignatureRequired` instead. Until then unsigned extensions load. - * `enduserAttribution`: use `endUserAttribution` instead. Until then end-user attribution is on. In the Windows registry, where names ignore case, the former name still reads as `endUserAttribution`. - * `trustBootstrapLocalExec`: use `trustBootstrapDelivery` instead. Until then a `bootstrapUrl` set by device management (on Windows, machine policy only) is trusted without asking each user, and any other `bootstrapUrl` asks each user. - * `inferenceGatewayHeaders`: use `inferenceCustomHeaders` instead. Until then no custom inference headers are sent. - * The deprecation notices for these spellings, which stopped being accepted on October 7, 2026 and are listed under v1.40609.0: header maps written as a string or list, `inferenceGatewayAuthScheme: "auto"`, `ask-session`, the older `managedMcpServers` entry forms, and the `orgPluginSettings` record form. Such a value is now reported like any other invalid value. - - - - No configuration changes in this release. - - - -
- | MDM key | Type | Description | - | - | - | - | - | [`otlpAttrMaxChars`](/docs/third-party/claude-desktop/configuration#otlpattrmaxchars) | `integer` | Telemetry attribute length limit | - | [`desktopHome`](/docs/third-party/claude-desktop/configuration#desktophome) | `enum` | Desktop home | -
- - **JSON (e.g. for non-MDM users or Bootstrap):** - - ```json theme={null} - { - "otlp": { - "attrMaxChars": "" - }, - "chatSurface": { - "desktopHome": "" - } - } - ``` +} +``` - **Changed:** +**Changed:** - * `allowedWorkspaceFolders`: in SSH sessions Claude's file tools can no longer modify a folder marked `ro`, as in a local Code session. Not enforced on Windows hosts, or on a host with Claude Code managed settings of its own (unless they set `parentSettingsBehavior` to `merge`). - * `claudeAiImport.automatic3pImport` now also brings over Cowork artifacts, projects, memory and global instructions, scheduled tasks from Cowork and Code, uploaded plugins (unless `userPluginUploadsEnabled` is off), saved skills (unless `skillCreationEnabled` is off) and the optional plugins a user had on from the organization's plugins directory or a marketplace served from its gateway's or bootstrap server's own address, also on computers that moved under an earlier release. - * `inferenceModels[].prefer1m` and `modelPrefer1mContext` now show one model picker entry for each model that offers 1M and has the preference, and start its new sessions at 1M, whichever entry a user had picked. Earlier releases only moved the starting selection of the first model. - +* A remote or local `managedMcpServers` entry accepts an `icon` value: a PNG or JPEG as a base64 `data:` URI of at most 4,096 characters. Any other non-blank value is ignored, with a configuration warning. Earlier releases ignore `icon` and keep the entry. +* `builtinToolPolicy` accepts every built-in tool name this release's Claude Code publishes, such as `CronCreate` or `LSP`. An earlier release drops each name it does not know with a configuration error and, if none is left, asks before each tool it knows. +* `isLocalDevMcpEnabled`: `false` now also stops local MCP servers from plugins (your organization's marketplaces included, not the org-plugins directory), from Claude Code's `managed-mcp.json` if they use `${VAR}`, and in Code from Claude Code's own configuration files. +* `relaunchEnforcementHours`: no waiting period when a device-management profile that sets more than the app-behavior keys first applies to an app that started without one, and the app will run on that profile after restarting. +* `sshHostAllowlist` (beta): a session's jump hosts (`ProxyJump`, or a `ProxyCommand` written `ssh -W %h:%p host`) must now be on the list too, by `HostName`. - - No configuration changes in this release. - +**v2.42304.2** - -
- | MDM key | Type | Description | - | - | - | - | - | [`microsoftAuthDefaultAccount`](/docs/third-party/claude-desktop/configuration#microsoftauthdefaultaccount) | `enum` | Microsoft 365 sign-in with the Windows account | -
+No configuration changes in this release. - **JSON (e.g. for non-MDM users or Bootstrap):** +**v2.42304.0** - ```json theme={null} - { - "authentication": { - "microsoftAuthDefaultAccount": "" - } +**Changed:** + +* `chatAdvancedFileAnalysisEnabled` and `coworkEgressAllowedHosts`: commands in Chat's file-analysis sandbox can now reach the listed hosts. With no list, or an empty one, they have no network access. +* `mcpPersistentAlwaysAllowEnabled`: `false` now also applies to Code sessions on the device, in WSL and over SSH. +* `claudeAiImport.automatic3pImport` now also reinstalls, without asking, the optional plugins that a user had switched on from any optional `allowedPluginMarketplaces` entry with the same source in the old and new organization. + +**v2.37337.1** + +| MDM key | Type | Description | +| - | - | - | +| [`developerModeEnabled`](/docs/third-party/claude-desktop/configuration#developermodeenabled) | `boolean` | Allow Developer Mode | + +**JSON (e.g. for non-MDM users or Bootstrap):** + +```json theme={null} +{ + "workspace": { + "developerModeEnabled": "" } - ``` +} +``` - **Changed:** +**Changed:** - * `claudeAiImport` accepts a new `allowedOrganizationUuids` value, a list of Claude.ai organization IDs: when set, users can import history only by signing in to Claude.ai, and only from an organization on the list; a sign-in to any other organization or to a personal account is refused, and importing from a file or from earlier sessions on this computer is turned off. The list turns nothing on by itself, and `automatic3pImport` is not affected. Earlier releases ignore the list and keep allowing every import they allowed before, so the list limits imports only on devices running this release or later. - * `disableAutoUpdates` now also decides when Cowork's workspace is downloaded: in the background, instead of at the first task, unless it is `true`. +* `coworkEgressAllowedHosts`: your inference provider's, gateway's, and OTLP collector's hosts and `api.anthropic.com` are no longer added automatically. List them if tools call them. +* `managedMcpServers[].toolPolicy`: a value other than `allow`, `ask`, or `blocked` now blocks that tool, and a `toolPolicy` that is not a map of tool names blocks every tool. The entry is kept, with a configuration error, instead of being dropped. +* `sshTransport` (beta): a value that cannot be read now counts as `builtin`. +* `disableNonessentialServices` no longer turns off Chart.js, Grid.js, and Mermaid in artifacts, which now come with the app. +* `modelCatalogEnabled`: with `false`, picker names, descriptions, and effort options now come from the catalog bundled with the app. +* `coworkTabEnabled`: with `false`, Cowork tasks now stay listed in the sidebar and open read-only instead of disappearing. +* `disabledBuiltinTools`: a `WebFetch` or bare `Bash` entry added by device management now also applies to open Cowork and Chat conversations, and a tool name spelled with underscores or hyphens raises a configuration warning. - **Deprecated** (no end date has been set; this release and later keep reading the original spelling): +**Removed:** - * `inferenceGatewayAuthScheme: "sso"`: use `inferenceCredentialKind: "interactive"` instead. If `inferenceCredentialKind` is not set, this release and later keep reading the original spelling as `inferenceCredentialKind: "interactive"` after October 7, 2026. Earlier releases stop reading it on that date, as announced under v1.40609.0. - +The former key names below are now unrecognized keys: the setting no longer applies and the deprecation notice no longer appears. This replaces what the v1.40609.0 entry says these names do after the cut-off. - - **Changed:** +* `isDxtEnabled`: use `isDesktopExtensionEnabled` instead. Until then extensions are off on third-party deployments and allowed on standard deployments. +* `isDxtSignatureRequired`: use `isDesktopExtensionSignatureRequired` instead. Until then unsigned extensions load. +* `enduserAttribution`: use `endUserAttribution` instead. Until then end-user attribution is on. In the Windows registry, where names ignore case, the former name still reads as `endUserAttribution`. +* `trustBootstrapLocalExec`: use `trustBootstrapDelivery` instead. Until then a `bootstrapUrl` set by device management (on Windows, machine policy only) is trusted without asking each user, and any other `bootstrapUrl` asks each user. +* `inferenceGatewayHeaders`: use `inferenceCustomHeaders` instead. Until then no custom inference headers are sent. +* The deprecation notices for these spellings, which stopped being accepted on October 7, 2026 and are listed under v1.40609.0: header maps written as a string or list, `inferenceGatewayAuthScheme: "auto"`, `ask-session`, the older `managedMcpServers` entry forms, and the `orgPluginSettings` record form. Such a value is now reported like any other invalid value. - * `allowedWorkspaceFolders`, when set, now also limits which of a project's folders a chat can read: only those inside a listed folder. - +**v2.31226.1** - - No configuration changes in this release. - +No configuration changes in this release. - -
- | MDM key | Type | Description | - | - | - | - | - | [`deniedPluginMcpServers`](/docs/third-party/claude-desktop/configuration#deniedpluginmcpservers) | `object[]` | Blocked plugin MCP servers | -
+**v2.31226.0** - **JSON (e.g. for non-MDM users or Bootstrap):** +| MDM key | Type | Description | +| - | - | - | +| [`otlpAttrMaxChars`](/docs/third-party/claude-desktop/configuration#otlpattrmaxchars) | `integer` | Telemetry attribute length limit | +| [`desktopHome`](/docs/third-party/claude-desktop/configuration#desktophome) | `enum` | Desktop home | - ```json theme={null} - { - "mcp": { - "deniedPluginServers": [ - { - "serverUrl": "" - } - ] - } +**JSON (e.g. for non-MDM users or Bootstrap):** + +```json theme={null} +{ + "otlp": { + "attrMaxChars": "" + }, + "chatSurface": { + "desktopHome": "" } - ``` - - **Changed:** - - * `userPluginMarketplacesEnabled`: when set to `false`, plugin marketplaces your organization did not provision are now hidden in every tab, installs and updates from them are refused, and the sessions the app starts load plugins only from your organization's marketplaces, the organization plugins directory, the app's own uploads and the user's own skills folder; nothing is deleted, and removing the key or setting it to `true` restores them. Earlier releases only blocked adding marketplaces, so on devices where the key is already `false`, plugins from marketplaces users added before stop loading once the app updates. - - - - No configuration changes in this release. - - - - **Changed:** - - * `autoModeEnabled` no longer defaults to `false`. Left unset, the Code tab offers Auto mode and new Code tab sessions start in it where the model supports it; `true` does the same and also offers it in Cowork (Cowork sessions still start by asking before each action); `false` removes it from both tabs. Earlier releases treat an unset key as `false`, so Auto mode stays off on devices that have not updated. - * `inferenceIdpOidc` and `inferenceGatewayOidc`: `resource` accepts, besides a web address, an identifier with a scheme of its own that is not a web address, such as an AD FS relying-party identifier (`urn:…`), which is sent to the identity provider exactly as written; a value with no scheme is still sent as `https://`. Earlier releases accept only a web address here and ignore the whole sign-in object, not just `resource`, when it carries such an identifier, so deploy one only once every device has updated. - - - -
- | MDM key | Type | Description | - | - | - | - | - | [`inferenceIdpAuthFlow`](/docs/third-party/claude-desktop/configuration#inferenceidpauthflow) | `enum` | Identity provider sign-in flow | - | [`inferenceIdpOidc`](/docs/third-party/claude-desktop/configuration#inferenceidpoidc) | `object` | Identity provider (OIDC) | - | [`mcpScheduledTaskApprovalLifetimeDays`](/docs/third-party/claude-desktop/configuration#mcpscheduledtaskapprovallifetimedays) | `integer` | Scheduled-task tool approval lifetime | - | [`keepAwakeEnabled`](/docs/third-party/claude-desktop/configuration#keepawakeenabled) | `boolean` | Allow keep awake | -
- - **Set in the Claude admin console only:** - - * [`disableLocalConfigCache`](/docs/third-party/claude-desktop/configuration#disablelocalconfigcache) — Keep only your organization ID and restrictions on disk - - **JSON (e.g. for non-MDM users or Bootstrap):** - - ```json theme={null} - { - "inference": { - "credential": { - "authFlow": "", - "oidc": { - "clientId": "", - "issuer": "", - "authorizationUrl": "", - "tokenUrl": "", - "bearerTokenType": "", - "scopes": "", - "appendOfflineAccess": "", - "resource": "", - "redirectPort": "", - "redirectHost": "<127.0.0.1|localhost>", - "additionalRedirectReferrerHosts": "" - } - } - }, - "mcp": { - "scheduledTaskApprovalLifetimeDays": "" - }, - "workspace": { - "keepAwakeEnabled": "" - } +} +``` + +**Changed:** + +* `allowedWorkspaceFolders`: in SSH sessions Claude's file tools can no longer modify a folder marked `ro`, as in a local Code session. Not enforced on Windows hosts, or on a host with Claude Code managed settings of its own (unless they set `parentSettingsBehavior` to `merge`). +* `claudeAiImport.automatic3pImport` now also brings over Cowork artifacts, projects, memory and global instructions, scheduled tasks from Cowork and Code, uploaded plugins (unless `userPluginUploadsEnabled` is off), saved skills (unless `skillCreationEnabled` is off) and the optional plugins a user had on from the organization's plugins directory or a marketplace served from its gateway's or bootstrap server's own address, also on computers that moved under an earlier release. +* `inferenceModels[].prefer1m` and `modelPrefer1mContext` now show one model picker entry for each model that offers 1M and has the preference, and start its new sessions at 1M, whichever entry a user had picked. Earlier releases only moved the starting selection of the first model. + +**v2.26454.2** + +No configuration changes in this release. + +**v2.26454.0** + +| MDM key | Type | Description | +| - | - | - | +| [`microsoftAuthDefaultAccount`](/docs/third-party/claude-desktop/configuration#microsoftauthdefaultaccount) | `enum` | Microsoft 365 sign-in with the Windows account | + +**JSON (e.g. for non-MDM users or Bootstrap):** + +```json theme={null} +{ + "authentication": { + "microsoftAuthDefaultAccount": "" } - ``` - - **Changed:** - - * `inferenceCredentialKind` accepts `external-idp` for the gateway and Bedrock providers: users sign in through your organization's OpenID Connect identity provider (`inferenceIdpOidc`, `inferenceIdpAuthFlow`) and the token is sent as the Bearer credential, on Bedrock to a token-validating proxy at `inferenceBedrockBaseUrl`, which that kind requires. - - **Deprecated** (no end date has been set; the original spellings keep working): - - * `inferenceCredentialKind: "interactive"` together with `inferenceGatewayOidc` (gateway): use `"external-idp"` instead once every desktop in the fleet is on 2.7032.0 or later; 2.7032.0 and later read the original spelling as `"external-idp"`. - * `inferenceGatewayOidc`: use `inferenceIdpOidc` with `inferenceCredentialKind: "external-idp"` instead, once every desktop in the fleet is on 2.7032.0 or later. - * `inferenceGatewayOidcAuthFlow`: use `inferenceIdpAuthFlow` together with `inferenceIdpOidc` instead, once every desktop in the fleet is on 2.7032.0 or later. - - - - No configuration changes in this release. - - - - No configuration changes in this release. - - - -
- | MDM key | Type | Description | - | - | - | - | - | [`inferenceCredentialHelperWindows`](/docs/third-party/claude-desktop/configuration#inferencecredentialhelperwindows) | `string` | Helper script (Windows) | - | [`allowedPluginMcpServers`](/docs/third-party/claude-desktop/configuration#allowedpluginmcpservers) | `object[]` | Allowed plugin MCP servers | - | [`builtinBrowserEnabled`](/docs/third-party/claude-desktop/configuration#builtinbrowserenabled) | `boolean` | Allow the built-in browser | - | [`builtinBrowserDefaultDomainPolicy`](/docs/third-party/claude-desktop/configuration#builtinbrowserdefaultdomainpolicy) | `enum` | Default site policy in the built-in browser | - | [`builtinBrowserAllowedDomains`](/docs/third-party/claude-desktop/configuration#builtinbrowseralloweddomains) | `string[]` | Allowed sites in the built-in browser | - | [`builtinBrowserBlockedDomains`](/docs/third-party/claude-desktop/configuration#builtinbrowserblockeddomains) | `string[]` | Blocked sites in the built-in browser | -
- - **JSON (e.g. for non-MDM users or Bootstrap):** - - ```json theme={null} - { - "inference": { - "credential": { - "commandWindows": "" +} +``` + +**Changed:** + +* `claudeAiImport` accepts a new `allowedOrganizationUuids` value, a list of Claude.ai organization IDs: when set, users can import history only by signing in to Claude.ai, and only from an organization on the list; a sign-in to any other organization or to a personal account is refused, and importing from a file or from earlier sessions on this computer is turned off. The list turns nothing on by itself, and `automatic3pImport` is not affected. Earlier releases ignore the list and keep allowing every import they allowed before, so the list limits imports only on devices running this release or later. +* `disableAutoUpdates` now also decides when Cowork's workspace is downloaded: in the background, instead of at the first task, unless it is `true`. + +**Deprecated** (no end date has been set; this release and later keep reading the original spelling): + +* `inferenceGatewayAuthScheme: "sso"`: use `inferenceCredentialKind: "interactive"` instead. If `inferenceCredentialKind` is not set, this release and later keep reading the original spelling as `inferenceCredentialKind: "interactive"` after October 7, 2026. Earlier releases stop reading it on that date, as announced under v1.40609.0. + +**v2.19675.1** + +**Changed:** + +* `allowedWorkspaceFolders`, when set, now also limits which of a project's folders a chat can read: only those inside a listed folder. + +**v2.19675.0** + +No configuration changes in this release. + +**v2.16120.0** + +| MDM key | Type | Description | +| - | - | - | +| [`deniedPluginMcpServers`](/docs/third-party/claude-desktop/configuration#deniedpluginmcpservers) | `object[]` | Blocked plugin MCP servers | + +**JSON (e.g. for non-MDM users or Bootstrap):** + +```json theme={null} +{ + "mcp": { + "deniedPluginServers": [ + { + "serverUrl": "" } - }, - "mcp": { - "allowedPluginServers": [ - { - "serverUrl": "" - } - ] - }, - "builtinBrowser": { - "enabled": "", - "defaultDomainPolicy": "", - "allowedDomains": [""], - "blockedDomains": [""] - } + ] } - ``` - - **Changed:** - - * `inferenceFoundryResource` now requires the user's consent when delivered by a bootstrap URL the user configured themselves (`consentRequired`), as `inferenceFoundryBaseUrl` and the other providers' endpoint settings already do; declining quits the app, and because the resource name is required each such Foundry install prompts once after updating. A bootstrap URL set by device management, or covered by `trustBootstrapDelivery: true`, never prompts, and values delivered by MDM are unchanged. Earlier releases apply a served value without asking. - - - -
- | MDM key | Type | Description | - | - | - | - | - | [`inferenceCredentialHelperArgs`](/docs/third-party/claude-desktop/configuration#inferencecredentialhelperargs) | `string[]` | Helper script arguments | - | [`inferenceFoundryBaseUrl`](/docs/third-party/claude-desktop/configuration#inferencefoundrybaseurl) | `string` | Azure AI Foundry base URL | - | [`defaultModelEffort`](/docs/third-party/claude-desktop/configuration#defaultmodeleffort) | `enum` | Default model effort | - | [`alwaysStartWithDefaultModel`](/docs/third-party/claude-desktop/configuration#alwaysstartwithdefaultmodel) | `boolean` | Always start with the default model | - | [`modelCatalogEnabled`](/docs/third-party/claude-desktop/configuration#modelcatalogenabled) | `boolean` | Model catalog metadata | - | [`modelCatalogUrl`](/docs/third-party/claude-desktop/configuration#modelcatalogurl) | `string` | Model catalog URL | - | [`scheduledTasksEnabled`](/docs/third-party/claude-desktop/configuration#scheduledtasksenabled) | `boolean` | Allow scheduled tasks | -
- - **JSON (e.g. for non-MDM users or Bootstrap):** - - ```json theme={null} - { - "inference": { - "credential": { - "args": [""] - }, - "baseUrl": "" - }, - "models": { - "defaultEffort": "", - "alwaysStartWithDefault": "", - "catalogEnabled": "", - "catalogUrl": "" - }, - "workspace": { - "scheduledTasksEnabled": "" +} +``` + +**Changed:** + +* `userPluginMarketplacesEnabled`: when set to `false`, plugin marketplaces your organization did not provision are now hidden in every tab, installs and updates from them are refused, and the sessions the app starts load plugins only from your organization's marketplaces, the organization plugins directory, the app's own uploads and the user's own skills folder; nothing is deleted, and removing the key or setting it to `true` restores them. Earlier releases only blocked adding marketplaces, so on devices where the key is already `false`, plugins from marketplaces users added before stop loading once the app updates. + +**v2.9939.4** + +No configuration changes in this release. + +**v2.9939.2** + +**Changed:** + +* `autoModeEnabled` no longer defaults to `false`. Left unset, the Code tab offers Auto mode and new Code tab sessions start in it where the model supports it; `true` does the same and also offers it in Cowork (Cowork sessions still start by asking before each action); `false` removes it from both tabs. Earlier releases treat an unset key as `false`, so Auto mode stays off on devices that have not updated. +* `inferenceIdpOidc` and `inferenceGatewayOidc`: `resource` accepts, besides a web address, an identifier with a scheme of its own that is not a web address, such as an AD FS relying-party identifier (`urn:…`), which is sent to the identity provider exactly as written; a value with no scheme is still sent as `https://`. Earlier releases accept only a web address here and ignore the whole sign-in object, not just `resource`, when it carries such an identifier, so deploy one only once every device has updated. + +**v2.7032.0** + +| MDM key | Type | Description | +| - | - | - | +| [`inferenceIdpAuthFlow`](/docs/third-party/claude-desktop/configuration#inferenceidpauthflow) | `enum` | Identity provider sign-in flow | +| [`inferenceIdpOidc`](/docs/third-party/claude-desktop/configuration#inferenceidpoidc) | `object` | Identity provider (OIDC) | +| [`mcpScheduledTaskApprovalLifetimeDays`](/docs/third-party/claude-desktop/configuration#mcpscheduledtaskapprovallifetimedays) | `integer` | Scheduled-task tool approval lifetime | +| [`keepAwakeEnabled`](/docs/third-party/claude-desktop/configuration#keepawakeenabled) | `boolean` | Allow keep awake | + +**Set in the Claude admin console only:** + +* [`disableLocalConfigCache`](/docs/third-party/claude-desktop/configuration#disablelocalconfigcache) — Keep only your organization ID and restrictions on disk + +**JSON (e.g. for non-MDM users or Bootstrap):** + +```json theme={null} +{ + "inference": { + "credential": { + "authFlow": "", + "oidc": { + "clientId": "", + "issuer": "", + "authorizationUrl": "", + "tokenUrl": "", + "bearerTokenType": "", + "scopes": "", + "appendOfflineAccess": "", + "resource": "", + "redirectPort": "", + "redirectHost": "<127.0.0.1|localhost>", + "additionalRedirectReferrerHosts": "" + } } + }, + "mcp": { + "scheduledTaskApprovalLifetimeDays": "" + }, + "workspace": { + "keepAwakeEnabled": "" } - ``` - - **Changed:** - - * `bootstrapOidc`, `inferenceGatewayOidc`, and `inferenceVertexWorkforceOidc` accept a new `redirectHost` value, `127.0.0.1` (the default) or `localhost`, which sets the host named in the browser sign-in's redirect URI (`http://:/callback`) for identity providers that only accept `localhost`; register exactly the URI you use. Earlier releases ignore the value and keep using `http://127.0.0.1:/callback`, so a `localhost`-only registration still fails sign-in on them until they update. - * An `inferenceModels` entry accepts a new `maxEffort` value (`low`, `medium`, `high`, `xhigh`, or `max`): effort levels above it are hidden for that model in Chat, Cowork, and Code and never requested, and Code sessions are held to it; an unrecognized value caps that model at `low`. Earlier releases ignore the value and keep offering every effort level, so the cap holds only on devices running this release or later. - * A `managedMcpServers` entry accepts a new `transport` value, `policy-only`: the entry sets `toolPolicy` for an MCP server that an installed plugin provides, matched by `name`, without the app connecting to or launching anything, and takes precedence over `orgPluginSettings` for that server in Chat, Cowork, and Code. Earlier releases drop a `policy-only` entry (it appears under Configuration parse errors in the diagnostic report) and apply `orgPluginSettings` to that server instead; if every entry in the list is `policy-only` they cannot read `managedMcpServers` at all and, until they update, leave MCP servers that users added themselves or that a project's `.mcp.json` declares out of Code sessions. Keep the same permissions in `orgPluginSettings` while earlier releases are in use, and do not deploy a list made only of `policy-only` entries until every device has updated. - - - - No configuration changes in this release. - - - - No configuration changes in this release. - - - -
- | MDM key | Type | Description | - | - | - | - | - | [`sshTransport`](/docs/third-party/claude-desktop/configuration#sshtransport) · Beta | `enum` | SSH connection engine | - | [`chatSessionRetentionDays`](/docs/third-party/claude-desktop/configuration#chatsessionretentiondays) | `integer` | Chat retention period | - | [`coworkSessionRetentionDays`](/docs/third-party/claude-desktop/configuration#coworksessionretentiondays) | `integer` | Cowork retention period | - | [`codeSessionRetentionDays`](/docs/third-party/claude-desktop/configuration#codesessionretentiondays) | `integer` | Code retention period | - | [`sessionRetentionHold`](/docs/third-party/claude-desktop/configuration#sessionretentionhold) | `boolean` | Suspend session deletion | - | [`coworkVmIpv6Enabled`](/docs/third-party/claude-desktop/configuration#coworkvmipv6enabled) | `boolean` | Enable IPv6 in the workspace VM | -
- - **JSON (e.g. for non-MDM users or Bootstrap):** - - ```json theme={null} - { - "codeSurface": { - "sshTransport": "" - }, - "sessionRetention": { - "chatDays": "", - "coworkDays": "", - "codeDays": "", - "legalHold": "" - }, - "workspace": { - "vmIpv6Enabled": "" +} +``` + +**Changed:** + +* `inferenceCredentialKind` accepts `external-idp` for the gateway and Bedrock providers: users sign in through your organization's OpenID Connect identity provider (`inferenceIdpOidc`, `inferenceIdpAuthFlow`) and the token is sent as the Bearer credential, on Bedrock to a token-validating proxy at `inferenceBedrockBaseUrl`, which that kind requires. + +**Deprecated** (no end date has been set; the original spellings keep working): + +* `inferenceCredentialKind: "interactive"` together with `inferenceGatewayOidc` (gateway): use `"external-idp"` instead once every desktop in the fleet is on 2.7032.0 or later; 2.7032.0 and later read the original spelling as `"external-idp"`. +* `inferenceGatewayOidc`: use `inferenceIdpOidc` with `inferenceCredentialKind: "external-idp"` instead, once every desktop in the fleet is on 2.7032.0 or later. +* `inferenceGatewayOidcAuthFlow`: use `inferenceIdpAuthFlow` together with `inferenceIdpOidc` instead, once every desktop in the fleet is on 2.7032.0 or later. + +**v2.2553.13** + +No configuration changes in this release. + +**v2.2553.1** + +No configuration changes in this release. + +**v2.2553.0** + +| MDM key | Type | Description | +| - | - | - | +| [`inferenceCredentialHelperWindows`](/docs/third-party/claude-desktop/configuration#inferencecredentialhelperwindows) | `string` | Helper script (Windows) | +| [`allowedPluginMcpServers`](/docs/third-party/claude-desktop/configuration#allowedpluginmcpservers) | `object[]` | Allowed plugin MCP servers | +| [`builtinBrowserEnabled`](/docs/third-party/claude-desktop/configuration#builtinbrowserenabled) | `boolean` | Allow the built-in browser | +| [`builtinBrowserDefaultDomainPolicy`](/docs/third-party/claude-desktop/configuration#builtinbrowserdefaultdomainpolicy) | `enum` | Default site policy in the built-in browser | +| [`builtinBrowserAllowedDomains`](/docs/third-party/claude-desktop/configuration#builtinbrowseralloweddomains) | `string[]` | Allowed sites in the built-in browser | +| [`builtinBrowserBlockedDomains`](/docs/third-party/claude-desktop/configuration#builtinbrowserblockeddomains) | `string[]` | Blocked sites in the built-in browser | + +**JSON (e.g. for non-MDM users or Bootstrap):** + +```json theme={null} +{ + "inference": { + "credential": { + "commandWindows": "" } + }, + "mcp": { + "allowedPluginServers": [ + { + "serverUrl": "" + } + ] + }, + "builtinBrowser": { + "enabled": "", + "defaultDomainPolicy": "", + "allowedDomains": [""], + "blockedDomains": [""] } - ``` - - - - **Changed:** - - * `managedMcpServers`: the built-in Microsoft 365 server entry (`"server": "microsoft365"`) accepts a new `continuousAccessEvaluation` value, `enabled` (the default) or `disabled`. When enabled, the bundled connector requests Continuous Access Evaluation-capable Microsoft Graph tokens, which live up to about 28 hours but are cut off within minutes when an administrator revokes sessions or disables the account, or, where the tenant enforces a location or compliant-network Conditional Access policy, when the token is used from outside that network; `disabled` keeps standard one-hour tokens. A change applies to tokens issued after the connector next starts. - * `microsoftAuthBroker` accepts a new `required` value: Microsoft 365 sign-in fails when the OS sign-in broker (WAM on Windows, the Company Portal SSO extension on macOS) is unavailable instead of falling back to the browser, so the refresh token stays broker-held, and the connector removes the token cache an earlier browser sign-in left on disk. Linux has no broker, so `required` is not supported there. Earlier releases treat `required` as `disabled` (browser-only sign-in), so deploy it once every device is on this release or later. - - - - No configuration changes in this release. - - - - No configuration changes in this release. - - - - No configuration changes in this release. - - - -
- | MDM key | Type | Description | - | - | - | - | - | [`sshClientPath`](/docs/third-party/claude-desktop/configuration#sshclientpath) · Beta | `string` | SSH client program | - | [`configRecheckIntervalMinutes`](/docs/third-party/claude-desktop/configuration#configrecheckintervalminutes) | `integer` | Configuration re-check interval | - | [`disableBypassPermissionsMode`](/docs/third-party/claude-desktop/configuration#disablebypasspermissionsmode) | `boolean` | Disable bypass permissions mode | - | [`blockReadsOutsideWorkingDirectories`](/docs/third-party/claude-desktop/configuration#blockreadsoutsideworkingdirectories) | `boolean` | Block reads outside working directories | -
- - **JSON (e.g. for non-MDM users or Bootstrap):** - - ```json theme={null} - { - "codeSurface": { - "sshClientPath": "" - }, - "lifecycle": { - "configRecheckIntervalMinutes": "" +} +``` + +**Changed:** + +* `inferenceFoundryResource` now requires the user's consent when delivered by a bootstrap URL the user configured themselves (`consentRequired`), as `inferenceFoundryBaseUrl` and the other providers' endpoint settings already do; declining quits the app, and because the resource name is required each such Foundry install prompts once after updating. A bootstrap URL set by device management, or covered by `trustBootstrapDelivery: true`, never prompts, and values delivered by MDM are unchanged. Earlier releases apply a served value without asking. + +**v2.110.0** + +| MDM key | Type | Description | +| - | - | - | +| [`inferenceCredentialHelperArgs`](/docs/third-party/claude-desktop/configuration#inferencecredentialhelperargs) | `string[]` | Helper script arguments | +| [`inferenceFoundryBaseUrl`](/docs/third-party/claude-desktop/configuration#inferencefoundrybaseurl) | `string` | Azure AI Foundry base URL | +| [`defaultModelEffort`](/docs/third-party/claude-desktop/configuration#defaultmodeleffort) | `enum` | Default model effort | +| [`alwaysStartWithDefaultModel`](/docs/third-party/claude-desktop/configuration#alwaysstartwithdefaultmodel) | `boolean` | Always start with the default model | +| [`modelCatalogEnabled`](/docs/third-party/claude-desktop/configuration#modelcatalogenabled) | `boolean` | Model catalog metadata | +| [`modelCatalogUrl`](/docs/third-party/claude-desktop/configuration#modelcatalogurl) | `string` | Model catalog URL | +| [`scheduledTasksEnabled`](/docs/third-party/claude-desktop/configuration#scheduledtasksenabled) | `boolean` | Allow scheduled tasks | + +**JSON (e.g. for non-MDM users or Bootstrap):** + +```json theme={null} +{ + "inference": { + "credential": { + "args": [""] }, - "workspace": { - "disableBypassPermissionsMode": "", - "blockReadsOutsideWorkingDirectories": "" - } + "baseUrl": "" + }, + "models": { + "defaultEffort": "", + "alwaysStartWithDefault": "", + "catalogEnabled": "", + "catalogUrl": "" + }, + "workspace": { + "scheduledTasksEnabled": "" } - ``` +} +``` - **Changed:** +**Changed:** - * **Breaking:** `relaunchEnforcementHours` moved in the nested served format from `bootstrap.relaunchEnforcementHours` to `lifecycle.relaunchEnforcementHours` (beside the new `lifecycle.configRecheckIntervalMinutes`). This release no longer reads the old path and earlier releases do not read the new one, so move the value under `lifecycle`; the MDM / flat key name `relaunchEnforcementHours` is unchanged. The key can now also be set from device management (availability MDM and served), and the default when no tier sets it is 24 hours (was 1). - +* `bootstrapOidc`, `inferenceGatewayOidc`, and `inferenceVertexWorkforceOidc` accept a new `redirectHost` value, `127.0.0.1` (the default) or `localhost`, which sets the host named in the browser sign-in's redirect URI (`http://:/callback`) for identity providers that only accept `localhost`; register exactly the URI you use. Earlier releases ignore the value and keep using `http://127.0.0.1:/callback`, so a `localhost`-only registration still fails sign-in on them until they update. +* An `inferenceModels` entry accepts a new `maxEffort` value (`low`, `medium`, `high`, `xhigh`, or `max`): effort levels above it are hidden for that model in Chat, Cowork, and Code and never requested, and Code sessions are held to it; an unrecognized value caps that model at `low`. Earlier releases ignore the value and keep offering every effort level, so the cap holds only on devices running this release or later. +* A `managedMcpServers` entry accepts a new `transport` value, `policy-only`: the entry sets `toolPolicy` for an MCP server that an installed plugin provides, matched by `name`, without the app connecting to or launching anything, and takes precedence over `orgPluginSettings` for that server in Chat, Cowork, and Code. Earlier releases drop a `policy-only` entry (it appears under Configuration parse errors in the diagnostic report) and apply `orgPluginSettings` to that server instead; if every entry in the list is `policy-only` they cannot read `managedMcpServers` at all and, until they update, leave MCP servers that users added themselves or that a project's `.mcp.json` declares out of Code sessions. Keep the same permissions in `orgPluginSettings` while earlier releases are in use, and do not deploy a list made only of `policy-only` entries until every device has updated. - - No configuration changes in this release. - +**v1.52386.6** - - No configuration changes in this release. - +No configuration changes in this release. - -
- | MDM key | Type | Description | - | - | - | - | - | [`inferenceStreamIdleTimeoutSec`](/docs/third-party/claude-desktop/configuration#inferencestreamidletimeoutsec) | `integer` | Stream idle timeout | - | [`egressProxyUrl`](/docs/third-party/claude-desktop/configuration#egressproxyurl) | `string` | Proxy server URL | - | [`egressProxyPacUrl`](/docs/third-party/claude-desktop/configuration#egressproxypacurl) | `string` | Proxy auto-config (PAC) URL | - | [`claudeAiImport.automatic3pImport`](/docs/third-party/claude-desktop/configuration#claudeaiimport) | `boolean` | New subfield (beta): when `true` and `deploymentOrganizationUuid` is set, the app copies this computer's earlier third-party sessions stored before an organization ID was configured into that organization's session store, once per device and in the background; independent of `enabled` (default `false`). | -
+**v1.52386.3** - **JSON (e.g. for non-MDM users or Bootstrap):** +No configuration changes in this release. - ```json theme={null} - { - "inference": { - "streamIdleTimeoutSec": "" - }, - "workspace": { - "egressProxyUrl": "", - "egressProxyPacUrl": "" - }, - "claudeAiImport": { - "automatic3pImport": "" - } +**v1.52386.0** + +| MDM key | Type | Description | +| - | - | - | +| [`sshTransport`](/docs/third-party/claude-desktop/configuration#sshtransport) · Beta | `enum` | SSH connection engine | +| [`chatSessionRetentionDays`](/docs/third-party/claude-desktop/configuration#chatsessionretentiondays) | `integer` | Chat retention period | +| [`coworkSessionRetentionDays`](/docs/third-party/claude-desktop/configuration#coworksessionretentiondays) | `integer` | Cowork retention period | +| [`codeSessionRetentionDays`](/docs/third-party/claude-desktop/configuration#codesessionretentiondays) | `integer` | Code retention period | +| [`sessionRetentionHold`](/docs/third-party/claude-desktop/configuration#sessionretentionhold) | `boolean` | Suspend session deletion | +| [`coworkVmIpv6Enabled`](/docs/third-party/claude-desktop/configuration#coworkvmipv6enabled) | `boolean` | Enable IPv6 in the workspace VM | + +**JSON (e.g. for non-MDM users or Bootstrap):** + +```json theme={null} +{ + "codeSurface": { + "sshTransport": "" + }, + "sessionRetention": { + "chatDays": "", + "coworkDays": "", + "codeDays": "", + "legalHold": "" + }, + "workspace": { + "vmIpv6Enabled": "" } - ``` +} +``` - `egressProxyUrl` and `egressProxyPacUrl` are read from device management or a local configuration file only; a value served by a bootstrap URL is not applied. +**v1.49585.0** - **Changed:** +**Changed:** - * **Breaking:** `inferenceModelPricingMultiplier` and `inferenceModelPricing` no longer turn on the Usage page's cost estimate by themselves; they apply only while `inferenceModelPricingEnabled` is `true` and are ignored otherwise. A configuration that sets either without `inferenceModelPricingEnabled: true` now shows token counts only; add that key to keep the estimate. - +* `managedMcpServers`: the built-in Microsoft 365 server entry (`"server": "microsoft365"`) accepts a new `continuousAccessEvaluation` value, `enabled` (the default) or `disabled`. When enabled, the bundled connector requests Continuous Access Evaluation-capable Microsoft Graph tokens, which live up to about 28 hours but are cut off within minutes when an administrator revokes sessions or disables the account, or, where the tenant enforces a location or compliant-network Conditional Access policy, when the token is used from outside that network; `disabled` keeps standard one-hour tokens. A change applies to tokens issued after the connector next starts. +* `microsoftAuthBroker` accepts a new `required` value: Microsoft 365 sign-in fails when the OS sign-in broker (WAM on Windows, the Company Portal SSO extension on macOS) is unavailable instead of falling back to the browser, so the refresh token stays broker-held, and the connector removes the token cache an earlier browser sign-in left on disk. Linux has no broker, so `required` is not supported there. Earlier releases treat `required` as `disabled` (browser-only sign-in), so deploy it once every device is on this release or later. - - No configuration changes in this release. - +**v1.46388.4** - -
- | MDM key | Type | Description | - | - | - | - | - | [`sshHostAllowlist`](/docs/third-party/claude-desktop/configuration#sshhostallowlist) · Beta | `string[]` | SSH host allowlist | - | [`disableConfigDeprecationWarnings`](/docs/third-party/claude-desktop/configuration#disableconfigdeprecationwarnings) | `boolean` | Hide configuration deprecation warnings | -
+No configuration changes in this release. - **JSON (e.g. for non-MDM users or Bootstrap):** +**v1.46388.3** - ```json theme={null} - { - "codeSurface": { - "sshHostAllowlist": [""] - }, - "bootstrap": { - "relaunchEnforcementHours": "" - }, - "appearance": { - "disableConfigDeprecationWarnings": "" - } +No configuration changes in this release. + +**v1.46388.2** + +No configuration changes in this release. + +**v1.46388.1** + +| MDM key | Type | Description | +| - | - | - | +| [`sshClientPath`](/docs/third-party/claude-desktop/configuration#sshclientpath) · Beta | `string` | SSH client program | +| [`configRecheckIntervalMinutes`](/docs/third-party/claude-desktop/configuration#configrecheckintervalminutes) | `integer` | Configuration re-check interval | +| [`disableBypassPermissionsMode`](/docs/third-party/claude-desktop/configuration#disablebypasspermissionsmode) | `boolean` | Disable bypass permissions mode | +| [`blockReadsOutsideWorkingDirectories`](/docs/third-party/claude-desktop/configuration#blockreadsoutsideworkingdirectories) | `boolean` | Block reads outside working directories | + +**JSON (e.g. for non-MDM users or Bootstrap):** + +```json theme={null} +{ + "codeSurface": { + "sshClientPath": "" + }, + "lifecycle": { + "configRecheckIntervalMinutes": "" + }, + "workspace": { + "disableBypassPermissionsMode": "", + "blockReadsOutsideWorkingDirectories": "" } - ``` - - `relaunchEnforcementHours` is read from served configuration only (a bootstrap URL); a value in a local configuration file or in device management is ignored with a warning. - - **Changed:** - - * `inferenceVertexProjectId` and `inferenceVertexWorkforceUserProject` now require the user's consent when delivered by a bootstrap URL the user configured themselves (`consentRequired`); a bootstrap URL set by device management, or covered by `trustBootstrapDelivery: true`, never prompts. Both keys must match the Google Cloud project format (`^[a-z0-9][a-z0-9.:-]*$`). - * `inferenceCredentialKind` accepts `interactive` for Vertex AI (Google sign-in); the Vertex `oauth` value is deprecated (below). - * `orgPluginSettings` is published as an array of `{ "serverName", "tools": [{ "toolName", "permission" }] }` entries; the `{ "mcpServers": {…} }` record form is deprecated (below). - * The published bootstrap JSON schema now rejects `authorityHost` on the Microsoft 365 entry, so a configuration that still uses it fails schema validation in tools that check against the schema; the app itself keeps mapping it to `azureCloud` until October 7, 2026. - * `allowedPluginMarketplaces` is no longer marked Beta. - - **Deprecated** (each accepted until October 7, 2026, 12:00 PM Pacific Time; users see an in-app warning from September 10, 2026, which `disableConfigDeprecationWarnings` hides, and a final reminder in the 24 hours before the cut-off, which it does not): - - * `inferenceGatewayHeaders`: use `inferenceCustomHeaders` instead. After the cut-off no custom inference headers are sent. - * `inferenceCustomHeaders`, `otlpHeaders`, `otlpResourceAttributes` and `bootstrapHeaders` written as a `"Name=value,…"` string or a `["Name: value", …]` list: use a JSON object such as `{"Name": "value"}` instead. After the cut-off a string or list value is rejected as malformed and no headers (or resource attributes) are sent. - * `inferenceGatewayAuthScheme: "sso"`: use `inferenceCredentialKind: "interactive"` instead. After the cut-off the value is reported as invalid and, unless another credential field says how to sign in, the gateway connection has no credential and inference does not start. - * `inferenceGatewayAuthScheme: "auto"`: use `"bearer"` instead, or remove the key (`bearer` is the default). After the cut-off the value is reported as invalid and the default applies. - * `inferenceCredentialKind: "oauth"` (Vertex AI): use `"interactive"` instead. After the cut-off `oauth` is reported as invalid and the kind is derived from the credential fields present. - * `inferenceCredentialKind: "interactive"` together with `inferenceVertexWorkforceAudience` (Vertex AI): use `"workforce"` instead, or remove the audience if Google sign-in is meant. After the cut-off the audience no longer implies Workforce Identity; `interactive` then needs `inferenceVertexOAuthClientId` or inference does not start. - * `isDxtEnabled` and `isDxtSignatureRequired`: use `isDesktopExtensionEnabled` and `isDesktopExtensionSignatureRequired` instead. After the cut-off the old names are unreadable: extensions are disabled, or only signed extensions load, until the name is updated. - * `trustBootstrapLocalExec`: use `trustBootstrapDelivery` instead. After the cut-off the key reads `false` and each user is asked to consent to bootstrap-delivered values. - * `enduserAttribution`: use `endUserAttribution` instead. After the cut-off the key reads `false` and end-user attribution stays off. - * `orgPluginSettings` as a `{ "mcpServers": {…} }` record: use the array form instead (read by desktop 1.15200.0 and later; older desktops ignore the array and enforce no tool locks). After the cut-off the record is rejected and every plugin-delivered MCP tool is blocked until the value is rewritten. - * `ask-session` in `builtinToolPolicy`, `orgPluginSettings[].tools[].permission` and `managedMcpServers[].toolPolicy`: use `ask` instead. After the cut-off it is treated as an unrecognized value: `ask` for a built-in tool, `blocked` for a plugin-delivered tool, and an invalid entry for a managed server. - * In `managedMcpServers` entries: replace `scopes` with `scope` (one space-separated string); remove `transport: "builtin"` and `source`; replace `authorityHost` with `azureCloud: "us-gov-high"` for a GCC High tenant; write `oauth` as `true` or an oauth object rather than a number or string; replace `oauth.scopes` (or `oauth.scope` as a list) with `oauth.scope` as one string; add `transport: "http"` (or `"sse"` / `"stdio"`) to an entry with no `transport` that is not a built-in server (a built-in Microsoft 365 or GitHub entry takes no `transport`). After the cut-off such an entry is rejected and that connector is unavailable until it is rewritten (`source` is ignored by the desktop but refused by a customer-run Apps Gateway). - - - - No configuration changes in this release. - - - - No configuration changes in this release. - - - - No configuration changes in this release. - - - -
- | MDM key | Type | Description | - | - | - | - | - | [`inferenceModelPricingEnabled`](/docs/third-party/claude-desktop/configuration#inferencemodelpricingenabled) | `boolean` | Show estimated cost | - | [`inferenceModelPricingMultiplier`](/docs/third-party/claude-desktop/configuration#inferencemodelpricingmultiplier) | `number` | Price multiplier | - | [`inferenceModelPricing`](/docs/third-party/claude-desktop/configuration#inferencemodelpricing) | `object[]` | Model pricing | - | [`userPluginMarketplacesEnabled`](/docs/third-party/claude-desktop/configuration#userpluginmarketplacesenabled) | `boolean` | Allow user-added plugin marketplaces | - | [`userPluginUploadsEnabled`](/docs/third-party/claude-desktop/configuration#userpluginuploadsenabled) | `boolean` | Allow user-added plugins | - | [`mcpToolTimeoutSec`](/docs/third-party/claude-desktop/configuration#mcptooltimeoutsec) | `integer` | MCP tool call timeout | - | [`skipWebFetchPreflight`](/docs/third-party/claude-desktop/configuration#skipwebfetchpreflight) | `boolean` | Skip WebFetch domain check | - | [`organizationInstructions`](/docs/third-party/claude-desktop/configuration#organizationinstructions) | `string` | Organization instructions | -
- - **JSON (e.g. for non-MDM users or Bootstrap):** - - ```json theme={null} - { - "models": { - "pricing": { - "enabled": "", - "multiplier": "", - "models": [ - { - "name": "", - "inputPerMtok": "", - "outputPerMtok": "", - "cacheReadPerMtok": "", - "cacheWritePerMtok": "" - } - ] - } - }, - "plugins": { - "userPluginMarketplacesEnabled": "", - "userPluginUploadsEnabled": "" - }, - "mcp": { - "toolTimeoutSec": "" - }, - "workspace": { - "skipWebFetchPreflight": "", - "organizationInstructions": "" - } +} +``` + +**Changed:** + +* **Breaking:** `relaunchEnforcementHours` moved in the nested served format from `bootstrap.relaunchEnforcementHours` to `lifecycle.relaunchEnforcementHours` (beside the new `lifecycle.configRecheckIntervalMinutes`). This release no longer reads the old path and earlier releases do not read the new one, so move the value under `lifecycle`; the MDM / flat key name `relaunchEnforcementHours` is unchanged. The key can now also be set from device management (availability MDM and served), and the default when no tier sets it is 24 hours (was 1). + +**v1.44121.4** + +No configuration changes in this release. + +**v1.44121.2** + +No configuration changes in this release. + +**v1.44121.1** + +| MDM key | Type | Description | +| - | - | - | +| [`inferenceStreamIdleTimeoutSec`](/docs/third-party/claude-desktop/configuration#inferencestreamidletimeoutsec) | `integer` | Stream idle timeout | +| [`egressProxyUrl`](/docs/third-party/claude-desktop/configuration#egressproxyurl) | `string` | Proxy server URL | +| [`egressProxyPacUrl`](/docs/third-party/claude-desktop/configuration#egressproxypacurl) | `string` | Proxy auto-config (PAC) URL | +| [`claudeAiImport.automatic3pImport`](/docs/third-party/claude-desktop/configuration#claudeaiimport) | `boolean` | New subfield (beta): when `true` and `deploymentOrganizationUuid` is set, the app copies this computer's earlier third-party sessions stored before an organization ID was configured into that organization's session store, once per device and in the background; independent of `enabled` (default `false`). | + +**JSON (e.g. for non-MDM users or Bootstrap):** + +```json theme={null} +{ + "inference": { + "streamIdleTimeoutSec": "" + }, + "workspace": { + "egressProxyUrl": "", + "egressProxyPacUrl": "" + }, + "claudeAiImport": { + "automatic3pImport": "" } - ``` +} +``` - **Changed:** +`egressProxyUrl` and `egressProxyPacUrl` are read from device management or a local configuration file only; a value served by a bootstrap URL is not applied. - * `builtinToolPolicy` accepts argument-scoped Claude Code permission rules such as `Bash(curl *)` or `Edit(**/*.env)` as keys, in addition to bare tool names; `WebSearch` and `WebFetch` take the bare name only, and a key that is not a usable rule is dropped with a configuration error. Deploy argument-scoped entries once your whole fleet is on this release: an older build drops an argument-scoped `ask` entry as an unknown tool, so that tool runs without a prompt. - +**Changed:** - - No configuration changes in this release. - +* **Breaking:** `inferenceModelPricingMultiplier` and `inferenceModelPricing` no longer turn on the Usage page's cost estimate by themselves; they apply only while `inferenceModelPricingEnabled` is `true` and are ignored otherwise. A configuration that sets either without `inferenceModelPricingEnabled: true` now shows token counts only; add that key to keep the estimate. - - No configuration changes in this release. - +**v1.40609.1** - -
- | MDM key | Type | Description | - | - | - | - | - | [`bootstrapHeaders`](/docs/third-party/claude-desktop/configuration#bootstrapheaders) | `object` | Bootstrap request headers | - | [`bootstrapHeadersHelper`](/docs/third-party/claude-desktop/configuration#bootstrapheadershelper) | `string` | Bootstrap headers helper script | -
+No configuration changes in this release. - **JSON (e.g. for non-MDM users or Bootstrap):** +**v1.40609.0** - ```json theme={null} - { - "bootstrap": { - "headers": "", - "headersHelper": "" - } +| MDM key | Type | Description | +| - | - | - | +| [`sshHostAllowlist`](/docs/third-party/claude-desktop/configuration#sshhostallowlist) · Beta | `string[]` | SSH host allowlist | +| [`disableConfigDeprecationWarnings`](/docs/third-party/claude-desktop/configuration#disableconfigdeprecationwarnings) | `boolean` | Hide configuration deprecation warnings | + +**JSON (e.g. for non-MDM users or Bootstrap):** + +```json theme={null} +{ + "codeSurface": { + "sshHostAllowlist": [""] + }, + "bootstrap": { + "relaunchEnforcementHours": "" + }, + "appearance": { + "disableConfigDeprecationWarnings": "" } - ``` +} +``` - **Changed:** +`relaunchEnforcementHours` is read from served configuration only (a bootstrap URL); a value in a local configuration file or in device management is ignored with a warning. - * `managedMcpServers[].oauth` accepts a new `mode` value, `hosted`: the app signs in to that MCP server with an Anthropic-hosted client identity (Anthropic vouches for the client on each token request) instead of a client you register yourself, pinned to the exact issuer URL(s) you list in `authorizationServer`; it requires the Claude.ai sign-in and is available once the hosted signer is enabled for your organization. - +**Changed:** - - No configuration changes in this release. - +* `inferenceVertexProjectId` and `inferenceVertexWorkforceUserProject` now require the user's consent when delivered by a bootstrap URL the user configured themselves (`consentRequired`); a bootstrap URL set by device management, or covered by `trustBootstrapDelivery: true`, never prompts. Both keys must match the Google Cloud project format (`^[a-z0-9][a-z0-9.:-]*$`). +* `inferenceCredentialKind` accepts `interactive` for Vertex AI (Google sign-in); the Vertex `oauth` value is deprecated (below). +* `orgPluginSettings` is published as an array of `{ "serverName", "tools": [{ "toolName", "permission" }] }` entries; the `{ "mcpServers": {…} }` record form is deprecated (below). +* The published bootstrap JSON schema now rejects `authorityHost` on the Microsoft 365 entry, so a configuration that still uses it fails schema validation in tools that check against the schema; the app itself keeps mapping it to `azureCloud` until October 7, 2026. +* `allowedPluginMarketplaces` is no longer marked Beta. - -
- | MDM key | Type | Description | - | - | - | - | - | [`claudeAiImport.exportEnabled`](/docs/third-party/claude-desktop/configuration#claudeaiimport) | `boolean` | New subfield: lets users export this computer's chats, Cowork tasks, and Code sessions from Settings > Import & export as a zip that another install can import; no effect unless `enabled` is `true` (default `false`). | - | [`allowedPluginMarketplaces[].manifestSha256`](/docs/third-party/claude-desktop/configuration#allowedpluginmarketplaces) | `string` | New subfield (beta): SHA-256 of the exact hosted `marketplace.json` a `url` marketplace may serve; required when `installationPreference` is `auto_install` or `required`, and a served manifest with any other digest is refused. | -
+**Deprecated** (each accepted until October 7, 2026, 12:00 PM Pacific Time; users see an in-app warning from September 10, 2026, which `disableConfigDeprecationWarnings` hides, and a final reminder in the 24 hours before the cut-off, which it does not): - **JSON (e.g. for non-MDM users or Bootstrap):** +* `inferenceGatewayHeaders`: use `inferenceCustomHeaders` instead. After the cut-off no custom inference headers are sent. +* `inferenceCustomHeaders`, `otlpHeaders`, `otlpResourceAttributes` and `bootstrapHeaders` written as a `"Name=value,…"` string or a `["Name: value", …]` list: use a JSON object such as `{"Name": "value"}` instead. After the cut-off a string or list value is rejected as malformed and no headers (or resource attributes) are sent. +* `inferenceGatewayAuthScheme: "sso"`: use `inferenceCredentialKind: "interactive"` instead. After the cut-off the value is reported as invalid and, unless another credential field says how to sign in, the gateway connection has no credential and inference does not start. +* `inferenceGatewayAuthScheme: "auto"`: use `"bearer"` instead, or remove the key (`bearer` is the default). After the cut-off the value is reported as invalid and the default applies. +* `inferenceCredentialKind: "oauth"` (Vertex AI): use `"interactive"` instead. After the cut-off `oauth` is reported as invalid and the kind is derived from the credential fields present. +* `inferenceCredentialKind: "interactive"` together with `inferenceVertexWorkforceAudience` (Vertex AI): use `"workforce"` instead, or remove the audience if Google sign-in is meant. After the cut-off the audience no longer implies Workforce Identity; `interactive` then needs `inferenceVertexOAuthClientId` or inference does not start. +* `isDxtEnabled` and `isDxtSignatureRequired`: use `isDesktopExtensionEnabled` and `isDesktopExtensionSignatureRequired` instead. After the cut-off the old names are unreadable: extensions are disabled, or only signed extensions load, until the name is updated. +* `trustBootstrapLocalExec`: use `trustBootstrapDelivery` instead. After the cut-off the key reads `false` and each user is asked to consent to bootstrap-delivered values. +* `enduserAttribution`: use `endUserAttribution` instead. After the cut-off the key reads `false` and end-user attribution stays off. +* `orgPluginSettings` as a `{ "mcpServers": {…} }` record: use the array form instead (read by desktop 1.15200.0 and later; older desktops ignore the array and enforce no tool locks). After the cut-off the record is rejected and every plugin-delivered MCP tool is blocked until the value is rewritten. +* `ask-session` in `builtinToolPolicy`, `orgPluginSettings[].tools[].permission` and `managedMcpServers[].toolPolicy`: use `ask` instead. After the cut-off it is treated as an unrecognized value: `ask` for a built-in tool, `blocked` for a plugin-delivered tool, and an invalid entry for a managed server. +* In `managedMcpServers` entries: replace `scopes` with `scope` (one space-separated string); remove `transport: "builtin"` and `source`; replace `authorityHost` with `azureCloud: "us-gov-high"` for a GCC High tenant; write `oauth` as `true` or an oauth object rather than a number or string; replace `oauth.scopes` (or `oauth.scope` as a list) with `oauth.scope` as one string; add `transport: "http"` (or `"sse"` / `"stdio"`) to an entry with no `transport` that is not a built-in server (a built-in Microsoft 365 or GitHub entry takes no `transport`). After the cut-off such an entry is rejected and that connector is unavailable until it is rewritten (`source` is ignored by the desktop but refused by a customer-run Apps Gateway). - ```json theme={null} - { - "claudeAiImport": { - "exportEnabled": "" - }, - "plugins": { - "marketplaces": [ +**v1.37937.3** + +No configuration changes in this release. + +**v1.37937.2** + +No configuration changes in this release. + +**v1.37937.1** + +No configuration changes in this release. + +**v1.37937.0** + +| MDM key | Type | Description | +| - | - | - | +| [`inferenceModelPricingEnabled`](/docs/third-party/claude-desktop/configuration#inferencemodelpricingenabled) | `boolean` | Show estimated cost | +| [`inferenceModelPricingMultiplier`](/docs/third-party/claude-desktop/configuration#inferencemodelpricingmultiplier) | `number` | Price multiplier | +| [`inferenceModelPricing`](/docs/third-party/claude-desktop/configuration#inferencemodelpricing) | `object[]` | Model pricing | +| [`userPluginMarketplacesEnabled`](/docs/third-party/claude-desktop/configuration#userpluginmarketplacesenabled) | `boolean` | Allow user-added plugin marketplaces | +| [`userPluginUploadsEnabled`](/docs/third-party/claude-desktop/configuration#userpluginuploadsenabled) | `boolean` | Allow user-added plugins | +| [`mcpToolTimeoutSec`](/docs/third-party/claude-desktop/configuration#mcptooltimeoutsec) | `integer` | MCP tool call timeout | +| [`skipWebFetchPreflight`](/docs/third-party/claude-desktop/configuration#skipwebfetchpreflight) | `boolean` | Skip WebFetch domain check | +| [`organizationInstructions`](/docs/third-party/claude-desktop/configuration#organizationinstructions) | `string` | Organization instructions | + +**JSON (e.g. for non-MDM users or Bootstrap):** + +```json theme={null} +{ + "models": { + "pricing": { + "enabled": "", + "multiplier": "", + "models": [ { - "source": "url", - "url": "", - "manifestSha256": "", - "credentialKind": "" + "name": "", + "inputPerMtok": "", + "outputPerMtok": "", + "cacheReadPerMtok": "", + "cacheWritePerMtok": "" } ] } + }, + "plugins": { + "userPluginMarketplacesEnabled": "", + "userPluginUploadsEnabled": "" + }, + "mcp": { + "toolTimeoutSec": "" + }, + "workspace": { + "skipWebFetchPreflight": "", + "organizationInstructions": "" } - ``` - - **Changed:** - - * **Breaking:** Managed-config URL settings now reject values that embed credentials (`https://user:password@host…`). Configurations that relied on this fail to load until the credentials are removed; use `bootstrapHeaders` / `bootstrapHeadersHelper` (available from 1.32885.1) to send authentication instead. - * `allowedPluginMarketplaces[].source` (beta) accepts a new `url` value: a hosted `marketplace.json` whose plugins are zip archives, fetched over HTTPS with no git on the device; set `url` to the manifest address (`repo`, `ref`, and `path` do not apply). - * `allowedPluginMarketplaces[].credentialKind` (beta) accepts a new `inferenceCredential` value, for `url` marketplaces on the inference gateway's own origin: fetches carry the same bearer credential the app already sends the gateway for inference. - - - - No configuration changes in this release. - - - -
- | MDM key | Type | Description | - | - | - | - | - | [`otlpAuthMode`](/docs/third-party/claude-desktop/configuration#otlpauthmode) | `enum` | Collector authentication | - | [`otlpHeadersHelper`](/docs/third-party/claude-desktop/configuration#otlpheadershelper) | `string` | OpenTelemetry headers helper script | - | [`inferenceGatewayOidc.resource`](/docs/third-party/claude-desktop/configuration#inferencegatewayoidc) | `string` | New subfield: RFC 8707 resource indicator sent on gateway sign-in and token refresh so the IdP audience-restricts the access token to the gateway; leave unset for Microsoft Entra ID. | -
- - **JSON (e.g. for non-MDM users or Bootstrap):** - - ```json theme={null} - { - "otlp": { - "authMode": "", - "headersHelper": "" - }, - "inference": { - "credential": { - "oidc": { - "resource": "" - } +} +``` + +**Changed:** + +* `builtinToolPolicy` accepts argument-scoped Claude Code permission rules such as `Bash(curl *)` or `Edit(**/*.env)` as keys, in addition to bare tool names; `WebSearch` and `WebFetch` take the bare name only, and a key that is not a usable rule is dropped with a configuration error. Deploy argument-scoped entries once your whole fleet is on this release: an older build drops an argument-scoped `ask` entry as an unknown tool, so that tool runs without a prompt. + +**v1.34493.1** + +No configuration changes in this release. + +**v1.34493.0** + +No configuration changes in this release. + +**v1.32885.1** + +| MDM key | Type | Description | +| - | - | - | +| [`bootstrapHeaders`](/docs/third-party/claude-desktop/configuration#bootstrapheaders) | `object` | Bootstrap request headers | +| [`bootstrapHeadersHelper`](/docs/third-party/claude-desktop/configuration#bootstrapheadershelper) | `string` | Bootstrap headers helper script | + +**JSON (e.g. for non-MDM users or Bootstrap):** + +```json theme={null} +{ + "bootstrap": { + "headers": "", + "headersHelper": "" + } +} +``` + +**Changed:** + +* `managedMcpServers[].oauth` accepts a new `mode` value, `hosted`: the app signs in to that MCP server with an Anthropic-hosted client identity (Anthropic vouches for the client on each token request) instead of a client you register yourself, pinned to the exact issuer URL(s) you list in `authorizationServer`; it requires the Claude.ai sign-in and is available once the hosted signer is enabled for your organization. + +**v1.32352.1** + +No configuration changes in this release. + +**v1.32352.0** + +| MDM key | Type | Description | +| - | - | - | +| [`claudeAiImport.exportEnabled`](/docs/third-party/claude-desktop/configuration#claudeaiimport) | `boolean` | New subfield: lets users export this computer's chats, Cowork tasks, and Code sessions from Settings > Import & export as a zip that another install can import; no effect unless `enabled` is `true` (default `false`). | +| [`allowedPluginMarketplaces[].manifestSha256`](/docs/third-party/claude-desktop/configuration#allowedpluginmarketplaces) | `string` | New subfield (beta): SHA-256 of the exact hosted `marketplace.json` a `url` marketplace may serve; required when `installationPreference` is `auto_install` or `required`, and a served manifest with any other digest is refused. | + +**JSON (e.g. for non-MDM users or Bootstrap):** + +```json theme={null} +{ + "claudeAiImport": { + "exportEnabled": "" + }, + "plugins": { + "marketplaces": [ + { + "source": "url", + "url": "", + "manifestSha256": "", + "credentialKind": "" } - } + ] } - ``` +} +``` - **Changed:** +**Changed:** - * `inferenceBedrockBaseUrl` and `inferenceVertexBaseUrl`: only affects users who entered the bootstrap server URL themselves (in Settings or a local config file). Those users are now asked once to allow a Bedrock or Vertex endpoint that server delivers (and again if it changes) before it takes effect, the same `trustBootstrapDelivery` consent prompt `inferenceGatewayBaseUrl` already shows; the provider's default endpoint is used until they allow it. Managed deployments (bootstrap URL set by device management, or `trustBootstrapDelivery: true`) see no change. - +* **Breaking:** Managed-config URL settings now reject values that embed credentials (`https://user:password@host…`). Configurations that relied on this fail to load until the credentials are removed; use `bootstrapHeaders` / `bootstrapHeadersHelper` (available from 1.32885.1) to send authentication instead. +* `allowedPluginMarketplaces[].source` (beta) accepts a new `url` value: a hosted `marketplace.json` whose plugins are zip archives, fetched over HTTPS with no git on the device; set `url` to the manifest address (`repo`, `ref`, and `path` do not apply). +* `allowedPluginMarketplaces[].credentialKind` (beta) accepts a new `inferenceCredential` value, for `url` marketplaces on the inference gateway's own origin: fetches carry the same bearer credential the app already sends the gateway for inference. - -
- | MDM key | Type | Description | - | - | - | - | - | [`modelPrefer1mContext`](/docs/third-party/claude-desktop/configuration#modelprefer1mcontext) | `boolean` | Default to 1M context | - | [`claudeAiImport.enabled`](/docs/third-party/claude-desktop/configuration#claudeaiimport) | `boolean` | New subfield: turns history import on; the banner and import actions stay off until set to `true` (default `false`). | - | [`claudeAiImport.bannerBehavior`](/docs/third-party/claude-desktop/configuration#claudeaiimport) | `enum` | New subfield: when the import banner appears: `off` (default), `detect`, or `show`. | -
+**v1.30096.5** - **JSON (e.g. for non-MDM users or Bootstrap):** +No configuration changes in this release. - ```json theme={null} - { - "models": { - "prefer1mContext": "" - }, - "claudeAiImport": { - "enabled": "", - "bannerBehavior": "" +**v1.30096.1** + +| MDM key | Type | Description | +| - | - | - | +| [`otlpAuthMode`](/docs/third-party/claude-desktop/configuration#otlpauthmode) | `enum` | Collector authentication | +| [`otlpHeadersHelper`](/docs/third-party/claude-desktop/configuration#otlpheadershelper) | `string` | OpenTelemetry headers helper script | +| [`inferenceGatewayOidc.resource`](/docs/third-party/claude-desktop/configuration#inferencegatewayoidc) | `string` | New subfield: RFC 8707 resource indicator sent on gateway sign-in and token refresh so the IdP audience-restricts the access token to the gateway; leave unset for Microsoft Entra ID. | + +**JSON (e.g. for non-MDM users or Bootstrap):** + +```json theme={null} +{ + "otlp": { + "authMode": "", + "headersHelper": "" + }, + "inference": { + "credential": { + "oidc": { + "resource": "" + } } } - ``` +} +``` - **Changed:** +**Changed:** - * `inferenceGatewayBaseUrl` delivered by a bootstrap server now goes through the `trustBootstrapDelivery` consent prompt: unless the bootstrap URL came from device management or `trustBootstrapDelivery` is `true`, each user is asked once to allow the address, and again if it changes, before it takes effect. - +* `inferenceBedrockBaseUrl` and `inferenceVertexBaseUrl`: only affects users who entered the bootstrap server URL themselves (in Settings or a local config file). Those users are now asked once to allow a Bedrock or Vertex endpoint that server delivers (and again if it changes) before it takes effect, the same `trustBootstrapDelivery` consent prompt `inferenceGatewayBaseUrl` already shows; the provider's default endpoint is used until they allow it. Managed deployments (bootstrap URL set by device management, or `trustBootstrapDelivery: true`) see no change. - -
- | MDM key | Type | Description | - | - | - | - | - | [`updateViaUpdatesHost`](/docs/third-party/claude-desktop/configuration#updateviaupdateshost) | `boolean` | Check for updates on releases.claude.com | - | [`allowedWorkspaceFolders[].mode`](/docs/third-party/claude-desktop/configuration#allowedworkspacefolders) | `enum` | New subfield: `ro` makes the folder read-only in Cowork; Code enforces file tools only. | -
+**v1.28929.0** - **JSON (e.g. for non-MDM users or Bootstrap):** +| MDM key | Type | Description | +| - | - | - | +| [`modelPrefer1mContext`](/docs/third-party/claude-desktop/configuration#modelprefer1mcontext) | `boolean` | Default to 1M context | +| [`claudeAiImport.enabled`](/docs/third-party/claude-desktop/configuration#claudeaiimport) | `boolean` | New subfield: turns history import on; the banner and import actions stay off until set to `true` (default `false`). | +| [`claudeAiImport.bannerBehavior`](/docs/third-party/claude-desktop/configuration#claudeaiimport) | `enum` | New subfield: when the import banner appears: `off` (default), `detect`, or `show`. | - ```json theme={null} - { - "autoUpdate": { - "viaUpdatesHost": "" - } +**JSON (e.g. for non-MDM users or Bootstrap):** + +```json theme={null} +{ + "models": { + "prefer1mContext": "" + }, + "claudeAiImport": { + "enabled": "", + "bannerBehavior": "" } - ``` - - `trustBootstrapLocalExec` was renamed to `trustBootstrapDelivery`; the previous name is still accepted. - - - -
- | MDM key | Type | Description | - | - | - | - | - | [`inferenceGatewayOidcAuthFlow`](/docs/third-party/claude-desktop/configuration#inferencegatewayoidcauthflow) | `enum` | Gateway sign-in flow | - | [`inferenceVertexWorkforceAuthFlow`](/docs/third-party/claude-desktop/configuration#inferencevertexworkforceauthflow) | `enum` | Workforce Identity sign-in flow | - | [`trustBootstrapLocalExec`](/docs/third-party/claude-desktop/configuration#trustbootstrapdelivery) | `boolean` | Trust bootstrap-delivered local commands | - | [`skillCreationEnabled`](/docs/third-party/claude-desktop/configuration#skillcreationenabled) | `boolean` | Allow user-created skills | -
- - **JSON (e.g. for non-MDM users or Bootstrap):** - - ```json theme={null} - { - "inference": { - "credential": { - "authFlow": "" - } - }, - "bootstrap": { - "trustBootstrapLocalExec": "" - }, - "workspace": { - "skillCreationEnabled": "" - } +} +``` + +**Changed:** + +* `inferenceGatewayBaseUrl` delivered by a bootstrap server now goes through the `trustBootstrapDelivery` consent prompt: unless the bootstrap URL came from device management or `trustBootstrapDelivery` is `true`, each user is asked once to allow the address, and again if it changes, before it takes effect. + +**v1.26832.0** + +| MDM key | Type | Description | +| - | - | - | +| [`updateViaUpdatesHost`](/docs/third-party/claude-desktop/configuration#updateviaupdateshost) | `boolean` | Check for updates on releases.claude.com | +| [`allowedWorkspaceFolders[].mode`](/docs/third-party/claude-desktop/configuration#allowedworkspacefolders) | `enum` | New subfield: `ro` makes the folder read-only in Cowork; Code enforces file tools only. | + +**JSON (e.g. for non-MDM users or Bootstrap):** + +```json theme={null} +{ + "autoUpdate": { + "viaUpdatesHost": "" } - ``` - - **Changed:** - - * `claudeAiImport`, `deploymentDisplayName`, and `deploymentDisplaySubtitle` now accept values from MDM and a local configuration file as well as a bootstrap server, and `disableDeepLinkRegistration`, `microsoftAuthBroker`, `userContentRendererUrl`, `inferenceFoundryTenantId`, `inferenceFoundryClientId`, `inferenceCredentialHelper` (with its TTL, timeout, and silent-refresh keys), `inferenceBedrockProfile`, `inferenceBedrockAwsDir`, `inferenceBedrockAwsCliPath`, and `inferenceVertexCredentialsFile` can now be delivered by a bootstrap server. The keys that name a local executable go through the `trustBootstrapLocalExec` consent prompt. - * `managedMcpServers` gains a built-in `github` server: set `server` to `github` and supply your own GitHub OAuth app client ID with the device flow enabled. The new `host`, `toolsets`, and `readOnly` subfields point the connector at a GitHub Enterprise Server instance, choose which toolsets load, and offer read tools only. - * `managedMcpServers[].oauth.authFlow` is a new subfield that lets a managed connector sign in through the operating system's Microsoft Entra account broker on Windows and macOS, so Conditional Access policies that require a managed device no longer block it. Devices without a broker keep using browser sign-in. - * `enduserAttribution` is renamed to the corrected spelling `endUserAttribution`. The previous spelling is still accepted and now records a configuration warning. - * `organizationPluginsUrl` is deprecated and removed from the configuration reference. The key is still honored, but organization plugins are better configured with `allowedPluginMarketplaces`. - - - - No configuration changes in this release. - - - -
- | MDM key | Type | Description | - | - | - | - | - | [`mcpPersistentAlwaysAllowEnabled`](/docs/third-party/claude-desktop/configuration#mcppersistentalwaysallowenabled) | `boolean` | Allow persistent tool approvals | -
- - **JSON (e.g. for non-MDM users or Bootstrap):** - - ```json theme={null} - { - "mcp": { - "persistentAlwaysAllowEnabled": "" +} +``` + +`trustBootstrapLocalExec` was renamed to `trustBootstrapDelivery`; the previous name is still accepted. + +**v1.25927.0** + +| MDM key | Type | Description | +| - | - | - | +| [`inferenceGatewayOidcAuthFlow`](/docs/third-party/claude-desktop/configuration#inferencegatewayoidcauthflow) | `enum` | Gateway sign-in flow | +| [`inferenceVertexWorkforceAuthFlow`](/docs/third-party/claude-desktop/configuration#inferencevertexworkforceauthflow) | `enum` | Workforce Identity sign-in flow | +| [`trustBootstrapLocalExec`](/docs/third-party/claude-desktop/configuration#trustbootstrapdelivery) | `boolean` | Trust bootstrap-delivered local commands | +| [`skillCreationEnabled`](/docs/third-party/claude-desktop/configuration#skillcreationenabled) | `boolean` | Allow user-created skills | + +**JSON (e.g. for non-MDM users or Bootstrap):** + +```json theme={null} +{ + "inference": { + "credential": { + "authFlow": "" } + }, + "bootstrap": { + "trustBootstrapLocalExec": "" + }, + "workspace": { + "skillCreationEnabled": "" } - ``` - - - -
- | MDM key | Type | Description | - | - | - | - | - | [`enduserAttribution`](/docs/third-party/claude-desktop/configuration#enduserattribution) | `boolean` | End-user attribution | - | [`userContentRendererUrl`](/docs/third-party/claude-desktop/configuration#usercontentrendererurl) | `string` | Artifact preview iframe origin | -
- - **JSON (e.g. for non-MDM users or Bootstrap):** - - ```json theme={null} - { - "deploymentDisplayName": "", - "deploymentDisplaySubtitle": "", - "enduserAttribution": "", - "userContentRendererUrl": "" +} +``` + +**Changed:** + +* `claudeAiImport`, `deploymentDisplayName`, and `deploymentDisplaySubtitle` now accept values from MDM and a local configuration file as well as a bootstrap server, and `disableDeepLinkRegistration`, `microsoftAuthBroker`, `userContentRendererUrl`, `inferenceFoundryTenantId`, `inferenceFoundryClientId`, `inferenceCredentialHelper` (with its TTL, timeout, and silent-refresh keys), `inferenceBedrockProfile`, `inferenceBedrockAwsDir`, `inferenceBedrockAwsCliPath`, and `inferenceVertexCredentialsFile` can now be delivered by a bootstrap server. The keys that name a local executable go through the `trustBootstrapLocalExec` consent prompt. +* `managedMcpServers` gains a built-in `github` server: set `server` to `github` and supply your own GitHub OAuth app client ID with the device flow enabled. The new `host`, `toolsets`, and `readOnly` subfields point the connector at a GitHub Enterprise Server instance, choose which toolsets load, and offer read tools only. +* `managedMcpServers[].oauth.authFlow` is a new subfield that lets a managed connector sign in through the operating system's Microsoft Entra account broker on Windows and macOS, so Conditional Access policies that require a managed device no longer block it. Devices without a broker keep using browser sign-in. +* `enduserAttribution` is renamed to the corrected spelling `endUserAttribution`. The previous spelling is still accepted and now records a configuration warning. +* `organizationPluginsUrl` is deprecated and removed from the configuration reference. The key is still honored, but organization plugins are better configured with `allowedPluginMarketplaces`. + +**v1.24012.11** + +No configuration changes in this release. + +**v1.24012.9** + +| MDM key | Type | Description | +| - | - | - | +| [`mcpPersistentAlwaysAllowEnabled`](/docs/third-party/claude-desktop/configuration#mcppersistentalwaysallowenabled) | `boolean` | Allow persistent tool approvals | + +**JSON (e.g. for non-MDM users or Bootstrap):** + +```json theme={null} +{ + "mcp": { + "persistentAlwaysAllowEnabled": "" } - ``` - - - - No configuration changes in this release. - - - -
- | MDM key | Type | Description | - | - | - | - | - | [`otlpTracesEnabled`](/docs/third-party/claude-desktop/configuration#otlptracesenabled) | `boolean` | Export traces (beta) | -
- - **JSON (e.g. for non-MDM users or Bootstrap):** - - ```json theme={null} - { - "otlp": { - "tracesEnabled": "" - } +} +``` + +**v1.24012.0** + +| MDM key | Type | Description | +| - | - | - | +| [`enduserAttribution`](/docs/third-party/claude-desktop/configuration#enduserattribution) | `boolean` | End-user attribution | +| [`userContentRendererUrl`](/docs/third-party/claude-desktop/configuration#usercontentrendererurl) | `string` | Artifact preview iframe origin | + +**JSON (e.g. for non-MDM users or Bootstrap):** + +```json theme={null} +{ + "deploymentDisplayName": "", + "deploymentDisplaySubtitle": "", + "enduserAttribution": "", + "userContentRendererUrl": "" +} +``` + +**v1.22209.3** + +No configuration changes in this release. + +**v1.22209.0** + +| MDM key | Type | Description | +| - | - | - | +| [`otlpTracesEnabled`](/docs/third-party/claude-desktop/configuration#otlptracesenabled) | `boolean` | Export traces (beta) | + +**JSON (e.g. for non-MDM users or Bootstrap):** + +```json theme={null} +{ + "otlp": { + "tracesEnabled": "" } - ``` - - - - No configuration changes in this release. - - - -
- | MDM key | Type | Description | - | - | - | - | - | [`disableFeatureDiscovery`](/docs/third-party/claude-desktop/configuration#disablefeaturediscovery) | `boolean` | Hide feature announcements | - | [`inferenceModels[].prefer1m`](/docs/third-party/claude-desktop/configuration#inferencemodels) | `boolean` | New subfield: make the 1M-context variant the default picker selection when this model is the default entry. | - | [`managedMcpServers[].envHelper`](/docs/third-party/claude-desktop/configuration#managedmcpservers) | `string` | New subfield: helper executable that prints environment variables as JSON for a managed stdio server. | - | [`managedMcpServers[].envHelperTtlSec`](/docs/third-party/claude-desktop/configuration#managedmcpservers) | `integer` | New subfield: maximum age in seconds of a cached `envHelper` result (default 300). | - | [`managedMcpServers[].headersHelperRefreshBufferSec`](/docs/third-party/claude-desktop/configuration#managedmcpservers) | `integer` | New subfield: how many seconds before credential expiry the `headersHelper` re-runs (default 60). | - | [`toolSearchEnabled`](/docs/third-party/claude-desktop/configuration#toolsearchenabled) | `boolean` | Enable tool search | -
- - **JSON (e.g. for non-MDM users or Bootstrap):** - - ```json theme={null} - { - "featureDiscovery": { - "disabled": "" - }, - "workspace": { - "toolSearchEnabled": "" - } +} +``` + +**v1.21459.3** + +No configuration changes in this release. + +**v1.21459.0** + +| MDM key | Type | Description | +| - | - | - | +| [`disableFeatureDiscovery`](/docs/third-party/claude-desktop/configuration#disablefeaturediscovery) | `boolean` | Hide feature announcements | +| [`inferenceModels[].prefer1m`](/docs/third-party/claude-desktop/configuration#inferencemodels) | `boolean` | New subfield: make the 1M-context variant the default picker selection when this model is the default entry. | +| [`managedMcpServers[].envHelper`](/docs/third-party/claude-desktop/configuration#managedmcpservers) | `string` | New subfield: helper executable that prints environment variables as JSON for a managed stdio server. | +| [`managedMcpServers[].envHelperTtlSec`](/docs/third-party/claude-desktop/configuration#managedmcpservers) | `integer` | New subfield: maximum age in seconds of a cached `envHelper` result (default 300). | +| [`managedMcpServers[].headersHelperRefreshBufferSec`](/docs/third-party/claude-desktop/configuration#managedmcpservers) | `integer` | New subfield: how many seconds before credential expiry the `headersHelper` re-runs (default 60). | +| [`toolSearchEnabled`](/docs/third-party/claude-desktop/configuration#toolsearchenabled) | `boolean` | Enable tool search | + +**JSON (e.g. for non-MDM users or Bootstrap):** + +```json theme={null} +{ + "featureDiscovery": { + "disabled": "" + }, + "workspace": { + "toolSearchEnabled": "" } - ``` - - **Changed:** - - * `chatTabEnabled` and `chatAdvancedFileAnalysisEnabled` are no longer Beta: the Chat tab and advanced file analysis are generally available. Availability and defaults are unchanged, and both remain opt-in. - * `orgPluginSettings[].tools.permission` accepts a new `ask-session` value. In this release the value is accepted but behaves as `ask` (a prompt on every use); the once-per-session approval flow is not yet enabled. - - - - No configuration changes in this release. - - - - No configuration changes in this release. - - - -
- | MDM key | Type | Description | - | - | - | - | - | [`inferenceFoundryAuthFlow`](/docs/third-party/claude-desktop/configuration#inferencefoundryauthflow) | `enum` | Entra ID sign-in flow | - | [`microsoftAuthBroker`](/docs/third-party/claude-desktop/configuration#microsoftauthbroker) | `enum` | Microsoft 365 native sign-in broker | - | [`managedMcpServers[].startupTimeoutSec`](/docs/third-party/claude-desktop/configuration#managedmcpservers) | `integer` | New subfield: maximum wait in seconds for the server to start and list its tools. | -
- - **JSON (e.g. for non-MDM users or Bootstrap):** - - ```json theme={null} - { - "inference": { - "credential": { - "authFlow": "" - } - }, - "authentication": { - "microsoftAuthBroker": "" +} +``` + +**Changed:** + +* `chatTabEnabled` and `chatAdvancedFileAnalysisEnabled` are no longer Beta: the Chat tab and advanced file analysis are generally available. Availability and defaults are unchanged, and both remain opt-in. +* `orgPluginSettings[].tools.permission` accepts a new `ask-session` value. In this release the value is accepted but behaves as `ask` (a prompt on every use); the once-per-session approval flow is not yet enabled. + +**v1.20186.9** + +No configuration changes in this release. + +**v1.20186.0** + +No configuration changes in this release. + +**v1.19367.0** + +| MDM key | Type | Description | +| - | - | - | +| [`inferenceFoundryAuthFlow`](/docs/third-party/claude-desktop/configuration#inferencefoundryauthflow) | `enum` | Entra ID sign-in flow | +| [`microsoftAuthBroker`](/docs/third-party/claude-desktop/configuration#microsoftauthbroker) | `enum` | Microsoft 365 native sign-in broker | +| [`managedMcpServers[].startupTimeoutSec`](/docs/third-party/claude-desktop/configuration#managedmcpservers) | `integer` | New subfield: maximum wait in seconds for the server to start and list its tools. | + +**JSON (e.g. for non-MDM users or Bootstrap):** + +```json theme={null} +{ + "inference": { + "credential": { + "authFlow": "" } + }, + "authentication": { + "microsoftAuthBroker": "" } - ``` +} +``` - **Changed:** +**Changed:** - * `isDesktopExtensionEnabled` — default changed from `true` to `false`: Desktop Extensions (`.dxt`, `.mcpb`) no longer load unless explicitly enabled. - * `allowedPluginMarketplaces` (beta) — can now be delivered per-user through the bootstrap server; previously MDM-only. - +* `isDesktopExtensionEnabled` — default changed from `true` to `false`: Desktop Extensions (`.dxt`, `.mcpb`) no longer load unless explicitly enabled. +* `allowedPluginMarketplaces` (beta) — can now be delivered per-user through the bootstrap server; previously MDM-only. - - No configuration changes in this release. - +**v1.18286.2** - - **Removed:** +No configuration changes in this release. - * `disableDefaultPlugins` — third-party deployments always skip the default plugin marketplaces and standard deployments always include them, so the key no longer has an effect. - +**v1.18286.0** - - No configuration changes in this release. - +**Removed:** - -
- | MDM key | Type | Description | - | - | - | - | - | [`allowedPluginMarketplaces`](/docs/third-party/claude-desktop/configuration#allowedpluginmarketplaces) | `object[]` | Admin-configured plugin marketplace git URLs appear under the Directory's Organization tab. (MDM-only; not settable via bootstrap JSON.) | - | [`inferenceVertexWorkforceOidc.omitOfflineAccess`](/docs/third-party/claude-desktop/configuration#inferencevertexworkforceoidc) | `boolean` | New subfield: omit `offline_access` from the OIDC scope request. | -
+* `disableDefaultPlugins` — third-party deployments always skip the default plugin marketplaces and standard deployments always include them, so the key no longer has an effect. - **JSON (Non-MDM User, Bootstrap Remote):** +**v1.17377.2** - ```json theme={null} - { - "inference": { - "credential": { - "oidc": { - "omitOfflineAccess": "" - } +No configuration changes in this release. + +**v1.17377.1** + +| MDM key | Type | Description | +| - | - | - | +| [`allowedPluginMarketplaces`](/docs/third-party/claude-desktop/configuration#allowedpluginmarketplaces) | `object[]` | Admin-configured plugin marketplace git URLs appear under the Directory's Organization tab. (MDM-only; not settable via bootstrap JSON.) | +| [`inferenceVertexWorkforceOidc.omitOfflineAccess`](/docs/third-party/claude-desktop/configuration#inferencevertexworkforceoidc) | `boolean` | New subfield: omit `offline_access` from the OIDC scope request. | + +**JSON (Non-MDM User, Bootstrap Remote):** + +```json theme={null} +{ + "inference": { + "credential": { + "oidc": { + "omitOfflineAccess": "" } } } - ``` - - - - No configuration changes in this release. - - - - No configuration changes in this release. - - - -
- | MDM key | Type | Description | - | - | - | - | - | [`otlpContentCapture`](/docs/third-party/claude-desktop/configuration#otlpcontentcapture) | `enum[]` | Content capture categories | - | [`disableBundledSkills`](/docs/third-party/claude-desktop/configuration#disablebundledskills) | `boolean` | Disable bundled skills and workflows | - | [`managedMcpServers[].server`](/docs/third-party/claude-desktop/configuration#managedmcpservers) | `enum` | Gained `"websearch"` — managed web search (Brave, Tavily, Exa or custom) | -
- - **JSON (Non-MDM User, Bootstrap Remote):** - - ```json theme={null} - { - "otlp": { - "contentCapture": [ - "" - ] - }, - "workspace": { - "disableBundledSkills": "" - }, - "mcp": { - "managedServers": [ - { - "name": "Web search", - "server": "websearch", - "provider": "", - "headers": { "": "" }, - "customUrl": "" - } - ] - } +} +``` + +**v1.15962.2** + +No configuration changes in this release. + +**v1.15962.1** + +No configuration changes in this release. + +**v1.15962.0** + +| MDM key | Type | Description | +| - | - | - | +| [`otlpContentCapture`](/docs/third-party/claude-desktop/configuration#otlpcontentcapture) | `enum[]` | Content capture categories | +| [`disableBundledSkills`](/docs/third-party/claude-desktop/configuration#disablebundledskills) | `boolean` | Disable bundled skills and workflows | +| [`managedMcpServers[].server`](/docs/third-party/claude-desktop/configuration#managedmcpservers) | `enum` | Gained `"websearch"` — managed web search (Brave, Tavily, Exa or custom) | + +**JSON (Non-MDM User, Bootstrap Remote):** + +```json theme={null} +{ + "otlp": { + "contentCapture": [ + "" + ] + }, + "workspace": { + "disableBundledSkills": "" + }, + "mcp": { + "managedServers": [ + { + "name": "Web search", + "server": "websearch", + "provider": "", + "headers": { "": "" }, + "customUrl": "" + } + ] } - ``` - - - - No configuration changes in this release. - - - -
- | MDM key | Type | Description | - | - | - | - | - | `chatAdvancedFileAnalysisEnabled` | `boolean` | Advanced file analysis | - | `inferenceSessionLifetimeSec` | `integer` | Sign-in session lifetime | -
- - **JSON (Non-MDM User, Bootstrap Remote):** - - ```json theme={null} - { - "chatSurface": { - "advancedFileAnalysis": "" - }, - "inference": { - "sessionLifetimeSec": "" - } +} +``` + +**v1.15200.0** + +No configuration changes in this release. + +**v1.14271.0** + +| MDM key | Type | Description | +| - | - | - | +| `chatAdvancedFileAnalysisEnabled` | `boolean` | Advanced file analysis | +| `inferenceSessionLifetimeSec` | `integer` | Sign-in session lifetime | + +**JSON (Non-MDM User, Bootstrap Remote):** + +```json theme={null} +{ + "chatSurface": { + "advancedFileAnalysis": "" + }, + "inference": { + "sessionLifetimeSec": "" } - ``` +} +``` - **Deprecated:** +**Deprecated:** - * `betaFeaturesEnabled` — Allow beta features (added and deprecated in this release) - +* `betaFeaturesEnabled` — Allow beta features (added and deprecated in this release) - -
- | MDM key | Type | Description | - | - | - | - | - | `chatTabEnabled` | `boolean` | Allow Chat tab | - | `inferenceBedrockAwsCliPath` | `string` | AWS CLI path | -
+**v1.13576.0** - **JSON (Non-MDM User, Bootstrap Remote):** +| MDM key | Type | Description | +| - | - | - | +| `chatTabEnabled` | `boolean` | Allow Chat tab | +| `inferenceBedrockAwsCliPath` | `string` | AWS CLI path | - ```json theme={null} - { - "chatSurface": { - "enabled": "" - }, - "inference": { - "awsEnv": { - "awsCliPath": "" - } +**JSON (Non-MDM User, Bootstrap Remote):** + +```json theme={null} +{ + "chatSurface": { + "enabled": "" + }, + "inference": { + "awsEnv": { + "awsCliPath": "" } } - ``` - - - -
- | MDM key | Type | Description | - | - | - | - | - | `inferenceVertexOAuthLoginHint` | `string` | Vertex OAuth login hint | -
- - **JSON (Non-MDM User, Bootstrap Remote):** - - ```json theme={null} - { - "inference": { - "credential": { - "loginHint": "" - } +} +``` + +**v1.12603.0** + +| MDM key | Type | Description | +| - | - | - | +| `inferenceVertexOAuthLoginHint` | `string` | Vertex OAuth login hint | + +**JSON (Non-MDM User, Bootstrap Remote):** + +```json theme={null} +{ + "inference": { + "credential": { + "loginHint": "" } } - ``` - - - -
- | MDM key | Type | Description | - | - | - | - | - | `inferenceVertexWorkforceAudience` | `string` | Workforce Identity audience | - | `inferenceVertexWorkforceUserProject` | `string` | Workforce Identity billing project | - | `inferenceVertexWorkforceOidc` | `object` | Workforce Identity IdP (OIDC) | - | `organizationPluginsUrl` | `string` | Organization plugins endpoint | - | `autoModeEnabled` | `boolean` | Allow Auto mode | - | `inferenceCredentialHelperSilentRefreshEnabled` | `boolean` | Re-run helper for silent refresh | - | `bootstrapEnabled` | `boolean` | Use bootstrap config | - | `bootstrapUrl` | `string` | Bootstrap config URL | - | `bootstrapOidc` | `object` | Bootstrap OIDC parameters | -
- - **JSON (Non-MDM User, Bootstrap Remote):** - - ```json theme={null} - { - "inference": { - "credential": { - "audience": "", - "userProject": "", - "oidc": { - "issuer": "", - "authorizationUrl": "", - "tokenUrl": "", - "clientId": "", - "scopes": "", - "redirectPort": "" - }, - "silentRefreshEnabled": "" - } +} +``` + +**v1.10628.0** + +| MDM key | Type | Description | +| - | - | - | +| `inferenceVertexWorkforceAudience` | `string` | Workforce Identity audience | +| `inferenceVertexWorkforceUserProject` | `string` | Workforce Identity billing project | +| `inferenceVertexWorkforceOidc` | `object` | Workforce Identity IdP (OIDC) | +| `organizationPluginsUrl` | `string` | Organization plugins endpoint | +| `autoModeEnabled` | `boolean` | Allow Auto mode | +| `inferenceCredentialHelperSilentRefreshEnabled` | `boolean` | Re-run helper for silent refresh | +| `bootstrapEnabled` | `boolean` | Use bootstrap config | +| `bootstrapUrl` | `string` | Bootstrap config URL | +| `bootstrapOidc` | `object` | Bootstrap OIDC parameters | + +**JSON (Non-MDM User, Bootstrap Remote):** + +```json theme={null} +{ + "inference": { + "credential": { + "audience": "", + "userProject": "", + "oidc": { + "issuer": "", + "authorizationUrl": "", + "tokenUrl": "", + "clientId": "", + "scopes": "", + "redirectPort": "" + }, + "silentRefreshEnabled": "" } } - ``` - - - -
- | MDM key | Type | Description | - | - | - | - | - | `coworkTabEnabled` | `boolean` | Allow Cowork tab | -
- - **JSON (Non-MDM User, Bootstrap Remote):** - - ```json theme={null} - { - "coworkSurface": { - "enabled": "" - } +} +``` + +**v1.9659.0** + +| MDM key | Type | Description | +| - | - | - | +| `coworkTabEnabled` | `boolean` | Allow Cowork tab | + +**JSON (Non-MDM User, Bootstrap Remote):** + +```json theme={null} +{ + "coworkSurface": { + "enabled": "" } - ``` - - - -
- | MDM key | Type | Description | - | - | - | - | - | `otlpDesktopLogLevel` | `enum` | Desktop telemetry export level | - | `inferenceFoundryTenantId` | `string` | Entra ID tenant ID | - | `inferenceFoundryClientId` | `string` | Entra ID client ID | -
- - **JSON (Non-MDM User, Bootstrap Remote):** - - ```json theme={null} - { - "otlp": { - "desktopLogLevel": "" - }, - "inference": { - "credential": { - "tenantId": "", - "clientId": "" - } +} +``` + +**v1.9255.0** + +| MDM key | Type | Description | +| - | - | - | +| `otlpDesktopLogLevel` | `enum` | Desktop telemetry export level | +| `inferenceFoundryTenantId` | `string` | Entra ID tenant ID | +| `inferenceFoundryClientId` | `string` | Entra ID client ID | + +**JSON (Non-MDM User, Bootstrap Remote):** + +```json theme={null} +{ + "otlp": { + "desktopLogLevel": "" + }, + "inference": { + "credential": { + "tenantId": "", + "clientId": "" } } - ``` - - - -
- | MDM key | Type | Description | - | - | - | - | - | `inferenceCredentialKind` | `enum` | Credential kind | -
- - **JSON (Non-MDM User, Bootstrap Remote):** - - ```json theme={null} - { - "inference": { - "credential": { - "kind": "" - } +} +``` + +**v1.8555.0** + +| MDM key | Type | Description | +| - | - | - | +| `inferenceCredentialKind` | `enum` | Credential kind | + +**JSON (Non-MDM User, Bootstrap Remote):** + +```json theme={null} +{ + "inference": { + "credential": { + "kind": "" } } - ``` - - - -
- | MDM key | Type | Description | - | - | - | - | - | `inferenceAnthropicApiKey` | `string` | Claude API key | - | `inferenceCustomHeaders` | `object` | Custom inference headers (renamed from `inferenceGatewayHeaders`) | - | `modelDiscoveryEnabled` | `boolean` | Model discovery | - | `orgPluginSettings` | `object` | Organization plugin settings | - | `builtinToolPolicy` | `object` | Built-in tool policy | - | `inferenceCredentialHelperTimeoutSec` | `integer` | Credential helper timeout | -
- - **JSON (Non-MDM User, Bootstrap Remote):** - - ```json theme={null} - { - "inference": { - "credential": { - "apiKey": "", - "timeoutSec": "" - }, - "customHeaders": "" - } +} +``` + +**v1.8089.0** + +| MDM key | Type | Description | +| - | - | - | +| `inferenceAnthropicApiKey` | `string` | Claude API key | +| `inferenceCustomHeaders` | `object` | Custom inference headers (renamed from `inferenceGatewayHeaders`) | +| `modelDiscoveryEnabled` | `boolean` | Model discovery | +| `orgPluginSettings` | `object` | Organization plugin settings | +| `builtinToolPolicy` | `object` | Built-in tool policy | +| `inferenceCredentialHelperTimeoutSec` | `integer` | Credential helper timeout | + +**JSON (Non-MDM User, Bootstrap Remote):** + +```json theme={null} +{ + "inference": { + "credential": { + "apiKey": "", + "timeoutSec": "" + }, + "customHeaders": "" } - ``` - - - -
- | MDM key | Type | Description | - | - | - | - | - | `banner` | `object` | Organization banner | -
- - - -
- | MDM key | Type | Description | - | - | - | - | - | `disableDeepLinkRegistration` | `boolean` | Disable claude:// deep-link handling | - | `inferenceGatewayOidc` | `object` | Gateway SSO IdP (OIDC) | -
- - **JSON (Non-MDM User, Bootstrap Remote):** - - ```json theme={null} - { - "inference": { - "credential": { - "oidc": { - "issuer": "", - "authorizationUrl": "", - "tokenUrl": "", - "clientId": "", - "scopes": "", - "redirectPort": "", - "bearerTokenType": "", - "appendOfflineAccess": "" - } +} +``` + +**v1.7196.0** + +| MDM key | Type | Description | +| - | - | - | +| `banner` | `object` | Organization banner | + +**v1.6889.0** + +| MDM key | Type | Description | +| - | - | - | +| `disableDeepLinkRegistration` | `boolean` | Disable claude:// deep-link handling | +| `inferenceGatewayOidc` | `object` | Gateway SSO IdP (OIDC) | + +**JSON (Non-MDM User, Bootstrap Remote):** + +```json theme={null} +{ + "inference": { + "credential": { + "oidc": { + "issuer": "", + "authorizationUrl": "", + "tokenUrl": "", + "clientId": "", + "scopes": "", + "redirectPort": "", + "bearerTokenType": "", + "appendOfflineAccess": "" } } } - ``` - - - -
- | MDM key | Type | Description | - | - | - | - | - | `inferenceBedrockSsoStartUrl` | `string` | AWS SSO start URL | - | `inferenceBedrockSsoRegion` | `string` | AWS SSO region | - | `inferenceBedrockSsoAccountId` | `string` | AWS SSO account ID | - | `inferenceBedrockSsoRoleName` | `string` | AWS SSO role name | -
- - **JSON (Non-MDM User, Bootstrap Remote):** - - ```json theme={null} - { - "inference": { - "credential": { - "ssoStartUrl": "", - "ssoRegion": "", - "ssoAccountId": "", - "ssoRoleName": "" - } +} +``` + +**v1.6259.0** + +| MDM key | Type | Description | +| - | - | - | +| `inferenceBedrockSsoStartUrl` | `string` | AWS SSO start URL | +| `inferenceBedrockSsoRegion` | `string` | AWS SSO region | +| `inferenceBedrockSsoAccountId` | `string` | AWS SSO account ID | +| `inferenceBedrockSsoRoleName` | `string` | AWS SSO role name | + +**JSON (Non-MDM User, Bootstrap Remote):** + +```json theme={null} +{ + "inference": { + "credential": { + "ssoStartUrl": "", + "ssoRegion": "", + "ssoAccountId": "", + "ssoRoleName": "" } } - ``` - - - -
- | MDM key | Type | Description | - | - | - | - | - | `otlpResourceAttributes` | `object` | OpenTelemetry resource attributes | -
- - **JSON (Non-MDM User, Bootstrap Remote):** - - ```json theme={null} - { - "otlp": { - "resourceAttributes": "" - } +} +``` + +**v1.5354.0** + +| MDM key | Type | Description | +| - | - | - | +| `otlpResourceAttributes` | `object` | OpenTelemetry resource attributes | + +**JSON (Non-MDM User, Bootstrap Remote):** + +```json theme={null} +{ + "otlp": { + "resourceAttributes": "" } - ``` - - - -
- | MDM key | Type | Description | - | - | - | - | - | `inferenceBedrockServiceTier` | `enum` | Bedrock service tier | -
- - **JSON (Non-MDM User, Bootstrap Remote):** - - ```json theme={null} - { - "inference": { - "serviceTier": "" - } +} +``` + +**v1.5186.0** + +| MDM key | Type | Description | +| - | - | - | +| `inferenceBedrockServiceTier` | `enum` | Bedrock service tier | + +**JSON (Non-MDM User, Bootstrap Remote):** + +```json theme={null} +{ + "inference": { + "serviceTier": "" } - ``` - - - -
- | MDM key | Type | Description | - | - | - | - | - | `disableDeploymentModeChooser` | `boolean` | Disable Claude.ai sign-in | -
- - - -
- | MDM key | Type | Description | - | - | - | - | - | `inferenceGatewayAuthScheme` | `enum` | Gateway auth scheme | -
- - **JSON (Non-MDM User, Bootstrap Remote):** - - ```json theme={null} - { - "inference": { - "credential": { - "authScheme": "" - } +} +``` + +**v1.3834.0** + +| MDM key | Type | Description | +| - | - | - | +| `disableDeploymentModeChooser` | `boolean` | Disable Claude.ai sign-in | + +**v1.3036.0** + +| MDM key | Type | Description | +| - | - | - | +| `inferenceGatewayAuthScheme` | `enum` | Gateway auth scheme | + +**JSON (Non-MDM User, Bootstrap Remote):** + +```json theme={null} +{ + "inference": { + "credential": { + "authScheme": "" } } - ``` - - - -
- | MDM key | Type | Description | - | - | - | - | - | `isDesktopExtensionEnabled` | `boolean` | Allow desktop extensions (renamed from `isDxtEnabled`) | - | `isDesktopExtensionSignatureRequired` | `boolean` | Require signed extensions (renamed from `isDxtSignatureRequired`) | - | `isLocalDevMcpEnabled` | `boolean` | Allow user-added MCP servers | - | `isClaudeCodeForDesktopEnabled` | `boolean` | Allow Claude Code tab | - | `coworkEgressAllowedHosts` | `array` | Allowed egress hosts | - | `otlpEndpoint` | `string` | OpenTelemetry collector endpoint | - | `otlpProtocol` | `enum` | OpenTelemetry exporter protocol | - | `otlpHeaders` | `object` | OpenTelemetry exporter headers | - | `autoUpdaterEnforcementHours` | `integer` | Auto-update enforcement window | - | `disableAutoUpdates` | `boolean` | Block auto-updates | - | `inferenceProvider` | `enum` | Inference provider | - | `inferenceGatewayBaseUrl` | `string` | Gateway base URL | - | `inferenceGatewayApiKey` | `string` | Gateway API key | - | `inferenceVertexProjectId` | `string` | GCP project ID | - | `inferenceVertexRegion` | `string` | GCP region | - | `inferenceVertexCredentialsFile` | `string` | GCP credentials file path | - | `inferenceVertexOAuthClientId` | `string` | Vertex OAuth client ID | - | `inferenceVertexOAuthClientSecret` | `string` | Vertex OAuth client secret | - | `inferenceVertexOAuthScopes` | `string` | Vertex OAuth scopes | - | `inferenceVertexBaseUrl` | `string` | Vertex AI base URL | - | `inferenceBedrockRegion` | `string` | AWS region | - | `inferenceBedrockBearerToken` | `string` | AWS bearer token | - | `inferenceBedrockBaseUrl` | `string` | Bedrock base URL | - | `inferenceBedrockProfile` | `string` | AWS profile name | - | `inferenceBedrockAwsDir` | `string` | AWS config directory | - | `inferenceFoundryResource` | `string` | Azure AI Foundry resource name | - | `inferenceFoundryApiKey` | `string` | Azure AI Foundry API key | - | `inferenceModels` | `array` | Model list | - | `deploymentOrganizationUuid` | `string` | Organization UUID | - | `disableEssentialTelemetry` | `boolean` | Block essential telemetry | - | `disableNonessentialTelemetry` | `boolean` | Block nonessential telemetry | - | `disableNonessentialServices` | `boolean` | Block nonessential services | - | `managedMcpServers` | `array` | Managed MCP servers | - | `disabledBuiltinTools` | `array` | Disabled built-in tools | - | `allowedWorkspaceFolders` | `array` | Allowed workspace folders | - | `inferenceCredentialHelper` | `string` | Helper script | - | `inferenceCredentialHelperTtlSec` | `integer` | Helper script TTL | - | `inferenceMaxTokensPerWindow` | `integer` | Max tokens per window | - | `inferenceTokenWindowHours` | `integer` | Token cap window | -
- - **Deprecated:** - - * `requireCoworkFullVmSandbox` — Require full VM sandbox - +} +``` + +**Baseline** + +| MDM key | Type | Description | +| - | - | - | +| `isDesktopExtensionEnabled` | `boolean` | Allow desktop extensions (renamed from `isDxtEnabled`) | +| `isDesktopExtensionSignatureRequired` | `boolean` | Require signed extensions (renamed from `isDxtSignatureRequired`) | +| `isLocalDevMcpEnabled` | `boolean` | Allow user-added MCP servers | +| `isClaudeCodeForDesktopEnabled` | `boolean` | Allow Claude Code tab | +| `coworkEgressAllowedHosts` | `array` | Allowed egress hosts | +| `otlpEndpoint` | `string` | OpenTelemetry collector endpoint | +| `otlpProtocol` | `enum` | OpenTelemetry exporter protocol | +| `otlpHeaders` | `object` | OpenTelemetry exporter headers | +| `autoUpdaterEnforcementHours` | `integer` | Auto-update enforcement window | +| `disableAutoUpdates` | `boolean` | Block auto-updates | +| `inferenceProvider` | `enum` | Inference provider | +| `inferenceGatewayBaseUrl` | `string` | Gateway base URL | +| `inferenceGatewayApiKey` | `string` | Gateway API key | +| `inferenceVertexProjectId` | `string` | GCP project ID | +| `inferenceVertexRegion` | `string` | GCP region | +| `inferenceVertexCredentialsFile` | `string` | GCP credentials file path | +| `inferenceVertexOAuthClientId` | `string` | Vertex OAuth client ID | +| `inferenceVertexOAuthClientSecret` | `string` | Vertex OAuth client secret | +| `inferenceVertexOAuthScopes` | `string` | Vertex OAuth scopes | +| `inferenceVertexBaseUrl` | `string` | Vertex AI base URL | +| `inferenceBedrockRegion` | `string` | AWS region | +| `inferenceBedrockBearerToken` | `string` | AWS bearer token | +| `inferenceBedrockBaseUrl` | `string` | Bedrock base URL | +| `inferenceBedrockProfile` | `string` | AWS profile name | +| `inferenceBedrockAwsDir` | `string` | AWS config directory | +| `inferenceFoundryResource` | `string` | Azure AI Foundry resource name | +| `inferenceFoundryApiKey` | `string` | Azure AI Foundry API key | +| `inferenceModels` | `array` | Model list | +| `deploymentOrganizationUuid` | `string` | Organization UUID | +| `disableEssentialTelemetry` | `boolean` | Block essential telemetry | +| `disableNonessentialTelemetry` | `boolean` | Block nonessential telemetry | +| `disableNonessentialServices` | `boolean` | Block nonessential services | +| `managedMcpServers` | `array` | Managed MCP servers | +| `disabledBuiltinTools` | `array` | Disabled built-in tools | +| `allowedWorkspaceFolders` | `array` | Allowed workspace folders | +| `inferenceCredentialHelper` | `string` | Helper script | +| `inferenceCredentialHelperTtlSec` | `integer` | Helper script TTL | +| `inferenceMaxTokensPerWindow` | `integer` | Max tokens per window | +| `inferenceTokenWindowHours` | `integer` | Token cap window | + +**Deprecated:** + +* `requireCoworkFullVmSandbox` — Require full VM sandbox diff --git a/content/claude/third-party/claude-desktop/configuration.md b/content/claude/third-party/claude-desktop/configuration.md index 70db8dade1..0588a16ad4 100644 --- a/content/claude/third-party/claude-desktop/configuration.md +++ b/content/claude/third-party/claude-desktop/configuration.md @@ -6,9 +6,11 @@ > Every managed-configuration key Claude Desktop on 3P supports, what it controls, and recommended security profiles -Most settings on this page are easier to configure in the [in-app configuration window](/docs/third-party/claude-desktop/in-app-configuration). Use this reference when you're scripting an MDM policy or bootstrap response by hand. +> [!TIP] +> +> Most settings on this page are easier to configure in the [in-app configuration window](/docs/third-party/claude-desktop/in-app-configuration). Use this reference when you're scripting an MDM policy or bootstrap response by hand. -Claude Desktop on third-party (3P) is configured through OS-native managed preferences: a `.mobileconfig` profile on macOS, registry policy on Windows, or a root-owned JSON file on Linux (organizations in the admin console beta can instead deliver these settings from **Organization settings** on claude.ai). This page documents every supported key. For the desktop release each key first appeared in, see the [configuration changelog](/docs/third-party/claude-desktop/configuration-changelog). +Claude Desktop on third-party (3P) is configured through OS-native managed preferences: a `.mobileconfig` profile on macOS, registry policy on Windows, or a root-owned JSON file on Linux (organizations managed from the [Enterprise Admin Console](/docs/third-party/claude-desktop/admin-console) can instead deliver these settings from **Organization settings** on claude.ai). This page documents every supported key. For the desktop release each key first appeared in, see the [configuration changelog](/docs/third-party/claude-desktop/configuration-changelog). The easiest way to author a configuration is the in-app configuration window (**Developer → Configure Third-Party Inference…**), which validates values, shows per-provider requirements, and exports directly to `.mobileconfig` or `.reg`. Use this reference when you need to author policy by hand, audit an existing profile, or understand exactly what a key does. @@ -22,11 +24,11 @@ The easiest way to author a configuration is the in-app configuration window (** The local location is a directory: `_meta.json` records which saved configuration is applied, and each configuration is a `.json` file alongside it. The in-app configuration window writes here. -When a managed source is present, locally written values are ignored. The exception is a managed source that sets only [app-behavior keys](/docs/third-party/claude-desktop/mdm#update-keys-and-managed-precedence) (the update keys `disableAutoUpdates`, `autoUpdaterEnforcementHours`, and `updateViaUpdatesHost`, the lifecycle keys `relaunchEnforcementHours` and `configRecheckIntervalMinutes`, or the [network proxy keys](/docs/third-party/claude-desktop/network-proxy#pin-a-proxy-from-managed-configuration)): those keys are enforced from the managed source, but the rest of the configuration stays local and user-editable. Configuration takes effect **at launch**, so fully quit and reopen the app after any change. From version 1.46388.1 a running app also notices a changed managed configuration at its next re-check ([`configRecheckIntervalMinutes`](#configrecheckintervalminutes), 10 minutes by default) and, for most settings, prompts the user to restart and requires the restart after [`relaunchEnforcementHours`](#relaunchenforcementhours) (24 hours by default). On Windows, the two policy hives are not merged: when machine policy is present under `HKLM\SOFTWARE\Policies\Claude`, the app ignores `HKCU\SOFTWARE\Policies\Claude` entirely; [Deploy the configuration](/docs/third-party/claude-desktop/mdm#4-deploy-the-configuration) has the exact rule. See [Deploy with MDM](/docs/third-party/claude-desktop/mdm#update-keys-and-managed-precedence) for the full precedence rules. +When a managed source is present, locally written values are ignored. The exception is a managed source that sets only [app-behavior keys](/docs/third-party/claude-desktop/mdm#update-keys-and-managed-precedence) (the update keys `disableAutoUpdates`, `autoUpdaterEnforcementHours`, `updateViaUpdatesHost`, and [`releaseChannel`](#releasechannel), the lifecycle keys `relaunchEnforcementHours` and `configRecheckIntervalMinutes`, or the [network proxy keys](/docs/third-party/claude-desktop/network-proxy#pin-a-proxy-from-managed-configuration)): those keys are enforced from the managed source, but the rest of the configuration stays local and user-editable. Configuration takes effect **at launch**, so fully quit and reopen the app after any change. From version 1.46388.1 a running app also notices a changed managed configuration at its next re-check ([`configRecheckIntervalMinutes`](#configrecheckintervalminutes), 10 minutes by default) and, for most settings, prompts the user to restart and requires the restart after [`relaunchEnforcementHours`](#relaunchenforcementhours) (24 hours by default). On Windows, the two policy hives are not merged: when machine policy is present under `HKLM\SOFTWARE\Policies\Claude`, the app ignores `HKCU\SOFTWARE\Policies\Claude` entirely; [Deploy the configuration](/docs/third-party/claude-desktop/mdm#4-deploy-the-configuration) has the exact rule. See [Deploy with MDM](/docs/third-party/claude-desktop/mdm#update-keys-and-managed-precedence) for the full precedence rules. - - Claude Desktop on 3P reads the same managed-configuration sources as standard Claude Desktop but ignores keys scoped to standard deployments, except [`forceLoginOrgUUID`](/docs/cowork/hipaa-setup#what-each-claude-desktop-key-does), as described under [Keep a device on its managed profile](/docs/third-party/claude-desktop/admin-console#keep-a-device-on-its-managed-profile). - +> [!NOTE] +> +> Claude Desktop on 3P reads the same managed-configuration sources as standard Claude Desktop but ignores keys scoped to standard deployments, except [`forceLoginOrgUUID`](/docs/cowork/hipaa-setup#what-each-claude-desktop-key-does), as described under [Keep a device on its managed profile](/docs/third-party/claude-desktop/admin-console#keep-a-device-on-its-managed-profile). ### Value types @@ -41,9 +43,9 @@ Write every value as a **string** in the OS preference store, even booleans and | object (JSON) | JSON object mapping name to value, as a string | `{"X-Org-Id":"team1"}` | | object\[] (JSON) | JSON array of objects, as a string | see [`managedMcpServers`](#managedmcpservers) | - - Array- and object-typed keys such as `inferenceModels`, `inferenceGatewayOidc`, `managedMcpServers`, `coworkEgressAllowedHosts`, and `otlpHeaders` are single keys whose value is a whole JSON document. The portable encoding is a JSON string, which works on every platform. In a `.mobileconfig` that is a single `` element containing `[...]` or `{...}`, and on Windows a `REG_SZ` value. A macOS profile may instead carry the value as a native `` or ``, which the app reads as the equivalent JSON. Separate keys with dotted names, such as `inferenceGatewayOidc.clientId`, are never read. - +> [!NOTE] +> +> Array- and object-typed keys such as `inferenceModels`, `inferenceGatewayOidc`, `managedMcpServers`, `coworkEgressAllowedHosts`, and `otlpHeaders` are single keys whose value is a whole JSON document. The portable encoding is a JSON string, which works on every platform. In a `.mobileconfig` that is a single `` element containing `[...]` or `{...}`, and on Windows a `REG_SZ` value. A macOS profile may instead carry the value as a native `` or ``, which the app reads as the equivalent JSON. Separate keys with dotted names, such as `inferenceGatewayOidc.clientId`, are never read. On Windows, write registry values as `REG_SZ`, directly under the policy key rather than nested in a subkey (the app never reads subkeys). `REG_DWORD` is also accepted for boolean and integer keys and is read as its decimal value. Avoid `REG_EXPAND_SZ`: the app counts it toward machine policy being present but cannot read its contents. The app cannot see `REG_QWORD`, `REG_MULTI_SZ`, or `REG_BINARY` values at all. @@ -79,368 +81,358 @@ The reference below is generated from the configuration schema and grouped to ma | Setting | Type | Availability | Default | Description | | - | - | - | - | - | -| Custom inference headers
`inferenceCustomHeaders` | `object` | MDM + Bootstrap
Added in 1.8089.0 | — | Extra headers on every inference request — routing and tenant headers only (org IDs, Bedrock Guardrails). No credentials; use the credential helper for tokens. | -| Sign-in session lifetime
`inferenceSessionLifetimeSec` | `integer` | MDM + Bootstrap
Added in 1.14271.0 | — | How long a sign-in stays valid under your IdP’s session policy. Shows a re-authenticate banner before it expires. | -| Helper script
`inferenceCredentialHelper` | `string` | MDM + Bootstrap
Added in 1.2581.0 | — | Absolute path to an executable that prints the credential, optionally with per-request headers. | -| Helper script (Windows)
`inferenceCredentialHelperWindows` | `string` | MDM + Bootstrap
Added in 2.2553.0 | — | Absolute path of the helper executable on Windows devices, used there instead of Helper script. Leave unset to use Helper script on every operating system. | -| Helper script arguments
`inferenceCredentialHelperArgs` | `string[]` | MDM + Bootstrap
Added in 2.110.0 | — | Arguments passed to the helper script, one per entry, in order. Leave unset to run it with none. | -| Helper script TTL
`inferenceCredentialHelperTtlSec` | `integer` | MDM + Bootstrap
Added in 1.2581.0 | `3600` | Helper output is cached for this many seconds; once it expires the helper re-runs without a relaunch (before the next turn when set above 120). Defaults to `3600`. | -| Credential helper timeout
`inferenceCredentialHelperTimeoutSec` | `integer` | MDM + Bootstrap
Added in 1.8089.0 | `60` | Maximum wait for the helper executable to finish. Raise this if the helper opens a browser for interactive sign-in. Defaults to `60`. Range: 1–600. | -| Re-run helper for silent refresh
`inferenceCredentialHelperSilentRefreshEnabled` | `boolean` | MDM + Bootstrap
Added in 1.10628.0 | `true` | On credential expiry, re-run the helper (CLAUDE\_HELPER\_CONTEXT=mid-session-refresh) to recover silently. Turn off if the helper can’t run non-interactively. Defaults to `true`. | -| Proxy server URL
`egressProxyUrl` | `string` | MDM only
Added in 1.44121.1 | — | Send the app’s and the agent’s traffic through this HTTP proxy instead of the operating system’s proxy settings. | -| Proxy auto-config (PAC) URL
`egressProxyPacUrl` | `string` | MDM only
Added in 1.44121.1 | — | URL of a PAC file that decides the proxy per request. Wins over the proxy server URL when both are set. | -| Enable IPv6 in the workspace VM
`coworkVmIpv6Enabled` | `boolean` | MDM + Bootstrap
Added in 1.52386.0 | — | Give the Cowork workspace VM an IPv6 address and route so the agent’s tools can reach IPv6-only hosts through the device. macOS and Windows; off by default. | -| Artifact preview iframe origin
`userContentRendererUrl` | `string` | MDM + Bootstrap
Added in 1.24012.0 | — | HTTPS origin of the user-content-renderer deployment used for artifact and file previews. Defaults to the commercial host when unset. | -| Inference provider
`inferenceProvider` | `enum` | MDM + Bootstrap
Added in 1.2581.0 | — | Selects the inference backend. Setting this key activates third-party mode. One of: `gateway`, `anthropic`, `bedrock`, `mantle`, `vertex`, `foundry`. | -| Credential kind
`inferenceCredentialKind` | `enum` | MDM + Bootstrap
Added in 1.8555.0 | — | Selects the credential source. When set, only that source is used (no fallback). One of: `static`, `helper-script`, `interactive`, `vendor-profile`, `workforce`, `external-idp`. Deprecated: `inferenceCredentialKind: "oauth" (Vertex AI)` (accepted until October 7, 2026); use "interactive" — the same Google sign-in under its new name (in hosted or nested documents, switch once every desktop is on a release that knows the Vertex "interactive" kind). If it is still present after that, "oauth" will no longer be a Vertex AI credential kind: the value will be reported as invalid and ignored — the device will then derive the kind from the credential fields present (Google sign-in when an OAuth client id is set), and the hosted editor will refuse to save the configuration until the kind is changed. Deprecated: `inferenceCredentialKind: "interactive" together with inferenceVertexWorkforceAudience (Vertex AI)` (accepted until October 7, 2026); use "workforce" — or remove inferenceVertexWorkforceAudience if Google sign-in ("interactive") is what is meant. If it is still present after that, the audience will no longer imply Workforce Identity: the kind will stay "interactive" (Google sign-in), which needs inferenceVertexOAuthClientId — without it the configuration will be reported as incomplete and inference will not start. Deprecated: `inferenceCredentialKind: "interactive" together with inferenceGatewayOidc (gateway)`; use "external-idp" once every desktop in the fleet is on a release that reads it. The original spelling will keep working ("interactive" with inferenceGatewayOidc is read as "external-idp"); no end date has been set. | - - - - Sent on every inference and model-discovery request (joined into the CLI's `ANTHROPIC_CUSTOM_HEADERS`). - - Use this for fleet-wide, non-secret constants. **Do not put API keys, bearer tokens or other credentials here** — this map is stored and distributed as plain configuration. For tokens, and for per-user or per-session values, have the **credential helper script** emit JSON with a `headers` field; those are merged over these static entries (helper wins on conflict). - - - - Claude runs the executable with the entries of **Helper script arguments** as its arguments (none by default) and reads **stdout** (trimmed). Exit code must be `0`; any output on **stderr** is logged but ignored. **Stdout must contain only one of the formats below** (no banners, prompts, or log lines). - - **Output format** is either: - - * a single bare token (the API key / bearer token), or - * a JSON object `{"token": "...", "headers": {"Name": "Value", ...}}` when per-request headers are needed (merged over **Custom inference headers**, helper wins on conflict) - - The helper receives `CLAUDE_HELPER_CONTEXT` in its environment (`interactive`, `mid-session-refresh`, `background`, `scheduled-task`, `setup-test`) so it can decide whether to prompt the user — see the credential-helper docs for the full contract. - - Result is cached for the TTL below. On TTL expiry the helper is re-invoked transparently (no user prompt, no relaunch). - - **Expiry and refresh:** the app checks the active credential's expiry before each turn and refreshes silently when possible (re-runs the helper, or uses the stored refresh token for interactive sign-in kinds). If the provider returns HTTP 401 mid-turn, the same silent refresh is attempted before surfacing an error. When silent refresh fails, a prompt appears with a provider-specific action (re-sign-in for interactive kinds; admin-contact for static credentials). Applies to all providers, and to both Cowork and Code. - - **Typical use:** a shell script that pulls from Keychain, 1Password CLI, or an internal secret broker. Example: - - `security find-generic-password -s anthropic-api -w` - - If this field is set, static credential fields (API key, bearer token) are ignored. The helper always wins. - - - - When one configuration serves both Windows and macOS or Linux devices, set **Helper script** to the macOS/Linux path and this to the Windows path (`C:\...` or `C:/...`). Windows devices run this executable with the same arguments, timeout, TTL and environment as **Helper script**; macOS and Linux devices ignore it. An invalid value here stops the connection on Windows devices only. Desktop releases that predate this setting ignore it and run **Helper script** on every operating system. - - - - Each entry reaches the executable as one argument, exactly as written: `["--environment", "production"]` runs `helper --environment production`. Use it to keep one installed script and let the configuration each user receives decide what it does (which environment, tenant or vault to read), instead of packaging a script per case. - - Entries may not be empty and may not contain a double quote (`"`), a percent sign (`%`) or control characters, on any platform: a Windows `.cmd`/`.bat` helper receives its arguments through `cmd.exe`, where those characters would change the command. A `.cmd`/`.bat` script sees each argument quoted (`%1` is `"production"`, `%~1` strips the quotes); `.ps1`, `.exe` and POSIX helpers receive them bare. Arguments are visible in the diagnostic report and to other processes on the machine, so do not put secrets in them; the helper exists to fetch the secret. - - A changed list takes effect the way a changed path does. - - - - Pins the app (sign-in, the connection test, model discovery, MCP servers, plugins), the Claude Code engine behind Chat, Cowork, and Code, and on macOS and Windows the Cowork workspace VM (the agent's shell, package-install, `git`, and plugin commands) to one HTTP proxy. Use it when your gateway or the internet is reachable only through a corporate proxy and you cannot rely on the system proxy. It is a reachability setting, not an egress control. - - The value is an `http://` or `https://` URL, usually with a port. SOCKS proxies and embedded credentials (`user:pass@`) are rejected. Give a local forwarding proxy on the device as `http://127.0.0.1:port`; an `https://` loopback address cannot be verified from inside the Cowork workspace VM. Requests to `localhost`, `127.0.0.1`, `[::1]`, and `*.local` names bypass the proxy so local MCP servers keep working; everything else goes through it, and if the proxy is unreachable requests fail rather than connect directly. The engine receives it as `HTTPS_PROXY` and `HTTP_PROXY` with a matching `NO_PROXY`; if Claude Code managed settings on the device set those variables, they win for the engine on the host. Traffic that never uses this proxy: the Cowork workspace VM on Linux, credential and header helper scripts, the update download, the Windows sign-in broker, and pages opened in the system browser. - - Read once at launch from device management (MDM) or the local configuration file only; a configuration server cannot deliver it, because the app may need the proxy to reach that server. A profile that sets only this key (or only the other app-behavior keys, such as `disableAutoUpdates`) does not take over a connection users set up in the app, but those keys are read from one source as a group, so put the proxy in the same profile as your update settings. Changes apply at the next app start. When `egressProxyPacUrl` is also set, the PAC file wins and this key is ignored. - - - - At launch the app downloads the PAC script and asks it which proxy to use for each request, as a browser would, instead of following the operating system's proxy settings. Same value rules, coverage, exclusions, and delivery as `egressProxyUrl`, except that bypassing is the script's decision: `localhost`, `127.0.0.1`, and `[::1]` still never use a proxy, but `*.local` names and everything else follow whatever it returns. If the PAC file cannot be downloaded, the app connects directly rather than failing. - - On macOS and Windows the Cowork workspace VM is handed a copy of the script when it starts and evaluates it for each request itself; there `myIpAddress()` returns the VM's internal address rather than the device's, so a script that chooses by client subnet gives the VM its off-network answer (if that download fails, the VM connects directly). The Claude Code engine behind Chat, Cowork, and Code cannot evaluate a PAC file, so the app hands it one proxy (whichever the script returns for your inference endpoint) plus a bypass for loopback and `*.local` names. If the script answers `DIRECT` or only `SOCKS` for that endpoint, the engine uses no proxy at all, so have it return an HTTP `PROXY host:port` entry there; if the engine needs different rules, set `HTTPS_PROXY` and `NO_PROXY` in Claude Code managed settings, which win for the engine on the host. - - - - When set to `true`, the Cowork workspace VM on macOS and Windows gets a static IPv6 address (a unique local `fd…` address) and an IPv6 default route on its virtual network next to its IPv4 address, and the VM's gateway forwards that traffic over the device's own IPv6 connectivity, as it already does for IPv4. Use it when the tools the agent runs in the VM (shell commands, package installs, `git`, and plugin commands) must reach IPv6-only destinations. The VM's resolver then also returns IPv6 (AAAA) answers. A connection the VM makes over IPv6 succeeds only where the device's own IPv6 does; on a device without working IPv6, destinations that have both keep working over IPv4 and IPv6-only destinations stay unreachable. Because the VM's address is unique-local, most tools in it keep preferring IPv4 for destinations that have both, so IPv6 mostly carries traffic to IPv6-only destinations. - - This is a reachability setting, not an egress control: `coworkEgressAllowedHosts` keeps deciding which hostnames the agent's tools may reach, by name, over either protocol, and IPv6 literals are still not accepted there. Hosts your policies allow must also be reachable, and filtered the way you intend, over IPv6 on your network. - - Unset (default): the VM is IPv4-only and its resolver returns no IPv6 answers. A change takes effect the next time the workspace VM starts, typically at the next app launch. Does not apply to the Cowork workspace VM on Linux or to Code sessions, which use the device's own network stack. - - - - Setting this key asks for 3P mode. The app opens in 3P mode unless the user chose to sign in to Claude.ai at the login screen, a choice `disableDeploymentModeChooser` removes. In 3P mode, if the selected provider's required credential keys are missing or invalid, the app shows a configuration error. A value the app cannot read (a misspelt, wrongly cased or unknown provider, or a value of the wrong type) still counts as set when machine-wide device management sent it: a macOS configuration profile, Windows policy under `HKLM`, or the root-owned policy file on Linux. The app then asks for 3P mode and, in 3P mode, shows a configuration error whose details name this key. An unreadable `bootstrapUrl` from the same sources counts the same way unless `bootstrapEnabled` is `false`. An unreadable value does not count where the user can write it: the local configuration file, or Windows policy under `HKCU`. Neither does an empty value (a value of only spaces is unreadable, not empty), or a Windows value of type `REG_BINARY`, `REG_MULTI_SZ` or `REG_QWORD`. Each of those reads as not set. When this key is not set, the app launches in standard mode unless another setting asks for 3P mode, such as a `bootstrapUrl` that `bootstrapEnabled` has not turned off. Keys for providers other than the selected one are ignored. Each provider's required keys are documented on its dedicated page under Inference providers. - - +| Custom inference headers `inferenceCustomHeaders` | `object` | MDM + Bootstrap Added in 1.8089.0 | — | Extra headers on every inference request — routing and tenant headers only (org IDs, Bedrock Guardrails). No credentials; use the credential helper for tokens. | +| Sign-in session lifetime `inferenceSessionLifetimeSec` | `integer` | MDM + Bootstrap Added in 1.14271.0 | — | How long a sign-in stays valid under your IdP’s session policy. Shows a re-authenticate banner before it expires. | +| Helper script `inferenceCredentialHelper` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | Absolute path to an executable that prints the credential, optionally with per-request headers. | +| Helper script (Windows) `inferenceCredentialHelperWindows` | `string` | MDM + Bootstrap Added in 2.2553.0 | — | Absolute path of the helper executable on Windows devices, used there instead of Helper script. Leave unset to use Helper script on every operating system. | +| Helper script arguments `inferenceCredentialHelperArgs` | `string[]` | MDM + Bootstrap Added in 2.110.0 | — | Arguments passed to the helper script, one per entry, in order. Leave unset to run it with none. | +| Helper script TTL `inferenceCredentialHelperTtlSec` | `integer` | MDM + Bootstrap Added in 1.2581.0 | `3600` | Helper output is cached for this many seconds; once it expires the helper re-runs without a relaunch (before the next turn when set above 120). Defaults to `3600`. | +| Credential helper timeout `inferenceCredentialHelperTimeoutSec` | `integer` | MDM + Bootstrap Added in 1.8089.0 | `60` | Maximum wait for the helper executable to finish. Raise this if the helper opens a browser for interactive sign-in. Defaults to `60`. Range: 1–600. | +| Re-run helper for silent refresh `inferenceCredentialHelperSilentRefreshEnabled` | `boolean` | MDM + Bootstrap Added in 1.10628.0 | `true` | On credential expiry, re-run the helper (CLAUDE\_HELPER\_CONTEXT=mid-session-refresh) to recover silently. Turn off if the helper can’t run non-interactively. Defaults to `true`. | +| Proxy server URL `egressProxyUrl` | `string` | MDM only Added in 1.44121.1 | — | Send the app’s and the agent’s traffic through this HTTP proxy instead of the operating system’s proxy settings. | +| Proxy auto-config (PAC) URL `egressProxyPacUrl` | `string` | MDM only Added in 1.44121.1 | — | URL of a PAC file that decides the proxy per request. Wins over the proxy server URL when both are set. | +| Enable IPv6 in the workspace VM `coworkVmIpv6Enabled` | `boolean` | MDM + Bootstrap Added in 1.52386.0 | — | Give the Cowork workspace VM an IPv6 address and route so the agent’s tools can reach IPv6-only hosts through the device. macOS and Windows; off by default. | +| Artifact preview iframe origin `userContentRendererUrl` | `string` | MDM + Bootstrap Added in 1.24012.0 | — | HTTPS origin of the user-content-renderer deployment used for artifact and file previews. Defaults to the commercial host when unset. | +| Inference provider `inferenceProvider` | `enum` | MDM + Bootstrap Added in 1.2581.0 | — | Selects the inference backend. Setting this key activates third-party mode. One of: `gateway`, `anthropic`, `bedrock`, `mantle`, `vertex`, `foundry`. | +| Credential kind `inferenceCredentialKind` | `enum` | MDM + Bootstrap Added in 1.8555.0 | — | Selects the credential source. When set, only that source is used (no fallback). One of: `static`, `helper-script`, `interactive`, `vendor-profile`, `workforce`, `external-idp`. Deprecated: `inferenceCredentialKind: "oauth" (Vertex AI)` (accepted until October 7, 2026); use "interactive" — the same Google sign-in under its new name (in hosted or nested documents, switch once every desktop is on a release that knows the Vertex "interactive" kind). If it is still present after that, "oauth" will no longer be a Vertex AI credential kind: the value will be reported as invalid and ignored — the device will then derive the kind from the credential fields present (Google sign-in when an OAuth client id is set), and the hosted editor will refuse to save the configuration until the kind is changed. Deprecated: `inferenceCredentialKind: "interactive" together with inferenceVertexWorkforceAudience (Vertex AI)` (accepted until October 7, 2026); use "workforce" — or remove inferenceVertexWorkforceAudience if Google sign-in ("interactive") is what is meant. If it is still present after that, the audience will no longer imply Workforce Identity: the kind will stay "interactive" (Google sign-in), which needs inferenceVertexOAuthClientId — without it the configuration will be reported as incomplete and inference will not start. Deprecated: `inferenceCredentialKind: "interactive" together with inferenceGatewayOidc (gateway)`; use "external-idp" once every desktop in the fleet is on a release that reads it. The original spelling will keep working ("interactive" with inferenceGatewayOidc is read as "external-idp"); no end date has been set. | + +> **inferenceCustomHeaders details** +> +> Sent on every inference and model-discovery request (joined into the CLI's `ANTHROPIC_CUSTOM_HEADERS`). +> +> Use this for fleet-wide, non-secret constants. **Do not put API keys, bearer tokens or other credentials here** — this map is stored and distributed as plain configuration. For tokens, and for per-user or per-session values, have the **credential helper script** emit JSON with a `headers` field; those are merged over these static entries (helper wins on conflict). + +> **inferenceCredentialHelper details** +> +> Claude runs the executable with the entries of **Helper script arguments** as its arguments (none by default) and reads **stdout** (trimmed). Exit code must be `0`; any output on **stderr** is logged but ignored. **Stdout must contain only one of the formats below** (no banners, prompts, or log lines). +> +> **Output format** is either: +> +> * a single bare token (the API key / bearer token), or +> * a JSON object `{"token": "...", "headers": {"Name": "Value", ...}}` when per-request headers are needed (merged over **Custom inference headers**, helper wins on conflict) +> +> The helper receives `CLAUDE_HELPER_CONTEXT` in its environment (`interactive`, `mid-session-refresh`, `background`, `scheduled-task`, `setup-test`) so it can decide whether to prompt the user — see the credential-helper docs for the full contract. +> +> Result is cached for the TTL below. On TTL expiry the helper is re-invoked transparently (no user prompt, no relaunch). +> +> **Expiry and refresh:** the app checks the active credential's expiry before each turn and refreshes silently when possible (re-runs the helper, or uses the stored refresh token for interactive sign-in kinds). If the provider returns HTTP 401 mid-turn, the same silent refresh is attempted before surfacing an error. When silent refresh fails, a prompt appears with a provider-specific action (re-sign-in for interactive kinds; admin-contact for static credentials). Applies to all providers, and to both Cowork and Code. +> +> **Typical use:** a shell script that pulls from Keychain, 1Password CLI, or an internal secret broker. Example: +> +> `security find-generic-password -s anthropic-api -w` +> +> If this field is set, static credential fields (API key, bearer token) are ignored. The helper always wins. + +> **inferenceCredentialHelperWindows details** +> +> When one configuration serves both Windows and macOS or Linux devices, set **Helper script** to the macOS/Linux path and this to the Windows path (`C:\...` or `C:/...`). Windows devices run this executable with the same arguments, timeout, TTL and environment as **Helper script**; macOS and Linux devices ignore it. An invalid value here stops the connection on Windows devices only. Desktop releases that predate this setting ignore it and run **Helper script** on every operating system. + +> **inferenceCredentialHelperArgs details** +> +> Each entry reaches the executable as one argument, exactly as written: `["--environment", "production"]` runs `helper --environment production`. Use it to keep one installed script and let the configuration each user receives decide what it does (which environment, tenant or vault to read), instead of packaging a script per case. +> +> Entries may not be empty and may not contain a double quote (`"`), a percent sign (`%`) or control characters, on any platform: a Windows `.cmd`/`.bat` helper receives its arguments through `cmd.exe`, where those characters would change the command. A `.cmd`/`.bat` script sees each argument quoted (`%1` is `"production"`, `%~1` strips the quotes); `.ps1`, `.exe` and POSIX helpers receive them bare. Arguments are visible in the diagnostic report and to other processes on the machine, so do not put secrets in them; the helper exists to fetch the secret. +> +> A changed list takes effect the way a changed path does. + +> **egressProxyUrl details** +> +> Pins the app (sign-in, the connection test, model discovery, MCP servers, plugins), the Claude Code engine behind Chat, Cowork, and Code, and on macOS and Windows the Cowork workspace VM (the agent's shell, package-install, `git`, and plugin commands) to one HTTP proxy. Use it when your gateway or the internet is reachable only through a corporate proxy and you cannot rely on the system proxy. It is a reachability setting, not an egress control. +> +> The value is an `http://` or `https://` URL, usually with a port. SOCKS proxies and embedded credentials (`user:pass@`) are rejected. Give a local forwarding proxy on the device as `http://127.0.0.1:port`; an `https://` loopback address cannot be verified from inside the Cowork workspace VM. Requests to `localhost`, `127.0.0.1`, `[::1]`, and `*.local` names bypass the proxy so local MCP servers keep working; everything else goes through it, and if the proxy is unreachable requests fail rather than connect directly. The engine receives it as `HTTPS_PROXY` and `HTTP_PROXY` with a matching `NO_PROXY`; if Claude Code managed settings on the device set those variables, they win for the engine on the host. Traffic that never uses this proxy: the Cowork workspace VM on Linux, credential and header helper scripts, the update download, the Windows sign-in broker, and pages opened in the system browser. +> +> Read once at launch from device management (MDM) or the local configuration file only; a configuration server cannot deliver it, because the app may need the proxy to reach that server. A profile that sets only this key (or only the other app-behavior keys, such as `disableAutoUpdates`) does not take over a connection users set up in the app, but those keys are read from one source as a group, so put the proxy in the same profile as your update settings. Changes apply at the next app start. When `egressProxyPacUrl` is also set, the PAC file wins and this key is ignored. + +> **egressProxyPacUrl details** +> +> At launch the app downloads the PAC script and asks it which proxy to use for each request, as a browser would, instead of following the operating system's proxy settings. Same value rules, coverage, exclusions, and delivery as `egressProxyUrl`, except that bypassing is the script's decision: `localhost`, `127.0.0.1`, and `[::1]` still never use a proxy, but `*.local` names and everything else follow whatever it returns. If the PAC file cannot be downloaded, the app connects directly rather than failing. +> +> On macOS and Windows the Cowork workspace VM is handed a copy of the script when it starts and evaluates it for each request itself; there `myIpAddress()` returns the VM's internal address rather than the device's, so a script that chooses by client subnet gives the VM its off-network answer (if that download fails, the VM connects directly). The Claude Code engine behind Chat, Cowork, and Code cannot evaluate a PAC file, so the app hands it one proxy (whichever the script returns for your inference endpoint) plus a bypass for loopback and `*.local` names. If the script answers `DIRECT` or only `SOCKS` for that endpoint, the engine uses no proxy at all, so have it return an HTTP `PROXY host:port` entry there; if the engine needs different rules, set `HTTPS_PROXY` and `NO_PROXY` in Claude Code managed settings, which win for the engine on the host. + +> **coworkVmIpv6Enabled details** +> +> When set to `true`, the Cowork workspace VM on macOS and Windows gets a static IPv6 address (a unique local `fd…` address) and an IPv6 default route on its virtual network next to its IPv4 address, and the VM's gateway forwards that traffic over the device's own IPv6 connectivity, as it already does for IPv4. Use it when the tools the agent runs in the VM (shell commands, package installs, `git`, and plugin commands) must reach IPv6-only destinations. The VM's resolver then also returns IPv6 (AAAA) answers. A connection the VM makes over IPv6 succeeds only where the device's own IPv6 does; on a device without working IPv6, destinations that have both keep working over IPv4 and IPv6-only destinations stay unreachable. Because the VM's address is unique-local, most tools in it keep preferring IPv4 for destinations that have both, so IPv6 mostly carries traffic to IPv6-only destinations. +> +> This is a reachability setting, not an egress control: `coworkEgressAllowedHosts` keeps deciding which hostnames the agent's tools may reach, by name, over either protocol, and IPv6 literals are still not accepted there. Hosts your policies allow must also be reachable, and filtered the way you intend, over IPv6 on your network. +> +> Unset (default): the VM is IPv4-only and its resolver returns no IPv6 answers. A change takes effect the next time the workspace VM starts, typically at the next app launch. Does not apply to the Cowork workspace VM on Linux or to Code sessions, which use the device's own network stack. + +> **inferenceProvider details** +> +> Setting this key asks for 3P mode. The app opens in 3P mode unless the user chose to sign in to Claude.ai at the login screen, a choice `disableDeploymentModeChooser` removes. In 3P mode, if the selected provider's required credential keys are missing or invalid, the app shows a configuration error. A value the app cannot read (a misspelt, wrongly cased or unknown provider, or a value of the wrong type) still counts as set when machine-wide device management sent it: a macOS configuration profile, Windows policy under `HKLM`, or the root-owned policy file on Linux. The app then asks for 3P mode and, in 3P mode, shows a configuration error whose details name this key. An unreadable `bootstrapUrl` from the same sources counts the same way unless `bootstrapEnabled` is `false`. An unreadable value does not count where the user can write it: the local configuration file, or Windows policy under `HKCU`. Neither does an empty value (a value of only spaces is unreadable, not empty), or a Windows value of type `REG_BINARY`, `REG_MULTI_SZ` or `REG_QWORD`. Each of those reads as not set. When this key is not set, the app launches in standard mode unless another setting asks for 3P mode, such as a `bootstrapUrl` that `bootstrapEnabled` has not turned off. Keys for providers other than the selected one are ignored. Each provider's required keys are documented on its dedicated page under Inference providers. ### Anthropic | Setting | Type | Availability | Default | Description | | - | - | - | - | - | -| Claude API key
`inferenceAnthropicApiKey` | `string` | MDM + Bootstrap
Added in 1.8089.0 | — | Leave blank to fetch a key via browser sign-in, or to supply the key via a credential helper. | +| Claude API key `inferenceAnthropicApiKey` | `string` | MDM + Bootstrap Added in 1.8089.0 | — | Leave blank to sign in with your browser, or to supply the key via a credential helper. | ### Bedrock | Setting | Type | Availability | Default | Description | | - | - | - | - | - | -| AWS region
`inferenceBedrockRegion` | `string` | MDM + Bootstrap
Added in 1.2581.0 | — | AWS region for the Bedrock runtime endpoint. | -| Bedrock base URL
`inferenceBedrockBaseUrl` | `string` | MDM + Bootstrap
Added in 1.2581.0 | — | For VPC endpoints or gateway proxies. Host origin only. | -| Bedrock service tier
`inferenceBedrockServiceTier` | `enum` | MDM + Bootstrap
Added in 1.5186.0 | — | Sent as the X-Amzn-Bedrock-Service-Tier header. Leave unset for on-demand. One of: `flex`, `priority`. | -| AWS bearer token
`inferenceBedrockBearerToken` | `string` | MDM + Bootstrap
Added in 1.2581.0 | — | Static bearer token for inference. For providers that support profile or helper-script credentials, prefer those. | -| AWS SSO start URL
`inferenceBedrockSsoStartUrl` | `string` | MDM + Bootstrap
Added in 1.6259.0 | — | Enables in-app AWS sign-in (no AWS CLI needed). Set with the three SSO fields below. | -| AWS SSO region
`inferenceBedrockSsoRegion` | `string` | MDM + Bootstrap
Added in 1.6259.0 | — | IAM Identity Center home region. | -| AWS SSO account ID
`inferenceBedrockSsoAccountId` | `string` | MDM + Bootstrap
Added in 1.6259.0 | — | 12-digit AWS account ID assigned to users in IAM Identity Center. | -| AWS SSO role name
`inferenceBedrockSsoRoleName` | `string` | MDM + Bootstrap
Added in 1.6259.0 | — | IAM Identity Center permission-set name granting bedrock:InvokeModel\* on the account above. | -| AWS profile name
`inferenceBedrockProfile` | `string` | MDM + Bootstrap
Added in 1.2581.0 | — | AWS named profile to use for Bedrock inference credentials. | -| AWS config directory
`inferenceBedrockAwsDir` | `string` | MDM + Bootstrap
Added in 1.2581.0 | — | Folder with AWS config/credentials. Defaults to \~/.aws when no bearer token is set. | -| AWS CLI path
`inferenceBedrockAwsCliPath` | `string` | MDM + Bootstrap
Added in 1.13576.0 | — | Absolute path to the aws executable. Leave unset to find it on PATH. | - - - - Tier availability varies by model and region. Reserved capacity uses a provisioned-throughput ARN as the model ID instead of this setting. Older bundled Claude Code CLI versions ignore this key. - - +| AWS region `inferenceBedrockRegion` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | AWS region for the Bedrock runtime endpoint. | +| Bedrock base URL `inferenceBedrockBaseUrl` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | For VPC endpoints or gateway proxies. Host origin only. | +| Bedrock service tier `inferenceBedrockServiceTier` | `enum` | MDM + Bootstrap Added in 1.5186.0 | — | Sent as the X-Amzn-Bedrock-Service-Tier header. Leave unset for on-demand. One of: `flex`, `priority`. | +| AWS bearer token `inferenceBedrockBearerToken` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | Static bearer token for inference. For providers that support profile or helper-script credentials, prefer those. | +| AWS SSO start URL `inferenceBedrockSsoStartUrl` | `string` | MDM + Bootstrap Added in 1.6259.0 | — | Enables in-app AWS sign-in (no AWS CLI needed). Set with the three SSO fields below. | +| AWS SSO region `inferenceBedrockSsoRegion` | `string` | MDM + Bootstrap Added in 1.6259.0 | — | IAM Identity Center home region. | +| AWS SSO account ID `inferenceBedrockSsoAccountId` | `string` | MDM + Bootstrap Added in 1.6259.0 | — | 12-digit AWS account ID assigned to users in IAM Identity Center. | +| AWS SSO role name `inferenceBedrockSsoRoleName` | `string` | MDM + Bootstrap Added in 1.6259.0 | — | IAM Identity Center permission-set name granting bedrock:InvokeModel\* on the account above. | +| AWS profile name `inferenceBedrockProfile` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | AWS named profile to use for Bedrock inference credentials. | +| AWS config directory `inferenceBedrockAwsDir` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | Folder with AWS config/credentials. Defaults to \~/.aws when no bearer token is set. | +| AWS CLI path `inferenceBedrockAwsCliPath` | `string` | MDM + Bootstrap Added in 1.13576.0 | — | Absolute path to the aws executable. Leave unset to find it on PATH. | + +> **inferenceBedrockServiceTier details** +> +> Tier availability varies by model and region. Reserved capacity uses a provisioned-throughput ARN as the model ID instead of this setting. Older bundled Claude Code CLI versions ignore this key. ### Foundry | Setting | Type | Availability | Default | Description | | - | - | - | - | - | -| Azure AI Foundry resource name
`inferenceFoundryResource` | `string` | MDM + Bootstrap
Added in 1.2581.0 | — | Azure AI Foundry resource name used to construct the endpoint URL. | -| Azure AI Foundry base URL
`inferenceFoundryBaseUrl` | `string` | MDM + Bootstrap
Added in 2.110.0 | — | Full base URL for a gateway or proxy in front of Foundry, path included (replaces [https://RESOURCE.services.ai.azure.com/anthropic](https://RESOURCE.services.ai.azure.com/anthropic)). | -| Azure AI Foundry API key
`inferenceFoundryApiKey` | `string` | MDM + Bootstrap
Added in 1.2581.0 | — | API key for Azure AI Foundry inference. | -| Entra ID tenant ID
`inferenceFoundryTenantId` | `string` | MDM + Bootstrap
Added in 1.9255.0 | — | Directory (tenant) ID of the Entra ID app registration that has the Cognitive Services scope. | -| Entra ID client ID
`inferenceFoundryClientId` | `string` | MDM + Bootstrap
Added in 1.9255.0 | — | Application (client) ID of the Entra ID app registration. Device-code sign-in requires the app to allow public client flows. | -| Entra ID sign-in flow
`inferenceFoundryAuthFlow` | `enum` | MDM + Bootstrap
Added in 1.19367.0 | — | How Entra sign-in runs: device code (default), system browser, or the OS identity broker. One of: `device-code`, `browser`, `broker`. | - - - - Set this only when the app reaches Foundry through a gateway or proxy you run, such as Azure API Management. Requests go to `/v1/messages` instead of `https://.services.ai.azure.com/anthropic/v1/messages`, carrying the same credential and headers the app would send to Foundry: each user's Entra ID token for the Azure Cognitive Services audience as `Authorization: Bearer` with Entra sign-in, otherwise the API key or the credential helper's output. Claude Code sessions receive the value as `ANTHROPIC_FOUNDRY_BASE_URL`, so use the same value you would give Claude Code in a terminal. `inferenceFoundryResource` is still required and should name the resource behind the gateway; the app sends nothing to the resource directly while this is set. Must be https, or http to a proxy at a loopback address on the device itself (127.0.0.1, localhost or \[::1]). - - - - * **`device-code`** (default) — shows a code to enter at microsoft.com/devicelogin. The app registration must have **Allow public client flows** enabled. - * **`browser`** — opens the system browser for an authorization-code (PKCE) sign-in on a loopback redirect URI. The app registration must include `http://127.0.0.1/callback` under the **Mobile and desktop applications** platform (Entra ignores the loopback port, but not the path). Works with **Allow public client flows** disabled, and is unaffected by Conditional Access policies that block device-code authentication. - * **`broker`** — signs in through the OS identity broker (Web Account Manager on Windows, Company Portal on macOS), so it can satisfy Conditional Access policies that require a compliant/managed device or token protection. The app registration must include the broker redirect URIs `ms-appx-web://Microsoft.AAD.BrokerPlugin/{client-id}` (Windows) and `msauth.com.anthropic.claudefordesktop://auth` (macOS) under the **Mobile and desktop applications** platform. Not supported on Linux. - - App versions that predate this key always use device code; versions that predate the broker option treat `broker` as unset and use device code. - - +| Azure AI Foundry resource name `inferenceFoundryResource` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | Azure AI Foundry resource name used to construct the endpoint URL. | +| Azure AI Foundry base URL `inferenceFoundryBaseUrl` | `string` | MDM + Bootstrap Added in 2.110.0 | — | Full base URL for a gateway or proxy in front of Foundry, path included (replaces [https://RESOURCE.services.ai.azure.com/anthropic](https://RESOURCE.services.ai.azure.com/anthropic)). | +| Azure AI Foundry API key `inferenceFoundryApiKey` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | API key for Azure AI Foundry inference. | +| Entra ID tenant ID `inferenceFoundryTenantId` | `string` | MDM + Bootstrap Added in 1.9255.0 | — | Directory (tenant) ID of the Entra ID app registration that has the Cognitive Services scope. | +| Entra ID client ID `inferenceFoundryClientId` | `string` | MDM + Bootstrap Added in 1.9255.0 | — | Application (client) ID of the Entra ID app registration. Device-code sign-in requires the app to allow public client flows. | +| Entra ID sign-in flow `inferenceFoundryAuthFlow` | `enum` | MDM + Bootstrap Added in 1.19367.0 | — | How Entra sign-in runs: device code (default), system browser, or the OS identity broker. One of: `device-code`, `browser`, `broker`. | + +> **inferenceFoundryBaseUrl details** +> +> Set this only when the app reaches Foundry through a gateway or proxy you run, such as Azure API Management. Requests go to `/v1/messages` instead of `https://.services.ai.azure.com/anthropic/v1/messages`, carrying the same credential and headers the app would send to Foundry: each user's Entra ID token for the Azure Cognitive Services audience as `Authorization: Bearer` with Entra sign-in, otherwise the API key or the credential helper's output. Claude Code sessions receive the value as `ANTHROPIC_FOUNDRY_BASE_URL`, so use the same value you would give Claude Code in a terminal. `inferenceFoundryResource` is still required and should name the resource behind the gateway; the app sends nothing to the resource directly while this is set. Must be https, or http to a proxy at a loopback address on the device itself (127.0.0.1, localhost or \[::1]). + +> **inferenceFoundryAuthFlow details** +> +> * **`device-code`** (default) — shows a code to enter at microsoft.com/devicelogin. The app registration must have **Allow public client flows** enabled. +> * **`browser`** — opens the system browser for an authorization-code (PKCE) sign-in on a loopback redirect URI. The app registration must include `http://127.0.0.1/callback` under the **Mobile and desktop applications** platform (Entra ignores the loopback port, but not the path). Works with **Allow public client flows** disabled, and is unaffected by Conditional Access policies that block device-code authentication. +> * **`broker`** — signs in through the OS identity broker (Web Account Manager on Windows, Company Portal on macOS), so it can satisfy Conditional Access policies that require a compliant/managed device or token protection. The app registration must include the broker redirect URIs `ms-appx-web://Microsoft.AAD.BrokerPlugin/{client-id}` (Windows) and `msauth.com.anthropic.claudefordesktop://auth` (macOS) under the **Mobile and desktop applications** platform. Not supported on Linux. +> +> App versions that predate this key always use device code; versions that predate the broker option treat `broker` as unset and use device code. ### Gateway | Setting | Type | Availability | Default | Description | | - | - | - | - | - | -| Gateway base URL
`inferenceGatewayBaseUrl` | `string` | MDM + Bootstrap
Added in 1.2581.0 | — | Full URL of the inference gateway endpoint. | -| Stream idle timeout
`inferenceStreamIdleTimeoutSec` | `integer` | MDM + Bootstrap
Added in 1.44121.1 | — | Extra seconds to wait for model output on a streaming response that is sending only keep-alive pings. Gateway provider only. Default 300. Range: 300–1800. | -| Gateway API key
`inferenceGatewayApiKey` | `string` | MDM + Bootstrap
Added in 1.2581.0 | — | API key for the configured inference gateway. | -| Gateway auth scheme
`inferenceGatewayAuthScheme` | `enum` | MDM + Bootstrap
Added in 1.3036.0 | `bearer` | How the gateway credential is sent on the wire (Authorization: Bearer vs x-api-key header). One of: `bearer`, `x-api-key`. Defaults to `bearer`. Deprecated: `inferenceGatewayAuthScheme: "sso"`; use inferenceCredentialKind: "interactive". The original spelling will keep working; no end date has been set. | -| Gateway sign-in flow
`inferenceGatewayOidcAuthFlow` | `enum` | MDM + Bootstrap
Added in 1.25927.0 | — | How the IdP sign-in runs: system browser (default) or the OS Microsoft Entra broker. One of: `browser`, `broker`. Deprecated: `inferenceGatewayOidcAuthFlow`; use inferenceIdpAuthFlow together with inferenceIdpOidc once every desktop in the fleet is on a release that reads them. The original spelling will keep working; no end date has been set. | -| Gateway SSO IdP (OIDC)
`inferenceGatewayOidc` | `object` | MDM + Bootstrap
Added in 1.6889.0 | — | External IdP for gateway sign-in. The user’s token from this issuer is sent to the gateway as the Bearer credential. Deprecated: `inferenceGatewayOidc`; use inferenceIdpOidc with inferenceCredentialKind: "external-idp" once every desktop in the fleet is on a release that reads them. The original spelling will keep working; no end date has been set. | -| Identity provider sign-in flow
`inferenceIdpAuthFlow` | `enum` | MDM + Bootstrap
Added in 2.7032.0 | — | How the identity-provider sign-in runs: system browser (default) or the OS Microsoft Entra broker. One of: `browser`, `broker`. | -| Identity provider (OIDC)
`inferenceIdpOidc` | `object` | MDM + Bootstrap
Added in 2.7032.0 | — | Your organization’s OpenID Connect identity provider. The user’s token is sent as the Bearer credential to the gateway or the Bedrock proxy. | - - - - Raises how long Cowork, Chat and Code sessions wait for the next model event on an open streaming response (Claude Code's `CLAUDE_STREAM_IDLE_TIMEOUT_MS`). It only helps when the gateway writes SSE keep-alive `ping` events (or `:` comment lines) into the response while the upstream model is silent — for example a LiteLLM proxy with keep-alive pings enabled in front of Amazon Bedrock. With pings arriving, Claude Code accepts at least about five minutes of keep-alives and then waits this many seconds more for real model output before abandoning the request. Gateway provider only; the other providers keep Claude Code's defaults. - - A response on which nothing at all arrives — no pings — still fails after about 5 minutes regardless of this key, because at the device a silent connection cannot be told apart from a dead one. If long generations fail behind a gateway that does not send pings, configure the gateway to send them rather than raising this value. A common case is automatic compaction, in which a session sends its whole conversation in one streaming request and waits for a long summary; when that request fails, the error reads `Prompt is too long · automatic compaction failed:` followed by the cause. While this key is set, the app's value takes precedence over `CLAUDE_STREAM_IDLE_TIMEOUT_MS` in Claude Code's own managed settings for sessions the app starts; when it is unset, that setting still applies. Values outside 300–1800 are rejected at parse time (the error is listed in the diagnostics report) and the default applies. - - - - * **`browser`** (default) — opens the system browser for an authorization-code (PKCE) sign-in on a loopback redirect URI. See the **IdP setup** notes on `inferenceGatewayOidc` for redirect-URI registration. - * **`broker`** — signs in through the OS identity broker (Web Account Manager on Windows, Company Portal on macOS). Requires the IdP to be **Microsoft Entra ID** — the `issuer` on `inferenceGatewayOidc` must be `https://login.microsoftonline.com/{tenant-id}/v2.0`. The broker satisfies Conditional Access policies that require a compliant/managed device or token protection, and needs no loopback redirect. The Entra app registration must include the broker redirect URIs `ms-appx-web://Microsoft.AAD.BrokerPlugin/{client-id}` (Windows) and `msauth.com.anthropic.claudefordesktop://auth` (macOS) under the **Mobile and desktop applications** platform. Not supported on Linux. - - Broker mode mints a token in the customer's own Entra tenant with the customer-configured `scopes`, and forwards it to the customer's own gateway; both endpoints of that trust relationship are inside the customer's control. A desktop that has the `external-idp` kind reads this key, together with `inferenceGatewayOidc`, as that kind's sign-in flow; it stays readable. - - - - **External IdP mode.** The app discovers `/.well-known/openid-configuration`, runs an OIDC authorization-code-with-PKCE sign-in in the system browser with `clientId`, and sends the resulting token as `Authorization: Bearer` on every inference request. Leave this unset for a gateway that hosts its own RFC 8414 metadata at `/.well-known/oauth-authorization-server`. A desktop that has the `external-idp` kind reads this block as that kind's identity-provider key; it stays readable, so a fleet keeps this spelling until every desktop is on such a release. - - **Bearer token type.** `id_token` (the default) sends the OIDC ID token; the gateway validates signature, `iss`, and `aud` (the `clientId` configured here). `access_token` sends the OAuth access token, for gateways that validate as a resource server (Portkey, Kong, Envoy JWT filter, AWS API Gateway authorizers); `scopes` must then name the gateway's registered API scope. Either way the gateway must check `aud`, not just signature and issuer, or it accepts any token from your tenant. - - **IdP setup.** The callback is `http://127.0.0.1:/callback` by default (`http://localhost:/callback` with `redirectHost: "localhost"`); register exactly the one you use and include `/callback`. **Entra:** a public-client app with a *Mobile and desktop applications* redirect URI of `http://127.0.0.1/callback` (any port; omitting the path fails with `AADSTS50011`); in `access_token` mode also grant the gateway API's delegated permission, or sign-in fails with `AADSTS65001`. **Okta:** a *Native* app with the exact URI `http://127.0.0.1:/callback` and that port in `redirectPort`. - - **Refresh.** With `offline_access` the app renews the token silently and prompts a browser sign-in only when refresh fails. Google never returns an `id_token` on refresh, so a Google Workspace-backed gateway in `id_token` mode re-prompts about hourly; `access_token` mode is unaffected. - - | Field | Type | Default | Description | - | - | - | - | - | - | `clientId` | `string` | — | OAuth client ID of the desktop app registration at your identity provider (public client, PKCE). | - | `issuer` | `string` | — | HTTPS issuer with OIDC discovery. Set this, or set the authorization and token URLs instead. | - | `authorizationUrl` | `string` | — | HTTPS authorization endpoint. Used with the token URL when no issuer is set. | - | `tokenUrl` | `string` | — | HTTPS token endpoint. Used with the authorization URL when no issuer is set. | - | `bearerTokenType` | `enum` | `id_token` | Which token to send as the bearer. Use access token for a gateway or proxy that validates as an OAuth resource server. One of: `id_token`, `access_token`. | - | `scopes` | `string` | — | Space-separated scopes. Required in access-token mode: set the gateway or proxy API scope. offline\_access is appended automatically unless disabled below. | - | `appendOfflineAccess` | `boolean` | `true` | Automatically append offline\_access to scopes so the IdP returns a refresh token for silent refresh. | - | `resource` | `string` | — | Access-token audience of the gateway or proxy: an https URL or an AD FS relying-party identifier, sent as the RFC 8707 resource. Leave unset for Entra ID. | - | `redirectPort` | `integer` | — | Fixed loopback port for the sign-in redirect. Leave unset to use a free port each time. | - | `redirectHost` | `enum` | — | Use localhost only if your IdP’s registered redirect URI specifies it. One of: `127.0.0.1`, `localhost`. | - | `additionalRedirectReferrerHosts` | `string` | — | Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host. | - - - - * **`browser`** (default) — opens the system browser for an authorization-code (PKCE) sign-in on a loopback redirect URI. See the **IdP setup** notes on `inferenceIdpOidc` for redirect-URI registration. - * **`broker`** — signs in through the OS identity broker (Web Account Manager on Windows, Company Portal on macOS). Requires the IdP to be **Microsoft Entra ID** — the `issuer` on `inferenceIdpOidc` must be `https://login.microsoftonline.com/{tenant-id}/v2.0`. The broker satisfies Conditional Access policies that require a compliant/managed device or token protection, and needs no loopback redirect. The Entra app registration must include the broker redirect URIs `ms-appx-web://Microsoft.AAD.BrokerPlugin/{client-id}` (Windows) and `msauth.com.anthropic.claudefordesktop://auth` (macOS) under the **Mobile and desktop applications** platform. Not supported on Linux. - - Broker mode mints a token in the customer's own Entra tenant with the customer-configured `scopes` and forwards it to the customer's own gateway or proxy; both endpoints of that trust relationship are inside the customer's control. - - - - Used with `inferenceCredentialKind: "external-idp"`. The app discovers `/.well-known/openid-configuration`, runs an OIDC authorization-code (PKCE) sign-in in the browser with `clientId` (or through the OS broker, see `inferenceIdpAuthFlow`) and sends the token as `Authorization: Bearer` on every inference request: to `inferenceGatewayBaseUrl` on the gateway provider, or on Bedrock to `inferenceBedrockBaseUrl`, which is then required: only a proxy that validates the token accepts it, never Amazon Bedrock itself (to sign in straight to Bedrock use `interactive`, AWS IAM Identity Center). On Bedrock this kind has no model discovery: list the models in `inferenceModels`. - - **Bearer token type.** `id_token` (the default) sends the OIDC ID token; the receiver validates signature, `iss` and `aud` (the `clientId` here). `access_token` sends the OAuth access token, for gateways and proxies that validate as an OAuth resource server; `scopes` must then name the registered API scope. Either way the receiver must check `aud`, or it accepts any token from your tenant. - - **IdP setup.** The callback is `http://127.0.0.1:/callback` (`localhost` with `redirectHost: "localhost"`); register exactly that. **Entra:** a public-client app with a *Mobile and desktop applications* redirect URI `http://127.0.0.1/callback` (omitting the path fails with `AADSTS50011`); in `access_token` mode also grant the API's delegated permission, or sign-in fails with `AADSTS65001`. **Okta:** a *Native* app with `http://127.0.0.1:/callback` and that port in `redirectPort`. - - **Refresh.** With `offline_access` the app renews the token silently and asks for a browser sign-in only when refresh fails (Google returns no `id_token` on refresh, so `id_token` mode there re-prompts about hourly). - - **Older names.** Gateway configurations written before this key use `inferenceGatewayOidc` / `inferenceGatewayOidcAuthFlow` with the `interactive` kind; they stay readable and mean the same sign-in. - - | Field | Type | Default | Description | - | - | - | - | - | - | `clientId` | `string` | — | OAuth client ID of the desktop app registration at your identity provider (public client, PKCE). | - | `issuer` | `string` | — | HTTPS issuer with OIDC discovery. Set this, or set the authorization and token URLs instead. | - | `authorizationUrl` | `string` | — | HTTPS authorization endpoint. Used with the token URL when no issuer is set. | - | `tokenUrl` | `string` | — | HTTPS token endpoint. Used with the authorization URL when no issuer is set. | - | `bearerTokenType` | `enum` | `id_token` | Which token to send as the bearer. Use access token for a gateway or proxy that validates as an OAuth resource server. One of: `id_token`, `access_token`. | - | `scopes` | `string` | — | Space-separated scopes. Required in access-token mode: set the gateway or proxy API scope. offline\_access is appended automatically unless disabled below. | - | `appendOfflineAccess` | `boolean` | `true` | Automatically append offline\_access to scopes so the IdP returns a refresh token for silent refresh. | - | `resource` | `string` | — | Access-token audience of the gateway or proxy: an https URL or an AD FS relying-party identifier, sent as the RFC 8707 resource. Leave unset for Entra ID. | - | `redirectPort` | `integer` | — | Fixed loopback port for the sign-in redirect. Leave unset to use a free port each time. | - | `redirectHost` | `enum` | — | Use localhost only if your IdP’s registered redirect URI specifies it. One of: `127.0.0.1`, `localhost`. | - | `additionalRedirectReferrerHosts` | `string` | — | Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host. | - - +| Gateway base URL `inferenceGatewayBaseUrl` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | Full URL of the inference gateway endpoint. | +| Stream idle timeout `inferenceStreamIdleTimeoutSec` | `integer` | MDM + Bootstrap Added in 1.44121.1 | — | Extra seconds to wait for model output on a streaming response that is sending only keep-alive pings. Gateway provider only. Default 300. Range: 300–1800. | +| Gateway API key `inferenceGatewayApiKey` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | API key for the configured inference gateway. | +| Gateway auth scheme `inferenceGatewayAuthScheme` | `enum` | MDM + Bootstrap Added in 1.3036.0 | `bearer` | How the gateway credential is sent on the wire (Authorization: Bearer vs x-api-key header). One of: `bearer`, `x-api-key`. Defaults to `bearer`. Deprecated: `inferenceGatewayAuthScheme: "sso"`; use inferenceCredentialKind: "interactive". The original spelling will keep working; no end date has been set. | +| Gateway sign-in flow `inferenceGatewayOidcAuthFlow` | `enum` | MDM + Bootstrap Added in 1.25927.0 | — | How the IdP sign-in runs: system browser (default) or the OS Microsoft Entra broker. One of: `browser`, `broker`. Deprecated: `inferenceGatewayOidcAuthFlow`; use inferenceIdpAuthFlow together with inferenceIdpOidc once every desktop in the fleet is on a release that reads them. The original spelling will keep working; no end date has been set. | +| Gateway SSO IdP (OIDC) `inferenceGatewayOidc` | `object` | MDM + Bootstrap Added in 1.6889.0 | — | External IdP for gateway sign-in. The user’s token from this issuer is sent to the gateway as the Bearer credential. Deprecated: `inferenceGatewayOidc`; use inferenceIdpOidc with inferenceCredentialKind: "external-idp" once every desktop in the fleet is on a release that reads them. The original spelling will keep working; no end date has been set. | +| Identity provider sign-in flow `inferenceIdpAuthFlow` | `enum` | MDM + Bootstrap Added in 2.7032.0 | — | How the identity-provider sign-in runs: system browser (default) or the OS Microsoft Entra broker. One of: `browser`, `broker`. | +| Identity provider (OIDC) `inferenceIdpOidc` | `object` | MDM + Bootstrap Added in 2.7032.0 | — | Your organization’s OpenID Connect identity provider. The user’s token is sent as the Bearer credential to the gateway or the Bedrock proxy. | + +> **inferenceStreamIdleTimeoutSec details** +> +> Raises how long Cowork, Chat and Code sessions wait for the next model event on an open streaming response (Claude Code's `CLAUDE_STREAM_IDLE_TIMEOUT_MS`). It only helps when the gateway writes SSE keep-alive `ping` events (or `:` comment lines) into the response while the upstream model is silent — for example a LiteLLM proxy with keep-alive pings enabled in front of Amazon Bedrock. With pings arriving, Claude Code accepts at least about five minutes of keep-alives and then waits this many seconds more for real model output before abandoning the request. Gateway provider only; the other providers keep Claude Code's defaults. +> +> A response on which nothing at all arrives — no pings — still fails after about 5 minutes regardless of this key, because at the device a silent connection cannot be told apart from a dead one. If long generations fail behind a gateway that does not send pings, configure the gateway to send them rather than raising this value. A common case is automatic compaction, in which a session sends its whole conversation in one streaming request and waits for a long summary; when that request fails, the error reads `Prompt is too long · automatic compaction failed:` followed by the cause. While this key is set, the app's value takes precedence over `CLAUDE_STREAM_IDLE_TIMEOUT_MS` in Claude Code's own managed settings for sessions the app starts; when it is unset, that setting still applies. Values outside 300–1800 are rejected at parse time (the error is listed in the diagnostics report) and the default applies. + +> **inferenceGatewayOidcAuthFlow details** +> +> * **`browser`** (default) — opens the system browser for an authorization-code (PKCE) sign-in on a loopback redirect URI. See the **IdP setup** notes on `inferenceGatewayOidc` for redirect-URI registration. +> * **`broker`** — signs in through the OS identity broker (Web Account Manager on Windows, Company Portal on macOS). Requires the IdP to be **Microsoft Entra ID** — the `issuer` on `inferenceGatewayOidc` must be `https://login.microsoftonline.com/{tenant-id}/v2.0`. The broker satisfies Conditional Access policies that require a compliant/managed device or token protection, and needs no loopback redirect. The Entra app registration must include the broker redirect URIs `ms-appx-web://Microsoft.AAD.BrokerPlugin/{client-id}` (Windows) and `msauth.com.anthropic.claudefordesktop://auth` (macOS) under the **Mobile and desktop applications** platform. Not supported on Linux. +> +> Broker mode mints a token in the customer's own Entra tenant with the customer-configured `scopes`, and forwards it to the customer's own gateway; both endpoints of that trust relationship are inside the customer's control. A desktop that has the `external-idp` kind reads this key, together with `inferenceGatewayOidc`, as that kind's sign-in flow; it stays readable. + +> **inferenceGatewayOidc details** +> +> **External IdP mode.** The app discovers `/.well-known/openid-configuration`, runs an OIDC authorization-code-with-PKCE sign-in in the system browser with `clientId`, and sends the resulting token as `Authorization: Bearer` on every inference request. Leave this unset for a gateway that hosts its own RFC 8414 metadata at `/.well-known/oauth-authorization-server`. A desktop that has the `external-idp` kind reads this block as that kind's identity-provider key; it stays readable, so a fleet keeps this spelling until every desktop is on such a release. +> +> **Bearer token type.** `id_token` (the default) sends the OIDC ID token; the gateway validates signature, `iss`, and `aud` (the `clientId` configured here). `access_token` sends the OAuth access token, for gateways that validate as a resource server (Portkey, Kong, Envoy JWT filter, AWS API Gateway authorizers); `scopes` must then name the gateway's registered API scope. Either way the gateway must check `aud`, not just signature and issuer, or it accepts any token from your tenant. +> +> **IdP setup.** The callback is `http://127.0.0.1:/callback` by default (`http://localhost:/callback` with `redirectHost: "localhost"`); register exactly the one you use and include `/callback`. **Entra:** a public-client app with a *Mobile and desktop applications* redirect URI of `http://127.0.0.1/callback` (any port; omitting the path fails with `AADSTS50011`); in `access_token` mode also grant the gateway API's delegated permission, or sign-in fails with `AADSTS65001`. **Okta:** a *Native* app with the exact URI `http://127.0.0.1:/callback` and that port in `redirectPort`. +> +> **Refresh.** With `offline_access` the app renews the token silently and prompts a browser sign-in only when refresh fails. Google never returns an `id_token` on refresh, so a Google Workspace-backed gateway in `id_token` mode re-prompts about hourly; `access_token` mode is unaffected. +> +> | Field | Type | Default | Description | +> | - | - | - | - | +> | `clientId` | `string` | — | OAuth client ID of the desktop app registration at your identity provider (public client, PKCE). | +> | `issuer` | `string` | — | HTTPS issuer with OIDC discovery. Set this, or set the authorization and token URLs instead. | +> | `authorizationUrl` | `string` | — | HTTPS authorization endpoint. Used with the token URL when no issuer is set. | +> | `tokenUrl` | `string` | — | HTTPS token endpoint. Used with the authorization URL when no issuer is set. | +> | `bearerTokenType` | `enum` | `id_token` | Which token to send as the bearer. Use access token for a gateway or proxy that validates as an OAuth resource server. One of: `id_token`, `access_token`. | +> | `scopes` | `string` | — | Space-separated scopes. Required in access-token mode: set the gateway or proxy API scope. offline\_access is appended automatically unless disabled below. | +> | `appendOfflineAccess` | `boolean` | `true` | Automatically append offline\_access to scopes so the IdP returns a refresh token for silent refresh. | +> | `resource` | `string` | — | Access-token audience of the gateway or proxy: an https URL or an AD FS relying-party identifier, sent as the RFC 8707 resource. Leave unset for Entra ID. | +> | `redirectPort` | `integer` | — | Fixed loopback port for the sign-in redirect. Leave unset to use a free port each time. | +> | `redirectHost` | `enum` | — | Use localhost only if your IdP’s registered redirect URI specifies it. One of: `127.0.0.1`, `localhost`. | +> | `additionalRedirectReferrerHosts` | `string` | — | Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host. | + +> **inferenceIdpAuthFlow details** +> +> * **`browser`** (default) — opens the system browser for an authorization-code (PKCE) sign-in on a loopback redirect URI. See the **IdP setup** notes on `inferenceIdpOidc` for redirect-URI registration. +> * **`broker`** — signs in through the OS identity broker (Web Account Manager on Windows, Company Portal on macOS). Requires the IdP to be **Microsoft Entra ID** — the `issuer` on `inferenceIdpOidc` must be `https://login.microsoftonline.com/{tenant-id}/v2.0`. The broker satisfies Conditional Access policies that require a compliant/managed device or token protection, and needs no loopback redirect. The Entra app registration must include the broker redirect URIs `ms-appx-web://Microsoft.AAD.BrokerPlugin/{client-id}` (Windows) and `msauth.com.anthropic.claudefordesktop://auth` (macOS) under the **Mobile and desktop applications** platform. Not supported on Linux. +> +> Broker mode mints a token in the customer's own Entra tenant with the customer-configured `scopes` and forwards it to the customer's own gateway or proxy; both endpoints of that trust relationship are inside the customer's control. + +> **inferenceIdpOidc details** +> +> Used with `inferenceCredentialKind: "external-idp"`. The app discovers `/.well-known/openid-configuration`, runs an OIDC authorization-code (PKCE) sign-in in the browser with `clientId` (or through the OS broker, see `inferenceIdpAuthFlow`) and sends the token as `Authorization: Bearer` on every inference request: to `inferenceGatewayBaseUrl` on the gateway provider, or on Bedrock to `inferenceBedrockBaseUrl`, which is then required: only a proxy that validates the token accepts it, never Amazon Bedrock itself (to sign in straight to Bedrock use `interactive`, AWS IAM Identity Center). On Bedrock this kind has no model discovery: list the models in `inferenceModels`. +> +> **Bearer token type.** `id_token` (the default) sends the OIDC ID token; the receiver validates signature, `iss` and `aud` (the `clientId` here). `access_token` sends the OAuth access token, for gateways and proxies that validate as an OAuth resource server; `scopes` must then name the registered API scope. Either way the receiver must check `aud`, or it accepts any token from your tenant. +> +> **IdP setup.** The callback is `http://127.0.0.1:/callback` (`localhost` with `redirectHost: "localhost"`); register exactly that. **Entra:** a public-client app with a *Mobile and desktop applications* redirect URI `http://127.0.0.1/callback` (omitting the path fails with `AADSTS50011`); in `access_token` mode also grant the API's delegated permission, or sign-in fails with `AADSTS65001`. **Okta:** a *Native* app with `http://127.0.0.1:/callback` and that port in `redirectPort`. +> +> **Refresh.** With `offline_access` the app renews the token silently and asks for a browser sign-in only when refresh fails (Google returns no `id_token` on refresh, so `id_token` mode there re-prompts about hourly). +> +> **Older names.** Gateway configurations written before this key use `inferenceGatewayOidc` / `inferenceGatewayOidcAuthFlow` with the `interactive` kind; they stay readable and mean the same sign-in. +> +> | Field | Type | Default | Description | +> | - | - | - | - | +> | `clientId` | `string` | — | OAuth client ID of the desktop app registration at your identity provider (public client, PKCE). | +> | `issuer` | `string` | — | HTTPS issuer with OIDC discovery. Set this, or set the authorization and token URLs instead. | +> | `authorizationUrl` | `string` | — | HTTPS authorization endpoint. Used with the token URL when no issuer is set. | +> | `tokenUrl` | `string` | — | HTTPS token endpoint. Used with the authorization URL when no issuer is set. | +> | `bearerTokenType` | `enum` | `id_token` | Which token to send as the bearer. Use access token for a gateway or proxy that validates as an OAuth resource server. One of: `id_token`, `access_token`. | +> | `scopes` | `string` | — | Space-separated scopes. Required in access-token mode: set the gateway or proxy API scope. offline\_access is appended automatically unless disabled below. | +> | `appendOfflineAccess` | `boolean` | `true` | Automatically append offline\_access to scopes so the IdP returns a refresh token for silent refresh. | +> | `resource` | `string` | — | Access-token audience of the gateway or proxy: an https URL or an AD FS relying-party identifier, sent as the RFC 8707 resource. Leave unset for Entra ID. | +> | `redirectPort` | `integer` | — | Fixed loopback port for the sign-in redirect. Leave unset to use a free port each time. | +> | `redirectHost` | `enum` | — | Use localhost only if your IdP’s registered redirect URI specifies it. One of: `127.0.0.1`, `localhost`. | +> | `additionalRedirectReferrerHosts` | `string` | — | Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host. | ### Models | Setting | Type | Availability | Default | Description | | - | - | - | - | - | -| Model discovery
`modelDiscoveryEnabled` | `boolean` | MDM + Bootstrap
Added in 1.8089.0 | — | Auto-populate the model picker from the provider at launch. | -| Use 1M wherever it’s available
`modelPrefer1mContext` | `boolean` | MDM + Bootstrap
Added in 1.28929.0 | — | Every model that offers 1M, in your list or from your gateway, shows one option and requests 1M. | -| Model list
`inferenceModels` | `object[]` | MDM + Bootstrap
Added in 1.2581.0 | — | Override the auto-discovered model list. First entry is the default. | -| Default model effort
`defaultModelEffort` | `enum` | MDM + Bootstrap
Added in 2.110.0 | — | Effort level the default model (the first listed model) starts at, instead of Anthropic’s recommended level: low, medium, high, xhigh or max. One of: `low`, `medium`, `high`, `xhigh`, `max`. | -| Always start with the default model
`alwaysStartWithDefaultModel` | `boolean` | MDM + Bootstrap
Added in 2.110.0 | — | When true, each new conversation or task starts on the default model, and a person’s model and effort changes are no longer saved as their default. | -| Show estimated cost
`inferenceModelPricingEnabled` | `boolean` | MDM + Bootstrap
Added in 1.37937.0 | — | Show an estimated cost on the Usage page at Anthropic list price; turn on to set a multiplier or per-model rates. | -| Price multiplier
`inferenceModelPricingMultiplier` | `number` | MDM + Bootstrap
Added in 1.37937.0 | — | Scales every estimated cost (0.85 = 85% of the price); between 0 and 1. Range: 0–1. | -| Model pricing
`inferenceModelPricing` | `object[]` | MDM + Bootstrap
Added in 1.37937.0 | — | Per-model rates replacing Anthropic list price in the Usage page’s estimate. | -| Model catalog metadata
`modelCatalogEnabled` | `boolean` | MDM + Bootstrap
Added in 2.110.0 | — | Fetch the published Claude Code model catalog to get model picker names, descriptions, and effort options. When off, the app uses only its bundled copy. | -| Model catalog URL
`modelCatalogUrl` | `string` | MDM + Bootstrap
Added in 2.110.0 | — | Fetch the model catalog and its signature file from this URL (a mirror inside your network serving Anthropic’s published files) instead of downloads.claude.ai. | - - - - Auto-populate the model picker from the provider's model-list endpoint at launch. For gateway and Anthropic providers, a config that doesn't set this key skips discovery automatically when the model list below already makes it unnecessary; the toggle here only sets it explicitly on or off. Turn off if the endpoint isn't reachable from your network, or to use a fixed list. When off, the model list below is required and must use full model IDs (aliases like sonnet/opus are resolved via discovery). - - - - Every model that offers a 1M-token context window shows one option in the model picker, and sessions on it request 1M from your provider. A model offers 1M when its `inferenceModels` entry sets `supports1m` or, under discovery, when your gateway's model list marks it. Equivalent to setting `prefer1m` on each of those entries, but also applies under dynamic discovery. To leave one listed model out, remove its `supports1m`. Beside a model list in which no entry sets `supports1m`, this setting does nothing. Older Claude Desktop versions show both options and only start the default model on its 1M option. - - - - Use the **provider's exact model ID**: Vertex publisher IDs (`claude-sonnet-5`), Bedrock inference-profile IDs (`us.anthropic.claude-sonnet-5`), or Foundry deployment names. Entries may be plain ID strings or objects. - - **Gateway:** the `name` must be the exact ID your gateway's `/v1/models` endpoint returns. If you set `supports1m` on an alias (`sonnet`) but discovery returns the full ID, the variant won't appear. - - **Extended context** (`supports1m`) is a capability assertion you make about your deployment; only set it for models you've confirmed support the 1M-token window: - - ```json theme={null} - [{"name": "claude-sonnet-5", "supports1m": true}, "claude-opus-4-8"] - ``` - - `"claude-sonnet-5[1m]"` is shorthand for the same entry. When an ID is listed both bare and with `[1m]` (as a gateway lists it), the picker shows one model with a 1M variant; put `labelOverride` on the bare entry (a label on the `[1m]` spelling is ignored there); tier-tagged entries are not folded. `prefer1m: true` (no effect without `supports1m`) shows only the 1M variant of the model. Under dynamic discovery (no explicit list), set `modelPrefer1mContext` instead. - - **Display label** (`labelOverride`) is for IDs the picker can't derive a friendly name from (Bedrock ARNs, gateway routing aliases). Display-only; `name` is still what the app sends: - - ```json theme={null} - [{"name": "arn:aws:bedrock:us-east-1:123:application-inference-profile/abc", "labelOverride": "Claude Opus (Prod)"}] - ``` - - **Tier mapping** (`anthropicFamilyTier`) tells the app which Claude tier (`haiku`/`sonnet`/`opus`/`fable`/`mythos`) an entry stands in for, so bare tier aliases (e.g. in Code sessions) resolve to your model. `isFamilyDefault: true` picks the winner when several entries share a tier: - - ```json theme={null} - [{"name": "us.anthropic.claude-opus-4-8", "anthropicFamilyTier": "opus"}] - ``` - - | Field | Type | Default | Description | - | - | - | - | - | - | `name` | `string` | — | Model ID exactly as the provider expects it. The first entry is the default model. | - | `labelOverride` | `string` | — | Shown in the model picker. Leave blank to auto-format from the ID. | - | `supports1m` | `boolean` | — | Adds a 1M-context variant of this model to the picker. Set only if the deployment accepts 1M-token context for it. | - | `prefer1m` | `boolean` | — | Shows one option for this model and requests 1M from your provider. Does nothing unless the entry offers 1M. | - | `anthropicFamilyTier` | `enum` | — | Which Claude tier this model stands in for. Pins the bare alias (e.g. ‘opus’) and, for opus/fable, the refusal fallback. One of: `sonnet`, `opus`, `haiku`, `fable`, `mythos`. | - | `isFamilyDefault` | `boolean` | — | When several models share a tier alias, marks this one as the model the alias resolves to. Otherwise the first listed wins. | - | `maxEffort` | `enum` | — | Highest effort level offered for this model; higher levels are hidden and never requested by Claude Desktop. An unrecognized value caps the model at low. One of: `low`, `medium`, `high`, `xhigh`, `max`. | - - - - The effort level the default model (the first `inferenceModels` entry, or the first model your endpoint returns under discovery) starts at in Chat, Cowork and Code, in place of Anthropic's recommended level for that model: one of `low`, `medium`, `high`, `xhigh`, `max`. It is a starting point, not a lock: a person's own effort choice for that model still applies unless `alwaysStartWithDefaultModel` is on, and other models keep their recommended level. A level the model doesn't offer falls to the nearest level it offers below it (its lowest level when none is lower), and it never exceeds that model's `maxEffort`. In Code sessions a `CLAUDE_CODE_EFFORT_LEVEL` environment variable or an `effortLevel` in Claude Code's own settings still takes precedence, as it does over any picker default. - - - - When `true`, each new conversation or task in Chat, Cowork and Code starts on the default model (the first `inferenceModels` entry), and the model and effort choices a person makes are no longer saved as their defaults. When unset or `false`, a person's last model and effort choice is remembered per tab, as before. Choices saved before the setting was turned on are kept and apply again if it is turned off. - - - - Off unless set: the Usage page shows token counts only, since the app cannot know your negotiated provider rates. `true` turns on a USD estimate priced at Anthropic's published list price and is the only switch that does: `inferenceModelPricingMultiplier` and `inferenceModelPricing` refine the estimate while this is on and are ignored otherwise; turning this off hides them in the config editors without clearing them. Claude Code performs the calculation, so the same figures appear in its own cost reporting for Code sessions. Model IDs Claude Code cannot map to a Claude model (an opaque gateway alias, an inference-profile ARN it cannot resolve) are left out of the estimate until `inferenceModelPricing` gives them a rate. A machine-level Claude Code managed `modelPricing` (MDM / managed-settings.json / server-managed) takes precedence over all three keys. - - - - Mirrors Claude Code's managed `modelPricing.multiplier`: a number in (0, 1] applied to every computed cost, whether the model was priced at Anthropic list price or by an `inferenceModelPricing` row; use it for a flat contracted discount. Applies only while `inferenceModelPricingEnabled` is `true`; on its own it does not turn the estimate on. Ignored when a machine-level Claude Code managed `modelPricing` is present. - - - - Each row replaces Anthropic list price for one model in the Usage page's estimate, in USD per million tokens (`inputPerMtok`, `outputPerMtok`, `cacheReadPerMtok`, `cacheWritePerMtok`, all four required; `cacheWritePerMtok` prices both 5-minute and 1-hour cache writes); rows apply only while `inferenceModelPricingEnabled` is `true` and do not turn the estimate on by themselves. Mirrors Claude Code's managed `modelPricing.overrides`, and `name` is matched the same way: a built-in Claude model ID (e.g. `claude-sonnet-4-6`, or its Bedrock, Vertex, or Foundry ID) covers every dated and provider spelling of that model; any other value (a gateway alias, an inference-profile ARN) matches that exact ID only (case-insensitive) and wins over a built-in row. An ID Claude Code cannot map to a Claude model at all gets no estimate until a row here prices it. `inferenceModelPricingMultiplier` still applies on top of a row. - - ```json theme={null} - {"inferenceModelPricingEnabled": true, "inferenceModelPricingMultiplier": 0.9, "inferenceModelPricing": [{"name": "claude-sonnet-4-6", "inputPerMtok": 2.4, "outputPerMtok": 12, "cacheReadPerMtok": 0.24, "cacheWritePerMtok": 3}]} - ``` - - These are estimates for visibility, not an invoice; your provider bills at its own rates. A machine-level Claude Code managed `modelPricing` (MDM / managed-settings.json / server-managed) takes precedence over this table. - - | Field | Type | Default | Description | - | - | - | - | - | - | `name` | `string` | — | A model ID from the list above, or any other ID or alias your provider serves. A built-in Claude ID also covers its dated and provider forms. | - | `inputPerMtok` | `number` | — | USD per million input tokens. | - | `outputPerMtok` | `number` | — | USD per million output tokens. | - | `cacheReadPerMtok` | `number` | — | USD per million prompt-cache read tokens. | - | `cacheWritePerMtok` | `number` | — | USD per million prompt-cache write tokens (5-minute and 1-hour writes alike). | - - - - When on (the default), the app reads the model catalog Anthropic publishes for Claude Code (a signed document fetched from `downloads.claude.ai`, or from `modelCatalogUrl` when that is set, and verified against a key built into the app; a copy bundled with the app is used until one has been fetched, or when the host is unreachable) and uses it to fill in each picker entry's display name, description, and thinking/effort options in the Chat, Cowork, and Code tabs. It never changes which models are offered, their order, or the default model (the first `inferenceModels` entry): those, 1M-context variants, and `labelOverride` still come from `inferenceModels` / discovery, and a model the catalog does not list keeps the built-in label. With `modelCatalogEnabled: false`, the app makes no catalog request and ignores any copy it fetched earlier. Picker names, descriptions, effort options, and recommended effort levels then come from the copy bundled with the installed app version, so they change only with app updates; `labelOverride`, `defaultModelEffort`, and `maxEffort` still apply. A model that copy does not list, typically one released after that version, may show no effort options until the app is updated. Applies to deployments configured on the device or by a bootstrap server; an install managed from the Claude admin console takes its model names and options from the console's settings and never fetches the catalog. - - - - When set, the app fetches the catalog document and its signature file (the same URL with `.raw-sig.json` appended to the path) from this URL instead of `https://downloads.claude.ai/model-catalog/v1/catalog.json`, for a gateway or mirror inside your network serving Anthropic's two published files byte-for-byte. The document is still verified against the key built into the app, so an edited or re-signed copy is refused and the app keeps its last verified copy (or the bundled one); there is no key to configure. `https://` is required (`http://` only to a loopback address, and only when set on the device itself; a bootstrap server may not deliver a loopback or non-`https://` value); the server must answer the GET directly (redirects are not followed) and may honor `If-None-Match` with `304`, and must serve a document at least as new as the one the install last accepted (or the bundled seed) — an older one is refused and re-fetched on the retry interval until the mirror catches up. Ignored when `modelCatalogEnabled` is `false`, and on an install managed from the Claude admin console (which never fetches the catalog). A value that is not a valid URL, names a link-local or cloud-metadata host (e.g. `169.254.169.254`, `metadata.google.internal`), or is a loopback / non-`https://` value a bootstrap server delivers, turns the catalog fetch off (no fallback to `downloads.claude.ai`); the last fetched or bundled copy keeps labelling the pickers. On an install configured for a bootstrap server, the default location is not fetched until the server's configuration applies after sign-in, so a device does not poll `downloads.claude.ai` while the server may yet name a mirror; a mirror URL set on the device, cached earlier, or served in a pre-sign-in subset still fetches. Diagnostics report the location only as `hosted`, `custom`, `invalid` or `pending`; the value itself is treated like `bootstrapUrl`: host name only in telemetry, printed in full in the diagnostics bundle. - - +| Model discovery `modelDiscoveryEnabled` | `boolean` | MDM + Bootstrap Added in 1.8089.0 | — | Auto-populate the model picker from the provider at launch. | +| Use 1M wherever it’s available `modelPrefer1mContext` | `boolean` | MDM + Bootstrap Added in 1.28929.0 | — | Every model that offers 1M, in your list or from your gateway, shows one option and requests 1M. | +| Model list `inferenceModels` | `object[]` | MDM + Bootstrap Added in 1.2581.0 | — | Override the auto-discovered model list. First entry is the default. | +| Default model effort `defaultModelEffort` | `enum` | MDM + Bootstrap Added in 2.110.0 | — | Effort level the default model (the first listed model) starts at, instead of Anthropic’s recommended level: low, medium, high, xhigh or max. One of: `low`, `medium`, `high`, `xhigh`, `max`. | +| Always start with the default model `alwaysStartWithDefaultModel` | `boolean` | MDM + Bootstrap Added in 2.110.0 | — | When true, each new conversation or task starts on the default model, and a person’s model and effort changes are no longer saved as their default. | +| Show estimated cost `inferenceModelPricingEnabled` | `boolean` | MDM + Bootstrap Added in 1.37937.0 | — | Show an estimated cost on the Usage page at Anthropic list price; turn on to set a multiplier or per-model rates. | +| Price multiplier `inferenceModelPricingMultiplier` | `number` | MDM + Bootstrap Added in 1.37937.0 | — | Scales every estimated cost (0.85 = 85% of the price); between 0 and 1. Range: 0–1. | +| Model pricing `inferenceModelPricing` | `object[]` | MDM + Bootstrap Added in 1.37937.0 | — | Per-model rates replacing Anthropic list price in the Usage page’s estimate. | +| Model catalog metadata `modelCatalogEnabled` | `boolean` | MDM + Bootstrap Added in 2.110.0 | — | Fetch the published Claude Code model catalog to get model picker names, descriptions, and effort options. When off, the app uses only its bundled copy. | +| Model catalog URL `modelCatalogUrl` | `string` | MDM + Bootstrap Added in 2.110.0 | — | Fetch the model catalog and its signature file from this URL (a mirror inside your network serving Anthropic’s published files) instead of downloads.claude.ai. | + +> **modelDiscoveryEnabled details** +> +> Auto-populate the model picker from the provider's model-list endpoint at launch. For gateway and Anthropic providers, a config that doesn't set this key skips discovery automatically when the model list below already makes it unnecessary; the toggle here only sets it explicitly on or off. Turn off if the endpoint isn't reachable from your network, or to use a fixed list. When off, the model list below is required and must use full model IDs (aliases like sonnet/opus are resolved via discovery). + +> **modelPrefer1mContext details** +> +> Every model that offers a 1M-token context window shows one option in the model picker, and sessions on it request 1M from your provider. A model offers 1M when its `inferenceModels` entry sets `supports1m` or, under discovery, when your gateway's model list marks it. Equivalent to setting `prefer1m` on each of those entries, but also applies under dynamic discovery. To leave one listed model out, remove its `supports1m`. Beside a model list in which no entry sets `supports1m`, this setting does nothing. Older Claude Desktop versions show both options and only start the default model on its 1M option. + +> **inferenceModels details** +> +> Use the **provider's exact model ID**: Vertex publisher IDs (`claude-sonnet-5`), Bedrock inference-profile IDs (`us.anthropic.claude-sonnet-5`), or Foundry deployment names. Entries may be plain ID strings or objects. +> +> **Gateway:** the `name` must be the exact ID your gateway's `/v1/models` endpoint returns. If you set `supports1m` on an alias (`sonnet`) but discovery returns the full ID, the variant won't appear. +> +> **Extended context** (`supports1m`) is a capability assertion you make about your deployment; only set it for models you've confirmed support the 1M-token window: +> +> ```json theme={null} theme={null} theme={null} +> [{"name": "claude-sonnet-5", "supports1m": true}, "claude-opus-4-8"] +> ``` +> +> `"claude-sonnet-5[1m]"` is shorthand for the same entry. When an ID is listed both bare and with `[1m]` (as a gateway lists it), the picker shows one model with a 1M variant; put `labelOverride` on the bare entry (a label on the `[1m]` spelling is ignored there); tier-tagged entries are not folded. `prefer1m: true` (no effect without `supports1m`) shows only the 1M variant of the model. Under dynamic discovery (no explicit list), set `modelPrefer1mContext` instead. +> +> **Display label** (`labelOverride`) is for IDs the picker can't derive a friendly name from (Bedrock ARNs, gateway routing aliases). Display-only; `name` is still what the app sends: +> +> ```json theme={null} theme={null} theme={null} +> [{"name": "arn:aws:bedrock:us-east-1:123:application-inference-profile/abc", "labelOverride": "Claude Opus (Prod)"}] +> ``` +> +> **Tier mapping** (`anthropicFamilyTier`) tells the app which Claude tier (`haiku`/`sonnet`/`opus`/`fable`/`mythos`) an entry stands in for, so bare tier aliases (e.g. in Code sessions) resolve to your model. `isFamilyDefault: true` picks the winner when several entries share a tier: +> +> ```json theme={null} theme={null} theme={null} +> [{"name": "us.anthropic.claude-opus-4-8", "anthropicFamilyTier": "opus"}] +> ``` +> +> **Auto mode on a gateway:** its safety classifier calls `claude-sonnet-5` by default, so include that exact ID in the list (see `autoModeEnabled`). +> +> | Field | Type | Default | Description | +> | - | - | - | - | +> | `name` | `string` | — | Model ID exactly as the provider expects it. The first entry is the default model. | +> | `labelOverride` | `string` | — | Shown in the model picker. Leave blank to auto-format from the ID. | +> | `supports1m` | `boolean` | — | Adds a 1M-context variant of this model to the picker. Set only if the deployment accepts 1M-token context for it. | +> | `prefer1m` | `boolean` | — | Shows one option for this model and requests 1M from your provider. Does nothing unless the entry offers 1M. | +> | `anthropicFamilyTier` | `enum` | — | Which Claude tier this model stands in for. Pins the bare alias (e.g. ‘opus’) and, for opus/fable, the refusal fallback. One of: `sonnet`, `opus`, `haiku`, `fable`, `mythos`. | +> | `isFamilyDefault` | `boolean` | — | When several models share a tier alias, marks this one as the model the alias resolves to. Otherwise the first listed wins. | +> | `maxEffort` | `enum` | — | Highest effort level offered for this model; higher levels are hidden and never requested by Claude Desktop. An unrecognized value caps the model at low. One of: `low`, `medium`, `high`, `xhigh`, `max`. | + +> **defaultModelEffort details** +> +> The effort level the default model (the first `inferenceModels` entry, or the first model your endpoint returns under discovery) starts at in Chat, Cowork and Code, in place of Anthropic's recommended level for that model: one of `low`, `medium`, `high`, `xhigh`, `max`. It is a starting point, not a lock: a person's own effort choice for that model still applies unless `alwaysStartWithDefaultModel` is on, and other models keep their recommended level. A level the model doesn't offer falls to the nearest level it offers below it (its lowest level when none is lower), and it never exceeds that model's `maxEffort`. In Code sessions a `CLAUDE_CODE_EFFORT_LEVEL` environment variable or an `effortLevel` in Claude Code's own settings still takes precedence, as it does over any picker default. + +> **alwaysStartWithDefaultModel details** +> +> When `true`, each new conversation or task in Chat, Cowork and Code starts on the default model (the first `inferenceModels` entry), and the model and effort choices a person makes are no longer saved as their defaults. When unset or `false`, a person's last model and effort choice is remembered per tab, as before. Choices saved before the setting was turned on are kept and apply again if it is turned off. + +> **inferenceModelPricingEnabled details** +> +> Off unless set: the Usage page shows token counts only, since the app cannot know your negotiated provider rates. `true` turns on a USD estimate priced at Anthropic's published list price and is the only switch that does: `inferenceModelPricingMultiplier` and `inferenceModelPricing` refine the estimate while this is on and are ignored otherwise; turning this off hides them in the config editors without clearing them. Claude Code performs the calculation, so the same figures appear in its own cost reporting for Code sessions. Model IDs Claude Code cannot map to a Claude model (an opaque gateway alias, an inference-profile ARN it cannot resolve) are left out of the estimate until `inferenceModelPricing` gives them a rate. A machine-level Claude Code managed `modelPricing` (MDM / managed-settings.json / server-managed) takes precedence over all three keys. + +> **inferenceModelPricingMultiplier details** +> +> Mirrors Claude Code's managed `modelPricing.multiplier`: a number in (0, 1] applied to every computed cost, whether the model was priced at Anthropic list price or by an `inferenceModelPricing` row; use it for a flat contracted discount. Applies only while `inferenceModelPricingEnabled` is `true`; on its own it does not turn the estimate on. Ignored when a machine-level Claude Code managed `modelPricing` is present. + +> **inferenceModelPricing details** +> +> Each row replaces Anthropic list price for one model in the Usage page's estimate, in USD per million tokens (`inputPerMtok`, `outputPerMtok`, `cacheReadPerMtok`, `cacheWritePerMtok`, all four required; `cacheWritePerMtok` prices both 5-minute and 1-hour cache writes); rows apply only while `inferenceModelPricingEnabled` is `true` and do not turn the estimate on by themselves. Mirrors Claude Code's managed `modelPricing.overrides`, and `name` is matched the same way: a built-in Claude model ID (e.g. `claude-sonnet-4-6`, or its Bedrock, Vertex, or Foundry ID) covers every dated and provider spelling of that model; any other value (a gateway alias, an inference-profile ARN) matches that exact ID only (case-insensitive) and wins over a built-in row. An ID Claude Code cannot map to a Claude model at all gets no estimate until a row here prices it. `inferenceModelPricingMultiplier` still applies on top of a row. +> +> ```json theme={null} theme={null} theme={null} +> {"inferenceModelPricingEnabled": true, "inferenceModelPricingMultiplier": 0.9, "inferenceModelPricing": [{"name": "claude-sonnet-4-6", "inputPerMtok": 2.4, "outputPerMtok": 12, "cacheReadPerMtok": 0.24, "cacheWritePerMtok": 3}]} +> ``` +> +> These are estimates for visibility, not an invoice; your provider bills at its own rates. A machine-level Claude Code managed `modelPricing` (MDM / managed-settings.json / server-managed) takes precedence over this table. +> +> | Field | Type | Default | Description | +> | - | - | - | - | +> | `name` | `string` | — | A model ID from the list above, or any other ID or alias your provider serves. A built-in Claude ID also covers its dated and provider forms. | +> | `inputPerMtok` | `number` | — | USD per million input tokens. | +> | `outputPerMtok` | `number` | — | USD per million output tokens. | +> | `cacheReadPerMtok` | `number` | — | USD per million prompt-cache read tokens. | +> | `cacheWritePerMtok` | `number` | — | USD per million prompt-cache write tokens (5-minute and 1-hour writes alike). | + +> **modelCatalogEnabled details** +> +> When on (the default), the app reads the model catalog Anthropic publishes for Claude Code (a signed document fetched from `downloads.claude.ai`, or from `modelCatalogUrl` when that is set, and verified against a key built into the app; a copy bundled with the app is used until one has been fetched, or when the host is unreachable) and uses it to fill in each picker entry's display name, description, and thinking/effort options in the Chat, Cowork, and Code tabs. It never changes which models are offered, their order, or the default model (the first `inferenceModels` entry): those, 1M-context variants, and `labelOverride` still come from `inferenceModels` / discovery, and a model the catalog does not list keeps the built-in label. With `modelCatalogEnabled: false`, the app makes no catalog request and ignores any copy it fetched earlier. Picker names, descriptions, effort options, and recommended effort levels then come from the copy bundled with the installed app version, so they change only with app updates; `labelOverride`, `defaultModelEffort`, and `maxEffort` still apply. A model that copy does not list, typically one released after that version, may show no effort options until the app is updated. Applies to deployments configured on the device or by a bootstrap server; an install managed from the Claude admin console takes its model names and options from the console's settings and never fetches the catalog. + +> **modelCatalogUrl details** +> +> When set, the app fetches the catalog document and its signature file (the same URL with `.raw-sig.json` appended to the path) from this URL instead of `https://downloads.claude.ai/model-catalog/v1/catalog.json`, for a gateway or mirror inside your network serving Anthropic's two published files byte-for-byte. The document is still verified against the key built into the app, so an edited or re-signed copy is refused and the app keeps its last verified copy (or the bundled one); there is no key to configure. `https://` is required (`http://` only to a loopback address, and only when set on the device itself; a bootstrap server may not deliver a loopback or non-`https://` value); the server must answer the GET directly (redirects are not followed) and may honor `If-None-Match` with `304`, and must serve a document at least as new as the one the install last accepted (or the bundled seed) — an older one is refused and re-fetched on the retry interval until the mirror catches up. Ignored when `modelCatalogEnabled` is `false`, and on an install managed from the Claude admin console (which never fetches the catalog). A value that is not a valid URL, names a link-local or cloud-metadata host (e.g. `169.254.169.254`, `metadata.google.internal`), or is a loopback / non-`https://` value a bootstrap server delivers, turns the catalog fetch off (no fallback to `downloads.claude.ai`); the last fetched or bundled copy keeps labelling the pickers. On an install configured for a bootstrap server, the default location is not fetched until the server's configuration applies after sign-in, so a device does not poll `downloads.claude.ai` while the server may yet name a mirror; a mirror URL set on the device, cached earlier, or served in a pre-sign-in subset still fetches. Diagnostics report the location only as `hosted`, `custom`, `invalid` or `pending`; the value itself is treated like `bootstrapUrl`: host name only in telemetry, printed in full in the diagnostics bundle. ### Vertex | Setting | Type | Availability | Default | Description | | - | - | - | - | - | -| GCP project ID
`inferenceVertexProjectId` | `string` | MDM + Bootstrap
Added in 1.2581.0 | — | Google Cloud project ID for Vertex AI inference. | -| GCP region
`inferenceVertexRegion` | `string` | MDM + Bootstrap
Added in 1.2581.0 | — | GCP region where your Vertex AI Claude models are deployed. | -| Vertex AI base URL
`inferenceVertexBaseUrl` | `string` | MDM + Bootstrap
Added in 1.2581.0 | — | PSC endpoint, if using one. | -| Vertex OAuth client ID
`inferenceVertexOAuthClientId` | `string` | MDM + Bootstrap
Added in 1.2581.0 | — | Desktop-app OAuth client ID. Enables Sign in with Google instead of a credentials file. | -| Vertex OAuth client secret
`inferenceVertexOAuthClientSecret` | `string` | MDM + Bootstrap
Added in 1.2581.0 | — | Secret for the Desktop-app OAuth client above. Google classifies installed-app client secrets as non-confidential, so this may be set from hosted config. | -| Vertex OAuth scopes
`inferenceVertexOAuthScopes` | `string` | MDM + Bootstrap
Added in 1.2581.0 | — | Override the Google OAuth scopes (space-separated). Leave blank for the default. | -| Vertex OAuth login hint
`inferenceVertexOAuthLoginHint` | `string` | MDM + Bootstrap
Added in 1.12603.0 | — | Pre-fill Google's account chooser and forward to your federated IdP. \{username} expands to the OS login name. | -| Workforce Identity audience
`inferenceVertexWorkforceAudience` | `string` | MDM + Bootstrap
Added in 1.10628.0 | — | Workforce-pool provider audience. When set, sign-in uses your own IdP plus a GCP STS exchange instead of a Google identity. | -| Workforce Identity billing project
`inferenceVertexWorkforceUserProject` | `string` | MDM + Bootstrap
Added in 1.10628.0 | — | GCP project for STS billing and quota. Defaults to the Vertex project ID above. | -| Workforce Identity sign-in flow
`inferenceVertexWorkforceAuthFlow` | `enum` | MDM + Bootstrap
Added in 1.25927.0 | — | How the IdP sign-in runs: system browser (default) or the OS Microsoft Entra broker. One of: `browser`, `broker`. | -| Workforce Identity IdP (OIDC)
`inferenceVertexWorkforceOidc` | `object` | MDM + Bootstrap
Added in 1.10628.0 | — | Your organization’s OIDC IdP. The app runs an authorization-code-with-PKCE flow against this issuer and exchanges the returned ID token at GCP STS. | -| GCP credentials file path
`inferenceVertexCredentialsFile` | `string` | MDM + Bootstrap
Added in 1.2581.0 | — | Absolute path to service-account JSON. Leave blank to fall back to ADC. | - - - - * **`browser`** (default) — opens the system browser for an authorization-code (PKCE) sign-in on a loopback redirect URI. See the **IdP setup** notes on `inferenceGatewayOidc` for redirect-URI registration; the same rules apply here. - * **`broker`** — signs in through the OS identity broker (Web Account Manager on Windows, Company Portal on macOS). Requires the workforce-pool IdP to be **Microsoft Entra ID** — the `issuer` on `inferenceVertexWorkforceOidc` must be `https://login.microsoftonline.com/{tenant-id}/v2.0`. The broker satisfies Conditional Access policies that require a compliant/managed device or token protection, and needs no loopback redirect. The Entra app registration must include the broker redirect URIs `ms-appx-web://Microsoft.AAD.BrokerPlugin/{client-id}` (Windows) and `msauth.com.anthropic.claudefordesktop://auth` (macOS) under the **Mobile and desktop applications** platform. Not supported on Linux. - - The GCP STS token-exchange step is unchanged in either flow; only how the Entra id\_token is acquired differs. - - - - | Field | Type | Default | Description | - | - | - | - | - | - | `clientId` | `string` | — | OAuth client ID of the desktop app registration at your identity provider (public client, PKCE). | - | `issuer` | `string` | — | HTTPS issuer with OIDC discovery. Set this, or set the authorization and token URLs instead. | - | `authorizationUrl` | `string` | — | HTTPS authorization endpoint. Used with the token URL when no issuer is set. | - | `tokenUrl` | `string` | — | HTTPS token endpoint. Used with the authorization URL when no issuer is set. | - | `scopes` | `string` | — | Space-separated scopes. Defaults to openid profile email offline\_access. | - | `redirectPort` | `integer` | — | Fixed loopback port for the sign-in redirect. Leave unset to use a free port each time. | - | `redirectHost` | `enum` | — | Use localhost only if your IdP’s registered redirect URI specifies it. One of: `127.0.0.1`, `localhost`. | - | `omitOfflineAccess` | `boolean` | — | Only enable if your IdP rejects the offline\_access scope on this client. Without it the app prompts for sign-in each time the token expires. | - | `additionalRedirectReferrerHosts` | `string` | — | Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host. | - - +| GCP project ID `inferenceVertexProjectId` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | Google Cloud project ID for Vertex AI inference. | +| GCP region `inferenceVertexRegion` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | GCP region where your Vertex AI Claude models are deployed. | +| Vertex AI base URL `inferenceVertexBaseUrl` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | PSC endpoint, if using one. | +| Vertex OAuth client ID `inferenceVertexOAuthClientId` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | Desktop-app OAuth client ID. Enables Sign in with Google instead of a credentials file. | +| Vertex OAuth client secret `inferenceVertexOAuthClientSecret` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | Secret for the Desktop-app OAuth client above. Google classifies installed-app client secrets as non-confidential, so this may be set from hosted config. | +| Vertex OAuth scopes `inferenceVertexOAuthScopes` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | Override the Google OAuth scopes (space-separated). Leave blank for the default. | +| Vertex OAuth login hint `inferenceVertexOAuthLoginHint` | `string` | MDM + Bootstrap Added in 1.12603.0 | — | Pre-fill Google's account chooser and forward to your federated IdP. \{username} expands to the OS login name. | +| Workforce Identity audience `inferenceVertexWorkforceAudience` | `string` | MDM + Bootstrap Added in 1.10628.0 | — | Workforce-pool provider audience. When set, sign-in uses your own IdP plus a GCP STS exchange instead of a Google identity. | +| Workforce Identity billing project `inferenceVertexWorkforceUserProject` | `string` | MDM + Bootstrap Added in 1.10628.0 | — | GCP project for STS billing and quota. Defaults to the Vertex project ID above. | +| Workforce Identity sign-in flow `inferenceVertexWorkforceAuthFlow` | `enum` | MDM + Bootstrap Added in 1.25927.0 | — | How the IdP sign-in runs: system browser (default) or the OS Microsoft Entra broker. One of: `browser`, `broker`. | +| Workforce Identity IdP (OIDC) `inferenceVertexWorkforceOidc` | `object` | MDM + Bootstrap Added in 1.10628.0 | — | Your organization’s OIDC IdP. The app runs an authorization-code-with-PKCE flow against this issuer and exchanges the returned ID token at GCP STS. | +| GCP credentials file path `inferenceVertexCredentialsFile` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | Absolute path to service-account JSON. Leave blank to fall back to ADC. | + +> **inferenceVertexWorkforceAuthFlow details** +> +> * **`browser`** (default) — opens the system browser for an authorization-code (PKCE) sign-in on a loopback redirect URI. See the **IdP setup** notes on `inferenceGatewayOidc` for redirect-URI registration; the same rules apply here. +> * **`broker`** — signs in through the OS identity broker (Web Account Manager on Windows, Company Portal on macOS). Requires the workforce-pool IdP to be **Microsoft Entra ID** — the `issuer` on `inferenceVertexWorkforceOidc` must be `https://login.microsoftonline.com/{tenant-id}/v2.0`. The broker satisfies Conditional Access policies that require a compliant/managed device or token protection, and needs no loopback redirect. The Entra app registration must include the broker redirect URIs `ms-appx-web://Microsoft.AAD.BrokerPlugin/{client-id}` (Windows) and `msauth.com.anthropic.claudefordesktop://auth` (macOS) under the **Mobile and desktop applications** platform. Not supported on Linux. +> +> The GCP STS token-exchange step is unchanged in either flow; only how the Entra id\_token is acquired differs. + +> **inferenceVertexWorkforceOidc details** +> +> | Field | Type | Default | Description | +> | - | - | - | - | +> | `clientId` | `string` | — | OAuth client ID of the desktop app registration at your identity provider (public client, PKCE). | +> | `issuer` | `string` | — | HTTPS issuer with OIDC discovery. Set this, or set the authorization and token URLs instead. | +> | `authorizationUrl` | `string` | — | HTTPS authorization endpoint. Used with the token URL when no issuer is set. | +> | `tokenUrl` | `string` | — | HTTPS token endpoint. Used with the authorization URL when no issuer is set. | +> | `scopes` | `string` | — | Space-separated scopes. Defaults to openid profile email offline\_access. | +> | `redirectPort` | `integer` | — | Fixed loopback port for the sign-in redirect. Leave unset to use a free port each time. | +> | `redirectHost` | `enum` | — | Use localhost only if your IdP’s registered redirect URI specifies it. One of: `127.0.0.1`, `localhost`. | +> | `omitOfflineAccess` | `boolean` | — | Only enable if your IdP rejects the offline\_access scope on this client. Without it the app prompts for sign-in each time the token expires. | +> | `additionalRedirectReferrerHosts` | `string` | — | Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host. | ## Capabilities @@ -448,601 +440,614 @@ The reference below is generated from the configuration schema and grouped to ma | Setting | Type | Availability | Default | Description | | - | - | - | - | - | -| Disable Claude.ai sign-in
`disableDeploymentModeChooser` | `boolean` | MDM + Bootstrap
Added in 1.3834.0 | `false` | Users see only this provider at the login screen. The option to sign in to Claude.ai is hidden. Defaults to `false`. | -| Disable claude:// deep-link handling
`disableDeepLinkRegistration` | `boolean` | MDM + Bootstrap
Added in 1.6889.0 | `false` | Stop external apps and websites from opening Claude Desktop via claude:// links. Defaults to `false`. | +| Disable Claude.ai sign-in `disableDeploymentModeChooser` | `boolean` | MDM + Bootstrap Added in 1.3834.0 | `false` | Users see only this provider at the login screen. The option to sign in to Claude.ai is hidden. Defaults to `false`. | +| Disable claude:// deep-link handling `disableDeepLinkRegistration` | `boolean` | MDM + Bootstrap Added in 1.6889.0 | `false` | Stop external apps and websites from opening Claude Desktop via claude:// links. Defaults to `false`. | - - - Set in a device-management profile, this key also keeps that profile in charge. Without it, a user who signs in to Claude.ai with an organization whose Claude Desktop deployment is configured in the admin console moves the device to that organization's configuration, at later launches too. The profile then still supplies what no configuration server can deliver, such as the network proxy, and a few device safeguards, such as `sessionRetentionHold`; every other key, update keys included, comes from the organization's configuration. A profile that sets only app-behavior keys (`disableAutoUpdates`, …) and no other key, not even `forceLoginOrgUUID`, is not affected: it keeps those keys over the organization's configuration without this key, and adding this key there would make the profile the device's whole configuration. The account menu offers the way back to a profile that sets a provider or a server. `forceLoginOrgUUID` in the profile limits the move to the organizations it lists. A value served only by the profile's own `bootstrapUrl` server does not keep the device. - - +> **disableDeploymentModeChooser details** +> +> Set in a device-management profile, this key also keeps that profile in charge. Without it, a user who signs in to Claude.ai with an organization whose Claude Desktop deployment is configured in the admin console moves the device to that organization's configuration, at later launches too. The profile then still supplies what no configuration server can deliver, such as the network proxy, and a few device safeguards, such as `sessionRetentionHold`; every other key, update keys included, comes from the organization's configuration. A profile that sets only app-behavior keys (`disableAutoUpdates`, …) and no other key, not even `forceLoginOrgUUID`, is not affected: it keeps those keys over the organization's configuration without this key, and adding this key there would make the profile the device's whole configuration. The account menu offers the way back to a profile that sets a provider or a server. `forceLoginOrgUUID` in the profile limits the move to the organizations it lists. A value served only by the profile's own `bootstrapUrl` server does not keep the device. ### Built-in browser | Setting | Type | Availability | Default | Description | | - | - | - | - | - | -| Allow the built-in browser
`builtinBrowserEnabled` | `boolean` | MDM + Bootstrap
Added in 2.2553.0 | `false` | Offer the built-in browser in Cowork and Code sessions so users and Claude can open and work with web pages. Site sign-ins stay on the device until cleared. Defaults to `false`. | -| Default site policy in the built-in browser
`builtinBrowserDefaultDomainPolicy` | `enum` | MDM + Bootstrap
Added in 2.2553.0 | `allow` | Whether Claude may open sites in the built-in browser by default; the allowed or blocked list is the exception. Mirrors the Claude in Chrome site policy. One of: `allow`, `block`. Defaults to `allow`. | -| Allowed sites in the built-in browser
`builtinBrowserAllowedDomains` | `string[]` | MDM + Bootstrap
Added in 2.2553.0 | — | Sites Claude may open, read, and act on in the built-in browser when the default site policy is block. Users can still view other sites. | -| Blocked sites in the built-in browser
`builtinBrowserBlockedDomains` | `string[]` | MDM + Bootstrap
Added in 2.2553.0 | — | Sites Claude may not open, read, or act on in the built-in browser when the default site policy is allow. Users can still view them. | - - - - When enabled, Cowork and Code sessions get a built-in browser pane. Users can open any site in it; Claude can open, read, and act on pages with its browser tools once the user approves each site (private-network hosts ask again per action unless the user always allows the host). Pages load directly from the user's machine, so your network controls apply; the pane's sign-ins and cookies stay in the app's browser profile on the device until cleared. - - Off (default): no browser pane; Code sessions keep the localhost-only dev-server preview. With `bootstrapUrl` set, put this key in the served configuration: a device-profile value alone leaves the browser off. On an install managed from the Claude admin console this follows the console's Built-in browser switch. - - When a public site opens or is framed in the pane, and before Claude works with it, the app checks its address (query removed) against Anthropic's site safety list on `releases.claude.com`, signed out, with no account, organization, or device identifier (Claude admin console installs: as the signed-in member on `api.anthropic.com`). A site it blocks stays blocked to Claude under every key below. Private addresses, names resolving to them, and internal-suffix or single-label names are never sent (a name under a public domain is checked even if only your VPN resolves it). Allow `releases.claude.com` through your firewall: if a check fails, users can browse but Claude's page tools stay off for that site. - - `builtinBrowserDefaultDomainPolicy` and its two site lists restrict where Claude may browse. A separately deployed Claude Code [managed-settings](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings) file still applies: `disableBrowserExternalNavigation: true` keeps the browser off even with this key on, and `browserExternalPageTools: "disabled"` keeps the pane but turns Claude's page tools off for external sites. Takes effect after the app restarts. - - - - Applies when `builtinBrowserEnabled` is on, in both Cowork and Code sessions, and decides which sites Claude may open, read, or act on with its browser tools; users can still view any site themselves. `allow` (default): every site except entries in `builtinBrowserBlockedDomains`. `block`: no site except entries in `builtinBrowserAllowedDomains`. Under either policy `coworkEgressAllowedHosts`, when set to anything but `*`, is an outer bound: sites outside it are refused to Claude in the browser too. A site Anthropic's site safety list blocks stays blocked to Claude under either policy (see `builtinBrowserEnabled`); for a site the list only flags for confirmation, Claude asks the user before each of its actions under `allow`, and skips that confirmation only when the site matches a `builtinBrowserAllowedDomains` entry under `block`. A value that cannot be read is treated as `block` until it is fixed. - - The policy also limits what pages load: a page in the pane, including one a user opened, cannot load frames, scripts, images, or other content from a site the policy does not admit (a blocked page a user opens still loads content from its own site). Under `block`, or with a `coworkEgressAllowedHosts` list, include the CDN and API hosts your allowed sites depend on. - - This key and the two site lists work the same way as the Claude in Chrome site policy in the admin console. They are set separately here, except on an install managed from the Claude admin console, where they follow your organization's browser site permissions there. - - - - Used when `builtinBrowserDefaultDomainPolicy` is `block`; ignored under `allow`. A site matching an entry is one Claude may open and work with using its browser tools; every other external site is treated as blocked by your organization: Claude cannot open it, cannot read or act on it, and frames, popups, and redirects into it from a page Claude is working on are refused. A user can still type its address and view it themselves. Listing a site here never unblocks a site Anthropic's site safety list blocks (see `builtinBrowserEnabled`); for a site that list only flags for confirmation, an entry here is your organization vouching for it, so Claude works with it without asking before each action. - - Entries use the same grammar as `coworkEgressAllowedHosts`, except that bare `*` is dropped: as in Claude in Chrome, no allowed-sites entry opens every site. Set the policy to `allow` for that. A wildcard whose base is a public suffix (`*.co.uk`, `*.github.io`) is likewise ignored so an entry can never open a whole shared registry. Any other entry outside that grammar is kept but matches nothing (the app log and the editor name it); a value that cannot be read at all allows nothing until it is fixed. A plain hostname entry (`example.com`) also covers its `www.` form, and a `www.` entry covers the bare name, but no other subdomain. `localhost` dev servers are always reachable, so listing them changes nothing. - - Empty or unset (default): under `block`, Claude may open no external site. On an install managed from the Claude admin console this follows your organization's browser site permissions there. - - - - Used when `builtinBrowserDefaultDomainPolicy` is `allow` (the default); ignored under `block`. A site matching an entry is treated as blocked by your organization: Claude cannot open it, cannot read or act on it with its browser tools, and frames, popups, and redirects into it from a page Claude is working on are refused. A user can still type its address and view it themselves: the pane shows a "blocked by your organization's policy" banner and Claude's tools stay off there. To take the external browser away from users as well, deploy Claude Code's `disableBrowserExternalNavigation` managed setting instead. A blocked site is refused before the site safety check, so its address is never sent to Anthropic. - - Entries use the same grammar as `coworkEgressAllowedHosts`; `*` blocks every external site. An entry outside that grammar is kept but matches nothing (the app log and the editor name it); a value that cannot be read at all blocks every external site until it is fixed. As in Claude in Chrome, a plain hostname entry (`example.com`) also covers its `www.` form, and a `www.` entry covers the bare name, but no other subdomain. `localhost` dev servers are never affected. - - Use this key for exceptions inside an allowed egress wildcard or when egress is open. Empty or unset (default): no sites beyond the egress list are blocked. On an install managed from the Claude admin console this follows your organization's browser site permissions there. - - +| Allow the built-in browser `builtinBrowserEnabled` | `boolean` | MDM + Bootstrap Added in 2.2553.0 | `false` | Offer the built-in browser in Cowork and Code sessions so users and Claude can open and work with web pages. Site sign-ins stay on the device until cleared. Defaults to `false`. | +| Default site policy in the built-in browser `builtinBrowserDefaultDomainPolicy` | `enum` | MDM + Bootstrap Added in 2.2553.0 | `allow` | Whether Claude may open sites in the built-in browser by default; the allowed or blocked list is the exception. Mirrors the Claude in Chrome site policy. One of: `allow`, `block`. Defaults to `allow`. | +| Allowed sites in the built-in browser `builtinBrowserAllowedDomains` | `string[]` | MDM + Bootstrap Added in 2.2553.0 | — | Sites Claude may open, read, and act on in the built-in browser when the default site policy is block. Users can still view other sites. | +| Blocked sites in the built-in browser `builtinBrowserBlockedDomains` | `string[]` | MDM + Bootstrap Added in 2.2553.0 | — | Sites Claude may not open, read, or act on in the built-in browser when the default site policy is allow. Users can still view them. | + +> **builtinBrowserEnabled details** +> +> When enabled, Cowork and Code sessions get a built-in browser pane. Users can open any site in it; Claude can open, read, and act on pages with its browser tools once the user approves each site (private-network hosts ask again per action unless the user always allows the host). Pages load directly from the user's machine, so your network controls apply; the pane's sign-ins and cookies stay in the app's browser profile on the device until cleared. +> +> Off (default): no browser pane; Code sessions keep the localhost-only dev-server preview. With `bootstrapUrl` set, put this key in the served configuration: a device-profile value alone leaves the browser off. On an install managed from the Claude admin console this follows the console's Built-in browser switch. +> +> When a public site opens or is framed in the pane, and before Claude works with it, the app checks its address (query removed) against Anthropic's site safety list on `releases.claude.com`, signed out, with no account, organization, or device identifier (Claude admin console installs: as the signed-in member on `api.anthropic.com`). A site it blocks stays blocked to Claude under every key below. Private addresses, names resolving to them, and internal-suffix or single-label names are never sent (a name under a public domain is checked even if only your VPN resolves it). Allow `releases.claude.com` through your firewall: if a check fails, users can browse but Claude's page tools stay off for that site. +> +> `builtinBrowserDefaultDomainPolicy` and its two site lists restrict where Claude may browse. A separately deployed Claude Code [managed-settings](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings) file still applies: `disableBrowserExternalNavigation: true` keeps the browser off even with this key on, and `browserExternalPageTools: "disabled"` keeps the pane but turns Claude's page tools off for external sites. Takes effect after the app restarts. + +> **builtinBrowserDefaultDomainPolicy details** +> +> Applies when `builtinBrowserEnabled` is on, in both Cowork and Code sessions, and decides which sites Claude may open, read, or act on with its browser tools; users can still view any site themselves. `allow` (default): every site except entries in `builtinBrowserBlockedDomains`. `block`: no site except entries in `builtinBrowserAllowedDomains`. Under either policy `coworkEgressAllowedHosts`, when set to anything but `*`, is an outer bound: sites outside it are refused to Claude in the browser too. A site Anthropic's site safety list blocks stays blocked to Claude under either policy (see `builtinBrowserEnabled`); for a site the list only flags for confirmation, Claude asks the user before each of its actions under `allow`, and skips that confirmation only when the site matches a `builtinBrowserAllowedDomains` entry under `block`. A value that cannot be read is treated as `block` until it is fixed. +> +> The policy also limits what pages load: a page in the pane, including one a user opened, cannot load frames, scripts, images, or other content from a site the policy does not admit (a blocked page a user opens still loads content from its own site). Under `block`, or with a `coworkEgressAllowedHosts` list, include the CDN and API hosts your allowed sites depend on. +> +> This key and the two site lists work the same way as the Claude in Chrome site policy in the admin console. They are set separately here, except on an install managed from the Claude admin console, where they follow your organization's browser site permissions there. + +> **builtinBrowserAllowedDomains details** +> +> Used when `builtinBrowserDefaultDomainPolicy` is `block`; ignored under `allow`. A site matching an entry is one Claude may open and work with using its browser tools; every other external site is treated as blocked by your organization: Claude cannot open it, cannot read or act on it, and frames, popups, and redirects into it from a page Claude is working on are refused. A user can still type its address and view it themselves. Listing a site here never unblocks a site Anthropic's site safety list blocks (see `builtinBrowserEnabled`); for a site that list only flags for confirmation, an entry here is your organization vouching for it, so Claude works with it without asking before each action. +> +> Entries use the same grammar as `coworkEgressAllowedHosts`, except that bare `*` is dropped: as in Claude in Chrome, no allowed-sites entry opens every site. Set the policy to `allow` for that. A wildcard whose base is a public suffix (`*.co.uk`, `*.github.io`) is likewise ignored so an entry can never open a whole shared registry. Any other entry outside that grammar is kept but matches nothing (the app log and the editor name it); a value that cannot be read at all allows nothing until it is fixed. A plain hostname entry (`example.com`) also covers its `www.` form, and a `www.` entry covers the bare name, but no other subdomain. `localhost` dev servers are always reachable, so listing them changes nothing. +> +> Empty or unset (default): under `block`, Claude may open no external site. On an install managed from the Claude admin console this follows your organization's browser site permissions there. + +> **builtinBrowserBlockedDomains details** +> +> Used when `builtinBrowserDefaultDomainPolicy` is `allow` (the default); ignored under `block`. A site matching an entry is treated as blocked by your organization: Claude cannot open it, cannot read or act on it with its browser tools, and frames, popups, and redirects into it from a page Claude is working on are refused. A user can still type its address and view it themselves: the pane shows a "blocked by your organization's policy" banner and Claude's tools stay off there. To take the external browser away from users as well, deploy Claude Code's `disableBrowserExternalNavigation` managed setting instead. A blocked site is refused before the site safety check, so its address is never sent to Anthropic. +> +> Entries use the same grammar as `coworkEgressAllowedHosts`; `*` blocks every external site. An entry outside that grammar is kept but matches nothing (the app log and the editor name it); a value that cannot be read at all blocks every external site until it is fixed. As in Claude in Chrome, a plain hostname entry (`example.com`) also covers its `www.` form, and a `www.` entry covers the bare name, but no other subdomain. `localhost` dev servers are never affected. +> +> Use this key for exceptions inside an allowed egress wildcard or when egress is open. Empty or unset (default): no sites beyond the egress list are blocked. On an install managed from the Claude admin console this follows your organization's browser site permissions there. ### Chat surface | Setting | Type | Availability | Default | Description | | - | - | - | - | - | -| Allow Chat
`chatTabEnabled` | `boolean` | MDM + Bootstrap
Added in 1.13576.0 | — | Enable Chat. Quick questions and drafting. | -| Advanced file analysis
`chatAdvancedFileAnalysisEnabled` | `boolean` | MDM + Bootstrap
Added in 1.14271.0 | — | Allow Claude to run code in a local sandbox to analyze attached files it can’t read natively — like Excel and PowerPoint. Off by default. | -| Desktop home
`desktopHome` | `enum` | MDM + Bootstrap
Added in 1.52386.0 | — | Unifies Chat and Cowork into one home. When set, it replaces Allow Chat, Advanced file analysis, and Allow Cowork. Leave unset to keep those. One of: `standard`, `off`. | - - - - Also enables inline data analysis. Of the user's own files, the sandbox can read only those attached to the conversation, plus folders added to the chat's project through the app (read-only). - - Commands in the sandbox can reach the hosts in `coworkEgressAllowedHosts`, and no others. If that list is unset or empty, they have no network access. With `*` in the list they can reach any host, as in Cowork. Plugin CLIs are the exception: they can always reach the hosts their plugin declares, plus the listed hosts (with `*`, only the declared hosts). Older app versions give the sandbox no network access by default. - - As in Cowork, commands run without an approval prompt. So they can upload anything the sandbox can read to a listed host, and run what they download from one. To have Claude ask before each command, set `Bash` to `ask` in `builtinToolPolicy`, which also applies to Cowork and Code. To let commands install packages, list the hosts of the package manager's default index (for pip, `pypi.org` and `files.pythonhosted.org`). For a private mirror, list its host instead. Nothing points package managers at a mirror, so each command must name it (for pip, `--index-url`). - - Project folders are not available in the sandbox of a chat started while a rule on `Read`, `Grep` or `Glob` is set: in `disabledBuiltinTools`, in `builtinToolPolicy` with a value other than `allow`, or as a deny or ask rule in Claude Code's own managed settings on the device, whether or not the rule covers the folder. They are not available either where those managed settings cannot be read, or where Claude Code takes its managed settings from a gateway. Claude's file tools still read what the rules allow. - - - - `standard` turns on Unified Claude, which combines Chat and Cowork into one experience. `off` turns Chat and Cowork off entirely. `isClaudeCodeForDesktopEnabled` still decides Code. Remove the key to hand control back to `chatTabEnabled`, `chatAdvancedFileAnalysisEnabled`, and `coworkTabEnabled`. Values are case-sensitive, so `Standard` is not recognized. A value that the app does not recognize is read as `off`, so update the app on devices before you deploy a value added in a later version. - - +| Allow Chat `chatTabEnabled` | `boolean` | MDM + Bootstrap Added in 1.13576.0 | — | Enable Chat. Quick questions and drafting. | +| Advanced file analysis `chatAdvancedFileAnalysisEnabled` | `boolean` | MDM + Bootstrap Added in 1.14271.0 | — | Allow Claude to run code in a local sandbox to analyze attached files it can’t read natively — like Excel and PowerPoint. Off by default. | +| Desktop home `desktopHome` | `enum` | MDM + Bootstrap Added in 1.52386.0 | — | Unifies Chat and Cowork into one home. When set, it replaces Allow Chat, Advanced file analysis, and Allow Cowork. Leave unset to keep those. One of: `standard`, `off`. | + +> **chatAdvancedFileAnalysisEnabled details** +> +> Also enables inline data analysis. Of the user's own files, the sandbox can read only those attached to the conversation, plus folders added to the chat's project through the app (read-only). +> +> Commands in the sandbox can reach the hosts in `coworkEgressAllowedHosts`, and no others. If that list is unset or empty, they have no network access. With `*` in the list they can reach any host, as in Cowork. Plugin CLIs are the exception: they can always reach the hosts their plugin declares, plus the listed hosts (with `*`, only the declared hosts). Older app versions give the sandbox no network access by default. +> +> As in Cowork, commands run without an approval prompt. So they can upload anything the sandbox can read to a listed host, and run what they download from one. To have Claude ask before each command, set `Bash` to `ask` in `builtinToolPolicy`, which also applies to Cowork and Code. To let commands install packages, list the hosts of the package manager's default index (for pip, `pypi.org` and `files.pythonhosted.org`). For a private mirror, list its host instead. Nothing points package managers at a mirror, so each command must name it (for pip, `--index-url`). +> +> Project folders are not available in the sandbox of a chat started while a rule on `Read`, `Grep` or `Glob` is set: in `disabledBuiltinTools`, in `builtinToolPolicy` with a value other than `allow`, or as a deny or ask rule in Claude Code's own managed settings on the device, whether or not the rule covers the folder. They are not available either where those managed settings cannot be read, or where Claude Code takes its managed settings from a gateway. Claude's file tools still read what the rules allow. + +> **desktopHome details** +> +> `standard` turns on Unified Claude, which combines Chat and Cowork into one experience. `off` turns Chat and Cowork off entirely. `isClaudeCodeForDesktopEnabled` still decides Code. Remove the key to hand control back to `chatTabEnabled`, `chatAdvancedFileAnalysisEnabled`, and `coworkTabEnabled`. Values are case-sensitive, so `Standard` is not recognized. A value that the app does not recognize is read as `off`, so update the app on devices before you deploy a value added in a later version. ### Code surface | Setting | Type | Availability | Default | Description | | - | - | - | - | - | -| Allow Code
`isClaudeCodeForDesktopEnabled` | `boolean` | MDM + Bootstrap
Added in 1.2581.0 | `true` | Enable Code. Claude writes and runs code. Defaults to `true`. | -| SSH host allowlist
`sshHostAllowlist` | `string[]` | MDM + Bootstrap · Beta
Added in 1.40609.0 | — | SSH hosts for Code sessions. Unset: off unless the device’s Claude Code managed settings list hosts. An admin’s empty list: off even then. \* allows any host. | -| SSH client program
`sshClientPath` | `string` | MDM + Bootstrap · Beta
Added in 1.46388.1 | — | Absolute path to the OpenSSH ssh program the app runs for SSH sessions. Unset: the first ssh on the user’s PATH. | -| SSH connection engine
`sshTransport` | `enum` | MDM + Bootstrap · Beta
Added in 1.52386.0 | — | Which SSH engine carries Code sessions: the OpenSSH ssh program on the device, or the app’s built-in SSH library. Unset or auto: the build’s default. One of: `auto`, `system-openssh`, `builtin`. | - - - - When off, the SSH option is hidden and any connection attempt is refused. - - Entries are exact hostnames (`build01.corp.example.com`) or `*.` wildcards (`*.corp.example.com` matches the apex and subdomains at any depth); matching is case-insensitive and ignores a `user@` prefix. The list is compared with the `HostName` that the user's SSH configuration (`~/.ssh/config`) gives for the host they entered, or with the entered host itself when the configuration has no entry for it or cannot be evaluated. So an alias is allowed when the host it points to is listed, whatever the alias is called, and refused when it is not. `ProxyCommand` is permitted when the resolved host matches (this key governs which hosts the app offers, not network egress); `ProxyJump` is permitted likewise on the system-OpenSSH engine (the default on macOS and Linux; see `sshTransport`) and refused, with a message suggesting `ProxyCommand`, by the built-in SSH library. - - This is opt-in because a remote session runs Claude Code on the SSH host and the app forwards the session's inference credential to it, plus your OTLP collector endpoint and auth headers when `otlpEndpoint` is set. List only hosts you trust with those. Token-based credentials are forwarded. File-based credentials (Bedrock IAM Identity Center sign-in or AWS profile, Vertex Google sign-in or a credentials file) are never forwarded, and a session that needs one from the device is refused. - - If this key is unset, an `sshHostAllowlist` in Claude Code's own managed-settings file on the device still applies; when both are set, this key wins where the app's configuration is admin-managed (MDM, the admin console, or a device-managed bootstrap URL) and otherwise applies only while that file sets none. `allowedWorkspaceFolders` still applies on the remote host. Claude Code's managed settings on a host replace the sandbox, network, permission, and MCP rules this app sends unless they set `parentSettingsBehavior` to `"merge"`. - - - - Pins which OpenSSH client the app runs wherever it starts `ssh`: evaluating the user's SSH configuration (`ssh -G`), making the SSH connection and its channels, and the Code tab's terminal. `ssh-keygen` and `ssh-add` are taken from the same directory when they exist there, otherwise from PATH. The program must be OpenSSH 7.6 or newer (on Windows, Win32-OpenSSH 9.4 or newer to carry the connection); on macOS and Linux a wrapper script that ends in one is accepted, on Windows it must be a native `.exe` (not a .cmd, .bat or .ps1 script). When this key is set and the program is missing, cannot be run, or is too old, SSH sessions fail with an error telling the user to ask their IT administrator (the configured path is in its details) — the app never falls back to another ssh. The connection itself runs through this program on the system-OpenSSH engine, which the SSH connection engine setting's `system-openssh` value selects on every platform, including Windows; when the app's built-in SSH library makes the connection instead, this key still governs configuration evaluation (`ssh -G`), host-key lookups (`ssh-keygen`) and the terminal. On a device that a Claude.ai sign-in has moved to an admin-console organization (see `disableDeploymentModeChooser`), the device profile's value is ignored: set the key in the admin console. There, until the organization's configuration has loaded, no client is pinned. - - - - `system-openssh`: the app makes every SSH connection by running an OpenSSH `ssh` program — the one `sshClientPath` names, otherwise the first `ssh` on the user's PATH (on Windows, a Win32-OpenSSH `ssh.exe`: the PATH one, else the in-box or Microsoft-installed client) — so the organization's own OpenSSH build, with its Kerberos/GSSAPI, certificate and `ssh_config` support, is what authenticates. The program must be OpenSSH 7.6 or newer (Windows: Win32-OpenSSH 9.4 or newer). When `sshClientPath` is set and that program cannot be used, sessions fail with an error telling the user to ask their IT administrator rather than falling back; when it is unset and Windows has no usable client, the built-in library is used. - - `builtin`: the app's built-in SSH library makes the connection, whatever the build's default. - - `auto` or unset: the build's default engine. - - An explicit value overrides the default at each host's next connect or reconnect. An open app takes a device profile's change at its next configuration check. From a configuration server it takes only `builtin`, once two checks in a row return it (about 12 minutes by default); other values wait until it is reopened or the user signs in again. A value that cannot be read, such as a misspelling, counts as `builtin` and waits likewise. Once a server's configuration has loaded it decides, even if it omits the key; until then the device profile's value applies. On a device that a Claude.ai sign-in has moved to an admin-console organization (see `disableDeploymentModeChooser`), the device profile's value is ignored: set the key in the admin console. There, until the organization's configuration has loaded, the build's default engine is used. - - +| Allow Code `isClaudeCodeForDesktopEnabled` | `boolean` | MDM + Bootstrap Added in 1.2581.0 | `true` | Enable Code. Claude writes and runs code. Defaults to `true`. | +| SSH host allowlist `sshHostAllowlist` | `string[]` | MDM + Bootstrap · Beta Added in 1.40609.0 | — | SSH hosts for Code sessions. Unset: off unless the device’s Claude Code managed settings list hosts. An admin’s empty list: off even then. \* allows any host. | +| SSH client program `sshClientPath` | `string` | MDM + Bootstrap · Beta Added in 1.46388.1 | — | Absolute path to the OpenSSH ssh program the app runs for SSH sessions. Unset: the first ssh on the user’s PATH. | +| SSH connection engine `sshTransport` | `enum` | MDM + Bootstrap · Beta Added in 1.52386.0 | — | Which SSH engine carries Code sessions: the OpenSSH ssh program on the device, or the app’s built-in SSH library. Unset or auto: the build’s default. One of: `auto`, `system-openssh`, `builtin`. | + +> **sshHostAllowlist details** +> +> When off, the SSH option is hidden and any connection attempt is refused. +> +> Entries are exact hostnames (`build01.corp.example.com`) or `*.` wildcards (`*.corp.example.com` matches the apex and subdomains at any depth); matching is case-insensitive and ignores a `user@` prefix. The list is compared with the `HostName` that the user's SSH configuration (`~/.ssh/config`) gives for the host they entered, or with the entered host itself when the configuration has no entry for it or cannot be evaluated. So an alias is allowed when the host it points to is listed, whatever the alias is called, and refused when it is not. A session's jump hosts (`ProxyJump`, or `ProxyCommand ssh -W %h:%p host`) must be listed too, by `HostName`. One the app fails to read, and any other `ProxyCommand` (`ssh -i`…), is permitted when the resolved host matches (this key governs which hosts the app offers, not network egress). The built-in SSH library refuses every `ProxyJump`. +> +> This is opt-in because a remote session runs Claude Code on the SSH host and the app forwards the session's inference credential to it, plus your OTLP collector endpoint and auth headers when `otlpEndpoint` is set. List only hosts you trust with those. Token-based credentials are forwarded. File-based credentials (Bedrock IAM Identity Center sign-in or AWS profile, Vertex Google sign-in or a credentials file) are never forwarded, and a session that needs one from the device is refused. +> +> If this key is unset, an `sshHostAllowlist` in Claude Code's own managed-settings file on the device still applies; when both are set, this key wins where the app's configuration is admin-managed (MDM, the admin console, or a device-managed bootstrap URL) and otherwise applies only while that file sets none. `allowedWorkspaceFolders` still applies on the remote host. Claude Code's managed settings on a host replace the sandbox, network, permission, and MCP rules this app sends unless they set `parentSettingsBehavior` to `"merge"`. + +> **sshClientPath details** +> +> Pins which OpenSSH client the app runs wherever it starts `ssh`: evaluating the user's SSH configuration (`ssh -G`), making the SSH connection and its channels, and the Code tab's terminal. `ssh-keygen` and `ssh-add` are taken from the same directory when they exist there, otherwise from PATH. The program must be OpenSSH 7.6 or newer (on Windows, Win32-OpenSSH 9.4 or newer to carry the connection); on macOS and Linux a wrapper script that ends in one is accepted, on Windows it must be a native `.exe` (not a .cmd, .bat or .ps1 script). When this key is set and the program is missing, cannot be run, or is too old, SSH sessions fail with an error telling the user to ask their IT administrator (the configured path is in its details) — the app never falls back to another ssh. The connection itself runs through this program on the system-OpenSSH engine, which the SSH connection engine setting's `system-openssh` value selects on every platform, including Windows; when the app's built-in SSH library makes the connection instead, this key still governs configuration evaluation (`ssh -G`), host-key lookups (`ssh-keygen`) and the terminal. On a device that a Claude.ai sign-in has moved to an admin-console organization (see `disableDeploymentModeChooser`), the device profile's value is ignored: set the key in the admin console. There, until the organization's configuration has loaded, no client is pinned. + +> **sshTransport details** +> +> `system-openssh`: the app makes every SSH connection by running an OpenSSH `ssh` program — the one `sshClientPath` names, otherwise the first `ssh` on the user's PATH (on Windows, a Win32-OpenSSH `ssh.exe`: the PATH one, else the in-box or Microsoft-installed client) — so the organization's own OpenSSH build, with its Kerberos/GSSAPI, certificate and `ssh_config` support, is what authenticates. The program must be OpenSSH 7.6 or newer (Windows: Win32-OpenSSH 9.4 or newer). When `sshClientPath` is set and that program cannot be used, sessions fail with an error telling the user to ask their IT administrator rather than falling back; when it is unset and Windows has no usable client, the built-in library is used. +> +> `builtin`: the app's built-in SSH library makes the connection, whatever the build's default. +> +> `auto` or unset: the build's default engine. +> +> An explicit value overrides the default at each host's next connect or reconnect. An open app takes a device profile's change at its next configuration check. From a configuration server it takes only `builtin`, once two checks in a row return it (about 12 minutes by default); other values wait until it is reopened or the user signs in again. A value that cannot be read, such as a misspelling, counts as `builtin` and waits likewise. Once a server's configuration has loaded it decides, even if it omits the key; until then the device profile's value applies. On a device that a Claude.ai sign-in has moved to an admin-console organization (see `disableDeploymentModeChooser`), the device profile's value is ignored: set the key in the admin console. There, until the organization's configuration has loaded, the build's default engine is used. ### Cowork surface | Setting | Type | Availability | Default | Description | | - | - | - | - | - | -| Allow Cowork
`coworkTabEnabled` | `boolean` | MDM + Bootstrap
Added in 1.9659.0 | `true` | Enable Cowork. Claude works on longer tasks like research, analysis, and documents. Defaults to `true`. | +| Allow Cowork `coworkTabEnabled` | `boolean` | MDM + Bootstrap Added in 1.9659.0 | `true` | Enable Cowork. Claude works on longer tasks like research, analysis, and documents. Defaults to `true`. | ### Workspace | Setting | Type | Availability | Default | Description | | - | - | - | - | - | -| Allow user-added plugin marketplaces
`userPluginMarketplacesEnabled` | `boolean` | MDM + Bootstrap
Added in 1.37937.0 | — | Allow users to add plugin marketplaces. When off, marketplaces your organization did not provision are hidden and the app’s sessions do not load their plugins. | -| Allow user-added plugins
`userPluginUploadsEnabled` | `boolean` | MDM + Bootstrap
Added in 1.37937.0 | — | Allow users to add their own plugins. When off, every in-app option for adding one is hidden and uploads that still reach the app are refused. | -| Disabled built-in tools
`disabledBuiltinTools` | `string[]` | MDM + Bootstrap
Added in 1.2581.0 | — | Built-in tools, or argument-scoped permission rules such as Read(//\*\*/.env), denied in Cowork and Code. | -| Disable bundled skills and workflows
`disableBundledSkills` | `boolean` | MDM + Bootstrap
Added in 1.15962.0 | — | Disables Claude Code’s bundled skills and workflows (deep-research and similar). Use where WebFetch/WebSearch aren’t available. | -| Allow user-created skills
`skillCreationEnabled` | `boolean` | MDM + Bootstrap
Added in 1.25927.0 | — | Allow users to create and upload their own skills. When off, the creation and upload surfaces are hidden and the agent’s skill-creation tools are disabled. | -| Allow scheduled tasks
`scheduledTasksEnabled` | `boolean` | MDM + Bootstrap
Added in 2.110.0 | — | Allow scheduled tasks in Cowork and Code. When off, the Scheduled page is hidden, existing tasks stop running, and Claude cannot create new ones. | -| Allow keep awake
`keepAwakeEnabled` | `boolean` | MDM + Bootstrap
Added in 2.7032.0 | — | Let Claude keep the computer awake. When off, Claude never prevents sleep and hides the keep-awake switches in Settings, the Scheduled page and the Code tab. | -| Allow Developer Mode
`developerModeEnabled` | `boolean` | MDM + Bootstrap
Added in 2.37337.1 | — | Let users turn on Developer Mode. When off, the app’s developer tools and the option to install an unpacked extension are unavailable. | -| Built-in tool policy
`builtinToolPolicy` | `object` | MDM + Bootstrap
Added in 1.8089.0 | — | Approval policy per built-in tool or argument-scoped rule such as Bash(curl \*). “ask” requires user approval before each matching call; “allow” is the default. | -| Allow Auto mode
`autoModeEnabled` | `boolean` | MDM + Bootstrap
Added in 1.10628.0 | — | Offer Auto mode in the Code permission selector (on unless set to false); set to true to also offer it in Cowork. Claude decides which actions need approval. | -| Disable bypass permissions mode
`disableBypassPermissionsMode` | `boolean` | MDM + Bootstrap
Added in 1.46388.1 | — | Remove the bypass permissions mode from Code sessions and Cowork tasks, so Claude always follows the permission policy. Off by default. | -| Enable tool search
`toolSearchEnabled` | `boolean` | MDM + Bootstrap
Added in 1.21459.0 | `false` | Load MCP tool schemas on demand (tool search) instead of inlining every schema into context. Defaults to `false`. | -| Skip WebFetch domain check
`skipWebFetchPreflight` | `boolean` | MDM + Bootstrap
Added in 1.37937.0 | — | Skip Claude Code’s WebFetch domain lookup against api.anthropic.com in Code sessions. Off by default; turn on when that host is blocked. | -| Allowed workspace folders
`allowedWorkspaceFolders` | `object[]` | MDM + Bootstrap
Added in 1.2581.0 | — | Folders where Claude may work. Applies to Cowork and Code sessions and to the project folders a chat reads. Leave unset for unrestricted access. | -| Block reads outside working directories
`blockReadsOutsideWorkingDirectories` | `boolean` | MDM + Bootstrap
Added in 1.46388.1 | — | Keep Claude from reading files outside a Code session’s working directories. File tools refuse such reads; sandboxed shell commands lose the home directory. | -| Allowed egress hosts
`coworkEgressAllowedHosts` | `string[]` | MDM + Bootstrap
Added in 1.2581.0 | — | Hosts agent tools may reach in Cowork and Chat (Code: in part). An empty list acts as unset for tools, but stops Claude opening sites in the built-in browser. | -| Require full VM sandbox
`requireCoworkFullVmSandbox` | `boolean` | MDM + Bootstrap · Deprecated
Added in 1.2581.0 | `false` | Runs tools inside an isolated VM instead of the host. Stronger isolation; slower file access and no host-process tools. Defaults to `false`. | -| Organization instructions
`organizationInstructions` | `string` | MDM + Bootstrap
Added in 1.37937.0 | — | Appended to Claude’s system prompt in Chat, Cowork, and Code. Guidance the model follows, not an enforced control. Up to 3,000 characters. | - - - - When on (default), users can add plugin marketplaces from the plugin browser. Set to `false` to restrict plugins to your organization's marketplaces: the add-marketplace surfaces are hidden, and the app refuses adds that still reach it (deep links, stale UI). Any other marketplace present on the device is then hidden in every tab, whether a user added it in the app earlier or something outside the app registered it (for example Claude Code in a terminal, under `~/.claude`): its plugins are not listed, and installs and updates from it are refused. The sessions the app starts load plugins only from your organization's marketplaces, the organization plugins directory, the app's own uploads and the user's own skills folder, enforced through Claude Code's marketplace allowlist (`strictKnownMarketplaces`, passed as the app's managed settings). Nothing is deleted: removing the key or setting it back to `true` restores them. Marketplaces provisioned by your organization (`allowedPluginMarketplaces`) and the organization plugins directory are unaffected, and plugins users uploaded are governed by `userPluginUploadsEnabled`, not this key. - - This is a feature-availability control, not a data boundary. Claude Code in a terminal reads the same `~/.claude` folder and is governed only by its own managed settings, not by this key. Claude Code may ignore this allowlist on a device that deploys its own Claude Code managed settings; restrict marketplaces in those settings as well. - - This key applies only while the app runs in third-party mode. If users could otherwise sign in to Claude.ai on the device, also set `disableDeploymentModeChooser` so the app stays in third-party mode. - - - - When on (default), users can upload plugin files and create plugins with Claude. Set to `false` to stop users adding plugins of their own: every in-app option for doing so is hidden, and the app refuses uploads that still reach it. - - This is a feature-availability control enforced in the app, not a data boundary: plugins already installed (or placed on disk outside the app) are not removed or blocked by this key. Plugins from organization-provisioned marketplaces and the organization plugins directory are unaffected. - - This key applies only while the app runs in third-party mode. If users could otherwise sign in to Claude.ai on the device, also set `disableDeploymentModeChooser` so the app stays in third-party mode. - - - - Each entry is a Claude Code tool name (`Bash`, `Read`, `Write`, `Edit`, `Glob`, `Grep`, `NotebookEdit`, `WebFetch`, `WebSearch`, `Task`, `TodoWrite`, `TaskCreate`, `TaskUpdate`, `TaskGet`, `TaskList`, `TaskStop`, `Skill`, `REPL`, `JavaScript`, `AskUserQuestion`, `ToolSearch`, `SendUserMessage`) or an argument-scoped [permission rule](https://code.claude.com/docs/en/permissions#permission-rule-syntax) such as `Bash(curl *)` or `Edit(//**/*.env)`. A bare name covers every call (a bare `Bash` entry also covers the `PowerShell` tool); a scoped rule covers matching calls in every permission mode, including Auto and bypass. Scopes are matched for `Bash(…)` (a command pattern) and for file paths written as `Read(…)` (covers `Read`, `Grep`, `Glob`) or `Edit(…)` (covers `Edit`, `Write`, `NotebookEdit`); other tools take `Tool(:)`. `WebSearch` and `WebFetch` are bare-name only: to allow specific hosts, use `coworkEgressAllowedHosts`. - - Scoped `Bash(…)` rules apply in Code sessions only; Cowork's shell follows only a bare `Bash` entry. Start absolute file paths with `//`, not `/`: a relative pattern such as `Read(**/.env)` covers only a Code session's project folder and none of Cowork's connected folders. Scoped rules need fleet-wide build support (`disableAutoUpdates` pins builds): an older build passes a scoped entry to Claude Code unchecked. An entry whose pattern contains `)` followed by a space or comma is enforced only through Claude Code's managed-settings channel, so another Claude Code [managed-settings source](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings) replaces it unless that source sets `parentSettingsBehavior` to `"merge"`; every other entry is enforced either way. - - An unusable entry (a lowercase tool name, an unbalanced parenthesis, a scoped `WebSearch(…)` or `WebFetch(…)`) is kept, because the deny list is served exactly as written, and raises a configuration warning. - - - - When on (default), users can create new skills and upload skill files in the app. Set to `false` to block user skill creation: the skill-creation and upload surfaces are hidden (the `skill_creation` feature is served as blocked by the organization), and the agent's skill-creation tools (saving skills from a conversation, skill proposals) are not offered in sessions — the same effect as turning off the **User-created skills** organization setting available to claude.ai enterprise admins. - - This is a feature-availability control enforced in the app's UI, not a data boundary: skills are files on the user's machine, and files already present there (or placed there outside the app) are not removed or blocked by this key. Skills themselves remain usable; organization-distributed plugins and bundled skills are unaffected (to disable bundled skills, use `disableBundledSkills`). - - - - When on (default), users can schedule Cowork tasks and Code sessions to run later or on a recurring schedule, and Claude can create such schedules when asked. - - Set to `false` to turn scheduled tasks off for every user. The Scheduled section in Cowork and the routines list in the Code tab are hidden, together with every other place a schedule can be created. Tasks that already exist on a device no longer run; they are kept, not deleted, and run again once the key is removed or set to `true`. Claude is not offered the tools that create, change or run these tasks, and sessions start without Claude Code's own in-session scheduling tools (the `/loop` command, its cron tools and its wake-up timer). - - It does not remove task files already on the user's machine. A change takes effect at the next app launch. - - - - When on (default), users can turn on **Keep computer awake** (Settings → This computer → System, also shown as **Keep awake** on the Scheduled page in Cowork and the Routines page in Code) so the computer does not idle-sleep while Claude is open and scheduled tasks keep running on an idle machine. The Code tab can also keep the computer awake while a session is working (**Keep computer awake while Claude works** in Settings → Claude Code, and a session's **Keep computer awake** menu item). - - Set to `false` to make sure Claude never prevents the computer from sleeping: those switches are hidden and no part of the app keeps the computer awake. Users' saved choices are kept but ignored, and apply again once the key is removed or set to `true`. Scheduled tasks are unaffected and still run only while the computer is awake and the app is open. - - A change takes effect on a running app. - - - - When on (default), a user can turn on **Developer Mode** (Help → Troubleshooting → Enable Developer Mode), which adds the **Developer** menu and lets them open the developer tools (Chrome DevTools, Inspect Element) and a debugger for the app's main process. - - Set to `false` to keep Developer Mode off on every device that receives this setting: the **Developer** menu and the Help → Troubleshooting → Enable Developer Mode item are removed, the developer tools and the debugger cannot be opened (any already open are closed), a user's own `developer_settings.json` opt-in is ignored, and the app refuses to install an extension from a folder. Packaged (`.mcpb`) extensions are governed by `isDesktopExtensionEnabled`, not this key. - - This is a feature control, not a sandbox: extensions already installed from a folder stay installed and keep working, and an extension folder copied into the app's extensions folder by hand is not blocked. - - A change takes effect on a running app, except that the **Install unpacked extension** button in Settings keeps its launch-time state until the app restarts (clicking it while the key is off shows an error). - - - - Keys use the same tool names and argument-scoped rule syntax as **Disabled built-in tools** (`disabledBuiltinTools`), and scopes apply in the same sessions. A bare `Bash` key also governs Claude Code's `PowerShell` tool (its shell on Windows PCs without Git for Windows); argument-scoped `Bash(…)` keys do not. Scoped **ask** rules reach sessions only through Claude Code's managed-settings channel, so another Claude Code managed-settings source replaces them unless it sets `parentSettingsBehavior` to `"merge"` (bare names hold either way). They need the same fleet-wide build support, and an older build drops a scoped **ask** entry as a configuration error (which also blocks WSL sessions on Windows until that client updates), so the tool runs unprompted. - - An **ask** entry, bare or scoped, also turns off the app's remembered “always allow” choices for that tool, so each prompted call is confirmed individually. **ask** on a file tool (`Read`, `Write`, `Edit`, `Glob`, `Grep`) prompts in Cowork, Chat and Code sessions. Calls that Cowork and Chat always refuse are still refused without a prompt: paths outside the session's connected folders (in Chat, outside its scratch directory and its project's folders) and protected or sensitive files inside them. A scheduled task in Cowork waits at the prompt, which appears in the task's session and, when that session is not in view, as a desktop notification. Code side chats cannot prompt, so they block matching calls. An unusable entry is dropped and recorded as a configuration error; a value other than `allow` or `ask` is treated as `ask` and reported. To remove a tool or deny a rule outright, use **Disabled built-in tools** instead. - - - - Left unset, users can select **Auto mode** in Code and new Code sessions start in it; a mode the user already chose, or a Claude Code settings file's `permissions.defaultMode`, takes precedence, and Cowork does not offer it. Set to `true` to also offer **Automatically approve** in Cowork (Cowork sessions still start by asking before each action until the user picks it). Set to `false` to remove the option from both tabs. In Auto mode Claude runs a safety classifier on each action and only prompts for approval on actions it judges risky, instead of following the static per-tool policy. - - Requires a model that supports the safety classifier — which models qualify depends on the deployment's provider and the app version. With a model that lacks support the option is greyed out and Code sessions do not start in it. `builtinToolPolicy` and this key may both be set; Auto mode is a user-selectable option alongside the default policy, not a replacement for it. - - In Code sessions, a separately deployed Claude Code [managed-settings](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings) file that sets `disableAutoMode` to `"disable"` also keeps Auto mode hidden and off, whatever this key says. - - - - When set to `true`, sessions cannot run in bypass permissions mode: the app stops offering the mode in Code and Cowork, and a session that requests it anyway is downgraded. This is the `disableBypassPermissionsMode` setting from the `permissions` section of Claude Code's [managed settings](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings); a separately deployed Claude Code managed-settings file that sets it to `"disable"` also removes the mode, whichever source sets it. - - Unset (default): users the deployment otherwise allows can choose bypass permissions mode. - - - - When enabled, Cowork, Code, and Chat sessions place only tool names in context up front, and Claude fetches a tool's full schema the first time it needs it. Use this when many MCP tools are configured and their inlined schemas crowd out the context window. If your endpoint does not accept the request shape it then receives, requests fail with HTTP 400. - - * **Claude API, Vertex AI, Bedrock, or Bedrock Mantle with no custom base URL**: not needed. The app leaves Claude Code's experimental betas on there, as terminal Claude Code does, so tool search is on by default (on Vertex AI, for Claude 4.5 and newer models). To turn it off in Code, Cowork, and Chat, set `ENABLE_TOOL_SEARCH` to `false` in the `env` block of OS-level Claude Code managed settings (with `parentSettingsBehavior: "merge"`). Earlier app versions treat these like the last case. - * **Gateway provider, app versions bundling Claude Code 2.1.247 or later**: requests add only the tool-search shape (the `tool-search-tool-2025-10-19` `anthropic-beta` value, deferred tool loading, `tool_reference` content blocks); every other experimental Claude Code beta stays suppressed. OS-level Claude Code managed settings that keep that suppression or turn `ENABLE_TOOL_SEARCH` off still win; set `ENABLE_TOOL_SEARCH` to `force` there instead (with `parentSettingsBehavior: "merge"`). Sessions the app runs in Claude Code's gateway mode (an opt-in for users on the gateway's own sign-in) get its gateway-safe tool-search shape instead. - * **Foundry, a custom base URL, and earlier app versions**: the app suppresses Claude Code's experimental betas for the session and the key lifts that, so requests carry the tool-search shape together with Claude Code's other experimental betas for that provider. On Vertex with app versions bundling Claude Code older than 2.1.221, leave this unset while any model older than Claude 4.5 is in use; those engines send the header regardless of model and Vertex's pre-4.5 stacks reject it. - - - - Before fetching a page, Claude Code's WebFetch tool asks `api.anthropic.com` whether the domain is on Anthropic's content blocklist, and refuses the fetch if that lookup cannot complete. Third-party deployments route inference elsewhere and often block `api.anthropic.com` at the firewall; with the lookup on, every WebFetch in Code sessions then fails with "Unable to verify if domain … is safe to fetch", and where the host is reachable, every fetched hostname is sent to Anthropic. (Cowork sessions fetch through the app's own allowlisted fetch and never run this lookup.) - - Off (default): the lookup runs as it does today, so `api.anthropic.com` must be reachable from users' machines for Code-session WebFetch to work (listed under Egress Requirements). Set to `true` when users' machines cannot reach `api.anthropic.com` (corporate firewall, government network) or you do not want fetched hostnames sent there: Code sessions then fetch without the lookup and never contact that host for it. This is the same `skipWebFetchPreflight` setting Claude Code reads from its own [managed-settings](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings) file; the app passes it to every session it starts. This key does not restrict which domains Claude may fetch. Neither does `coworkEgressAllowedHosts` in Code sessions, where it only pre-approves its hosts; `builtinToolPolicy` can require approval for every fetch. - - - - Paths can reference `~` and these environment variables, expanded per user: `%OneDrive%`, `%OneDriveCommercial%`, `%OneDriveConsumer%`, `%APPDATA%`, `%LOCALAPPDATA%`, `%USERNAME%`, `%XDG_DOCUMENTS_DIR%`. The set is fixed; an entry that references any other `%VAR%`, or one that is unset on the device, is ignored. - - Each folder is interpreted on the machine the session runs on. For a Code session on an SSH host, `~` means the remote user's home, an entry that references a `%VAR%` is ignored there (environment variables belong to the machine that defines them), and the session's working directory must fall inside one of the folders as they exist on that host. One list serves every machine: `["~/work", "/srv/work"]` governs `~/work` for each user, on a managed Mac or a Linux host, and `/srv/work` on a host that has it. A folder that names nothing real on a given machine simply allows nothing there. An empty list allows no folder at all; unset leaves access unrestricted. - - A listed folder is one Claude may write as well as read, unless the entry's `mode` (Access mode in Setup) makes it read-only; that field's own description says how far read-only reaches. A Code session can reach every listed folder, not only the one it was opened in. Setting this key also turns on Claude Code's sandbox where it runs (macOS, or Linux and SSH hosts with bubblewrap): there a shell command normally writes in the listed folders without an approval prompt, and its writes to most other places, such as a package cache in the home directory, are refused. A home directory holds shell start-up files and SSH keys, so list work folders, not a whole home directory. - - The list also limits which folders of a project a chat reads. - - | Field | Type | Default | Description | - | - | - | - | - | - | `path` | `string` | — | Absolute folder path. May start with \~ or one of the listed %VAR% tokens, expanded per user. Subfolders are included. | - | `isDefaultSelected` | `boolean` | — | Shows as a folder chip on the new-task page and skips the trust prompt. Users can remove it. | - | `mode` | `enum` | — | Read-only folders can be viewed and searched but not modified in Cowork. In Code, applies to file tools only. Over SSH, also to Bash in its sandbox. One of: `rw`, `ro`. | - - - - When set to `true`, Code sessions refuse reads outside their working directories (the session folder plus any `allowedWorkspaceFolders`). The file tools (Read, Grep, Glob) refuse them in every permission mode; where Claude Code's sandbox runs (macOS, or Linux and SSH hosts with bubblewrap, once `allowedWorkspaceFolders` is set or an egress allowlist applies: in third-party deployments one applies unless `coworkEgressAllowedHosts` contains `*`, in first-party deployments none does) shell commands cannot see the home directory and other user folders (`/Users`, `/home`, mounted volumes) and a read there is refused with no prompt; elsewhere (Windows, Linux without bubblewrap, or neither folders nor an egress allowlist in effect) such shell reads prompt for approval. The app keeps the user's git configuration files (which may themselves embed credentials such as URL tokens; a symlinked one stays hidden), its own Claude Code installation, and the session's plugin and attachment folders readable (not on a Windows SSH host, where plugin files and attachments stay out of the file tools' reach under the block). An allowed folder that is or contains the home directory leaves it readable. - - Users can re-open folders (even their whole home) in their own Claude Code settings with `sandbox.filesystem.allowRead` or `permissions.additionalDirectories`; settings files tracked in a git repository cannot. The key travels on Claude Code's managed-settings channel: another Claude Code managed-settings source replaces it unless that source sets `parentSettingsBehavior` to `"merge"`, and one that sets `sandbox.filesystem.allowManagedReadPathsOnly` reduces it to approval prompts. This is `permissions.blockReadsOutsideWorkingDirectories` in Claude Code's [managed settings](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings). - - Unset (default): nothing changes. - - - - Applies only to **tool calls**, in Cowork, Code and Chat. In Cowork it covers the sandbox's web fetch, shell commands and package installs. In Chat it covers web fetch and commands in the file-analysis sandbox. In Code it's [translated into Claude Code's network sandbox allowlist](https://claude.com/docs/third-party/claude-desktop/code#applied-as-managed-policy), and by default a separately deployed Claude Code managed-settings file takes precedence. It does **not** cover Web Search (which runs at your inference provider), inference, or MCP traffic. A list other than `*` also bounds where Claude may browse in the built-in browser. When unset, Cowork and Chat refuse web fetch. - - Entries are exact hostnames (`api.github.com`), wildcards (`*.corp.com` matches subdomains at any depth, not `corp.com` itself), or `*` to allow all. IP addresses match only when listed exactly. In Cowork and Chat, web fetch always blocks `localhost` and private addresses, and shells reach only listed hosts (not your inference provider's, unless listed), or none when unset. Code's shell obeys that limit only on macOS, and with bubblewrap and socat on Linux or WSL2; elsewhere, Windows included, it reaches any host. Code's web fetch isn't limited. - - Any entry except bare `*` may carry a `:port` suffix (`*.corp.com:8443`) restricting it to that port. IPv6 literals are not supported. Invalid entries are dropped with a log warning and the rest still work. An unreadable value counts as an empty list. Ports are enforced for the Cowork sandbox's web fetch, shell, and package-install egress; plugin CLIs also reach hosts their plugin declares and ignore port-scoped entries for now, and the Code translation treats them as the bare host. Only deploy port-scoped entries once your whole fleet supports them (`disableAutoUpdates` pins builds). On an older build, a single one invalidates the session's whole shell and package-install allowlist. - - Open listed hosts on your network firewall too. - - - - Free-text instructions from your organization that Claude Desktop appends, in a clearly delimited block, after its own system prompt in **Chat**, **Cowork**, and **Code** (every chat, task, and Code session, including the sub-agents they spawn): for example house style, data-handling rules, or topics to decline. The model is told these instructions come from the organization's administrator and take priority over a user's personal preferences. - - This is guidance the model follows, not an enforced control: like any system-prompt text it steers the model's behavior and is usually honored, but it does not guarantee an outcome and is not a substitute for the restriction keys (tool policy, egress allowlist, folder allowlist). The app's own system prompt is never replaced or shortened by this key; in Code sessions it is added after Claude Code's own prompt and any `CLAUDE.md` instructions still apply. - - Read from the app's loaded configuration when a session starts; a changed value generally takes effect for sessions started after the next app launch. Leading and trailing whitespace is trimmed; an empty string is treated as unset. Maximum 3,000 characters; a longer value is rejected (the key is ignored with a configuration error) rather than truncated. Line breaks are preserved when the value is delivered as JSON, a bootstrap response, a `.mobileconfig` profile, or a `.reg` file; the Group Policy (ADMX) and Intune text box for this setting is single-line. - - +| Allow user-added plugin marketplaces `userPluginMarketplacesEnabled` | `boolean` | MDM + Bootstrap Added in 1.37937.0 | — | Allow users to add plugin marketplaces. When off, marketplaces your organization did not provision are hidden and the app’s sessions do not load their plugins. | +| Allow user-added plugins `userPluginUploadsEnabled` | `boolean` | MDM + Bootstrap Added in 1.37937.0 | — | Allow users to add their own plugins. When off, every in-app option for adding one is hidden and uploads that still reach the app are refused. | +| Disabled built-in tools `disabledBuiltinTools` | `string[]` | MDM + Bootstrap Added in 1.2581.0 | — | Built-in tools, or argument-scoped permission rules such as Read(//\*\*/.env), denied in Cowork and Code. | +| Disable bundled skills and workflows `disableBundledSkills` | `boolean` | MDM + Bootstrap Added in 1.15962.0 | — | Disables Claude Code’s bundled skills and workflows (deep-research and similar). Use where WebFetch/WebSearch aren’t available. | +| Allow user-created skills `skillCreationEnabled` | `boolean` | MDM + Bootstrap Added in 1.25927.0 | — | Allow users to create and upload their own skills. When off, the creation and upload surfaces are hidden and the agent’s skill-creation tools are disabled. | +| Allow scheduled tasks `scheduledTasksEnabled` | `boolean` | MDM + Bootstrap Added in 2.110.0 | — | Allow scheduled tasks in Cowork and Code. When off, the Scheduled page is hidden, existing tasks stop running, and Claude cannot create new ones. | +| Allow keep awake `keepAwakeEnabled` | `boolean` | MDM + Bootstrap Added in 2.7032.0 | — | Let Claude keep the computer awake. When off, Claude never prevents sleep and hides the keep-awake switches in Settings, the Scheduled page and the Code tab. | +| Allow Developer Mode `developerModeEnabled` | `boolean` | MDM + Bootstrap Added in 2.37337.1 | — | Let users turn on Developer Mode. When off, the app’s developer tools and the option to install an unpacked extension are unavailable. | +| Default Quick Entry shortcut `quickEntryDefaultShortcut` | `string` | MDM + Bootstrap Added in 3.1623.0 | — | Set the shortcut that opens Quick Entry, such as Ctrl+Alt+K, for users who haven’t set their own in Settings. Use “off” for no shortcut. | +| Built-in tool policy `builtinToolPolicy` | `object` | MDM + Bootstrap Added in 1.8089.0 | — | Approval per tool or rule such as Bash(curl \*). “ask” prompts the user before each matching call. “allow” is the default. To block, use Disabled built-in tools. | +| Allow Auto mode `autoModeEnabled` | `boolean` | MDM + Bootstrap Added in 1.10628.0 | — | Offer Auto mode in the Code permission selector (on unless set to false); set to true to also offer it in Cowork. Claude decides which actions need approval. | +| Disable bypass permissions mode `disableBypassPermissionsMode` | `boolean` | MDM + Bootstrap Added in 1.46388.1 | — | Remove the bypass permissions mode from Code sessions and Cowork tasks, so Claude always follows the permission policy. Off by default. | +| Enable tool search `toolSearchEnabled` | `boolean` | MDM + Bootstrap Added in 1.21459.0 | `false` | Load MCP tool schemas on demand (tool search) instead of inlining every schema into context. Defaults to `false`. | +| Skip WebFetch domain check `skipWebFetchPreflight` | `boolean` | MDM + Bootstrap Added in 1.37937.0 | — | Skip Claude Code’s WebFetch domain lookup against api.anthropic.com in Code sessions. Off by default; turn on when that host is blocked. | +| Allowed workspace folders `allowedWorkspaceFolders` | `object[]` | MDM + Bootstrap Added in 1.2581.0 | — | Folders where Claude may work. Applies to Cowork and Code sessions and to the project folders a chat reads. Leave unset for unrestricted access. | +| Block reads outside working directories `blockReadsOutsideWorkingDirectories` | `boolean` | MDM + Bootstrap Added in 1.46388.1 | — | Keep Claude from reading files outside a Code session’s working directories. File tools refuse such reads; sandboxed shell commands lose the home directory. | +| Allowed egress hosts `coworkEgressAllowedHosts` | `string[]` | MDM + Bootstrap Added in 1.2581.0 | — | Hosts agent tools may reach in Cowork and Chat (Code: in part). An empty list acts as unset for tools, but stops Claude opening sites in the built-in browser. | +| Require full VM sandbox `requireCoworkFullVmSandbox` | `boolean` | MDM + Bootstrap · Deprecated Added in 1.2581.0 | `false` | Runs tools inside an isolated VM instead of the host. Stronger isolation; slower file access and no host-process tools. Defaults to `false`. | +| Organization instructions `organizationInstructions` | `string` | MDM + Bootstrap Added in 1.37937.0 | — | Appended to Claude’s system prompt in Chat, Cowork, and Code. Guidance the model follows, not an enforced control. Up to 3,000 characters. | + +> **userPluginMarketplacesEnabled details** +> +> When on (default), users can add plugin marketplaces from the plugin browser. Set to `false` to restrict plugins to your organization's marketplaces: the add-marketplace surfaces are hidden, and the app refuses adds that still reach it (deep links, stale UI). Any other marketplace present on the device is then hidden in every tab, whether a user added it in the app earlier or something outside the app registered it (for example Claude Code in a terminal, under `~/.claude`): its plugins are not listed, and installs and updates from it are refused. The sessions the app starts load plugins only from your organization's marketplaces, the organization plugins directory, the app's own uploads and the user's own skills folder, enforced through Claude Code's marketplace allowlist (`strictKnownMarketplaces`, passed as the app's managed settings). Nothing is deleted: removing the key or setting it back to `true` restores them. Marketplaces provisioned by your organization (`allowedPluginMarketplaces`) and the organization plugins directory are unaffected, and plugins users uploaded are governed by `userPluginUploadsEnabled`, not this key. +> +> This is a feature-availability control, not a data boundary. Claude Code in a terminal reads the same `~/.claude` folder and is governed only by its own managed settings, not by this key. Claude Code may ignore this allowlist on a device that deploys its own Claude Code managed settings; restrict marketplaces in those settings as well. +> +> This key applies only while the app runs in third-party mode. If users could otherwise sign in to Claude.ai on the device, also set `disableDeploymentModeChooser` so the app stays in third-party mode. + +> **userPluginUploadsEnabled details** +> +> When on (default), users can upload plugin files and create plugins with Claude. Set to `false` to stop users adding plugins of their own: every in-app option for doing so is hidden, and the app refuses uploads that still reach it. +> +> This is a feature-availability control enforced in the app, not a data boundary: plugins already installed (or placed on disk outside the app) are not removed or blocked by this key. Plugins from organization-provisioned marketplaces and the organization plugins directory are unaffected. +> +> This key applies only while the app runs in third-party mode. If users could otherwise sign in to Claude.ai on the device, also set `disableDeploymentModeChooser` so the app stays in third-party mode. + +> **disabledBuiltinTools details** +> +> Each entry is a Claude Code [tool name](https://code.claude.com/docs/en/tools-reference) such as `Bash`, `Edit`, `WebFetch` or `WebSearch`, or an argument-scoped [permission rule](https://code.claude.com/docs/en/permissions#permission-rule-syntax) such as `Bash(curl *)` or `Edit(//**/*.env)`. A bare name covers every call (a bare `Bash` entry also covers the `PowerShell` tool); a scoped rule covers matching calls in every permission mode, including Auto and bypass. Scopes are matched for `Bash(…)` and `PowerShell(…)` (a command pattern) and for file paths written as `Read(…)` (covers `Read`, `Grep`, `Glob`) or `Edit(…)` (covers `Edit`, `Write`, `NotebookEdit`); many other tools take `Tool(:)`. `WebSearch` and `WebFetch` are bare-name only: to allow specific hosts, use `coworkEgressAllowedHosts`. +> +> Scoped `Bash(…)` rules apply in Code sessions only; Cowork's shell follows only a bare `Bash` entry. Start absolute file paths with `//`, not `/`: a relative pattern such as `Read(**/.env)` covers only a Code session's project folder and none of Cowork's connected folders. Scoped rules need fleet-wide build support (`disableAutoUpdates` pins builds): an older build passes a scoped entry to Claude Code unchecked. An entry whose pattern contains `)` followed by a space or comma is enforced only through Claude Code's managed-settings channel, so another Claude Code [managed-settings source](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings) replaces it unless that source sets `parentSettingsBehavior` to `"merge"`; every other entry is enforced either way. +> +> An unusable entry (a tool name in the wrong letter case, an unbalanced parenthesis, a scoped `WebSearch(…)` or `WebFetch(…)`) is kept, because the deny list is served exactly as written, and raises a configuration warning. + +> **skillCreationEnabled details** +> +> When on (default), users can create new skills and upload skill files in the app. Set to `false` to block user skill creation: the skill-creation and upload surfaces are hidden (the `skill_creation` feature is served as blocked by the organization), and the agent's skill-creation tools (saving skills from a conversation, skill proposals) are not offered in sessions — the same effect as turning off the **User-created skills** organization setting available to claude.ai enterprise admins. +> +> This is a feature-availability control enforced in the app's UI, not a data boundary: skills are files on the user's machine, and files already present there (or placed there outside the app) are not removed or blocked by this key. Skills themselves remain usable; organization-distributed plugins and bundled skills are unaffected (to disable bundled skills, use `disableBundledSkills`). + +> **scheduledTasksEnabled details** +> +> When on (default), users can schedule Cowork tasks and Code sessions to run later or on a recurring schedule, and Claude can create such schedules when asked. +> +> Set to `false` to turn scheduled tasks off for every user. The Scheduled section in Cowork and the routines list in the Code tab are hidden, together with every other place a schedule can be created. Tasks that already exist on a device no longer run; they are kept, not deleted, and run again once the key is removed or set to `true`. Claude is not offered the tools that create, change or run these tasks, and sessions start without Claude Code's own in-session scheduling tools (the `/loop` command, its cron tools and its wake-up timer). +> +> It does not remove task files already on the user's machine. A change takes effect at the next app launch. + +> **keepAwakeEnabled details** +> +> When on (default), users can turn on **Keep computer awake** (Settings → This computer → System, also shown as **Keep awake** on the Scheduled page in Cowork and the Routines page in Code) so the computer does not idle-sleep while Claude is open and scheduled tasks keep running on an idle machine. The Code tab can also keep the computer awake while a session is working (**Keep computer awake while Claude works** in Settings → Claude Code, and a session's **Keep computer awake** menu item). +> +> Set to `false` to make sure Claude never prevents the computer from sleeping: those switches are hidden and no part of the app keeps the computer awake. Users' saved choices are kept but ignored, and apply again once the key is removed or set to `true`. Scheduled tasks are unaffected and still run only while the computer is awake and the app is open. +> +> A change takes effect on a running app. + +> **developerModeEnabled details** +> +> When on (default), a user can turn on **Developer Mode** (Help → Troubleshooting → Enable Developer Mode), which adds the **Developer** menu and lets them open the developer tools (Chrome DevTools, Inspect Element) and a debugger for the app's main process. +> +> Set to `false` to keep Developer Mode off on every device that receives this setting: the **Developer** menu and the Help → Troubleshooting → Enable Developer Mode item are removed, the developer tools and the debugger cannot be opened (any already open are closed), a user's own `developer_settings.json` opt-in is ignored, and the app refuses to install an extension from a folder. Packaged (`.mcpb`) extensions are governed by `isDesktopExtensionEnabled`, not this key. +> +> This is a feature control, not a sandbox: extensions already installed from a folder stay installed and keep working, and an extension folder copied into the app's extensions folder by hand is not blocked. +> +> A change takes effect on a running app, except that the **Install unpacked extension** button in Settings keeps its launch-time state until the app restarts (clicking it while the key is off shows an error). + +> **quickEntryDefaultShortcut details** +> +> Sets the default shortcut for Quick Entry, the small prompt window that opens over other apps. It replaces Claude's built-in shortcut (double-tap Option on macOS, Ctrl+Alt+Space on Windows and Linux) for users who haven't chosen their own. +> +> This is a default, not a lock. A shortcut that a user saves in Settings → This computer → System (**Quick access shortcut** on macOS, **Quick Entry keyboard shortcut** on Windows and Linux) takes precedence, including one saved before this key was set. +> +> Accepted values: +> +> * Modifiers and one key joined by `+`, such as `Ctrl+Alt+K` or `Alt+Space`. Modifiers include `Ctrl`, `Alt`, `Shift`, `Cmd` and `Super`. `CommandOrControl` means Cmd on macOS and Ctrl elsewhere, so one value works on every platform. A combination must pair `Ctrl`, `Cmd` or `Super` with `Alt` or `Shift`, except for `Alt+Space`. Write modifier and key names exactly as shown: `ctrl` is not read as `Ctrl`. +> * `off` (the string, not `false`): no shortcut. Users can still open Quick Entry from Claude's tray or menu bar icon and set a shortcut in Settings. +> * `double-tap-option`: macOS only. Windows and Linux keep the built-in shortcut. +> +> While Claude is running, other apps don't receive this shortcut. So Claude rejects other combinations, such as `F11`, `Ctrl+C`, `Shift+K` or `Alt+Shift+K`, which typing and other apps rely on. It also rejects any combination that includes `Insert`, `Capslock` or `F5`, which screen readers use. Choose a combination that users don't need elsewhere. +> +> If Claude can't use the value as a shortcut, it ignores the value and keeps the built-in one. If another app already uses the shortcut, Claude on macOS uses the built-in shortcut. On Windows and Linux, Quick Entry keeps its previous shortcut, or none at start-up. Users can choose another in Settings. +> +> A change takes effect on a running app. + +> **builtinToolPolicy details** +> +> Keys use the same tool names and argument-scoped rule syntax as **Disabled built-in tools** (`disabledBuiltinTools`), and scopes apply in the same sessions. A bare `Bash` key also governs Claude Code's `PowerShell` tool (its shell on Windows PCs without Git for Windows); argument-scoped `Bash(…)` keys do not. Scoped **ask** rules reach sessions only through Claude Code's managed-settings channel, so another Claude Code managed-settings source replaces them unless it sets `parentSettingsBehavior` to `"merge"` (bare names hold either way). They need the same fleet-wide build support, and an older build drops a scoped **ask** entry as a configuration error (which also blocks WSL sessions on Windows until that client updates), so the tool runs unprompted. +> +> An **ask** entry, bare or scoped, also turns off the app's remembered “always allow” choices for that tool, so each prompted call is confirmed individually. **ask** on a file tool (`Read`, `Write`, `Edit`, `Glob`, `Grep`) prompts in Cowork, Chat and Code sessions. Calls that Cowork and Chat always refuse are still refused without a prompt: paths outside the session's connected folders (in Chat, outside its scratch directory and its project's folders) and protected or sensitive files inside them. A scheduled task in Cowork waits at the prompt, which appears in the task's session and, when that session is not in view, as a desktop notification. Code side chats cannot prompt, so they block matching calls. An unusable entry is dropped and recorded as a configuration error; a value other than `allow` or `ask` is treated as `ask` and reported. To remove a tool or deny a rule outright, use **Disabled built-in tools** instead. + +> **autoModeEnabled details** +> +> Left unset, users can select **Auto mode** in Code and new Code sessions start in it; a mode the user already chose, or a Claude Code settings file's `permissions.defaultMode`, takes precedence, and Cowork does not offer it. Set to `true` to also offer **Automatically approve** in Cowork (Cowork sessions still start by asking before each action until the user picks it). Set to `false` to remove the option from both tabs. In Auto mode Claude runs a safety classifier on each action and only prompts for approval on actions it judges risky, instead of following the static per-tool policy. +> +> Requires a session model that supports the safety classifier — which models qualify depends on the deployment's provider and the app version. With a model that lacks support the option is greyed out and Code sessions do not start in it. `builtinToolPolicy` and this key may both be set; Auto mode is a user-selectable option alongside the default policy, not a replacement for it. +> +> By default on a gateway, the safety classifier sends its own requests through your gateway to Claude Sonnet 5, whatever model the session uses. Make sure your gateway accepts the exact ID `claude-sonnet-5` and the `context-1m-2025-08-07` value in the `anthropic-beta` request header. If you set `inferenceModels`, list that ID there and in any group's model list (no `supports1m` needed). Sonnet 5 then also shows in the model picker. If the gateway rejects those requests or the list omits the ID, Auto mode stays available but can block actions it would otherwise allow. In Code, users see those actions marked **Blocked**. +> +> In Code sessions, a separately deployed Claude Code [managed-settings](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings) file that sets `disableAutoMode` to `"disable"` also keeps Auto mode hidden and off, whatever this key says. + +> **disableBypassPermissionsMode details** +> +> When set to `true`, sessions cannot run in bypass permissions mode: the app stops offering the mode in Code and Cowork, and a session that requests it anyway is downgraded. This is the `disableBypassPermissionsMode` setting from the `permissions` section of Claude Code's [managed settings](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings); a separately deployed Claude Code managed-settings file that sets it to `"disable"` also removes the mode, whichever source sets it. +> +> Unset (default): users the deployment otherwise allows can choose bypass permissions mode. + +> **toolSearchEnabled details** +> +> When enabled, Cowork, Code, and Chat sessions place only tool names in context up front, and Claude fetches a tool's full schema the first time it needs it. Use this when many MCP tools are configured and their inlined schemas crowd out the context window. If your endpoint does not accept the request shape it then receives, requests fail with HTTP 400. +> +> * **Claude API, Vertex AI, Bedrock, or Bedrock Mantle with no custom base URL**: not needed. The app leaves Claude Code's experimental betas on there, as terminal Claude Code does, so tool search is on by default (on Vertex AI, for Claude 4.5 and newer models). To turn it off in Code, Cowork, and Chat, set `ENABLE_TOOL_SEARCH` to `false` in the `env` block of OS-level Claude Code managed settings (with `parentSettingsBehavior: "merge"`). Earlier app versions treat these like the last case. +> * **Gateway provider, app versions bundling Claude Code 2.1.247 or later**: requests add only the tool-search shape (the `tool-search-tool-2025-10-19` `anthropic-beta` value, deferred tool loading, `tool_reference` content blocks); every other experimental Claude Code beta stays suppressed. OS-level Claude Code managed settings that keep that suppression or turn `ENABLE_TOOL_SEARCH` off still win; set `ENABLE_TOOL_SEARCH` to `force` there instead (with `parentSettingsBehavior: "merge"`). Sessions the app runs in Claude Code's gateway mode (an opt-in for users on the gateway's own sign-in) get its gateway-safe tool-search shape instead. +> * **Foundry, a custom base URL, and earlier app versions**: the app suppresses Claude Code's experimental betas for the session and the key lifts that, so requests carry the tool-search shape together with Claude Code's other experimental betas for that provider. On Vertex with app versions bundling Claude Code older than 2.1.221, leave this unset while any model older than Claude 4.5 is in use; those engines send the header regardless of model and Vertex's pre-4.5 stacks reject it. + +> **skipWebFetchPreflight details** +> +> Before fetching a page, Claude Code's WebFetch tool asks `api.anthropic.com` whether the domain is on Anthropic's content blocklist, and refuses the fetch if that lookup cannot complete. Third-party deployments route inference elsewhere and often block `api.anthropic.com` at the firewall; with the lookup on, every WebFetch in Code sessions then fails with "Unable to verify if domain … is safe to fetch", and where the host is reachable, every fetched hostname is sent to Anthropic. (Cowork sessions fetch through the app's own allowlisted fetch and never run this lookup.) +> +> Off (default): the lookup runs as it does today, so `api.anthropic.com` must be reachable from users' machines for Code-session WebFetch to work (listed under Egress Requirements). Set to `true` when users' machines cannot reach `api.anthropic.com` (corporate firewall, government network) or you do not want fetched hostnames sent there: Code sessions then fetch without the lookup and never contact that host for it. This is the same `skipWebFetchPreflight` setting Claude Code reads from its own [managed-settings](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings) file; the app passes it to every session it starts. This key does not restrict which domains Claude may fetch. Neither does `coworkEgressAllowedHosts` in Code sessions, where it only pre-approves its hosts; `builtinToolPolicy` can require approval for every fetch. + +> **allowedWorkspaceFolders details** +> +> Paths can reference `~` and these environment variables, expanded per user: `%OneDrive%`, `%OneDriveCommercial%`, `%OneDriveConsumer%`, `%APPDATA%`, `%LOCALAPPDATA%`, `%USERNAME%`, `%XDG_DOCUMENTS_DIR%`. The set is fixed; an entry that references any other `%VAR%`, or one that is unset on the device, is ignored. +> +> Each folder is interpreted on the machine the session runs on. For a Code session on an SSH host, `~` means the remote user's home, an entry that references a `%VAR%` is ignored there (environment variables belong to the machine that defines them), and the session's working directory must fall inside one of the folders as they exist on that host. One list serves every machine: `["~/work", "/srv/work"]` governs `~/work` for each user, on a managed Mac or a Linux host, and `/srv/work` on a host that has it. A folder that names nothing real on a given machine simply allows nothing there. An empty list allows no folder at all; unset leaves access unrestricted. +> +> A listed folder is one Claude may write as well as read, unless the entry's `mode` (Access mode in Setup) makes it read-only; that field's own description says how far read-only reaches. A Code session can reach every listed folder, not only the one it was opened in. Setting this key also turns on Claude Code's sandbox where it runs (macOS, or Linux and SSH hosts with bubblewrap): there a shell command normally writes in the listed folders without an approval prompt, and its writes to most other places, such as a package cache in the home directory, are refused. A home directory holds shell start-up files and SSH keys, so list work folders, not a whole home directory. +> +> The list also limits which folders of a project a chat reads. +> +> | Field | Type | Default | Description | +> | - | - | - | - | +> | `path` | `string` | — | Absolute folder path. May start with \~ or one of the listed %VAR% tokens, expanded per user. Subfolders are included. | +> | `isDefaultSelected` | `boolean` | — | Shows as a folder chip on the new-task page and skips the trust prompt. Users can remove it. | +> | `mode` | `enum` | — | Read-only folders can be viewed and searched but not modified in Cowork. In Code, applies to file tools only. Over SSH, also to Bash in its sandbox. One of: `rw`, `ro`. | + +> **blockReadsOutsideWorkingDirectories details** +> +> When set to `true`, Code sessions refuse reads outside their working directories (the session folder plus any `allowedWorkspaceFolders`). The file tools (Read, Grep, Glob) refuse them in every permission mode; where Claude Code's sandbox runs (macOS, or Linux and SSH hosts with bubblewrap, once `allowedWorkspaceFolders` is set or an egress allowlist applies: in third-party deployments one applies unless `coworkEgressAllowedHosts` contains `*`, in first-party deployments none does) shell commands cannot see the home directory and other user folders (`/Users`, `/home`, mounted volumes) and a read there is refused with no prompt; elsewhere (Windows, Linux without bubblewrap, or neither folders nor an egress allowlist in effect) such shell reads prompt for approval. The app keeps the user's git configuration files (which may themselves embed credentials such as URL tokens; a symlinked one stays hidden), its own Claude Code installation, and the session's plugin and attachment folders readable (not on a Windows SSH host, where plugin files and attachments stay out of the file tools' reach under the block). An allowed folder that is or contains the home directory leaves it readable. +> +> Users can re-open folders (even their whole home) in their own Claude Code settings with `sandbox.filesystem.allowRead` or `permissions.additionalDirectories`; settings files tracked in a git repository cannot. The key travels on Claude Code's managed-settings channel: another Claude Code managed-settings source replaces it unless that source sets `parentSettingsBehavior` to `"merge"`, and one that sets `sandbox.filesystem.allowManagedReadPathsOnly` reduces it to approval prompts. This is `permissions.blockReadsOutsideWorkingDirectories` in Claude Code's [managed settings](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings). +> +> Unset (default): nothing changes. + +> **coworkEgressAllowedHosts details** +> +> Applies only to **tool calls**, in Cowork, Code and Chat. In Cowork it covers the sandbox's web fetch, shell commands and package installs. In Chat it covers web fetch and commands in the file-analysis sandbox. In Code it's [translated into Claude Code's network sandbox allowlist](https://claude.com/docs/third-party/claude-desktop/code#applied-as-managed-policy), and by default a separately deployed Claude Code managed-settings file takes precedence. It does **not** cover Web Search (which runs at your inference provider), inference, or MCP traffic. A list other than `*` also bounds where Claude may browse in the built-in browser. When unset, Cowork and Chat refuse web fetch. +> +> Entries are exact hostnames (`api.github.com`), wildcards (`*.corp.com` matches subdomains at any depth, not `corp.com` itself), or `*` to allow all. IP addresses match only when listed exactly. In Cowork and Chat, web fetch always blocks `localhost` and private addresses, and shells reach only listed hosts (not your inference provider's, unless listed), or none when unset. Code's shell obeys that limit only on macOS, and with bubblewrap and socat on Linux or WSL2; elsewhere, Windows included, it reaches any host. Code's web fetch isn't limited. +> +> Any entry except bare `*` may carry a `:port` suffix (`*.corp.com:8443`) restricting it to that port. IPv6 literals are not supported. Invalid entries are dropped with a log warning and the rest still work. An unreadable value counts as an empty list. Ports are enforced for the Cowork sandbox's web fetch, shell, and package-install egress; plugin CLIs also reach hosts their plugin declares and ignore port-scoped entries for now, and the Code translation treats them as the bare host. Only deploy port-scoped entries once your whole fleet supports them (`disableAutoUpdates` pins builds). On an older build, a single one invalidates the session's whole shell and package-install allowlist. +> +> Open listed hosts on your network firewall too. + +> **organizationInstructions details** +> +> Free-text instructions from your organization that Claude Desktop appends, in a clearly delimited block, after its own system prompt in **Chat**, **Cowork**, and **Code** (every chat, task, and Code session, including the sub-agents they spawn): for example house style, data-handling rules, or topics to decline. The model is told these instructions come from the organization's administrator and take priority over a user's personal preferences. +> +> This is guidance the model follows, not an enforced control: like any system-prompt text it steers the model's behavior and is usually honored, but it does not guarantee an outcome and is not a substitute for the restriction keys (tool policy, egress allowlist, folder allowlist). The app's own system prompt is never replaced or shortened by this key; in Code sessions it is added after Claude Code's own prompt and any `CLAUDE.md` instructions still apply. +> +> Read from the app's loaded configuration when a session starts; a changed value generally takes effect for sessions started after the next app launch. Leading and trailing whitespace is trimmed; an empty string is treated as unset. Maximum 3,000 characters; a longer value is rejected (the key is ignored with a configuration error) rather than truncated. Line breaks are preserved when the value is delivered as JSON, a bootstrap response, a `.mobileconfig` profile, or a `.reg` file; the Group Policy (ADMX) and Intune text box for this setting is single-line. ## Connectors | Setting | Type | Availability | Default | Description | | - | - | - | - | - | -| Claude.ai data import
`claudeAiImport` | `object` | MDM + Bootstrap
Added in 1.10628.0 | — | Lets users import Claude.ai chats and projects, plus earlier Claude sessions on this computer, when `enabled` is true. `automatic3pImport` is a separate switch. | - - - - | Field | Type | Default | Description | - | - | - | - | - | - | `enabled` | `boolean` | `false` | Lets users import a Claude.ai data export and earlier Claude sessions on this computer from Settings → Import. Doesn’t affect a provisioned sign-in import. | - | `allowedOrganizationUuids` | `string[]` | — | When set, users import by sign-in only, and only from the Claude.ai organizations with these IDs. | - | `automatic3pImport` | `boolean` | — | Copy this computer’s earlier third-party sessions into the app once, in the background. Independent of `enabled`. | - | `exportEnabled` | `boolean` | `false` | Lets users export this computer’s chats, Cowork tasks, and Code sessions as a zip another install can import. No effect unless `enabled` is true. | - | `bannerBehavior` | `enum` | — | Prompt to import on a new chat or task. Off if unset. `show`: always; needs `enabled` or a sign-in import. `detect`: if `enabled` finds earlier Claude sessions. One of: `off`, `detect`, `show`. | - - +| Claude.ai data import `claudeAiImport` | `object` | MDM + Bootstrap Added in 1.10628.0 | — | Lets users import Claude.ai chats and projects, plus earlier Claude sessions on this computer, when `enabled` is true. `automatic3pImport` is a separate switch. | + +> **claudeAiImport details** +> +> | Field | Type | Default | Description | +> | - | - | - | - | +> | `enabled` | `boolean` | `false` | Lets users import a Claude.ai data export and earlier Claude sessions on this computer from Settings → Import. Doesn’t affect a provisioned sign-in import. | +> | `allowedOrganizationUuids` | `string[]` | — | When set, users import by sign-in only, and only from the Claude.ai organizations with these IDs. | +> | `automatic3pImport` | `boolean` | — | Copy this computer’s earlier third-party sessions into the app once, in the background. Independent of `enabled`. | +> | `exportEnabled` | `boolean` | `false` | Lets users export this computer’s chats, Cowork tasks, and Code sessions as a zip another install can import. No effect unless `enabled` is true. | +> | `bannerBehavior` | `enum` | — | Prompt to import on a new chat or task. Off if unset. `show`: always; needs `enabled` or a sign-in import. `detect`: if `enabled` finds earlier Claude sessions. One of: `off`, `detect`, `show`. | ### Authentication | Setting | Type | Availability | Default | Description | | - | - | - | - | - | -| Microsoft 365 native sign-in broker
`microsoftAuthBroker` | `enum` | MDM + Bootstrap
Added in 1.19367.0 | `auto` | “disabled” forces browser-based Microsoft 365 sign-in; “required” fails sign-in when the OS broker is unavailable, so the refresh token stays broker-held. One of: `auto`, `disabled`, `required`. Defaults to `auto`. | -| Microsoft 365 sign-in with the Windows account
`microsoftAuthDefaultAccount` | `enum` | MDM + Bootstrap
Added in 2.26454.0 | `disabled` | “enabled”: when a user clicks Connect on Windows, Microsoft 365 signs in with the work account already signed in to Windows, without the account picker. One of: `enabled`, `disabled`. Defaults to `disabled`. | +| Microsoft 365 native sign-in broker `microsoftAuthBroker` | `enum` | MDM + Bootstrap Added in 1.19367.0 | `auto` | “disabled” forces browser-based Microsoft 365 sign-in; “required” fails sign-in when the OS broker is unavailable, so the refresh token stays broker-held. One of: `auto`, `disabled`, `required`. Defaults to `auto`. | +| Microsoft 365 sign-in with the Windows account `microsoftAuthDefaultAccount` | `enum` | MDM + Bootstrap Added in 2.26454.0 | `disabled` | “enabled”: when a user clicks Connect on Windows, Microsoft 365 signs in with the work account already signed in to Windows, without the account picker. One of: `enabled`, `disabled`. Defaults to `disabled`. | - - - `auto` (default): use the OS sign-in broker where available (WAM on Windows, the Company Portal SSO extension on macOS) and fall back to a browser sign-in otherwise. `disabled`: always use the browser sign-in. `required`: fail sign-in when the broker is unavailable rather than falling back to the browser, so the refresh token stays broker-held. Linux has no broker, so `required` is not supported there. Desktop builds older than the version that introduced `required` treat it as `disabled` (browser-only sign-in) — the opposite posture — so gate rollout on client version. - +> **microsoftAuthBroker details** +> +> `auto` (default): use the OS sign-in broker where available (WAM on Windows, the Company Portal SSO extension on macOS) and fall back to a browser sign-in otherwise. `disabled`: always use the browser sign-in. `required`: fail sign-in when the broker is unavailable rather than falling back to the browser, so the refresh token stays broker-held. Linux has no broker, so `required` is not supported there. Desktop builds older than the version that introduced `required` treat it as `disabled` (browser-only sign-in) — the opposite posture — so gate rollout on client version. - - `disabled` (default): Connect shows the account picker when no account is connected. `enabled`: on Windows, when `microsoftAuthBroker` is not `disabled`, Connect first signs in silently with the account Windows already uses. The `tenantId` on the `microsoft365` entry in managed MCP servers must be a tenant GUID. With `common`, `organizations` or `consumers`, users always get the picker. Users also get the picker for accounts from another tenant, guest accounts and personal Microsoft accounts, when the silent sign-in fails, and when the computer cannot store credentials securely. A user who already signed in to Microsoft 365 through the browser keeps that account. After a user disconnects Microsoft 365, or a different person signs in to Claude on this computer, Connect always shows the picker for that connector on this computer, including for a disconnect that happened before this setting was turned on. Turning this setting off stops new silent sign-ins and signs nobody out: users already connected keep their account until they disconnect. macOS and Linux are not affected. Third-party deployments only: first-party installs ignore this setting. - - +> **microsoftAuthDefaultAccount details** +> +> `disabled` (default): Connect shows the account picker when no account is connected. `enabled`: on Windows, when `microsoftAuthBroker` is not `disabled`, Connect first signs in silently with the account Windows already uses. The `tenantId` on the `microsoft365` entry in managed MCP servers must be a tenant GUID. With `common`, `organizations` or `consumers`, users always get the picker. Users also get the picker for accounts from another tenant, guest accounts and personal Microsoft accounts, when the silent sign-in fails, and when the computer cannot store credentials securely. A user who already signed in to Microsoft 365 through the browser keeps that account. After a user disconnects Microsoft 365, or a different person signs in to Claude on this computer, Connect always shows the picker for that connector on this computer, including for a disconnect that happened before this setting was turned on. Turning this setting off stops new silent sign-ins and signs nobody out: users already connected keep their account until they disconnect. macOS and Linux are not affected. Third-party deployments only: first-party installs ignore this setting. ### Extensions | Setting | Type | Availability | Default | Description | | - | - | - | - | - | -| Allow desktop extensions
`isDesktopExtensionEnabled` | `boolean` | MDM + Bootstrap
Added in 1.2581.0 | `false` | .dxt and .mcpb installs. Defaults to `false`. | -| Require signed extensions
`isDesktopExtensionSignatureRequired` | `boolean` | MDM + Bootstrap
Added in 1.2581.0 | `false` | Reject desktop extensions that are not signed by a trusted publisher. Defaults to `false`. | +| Allow desktop extensions `isDesktopExtensionEnabled` | `boolean` | MDM + Bootstrap Added in 1.2581.0 | `false` | .dxt and .mcpb installs. Defaults to `false`. | +| Require signed extensions `isDesktopExtensionSignatureRequired` | `boolean` | MDM + Bootstrap Added in 1.2581.0 | `false` | Reject desktop extensions that are not signed by a trusted publisher. Defaults to `false`. | - - - 1P builds default to enabled at runtime unless this is explicitly set. In 3P, enabling this allows loading extensions; local install additionally requires an org policy backend. - - +> **isDesktopExtensionEnabled details** +> +> 1P builds default to enabled at runtime unless this is explicitly set. In 3P, enabling this allows loading extensions; local install additionally requires an org policy backend. ### MCP | Setting | Type | Availability | Default | Description | | - | - | - | - | - | -| Managed MCP servers
`managedMcpServers` | `object[]` | MDM + Bootstrap
Added in 1.2581.0 | — | Org-pushed MCP servers: remote (HTTP/SSE) or local (stdio command). May embed bearer tokens. | -| Allow persistent tool approvals
`mcpPersistentAlwaysAllowEnabled` | `boolean` | MDM + Bootstrap
Added in 1.24012.9 | `true` | Offer the persistent “Always allow” approval options for MCP tools. Disable to keep tool approvals per-call or session-scoped only. Defaults to `true`. | -| Scheduled-task tool approval lifetime
`mcpScheduledTaskApprovalLifetimeDays` | `integer` | MDM + Bootstrap
Added in 2.7032.0 | — | How many days a scheduled task may reuse a lasting MCP-tool approval before it asks again. 0 removes the lasting option. Range: 0–3650. | -| Allow user-added MCP servers
`isLocalDevMcpEnabled` | `boolean` | MDM + Bootstrap
Added in 1.2581.0 | `true` | Local stdio servers added via the Developer settings. Remote servers come from the managed list above or organization plugins. Defaults to `true`. | -| Allowed plugin MCP servers
`allowedPluginMcpServers` | `object[]` | MDM + Bootstrap
Added in 2.2553.0 | — | Servers plugins may connect in sessions, beyond the managed list above and organization plugins. An empty list allows none; unset keeps today’s rules. | -| Blocked plugin MCP servers
`deniedPluginMcpServers` | `object[]` | MDM + Bootstrap
Added in 2.16120.0 | — | Remote servers plugins may not connect, even if the allowed list admits them; in Code sessions, configuration-file servers too. Unset or empty blocks none. | -| MCP tool call timeout
`mcpToolTimeoutSec` | `integer` | MDM + Bootstrap
Added in 1.37937.0 | — | Per-call timeout for MCP tool calls, in seconds. Default 180 (3 minutes). Range: 60–3600. | - - - - For OAuth-authenticated entries, the app builds the redirect URI as `http://:/callback`; register that exact value with the OAuth provider. Tokens refresh automatically during a session. - - `toolPolicy` locks the per-tool approval state, keyed by tool name: `"blocked"` removes the tool from the session and labels it admin-blocked, `"ask"` requires approval on every call (Allow once / Deny only; no persistent always-allow; a scheduled Cowork task waits at that prompt), `"allow"` pre-approves. Tools **not listed** follow the user's choice: the prompt offers a persistent Always allow, except for tools that can modify data, which show a session-scoped **Allow for this task** alongside **Allow for all tasks** with a malicious-instruction warning. In Code sessions, `blocked` and `ask` are forwarded as Claude Code permission rules; `allow` is not. - - Keys may contain `*` wildcards (`"read_*"` matches every tool whose name starts with `read_`; anchored, and `*` is the only wildcard). When several wildcard keys match, the strictest applies (blocked > ask > allow). An exact-name key wins over matching wildcards, with two exceptions in the stricter direction: in Code sessions a wildcard `ask`, or a wildcard `blocked` other than the bare `"*"`, beats a less strict exact key (so `"*": "blocked"` plus exact `"allow"` entries still works as deny-by-default there); and in chat approval prompts and always-allow persistence a wildcard `ask` keeps every matching tool behind a per-call prompt even when a more permissive exact key matches, while direct tool invocations such as artifact or widget calls follow the exact key. - - For the bundled Microsoft 365 connector, the send tools (`outlook_send_mail`, `outlook_send_draft`, `outlook_forward_mail`, `outlook_create_event`, `outlook_update_event`, `teams_send_chat_message`, `teams_send_channel_message`, `teams_reply_channel_message`) cannot be loosened below `ask`; an `allow` setting resolves to `ask`. - - | Field | Type | Default | Description | - | - | - | - | - | - | `name` | `string` | — | Unique name for this server. Shown to users and used to key tool policy and sign-in state. | - | `server` | `string` | — | Which bundled connector this entry turns on. Set instead of a transport; each built-in server has its own fields. One of: `microsoft365`, `websearch`, `github`. | - | `tenantId` | `string` | — | Your organization’s Microsoft Entra directory (tenant) ID. | - | `clientId` | `string` | — | OAuth app client ID for this built-in server. | - | `azureCloud` | `enum` | — | Microsoft cloud for sign-in and Graph. Leave as global for commercial Microsoft 365; US Government clouds require your own app registration (Client ID). One of: `global`, `us-gov-high`, `us-gov-dod`. | - | `continuousAccessEvaluation` | `enum` | `enabled` | Request CAE-capable Microsoft Graph tokens: long-lived (up to about 28 hours) but revocable within minutes. Set “disabled” to keep standard one-hour tokens. One of: `enabled`, `disabled`. | - | `scope` | `string` | — | What the server may request at sign-in. If blank, Desktop’s default read set is used. | - | `toolPolicy` | `object` | — | Lock the approval state for specific tools. Unlisted tools stay user-controlled. | - | `headers` | `object` | — | Static headers sent on every request — routing and tenant headers only. No credentials here; use the headers helper script for tokens and rotating values. | - | `headersHelper` | `string` | — | Script that prints the auth header as a JSON object to stdout. Runs before each request (cached for the TTL below). | - | `headersHelperTtlSec` | `integer` | — | How long the helper’s headers are reused before it runs again, in seconds. Defaults to 300. | - | `headersHelperRefreshBufferSec` | `integer` | — | Seconds before the TTL expires at which the helper re-runs mid-session. Defaults to 60. Keep it larger than the helper’s typical runtime. | - | `provider` | `enum` | — | Runs search from the desktop, for inference providers without native web search. Supply the provider’s API key through the headers helper script below. One of: `brave`, `tavily`, `exa`, `custom`. | - | `customUrl` | `string` | — | POST endpoint accepting \{q} JSON and returning a results\[] array. Only used when provider is Custom. | - | `host` | `string` | — | Leave blank for github.com. For GitHub Enterprise Server, your instance’s base URL. | - | `toolsets` | `string` | — | Comma-separated github-mcp-server toolsets to enable. If blank, the bundled server’s default toolsets are used. | - | `readOnly` | `boolean` | — | Offer only read tools — the server registers no write tools at all. | - | `transport` | `enum` | — | How the app connects: Streamable HTTP, legacy SSE, or a local command (stdio). policy-only connects to nothing; it only sets a plugin server’s tool policy. One of: `http`, `sse`, `stdio`, `policy-only`. | - | `url` | `string` | — | HTTPS endpoint of the remote MCP server. | - | `oauth` | `object` | — | OAuth for a remote server: true to auto-register a client, a pre-registered client ID with tenant and scope, or mode “hosted” for an Anthropic-signed identity. | - | `oauth.clientId` | `string` | — | OAuth client ID from your IdP app registration. Leave unset to auto-register (dynamic client registration) and only narrow scopes. | - | `oauth.clientSecret` | `string` | — | Only for IdPs that require one (e.g. Box). Hosted config can store only a Google Desktop-app secret (GOCSPX-…); for other IdPs use the client secret helper. | - | `oauth.clientSecretHelper` | `string` | — | Executable that prints the client secret on stdout as a JSON object with a single clientSecret key; any other output is rejected. Overrides the inline value. | - | `oauth.authorizationServer` | `string[]` | — | Issuer URLs the OAuth sign-in may use, as a JSON array. Pre-filled by presets; ask your IdP admin if unsure. | - | `oauth.authorizationUrl` | `string` | — | Only for IdPs that don’t serve a .well-known discovery document. Set together with Token URL; requires Client ID. | - | `oauth.tokenUrl` | `string` | — | Only for IdPs that don’t serve a .well-known discovery document. Set together with Authorization URL; requires Client ID. | - | `oauth.tenantId` | `string` | — | Required for single-tenant Entra apps. Leave blank for multi-tenant or non-Microsoft IdPs. | - | `oauth.authFlow` | `enum` | — | How Entra sign-in runs for this server: the system browser (default) or the OS identity broker. One of: `browser`, `broker`. | - | `oauth.scope` | `string` | — | Space-separated scopes sent on the authorize request. Leave unset to use the scopes the server advertises. Required when Tenant ID is set. | - | `oauth.appendOfflineAccess` | `boolean` | — | Adds offline\_access to the authorize request so the IdP returns a refresh token for silent renewal. | - | `oauth.callbackHost` | `enum` | — | Use localhost only if your IdP’s registered redirect URI specifies it. One of: `127.0.0.1`, `localhost`. | - | `oauth.callbackPort` | `integer` | — | Only set if your IdP requires an exact-match redirect port. Entra accepts any. | - | `oauth.additionalRedirectReferrerHosts` | `string` | — | Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host. | - | `command` | `string` | — | Absolute path to the server executable, run on the user’s machine. | - | `args` | `string[]` | — | Arguments passed to the command, one per entry. | - | `env` | `object` | — | Environment variables set for the command. | - | `envHelper` | `string` | — | Script that prints environment variables as a JSON object to stdout. Runs when the local server starts (cached for the TTL below). | - | `envHelperTtlSec` | `integer` | `300` | Maximum age of a cached helper result, in seconds (default 300). Applies when the server starts or restarts. | - | `startupTimeoutSec` | `integer` | `120` | Maximum wait in seconds for the server to start and list its tools. | - - - - When enabled (the default), approval prompts for tools without a `toolPolicy` entry offer a persistent grant: **Always allow**, or **Allow for all tasks** for tools that can modify data. The Tool permissions picker in Connector settings also lets users pre-approve tools. These grants persist across sessions with no expiry. - - When disabled, the persistent options are hidden from approval prompts and from the Connector settings picker, and previously stored persistent grants stop being honored. Scheduled-task runs also stop offering, recording, and replaying the **Allow for all scheduled runs** approval (**Always allow** in Code sessions), unless a scheduled-task approval lifetime of one day or more is set. Users can still approve each call. Outside scheduled-task runs, in chat and Cowork they can also choose **Allow for this task**, except for read-only tools on servers they added themselves. - - A per-tool `toolPolicy` entry on `managedMcpServers` always takes precedence over this key: `blocked`, `ask`, and `allow` behave exactly as documented there whether this key is enabled or not. - - This key governs chat and Cowork, and also Code sessions on the device (including WSL) or over SSH. In those Code sessions, with the key disabled, the prompt for an MCP tool offers **Allow for this session** instead of **Always allow**, except on scheduled-task runs. This approval is not saved to Claude Code's settings files. It lasts until the session is deleted, and sessions forked or started from it do not inherit it. Claude Code's own allow rules and hooks still apply. Allow rules in its settings files, including ones saved earlier with **Always allow**, and hooks in its settings or plugins keep allowing the tool until they are removed. Code sessions receive only the `blocked` and `ask` values of `toolPolicy` entries, so a tool set to `allow` still prompts there, and this key applies to it. - - - - On a scheduled task, the approval prompt for an MCP tool can offer a lasting approval, so later runs use that tool without asking: **Allow for all scheduled runs** in Cowork, **Always allow** in the Code tab. This setting limits how long that approval lasts. With a limit, the button reads **Allow for N days**. Once an approval is older than that, the next run asks again, and approving again renews it. `0` removes the lasting option, and approvals already stored stop being reused. Leave it blank to change nothing. Choose a number comfortably longer than the gap between runs. - - The limit covers MCP tools only, and a `toolPolicy` entry on `managedMcpServers` still takes precedence. If a configuration server delivers the setting, then after each launch scheduled tasks ask instead of reusing stored approvals (as at `0`) until the app has fetched the configuration again. - - If `mcpPersistentAlwaysAllowEnabled` is off, a limit of one day or more brings the lasting option back for scheduled tasks only. - - Code tab: the limit covers only lasting approvals given after this setting took effect. An earlier one was usually saved as an allow rule in Claude Code's own settings: for a scheduled task, the project's `.claude/settings.local.json`, under `permissions.allow`. Any allow rule in Claude Code's settings keeps allowing the tool without asking, even at `0`, until that entry is removed. That includes a rule written by hand, and one saved by **Always allow** in an ordinary Code session in the same project, which the app offers whenever `mcpPersistentAlwaysAllowEnabled` is on. In an ordinary Code session over SSH, if this setting has a value (even `0`), **Always allow** for a tool of a server set up on the host lasts for the session only and saves no rule there. - - - - Set to `false` in a device-management profile, this key also locks down the local (`stdio`) entries of `managedMcpServers`: the app starts one only when that profile itself lists an entry of the same name, and with the profile's own command, arguments and environment. Only the profile's value engages this. A `false` from a configuration server or the admin console turns user-added servers off and does not engage it. - - - - Unset (default): with managed servers listed, sessions take MCP servers only from plugins and the desktop; with no managed servers listed, nothing is restricted. - - When set, Cowork, Chat and Code sessions connect the managed list above and the servers the desktop serves from the administrator's org-plugins directory, plus only servers declared by other plugins (user-installed or marketplace) that match an entry. An entry in the managed list above with `transport: "policy-only"` sets a plugin server's tool permissions but does not admit it; to admit that server, list the server's own URL here. Claude Code configuration-file servers (`~/.claude.json`, a project's `.mcp.json`, `claude mcp add`) are never connected. With the key set, the desktop starts no plugin server on the computer itself, whatever the entries say. The one exception is the MCP servers it serves to sessions from the org-plugins directory. Each entry is a URL pattern in Claude Code's form, `{"serverUrl": "https://*.example.com/*"}` (`*` wildcards; a host `*` spans `a.b`): a plugin's remote server connects when its URL matches an entry. No entry admits a plugin's local (stdio) server, and an empty list admits no plugin server. Other shapes, the `serverName` and `serverCommand` forms included, are dropped and reported; a value that is not a list, or has no readable entry, locks sessions to the managed list and the org-plugins directory's servers, and stops every other desktop-started plugin server. User-added local servers and extensions keep their own keys. - - Coexistence with another Claude Code managed-settings source on the device: see [managed settings](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings). - - | Field | Type | Default | Description | - | - | - | - | - | - | `serverUrl` | `string` | — | URL pattern a plugin’s remote server must match, with \* wildcards. | - - - - Unset (default) or an empty list: nothing is blocked. - - When set, Cowork, Chat and Code sessions do not connect a plugin's remote server whose URL matches an entry. The key works with or without `allowedPluginMcpServers`; a server that matches both lists stays blocked. In a Code session that reads Claude Code configuration-file servers (`~/.claude.json`, a project's `.mcp.json`, `claude mcp add`), a matching remote server from those files is refused as well. The managed list above, the servers the desktop serves from the administrator's org-plugins directory, user-added local servers and extensions are not affected: remove those at their own keys. Each entry is a URL pattern in Claude Code's form, `{"serverUrl": "https://*.example.com/*"}` (`*` wildcards; a host `*` spans `a.b`). An entry matches an address, not a server: the same server under another host name or an IP address, or behind a plugin's local (stdio) server, which has no URL, is not matched. `https://*.example.com/*` does not match `http://`, `wss://` or the bare `example.com`; a pattern such as `example.com/*`, which names no scheme, matches nothing, and a lone `*` matches every URL. To keep a plugin's servers out whatever address they use, set `allowedPluginMcpServers`, which admits only the servers it lists. The desktop reads no other shape, the `serverName` and `serverCommand` forms included: a value that is not a list, or that holds any entry the desktop cannot read, is reported and blocks every plugin's remote server (and those configuration-file remote servers), because skipping an entry of a block list would let its server connect. The servers named above as not affected still connect. - - Coexistence with another Claude Code managed-settings source on the device: see [managed settings](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings). - - | Field | Type | Default | Description | - | - | - | - | - | - | `serverUrl` | `string` | — | URL pattern of the remote servers to block, with \* wildcards. | - - - - Sets the per-call timeout the agent applies to every MCP tool call; a call that runs longer fails with a timeout error the model can see. Cowork and chat sessions default to 180 seconds. Code sessions have no desktop-imposed MCP tool timeout today, so setting this key introduces one there as well. The desktop's own request deadlines toward MCP servers — the managed servers above and, where `isLocalDevMcpEnabled` permits them, user-added local servers — follow this value so they never cut a call short first; while the key is unset, calls to user-added local servers are additionally limited to 60 seconds by the desktop. Values outside 60–3600 are rejected at parse time (the error is listed in the diagnostics report) and the defaults apply. - - The timeout is global (there is no per-server or per-tool form), so size it for the slowest tool you need to complete: long-running tools on one server extend the window during which a stuck call on any server holds its turn. Cowork's built-in shell tool runs under the same cap: a single command's `timeout_ms` (itself limited to 600 seconds) cannot exceed this value. - - +| Managed MCP servers `managedMcpServers` | `object[]` | MDM + Bootstrap Added in 1.2581.0 | — | Org-pushed MCP servers: remote (HTTP/SSE) or local (stdio command). May embed bearer tokens. | +| Allow persistent tool approvals `mcpPersistentAlwaysAllowEnabled` | `boolean` | MDM + Bootstrap Added in 1.24012.9 | `true` | Offer the persistent “Always allow” approval options for MCP tools. Disable to keep tool approvals per-call or session-scoped only. Defaults to `true`. | +| Scheduled-task tool approval lifetime `mcpScheduledTaskApprovalLifetimeDays` | `integer` | MDM + Bootstrap Added in 2.7032.0 | — | How many days a scheduled task may reuse a lasting MCP-tool approval before it asks again. 0 removes the lasting option. Range: 0–3650. | +| Allow user-added MCP servers `isLocalDevMcpEnabled` | `boolean` | MDM + Bootstrap Added in 1.2581.0 | `true` | Local stdio servers added via the Developer settings. On third-party deployments, off also stops plugins’ local servers. Remote servers keep working. Defaults to `true`. | +| Allowed plugin MCP servers `allowedPluginMcpServers` | `object[]` | MDM + Bootstrap Added in 2.2553.0 | — | Servers plugins may connect in sessions, beyond the managed list above and organization plugins. An empty list allows none; unset keeps today’s rules. | +| Blocked plugin MCP servers `deniedPluginMcpServers` | `object[]` | MDM + Bootstrap Added in 2.16120.0 | — | Remote servers plugins may not connect, even if the allowed list admits them; in Code sessions, configuration-file servers too. Unset or empty blocks none. | +| MCP tool call timeout `mcpToolTimeoutSec` | `integer` | MDM + Bootstrap Added in 1.37937.0 | — | Per-call timeout for MCP tool calls, in seconds. Default 180 (3 minutes). Range: 60–3600. | + +> **managedMcpServers details** +> +> For OAuth-authenticated entries, the app builds the redirect URI as `http://:/callback`; register that exact value with the OAuth provider. Tokens refresh automatically during a session. +> +> `toolPolicy` locks the per-tool approval state, keyed by tool name: `"blocked"` removes the tool from the session and labels it admin-blocked, `"ask"` requires approval on every call (Allow once / Deny only; no persistent always-allow; a scheduled Cowork task waits at that prompt), `"allow"` pre-approves. Tools **not listed** follow the user's choice: the prompt offers a persistent Always allow, except for tools that can modify data, which show a session-scoped **Allow for this task** alongside **Allow for all tasks** with a malicious-instruction warning. In Code sessions, `blocked` and `ask` are forwarded as Claude Code permission rules; `allow` is not. +> +> Keys may contain `*` wildcards (`"read_*"` matches every tool whose name starts with `read_`; anchored, and `*` is the only wildcard). When several wildcard keys match, the strictest applies (blocked > ask > allow). An exact-name key wins over matching wildcards, with two exceptions in the stricter direction: in Code sessions a wildcard `ask`, or a wildcard `blocked` other than the bare `"*"`, beats a less strict exact key (so `"*": "blocked"` plus exact `"allow"` entries still works as deny-by-default there); and in chat approval prompts and always-allow persistence a wildcard `ask` keeps every matching tool behind a per-call prompt even when a more permissive exact key matches, while direct tool invocations such as artifact or widget calls follow the exact key. +> +> For the bundled Microsoft 365 connector, the send tools (`outlook_send_mail`, `outlook_send_draft`, `outlook_forward_mail`, `outlook_create_event`, `outlook_update_event`, `teams_send_chat_message`, `teams_send_channel_message`, `teams_reply_channel_message`) cannot be loosened below `ask`; an `allow` setting resolves to `ask`. +> +> | Field | Type | Default | Description | +> | - | - | - | - | +> | `name` | `string` | — | Unique name for this server. Shown to users and used to key tool policy and sign-in state. | +> | `server` | `string` | — | Which bundled connector this entry turns on. Set instead of a transport; each built-in server has its own fields. One of: `microsoft365`, `websearch`, `github`. | +> | `tenantId` | `string` | — | Your organization’s Microsoft Entra directory (tenant) ID. | +> | `clientId` | `string` | — | OAuth app client ID for this built-in server. | +> | `azureCloud` | `enum` | — | Microsoft cloud for sign-in and Graph. Leave as global for commercial Microsoft 365; US Government clouds require your own app registration (Client ID). One of: `global`, `us-gov-high`, `us-gov-dod`. | +> | `continuousAccessEvaluation` | `enum` | `enabled` | Request CAE-capable Microsoft Graph tokens: long-lived (up to about 28 hours) but revocable within minutes. Set “disabled” to keep standard one-hour tokens. One of: `enabled`, `disabled`. | +> | `scope` | `string` | — | What the server may request at sign-in. If blank, Desktop’s default read set is used. | +> | `toolPolicy` | `object` | — | Lock the approval state for specific tools. Unlisted tools stay user-controlled. | +> | `headers` | `object` | — | Static headers sent on every request — routing and tenant headers only. No credentials here; use the headers helper script for tokens and rotating values. | +> | `headersHelper` | `string` | — | Script that prints the auth header as a JSON object to stdout. Runs before each request (cached for the TTL below). | +> | `headersHelperTtlSec` | `integer` | — | How long the helper’s headers are reused before it runs again, in seconds. Defaults to 300. | +> | `headersHelperRefreshBufferSec` | `integer` | — | Seconds before the TTL expires at which the helper re-runs mid-session. Defaults to 60. Keep it larger than the helper’s typical runtime. | +> | `provider` | `enum` | — | Runs search from the desktop, for inference providers without native web search. Supply the provider’s API key through the headers helper script below. One of: `brave`, `tavily`, `exa`, `custom`. | +> | `customUrl` | `string` | — | POST endpoint accepting \{q} JSON and returning a results\[] array. Only used when provider is Custom. | +> | `host` | `string` | — | Leave blank for github.com. For GitHub Enterprise Server, your instance’s base URL. | +> | `toolsets` | `string` | — | Comma-separated github-mcp-server toolsets to enable. If blank, the bundled server’s default toolsets are used. | +> | `readOnly` | `boolean` | — | Offer only read tools — the server registers no write tools at all. | +> | `transport` | `enum` | — | How the app connects: Streamable HTTP, legacy SSE, or a local command (stdio). policy-only connects to nothing; it only sets a plugin server’s tool policy. One of: `http`, `sse`, `stdio`, `policy-only`. | +> | `url` | `string` | — | HTTPS endpoint of the remote MCP server. Use the server’s final address: HTTP redirects are not followed. | +> | `oauth` | `object` | — | OAuth for a remote server: true to auto-register a client, a pre-registered client ID with tenant and scope, or mode “hosted” for an Anthropic-signed identity. | +> | `oauth.clientId` | `string` | — | OAuth client ID from your IdP app registration. Leave unset to auto-register (dynamic client registration) and only narrow scopes. | +> | `oauth.clientSecret` | `string` | — | Only for IdPs that require one (e.g. Box). Hosted config can store only a Google Desktop-app secret (GOCSPX-…); for other IdPs use the client secret helper. | +> | `oauth.clientSecretHelper` | `string` | — | Executable that prints the client secret on stdout as a JSON object with a single clientSecret key; any other output is rejected. Overrides the inline value. | +> | `oauth.authorizationServer` | `string[]` | — | Issuer URLs the OAuth sign-in may use, as a JSON array. Pre-filled by presets; ask your IdP admin if unsure. | +> | `oauth.authorizationUrl` | `string` | — | Only for IdPs that don’t serve a .well-known discovery document. Set together with Token URL; requires Client ID. | +> | `oauth.tokenUrl` | `string` | — | Only for IdPs that don’t serve a .well-known discovery document. Set together with Authorization URL; requires Client ID. | +> | `oauth.tenantId` | `string` | — | Required for single-tenant Entra apps. Leave blank for multi-tenant or non-Microsoft IdPs. | +> | `oauth.authFlow` | `enum` | — | How Entra sign-in runs for this server: the system browser (default) or the OS identity broker. One of: `browser`, `broker`. | +> | `oauth.scope` | `string` | — | Space-separated scopes sent on the authorize request. Leave unset to use the scopes the server advertises. Required when Tenant ID is set. | +> | `oauth.appendOfflineAccess` | `boolean` | — | Adds offline\_access to the authorize request so the IdP returns a refresh token for silent renewal. | +> | `oauth.callbackHost` | `enum` | — | Use localhost only if your IdP’s registered redirect URI specifies it. One of: `127.0.0.1`, `localhost`. | +> | `oauth.callbackPort` | `integer` | — | Only set if your IdP requires an exact-match redirect port. Entra accepts any. | +> | `oauth.additionalRedirectReferrerHosts` | `string` | — | Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host. | +> | `icon` | `string` | — | Icon shown for this connector: a PNG or JPEG image as a base64 data: URI, at most 4,096 characters. | +> | `command` | `string` | — | Absolute path to the server executable, run on the user’s machine. | +> | `args` | `string[]` | — | Arguments passed to the command, one per entry. | +> | `env` | `object` | — | Environment variables set for the command. | +> | `envHelper` | `string` | — | Script that prints environment variables as a JSON object to stdout. Runs when the local server starts (cached for the TTL below). | +> | `envHelperTtlSec` | `integer` | `300` | Maximum age of a cached helper result, in seconds (default 300). Applies when the server starts or restarts. | +> | `startupTimeoutSec` | `integer` | `120` | Maximum wait in seconds for the server to start and list its tools. | + +> **mcpPersistentAlwaysAllowEnabled details** +> +> When enabled (the default), approval prompts for tools without a `toolPolicy` entry offer a persistent grant: **Always allow**, or **Allow for all tasks** for tools that can modify data. The Tool permissions picker in Connector settings also lets users pre-approve tools. These grants persist across sessions with no expiry. +> +> When disabled, the persistent options are hidden from approval prompts and from the Connector settings picker, and previously stored persistent grants stop being honored. Scheduled-task runs also stop offering, recording, and replaying the **Allow for all scheduled runs** approval (**Always allow** in Code sessions), unless a scheduled-task approval lifetime of one day or more is set. Users can still approve each call. Outside scheduled-task runs, in chat and Cowork they can also choose **Allow for this task**, except for read-only tools on servers they added themselves. +> +> A per-tool `toolPolicy` entry on `managedMcpServers` always takes precedence over this key: `blocked`, `ask`, and `allow` behave exactly as documented there whether this key is enabled or not. +> +> This key governs chat and Cowork, and also Code sessions on the device (including WSL) or over SSH. In those Code sessions, with the key disabled, the prompt for an MCP tool offers **Allow for this session** instead of **Always allow**, except on scheduled-task runs. This approval is not saved to Claude Code's settings files. It lasts until the session is deleted, and sessions forked or started from it do not inherit it. Claude Code's own allow rules and hooks still apply. Allow rules in its settings files, including ones saved earlier with **Always allow**, and hooks in its settings or plugins keep allowing the tool until they are removed. Code sessions receive only the `blocked` and `ask` values of `toolPolicy` entries, so a tool set to `allow` still prompts there, and this key applies to it. + +> **mcpScheduledTaskApprovalLifetimeDays details** +> +> On a scheduled task, the approval prompt for an MCP tool can offer a lasting approval, so later runs use that tool without asking: **Allow for all scheduled runs** in Cowork, **Always allow** in the Code tab. This setting limits how long that approval lasts. With a limit, the button reads **Allow for N days**. Once an approval is older than that, the next run asks again, and approving again renews it. `0` removes the lasting option, and approvals already stored stop being reused. Leave it blank to change nothing. Choose a number comfortably longer than the gap between runs. +> +> The limit covers MCP tools only, and a `toolPolicy` entry on `managedMcpServers` still takes precedence. If a configuration server delivers the setting, then after each launch scheduled tasks ask instead of reusing stored approvals (as at `0`) until the app has fetched the configuration again. +> +> If `mcpPersistentAlwaysAllowEnabled` is off, a limit of one day or more brings the lasting option back for scheduled tasks only. +> +> Code tab: the limit covers only lasting approvals given after this setting took effect. An earlier one was usually saved as an allow rule in Claude Code's own settings: for a scheduled task, the project's `.claude/settings.local.json`, under `permissions.allow`. Any allow rule in Claude Code's settings keeps allowing the tool without asking, even at `0`, until that entry is removed. That includes a rule written by hand, and one saved by **Always allow** in an ordinary Code session in the same project, which the app offers whenever `mcpPersistentAlwaysAllowEnabled` is on. In an ordinary Code session over SSH, if this setting has a value (even `0`), **Always allow** for a tool of a server set up on the host lasts for the session only and saves no rule there. + +> **isLocalDevMcpEnabled details** +> +> On third-party deployments, `false` from any source also stops plugins' local (`stdio`) MCP servers in Cowork, Chat and Code sessions. That covers `.mcpb` bundles and plugins from every marketplace, your organization's included. In Code it also stops the local servers in Claude Code's own configuration files (`~/.claude.json`, a project's `.mcp.json`). It also stops a local server in Claude Code's `managed-mcp.json` whose command, arguments or environment use `${VAR}`. Remote servers keep working. Plugins placed in the org-plugins directory on the computer are not affected: the desktop still runs their servers. +> +> Set to `false` in a device-management profile, this key also locks down the local (`stdio`) entries of `managedMcpServers`: the app starts one only when that profile itself lists an entry of the same name, and with the profile's own command, arguments and environment. Only the profile's value engages this. A `false` from a configuration server or the admin console turns user-added servers off and does not engage it. +> +> Claude Code's own managed settings, on the device or (for Code sessions on a Claude API key) from the Claude Console, may override this key: see [managed settings](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings). + +> **allowedPluginMcpServers details** +> +> Unset (default): with managed servers listed, sessions take MCP servers only from plugins and the desktop; with no managed servers listed, this key restricts nothing. Either way, `isLocalDevMcpEnabled` set to `false` stops plugins' local servers and, in Code, those of Claude Code's own configuration files. +> +> When set, Cowork, Chat and Code sessions connect the managed list above and the servers the desktop serves from the administrator's org-plugins directory, plus only servers declared by other plugins (user-installed or marketplace) that match an entry. An entry in the managed list above with `transport: "policy-only"` sets a plugin server's tool permissions but does not admit it; to admit that server, list the server's own URL here. Claude Code configuration-file servers (`~/.claude.json`, a project's `.mcp.json`, `claude mcp add`) are never connected. With the key set, the desktop starts no plugin server on the computer itself, whatever the entries say. The one exception is the MCP servers it serves to sessions from the org-plugins directory. Each entry is a URL pattern in Claude Code's form, `{"serverUrl": "https://*.example.com/*"}` (`*` wildcards; a host `*` spans `a.b`): a plugin's remote server connects when its URL matches an entry. No entry admits a plugin's local (stdio) server, and an empty list admits no plugin server. Other shapes, the `serverName` and `serverCommand` forms included, are dropped and reported; a value that is not a list, or has no readable entry, locks sessions to the managed list and the org-plugins directory's servers, and stops every other desktop-started plugin server. User-added local servers and extensions keep their own keys. +> +> Claude Code's own managed settings, on the device or (for Code sessions on a Claude API key) from the Claude Console, may override this key: see [managed settings](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings). +> +> | Field | Type | Default | Description | +> | - | - | - | - | +> | `serverUrl` | `string` | — | URL pattern a plugin’s remote server must match, with \* wildcards. | + +> **deniedPluginMcpServers details** +> +> Unset (default) or an empty list: nothing is blocked. +> +> When set, Cowork, Chat and Code sessions do not connect a plugin's remote server whose URL matches an entry. The key works with or without `allowedPluginMcpServers`; a server that matches both lists stays blocked. In a Code session that reads Claude Code configuration-file servers (`~/.claude.json`, a project's `.mcp.json`, `claude mcp add`), a matching remote server from those files is refused as well. The managed list above, the servers the desktop serves from the administrator's org-plugins directory, user-added local servers and extensions are not affected: remove those at their own keys. Each entry is a URL pattern in Claude Code's form, `{"serverUrl": "https://*.example.com/*"}` (`*` wildcards; a host `*` spans `a.b`). An entry matches an address, not a server: the same server under another host name or an IP address, or behind a plugin's local (stdio) server, which has no URL, is not matched. `https://*.example.com/*` does not match `http://`, `wss://` or the bare `example.com`; a pattern such as `example.com/*`, which names no scheme, matches nothing, and a lone `*` matches every URL. To keep a plugin's servers out whatever address they use, set `allowedPluginMcpServers`, which admits only the servers it lists. The desktop reads no other shape, the `serverName` and `serverCommand` forms included: a value that is not a list, or that holds any entry the desktop cannot read, is reported and blocks every plugin's remote server (and those configuration-file remote servers), because skipping an entry of a block list would let its server connect. The servers named above as not affected still connect. +> +> Claude Code's own managed settings, on the device or (for Code sessions on a Claude API key) from the Claude Console, may override this key: see [managed settings](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings). +> +> | Field | Type | Default | Description | +> | - | - | - | - | +> | `serverUrl` | `string` | — | URL pattern of the remote servers to block, with \* wildcards. | + +> **mcpToolTimeoutSec details** +> +> Sets the per-call timeout the agent applies to every MCP tool call; a call that runs longer fails with a timeout error the model can see. Cowork and chat sessions default to 180 seconds. Code sessions have no desktop-imposed MCP tool timeout today, so setting this key introduces one there as well. The desktop's own request deadlines toward MCP servers — the managed servers above and, where `isLocalDevMcpEnabled` permits them, user-added local servers — follow this value so they never cut a call short first; while the key is unset, calls to user-added local servers are additionally limited to 60 seconds by the desktop. Values outside 60–3600 are rejected at parse time (the error is listed in the diagnostics report) and the defaults apply. +> +> The timeout is global (there is no per-server or per-tool form), so size it for the slowest tool you need to complete: long-running tools on one server extend the window during which a stuck call on any server holds its turn. Cowork's built-in shell tool runs under the same cap: a single command's `timeout_ms` (itself limited to 600 seconds) cannot exceed this value. ## Telemetry & updates | Setting | Type | Availability | Default | Description | | - | - | - | - | - | -| Organization UUID
`deploymentOrganizationUuid` | `string` | MDM + Bootstrap
Added in 1.2581.0 | — | A UUID you generate. Tags telemetry so Anthropic support can locate your fleet’s events, and namespaces each user’s local data. Not used for auth. | -| Block essential telemetry
`disableEssentialTelemetry` | `boolean` | MDM + Bootstrap
Added in 1.2581.0 | `false` | Crash and performance reports to Anthropic. Defaults to `false`. | -| Block nonessential telemetry
`disableNonessentialTelemetry` | `boolean` | MDM + Bootstrap
Added in 1.2581.0 | `false` | Product-usage analytics (no message content) and diagnostic-report uploads. Defaults to `false`. | -| Block nonessential services
`disableNonessentialServices` | `boolean` | MDM + Bootstrap
Added in 1.2581.0 | `false` | Connector favicons, artifact-preview and MCP Apps iframes, and the Linux spellcheck dictionary. Connector widgets fall back to text; spellcheck is off on Linux. Defaults to `false`. | - - - - If unset, the app uses the organization of your Anthropic sign-in, where the connection has one. Otherwise, telemetry is tagged with a value the app derives from your connection settings. Where it cannot derive one, telemetry is tagged with a placeholder UUID shared with other unconfigured deployments. In the last two cases, local data is stored under the placeholder. **Changing this value orphans data** stored under the previous value (sessions, skills, plugins). - - - - "Essential" means the signals Anthropic needs to keep your deployment working: **crash stacks**, **startup failure reasons**, **version/OS metadata**, and **crash dumps** (each an unfiltered copy of part of the app's memory). Reports carry a random install ID and an organization ID. The organization ID is the one you set, one the app takes from your Anthropic sign-in or derives from your connection settings, or a placeholder shared with other unconfigured deployments. Reports can also include a summary of your settings, the host names of addresses you configured, text you set for display (such as the display name, subtitle, and banner text and link), and a one-way digest of a session ID. - - **What you lose when this is on:** when a Claude Desktop build hits a bug that only reproduces on your OS version or locale, Anthropic can't see it unless a user manually reports. Fixes ship slower. - - **Why this is discouraged, not blocked:** some air-gapped environments require zero outbound telemetry as a matter of policy. The switch exists for them. If you don't have that constraint, leave it off. - - - - "Nonessential" covers two things: **product-usage analytics** (which features get used, navigation patterns; no prompts or completions) and the **Send** action in Help → Generate Diagnostic Report. Turning this on stops both. - - Destinations are listed under Egress Requirements → Nonessential telemetry. - - - - "Nonessential services" covers these outbound fetches the app runs without: **connector favicons** (the icon proxy), the **artifact-preview** iframe origin, the **MCP Apps widget** iframe origin (`*.claudemcpcontent.com`), and the **spellcheck dictionary** the built-in spellchecker downloads on Linux. Turning this on blocks all of them. (macOS and Windows use the system spellchecker. Windows still downloads a dictionary for a language it cannot check natively; this key does not stop that download.) - - **What you lose when this is on:** connectors show without icons, the hosted artifact preview frame does not load (artifacts still render locally), connectors that return MCP Apps show the text tool result instead of the widget, Excel files in the Code tab preview only through Claude’s workspace (the local VM) instead of that frame, and spellcheck underlines are off on Linux. - - Destinations are listed under Egress Requirements → Nonessential services. - - +| Organization UUID `deploymentOrganizationUuid` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | A UUID you generate. Tags telemetry so Anthropic support can locate your fleet’s events, and namespaces each user’s local data. Not used for auth. | +| Block essential telemetry `disableEssentialTelemetry` | `boolean` | MDM + Bootstrap Added in 1.2581.0 | `false` | Crash and performance reports to Anthropic. Defaults to `false`. | +| Block nonessential telemetry `disableNonessentialTelemetry` | `boolean` | MDM + Bootstrap Added in 1.2581.0 | `false` | Product-usage analytics (no message content) and diagnostic-report uploads. Defaults to `false`. | +| Block nonessential services `disableNonessentialServices` | `boolean` | MDM + Bootstrap Added in 1.2581.0 | `false` | Connector favicons, artifact-preview and MCP Apps iframes, and the Linux spellcheck dictionary. Connector widgets fall back to text; spellcheck is off on Linux. Defaults to `false`. | + +> **deploymentOrganizationUuid details** +> +> If unset, the app uses the organization of your Anthropic sign-in, where the connection has one. Otherwise, telemetry is tagged with a value the app derives from your connection settings. Where it cannot derive one, telemetry is tagged with a placeholder UUID shared with other unconfigured deployments. In the last two cases, local data is stored under the placeholder. **Changing this value orphans data** stored under the previous value (sessions, skills, plugins). + +> **disableEssentialTelemetry details** +> +> "Essential" means the signals Anthropic needs to keep your deployment working: **crash stacks**, **startup failure reasons**, **version/OS metadata**, and **crash dumps** (each an unfiltered copy of part of the app's memory). Reports carry a random install ID and an organization ID. The organization ID is the one you set, one the app takes from your Anthropic sign-in or derives from your connection settings, or a placeholder shared with other unconfigured deployments. Reports can also include a summary of your settings, the host names of addresses you configured, text you set for display (such as the display name, subtitle, and banner text and link), and a one-way digest of a session ID. +> +> **What you lose when this is on:** when a Claude Desktop build hits a bug that only reproduces on your OS version or locale, Anthropic can't see it unless a user manually reports. Fixes ship slower. +> +> **Why this is discouraged, not blocked:** some air-gapped environments require zero outbound telemetry as a matter of policy. The switch exists for them. If you don't have that constraint, leave it off. + +> **disableNonessentialTelemetry details** +> +> "Nonessential" covers two things: **product-usage analytics** (which features get used, navigation patterns; no prompts or completions) and the **Send** action in Help → Generate Diagnostic Report. Turning this on stops both. +> +> Destinations are listed under Egress Requirements → Nonessential telemetry. + +> **disableNonessentialServices details** +> +> "Nonessential services" covers these outbound fetches the app runs without: **connector favicons** (the icon proxy), the **artifact-preview** iframe origin, the **MCP Apps widget** iframe origin (`*.claudemcpcontent.com`), and the **spellcheck dictionary** the built-in spellchecker downloads on Linux. Turning this on blocks all of them. (macOS and Windows use the system spellchecker. Windows still downloads a dictionary for a language it cannot check natively; this key does not stop that download.) +> +> **What you lose when this is on:** connectors show without icons, the hosted artifact preview frame does not load (artifacts still render locally), connectors that return MCP Apps show the text tool result instead of the widget, Excel files in the Code tab preview only through Claude’s workspace (the local VM) instead of that frame, and spellcheck underlines are off on Linux. +> +> Destinations are listed under Egress Requirements → Nonessential services. ### Auto update | Setting | Type | Availability | Default | Description | | - | - | - | - | - | -| Block auto-updates
`disableAutoUpdates` | `boolean` | MDM + Bootstrap
Added in 1.2581.0 | `false` | Stop Claude Desktop from fetching updates entirely (no time limit). You’ll need to push new versions yourself. Defaults to `false`. | -| Auto-update enforcement window
`autoUpdaterEnforcementHours` | `integer` | MDM + Bootstrap
Added in 1.2581.0 | — | Hours before a downloaded update force-installs. Only applies when auto-updates are enabled. Blank = 72-hour default. Range: 1–72. | -| Check for updates on releases.claude.com
`updateViaUpdatesHost` | `boolean` | MDM + Bootstrap
Added in 1.26832.0 | `false` | Read the update feed from releases.claude.com so api.anthropic.com can stay blocked. Defaults to `false`. | - - - - In third-party deployments this also keeps Cowork's workspace image and tools from being fetched ahead of use; they are then fetched when a task first needs them. - - - - Has no effect when `disableAutoUpdates` is in place at launch: the updater never starts, so nothing is downloaded and this timer never arms. If the policy reaches an already-running app after an update has downloaded, that one staged update still installs on this timer; no further updates are fetched. - - Leaving it blank uses the 72-hour default *and* then waits for the machine to be idle (10+ minutes without input) before restarting; setting any explicit value (including 72) restarts once the window elapses regardless of user activity. In both cases the restart holds off while Claude is mid-task. - - - - By default the app asks `api.anthropic.com` which version to install. That host also serves the model APIs, so organizations that block un-approved LLM endpoints at the network edge end up blocking updates too. - - Turn this on to read the same feed from `releases.claude.com`, a hostname that carries no model API. `api.anthropic.com` can then stay blocked without breaking auto-update. Rollout behavior is unchanged; the installer download still comes from `downloads.claude.ai` as before. - - +| Block auto-updates `disableAutoUpdates` | `boolean` | MDM + Bootstrap Added in 1.2581.0 | `false` | Stop Claude Desktop from fetching updates entirely (no time limit). You’ll need to push new versions yourself. Defaults to `false`. | +| Auto-update enforcement window `autoUpdaterEnforcementHours` | `integer` | MDM + Bootstrap Added in 1.2581.0 | — | Hours before a downloaded update force-installs. Only applies when auto-updates are enabled. Blank = 72-hour default. Range: 1–72. | +| Check for updates on releases.claude.com `updateViaUpdatesHost` | `boolean` | MDM + Bootstrap Added in 1.26832.0 | `false` | Read the update feed from releases.claude.com so api.anthropic.com can stay blocked. Defaults to `false`. | +| Release channel `releaseChannel` | `enum` | MDM + Bootstrap Added in 3.1623.0 | `stable` | Which releases auto-update installs. Stable: each release as it rolls out. Staggered: a release only after it has been on stable for a while. One of: `stable`, `staggered`. Defaults to `stable`. | + +> **disableAutoUpdates details** +> +> In third-party deployments this also keeps Cowork's workspace image and tools from being fetched ahead of use; they are then fetched when a task first needs them. + +> **autoUpdaterEnforcementHours details** +> +> Has no effect when `disableAutoUpdates` is in place at launch: the updater never starts, so nothing is downloaded and this timer never arms. If the policy reaches an already-running app after an update has downloaded, that one staged update still installs on this timer; no further updates are fetched. +> +> Leaving it blank uses the 72-hour default *and* then waits for the machine to be idle (10+ minutes without input) before restarting; setting any explicit value (including 72) restarts once the window elapses regardless of user activity. In both cases the restart holds off while Claude is mid-task, unless the task runs on an SSH host and the app expects to pick it up again after the restart. + +> **updateViaUpdatesHost details** +> +> By default the app asks `api.anthropic.com` which version to install. That host also serves the model APIs, so organizations that block un-approved LLM endpoints at the network edge end up blocking updates too. +> +> Turn this on to read the same feed from `releases.claude.com`, a hostname that carries no model API. `api.anthropic.com` can then stay blocked without breaking auto-update. Rollout behavior is unchanged; the installer download still comes from `downloads.claude.ai` as before. + +> **releaseChannel details** +> +> Third-party deployments only. `stable` (default): devices take each release as it rolls out. `staggered`: devices update only to the release Anthropic has marked for this channel, after it has fully rolled out on stable, and skip the ones in between. They stay where they are until a newer one is marked, so features and fixes, security fixes included, reach them later. +> +> Devices never move to an older version. One already on a newer version than the marked one, a new install included, waits until the channel passes it. After a change to `stable`, or removal of the setting, devices update to the newest release. An update downloaded before the setting reached a device can still install. A change applies at the next update check, with no restart; a served one, once two configuration checks in a row return it. At each launch, a device last served this setting, with either value, follows `staggered` until it has fetched its configuration again. An unreadable value, such as a misspelling, counts as `staggered`. +> +> The setting applies only while the app is set up for your organization's deployment. A device managed from the admin console follows `stable` until its user signs in, and again after sign-out. Elsewhere, a user who signs in to Claude.ai instead follows `stable` too; `disableDeploymentModeChooser` removes that choice. A version from before this setting existed follows `stable`, and on Windows or Linux may reject a machine policy that names it and turn off local settings. +> +> With `disableAutoUpdates` on, nothing updates and this setting has no effect. Where something else delivers updates (apt on Linux, the Microsoft Store), it has no effect either. A device-management profile that sets only app-behavior keys becomes the only source for all of them, so put this key in that profile. Where a profile names a configuration server, or the admin console manages the device, set this key there. ### Configuration updates | Setting | Type | Availability | Default | Description | | - | - | - | - | - | -| Configuration relaunch window
`relaunchEnforcementHours` | `integer` | MDM + Bootstrap
Added in 1.40609.0 | `24` | Hours a user may keep working on the old configuration after a managed-configuration change is detected. 0 = restart required at once. Blank = 24 hours. Defaults to `24`. Range: 0–336. | -| Configuration re-check interval
`configRecheckIntervalMinutes` | `integer` | MDM + Bootstrap
Added in 1.46388.1 | `10` | Minutes between the running app’s checks for a changed managed configuration. Blank = 10 minutes. Defaults to `10`. Range: 2–30. | -| Keep only your organization ID and restrictions on disk
`disableLocalConfigCache` | `boolean` | hybrid-only
Added in 2.7032.0 | `false` | Don’t keep your organization’s name or any permissive setting on disk between launches; only your organization ID and the restrictions you turn on are kept. Defaults to `false`. | - - - - Set it via MDM (plist, registry, or file) or serve it from your configuration endpoint (remote bootstrap configuration). When the running app observes a managed-configuration change it cannot apply without restarting, it shows the sidebar relaunch card and starts this window. The window starts at the running app’s next configuration re-check (the re-check interval beside it), so allow up to one re-check interval on top of this value between saving a change and the restart dialog. When the window ends the app blocks with a restart dialog and restarts on its own after 2 minutes with no activity (no running Claude task and no keyboard or pointer input); the user can also restart right away. Defaults to 24 hours. Set a larger value (up to 336 = 14 days) to give users longer; `0` shows the dialog at the first observation. - - A served value is read from the newest served configuration, so tightening or loosening the window takes effect without a restart once two re-checks in a row have served it, and a change to this key alone never asks for one. Like the update keys beside it, a value from a device-management profile that sets only app-behavior keys applies without making the rest of the configuration device-managed, and takes precedence over a served one. Because the key is grouped with the other app-behavior keys, a profile that sets any of them claims the whole group: set this key in the same profile as the update keys you deploy, or a served value is ignored on those devices and the 24-hour default applies. - - - - How often the running app re-checks its managed configuration for changes: it re-polls your configuration endpoint with a conditional request, so an unchanged configuration costs one `304` round-trip. A detected change shows the sidebar relaunch card and starts the `relaunchEnforcementHours` window, so a saved change reaches a running app within roughly one interval. Defaults to 10 minutes; each wait is jittered by ±10% so a fleet does not poll in lockstep. Values outside 2–30 are rejected with a parse error and the default applies. - - Applied without a restart: a new served value re-arms the timer once two checks in a row have served it, and a change to this key alone never asks for a relaunch. Set it via MDM or serve it from your configuration endpoint; like the update keys beside it, a value from a device-management profile that sets only app-behavior keys applies without making the rest of the configuration device-managed, and takes precedence over a served one. Because the key is grouped with the other app-behavior keys, a profile that sets any of them claims the whole group, and every key in it is then read from that profile alone: deploy this key in the same profile as the update keys (`disableAutoUpdates`, `autoUpdaterEnforcementHours`, …). A profile that sets the update keys without it ignores a served interval and the default applies; a profile that sets only this key ignores served update settings, so a served `disableAutoUpdates` no longer holds on those devices. A profile that also manages the connection itself (sets `bootstrapUrl` or the provider keys) follows the normal tier order instead: once a served configuration is in hand it, not the profile, supplies this key. - - - - By default the app keeps on disk, from the last configuration the admin console served, your organization’s ID and name and the few settings a launch applies before the console answers (the telemetry switches, the Microsoft 365 sign-in broker setting, and any restriction you have turned on). When this is on, it keeps only your organization ID and those restrictions (for example telemetry blocked, or local MCP servers off), never the name or anything you have allowed, and cuts an earlier copy down at the next launch that reaches the console, or at once when a running app confirms the change; signing out deletes the kept copy too. While on: crash and performance reports to Anthropic do not start on these devices, and the sign-in screen and account switcher cannot show your organization’s name before the console answers. - - A running app picks up a change to this setting once two configuration checks in a row have served it; changing it alone never asks for a relaunch. It applies only to organizations managed from the Claude admin console; the setting is ignored when a customer configuration server or a device profile sends it. - - +| Configuration relaunch window `relaunchEnforcementHours` | `integer` | MDM + Bootstrap Added in 1.40609.0 | `24` | Hours a user may keep working on the old configuration after a managed-configuration change is detected. 0 = restart required at once. Blank = 24 hours. Defaults to `24`. Range: 0–336. | +| Configuration re-check interval `configRecheckIntervalMinutes` | `integer` | MDM + Bootstrap Added in 1.46388.1 | `10` | Minutes between the running app’s checks for a changed managed configuration. Blank = 10 minutes. Defaults to `10`. Range: 2–30. | +| Keep only your organization ID and restrictions on disk `disableLocalConfigCache` | `boolean` | hybrid-only Added in 2.7032.0 | `false` | Don’t keep your organization’s name or any permissive setting on disk between launches; only your organization ID and the restrictions you turn on are kept. Defaults to `false`. | + +> **relaunchEnforcementHours details** +> +> Set it via MDM (plist, registry, or file) or serve it from your configuration endpoint (remote bootstrap configuration). When the running app observes a managed-configuration change it cannot apply without restarting, it shows the sidebar relaunch card and starts this window. The window starts at the running app’s next configuration re-check (the re-check interval beside it), so allow up to one re-check interval on top of this value between saving a change and the restart dialog. When the window ends the app blocks with a restart dialog and restarts on its own after 2 minutes with no activity (no running Claude task and no keyboard or pointer input); the user can also restart right away. Defaults to 24 hours. Set a larger value (up to 336 = 14 days) to give users longer; `0` shows the dialog at the first observation. One case gets no window, whatever this value: when a device-management profile that sets more than app-behavior keys first applies to an app that started without one, and the app will run on that profile after restarting, the dialog shows at the re-check that confirms it, because until the restart the app stays connected the way it started. +> +> A served value is read from the newest served configuration, so tightening or loosening the window takes effect without a restart once two re-checks in a row have served it, and a change to this key alone never asks for one. Like the update keys beside it, a value from a device-management profile that sets only app-behavior keys applies without making the rest of the configuration device-managed, and takes precedence over a served one. Because the key is grouped with the other app-behavior keys, a profile that sets any of them claims the whole group: set this key in the same profile as the update keys you deploy, or a served value is ignored on those devices and the 24-hour default applies. + +> **configRecheckIntervalMinutes details** +> +> How often the running app re-checks its managed configuration for changes: it re-polls your configuration endpoint with a conditional request, so an unchanged configuration costs one `304` round-trip. A detected change shows the sidebar relaunch card and starts the `relaunchEnforcementHours` window, so a saved change reaches a running app within roughly one interval. Defaults to 10 minutes; each wait is jittered by ±10% so a fleet does not poll in lockstep. Values outside 2–30 are rejected with a parse error and the default applies. +> +> Applied without a restart: a new served value re-arms the timer once two checks in a row have served it, and a change to this key alone never asks for a relaunch. Set it via MDM or serve it from your configuration endpoint; like the update keys beside it, a value from a device-management profile that sets only app-behavior keys applies without making the rest of the configuration device-managed, and takes precedence over a served one. Because the key is grouped with the other app-behavior keys, a profile that sets any of them claims the whole group, and every key in it is then read from that profile alone: deploy this key in the same profile as the update keys (`disableAutoUpdates`, `autoUpdaterEnforcementHours`, …). A profile that sets the update keys without it ignores a served interval and the default applies; a profile that sets only this key ignores served update settings, so a served `disableAutoUpdates` no longer holds on those devices. A profile that also manages the connection itself (sets `bootstrapUrl` or the provider keys) follows the normal tier order instead: once a served configuration is in hand it, not the profile, supplies this key. + +> **disableLocalConfigCache details** +> +> By default the app keeps on disk, from the last configuration the admin console served, your organization’s ID and name and the few settings a launch applies before the console answers (the telemetry switches, the Microsoft 365 sign-in broker setting, and any restriction you have turned on). When this is on, it keeps only your organization ID and those restrictions (for example telemetry blocked, or local MCP servers off), never the name or anything you have allowed, and cuts an earlier copy down at the next launch that reaches the console, or at once when a running app confirms the change; signing out deletes the kept copy too. While on: crash and performance reports to Anthropic do not start on these devices, and the sign-in screen and account switcher cannot show your organization’s name before the console answers. +> +> A running app picks up a change to this setting once two configuration checks in a row have served it; changing it alone never asks for a relaunch. It applies only to organizations managed from the Claude admin console; the setting is ignored when a customer configuration server or a device profile sends it. ### OTLP | Setting | Type | Availability | Default | Description | | - | - | - | - | - | -| OpenTelemetry collector endpoint
`otlpEndpoint` | `string` | MDM + Bootstrap
Added in 1.2581.0 | — | Where OpenTelemetry logs and metrics are sent. Leave blank to disable. | -| OpenTelemetry exporter protocol
`otlpProtocol` | `enum` | MDM + Bootstrap
Added in 1.2581.0 | `http/protobuf` | Transport protocol for the OpenTelemetry exporters. One of: `http/protobuf`, `http/json`, `grpc`. Defaults to `http/protobuf`. | -| OpenTelemetry exporter headers
`otlpHeaders` | `object` | MDM + Bootstrap
Added in 1.2581.0 | — | Static collector headers — routing and tenant headers only. No credentials here; use Collector authentication or the headers helper script for tokens. | -| Collector authentication
`otlpAuthMode` | `enum` | MDM + Bootstrap
Added in 1.30096.1 | — | inference-credential sends the user’s inference bearer token to the collector as Authorization: Bearer. One of: `none`, `inference-credential`. | -| OpenTelemetry headers helper script
`otlpHeadersHelper` | `string` | MDM + Bootstrap
Added in 1.30096.1 | — | Absolute path to an executable that prints a JSON object of collector headers. Merged over the static headers and Collector authentication; the helper wins. | -| OpenTelemetry resource attributes
`otlpResourceAttributes` | `object` | MDM + Bootstrap
Added in 1.5354.0 | — | Extra resource attributes to attach to every span/metric. A static enduser.id set here always wins over the runtime identity. | -| Desktop telemetry export level
`otlpDesktopLogLevel` | `enum` | MDM + Bootstrap
Added in 1.9255.0 | `error` | Controls the Claude Desktop application’s events, separate from Cowork and Code sessions. Defaults to error. One of: `off`, `error`, `warn`, `info`, `debug`. Defaults to `error`. | -| Content capture categories
`otlpContentCapture` | `enum[]` | MDM + Bootstrap
Added in 1.15962.0 | — | Content categories Claude Desktop sends unredacted to your collector. `userPrompts` also sends Claude’s responses. Leave empty to redact all content (default). One of: `userPrompts`, `assistantResponses`, `toolDetails`, `toolContent`, `rawApiBodies`. | -| Export traces
`otlpTracesEnabled` | `boolean` | MDM + Bootstrap
Added in 1.22209.0 | — | Also export OpenTelemetry traces from Cowork tasks and Code sessions. Uses Claude Code’s session tracing. | -| Telemetry attribute length limit
`otlpAttrMaxChars` | `integer` | MDM + Bootstrap
Added in 2.31226.0 | — | Maximum length, in characters, of captured content such as a raw API body (256–15,000,000). Cowork tasks and Code sessions use 61,440 when unset. Range: 256–15000000. | - - - - Code sessions export over the protocol set here. Chats and Cowork tasks export over `http/protobuf` instead of `grpc` on Windows, and on other platforms whenever the Claude Code engine is given an HTTP proxy (the operating system's proxy, `egressProxyUrl` or `egressProxyPacUrl`, or `HTTPS_PROXY` / `HTTP_PROXY` in a Claude Code settings file); the application log notes the substitution. The desktop application's own events always go over `http/json` to `/v1/logs`. None of this changes the endpoint, so choose `grpc` only for a collector that also serves OTLP/HTTP at the same address; otherwise keep `http/protobuf` and point `otlpEndpoint` at the collector's OTLP/HTTP receiver (conventionally port 4318). - - - - `inference-credential` adds `Authorization: Bearer ` to every export, using the token the app currently holds for the inference provider, with no helper script to deploy. The collector must accept that token as issued: an identity-provider sign-in (`external-idp`, gateway or Bedrock proxy) forwards the identity provider’s token, which carries the audience you registered, Microsoft Entra on Foundry issues the Foundry resource’s token, and Vertex workforce identity forwards a Google Cloud access token; static gateway and Bedrock keys are forwarded as-is. Because the token can also call inference as the user, use this only for a collector you operate; for anything else, use the headers helper script with an ingest-scoped credential. Kinds that never produce a bearer (AWS SigV4 kinds on Bedrock, Google ADC / OAuth files on Vertex, API-key kinds) export without it — use the helper script instead. Cowork tasks pick up the current token each time they start; a Code session keeps the token it started with for as long as it stays open; the desktop’s own event exporter uses the current token on every flush. Before sign-in, exports go out unauthenticated. An `Authorization` header printed by the headers helper script wins over this. - - - - Absolute path to an executable that prints a single JSON object of HTTP headers on stdout, e.g. `{"Authorization": "Bearer …"}`. The desktop runs it (no arguments; output cached for a few minutes, and a failure is not retried for 30 seconds) whenever it needs collector headers and merges the result over **OpenTelemetry exporter headers** and the **Collector authentication** header (the helper wins on conflict). Cowork tasks get the current output when they start; Code and Cowork sessions are also given the script as Claude Code’s own `otelHeadersHelper`, so an open session re-runs it as tokens rotate (on Windows this applies to `.exe`, `.cmd` and `.bat` helpers; a `.ps1` helper applies at session start only); the desktop’s own event exporter re-runs it per flush. Session start waits at most two seconds for a slow helper and otherwise proceeds without its headers until it finishes. Use this when the collector needs a credential the inference sign-in cannot provide, when the collector token rotates, or when the config comes from a hosted admin console, which cannot store header values. If the helper fails, telemetry is sent without its headers — check the app log. - - - - Extra resource attributes to attach to every span, metric, and log sent to your collector. When End-user attribution is on and no `enduser.id` is set here, the desktop fills it with the signed-in user's runtime identity; a value you set here always wins. `process.owner` (the OS login name) is always emitted; set it here to override. - - - - Each category enables a class of raw content in OpenTelemetry events sent to your collector (this data never reaches Anthropic): - - * `userPrompts` — user-typed prompt text - * `assistantResponses` — assistant message text - * `toolDetails` — tool input arguments, e.g. the web-search query string - * `toolContent` — tool output content, e.g. fetched page text or command stdout - * `rawApiBodies` — inference API request and response bodies, each cut at 61,440 characters by default - - These mirror Claude Code's `OTEL_LOG_*` env vars; see the [Claude Code monitoring docs](https://code.claude.com/docs/en/monitoring-usage). - - In Claude Desktop, Claude's responses are included when user prompts are captured, even if `assistantResponses` is not listed. To exclude them, set `OTEL_LOG_ASSISTANT_RESPONSES` to `0` in the `env` block of Claude Code's managed settings; a value in the per-user Windows registry policy (`HKCU`) is ignored. That `0` also wins when `assistantResponses` is listed, but `rawApiBodies` still includes responses. Claude Desktop versions released before this was supported ignore the variable and keep sending responses. - - - - Enables Claude Code's session tracing (`CLAUDE_CODE_ENHANCED_TELEMETRY_BETA=1` + `OTEL_TRACES_EXPORTER=otlp`) in spawned Cowork tasks and Code sessions. Each user interaction exports a trace whose spans and events carry `trace_id`/`span_id`, enabling end-to-end correlation in your observability backend (metrics do not carry trace context; correlate those via `session.id`). Traces go to the collector endpoint and protocol configured above. When `otlpEndpoint` is set, this key alone decides whether those sessions export traces: leaving it unset or `false` keeps traces off even if Claude Code's own settings or managed settings (for example a `managed-settings.json` on the device) turn tracing on. Without `otlpEndpoint` it has no effect. The span structure may evolve between Claude Code releases; see the [Claude Code monitoring docs](https://code.claude.com/docs/en/monitoring-usage). - - - - Captured content longer than this is cut at the end and marked as truncated. - - * Cowork tasks and Code sessions: 61,440 when unset. Applies to model responses, tool content and raw API bodies. User prompts are not cut, and `tool_input` keeps its own smaller limits. A cut request body keeps the oldest messages and loses the newest, so to capture whole bodies with `rawApiBodies`, set this just above your longest body, not at the maximum. Lower it to reduce volume. While this key and `otlpEndpoint` are set, Claude Code's own settings and managed settings (for example a `managed-settings.json` on the device) cannot change the limit or the export interval. - * Claude add-in for Microsoft 365: 4,000 when unset. Values above 32,000 count as 32,000. - * The desktop application's own events are not affected. - - A collector refuses an export over its size limit, and every event in that export is lost. By default an OpenTelemetry Collector accepts 20 MiB per OTLP/HTTP request (`max_request_body_size`) and 4 MiB per gRPC message (`max_recv_msg_size_mib`). Keep that limit at a few times the size of your longest body: one export can carry several, and a character takes one byte in Latin text and up to three otherwise. With this key set, Code sessions export events as they happen, not every five seconds, as Cowork tasks already do, so the collector sees more, smaller requests. - - +| OpenTelemetry collector endpoint `otlpEndpoint` | `string` | MDM + Bootstrap Added in 1.2581.0 | — | Where OpenTelemetry logs and metrics are sent. Leave blank to disable. | +| OpenTelemetry exporter protocol `otlpProtocol` | `enum` | MDM + Bootstrap Added in 1.2581.0 | `http/protobuf` | Transport protocol for the OpenTelemetry exporters. One of: `http/protobuf`, `http/json`, `grpc`. Defaults to `http/protobuf`. | +| OpenTelemetry exporter headers `otlpHeaders` | `object` | MDM + Bootstrap Added in 1.2581.0 | — | Static collector headers — routing and tenant headers only. No credentials here; use Collector authentication or the headers helper script for tokens. | +| Collector authentication `otlpAuthMode` | `enum` | MDM + Bootstrap Added in 1.30096.1 | — | inference-credential sends the user’s inference bearer token to the collector as Authorization: Bearer. One of: `none`, `inference-credential`. | +| OpenTelemetry headers helper script `otlpHeadersHelper` | `string` | MDM + Bootstrap Added in 1.30096.1 | — | Absolute path to an executable that prints a JSON object of collector headers. Merged over the static headers and Collector authentication; the helper wins. | +| OpenTelemetry resource attributes `otlpResourceAttributes` | `object` | MDM + Bootstrap Added in 1.5354.0 | — | Extra resource attributes to attach to every span/metric. A static enduser.id set here always wins over the runtime identity. | +| Desktop telemetry export level `otlpDesktopLogLevel` | `enum` | MDM + Bootstrap Added in 1.9255.0 | `error` | Controls the Claude Desktop application’s events, separate from Cowork and Code sessions. Defaults to error. One of: `off`, `error`, `warn`, `info`, `debug`. Defaults to `error`. | +| Content capture categories `otlpContentCapture` | `enum[]` | MDM + Bootstrap Added in 1.15962.0 | — | Content categories Claude Desktop sends unredacted to your collector. `userPrompts` also sends Claude’s responses. If empty, no category is enabled (default). One of: `userPrompts`, `assistantResponses`, `toolDetails`, `toolContent`, `rawApiBodies`. | +| Export traces `otlpTracesEnabled` | `boolean` | MDM + Bootstrap Added in 1.22209.0 | — | Also export OpenTelemetry traces from Cowork tasks and Code sessions. Uses Claude Code’s session tracing. | +| Telemetry attribute length limit `otlpAttrMaxChars` | `integer` | MDM + Bootstrap Added in 2.31226.0 | — | Maximum length, in characters, of captured content such as a raw API body (256–15,000,000). Cowork tasks and Code sessions use 61,440 when unset. Range: 256–15000000. | + +> **otlpProtocol details** +> +> Code sessions export over the protocol set here. Chats and Cowork tasks export over `http/protobuf` instead of `grpc` on Windows, and on other platforms whenever the Claude Code engine is given an HTTP proxy (the operating system's proxy, `egressProxyUrl` or `egressProxyPacUrl`, or `HTTPS_PROXY` / `HTTP_PROXY` in a Claude Code settings file); the application log notes the substitution. The desktop application's own events always go over `http/json` to `/v1/logs`. None of this changes the endpoint, so choose `grpc` only for a collector that also serves OTLP/HTTP at the same address; otherwise keep `http/protobuf` and point `otlpEndpoint` at the collector's OTLP/HTTP receiver (conventionally port 4318). + +> **otlpAuthMode details** +> +> `inference-credential` adds `Authorization: Bearer ` to every export, using the token the app currently holds for the inference provider, with no helper script to deploy. The collector must accept that token as issued: an identity-provider sign-in (`external-idp`, gateway or Bedrock proxy) forwards the identity provider’s token, which carries the audience you registered, Microsoft Entra on Foundry issues the Foundry resource’s token, and Vertex workforce identity forwards a Google Cloud access token; static gateway and Bedrock keys are forwarded as-is. Because the token can also call inference as the user, use this only for a collector you operate; for anything else, use the headers helper script with an ingest-scoped credential. Kinds that never produce a bearer (AWS SigV4 kinds on Bedrock, Google ADC / OAuth files on Vertex, API-key kinds) export without it, and so does Sign in with Claude Console, whose token is the user’s own and is never sent to a collector. Use the helper script instead. Cowork tasks pick up the current token each time they start; a Code session keeps the token it started with for as long as it stays open; the desktop’s own event exporter uses the current token on every flush. Before sign-in, exports go out unauthenticated. An `Authorization` header printed by the headers helper script wins over this. + +> **otlpHeadersHelper details** +> +> Absolute path to an executable that prints a single JSON object of HTTP headers on stdout, e.g. `{"Authorization": "Bearer …"}`. The desktop runs it (no arguments; output cached for a few minutes, and a failure is not retried for 30 seconds) whenever it needs collector headers and merges the result over **OpenTelemetry exporter headers** and the **Collector authentication** header (the helper wins on conflict). Cowork tasks get the current output when they start; Code and Cowork sessions are also given the script as Claude Code’s own `otelHeadersHelper`, so an open session re-runs it as tokens rotate (on Windows this applies to `.exe`, `.cmd` and `.bat` helpers; a `.ps1` helper applies at session start only); the desktop’s own event exporter re-runs it per flush. Session start waits at most two seconds for a slow helper and otherwise proceeds without its headers until it finishes. Use this when the collector needs a credential the inference sign-in cannot provide, when the collector token rotates, or when the config comes from a hosted admin console, which cannot store header values. If the helper fails, telemetry is sent without its headers — check the app log. + +> **otlpResourceAttributes details** +> +> Extra resource attributes to attach to every span, metric, and log sent to your collector. When End-user attribution is on and no `enduser.id` is set here, the desktop fills it with the signed-in user's runtime identity; a value you set here always wins. `process.owner` (the OS login name) is always emitted; set it here to override. + +> **otlpContentCapture details** +> +> Each category enables a class of raw content in OpenTelemetry events sent to your collector (this data never reaches Anthropic): +> +> * `userPrompts` — user-typed prompt text +> * `assistantResponses` — assistant message text +> * `toolDetails` — tool input arguments, e.g. the web-search query string +> * `toolContent` — tool output content, e.g. fetched page text or command stdout +> * `rawApiBodies` — inference API request and response bodies, each cut at 61,440 characters by default +> +> These mirror Claude Code's `OTEL_LOG_*` env vars; see the [Claude Code monitoring docs](https://code.claude.com/docs/en/monitoring-usage). +> +> In Claude Desktop, Claude's responses are included when user prompts are captured, even if `assistantResponses` is not listed. To exclude them, set `OTEL_LOG_ASSISTANT_RESPONSES` to `0` in the `env` block of Claude Code's managed settings, not in Claude Desktop's managed configuration. That `0` also wins when `assistantResponses` is listed, but `rawApiBodies` still includes responses. Claude Desktop ignores a `0` set in Claude Code's per-user Windows registry policy (`HKCU`). If a device has several managed sources, set the `0` in the highest-priority one with a policy. Excluding responses this way requires Claude Desktop 2.37337.1 or later. +> +> Claude Code managed settings set no policy if they are missing, empty, or hold only `wslInheritsWindowsSettings`, `managedSourcesBehavior`, or empty objects such as `"permissions": {}`. Adding `OTEL_LOG_ASSISTANT_RESPONSES` to such settings makes them a policy, so also set `parentSettingsBehavior` to `"merge"` there. Without `"merge"`, Claude Code can drop the restrictions that Claude Desktop passes to it. If the settings already set a policy, add only `OTEL_LOG_ASSISTANT_RESPONSES` to their `env` block, and read [Interaction with Claude Code's own managed settings](https://claude.com/docs/third-party/claude-desktop/code#interaction-with-claude-code%E2%80%99s-own-managed-settings) before you change `parentSettingsBehavior`. + +> **otlpTracesEnabled details** +> +> Enables Claude Code's session tracing (`CLAUDE_CODE_ENHANCED_TELEMETRY_BETA=1` + `OTEL_TRACES_EXPORTER=otlp`) in spawned Cowork tasks and Code sessions. Each user interaction exports a trace whose spans and events carry `trace_id`/`span_id`, enabling end-to-end correlation in your observability backend (metrics do not carry trace context; correlate those via `session.id`). Traces go to the collector endpoint and protocol configured above. When `otlpEndpoint` is set, this key alone decides whether those sessions export traces: leaving it unset or `false` keeps traces off even if Claude Code's own settings or managed settings (for example a `managed-settings.json` on the device) turn tracing on. Without `otlpEndpoint` it has no effect. The span structure may evolve between Claude Code releases; see the [Claude Code monitoring docs](https://code.claude.com/docs/en/monitoring-usage). + +> **otlpAttrMaxChars details** +> +> Captured content longer than this is cut at the end and marked as truncated. +> +> * Cowork tasks and Code sessions: 61,440 when unset. Applies to model responses, tool content and raw API bodies. User prompts are not cut, and `tool_input` keeps its own smaller limits. A cut request body keeps the oldest messages and loses the newest, so to capture whole bodies with `rawApiBodies`, set this just above your longest body, not at the maximum. Lower it to reduce volume. While this key and `otlpEndpoint` are set, Claude Code's own settings and managed settings (for example a `managed-settings.json` on the device) cannot change the limit or the export interval. +> * Claude add-in for Microsoft 365: 4,000 when unset. Values above 32,000 count as 32,000. +> * The desktop application's own events are not affected. +> +> A collector refuses an export over its size limit, and every event in that export is lost. By default an OpenTelemetry Collector accepts 20 MiB per OTLP/HTTP request (`max_request_body_size`) and 4 MiB per gRPC message (`max_recv_msg_size_mib`). Keep that limit at a few times the size of your longest body: one export can carry several, and a character takes one byte in Latin text and up to three otherwise. With this key set, Code sessions export events as they happen, not every five seconds, as Cowork tasks already do, so the collector sees more, smaller requests. ## Limits @@ -1050,148 +1055,138 @@ The reference below is generated from the configuration schema and grouped to ma | Setting | Type | Availability | Default | Description | | - | - | - | - | - | -| Chat retention period
`chatSessionRetentionDays` | `integer` | MDM + Bootstrap
Added in 1.52386.0 | — | Delete chats, with their files, after this many days without activity. Unset: kept until the user deletes them. Projects and memory stay. Range: 1–3650. | -| Cowork retention period
`coworkSessionRetentionDays` | `integer` | MDM + Bootstrap
Added in 1.52386.0 | — | Delete Cowork tasks, with their uploads and outputs, after this many days without activity. Unset: kept until the user deletes them. Spaces and memory stay. Range: 1–3650. | -| Code retention period
`codeSessionRetentionDays` | `integer` | MDM + Bootstrap
Added in 1.52386.0 | — | Delete Code sessions, conversation included, after this many days without activity. Unset: kept until the user deletes them. Uncommitted work stays on disk. Range: 1–3650. | -| Suspend session deletion
`sessionRetentionHold` | `boolean` | MDM + Bootstrap
Added in 1.52386.0 | — | Suspend all automatic session deletion for these users (legal hold). While on, the retention periods above delete nothing. | +| Chat retention period `chatSessionRetentionDays` | `integer` | MDM + Bootstrap Added in 1.52386.0 | — | Delete chats, with their files, after this many days without activity. Unset: kept until the user deletes them. Projects and memory stay. Range: 1–3650. | +| Cowork retention period `coworkSessionRetentionDays` | `integer` | MDM + Bootstrap Added in 1.52386.0 | — | Delete Cowork tasks, with their uploads and outputs, after this many days without activity. Unset: kept until the user deletes them. Spaces and memory stay. Range: 1–3650. | +| Code retention period `codeSessionRetentionDays` | `integer` | MDM + Bootstrap Added in 1.52386.0 | — | Delete Code sessions, conversation included, after this many days without activity. Unset: kept until the user deletes them. Uncommitted work stays on disk. Range: 1–3650. | +| Suspend session deletion `sessionRetentionHold` | `boolean` | MDM + Bootstrap Added in 1.52386.0 | — | Suspend all automatic session deletion for these users (legal hold). While on, the retention periods above delete nothing. | - - - The app deletes whole sessions in the background shortly after it fetches this configuration (at launch and on each re-poll), or some minutes after launch and then daily when the configuration comes from device management alone. Idle time runs from the session's last activity; viewing an old Code session counts as activity, viewing an old chat or Cowork task without continuing it does not durably. A session that is running or open on screen is skipped and checked again on the next pass, as is a chat or Cowork task whose folder changed on disk within the period. Pinned sessions are not exempt. Minimum 1 day; a value that cannot be read as a whole number of days deletes nothing. Set through the served configuration or in the device-management profile that carries the rest of the configuration. What it does not reach: another account's sessions on the device (evaluated when that account signs in), Code sessions on a remote machine (SSH/WSL), Cowork background (dispatch) tasks the sidebar does not list, a chat or Cowork task whose folder cannot be located, and Claude Code files not named by a session id (prompt history, plans, shell snapshots), which keep Claude Code's own retention. Honored only by Claude Desktop configured for a third-party model provider. - +> **chatSessionRetentionDays details** +> +> The app deletes whole sessions in the background shortly after it fetches this configuration (at launch and on each re-poll), or some minutes after launch and then daily when the configuration comes from device management alone. Idle time runs from the session's last activity; viewing an old Code session counts as activity, viewing an old chat or Cowork task without continuing it does not durably. A session that is running or open on screen is skipped and checked again on the next pass, as is a chat or Cowork task whose folder changed on disk within the period. Pinned sessions are not exempt. Minimum 1 day; a value that cannot be read as a whole number of days deletes nothing. Set through the served configuration or in the device-management profile that carries the rest of the configuration. What it does not reach: another account's sessions on the device (evaluated when that account signs in), Code sessions on a remote machine (SSH/WSL), Cowork background (dispatch) tasks the sidebar does not list, a chat or Cowork task whose folder cannot be located, and Claude Code files not named by a session id (prompt history, plans, shell snapshots), which keep Claude Code's own retention. Honored only by Claude Desktop configured for a third-party model provider. - - The app deletes whole sessions in the background shortly after it fetches this configuration (at launch and on each re-poll), or some minutes after launch and then daily when the configuration comes from device management alone. Idle time runs from the session's last activity; viewing an old Code session counts as activity, viewing an old chat or Cowork task without continuing it does not durably. A session that is running or open on screen is skipped and checked again on the next pass, as is a chat or Cowork task whose folder changed on disk within the period. Pinned sessions are not exempt. Minimum 1 day; a value that cannot be read as a whole number of days deletes nothing. Set through the served configuration or in the device-management profile that carries the rest of the configuration. What it does not reach: another account's sessions on the device (evaluated when that account signs in), Code sessions on a remote machine (SSH/WSL), Cowork background (dispatch) tasks the sidebar does not list, a chat or Cowork task whose folder cannot be located, and Claude Code files not named by a session id (prompt history, plans, shell snapshots), which keep Claude Code's own retention. Honored only by Claude Desktop configured for a third-party model provider. - +> **coworkSessionRetentionDays details** +> +> The app deletes whole sessions in the background shortly after it fetches this configuration (at launch and on each re-poll), or some minutes after launch and then daily when the configuration comes from device management alone. Idle time runs from the session's last activity; viewing an old Code session counts as activity, viewing an old chat or Cowork task without continuing it does not durably. A session that is running or open on screen is skipped and checked again on the next pass, as is a chat or Cowork task whose folder changed on disk within the period. Pinned sessions are not exempt. Minimum 1 day; a value that cannot be read as a whole number of days deletes nothing. Set through the served configuration or in the device-management profile that carries the rest of the configuration. What it does not reach: another account's sessions on the device (evaluated when that account signs in), Code sessions on a remote machine (SSH/WSL), Cowork background (dispatch) tasks the sidebar does not list, a chat or Cowork task whose folder cannot be located, and Claude Code files not named by a session id (prompt history, plans, shell snapshots), which keep Claude Code's own retention. Honored only by Claude Desktop configured for a third-party model provider. - - The app deletes whole sessions in the background shortly after it fetches this configuration (at launch and on each re-poll), or some minutes after launch and then daily when the configuration comes from device management alone. Idle time runs from the session's last activity; viewing an old Code session counts as activity, viewing an old chat or Cowork task without continuing it does not durably. A session that is running or open on screen is skipped and checked again on the next pass, as is a chat or Cowork task whose folder changed on disk within the period. Pinned sessions are not exempt. Minimum 1 day; a value that cannot be read as a whole number of days deletes nothing. Set through the served configuration or in the device-management profile that carries the rest of the configuration. What it does not reach: another account's sessions on the device (evaluated when that account signs in), Code sessions on a remote machine (SSH/WSL), Cowork background (dispatch) tasks the sidebar does not list, a chat or Cowork task whose folder cannot be located, and Claude Code files not named by a session id (prompt history, plans, shell snapshots), which keep Claude Code's own retention. Honored only by Claude Desktop configured for a third-party model provider. - +> **codeSessionRetentionDays details** +> +> The app deletes whole sessions in the background shortly after it fetches this configuration (at launch and on each re-poll), or some minutes after launch and then daily when the configuration comes from device management alone. Idle time runs from the session's last activity; viewing an old Code session counts as activity, viewing an old chat or Cowork task without continuing it does not durably. A session that is running or open on screen is skipped and checked again on the next pass, as is a chat or Cowork task whose folder changed on disk within the period. Pinned sessions are not exempt. Minimum 1 day; a value that cannot be read as a whole number of days deletes nothing. Set through the served configuration or in the device-management profile that carries the rest of the configuration. What it does not reach: another account's sessions on the device (evaluated when that account signs in), Code sessions on a remote machine (SSH/WSL), Cowork background (dispatch) tasks the sidebar does not list, a chat or Cowork task whose folder cannot be located, and Claude Code files not named by a session id (prompt history, plans, shell snapshots), which keep Claude Code's own retention. Honored only by Claude Desktop configured for a third-party model provider. - - Meant to be set per user or group, through the served configuration's group overrides or in the same device-management profile that carries the rest of the configuration (a profile carrying only this key makes the device profile-managed, like any policy key); a hold in the device's profile also counts when the served configuration does not restate it. Deletion stops at the first configuration fetch that carries this value, before it takes effect as configuration at the next relaunch; a device that cannot reach its configuration server deletes nothing. - - +> **sessionRetentionHold details** +> +> Meant to be set per user or group, through the served configuration's group overrides or in the same device-management profile that carries the rest of the configuration (a profile carrying only this key makes the device profile-managed, like any policy key); a hold in the device's profile also counts when the served configuration does not restate it. Deletion stops at the first configuration fetch that carries this value, before it takes effect as configuration at the next relaunch; a device that cannot reach its configuration server deletes nothing. ### Token limits | Setting | Type | Availability | Default | Description | | - | - | - | - | - | -| Max tokens per window
`inferenceMaxTokensPerWindow` | `integer` | MDM + Bootstrap
Added in 1.2581.0 | — | Limits each person’s input and output tokens per window on each device. Cached tokens do not count, so this does not cap your provider’s bill. | -| Token cap window
`inferenceTokenWindowHours` | `integer` | MDM + Bootstrap
Added in 1.2581.0 | — | The count resets to zero at the end of each window. A window can last 1 to 720 hours (30 days). Range: 1–720. | +| Max tokens per window `inferenceMaxTokensPerWindow` | `integer` | MDM + Bootstrap Added in 1.2581.0 | — | Limits each person’s input and output tokens per window on each device. Cached tokens do not count, so this does not cap your provider’s bill. | +| Token cap window `inferenceTokenWindowHours` | `integer` | MDM + Bootstrap Added in 1.2581.0 | — | The count resets to zero at the end of each window. A window can last 1 to 720 hours (30 days). Range: 1–720. | - - - Requires `inferenceTokenWindowHours` to also be set — without a window length the cap is inert and no limit is enforced. +> **inferenceMaxTokensPerWindow details** +> +> Requires `inferenceTokenWindowHours` to also be set — without a window length the cap is inert and no limit is enforced. +> +> Where the app runs the sessions, it keeps each person’s count in a local file, so someone who uses two devices has a separate count on each. - The app keeps each person’s count in a local file, and no server enforces it. Someone who uses two devices has a separate count on each. - - - - Required when `inferenceMaxTokensPerWindow` is set — the cap only takes effect once both are configured. - - Each person’s window starts the first time they use the app after their previous window ends, so 24 hours does not mean midnight to midnight. - - +> **inferenceTokenWindowHours details** +> +> Required when `inferenceMaxTokensPerWindow` is set — the cap only takes effect once both are configured. +> +> Each person’s window starts the first time they use the app after their previous window ends, so 24 hours does not mean midnight to midnight. ## Appearance | Setting | Type | Availability | Default | Description | | - | - | - | - | - | -| End-user attribution
`endUserAttribution` | `boolean` | MDM + Bootstrap
Added in 1.25927.0 | — | Show the signed-in user’s identity-provider identity in the sidebar and account menu, and emit it as the OpenTelemetry enduser.id resource attribute. | -| Deployment display name
`deploymentDisplayName` | `string` | MDM + Bootstrap
Added in 1.24012.0 | — | Overrides the provider label shown in the sidebar footer, user-menu header, and connection-error banner. | -| Deployment display subtitle
`deploymentDisplaySubtitle` | `string` | MDM + Bootstrap
Added in 1.24012.0 | — | Optional detail shown after the deployment display name in the account-menu header. | -| Hide configuration deprecation warnings
`disableConfigDeprecationWarnings` | `boolean` | MDM + Bootstrap
Added in 1.40609.0 | — | Don’t show users the in-app warning that this configuration uses a deprecated field. The final reminder in the 24 hours before the cut-off still appears. | -|