会話履歴を30日で消さない
初期値だと、30日使っていないセッションの履歴は起動時に何の通知もなく削除され、/resume からも消えます。過去のやり取りを検索・再開したいなら大きくしておくのが安全です。
最小値は 1。大きくするとディスク使用量は増えます。
- 既定値
- 30(日)
- 書く場所
~/.claude/settings.json
{ "cleanupPeriodDays": 3650 }
Claude Code と Codex で「入れておくべき設定」32 項目を、理由とコピペ用スニペットつきでまとめました。自分の settings.json / config.toml を貼れば、足りない項目を判定します。
上から順に入れていけば大体OK。コードはそのままコピーでき、「まとめに追加」で複数を1ファイル分に結合できます。
おすすめには該当なし。下の「全項目」に 件あります。
初期値だと、30日使っていないセッションの履歴は起動時に何の通知もなく削除され、/resume からも消えます。過去のやり取りを検索・再開したいなら大きくしておくのが安全です。
最小値は 1。大きくするとディスク使用量は増えます。
~/.claude/settings.json{ "cleanupPeriodDays": 3650 }
deny に書いたファイルは検索結果から外れ、読み取りも Edit / Write もブロックされます。deny はどの権限モード(bypassPermissions を含む)でも効くので、最後の砦として置いておけます。
Read の deny は Claude の Read ツールに対する制限です。Bash 経由の cat まで確実に止めたいなら sandbox も併用します。
~/.claude/settings.json{ "permissions": { "deny": [ "Read(./.env)", "Read(./.env.*)", "Read(./secrets/**)", "Read(~/.ssh/**)", "Read(~/.aws/**)" ] } }
acceptEdits や bypassPermissions など、普段は確認なしで進むモードでも ask に書いた操作だけは確認が出ます。外に出ていく操作(push・デプロイなど)を止めるのに向いています。
dontAsk モードでは確認の代わりに拒否になります。
~/.claude/settings.json{ "permissions": { "ask": ["Bash(git push *)"] } }
Claude が実行する Bash コマンドを、ファイルシステム・ネットワークから隔離します。/sandbox で選ぶとそのプロジェクトの settings.local.json にしか書かれないので、全プロジェクトで有効にしたいならユーザー設定に書きます。
macOS・Linux・WSL2 のみ。Linux/WSL2 は bubblewrap と socat が必要。起動できないときは黙ってサンドボックスなしで動くので、厳密にしたいなら sandbox.failIfUnavailable も true に。
~/.claude/settings.json{ "sandbox": { "enabled": true } }
サンドボックスの既定の読み取り範囲には ~/.aws/credentials のような認証ファイルも含まれます。読ませる必要のないものは明示的に塞いでおきます。
認証情報を使わせつつ中身は見せたくない場合は sandbox.credentials の mask を使います。
~/.claude/settings.json{ "sandbox": { "filesystem": { "denyRead": ["~/.aws/credentials", "~/.ssh"] } } }
サンドボックス内のコマンドが通信するたびに確認が出るのを減らせます。*.example.com で サブドメイン、:443 のようにポートも絞れます。
~/.claude/settings.json{ "sandbox": { "network": { "allowedDomains": ["github.com", "*.npmjs.org", "registry.npmjs.org"] } } }
acceptEdits ならファイル編集と mkdir・mv などは確認なしで進み、それ以外は確認が出ます。毎回 Shift+Tab で切り替えている人向け。
選べる値: default / acceptEdits / plan / auto / dontAsk / bypassPermissions。auto と bypassPermissions はプロジェクト設定からは効かず、~/.claude/settings.json に書く必要があります。
~/.claude/settings.json{ "permissions": { "defaultMode": "acceptEdits" } }
うっかり全許可で起動するのを防ぎます。サブエージェント定義の permissionMode: bypassPermissions も無視されます。チームでは managed settings に置くのが定番。
~/.claude/settings.json または managed-settings.json{ "permissions": { "disableBypassPermissionsMode": "disable" } }
true だと、クローンしたリポジトリの .mcp.json に書かれたサーバーが確認なしで起動します。承認ダイアログで「すべて承認」を選ぶと settings.local.json に true が書かれるので、ときどき確認しておくと安心です。
~/.claude/settings.json{ "enableAllProjectMcpServers": false }
毎回「日本語で」と書かなくても日本語で返ってきます。音声入力の言語やセッションタイトルにも使われます。
値は検証されないので、スペルミスしてもエラーになりません。
~/.claude/settings.json{ "language": "japanese" }
入力欄の下に、今のモデルとコンテキストの使用率が常に出ます。圧縮(compact)が近いことに気づけるので地味に効きます。
この例は jq が必要です。標準入力に JSON が来るので、任意のスクリプトに差し替えられます。
~/.claude/settings.json{ "statusLine": { "type": "command", "command": "jq -r '\"[\\(.model.display_name)] \\(.context_window.used_percentage // 0)% context\"'", "padding": 2 } }
auto のままだと多くのターミナルでは通知が出ません。terminal_bell ならどのターミナルでもベルが鳴り、タスク完了や権限確認待ちに気づけます。
他の値: iterm2 / iterm2_with_bell / kitty / ghostty / notifications_disabled
~/.claude/settings.json{ "preferredNotifChannel": "terminal_bell" }
stable は概ね1週間前の版で、大きな不具合のあったリリースを飛ばします。仕事で使う環境を安定させたいとき向け。
~/.claude/settings.json{ "autoUpdatesChannel": "stable" }
low / medium は速くて安く、high はバランス型、xhigh はより深く考える代わりにトークンを多く使います。普段使いの基準を決めておくと、毎回 /model で調整する手間が減ります。
~/.claude/settings.json{ "effortLevel": "high" }
休憩を挟んでもキャッシュが残り、再開時の読み直しコストが下がります。
1時間キャッシュは書き込み単価が5分より高くなります(API 従量課金の場合)。v2.1.242 以降。
~/.claude/settings.json{ "promptCacheTtl": "1h" }
空文字にすると表記なし、文字列を入れるとその文面になります。古い includeCoAuthoredBy は attribution に置き換えられました。
チームのルールで AI 利用を明記する場合は消さないこと。
~/.claude/settings.json{ "attribution": { "commit": "", "pr": "" } }
慣れてきたら、スピナー横に流れる使い方のヒントは不要になります。/config の Show tips と同じです。
~/.claude/settings.json{ "spinnerTipsEnabled": false }
{ "feedbackSurveyRate": 0 }
AGENTS.md は合計32KiBを超えた分が読まれません。長い指示書を書いている人は、後半の大事なルールが黙って無視されている可能性があります。
上げすぎると毎回の最初のターンでトークンを消費します。ディレクトリごとに AGENTS.md を分けるのも手です。
~/.codex/config.tomlproject_doc_max_bytes = 65536
Claude Code と Codex を併用しているなら、指示書を二重管理せずに済みます。AGENTS.md がないディレクトリでだけ使われます。
~/.codex/config.tomlproject_doc_fallback_filenames = ["CLAUDE.md"]
approval_policy = "untrusted" はもうサポートされず、on-failure も非推奨です。古い設定をコピペしたままの人は on-request(対話)か never(非対話)に直しましょう。
細かく制御したいときは approval_policy = { granular = { ... } } 形式も使えます。
~/.codex/config.tomlapproval_policy = "on-request"
read-only のままだと編集のたびに承認が必要です。workspace-write なら作業ディレクトリ内だけ書き込めて、それ以外は守られます。danger-full-access は基本的に避けます。
workspace-write でも .git/ や .codex/ は保護される場合があります。
~/.codex/config.tomlsandbox_mode = "workspace-write"
[sandbox_workspace_write] network_access = true
Windows ネイティブで Codex を動かすときの推奨値です。管理者権限がない・セットアップに失敗する場合だけ unelevated を使います。
~/.codex/config.toml[windows] sandbox = "elevated"
プロジェクト内の .codex/config.toml・hooks・rules は信頼したプロジェクトでしか読まれません。逆に "untrusted" にすれば、怪しいリポジトリの設定を確実に無視できます。
パスは自分の環境に合わせて書き換えてください。
~/.codex/config.toml[projects."/path/to/your/repo"] trust_level = "trusted"
~/.codex/history.jsonl は放っておくと増え続けます。上限(例は100MiB)を超えると古いものから捨てて圧縮します。
履歴を一切残したくないなら persistence = "none"。
~/.codex/config.toml[history] persistence = "save-all" max_bytes = 104857600
ターミナルが非アクティブなときに完了・承認待ちを通知します。auto は OSC 9 対応端末ならデスクトップ通知、そうでなければベル。確実に音を鳴らしたいなら bel。
notifications = ["agent-turn-complete", "approval-requested"] のように種類を絞ることもできます。
~/.codex/config.toml[tui] notifications = true notification_method = "bel"
[tui] alternate_screen = "never"
既定の cached は事前にインデックスされた結果を返すので最新情報に弱めです。live は最新を取りに行く代わりに、プロンプトインジェクションの危険が増えます。
"disabled" で検索ツール自体を外せます。
~/.codex/config.tomlweb_search = "live"
出力中の path:行番号 がそのエディタで開くリンクになります。vscode / vscode-insiders / windsurf / cursor / none から選択。
~/.codex/config.tomlfile_opener = "cursor"
low〜max などから選べます(使える段階はモデル次第)。重い作業が多いなら上げ、速さ優先なら下げます。
~/.codex/config.tomlmodel_reasoning_effort = "high"
[analytics] enabled = false
設定ファイルの中身を貼ると、おすすめ 32 項目と照らして「推奨どおり・違う値・未設定・要見直し」を判定します。処理はこのブラウザの中だけで行い、内容はどこにも送信しません。API キーなどは念のため伏せてから貼ってください。
settings.json中身を出す:
config.toml中身を出す:
公式リファレンスから自動で取り込んだ 711 キーの一覧です(説明は英語)。上の絞り込みはここにも効き、日本語で検索しても英語の言い換えでヒットします。
該当なし。
advisorModelPick which model answers when Claude asks the advisor toolPick which model answers when Claude calls the server-side advisor tool. Unset it to turn the advisor off. The advisor must be at least as capable as your main model. See Choose an advisor model for the accepted pairings and what happens when you pick one that isn't accepted.
"fable", "opus", or "sonnet", which resolve to Claude Code's current default version of that model family, or a full model ID such as "claude-opus-5-5"{ "advisorModel": "opus" }
alwaysThinkingEnabledTurn extended thinking off for every sessionTurn extended thinking off for every session by setting this to false. Thinking is on by default, so true changes nothing. Most people set this through /config rather than by editing the file.
true no effect; thinking is already onfalse Claude Code turns extended thinking off for every session{ "alwaysThinkingEnabled": false }
availableModelsRestrict which models people can pickRestrict which models people can select for the main session, subagents, skills, and the advisor. A managed list constrains /model, --model, and the model key in a developer's own files; a model outside it can't be selected. With the default prefix matching, this doesn't touch the Default option on its own; pair it with enforceAvailableModels for that.
{ "availableModels": ["sonnet", "haiku"] }
availableModelsMatchMake each availableModels model ID entry permit only the version it namesChoose how availableModels entries match model IDs. By default a model ID entry also permits later versions that extend it, so "claude-opus-5" permits Opus 5.5. With "exact", each model ID entry permits only the version it names, so a newer version of that model stays blocked until you list it. Requires Claude Code v2.1.283 or later.
"prefix""prefix" a model ID entry permits its version and any model ID that extends it with another segment"exact" a model ID entry permits only the version it names, including that version's dated IDs, so "claude-opus-5" permits Opus 5 but not claude-opus-5-5. A family alias such as "opus" still permits the whole family, and best, opusplan, and default entries are ignored{ "availableModels": ["claude-opus-5", "claude-sonnet-5"], "availableModelsMatch": "exact" }
deniedModelsBlock specific models, even ones availableModels permitsBlock specific models, with or without an availableModels allowlist and even when that list permits them. Claude Code hides a blocked model from the /model picker, and the model can't be selected anywhere availableModels is enforced. A session on the Default option doesn't run a blocked model either, as Block specific models or versions describes. Requires Claude Code v2.1.283 or later.
{ "availableModels": ["opus", "sonnet"], "deniedModels": ["claude-opus-5-5"] }
effortLevelSet a default effort level for models without a saved level of their ownSet a default effort level for models you haven't saved a level for. Lower levels are faster and cheaper on straightforward tasks, and higher levels reason more deeply on complex problems.
"low" the least reasoning, for short, scoped, latency-sensitive tasks that aren't intelligence-sensitive"medium" reduces token usage for cost-sensitive work that can trade off some intelligence"high" balances token usage and intelligence"xhigh" deeper reasoning at higher token spend{ "effortLevel": "xhigh" }
enforceAvailableModelsKeep the /model Default choice inside your availableModels allowlistThe /model picker has a Default option, and default model setting describes the model it resolves to. An availableModels allowlist limits the models you can name, but with the default prefix matching it doesn't remap your account type's default, so Default can still resolve to a model outside the list. This key closes that gap. Requires Claude Code v2.1.175 or later.
falsetrue when Default would resolve to a model outside availableModels, Claude Code resolves it to the first available model in the listfalse this key doesn't change how Default resolves{ "availableModels": ["sonnet", "haiku"], "enforceAvailableModels": true }
fallbackModelName backup models for when the primary is overloadedName backup models for Claude Code to try, in order, when your primary model is overloaded or unavailable. Claude Code switches to the next available model in the chain for the rest of the turn and shows a notice. Without a chain, Claude Code retries the same model and then surfaces the server's error, and you retry or switch models yourself.
"default" expands to the default model{ "fallbackModel": ["claude-sonnet-5", "claude-haiku-4-5"] }
fastModeTurn fast mode on for sessions where it's availableTurn fast mode on for sessions where it's available, for interactive work like rapid iteration or live debugging where you want speed at a higher cost per token. You don't usually edit this key by hand: running /fast writes fastMode: true to ~/.claude/settings.json, and running it again to turn fast mode off removes the key. Fast mode runs only on Opus 5.5, Opus 5, and Opus 4.8: turning it on from another model switches you to Opus, and switching to an unsupported model turns it off. See Switch models while fast mode is on.
true Claude Code turns fast mode on for sessions where it's availablefalse fast mode stays off{ "fastMode": true }
fastModePerSessionOptInRequire people to turn fast mode on each sessionNormally, running /fast saves fastMode to a person's user settings, so fast mode is on at the start of every later session. Set this key to true to stop that: a saved fastMode: true no longer turns fast mode on at session start, and each person has to run /fast in each session they want it. Claude Code leaves the fastMode key in their file, so turning this key off restores the old behavior.
falsetrue a saved fastMode: true no longer turns fast mode on at session start, so each person runs /fast in each session they want it; a fastMode: true passed with --settings still counts for that session unless managed settings set this keyfalse a saved fastMode: true turns fast mode on at the start of every later session{ "fastModePerSessionOptIn": true }
languageHave Claude respond in a language other than EnglishHave Claude respond in a language other than English by default. There is no fixed list for responses: Claude Code passes the value verbatim to Claude as an instruction to always respond in that language, so any language name Claude can read works. Claude Code doesn't check the value, so a misspelled name reaches Claude as written rather than producing an error. The same value sets the language for voice dictation, which does have a fixed list of supported dictation languages, and for auto-generated session titles.
"japanese", "spanish", or "french"; Claude Code doesn't validate it{ "language": "japanese" }
maxEffortLevelCap the effort level for every model or per model, on every providerCap the effort level a session can use, leaving lower levels available. Any higher level runs at the cap instead, including one from /effort, the /model picker, --effort, CLAUDE_CODE_EFFORT_LEVEL, a skill's or subagent's effort frontmatter, or the model's own default. Claude Code applies the cap itself before each request, so it holds on every provider, including Amazon Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry. Requires Claude Code v2.1.267 or later.
"low", "medium", "high", "xhigh", or "max". A "max" value sets no cap{ "maxEffortLevel": "medium", "modelSettings": { "claude-sonnet-4-6": { "maxEffortLevel": "max" } } }
modelChange the model Claude Code starts withSet the model every new session uses, so you don't have to pick one with /model each time. Setting it here doesn't stop you from switching mid-session. If your admin set an organization default model to override user selection, you get that model even when you set this key in user, project, or local settings.
{ "model": "claude-sonnet-5" }
modelOverridesMap model IDs to your provider's IDs, such as Bedrock ARNsMap Anthropic model IDs to provider-specific model IDs, such as Amazon Bedrock inference profile ARNs. Each model picker entry then uses its mapped value when calling the provider API. Administrators use this on Amazon Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry to route each model version to a specific inference profile, version name, or deployment for governance, cost allocation, or regional routing.
{ "modelOverrides": { "claude-opus-4-6": "arn:aws:bedrock:us-east-1:123456789012:inference-profile/example" } }
modelPickerChoose which models the /model picker lists, in your own order and with your own labelsList the models the /model picker offers, in the order you write them and under labels you choose, so the picker lists the models your organization runs, after the built-in lineup or instead of it. Each row's model is taken verbatim, so it accepts anything --model accepts: an alias such as opus, an Anthropic model ID, or a provider-format ID for Amazon Bedrock, Google Cloud's Agent Platform, Microsoft Foundry, or an LLM gateway. Requires Claude Code v2.1.242 or later.
options array of rows and an optional replaceBuiltInOptions Boolean{ "modelPicker": { "options": [ { "model": "us.anthropic.claude-opus-4-8", "label": "Opus (production)" }, { "model": "us.anthropic.claude-sonnet-4-6", "label": "Sonnet (production)", "description": "Day-to-day work" } ] } }
modelPricingReport spend at your organization's contracted rates instead of list priceReport spend at the rates your organization pays instead of list price. Set it when your organization has contracted rates, so the dollar figures developers see match your bill. Claude Code applies the rates in /usage, the status line, the Agent SDK's total_cost_usd, the --max-budget-usd limit, and the OpenTelemetry cost metric and events. You supply the rates: Claude Code doesn't read them from your contract or the Claude Console. Requires Claude Code v2.1.242 or later.
multiplier and an optional overrides map{ "modelPricing": { "multiplier": 0.85, "overrides": { "claude-sonnet-4-6": { "input": 2.4, "output": 12, "cacheRead": 0.24, "cacheWrite": 3 } } } }
modelSettingsKeep a saved effort level or auto-compact window per model, or cap one model's effortSave an effort level for each model you use. Requires Claude Code v2.1.251 or later.
effortLevel one of "low", "medium", "high", or "xhigh"autoCompactWindow a number of tokens from 100000 to 1000000, or "auto" for the window tuned for the model. /autocompact saves here. For that model, the value takes precedence over a top-level autoCompactWindow in the same settings file. Requires Claude Code v2.1.288 or later{ "modelSettings": { "claude-opus-5-5": { "effortLevel": "high" } } }
outputStyleChange Claude's role, tone, and output format with an output styleSelect an output style by name. An output style is a saved set of instructions that changes Claude's role, tone, and output format, such as the built-in Explanatory and Learning styles or one you wrote yourself.
{ "outputStyle": "Explanatory" }
promptCacheTtlChoose the prompt cache lifetime for the main conversationChoose how long the prompt cache holds the main conversation. This key applies to your interactive, -p, and Agent SDK turns, together with the helpers Claude Code runs inline with them. The one-hour lifetime keeps the cache warm across longer breaks, and the API bills each cache write at a higher rate than at the five-minute lifetime. Requires Claude Code v2.1.242 or later.
"5m" the cache holds for five minutes"1h" the cache holds for an hour{ "promptCacheTtl": "1h", "subagentPromptCacheTtl": "5m" }
showThinkingSummariesSee summaries of Claude's thinking instead of a collapsed stubSee summaries of Claude's extended thinking in interactive sessions. Set it if you want the full summaries when you expand thinking with Ctrl+O. When unset or false, the Anthropic API redacts thinking blocks and Claude Code shows a collapsed stub; third-party providers don't redact.
falsetrue you see full thinking summaries when you expand thinking with Ctrl+Ofalse the Anthropic API redacts thinking blocks and Claude Code shows a collapsed stub{ "showThinkingSummaries": true }
subagentPromptCacheTtlChoose the prompt cache lifetime for subagents and other requests outside the main conversationChoose how long the prompt cache holds the requests Claude Code makes outside the main conversation. This key applies to subagents, workflows, and Claude Code's own background and helper requests, such as compaction and session titles. The one-hour lifetime keeps the cache warm across longer breaks, and the API bills each cache write at a higher rate than at the five-minute lifetime. Requires Claude Code v2.1.242 or later.
"5m" the cache holds for five minutes"1h" the cache holds for an hour{ "subagentPromptCacheTtl": "1h" }
switchModelsOnFlagSwitch models automatically or pause when a safety classifier flags a requestChoose what happens when a safety classifier flags a request: switch to the fallback model and continue, or pause so you can choose between switching and editing the prompt.
true, switch automaticallytrue Claude Code switches to the fallback model and continuesfalse in an interactive session Claude Code pauses so you can choose between switching and editing the prompt; where no dialog can show, such as a -p run, the flagged request ends as an error{ "switchModelsOnFlag": false }
ultracodeHave Claude plan a workflow for each substantive task without being askedStart sessions with ultracode on. With it on, Claude plans a workflow for each substantive task instead of waiting for you to ask. Claude plans workflows only when dynamic workflows are enabled for you and your model supports xhigh effort. The key doesn't change the session's effort level: ultracode runs at whichever level the session uses. Claude Code reads this key but never writes it: /effort ultracode turns ultracode on for the current session only.
true sessions start with ultracode on when dynamic workflows are enabled for you and your model supports xhighfalse sessions start with ultracode off{ "ultracode": true }
allowManagedPermissionRulesOnlyMake managed settings the only settings source of permission rulesMake managed settings the only settings source of permission rules. Claude Code then ignores allow, ask, and deny rules in user, project, local, and --settings files, ignores --allowedTools, hides the always-allow choices in permission prompts, and stops saving new rules.
--settings, in addition to the managed onestrue managed settings become the only settings source of permission rulesfalse Claude Code applies permission rules from user, project, local, and --settings files in addition to the managed ones{ "allowManagedPermissionRulesOnly": true }
autoModeAdd your own allow and deny rules to the auto mode classifierAdd your own rules to what the auto mode classifier blocks and allows. Use it to tell the classifier which repos, buckets, and domains your organization trusts, so it stops blocking routine internal operations. The classifier ships with built-in allow and deny rules. Include the literal string "$defaults" in an array to keep those built-in rules at that position and add yours around them; leave it out to replace them with yours.
environment, allow, soft_deny, and hard_deny arrays of prose rules, plus the classifyAllShell Boolean{ "autoMode": { "soft_deny": ["$defaults", "Never run terraform apply"] } }
autoMode.classifyAllShellSend every shell command through the auto mode classifier, even ones a narrow allow rule matchesSend every Bash and PowerShell command through the auto mode classifier while auto mode is active. By default, auto mode suspends only allow rules that could run arbitrary code: tool-wide and wildcard rules such as Bash(*), and interpreter or shell-wrapper prefixes such as Bash(python *). A command that any other allow rule matches, such as Bash(npm test), skips the classifier unless it carries per-command allowed domains. When it skips, a destructive argument the rule's prefix didn't anticipate can get through unseen. Setting this key suspends every shell allow rule for the session so the classifier sees every command. Requires Claude Code v2.1.193 or later.
falsetrue while auto mode is active, Claude Code sends every Bash and PowerShell command through the classifier and suspends your shell allow rules; outside auto mode the rules still applyfalse auto mode suspends only allow rules that could run arbitrary code, such as Bash(*) and Bash(python *); a command that any other allow rule matches skips the classifier unless it carries per-command allowed domains, and every other shell command goes through it{ "autoMode": { "classifyAllShell": true } }
disableAutoModeRemove auto mode from the permission mode cycleRemove auto mode from the Shift+Tab cycle. Any session that would otherwise start in auto mode, whether from --permission-mode auto, a settings file, or the built-in default, starts in default instead. Administrators set it in managed settings to prevent developers in their organization from using auto mode.
"disable"{ "disableAutoMode": "disable" }
permissionsSet allow, ask, and deny rules and the starting permission modeControl which tools Claude can use without asking, which ones always prompt, and which ones are blocked, and set the permission mode a session starts in. Every permissions.* key below nests under this object.
allow, ask, deny, additionalDirectories, blockReadsOutsideWorkingDirectories, defaultMode, disableBypassPermissionsMode, and disableAutoMode{ "permissions": { "allow": ["Bash(npm run *)"], "ask": ["Bash(git push *)"], "deny": ["Read(./.env)"], "defaultMode": "acceptEdits" } }
useAutoModeDuringPlanLet the auto mode classifier review shell commands in plan mode; set false to get prompts insteadChoose whether Claude Code uses the auto mode classifier to review shell commands in plan mode. With the default true, the classifier reviews each command during planning when auto mode is available and you see no prompt, except for critical-path removals. Set false to get a permission prompt for every command outside the built-in read-only set. Appears in /config as Use auto mode during plan.
truetrue the same as unset; when auto mode is available, the classifier reviews each shell command during planning instead of prompting you for it, except critical-path removals. A false in any of these files still turns it offfalse you get a permission prompt for every command outside the built-in read-only set{ "useAutoModeDuringPlan": false }
permissions.allowApprove listed tool uses without a promptList the tool uses Claude Code approves without asking you. In an MCP rule, * can appear only in the tool name after the mcp__<server>__ prefix, such as mcp__github__get_*; it can't appear in the server name.
{ "permissions": { "allow": ["Bash(git diff *)", "Read(~/.zshrc)"] } }
permissions.askAlways prompt before listed tool usesList the tool uses that prompt you for confirmation even in a permission mode that would otherwise approve them, such as acceptEdits or bypassPermissions. In dontAsk mode Claude Code denies a matching tool use instead of prompting.
{ "permissions": { "ask": ["Bash(git push *)"] } }
permissions.denyBlock listed tool uses, including reads of files that hold secretsList the tool uses Claude Code blocks. Use it for files that hold API keys, secrets, or environment values: Claude Code excludes matching files from file discovery and search results, denies reads of them, and blocks the Edit and Write tools on the matching paths.
{ "permissions": { "deny": [ "Read(./.env)", "Read(./.env.*)", "Read(./secrets/**)", "Read(./config/credentials.json)", "Bash(curl *)" ] } }
permissions.additionalDirectoriesGive Claude file access to directories outside the current oneGive Claude file access to directories outside the one you started in, as additional working directories. Most .claude/ configuration is not discovered from these directories.
{ "permissions": { "additionalDirectories": ["../docs/"] } }
permissions.blockReadsOutsideWorkingDirectoriesMake the file tools refuse reads outside the working directories in every permission modeMake Claude's file tools refuse reads outside your working directories in every permission mode, including bypassPermissions. Claude Code denies Read, Grep, Glob, and LSP calls on those paths and tells Claude to ask you to add the directory with /add-dir. Files Claude Code itself needs stay readable, such as your skills, plugins, rules, agents, commands, and the CLAUDE.md memory file under ~/.claude/. Requires Claude Code v2.1.257 or later.
true Claude's file tools refuse reads outside the working directoriesfalse the same as unset; the block still applies if another file sets true{ "permissions": { "blockReadsOutsideWorkingDirectories": true } }
permissions.defaultModeSet the permission mode new sessions start inSet the permission mode new sessions start in. When you leave it unset, sessions start in the built-in default for your surface.
"default" Claude Code runs only reads without asking"acceptEdits" Claude Code also runs file edits and common filesystem commands such as mkdir and mv without asking"plan" Claude Code reads and plans but blocks edits until you approve a plan"auto" Claude Code runs without routine prompts; before actions such as shell commands and network requests run, a background classifier checks that they align with your request"dontAsk" Claude Code auto-denies every call that would otherwise prompt; reads, other actions that need no approval, and pre-approved tools still run"bypassPermissions" Claude Code runs everything without asking"manual" an alias for "default", in Claude Code v2.1.200 or later{ "permissions": { "defaultMode": "acceptEdits" } }
permissions.disableBypassPermissionsModePrevent anyone from entering bypassPermissions modePrevent anyone from entering bypassPermissions mode. Claude Code then rejects the --dangerously-skip-permissions flag, and ignores an agent definition's permissionMode: bypassPermissions, so the subagent runs with the parent session's permission mode.
"disable"{ "permissions": { "disableBypassPermissionsMode": "disable" } }
skipAutoPermissionPromptSkip the one-time notice Claude Code shows when you first enter auto mode yourself rather than through the built-in defaultSkip the one-time notice describing auto mode that Claude Code shows when you first enter auto mode yourself, for example through your own settings or the mode selector, rather than when the built-in default starts a session in it. Claude Code shows that notice once and then records that it was shown, so this key only matters where the notice hasn't appeared yet.
true Claude Code skips the noticefalse the same as unset; the notice appears once unless another of these files sets true{ "skipAutoPermissionPrompt": true }
skipDangerousModePermissionPromptSkip the confirmation dialog before bypassPermissions modeSkip the confirmation dialog Claude Code shows before a session enters bypassPermissions mode, whether from --dangerously-skip-permissions or from defaultMode: "bypassPermissions". Claude Code writes true here in your user settings when you accept that dialog once.
true Claude Code skips the confirmation dialog before a session enters bypassPermissions modefalse the same as unset; the dialog appears unless another of these files sets true{ "skipDangerousModePermissionPrompt": true }
sandboxIsolate Bash commands from your filesystem and network on macOS, Linux, and WSL2Isolate the Bash commands Claude runs from your filesystem and network with sandboxing. Turn the sandbox on with enabled, then narrow or widen what sandboxed commands can touch with the filesystem, network, and credentials sub-objects. The sandbox runs on macOS, Linux, and WSL2.
enabled, failIfUnavailable, autoAllowBashIfSandboxed, excludedCommands, allowUnsandboxedCommands, enableWeakerNestedSandbox, enableWeakerNetworkIsolation, allowAppleEvents, bwrapPath, socatPath, ignoreViolations, and ripgrep, plus the filesystem, network, and credentials objects{ "sandbox": { "enabled": true, "autoAllowBashIfSandboxed": true, "excludedCommands": ["docker *"], "filesystem": { "allowWrite": ["/tmp/build", "~/.kube"], "denyRead": ["~/.aws/credentials"] }, "network": { "allowedDomains": ["github.com", "*.npmjs.org"] } } }
sandbox.enabledTurn on Bash sandboxing on macOS, Linux, and WSL2Turn on sandboxing for Bash commands. When you pick a mode in the /sandbox panel, Claude Code writes this key to .claude/settings.local.json for the current project; set it in ~/.claude/settings.json to sandbox every project.
falsetrue Claude Code sandboxes Bash commandsfalse Bash commands run unsandboxed{ "sandbox": { "enabled": true } }
sandbox.autoAllowBashIfSandboxedRun sandboxed commands without a permission promptLet Claude Code run sandboxed Bash commands without a permission prompt. Commands that can't run in the sandbox still go through the regular permission flow, and deny rules and content-scoped ask rules such as Bash(git push *) still apply; a bare Bash ask rule is skipped for sandboxed commands. Set it to false to send sandboxed commands through the regular permission flow too, which the /sandbox Mode tab calls regular permissions mode.
truetrue Claude Code runs sandboxed Bash commands without a permission prompt, subject to deny rules and content-scoped ask rules; CLAUDE_CODE_SUBPROCESS_ENV_SCRUB turns auto-allow offfalse sandboxed commands go through the regular permission flow, so your allow rules and permission mode decide. The /sandbox Mode tab calls this regular permissions mode{ "sandbox": { "enabled": true, "autoAllowBashIfSandboxed": false } }
sandbox.excludedCommandsName commands Claude Code can run outside the sandboxName commands that Claude Code runs outside the sandbox, such as tools that don't work under it. Each entry uses the same syntax as the content of a Bash(...) permission rule: an exact command, a prefix such as docker *, or a wildcard pattern. A pattern with no wildcard is an exact match, so docker matches only docker with no arguments.
{ "sandbox": { "excludedCommands": ["docker *"] } }
sandbox.allowUnsandboxedCommandsLet Claude retry a blocked command outside the sandbox, or forbid itLet Claude retry a command outside the sandbox with the dangerouslyDisableSandbox parameter after the sandbox blocks it. When it's false, Claude Code ignores that parameter. While the sandbox is running, commands Claude runs are then sandboxed unless they match an excludedCommands entry. The /sandbox Overrides tab shows that state as Strict sandbox mode. A false in managed settings turns on strict sandbox mode for the developers it covers.
truetrue Claude can retry a command outside the sandbox with the dangerouslyDisableSandbox parameter after the sandbox blocks itfalse Claude Code ignores that parameter, so while the sandbox is running, commands Claude runs are sandboxed unless they match an excludedCommands entry{ "sandbox": { "enabled": true, "allowUnsandboxedCommands": false } }
sandbox.filesystemControl which paths sandboxed commands can read and writeControl which paths sandboxed commands can read and write. By default they can write to the working directory, the per-user temp directory, and directories you add with --add-dir, /add-dir, or permissions.additionalDirectories, and can read the rest of the filesystem, including credential files. Widen or narrow that with the four path lists, or switch the filesystem layer off with disabled. See Filesystem isolation for the default boundaries.
allowWrite, denyWrite, denyRead, and allowRead arrays, plus the allowManagedReadPathsOnly and disabled Booleans{ "sandbox": { "filesystem": { "allowWrite": ["/tmp/build", "~/.kube"], "denyRead": ["~/.aws/credentials"] } } }
sandbox.filesystem.allowWriteAdd paths sandboxed commands can write toAdd paths where sandboxed commands can write, beyond the working directory, the per-user temp directory, and the directories you've added with --add-dir, /add-dir, or permissions.additionalDirectories. Use it when a subprocess such as kubectl or a build tool needs to write outside the project.
--add-dir or /add-dir, and directories in permissions.additionalDirectories{ "sandbox": { "filesystem": { "allowWrite": ["/tmp/build", "~/.kube"] } } }
sandbox.filesystem.denyWriteBlock sandboxed commands from writing to specific pathsBlock sandboxed commands from writing to specific paths, including paths inside a directory that is otherwise writable.
{ "sandbox": { "filesystem": { "denyWrite": ["/etc", "/usr/local/bin"] } } }
sandbox.filesystem.denyReadBlock sandboxed commands from reading specific pathsBlock sandboxed commands from reading specific paths, such as credential files that the default read policy would otherwise expose. To protect a credential file and keep it usable through the sandbox proxy, see sandbox.credentials instead.
~/.aws/credentials{ "sandbox": { "filesystem": { "denyRead": ["~/.aws/credentials"] } } }
sandbox.filesystem.allowReadRe-open reading inside a region denyRead blocksRe-open reading for specific paths inside a region that denyRead blocks, to build workspace-only read access. An exact or wildcard denyRead entry stays blocked inside a broader allowRead, as the overlap table shows. When a wildcard denyRead entry such as ~/**/.env matches a directory, Claude Code blocks reads of its contents as well. Before v2.1.236 on macOS, Claude Code re-opened the paths a wildcard denyRead entry matched wherever a broader allowRead entry covered them, and left a matched directory's contents readable.
{ "sandbox": { "filesystem": { "denyRead": ["~/"], "allowRead": ["."] } } }
sandbox.filesystem.allowManagedReadPathsOnlyStop developers from re-opening read paths your organization blockedHonor only the allowRead entries that come from managed settings, so developers can't re-open read access to paths your organization blocked. Claude Code still merges denyRead entries from every settings scope the session loads.
falsetrue Claude Code honors only the allowRead entries from managed settingsfalse allowRead entries from other settings files can merge in{ "sandbox": { "filesystem": { "denyRead": ["~/"], "allowRead": ["~/work"], "allowManagedReadPathsOnly": true } } }
sandbox.filesystem.disabledTurn off filesystem isolation while keeping network isolationSkip filesystem isolation while keeping network isolation. Sandboxed commands get unrestricted read and write access to the host filesystem, and their network egress stays confined to network.allowedDomains. Use it when you sandbox to control where commands connect rather than what they write. Requires Claude Code v2.1.216 or later.
false, so filesystem isolation stays ontrue Claude Code skips filesystem isolation and keeps network isolationfalse filesystem isolation stays on{ "sandbox": { "enabled": true, "filesystem": { "disabled": true }, "network": { "allowedDomains": ["github.com", "*.npmjs.org"] } } }
sandbox.ignoreViolationsSilence violation reports for paths a command is expected to probeSilence sandbox violation reports for paths you expect a command to probe and be refused, such as a tool that checks /etc/hosts on startup, so those denials don't show up as violations or in what Claude sees. The sandbox still blocks the access; only the report is suppressed. Keys are substrings to match against the command, with * matching every command, and values are substrings of the violation to ignore for that command, such as a filesystem path.
{ "sandbox": { "ignoreViolations": { "*": ["/etc/hosts"] } } }
sandbox.enableWeakerNestedSandboxRun the Linux sandbox inside an unprivileged containerRun the Linux sandbox inside an unprivileged Docker container, where bubblewrap can't mount a fresh /proc. Instead the inner sandbox bind-mounts the container's existing /proc, which exposes process information that a fresh mount would hide. This reduces security; use it only when the outer container already provides the isolation you need.
falsetrue the inner sandbox bind-mounts the container's existing /proc instead of mounting a fresh onefalse the sandbox mounts a fresh /proc, which doesn't work in an unprivileged Docker container{ "sandbox": { "enabled": true, "enableWeakerNestedSandbox": true } }
sandbox.enableWeakerNetworkIsolationLet gh, gcloud, and terraform verify TLS behind a MITM proxy inside the sandbox on macOSLet sandboxed commands on macOS reach the system TLS trust service, com.apple.trustd.agent. Go-based tools such as gh, gcloud, and terraform need it to verify TLS certificates when you use network.httpProxyPort with a MITM proxy and a custom CA. This reduces security by opening a potential data exfiltration path through the trust service.
falsetrue sandboxed commands on macOS can reach com.apple.trustd.agentfalse sandboxed commands on macOS can't reach the system TLS trust service{ "sandbox": { "enabled": true, "enableWeakerNetworkIsolation": true } }
sandbox.allowAppleEventsLet sandboxed commands send Apple Events on macOSLet sandboxed commands on macOS send Apple Events, which open, osascript, and tools that open URLs in a browser need; without it they fail with error -600. This removes code-execution isolation: sandboxed commands can launch other applications unsandboxed with no user prompt, and can send AppleScript commands to running applications such as Terminal, subject to the per-app macOS automation-consent prompt (TCC).
falsetrue sandboxed commands on macOS can send Apple Eventsfalse sandboxed commands on macOS can't send Apple Events, so open and osascript fail with error -600{ "sandbox": { "enabled": true, "allowAppleEvents": true } }
sandbox.ripgrepUse your own ripgrep binary inside the sandboxPoint the sandbox at a ripgrep binary of your own instead of the one Claude Code uses, for example when your platform needs a differently built rg.
command, the path to the ripgrep binary, and optional args, an array of arguments to prependUSE_BUILTIN_RIPGREP to 0{ "sandbox": { "ripgrep": { "command": "/usr/local/bin/rg" } } }
sandbox.bwrapPathPoint the sandbox at a bubblewrap binary outside PATHPoint the sandbox at a bubblewrap binary installed outside PATH, such as a vendored copy on an air-gapped host. Claude Code uses the path both for the startup dependency check and when it wraps each sandboxed command.
PATH lookupbwrap on PATH{ "sandbox": { "enabled": true, "bwrapPath": "/opt/admin/bwrap" } }
sandbox.socatPathPoint the sandbox proxy at a socat binary outside PATHPoint the sandbox network proxy at a socat binary installed outside PATH.
PATH lookupsocat on PATH{ "sandbox": { "enabled": true, "socatPath": "/opt/admin/socat" } }
sandbox.credentialsHide or mask credential files and variables inside the sandboxDeclare the credential files and environment variables to protect from sandboxed commands. Each entry names a file path or a variable name and a mode: deny hides the credential inside the sandbox, and mask shows sandboxed commands a placeholder while the sandbox proxy substitutes the real value on outbound requests. Claude Code protects only the entries you list; there is no built-in credential deny list.
files, envVars, allowPlaintextInject, awsPairs, and sigv4{ "sandbox": { "credentials": { "files": [{ "path": "~/.aws/credentials", "mode": "deny" }], "envVars": [{ "name": "GITHUB_TOKEN", "mode": "deny" }] } } }
sandbox.credentials.filesBlock or mask reads of a credential file inside the sandboxProtect credential files or directories from sandboxed commands. With "mode": "deny", Claude Code blocks reads of the path inside the sandbox, the same read block as sandbox.filesystem.denyRead. With "mode": "mask", sandboxed commands on Linux and WSL2 read a sentinel copy of the file, and the sandbox proxy substitutes the real value on outbound requests to that entry's injectHosts; on macOS the file is unreadable inside the sandbox instead. "mode": "mask" requires Claude Code v2.1.221 or later.
path and a mode of "deny" or "mask", plus the optional mask fields for files{ "sandbox": { "credentials": { "files": [ { "path": "~/.aws/credentials", "mode": "deny" }, { "path": "~/.config/gh/hosts.yml", "mode": "mask", "injectHosts": ["api.github.com"] } ] } } }
sandbox.credentials.envVarsUnset or mask an environment variable inside the sandboxProtect environment variables from sandboxed commands. With "mode": "deny", Claude Code removes the variable from the environment of sandboxed commands. With "mode": "mask", sandboxed commands see a per-session sentinel value, and the sandbox proxy substitutes the real value on outbound requests to that entry's injectHosts, so tools such as gh and npm keep authenticating without ever holding the real credential.
name and a mode of "deny" or "mask", plus the optional mask fields for environment variables{ "sandbox": { "credentials": { "envVars": [ { "name": "NPM_TOKEN", "mode": "deny" }, { "name": "GITHUB_TOKEN", "mode": "mask", "injectHosts": ["api.github.com"] } ] } } }
sandbox.credentials.allowPlaintextInjectLet masked credentials reach plain HTTP services on trusted test networksAllow mask substitution on plain HTTP requests as well as TLS-terminated HTTPS. On plain HTTP the upstream identity is unverified and the credential travels in cleartext, so leave this off outside trusted test networks.
falsetrue Claude Code allows mask substitution on plain HTTP requests as well as TLS-terminated HTTPSfalse Claude Code allows mask substitution only on TLS-terminated HTTPS{ "sandbox": { "credentials": { "allowPlaintextInject": true } } }
sandbox.credentials.awsPairsLink custom-named AWS key variables into one credential for re-signingGroup masked environment variables that form one AWS credential for SigV4 re-signing when your credential lives in variables with non-standard names. Claude Code links the conventional AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN trio automatically when you mask their whole values, so you need this key only for other names. Requires Claude Code v2.1.224 or later.
accessKeyIdVar, secretAccessKeyVar, and optionally sessionTokenVar, naming sandbox.credentials.envVars entries{ "sandbox": { "credentials": { "awsPairs": [ { "accessKeyIdVar": "MY_KEY_ID", "secretAccessKeyVar": "MY_SECRET_KEY", "sessionTokenVar": "MY_SESSION_TOKEN" } ] } } }
sandbox.credentials.sigv4Choose whether streaming, presigned, or SigV4A AWS requests fail or pass throughChoose what the sandbox proxy does with AWS request forms it can't re-sign: streaming for aws-chunked streaming uploads, presigned for presigned URLs, and sigv4a for SigV4A asymmetric signatures. This applies only to requests signed with a masked pair's placeholder access key ID. Requires Claude Code v2.1.224 or later.
streaming, presigned, and sigv4a, each one of:"deny""deny" the proxy fails the request"passthrough" the proxy forwards the request signed with the masked placeholder, so the tool receives AWS's own rejection{ "sandbox": { "credentials": { "sigv4": { "streaming": "passthrough" } } } }
sandbox.networkControl which hosts, ports, and sockets sandboxed commands reachControl which hosts, ports, and sockets sandboxed commands can reach. The sandbox routes outbound traffic through a proxy that enforces these lists; see Network isolation for how the proxy decides and when it prompts.
{ "sandbox": { "network": { "allowedDomains": ["github.com", "*.npmjs.org"], "deniedDomains": ["uploads.github.com"], "allowLocalBinding": true } } }
sandbox.network.allowUnixSocketsList Unix socket paths sandboxed commands can use on macOSList the Unix socket paths sandboxed commands can connect to on macOS. Claude Code ignores this list on Linux and WSL2, where the seccomp filter can't inspect socket paths; use allowAllUnixSockets there instead.
{ "sandbox": { "network": { "allowUnixSockets": ["~/.ssh/agent-socket"] } } }
sandbox.network.allowAllUnixSocketsLet sandboxed commands connect to every Unix socketLet sandboxed commands connect to every Unix socket. On Linux and WSL2, the sandbox's seccomp filter blocks socket(AF_UNIX, ...) calls, so this is the only way to permit Unix sockets there. When the filter is missing, which /sandbox reports on its Dependencies tab, the sandbox doesn't block Unix-socket calls. See Set up Linux and WSL2 for where the filter comes from.
falsetrue sandboxed commands can connect to every Unix socketfalse the sandbox blocks Unix-socket connections: on macOS except the paths in allowUnixSockets, and on Linux and WSL2 through the seccomp filter when it's present{ "sandbox": { "network": { "allowAllUnixSockets": true } } }
sandbox.network.allowLocalBindingLet sandboxed commands listen on network ports and connect to localhost on macOSLet sandboxed commands on macOS listen on network ports, for example to start a dev server, and connect to any port on localhost. A command that listens on a non-loopback address accepts connections from other machines. The key has no effect on Linux and WSL2, where each sandboxed command has its own loopback interface. To reach a server on the host from Linux or WSL2, see A command fails to reach a server on localhost.
falsetrue sandboxed commands on macOS can listen on any local address and connect to any port on localhostfalse sandboxed commands on macOS can't listen on a port or connect directly to servers on localhost{ "sandbox": { "network": { "allowLocalBinding": true } } }
sandbox.network.allowMachLookupLet macOS sandboxed tools like the iOS Simulator or Playwright reach their XPC servicesList additional XPC and Mach service names the macOS sandbox may look up. Tools that communicate over XPC, such as the iOS Simulator or Playwright, need their services listed here.
* matches a prefix, and "*" alone matches every service{ "sandbox": { "network": { "allowMachLookup": ["com.apple.coresimulator.*"] } } }
sandbox.network.allowedDomainsPre-allow domains so sandboxed commands don't prompt for themPre-allow domains for outbound traffic from sandboxed commands, so the sandbox doesn't prompt for them. Wildcards such as *.example.com match subdomains, and an optional :port suffix limits an entry to one port; an entry without a port matches every port.
:port suffix{ "sandbox": { "network": { "allowedDomains": ["github.com", "*.npmjs.org", "api.example.com:443"] } } }
sandbox.network.deniedDomainsBlock domains for sandboxed commands, even inside an allowed wildcardBlock domains for outbound traffic from sandboxed commands, using the same wildcard, port, and IPv6 syntax as allowedDomains. A denied domain stays blocked even when an allowedDomains entry matches it too.
:port suffix{ "sandbox": { "network": { "deniedDomains": ["sensitive.cloud.example.com"] } } }
sandbox.network.strictAllowlistDeny hosts outside the allowlist instead of promptingDeny sandboxed commands access to hosts outside the allowlist instead of prompting for approval. The allowlist is allowedDomains plus domains from WebFetch(domain:...) allow rules, or only the managed settings entries when allowManagedDomainsOnly is set. Locks that apply without an admin-required sandbox covers a repository's entries. Requires Claude Code v2.1.219 or later.
falsetrue Claude Code denies sandboxed commands access to hosts outside the allowlistfalse unless another trusted settings file sets true, Claude Code decides a host outside the allowlist by permission mode instead of denying it outright: in auto mode it checks the host against the command's per-command allowed domains, in dontAsk mode it denies, in bypassPermissions mode and in interactive terminal plan-mode sessions where bypass is available it allows, and otherwise it asks you{ "sandbox": { "network": { "strictAllowlist": true } } }
sandbox.network.allowManagedDomainsOnlyLock the network allowlist to managed settingsLock the network allowlist to what managed settings define. Claude Code then honors only allowedDomains and WebFetch(domain:...) allow rules from managed settings, ignores domains from user, project, local, and --settings settings, and blocks a non-allowed domain automatically instead of prompting.
falsetrue Claude Code honors only allowedDomains and WebFetch(domain:...) allow rules from managed settings and blocks a non-allowed domain instead of promptingfalse domains from other settings files can merge into the allowlist{ "sandbox": { "network": { "allowManagedDomainsOnly": true, "allowedDomains": ["github.com", "*.npmjs.org"] } } }
sandbox.network.httpProxyPortRoute sandbox HTTP traffic through your own proxyPoint the sandbox at your own HTTP proxy instead of the one Claude Code runs. Organizations do this to inspect HTTPS traffic, apply their own filtering rules, or log requests. Your proxy takes over filtering, and Claude Code stops applying its domain lists and network prompts to traffic sent there. When unset, Claude Code starts its own proxy for HTTP traffic.
{ "sandbox": { "network": { "httpProxyPort": 8080 } } }
sandbox.network.socksProxyPortRoute sandbox SOCKS traffic through your own proxyPoint the sandbox at your own SOCKS5 proxy instead of the one Claude Code runs. Your proxy takes over filtering, and Claude Code stops applying its domain lists and network prompts to traffic sent there. When unset, Claude Code starts its own proxy for SOCKS traffic.
{ "sandbox": { "network": { "socksProxyPort": 8081 } } }
sandbox.network.tlsTerminateHave the sandbox proxy terminate TLS so it can read HTTPS requestsMake the sandbox proxy terminate TLS so it can read the contents of HTTPS requests. This is experimental, and mask credential substitution requires it. Set {} to generate an ephemeral certificate authority for the session, or set caCertPath and caKeyPath to use your own.
caCertPath and caKeyPath strings, each a file path{ "sandbox": { "network": { "tlsTerminate": {} } } }
autoCompactEnabledTurn automatic compaction off or onHave Claude Code compact the conversation automatically when context approaches the limit. Appears in /config as Auto-compact, and toggling it there writes this key to your user settings.
truetrue Claude Code compacts the conversation automatically when context approaches the limitfalse Claude Code doesn't compact automatically{ "autoCompactEnabled": false }
autoCompactWindowSet how full the context gets before Claude Code compactsSet how full the context window gets before Claude Code compacts automatically.
100000 to 1000000. Claude Code caps the value at your model's context window; the models overview lists each model's window{ "autoCompactWindow": 500000 }
autoMemoryDirectoryStore auto memory in a directory you chooseStore auto memory in a directory of your choice instead of the per-project default.
~/-prefixed directory path~/.claude/projects/<project>/memory/{ "autoMemoryDirectory": "~/my-memory-dir" }
autoMemoryEnabledTurn auto memory off or onTurn auto memory on or off. When false, Claude doesn't read from or write to the auto memory directory. You can also toggle it with /memory during a session, which writes this key to your user settings.
truetrue the same as unset; auto memory stays on unless something that outranks this key turns it off for the session, such as --bare, safe mode, or CLAUDE_CODE_DISABLE_AUTO_MEMORYfalse Claude doesn't read from or write to the auto memory directory{ "autoMemoryEnabled": false }
bashOutputMaxCharsSet how much of a successful command's output Claude receives inlineSet how many characters of a successful Bash or PowerShell command's output Claude receives inline. When output passes the limit, Claude Code saves it to a file and Claude receives a short preview plus the file's path. Raise the limit when command output, such as a verbose build or a full test-suite log, routinely overflows the default and you want Claude to read it without opening the file. Requires Claude Code v2.1.261 or later.
4000 to 128000{ "bashOutputMaxChars": 100000 }
claudeMdInject organization-wide CLAUDE.md instructions from managed settingsInject CLAUDE.md-style instructions as organization-managed memory without deploying a separate file. Claude Code loads the text as a managed memory entry ahead of user and project CLAUDE.md files.
\n{ "claudeMd": "# Engineering rules\n\n- Always run make lint before committing.\n- Never push directly to main." }
claudeMdExcludesSkip specific CLAUDE.md files when memory loadsSkip specific CLAUDE.md files when Claude Code loads memory. In a large monorepo, use it to skip CLAUDE.md files from other teams that aren't relevant to your work; Exclude irrelevant CLAUDE.md files in the large-codebases guide walks through that case. Patterns match against absolute file paths.
{ "claudeMdExcludes": ["**/vendor/**/CLAUDE.md"] }
envSet environment variables for every session and its subprocessesSet environment variables for every session and for the subprocesses Claude Code starts from it. Most variables in the environment variables reference can go here, which is how you apply one to every session or roll it out to your team. Project and local settings can't set some of them.
{ "env": { "DISABLE_AUTO_COMPACT": "1", "ANTHROPIC_BASE_URL": "https://proxy.example.com" } }
fileCheckpointingEnabledTurn off or on the file snapshots that /rewind restoresHave Claude Code snapshot files before each edit so /rewind can restore them. Appears in /config as Rewind code (checkpoints), and toggling it there writes this key to your user settings.
truetrue Claude Code snapshots files before each edit so /rewind can restore themfalse Claude Code doesn't snapshot files, so /rewind can't restore them{ "fileCheckpointingEnabled": false }
plansDirectoryChoose where plan mode writes plan filesChoose where Claude Code stores the plan files it writes in plan mode. Claude Code resolves the path relative to the project root and keeps the default when the path resolves outside it.
~/.claude/plans{ "plansDirectory": "./plans" }
skillListingBudgetFractionReserve more or less context for the skill listingEach turn, Claude sees a listing of your skills with their descriptions, and Claude Code caps that listing at a share of the context window. When the listing is over the cap, Claude Code keeps every skill's name but drops the descriptions of the least-used skills, so Claude can still invoke those skills but is less likely to choose one on its own. Raise this key to keep more descriptions visible at the cost of more context per turn.
0 and at most 10.01, which reserves 1% of the context window{ "skillListingBudgetFraction": 0.02 }
skillListingMaxDescCharsCap each skill's description length in the skill listingEach turn, Claude sees a listing of your skills that shows each skill's description and when_to_use text. This key caps how many characters of that text Claude Code shows per skill; longer text is cut at the cap.
1536{ "skillListingMaxDescChars": 2048 }
taskOutputMaxCharsRemoved in v2.1.277, together with the TaskOutput tool it sizedThrough v2.1.276, you set this key to the number of characters of a background task's output that Claude received inline when it read the task with the TaskOutput tool.
askUserQuestionTimeoutLet an unanswered question auto-continue after idle timeLet an unanswered AskUserQuestion dialog auto-continue after a period of idle time, submitting whatever options you had already selected. Set it when you step away and want Claude to continue without you. With the default, questions wait until you answer them. For when the timer pauses or never starts, see Question auto-continue timeout. Requires Claude Code v2.1.200 or later.
"60s", "5m", "10m", or "never""never"{ "askUserQuestionTimeout": "5m" }
autoContinueAtUsageLimitWait in the open session and continue the task automatically after a claude.ai usage limit resetsAfter a claude.ai usage limit stops your session, wait in the open session and continue the task automatically after the reset. See Turn automatic continue off. Requires Claude Code v2.1.234 or later.
truetrue after a claude.ai usage limit stops your session, Claude Code waits in the open session and continues the task automatically after the resetfalse Claude Code doesn't start the wait on its own. You can still start a wait yourself from the usage-limit options menu{ "autoContinueAtUsageLimit": false }
autoScrollEnabledFollow new output to the bottom in fullscreen renderingFollow new output to the bottom of the conversation in fullscreen rendering. Turn it off to stay where you scrolled while Claude keeps working; permission prompts still scroll into view.
truetrue the conversation follows new output to the bottomfalse you stay where you scrolled while Claude keeps working; permission prompts still appear below the transcript{ "autoScrollEnabled": false }
axScreenReaderRender screen-reader friendly outputRender screen-reader friendly output: flat text without decorative borders or animations. Screen-reader mode uses the classic renderer, so the tui setting has no effect while it is active; attached background sessions still render fullscreen.
true Claude Code renders flat text without decorative borders or animations, using the classic rendererfalse Claude Code renders normally{ "axScreenReader": true }
bashEditDiffEnabledRecord the files that changed while a Bash command ran in every permission modeChoose whether Claude Code records which files changed in a Git repository while a Bash command runs. When it records them, you see their diff in the terminal after the command, and your PostToolUse Bash hooks receive the changed-file list.
bypassPermissions mode when it directs Claude to edit files through Bash{ "bashEditDiffEnabled": true }
companyAnnouncementsShow your organization's announcements at startupShow your organization's announcements to users at startup. When you list more than one, Claude Code picks one at random for each session; on a person's very first launch it shows the first entry.
{ "companyAnnouncements": [ "Welcome to Acme Corp! Review our code guidelines at docs.example.com" ] }
defaultShellChoose whether Bash or PowerShell runs the shell commands you type with the ! prefixChoose whether Bash or PowerShell runs the shell commands you type with the ! prefix in the input box, the ones Claude Code runs directly and adds to the session.
"bash", or "powershell" on Windows when Bash isn't available"bash" Claude Code runs your ! commands in Bash"powershell" Claude Code runs your ! commands in PowerShell{ "defaultShell": "powershell" }
dialogExpirySet how long Claude Code waits for Remote Control or an SDK host to answer a forwarded dialog before it cancels the dialogSet the deadline for dialogs Claude Code forwards to a remote client, such as a Remote Control or SDK host, and for the approval dialog for a held cross-session message. On Claude Code v2.1.236 or later, the same deadline bounds the mid-session Fable usage-credits consent prompt in a session that may have nobody at the terminal. When no answer arrives before the deadline, Claude Code cancels the dialog and continues with its no-action default. Requires Claude Code v2.1.224 or later.
"60s", "5m", "10m", or "never", which disables the deadline"5m"{ "dialogExpiry": "10m" }
editorModeUse vim key bindings in the input promptChoose the key binding mode for the input prompt.
"normal""normal" standard key bindings in the prompt input"vim" vim-style editing with NORMAL, INSERT, and VISUAL modes{ "editorMode": "vim" }
emojiCompletionEnabledTurn off :shortcode: emoji suggestions and replacement in the prompt inputShow emoji suggestions when you type : plus a shortcode in the prompt input, and replace a completed shortcode such as :heart: with its emoji. Set it to false to turn off both.
truetrue Claude Code shows emoji suggestions after : and replaces a completed shortcode with its emojifalse Claude Code neither suggests emoji nor replaces shortcodes{ "emojiCompletionEnabled": false }
fileSuggestionSupply @ file autocomplete from your own commandRun your own command to supply @ file path autocomplete instead of the built-in file suggestion. The built-in suggestion uses fast filesystem traversal; a large monorepo may do better with project-specific indexing such as a pre-built file index.
type, always "command", and command, the shell command to run{ "fileSuggestion": { "type": "command", "command": "~/.claude/file-suggestion.sh" } }
keybindingFlavorDeprecated and has no effect; the word-editing shortcuts always follow readline conventionsIn v2.1.238 through v2.1.260, setting it to "readline" made Ctrl+W delete back to the previous whitespace instead of only the previous word.
"classic" or "readline"maxProseWidthCap how wide the prose in Claude's responses runs in a wide terminalCap the width of the prose in Claude's responses so lines stay readable in a wide terminal. Paragraphs, headings, lists, and blockquotes wrap within this many columns, while tables and code blocks keep the full terminal width. Requires Claude Code v2.1.282 or later.
40. Claude Code ignores any other value{ "maxProseWidth": 80 }
prefersReducedMotionReduce or turn off spinner, shimmer, and flash animationsReduce or turn off interface animations such as the spinner, shimmer, and flash effects. Appears in /config as Reduce motion.
falsetrue Claude Code reduces or turns off interface animations such as the spinner, shimmer, and flash effectsfalse the same as unset; Claude Code shows its animations{ "prefersReducedMotion": true }
promptSuggestionEnabledHide the grayed-out prompt suggestions in the input boxShow or hide prompt suggestions, the grayed-out predictions that appear in your prompt input. Set it to false, or turn off Prompt suggestions in /config, to hide them.
truetrue you see prompt suggestions in your prompt inputfalse Claude Code hides prompt suggestions{ "promptSuggestionEnabled": false }
respectGitignoreKeep gitignored files out of the @ file pickerControl whether the @ file picker leaves out files that match .gitignore patterns. Appears in /config as Respect .gitignore in file picker.
truetrue the @ file picker leaves out files that match .gitignore patternsfalse the @ file picker includes files that match .gitignore patterns{ "respectGitignore": false }
respondToBashCommandsStop Claude from responding after a ! shell command runsChoose whether Claude responds after you run a shell command with the ! prefix in the input box. By default, Claude Code adds the command's output to the conversation and Claude replies to it. Set this key to false to add the output to context without a reply, so you can run several commands and ask about them together.
truetrue Claude Code adds the command's output to the conversation and Claude replies to itfalse Claude Code adds the output to context without a reply{ "respondToBashCommands": false }
showClearContextOnPlanAcceptShow a "clear context" option on the plan accept screenWhen Claude finishes a plan in plan mode, it shows an approval menu. Planning can use a lot of context, so this key adds a first option to that menu, Yes, clear context and …, that approves the plan, clears the conversation context, and starts implementing from the plan alone. The rest of the label names the permission mode the session continues in, and shows how much of your context the planning used.
falsetrue the plan approval menu gets a first option, Yes, clear context and …, that approves the plan and clears the conversation contextfalse the plan approval menu shows no clear-context option{ "showClearContextOnPlanAccept": true }
showTurnDurationHide the "Cooked for" duration after each responseShow or hide the turn duration message after each response, such as "Cooked for 1m 6s · done 6:05 PM". The clock after "done" shows when the turn finished; timeFormat and timeZone control its format and zone. Appears in /config as Show turn duration.
truetrue you see the turn duration message after each responsefalse Claude Code hides the turn duration message{ "showTurnDuration": false }
spellcheckUnderline misspelled words in the prompt input with a spell checker you installUnderline misspelled words in the prompt input as you type, using a spell checker you install. Claude Code checks only the text in the input box. Check spelling as you type covers installing aspell, hunspell, or ispell and what the checker covers. Requires Claude Code v2.1.235 or later.
enabled (Boolean), checker ("aspell", "hunspell", "ispell", or "auto"), language (string, passed to the checker as its dictionary name), and color (string, a terminal color name, #rrggbb, rgb(r,g,b), ansi256(n), or ansi:<name>)checker defaults to "auto", the first of the three found on PATH; language defaults to the checker's own dictionary; color defaults to the theme's error color{ "spellcheck": { "enabled": true, "language": "en_GB" } }
spinnerTipsEnabledHide tips in the spinner while Claude worksWhile Claude works, the spinner line rotates through short tips about Claude Code features, such as "Use Plan Mode to prepare for a complex request before making changes. Press Shift+Tab twice to enable." Set this key to false to hide them. Appears in /config as Show tips.
truetrue you see tips in the spinner while Claude is workingfalse Claude Code hides spinner tips{ "spinnerTipsEnabled": false }
spinnerTipsOverrideAdd your own tips to the spinner rotation, or replace the built-in tipsAdd your own tips to the spinner tips that Claude Code shows while Claude works, or replace the built-in tips with yours. Claude Code puts your tips in the same rotation as the built-in ones.
tips, tipsFile, label, and excludeDefault fields, each optional{ "spinnerTipsOverride": { "label": "Acme tip", "tips": [ "Run /review before opening a PR", { "id": "gateway-errors", "text": "Seeing 5xx errors? Check the gateway status page first", "cooldownSessions": 5, "priority": 2 } ] } }
spinnerVerbsAdd or replace the verbs shown while a turn runsWhile a turn is in progress, the spinner shows a rotating verb such as "Accomplishing", "Architecting", or "Baking". Use this key to add your own verbs to that rotation or replace the built-in list with yours.
verbs array of strings and mode, one of:"append" Claude Code adds your verbs to the built-in set"replace" Claude Code shows only your verbs{ "spinnerVerbs": { "mode": "append", "verbs": ["Pondering", "Crafting"] } }
statusLineRun your own command to render a status line below the promptRun your own command to render a status line below the prompt with context such as the model, cost, or git branch. Optional fields adjust spacing, add periodic re-runs, and hide the built-in vim mode indicator when your script renders vim.mode itself.
type set to "command" and a command string, plus optional padding as a number of characters, refreshInterval as a number of seconds, minimum 1, and hideVimModeIndicator as a Boolean{ "statusLine": { "type": "command", "command": "jq -r '\"[\\(.model.display_name)] \\(.context_window.used_percentage // 0)% context\"'", "padding": 2 } }
subagentStatusLineRewrite rows in the subagent task display with your own commandWhen Claude runs subagents, Claude Code lists them in a task display below the prompt, one row per subagent showing name · description · token count. This key lets you run your own command to rewrite those rows, for example to show each subagent's context usage as a percentage. On each refresh, Claude Code sends the visible rows as one JSON object on stdin, with a tasks array carrying each subagent's id, name, status, model, tokenCount, and more, and replaces the row for each id you write back as a {"id", "content"} line. Rows you don't write back keep the default rendering.
type set to "command" and a command string{ "subagentStatusLine": { "type": "command", "command": "jq -c '.tasks[] | {id, content: \"\\(.name): \\(.tokenCount) tokens\"}'" } }
syntaxHighlightingDisabledTurn off syntax highlighting in diffs and code blocksClaude Code colors code by language in the diffs, code blocks, and file previews it shows in the terminal, with its built-in highlighter; no plugin or language server is involved. Set this key to true to show them as plain text instead, for example if the colors clash with your terminal theme or slow a screen reader.
falsetrue Claude Code turns off syntax highlighting in diffs, code blocks, and file previewsfalse Claude Code highlights syntax{ "syntaxHighlightingDisabled": true }
terminalProgressBarEnabledHide the terminal progress bar in terminals that support itSome terminals can show a progress indicator on the tab or in the taskbar for the program running in them. While Claude is working, Claude Code reports an in-progress state to the terminal, so you can see from another tab or window whether the session is still busy. The indicator stays visible after the turn ends while background subagents or dynamic workflows are still running, and clears once the session is idle.
truetrue you see the terminal progress bar in terminals that support itfalse Claude Code hides the terminal progress bar{ "terminalProgressBarEnabled": false }
terminalTitleFromRenameStop /rename and --name from changing the terminal tab titleClaude Code sets your terminal tab's title. By default it uses a title it generates from the conversation, and once you give the session a name with /rename or --name, the tab shows that name instead. Set this key to false to keep the generated title on the tab even after you name the session. The name itself still applies, so /resume <name> and the session picker find it.
truetrue the terminal tab title shows the session name you setfalse the tab keeps the title Claude Code generates from your conversation{ "terminalTitleFromRename": false }
themePick the interface color theme, built-in or customPick the color theme for the interface. Appears in /config as Theme.
"dark""auto" matches your terminal's light or dark background"dark" the dark theme"light" the light theme"dark-daltonized" the dark theme with colorblind-friendly colors"light-daltonized" the light theme with colorblind-friendly colors"dark-ansi" the dark theme using only your terminal's ANSI color palette"light-ansi" the light theme using only your terminal's ANSI color palette{ "theme": "light-daltonized" }
timeFormatShow the times in the interface on a 12-hour or 24-hour clock, in UTC, or with a strftime patternChoose how Claude Code writes the times it shows in the interface, such as the done 6:05 PM at the end of each turn duration message and the timestamps in the transcript viewer. To pick a preset, run /config and set Time format. Requires Claude Code v2.1.257 or later.
"auto""auto" the same as unset; each time keeps its built-in format, which follows your locale on the turn duration message"12-hour" a 12-hour clock"24-hour" a 24-hour clock"24-hour-utc" a 24-hour clock in UTC with Z after the minutes, such as 18:05Z; Claude Code ignores timeZone for this preset{ "timeFormat": "24-hour" }
timeZoneShow the times in the interface in a time zone other than your system'sShow the times in the interface in a time zone other than your system's. Set it to an IANA time zone name, such as "UTC" or "Europe/Dublin". The times that timeFormat controls then show in this zone. If timeFormat is "24-hour-utc", times stay in UTC and Claude Code ignores this key. /config has no row for this key, so set it in a settings file. Requires Claude Code v2.1.257 or later.
{ "timeZone": "Europe/Dublin" }
tuiChoose the fullscreen or classic terminal rendererChoose the terminal UI renderer. Use "fullscreen" for the flicker-free alt-screen renderer with virtualized scrollback, or "default" for the classic main-screen renderer. Running /tui fullscreen or /tui default writes this key for you.
"default" the classic main-screen renderer"fullscreen" the flicker-free alt-screen renderer with virtualized scrollback{ "tui": "fullscreen" }
verboseShow full tool output instead of truncated summaries; viewMode takes precedence when both are setBy default, the transcript collapses each tool call to a short summary, such as the command Claude ran and a line count of its output, and you press Ctrl+O to switch the whole transcript to the expanded view when you want the details. Set this key to true to show every tool call's full input and output inline as it happens, which is useful when you're debugging a hook, an MCP server, or a long shell command. Appears in /config as Verbose output.
falsetrue you see full tool outputfalse you see truncated summaries of tool output{ "verbose": true }
viewModeStart every session in default, verbose, or focus viewSet the transcript view Claude Code starts in: "default", "verbose", or "focus". When set, it overrides both the sticky /focus selection and the verbose setting.
verbose setting and your last /focus choice apply"default" the normal transcript with truncated tool output"verbose" the transcript with full tool output"focus" only your last prompt, a one-line summary of tool calls with edit diffstats, and the final response. Focus view needs the fullscreen renderer{ "viewMode": "focus" }
vimInsertModeRemapsMap a two-key INSERT-mode sequence such as jj to EscapeMap two-key INSERT-mode sequences to Escape in vim editor mode. Each key is exactly two printable characters typed in sequence, and "<Esc>" is the only supported target; Claude Code ignores other entries. Requires Claude Code v2.1.208 or later.
"<Esc>"{ "vimInsertModeRemaps": { "jj": "<Esc>" } }
voiceTurn on voice dictation and pick hold or tap modeTurn on voice dictation and choose how the dictation key behaves. Claude Code writes this object for you when you run /voice.
enabled as a Boolean, autoSubmit as a Boolean that applies in hold mode only, and mode, one of:enabled is true and mode is unset, Claude Code uses "hold""hold" you hold the dictation key while speaking and release it to stop"tap" you tap the key once to start recording and again to send{ "voice": { "enabled": true, "mode": "tap" } }
voiceEnabledTurn on voice dictation with the older single-key formTurn voice dictation on with the single Boolean form that predates the voice object. When both are set, voice.enabled applies.
true voice dictation is on when you're logged in with a claude.ai account and your organization's policy allows voice, unless voice.enabled is setfalse voice dictation is off, unless voice.enabled is set{ "voiceEnabled": true }
wheelScrollAccelerationEnabledTurn off mouse-wheel acceleration in fullscreen renderingAccelerate mouse-wheel scroll speed during fast scrolls in fullscreen rendering. Set it to false for a constant scroll rate per wheel notch.
truetrue Claude Code accelerates mouse-wheel scroll speed during fast scrollsfalse Claude Code scrolls at a constant rate per wheel notch{ "wheelScrollAccelerationEnabled": false }
attributionCustomize the attribution Claude Code adds to commits and pull requestsCustomize the attribution Claude Code adds to git commits and pull requests. Commits get a git trailer such as Co-Authored-By by default; pull request descriptions get plain text. Set each part separately with the sub-keys below.
commit and pr strings and a sessionUrl Boolean, or false to hide all attribution. The false value requires Claude Code v2.1.281 or later; earlier versions reject it and skip the whole user, project, or local settings file that holds it{ "attribution": { "commit": "Generated with AI\n\nCo-Authored-By: AI <ai@example.com>", "pr": "", "sessionUrl": false } }
includeCoAuthoredByDeprecated; use attribution to hide or change commit and PR attributionUse attribution instead, which replaces this key and lets you change or hide the commit trailer, the pull request text, and the session link separately. Claude Code still honors includeCoAuthoredBy: false from settings files that predate attribution, but ignores it once you set attribution.commit or attribution.pr.
truetrue the same as unset; Claude Code adds the commit trailer and the pull request attribution textfalse Claude Code omits both the commit trailer and the pull request attribution text, unless attribution sets commit or pr, in which case the attribution rules apply{ "includeCoAuthoredBy": false }
includeGitInstructionsRemove the built-in commit and PR instructions from Claude's contextClaude Code gives Claude two git-related pieces of context: its built-in instructions for how to write commits and pull requests, in the Bash tool's description, and a git status snapshot of your repository. The snapshot holds the current branch, the main branch, git status output, and recent commits. Claude Code reads it when a conversation starts.
truetrue Claude Code includes its built-in commit and pull request workflow instructions and the git status snapshot. Cloud sessions never include the snapshotfalse Claude Code leaves both out{ "includeGitInstructions": false }
prUrlTemplatePoint PR links at an internal code-review tool instead of github.comPoint the PR links Claude Code renders, in the footer badge and in tool-result summaries, at an internal code-review tool instead of github.com. Claude Code substitutes {host}, {owner}, {repo}, {number}, and {url} from the PR URL. GitLab merge request links on both surfaces keep their GitLab URL.
{ "prUrlTemplate": "https://reviews.example.com/{owner}/{repo}/pull/{number}" }
attribution.commitChange or hide the trailer Claude Code adds to commitsSet the attribution text Claude Code adds to git commits, including any trailers. Set it to an empty string to hide commit attribution.
Co-Authored-By: <name> <noreply@anthropic.com>. The name is the model in use when the commit is made, such as Claude Sonnet 5. When a subagent makes the commit, the trailer names the subagent's model.{ "attribution": { "commit": "Generated with AI\n\nCo-Authored-By: AI <ai@example.com>" } }
attribution.prChange or hide the attribution line in pull request descriptionsSet the attribution text Claude Code adds to pull request descriptions. Set it to an empty string to hide pull request attribution.
🤖 Generated with Claude Code{ "attribution": { "pr": "" } }
attribution.sessionUrlOmit the claude.ai session link from cloud and Remote Control commitsChoose whether Claude Code appends the claude.ai session link when it commits or opens a pull request from a cloud or Remote Control session. Claude Code adds the link as a Claude-Session trailer on commits and as a link in pull request descriptions. Set it to false to omit the link.
truetrue Claude Code appends the claude.ai session link when it commits or opens a pull request from a cloud or Remote Control sessionfalse Claude Code omits the link{ "attribution": { "sessionUrl": false } }
allowedHttpHookUrlsLimit which URLs HTTP hooks can targetLimit which URLs HTTP hooks can target. When you define this key, Claude Code runs an HTTP hook only if its URL matches one of the patterns and blocks the rest without running them; an empty array blocks every HTTP hook.
* as a wildcard{ "allowedHttpHookUrls": ["https://hooks.example.com/*", "http://localhost:*"] }
allowManagedHooksOnlyRun only the hooks your organization deploysRestrict hook execution to hooks your organization deploys.
true only managed hooks run, plus Agent SDK hooks and hooks from plugins your managed settings force-enable. See What runs under allowManagedHooksOnlyfalse hooks from every settings scope and plugin run{ "allowManagedHooksOnly": true }
disableAllHooksTurn off hooks, a custom status line, and a custom @ file suggestion command at onceTurn off hooks, any custom status line, and any custom file suggestion command. Use it to turn all of these off temporarily without deleting them from your settings.
true Claude Code turns off hooks, any custom status line, and any custom file suggestion commandfalse hooks, the status line, and the file suggestion command run{ "disableAllHooks": true }
disableWorkflowsTurn dynamic workflows off for everyone; use enableWorkflows for yourselfTurn off dynamic workflows and the bundled workflow commands for everyone your settings reach, such as an organization through managed settings. To turn workflows on or off just for yourself, use enableWorkflows instead, which the Dynamic workflows toggle in /config writes to your user settings.
falsetrue Claude Code turns off dynamic workflows and the bundled workflow commands for everyone your settings reachfalse the same as unset; whether workflows are on then follows enableWorkflows and your plan's default{ "disableWorkflows": true }
enableWorkflowsTurn dynamic workflows on or off against your plan's defaultTurn dynamic workflows on or off for yourself when your plan's default isn't what you want. Appears in /config as Dynamic workflows, which writes this key to your user settings and removes it again when you toggle back to your plan's default. To turn workflows off for everyone from managed settings, use disableWorkflows instead.
true Claude Code turns dynamic workflows on for youfalse Claude Code turns dynamic workflows off for you{ "enableWorkflows": true }
hooksRun your own commands as hooks at points in Claude Code's lifecycleRun your own commands, prompts, agents, HTTP requests, or MCP tools as hooks at points in Claude Code's lifecycle, such as before a tool call or when a session starts; the hooks reference lists every event, its payload, and its exit codes. Each event maps to a list of matcher groups, and each group lists the handlers to run when the matcher applies.
{ "matcher", "hooks" } groups whose hooks entries have a type of "command", "prompt", "agent", "http", or "mcp_tool"{ "hooks": { "PreToolUse": [ { "matcher": "Bash", "hooks": [ { "type": "command", "command": "~/.claude/hooks/check-bash.sh" } ] } ] } }
httpHookAllowedEnvVarsLimit which env vars HTTP hooks can put in headersAn HTTP hook can put the value of an environment variable into a request header, for example an Authorization: Bearer $HOOK_TOKEN header, but only for variables the hook lists in its own allowedEnvVars. This key sets an outer limit on that list for every HTTP hook: a hook can use a variable only if both its own allowedEnvVars and this key name it. Use it to stop a hook from reading a secret it shouldn't, even when the hook's definition asks for it.
allowedEnvVars list applies{ "httpHookAllowedEnvVars": ["MY_TOKEN", "HOOK_SECRET"] }
workflowKeywordTriggerEnabledLet the word ultracode in a prompt start a workflow; set false to type it without starting oneChoose whether typing the keyword ultracode in a prompt triggers a dynamic workflow. Set it to false to type the word without triggering one.
truetrue typing ultracode in a prompt triggers a dynamic workflowfalse you can type the word without triggering one{ "workflowKeywordTriggerEnabled": false }
workflowSizeGuidelineSet the agent count Claude aims for in dynamic workflowsSet the agent count Claude aims for in the dynamic workflows it writes. Claude Code sends the value to Claude as advice, not an enforced cap: "small" asks for fewer than 5 agents, "medium" fewer than 10, and "large" fewer than 50. Choose "small" when you want to bound what a workflow spends. Requires Claude Code v2.1.219 or later.
"medium", or "small" when you're signed in on a Pro plan with Claude Code v2.1.271 or later"unrestricted" no guideline, so Claude sizes the workflow to the task"small" Claude aims for fewer than 5 agents"medium" Claude aims for fewer than 10 agents"large" Claude aims for fewer than 50 agents{ "workflowSizeGuideline": "small" }
disableBundledSkillsTurn off the skills and workflows included with Claude CodeTurn off the skills and workflows included with Claude Code. Claude Code removes bundled skills and workflows entirely, while built-in commands such as /init stay typable but are hidden from the model.
true Claude Code removes bundled skills and workflows and hides built-in commands such as /init from the modelfalse bundled skills load{ "disableBundledSkills": true }
disableSkillShellExecutionStop skills and custom commands from running inline shellTurn off inline shell execution for ` !... and ``! blocks in skills and custom commands from user, project, plugin, or additional-directory sources. Claude Code replaces each command with [shell command execution disabled by policy] instead of running it.`
true Claude Code replaces each inline shell command with [shell command execution disabled by policy] instead of running itfalse inline shell runs{ "disableSkillShellExecution": true }
skillOverridesHide or collapse a skill without editing its SKILL.mdHide or collapse a skill without editing its SKILL.md. Claude Code applies the value under each skill's name to the skill list Claude sees and to your / autocomplete.
"on""on" Claude sees the skill and you can type /name"name-only" Claude sees the skill by name without its description"user-invocable-only" Claude doesn't see the skill, but you can still type /name"off" Claude doesn't see the skill and /name is hidden from autocomplete{ "skillOverrides": { "legacy-context": "name-only", "deploy": "off" } }
syncClaudeAiSkillsStop loading the skills enabled on your claude.ai account and stop downloading new onesTurn off the download of the skills enabled for your claude.ai account. Claude Code downloads them into ~/.claude/skills/synced/ in terminal sessions where you sign in with your claude.ai account, interactive or non-interactive, and in Cowork and cloud sessions. Set false to stop that download and stop loading the skills it already synced. Claude Code honors only false: true is the same as unset and doesn't turn syncing on where it's otherwise off.
false Claude Code stops downloading synced skills and stops loading the ones already in ~/.claude/skills/synced/. In user or managed settings, it also moves them to ~/.claude/skills/.trash/true the same as unset{ "syncClaudeAiSkills": false }
syncClaudeAiPluginsStop loading the plugins enabled on your claude.ai account and stop downloading new onesTurn off the download of the plugins enabled for your claude.ai account. Claude Code downloads them into ~/.claude/plugins/synced/ at the start of terminal sessions where you sign in with your claude.ai account and in Cowork sessions, and loads each one as <name>@synced. Set false to stop that download and stop loading the plugins it already synced. Claude Code honors only false: true is the same as unset and doesn't turn syncing on where it's otherwise off. Requires Claude Code v2.1.273 or later.
false Claude Code stops downloading synced plugins and stops loading the ones already in ~/.claude/plugins/synced/. In user or managed settings, it also moves them to ~/.claude/plugins/.trash/true the same as unset{ "syncClaudeAiPlugins": false }
allowedChannelPluginsReplace the default allowlist of channel plugins that can push messagesChoose which channel plugins can push messages into sessions in your organization. When you set it, Claude Code uses your list in place of the default Anthropic allowlist; each entry names a plugin and the marketplace it comes from.
marketplace and plugin strings. An entry can instead be a "plugin@marketplace" string such as "telegram@claude-plugins-official", which Claude Code treats as the equivalent object. The string form requires Claude Code v2.1.267 or later; earlier versions reject the whole allowedChannelPlugins value when it contains one{ "channelsEnabled": true, "allowedChannelPlugins": [ { "marketplace": "claude-plugins-official", "plugin": "telegram" } ] }
blockedMarketplacesBlock plugin marketplace sources for your organizationBlock plugin marketplace sources for your organization. Claude Code checks the blocklist on marketplace add and on plugin install, update, refresh, and auto-update, so a marketplace someone added before you set the policy can't be used to fetch plugins either. Blocked sources are checked before download, so they never touch the filesystem.
strictKnownMarketplaces{ "blockedMarketplaces": [ { "source": "github", "repo": "untrusted/plugins" } ] }
channelsEnabledAllow channels for your organizationAllow channels for your organization. On claude.ai Team and Enterprise plans, Claude Code blocks channels until you set this to true. For Anthropic Console accounts that authenticate with an API key, channels are allowed by default. If your organization deploys managed settings, Claude Code blocks channels on those accounts too until you set this key to true.
true Claude Code allows channels for your organizationfalse the same as unset; whether channels are blocked depends on your plan, as the Default says{ "channelsEnabled": true }
disableCommandPluginSourcesBlock plugins that install by running a marketplace-declared commandBlock the command plugin source, which installs a plugin by running a marketplace-declared command on the user's machine. When you set it to true, Claude Code never runs the command, doesn't install or update command-sourced plugins, and stops loading the ones already installed. Set it to false to allow them explicitly. Whenever it blocks command sources, whether you set it to true or leave it unset under allowManagedHooksOnly, it also blocks marketplace headersHelper commands, except for a marketplace that managed settings themselves declare. Requires Claude Code v2.1.229 or later, and the headersHelper block requires v2.1.238 or later.
allowManagedHooksOnly: an organization that restricts hook execution to managed settings gets command sources disabled tootrue Claude Code never runs the marketplace-declared command, doesn't install or update command-sourced plugins, and stops loading the ones already installedfalse Claude Code allows command-sourced plugins explicitly{ "disableCommandPluginSources": true }
pluginSuggestionMarketplacesChoose which marketplaces can surface plugin install suggestions in /pluginName the marketplaces whose plugins can appear as contextual install suggestions, in spinner tips and pinned at the top of the /plugin Discover tab. The built-in first-party frontend-design tip is unaffected. Suggestions come from each plugin's relevance declaration in its marketplace entry.
{ "pluginSuggestionMarketplaces": ["acme-corp-plugins"] }
pluginTrustMessageAdd your own text to the plugin trust warningAdd your organization's own text to the plugin trust warning Claude Code shows before installation, for example to confirm that plugins from your internal marketplace are vetted.
{ "pluginTrustMessage": "All plugins from our marketplace are approved by IT" }
strictKnownMarketplacesAllowlist the marketplace sources users can add and install fromRestrict which plugin marketplace sources people in your organization can add and install plugins from. Claude Code enforces the allowlist on marketplace add and on plugin install, update, refresh, and auto-update, before any network or filesystem operation, so a marketplace someone added before you set the policy can't be used to fetch plugins once its source no longer matches. Blocked users see an error naming the managed policy.
{ "strictKnownMarketplaces": [ { "source": "github", "repo": "acme-corp/approved-plugins" }, { "source": "github", "repo": "acme-corp/security-tools", "ref": "v2.0" }, { "source": "url", "url": "https://plugins.example.com/marketplace.json" } ] }
strictPluginOnlyCustomizationBlock skills, agents, hooks, and MCP servers from user and project sourcesBlock skills, agents, hooks, and MCP servers from user and project sources, so they can come only from plugins or managed settings. Combine it with strictKnownMarketplaces to control the full customization supply chain: the marketplace allowlist controls which plugins users can install.
true to lock all four kinds of customization, or an array naming the kinds to lock, from "skills", "agents", "hooks", and "mcp"{ "strictPluginOnlyCustomization": ["skills", "hooks"] }
strictPluginOnlyCustomization.skillsLock skills to plugin and managed sourcesLock the skills surface. Claude Code stops loading skills from ~/.claude/skills/ and .claude/skills/, custom commands from ~/.claude/commands/ and .claude/commands/, skills and commands under --add-dir directories, and skills synced from your claude.ai account. It keeps loading plugin skills, bundled skills, and skills in the managed policy directory.
"skills" in the strictPluginOnlyCustomization array{ "strictPluginOnlyCustomization": ["skills"] }
strictPluginOnlyCustomization.agentsLock agents to plugin and managed sourcesLock the agents surface. Claude Code stops loading agents from ~/.claude/agents/, .claude/agents/, and --add-dir directories. It keeps loading plugin agents, built-in agents, and agents in the managed policy directory.
"agents" in the strictPluginOnlyCustomization array{ "strictPluginOnlyCustomization": ["agents"] }
strictPluginOnlyCustomization.hooksLock hooks to plugin and managed sourcesLock the hooks surface. Claude Code stops running hooks from user, project, and local settings.json, and keeps running plugin hooks and hooks in managed settings.
"hooks" in the strictPluginOnlyCustomization array{ "strictPluginOnlyCustomization": ["hooks"] }
strictPluginOnlyCustomization.mcpLock MCP servers to plugin and managed sourcesLock the mcp surface. Claude Code stops loading MCP servers from ~/.claude.json and .mcp.json, and keeps loading plugin MCP servers, managed-mcp.json servers, and servers from managedMcpServers.
"mcp" in the strictPluginOnlyCustomization array{ "strictPluginOnlyCustomization": ["mcp"] }
enabledPluginsTurn individual plugins on or off per scopeTurn individual plugins on or off, keyed by plugin-name@marketplace-name. A plugin with no entry at any scope falls back to its defaultEnabled value. When you enable or disable a plugin with /plugin or claude plugin enable, Claude Code writes this key for you.
plugin-name@marketplace-name to a BooleandefaultEnabled value{ "enabledPlugins": { "code-formatter@team-tools": true, "deployment-tools@team-tools": true, "experimental-features@personal": false } }
extraKnownMarketplacesRegister marketplaces for a repository or an organizationRegister additional plugin marketplaces by name, so that people who open the repository, or everyone your managed settings reach, get the marketplace without adding it themselves. Claude Code registers each marketplace it doesn't already know. Whether a plugin that enabledPlugins names from it installs depends on the plugin's source and which file enables it; that entry has the rules.
source object and an optional autoUpdate Boolean{ "extraKnownMarketplaces": { "acme-tools": { "source": { "source": "github", "repo": "acme-corp/claude-plugins" } }, "security-plugins": { "source": { "source": "git", "url": "https://git.example.com/security/plugins.git" } } } }
pluginConfigsStore the answers you gave a plugin's configuration dialogStore the non-sensitive answers you give a plugin's userConfig configuration dialog, keyed by plugin ID. Claude Code writes this key to your user settings when you fill in the dialog, so you don't need to edit it by hand. Claude Code stores sensitive options in the macOS Keychain instead, falling back to ~/.claude/.credentials.json when the Keychain rejects the write; on platforms without a supported keychain, it stores them in ~/.claude/.credentials.json.
options field, mapping each option name to a string, number, Boolean, or array of strings, and an optional mcpServers field holding per-server user configuration values in the same shape{ "pluginConfigs": { "deployer@acme-tools": { "options": { "api_endpoint": "https://api.example.com" } } } }
prependPluginsRun your organization's mods before every mod a user installsList the managed plugins whose mods run before every mod a user installs, in the listed order. When you set this key in managed settings, name sec-default@builtin in the list to keep the built-in guard. In managed settings, Claude Code skips an id whose plugin doesn't count as your organization's. See Install your organization's mods and set the order for those conditions and for how the two ordering keys work together.
plugin-name@marketplace-name strings{ "extraKnownMarketplaces": { "acme-tools": { "source": { "source": "directory", "path": "/opt/acme/claude-plugins" } } }, "enabledPlugins": { "acme-guard@acme-tools": true }, "prependPlugins": ["acme-guard@acme-tools", "sec-default@builtin"] }
appendPluginsRun your organization's mods after every mod a user installsList the managed plugins whose mods run after every mod a user installs, in the listed order. An id listed in both prependPlugins and appendPlugins is prepended. In managed settings, Claude Code skips an id whose plugin doesn't count as your organization's.
plugin-name@marketplace-name strings{ "extraKnownMarketplaces": { "acme-tools": { "source": { "source": "directory", "path": "/opt/acme/claude-plugins" } } }, "enabledPlugins": { "acme-audit@acme-tools": true }, "appendPlugins": ["acme-audit@acme-tools"] }
allowAllClaudeAiMcpsLoad the claude.ai connectors Claude Code fetches itself alongside a deployed managed-mcp.jsonLoad the claude.ai connectors Claude Code fetches itself alongside a deployed managed-mcp.json. Without this key, managed-mcp.json takes exclusive control of MCP servers and suppresses those connectors.
false, so a deployed managed-mcp.json suppresses the claude.ai connectors Claude Code fetches itselftrue Claude Code loads the claude.ai connectors alongside a deployed managed-mcp.jsonfalse a deployed managed-mcp.json takes exclusive control of MCP servers and suppresses the claude.ai connectors Claude Code fetches itself{ "allowAllClaudeAiMcps": true }
allowClaudeInChromeWithManagedMcpLet the built-in Claude in Chrome server run alongside a deployed managed-mcp.jsonLet the built-in Claude in Chrome server run alongside a deployed managed-mcp.json. Without this key, a deployed managed-mcp.json blocks Claude in Chrome in terminal sessions. Requires Claude Code v2.1.282 or later.
false, so a deployed managed-mcp.json blocks Claude in Chrome in terminal sessionstrue the built-in Claude in Chrome server can run alongside a deployed managed-mcp.jsonfalse a deployed managed-mcp.json blocks Claude in Chrome in terminal sessions{ "allowClaudeInChromeWithManagedMcp": true }
allowedMcpServersAllowlist which MCP servers users can addAllowlist the MCP servers people can add. Claude Code blocks any server that doesn't match an entry wherever it's defined, including plugin servers, servers a user passes with --mcp-config, and servers from claude.ai.
serverName, a string limited to letters, numbers, hyphens, and underscores; serverCommand, an array of the command and its arguments matched exactly; or serverUrl, a URL pattern with * wildcards{ "allowedMcpServers": [ { "serverCommand": ["npx", "-y", "@modelcontextprotocol/server-filesystem"] } ] }
allowManagedMcpServersOnlyMake the managed MCP allowlist the only one that appliesMake the managed allowlist the only one that applies. Claude Code then reads allowedMcpServers from managed settings alone and ignores allowlists in user, project, and local settings; deniedMcpServers still merges from every settings scope, so users can still block servers for themselves. Administrators set it so a user's own settings can't broaden what the managed allowlist permits.
false, so allowlists from every settings scope mergetrue Claude Code reads allowedMcpServers from managed settings alone and ignores allowlists in user, project, and local settingsfalse allowlists from every settings scope merge{ "allowManagedMcpServersOnly": true, "allowedMcpServers": [ { "serverName": "github" } ] }
deniedMcpServersBlock specific MCP servers by URL, command, or nameBlock specific MCP servers. Claude Code refuses to load a matching server wherever it's defined, including plugin servers, servers passed with --mcp-config, servers from managed-mcp.json, servers from managedMcpServers, and the claude.ai connectors it fetches itself. In-process type: "sdk" servers are exempt; the app that started the session registers them.
serverName, a string, so a claude.ai connector's display name such as "claude.ai Slack" works; serverCommand, an array of the command and its arguments matched exactly; or serverUrl, a URL pattern with * wildcards{ "deniedMcpServers": [ { "serverName": "filesystem" } ] }
disableClaudeAiConnectorsTurn off claude.ai connectors so Claude Code doesn't fetch themTurn off the claude.ai MCP connectors Claude Code fetches itself, so it neither fetches nor connects them. A true in any settings file applies: a checked-in project .claude/settings.json can opt a repository out of those connectors, but a project-level false can't override a user- or managed-level true.
false, so Claude Code fetches your connectorstrue Claude Code neither fetches nor connects those connectorsfalse the same as unset; Claude Code fetches your connectors unless another settings file or ENABLE_CLAUDEAI_MCP_SERVERS turns them off{ "disableClaudeAiConnectors": true }
disabledMcpjsonServersReject specific servers from a project's .mcp.jsonReject specific servers defined in a project's .mcp.json file so Claude Code never connects them or asks you to approve them. A rejection in any settings file applies, including a project .claude/settings.json checked into the repository.
.mcp.json{ "disabledMcpjsonServers": ["filesystem"] }
enableAllProjectMcpServersApprove every server in project .mcp.json files without a promptApprove every MCP server defined in project .mcp.json files without a prompt. Claude Code writes this key to .claude/settings.local.json when you choose to approve all servers in the approval dialog.
true Claude Code approves every MCP server defined in project .mcp.json files without a promptfalse Claude Code asks you to approve each server. In a trusted folder, a false in a higher-precedence file overrides a true in a lower one; in a folder you haven't trusted, a true in any honored file is enough{ "enableAllProjectMcpServers": true }
enabledMcpjsonServersApprove specific servers from a project's .mcp.jsonApprove specific servers defined in project .mcp.json files so Claude Code connects them without asking. Claude Code writes this key to .claude/settings.local.json when you approve a server in the approval dialog.
.mcp.json{ "enabledMcpjsonServers": ["memory", "github"] }
managedMcpServersProvide remote MCP servers to every user alongside the ones they addProvide remote MCP servers to every user from managed settings. Users keep the servers they add themselves and can't edit or remove the ones you provide. Requires Claude Code v2.1.259 or later.
.mcp.json shape for an http or sse server: a required https:// url, and optionally headers, oauth, and the other HTTP and SSE options. Claude Code drops entries that fail validation, and What an entry can contain lists the conditions{ "managedMcpServers": { "search": { "type": "http", "url": "https://search.example.com/mcp" } } }
agentStart every session as a named subagent with its prompt, tools, and modelRun the main thread as a named subagent, so Claude Code applies that subagent's system prompt, tool restrictions, and model to your session. The same key sets the default agent for sessions you dispatch from claude agents.
{ "agent": "code-reviewer" }
crossSessionInboundChoose whether Claude Code delivers messages from your other sessions, shows a notice without delivering them, or refuses themChoose what this session does with messages arriving from your other Claude Code sessions. When no value applies, Claude Code decides per message from the two sessions' permission-mode classes. Requires Claude Code v2.1.224 or later.
"accept" Claude Code delivers the message to Claude"hold" Claude Code shows a notice for the message without delivering it"refuse" Claude Code drops the message{ "crossSessionInbound": "hold" }
disableAgentViewTurn off background agents and agent viewTurn off background agents and agent view: claude agents, --bg, /background, and the on-demand supervisor. Set it in managed settings to enforce it for an organization.
true Claude Code turns off claude agents, --bg, /background, and the on-demand supervisorfalse agent view is available{ "disableAgentView": true }
isolatePeerMachinesAsk you before Claude messages one of your sessions on another machineRequire your explicit approval before Claude's SendMessage reaches one of your sessions beyond this machine; see Require approval for cross-machine messages. The approval prompt appears even in bypassPermissions mode.
true Claude Code asks for your approval before Claude's SendMessage reaches one of your sessions beyond this machinefalse cross-machine messages don't prompt{ "isolatePeerMachines": true }
processWrapperRun Claude Code's background processes through a corporate launcher on macOS and LinuxOn macOS and Linux, place a corporate launcher command in front of the background processes Claude Code starts. Claude Code runs the launcher with its own command line appended, so the launcher must exec into Claude Code; see Run Claude Code behind a corporate launcher for the launcher contract. Requires Claude Code v2.1.210 or later.
{ "processWrapper": "/opt/corp/launcher --profile claude" }
teammateModeChoose how agent team teammates displayChoose where Claude Code shows agent team teammates: inside your main terminal pane, or in split panes when your terminal supports them. See Choose a display mode.
"in-process""in-process" teammates run inside your main terminal pane"auto" split panes when you're running inside tmux, or inside iTerm2 with it2 on your PATH or tmux installed; in-process otherwise"tmux" split panes using tmux or iTerm2, detected from your terminal"iterm2" iTerm2 native split panes through the it2 CLI{ "teammateMode": "auto" }
worktreeConfigure how Claude Code creates git worktreesConfigure how Claude Code creates and manages git worktrees for --worktree, the EnterWorktree tool, and isolated subagents and background sessions.
baseRef, symlinkDirectories, sparsePaths, and bgIsolation{ "worktree": { "baseRef": "head", "symlinkDirectories": ["node_modules"] } }
worktree.baseRefBranch new worktrees from the remote default branch or your local HEADChoose which ref new worktrees branch from. "fresh" branches from origin/<default-branch> for a clean tree matching the remote; "head" branches from your current local HEAD, so unpushed commits and feature-branch state are present in the worktree.
"fresh""fresh" new worktrees branch from origin/<default-branch>"head" new worktrees branch from your current local HEAD, including unpushed commits{ "worktree": { "baseRef": "head" } }
worktree.symlinkDirectoriesSymlink large directories into each worktree instead of duplicating themSymlink directories from the main repository into each worktree so you don't duplicate large directories on disk.
{ "worktree": { "symlinkDirectories": ["node_modules", ".cache"] } }
worktree.sparsePathsCheck out only the directories you need in each worktreeCheck out only the listed directories in each worktree through git sparse-checkout. Claude Code writes only those directories plus root-level files to disk, which is faster in large monorepos; see Check out only the directories you need.
{ "worktree": { "sparsePaths": ["packages/my-app", "shared/utils"] } }
worktree.bgIsolationLet background sessions edit the working copy without a worktreeChoose how background sessions isolate their file edits. If you moved a session to the background with ← or /background, that session edits files in place whatever this key says. With "worktree", Claude Code blocks Edit and Write in the main checkout until the session calls EnterWorktree; with "none", background jobs edit the working copy directly. Set "none" for a repository where git worktrees are impractical.
"worktree""worktree" Claude Code blocks Edit and Write in the main checkout until the session calls EnterWorktree"none" background jobs edit the working copy directly{ "worktree": { "bgIsolation": "none" } }
agentPushNotifEnabledLet Claude send a push notification to your phone when it decides toAllow Claude to send a push notification to your phone when it decides one is worth sending, for example when a long task finishes. Claude Code syncs this choice to your account, and pushes arrive while Remote Control is connected. Appears in /config as Push when Claude decides.
falsetrue Claude can send a push notification to your phone when it decides one is worth sendingfalse Claude doesn't send those notifications{ "agentPushNotifEnabled": true }
awaySummaryEnabledTurn off the session recap shown when you come back to the terminalShow a one-line session recap when you return to the terminal after a few minutes away. Set it to false, or turn off Session recap in /config, to stop the recap.
true you see a one-line session recap when you return after a few minutes awayfalse Claude Code shows no recap{ "awaySummaryEnabled": false }
disableArtifactDeprecated; use enableArtifact to turn the Artifact tool offUse enableArtifact instead to turn off the Artifact tool, which publishes session output as a private web page on claude.ai. When you turn the Artifacts row off in /config, Claude Code writes enableArtifact to your user settings and clears this key.
true Claude Code turns the Artifact tool off for every session the file applies to, and no other file turns it back onfalse ignored; to leave the tool on, remove the key{ "disableArtifact": true }
disableDeepLinkRegistrationStop Claude Code from registering the claude-cli:// handlerStop Claude Code from registering the claude-cli:// protocol handler with the operating system, which it otherwise does after you send the first prompt of an interactive session. Deep links let external tools open a Claude Code session with a pre-filled prompt. Set this in environments where protocol handler registration is restricted or managed separately.
"disable"{ "disableDeepLinkRegistration": "disable" }
disableDesktopLocalSessionsTurn off Desktop Code sessions that run on the device, leaving SSH to other hosts and cloudTurn off Code sessions that run on the device in the desktop app, for deployments where developers should work on remote machines over SSH. In the Code tab, the Local environment stays in the environment dropdown but is grayed out and can't be selected, with a tooltip saying your organization turned it off; on Windows the WSL entry is grayed out the same way, though whether WSL sessions run on a managed device at all is governed separately. New sessions default to the first SSH connection if one is configured, and the app refuses to start or resume a session on the device, including an SSH connection back to the same machine. SSH sessions to other hosts and cloud sessions are unaffected. The desktop app reads this key; the terminal CLI ignores it. Requires Claude Desktop v1.37937.0 or later.
true takes effecttrue the desktop app offers no on-device Code sessions; existing local sessions stay listed but can't continuefalse local sessions stay available{ "disableDesktopLocalSessions": true }
disableRemoteControlTurn off Remote Control everywhere it can startTurn off Remote Control: Claude Code then refuses claude remote-control, the --remote-control flag, auto-start, and the in-session toggle, and reports that your organization's policy disabled it. Place it in managed settings for per-device MDM enforcement.
falsetrue Claude Code refuses claude remote-control, the --remote-control flag, auto-start, and the in-session togglefalse Remote Control stays available{ "disableRemoteControl": true }
enableArtifactTurn the Artifact tool off with a false in any file; no file can turn it back onTurn off the Artifact tool, which publishes session output as a private web page on claude.ai. When you turn the Artifacts row off in /config, Claude Code writes this key to your user settings, so you don't usually edit it by hand. Requires Claude Code v2.1.196 or later.
false Claude Code turns the Artifact tool off for every session the file applies totrue the same as leaving the key unset, because it never overrides a false from another file, from CLAUDE_CODE_DISABLE_ARTIFACT, or from your organization's admin setting{ "enableArtifact": false }
inputNeededNotifEnabledGet a push notification when Claude is waiting on youGet a push notification on your phone when a permission prompt or question is waiting for your input. Claude Code sends these only while Remote Control is connected. Appears in /config as Push when actions required.
falsetrue you get a push notification on your phone when a permission prompt or question is waiting, while Remote Control is connectedfalse Claude Code sends no such notifications{ "inputNeededNotifEnabled": true }
preferredNotifChannelChoose a terminal bell or desktop notification for task completionChoose how Claude Code notifies you when a task completes or a permission prompt is waiting. Appears in /config as Local notifications.
"auto""auto" Claude Code sends a desktop notification in iTerm2, Ghostty, and Kitty, rings the bell in Terminal.app only when its audible bell is off, and does nothing elsewhere"terminal_bell" Claude Code rings the bell character in any terminal"iterm2" Claude Code sends an iTerm2 desktop notification"iterm2_with_bell" Claude Code sends an iTerm2 desktop notification and rings the bell"kitty" Claude Code sends a Kitty desktop notification"ghostty" Claude Code sends a Ghostty desktop notification"notifications_disabled" Claude Code sends no notification{ "preferredNotifChannel": "terminal_bell" }
remote.defaultEnvironmentIdPick the default cloud environment for claude --cloud; a self-hosted ccpool_ ID is read only from user and managed settings and --settingsPick the default cloud environment for cloud sessions you create from the CLI, such as with claude --cloud. Claude Code writes this key to your user settings when you pick an environment with /remote-env.
env_... or ccpool_...{ "remote": { "defaultEnvironmentId": "env_0123abcd" } }
remoteControlAtStartupConnect Remote Control automatically when a session startsConnect Remote Control automatically when each interactive session starts, instead of waiting for /remote-control. Set it to true to turn auto-connect on, false to turn it off. Appears in /config as Enable Remote Control for all sessions.
true Claude Code connects Remote Control automatically when each interactive session startsfalse Claude Code waits for /remote-control{ "remoteControlAtStartup": true }
sshConfigsAdd SSH connections to the Desktop environment dropdownAdd SSH connections to the Desktop environment dropdown. Administrators use it to distribute shared connections to a team. Connections you define in managed settings show as managed, so users can select them but can't edit or delete them in the app.
id, name, and sshHost and optional sshPort and sshIdentityFile{ "sshConfigs": [ { "id": "dev-vm", "name": "Dev VM", "sshHost": "user@dev.example.com" } ] }
sshHostAllowlistLimit which hosts Desktop SSH sessions can reachLimit the hosts a Desktop SSH session can connect to. Only the Desktop app reads this key; the CLI doesn't. Patterns are case-insensitive: * matches any host, *.example.com matches example.com and every subdomain, and anything else is an exact match against the hostname after ~/.ssh/config resolution. An empty array turns SSH sessions off.
{ "sshHostAllowlist": ["*.devboxes.example.com", "bastion.example.com"] }
allowedProvidersLimit which API providers a machine may useList the services a machine may reach Claude through, such as the Anthropic API, Amazon Bedrock, or an LLM gateway. A session on a provider that isn't listed is refused at startup, at login, and when it next contacts the API, so switching to an unlisted provider mid-session is refused too. The refusal message names what selected the provider and the steps to continue. Requires Claude Code v2.1.285 or later.
"anthropic" the Anthropic API on Anthropic's own host, through a claude.ai or Console sign-in or an API key. Pair it with forceLoginMethod or forceLoginOrgUUID to also restrict the sign-in"bedrock" Amazon Bedrock"vertex" Google Cloud's Agent Platform, formerly Vertex AI"foundry" Microsoft Foundry"anthropicAws" Claude Platform on AWS"mantle" the Amazon Bedrock Mantle endpoint. A session that runs Mantle alongside the Invoke API uses both providers, so list "bedrock" and "mantle" together for it"customEndpoint" the Anthropic API or a cloud provider's API sent to another host, such as an LLM gateway named by ANTHROPIC_BASE_URL or by a provider's endpoint variable such as ANTHROPIC_BEDROCK_BASE_URL. Claude Code admits it only for the exact value a managed env block pins"gateway" a Cloud gateway sign-in{ "allowedProviders": ["anthropic", "bedrock"] }
apiKeyHelperGenerate the API credential with your own commandRun your own command to produce the credential Claude Code sends with model requests. Claude Code runs the command through the system shell, /bin/sh on macOS and Linux and cmd on Windows, and sends its output as both the X-Api-Key and Authorization: Bearer headers. Use it for dynamic or rotating credentials, such as short-lived tokens fetched from a vault.
{ "apiKeyHelper": "/bin/generate_temp_api_key.sh" }
awsAuthRefreshRefresh expired Bedrock credentials in .aws with your own commandRun your own command, such as aws sso login, to refresh the credentials in your .aws directory when the ones Claude Code has for Amazon Bedrock stop working. Claude Code checks the current credentials against STS first and runs the command only when that check fails, then reads the refreshed .aws directory.
{ "awsAuthRefresh": "aws sso login --profile myprofile" }
awsCredentialExportSupply Bedrock credentials as JSON from your own commandRun your own command that prints AWS credentials as JSON, so Claude Code can call Amazon Bedrock with credentials that don't live in your .aws directory. Claude Code accepts the aws sts output shape and the flat aws configure export-credentials shape, and scopes the credentials to its own Bedrock client, so the shell commands Claude runs still see your ambient credentials.
{ "awsCredentialExport": "/bin/generate_aws_grant.sh" }
forceLoginMethodRestrict login to claude.ai, Claude Console, or a cloud gatewayRestrict which kind of account people can log in with. Set "claudeai" to allow only claude.ai accounts, "console" to allow only Claude Console accounts, or "gateway" to send people to a cloud gateway instead of a first-party login. Administrators set it in managed settings and pair it with forceLoginOrgUUID to keep developers' claude.ai logins inside one organization. If you set it to "claudeai" or "console" in any settings file, Claude Code also stops offering the keyless Console sign-in in the sessions that file applies to.
"claudeai" only claude.ai accounts can log in"console" only Claude Console accounts can log in"gateway" Claude Code sends people to a cloud gateway instead of a first-party login{ "forceLoginMethod": "claudeai" }
forceLoginGatewayUrlSet the gateway URL the login screen connects toSet the gateway URL the /login Cloud gateway screen connects to, so people reach your cloud gateway without typing its address. The screen has no URL field: with this key set, it shows your gateway URL and connects when the person presses Enter; without it, it tells them to contact their IT administrator.
{ "forceLoginGatewayUrl": "https://claude-gateway.example.com" }
forceLoginOrgUUIDPin claude.ai logins to your organization; only a managed source enforces itFrom a managed source, require claude.ai account logins to belong to one Anthropic organization, given as a single UUID, or to any of several organizations, given as an array. From any settings file, Claude Code also uses a single UUID to pre-select that organization during a claude.ai or Claude Console login, and pre-selects nothing for an array. If you set the key in any settings file, Claude Code also stops offering the keyless Console sign-in in the sessions that file applies to and creates an API key instead.
{ "forceLoginOrgUUID": ["xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx", "yyyyyyyy-yyyy-yyyy-yyyy-yyyyyyyyyyyy"] }
gatewayInternalNetworksLet /login reach a cloud gateway on public IPv4 space your organization uses internallyDeclare the public IPv4 blocks that your organization numbers its internal network from, so /login accepts a cloud gateway there. Requires Claude Code v2.1.268 or later.
/8 to /32, not overlapping one another, and none overlapping private space./login accepts only gateways on private addresses{ "gatewayInternalNetworks": ["203.0.113.0/24"] }
gcpAuthRefreshRefresh Google Cloud credentials with your own commandRun your own command to refresh Google Cloud Application Default Credentials when Claude Code finds they've expired or can't be loaded, so Google Cloud's Agent Platform requests keep working without you re-authenticating by hand.
gcloud auth application-default login yourself{ "gcpAuthRefresh": "gcloud auth application-default login" }
otelHeadersHelperGenerate rotating OpenTelemetry headers with your own commandRun your own command to generate the headers Claude Code sends with OpenTelemetry exports, for backends whose tokens rotate. Claude Code runs it at startup and periodically after that, and expects a JSON object of string header values on stdout.
{ "otelHeadersHelper": "/bin/generate_otel_headers.sh" }
autoUpdatesChannelFollow the stable release channel instead of latestChoose which release channel background auto-updates and claude update follow. Set "stable" for a version that is typically about one week old and skips releases with major regressions, or "latest" for the most recent release.
"latest""latest" updates follow the most recent release"stable" updates follow a version that is typically about one week old and skips releases with major regressions{ "autoUpdatesChannel": "stable" }
minimumVersionKeep auto-updates from installing anything below a versionKeep background auto-updates and claude update from installing any version below this one, so moving to the "stable" channel doesn't downgrade you from a newer "latest" build. Claude Code writes this key for you when you choose to stay on your current version while switching channels in /config, and clears it when you switch back to "latest".
"2.1.100"; a value that isn't a valid version is ignored{ "autoUpdatesChannel": "stable", "minimumVersion": "2.1.100" }
requiredMaximumVersionRefuse to start on a version newer than your organization allowsSet the newest Claude Code version your organization allows to start. When the running version is newer, Claude Code exits at startup and tells the user to install an approved version through your organization's approved method; claude install <version> may also work. Requires Claude Code v2.1.163 or later.
"2.1.150"; a value that isn't a valid version is ignored{ "requiredMaximumVersion": "2.1.150" }
requiredMinimumVersionRefuse to start on a version older than your organization requiresSet the oldest Claude Code version your organization allows to start. When the running version is older, Claude Code exits at startup and tells the user to update through your organization's approved method. The check runs at startup only, so a session that's already running continues. Requires Claude Code v2.1.163 or later.
"2.1.150"; a value that isn't a valid version is ignored{ "requiredMinimumVersion": "2.1.150" }
browserExternalPageToolsKeep Claude's tools off external pages in the desktop Browser paneStop Claude from using its tools to read or act on external pages in the desktop app's Browser pane. People in your organization can still open external sites themselves, and local dev server previews keep working with Claude's tools. The desktop app reads this key; the terminal CLI ignores it.
"disabled"; the desktop app also accepts "disable", in either case{ "browserExternalPageTools": "disabled" }
disableMobileSimulatorToolsBlock Claude's tools in the desktop iOS Simulator paneBlock Claude's tools for the desktop app's iOS Simulator pane. People keep manual use of the pane; only Claude's access is removed, and nobody can turn it back on from inside the app. The desktop app reads this key; the terminal CLI ignores it.
true takes effecttrue the desktop app blocks Claude's tools for the iOS Simulator panefalse Claude's simulator tools follow each person's settings toggle in the desktop app{ "disableMobileSimulatorTools": true }
cleanupPeriodDaysChoose how many days Claude Code keeps transcripts before deleting themSet how many days Claude Code keeps session transcripts and other application data before deleting them. Claude Code runs the deletion as a background sweep after a session starts, as long as it can safely determine the retention period. The sweep deletes transcripts without showing a message, so a session you haven't used for longer than the retention period no longer appears in the /resume picker.
130{ "cleanupPeriodDays": 20 }
desktopSessionCleanupPeriodDaysSet an age limit in days for Claude Desktop and Cowork transcriptsSet an age limit in days for the transcripts of sessions you started or most recently continued in Claude Desktop or Cowork. Without this key, Claude Code keeps those transcripts at any age. Claude Code deletes each one once it's older than both this limit and cleanupPeriodDays, so with cleanupPeriodDays at its default of 30, a value of 7 still keeps them 30 days. When managed settings set cleanupPeriodDays, that period applies instead and this key is ignored. Requires Claude Code v2.1.248 or later.
00, which sets no age limit{ "desktopSessionCleanupPeriodDays": 90 }
feedbackDraftsControl whether Claude queues feedback drafts for you to reviewControl Claude-drafted feedback: whether Claude can queue feedback drafts for you to review, and whether Claude Code shows a card when Claude queues one.
"notify", "quiet", or "off""notify""notify" Claude Code shows a card above the prompt when Claude queues a draft, up to three cards in a session by default"quiet" Claude drafts without a card. You see the count of queued drafts in the prompt footer and review them in /feedback"off" Claude Code removes the SendFeedback tool, so Claude can't queue drafts{ "feedbackDrafts": "quiet" }
feedbackSurveyRateChange how often the session quality survey appearsSet the probability that the session quality survey appears when a session is eligible for it. Set 0 to keep the survey from appearing.
0 and 10.005 on Amazon Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry, which don't receive remote configuration{ "feedbackSurveyRate": 0.05 }
skipWebFetchPreflightSkip the WebFetch hostname check when Anthropic is unreachableSkip the WebFetch domain safety check, which sends each requested hostname to api.anthropic.com before fetching. Set true in environments that block traffic to Anthropic, such as Amazon Bedrock, Google Cloud's Agent Platform, or Microsoft Foundry deployments with restrictive egress.
true Claude Code skips the WebFetch domain safety checkfalse the check runs before the first fetch to each hostname in a session, and again for a hostname whose earlier check was blocked or failed{ "skipWebFetchPreflight": true }
disableSideloadFlagsReject the CLI flags that sideload plugins, subagents, and MCP serversReject the --plugin-dir, --plugin-url, --agents, and --mcp-config CLI flags at startup, which users could otherwise pass to bypass strictKnownMarketplaces for a single run. Claude Code exits with an error naming the rejected flags. In cloud sessions, Claude Code instead starts the session and drops every server-delivered --mcp-config entry except in-process type: "sdk" entries and a Claude Tag session's Slack tools. Requires Claude Code v2.1.193 or later.
falsetrue Claude Code rejects --plugin-dir, --plugin-url, --agents, and --mcp-config at startup and exits with an error naming them. In cloud sessions, it instead starts the session and drops every server-delivered --mcp-config entry except in-process type: "sdk" entries and a Claude Tag session's Slack toolsfalse Claude Code accepts those flags{ "disableSideloadFlags": true }
forceRemoteSettingsRefreshBlock startup until server-managed settings are freshly fetchedBlock CLI startup until Claude Code has freshly fetched server-managed settings. If the fetch fails, Claude Code exits instead of continuing with cached or no settings. Set it when your environment can't accept even a brief window in which a session runs without its managed policy.
falsetrue Claude Code blocks startup until it has freshly fetched server-managed settings, and exits if the fetch failsfalse Claude Code doesn't block startup on the fetch, though at a sign-in startup it waits up to five seconds for the fetch{ "forceRemoteSettingsRefresh": true }
managedSourcesBehaviorCompose every managed source you deploy instead of using the highest-priority one aloneChoose whether Claude Code applies only the highest-priority managed source your organization delivers, or combines every admin source it delivers. By default Claude Code takes the highest-priority source that carries a policy key and ignores the rest. A policy key is any settings key other than this one and wslInheritsWindowsSettings. Under that default, once server-managed settings or an MDM policy deliver a policy key, a managed-settings.json file contributes only the keys Claude Code reads from every admin source. With "merge", every admin source you deliver contributes its keys to one combined policy. Requires Claude Code v2.1.242 or later.
"first-wins""first-wins" the highest-priority source that carries a policy key supplies the policy, and lower sources contribute only the keys Claude Code reads from every admin source"merge" every admin source you deliver contributes its keys, combined by the rules below{ "managedSourcesBehavior": "merge" }
parentSettingsBehaviorApply or drop restrictions an SDK or IDE host passes when you deploy managed settingsChoose whether Claude Code applies managed settings supplied by an embedding host process, such as the Agent SDK or an IDE extension, when an admin-deployed managed tier is also present. With "first-wins", Claude Code drops the host-supplied settings; with "merge", it applies them under the admin tier through a restrictive-only filter. Set "merge" when a host needs to pass its own restrictions to the sessions it launches, for example Claude Desktop delivering a gateway's egress allowlist.
"first-wins""first-wins" Claude Code drops the host-supplied settings when an admin-deployed managed tier is present"merge" Claude Code applies the host-supplied settings under the admin tier through a restrictive-only filter{ "parentSettingsBehavior": "merge" }
policyHelperRun an executable that computes managed settings at startupRun an executable you deploy that computes managed settings at startup, so you can derive policy from device posture, identity, or a remote service instead of a static file. Claude Code runs the helper before it accepts the first prompt and treats the settings it emits as the managed settings for the session.
path, timeoutMs, and refreshIntervalMs{ "policyHelper": { "path": "/usr/local/bin/claude-policy", "timeoutMs": 5000, "refreshIntervalMs": 300000 } }
policyHelper.pathName the helper executable Claude Code runsName the helper executable Claude Code runs. For what happens when the path breaks the rules below, see Helper failures.
. or .. segments; on Windows, a drive-letter or UNC path that ends in .exepolicyHelper is set{ "policyHelper": { "path": "/usr/local/bin/claude-policy" } }
policyHelper.timeoutMsSet how long Claude Code waits for the helperSet how long Claude Code waits for the helper before treating the run as failed. A timed-out run fails the same way as a non-zero exit, so at startup Claude Code refuses to start.
100010000{ "policyHelper": { "path": "/usr/local/bin/claude-policy", "timeoutMs": 5000 } }
policyHelper.refreshIntervalMsRe-run the helper in the background on an intervalHave Claude Code re-run the helper in the background on an interval so policy changes reach a running session. When a refresh succeeds, its output replaces the previous managed settings without a restart; when a refresh fails, Claude Code keeps the policy it already has.
0 to disable refresh, otherwise at least 60000{ "policyHelper": { "path": "/usr/local/bin/claude-policy", "refreshIntervalMs": 300000 } }
wslInheritsWindowsSettingsHave WSL read managed settings from the Windows policy chainHave Claude Code on WSL read managed settings from the Windows policy chain, with HKLM and the Windows managed settings file taking priority over /etc/claude-code and HKCU below it. While the chain is on, Claude Code reads /etc/claude-code only when no Windows admin document is present in the HKLM registry value or the C:\Program Files\ClaudeCode\ folder. Set it to extend the policy you already deploy on Windows to WSL sessions on the same machine, so they follow the same rules as host sessions. Claude Code honors it only when set in the HKLM registry key or in a managed settings file or drop-in under C:\Program Files\ClaudeCode\, both of which require Windows admin to write.
false, so WSL reads only /etc/claude-codetrue Claude Code on WSL reads managed settings from the Windows policy chain, and reads /etc/claude-code only when no Windows admin document is presentfalse WSL reads only /etc/claude-code{ "wslInheritsWindowsSettings": true }
autoConnectIdeConnect to a running VS Code or JetBrains IDE automatically from an external terminalConnect to a running IDE automatically when you start Claude Code from an external terminal. Appears in /config as Auto-connect to IDE (external terminal) when you run Claude Code outside a VS Code or JetBrains terminal.
falsetrue Claude Code connects to a running IDE automatically when you start it from an external terminalfalse Claude Code doesn't connect automatically from an external terminal; inside a VS Code or JetBrains terminal, or with --ide, it still connects{ "autoConnectIde": true }
autoInstallIdeExtensionTurn off automatic install of the IDE extension from a VS Code terminalInstall the Claude Code IDE extension automatically when you run Claude Code from a VS Code terminal. Appears in /config as Auto-install IDE extension when you run Claude Code inside a VS Code or JetBrains terminal.
truetrue Claude Code installs the IDE extension automatically when you run it from a VS Code terminalfalse Claude Code doesn't install the extension automatically{ "autoInstallIdeExtension": false }
claudeInChromeDefaultEnabledTurn on Chrome integration when a session starts, in the interactive CLI and the VS Code extensionStart every interactive CLI session with Chrome integration on, without passing --chrome each time. If you run claude remote-control, a session it starts for one of your project threads follows this key too, except in bypassPermissions mode. With Claude Code v2.1.287 or later, this key also applies to sessions in the VS Code extension: see Enable Chrome by default.
true Claude Code turns on Chrome integration when an interactive CLI session starts, as it does when you pass --chrome. In the VS Code extension, sessions connect to the browser as they startfalse interactive CLI sessions start with Chrome integration off, and Claude Code stops offering to set it up. Pass --chrome to turn it on for one interactive session. In the VS Code extension, a session connects when you type @browser, as when the key is unset{ "claudeInChromeDefaultEnabled": true }
copyFullResponseMake /copy copy the full response without showing the code block pickerMake /copy copy the full response every time, without the picker it otherwise shows when the response contains code blocks. Selecting Always copy full response in that picker sets this key to true. Appears in /config as Skip the /copy picker.
falsetrue /copy copies the full response without showing the pickerfalse when the response contains code blocks, /copy shows a picker where you choose one code block or the full response{ "copyFullResponse": true }
copyOnSelectTurn off automatic copying of text you select with the mouse in fullscreen rendering and agent viewCopy text to your clipboard automatically when you finish selecting it with the mouse in fullscreen rendering or agent view. Appears in /config as Copy on select while fullscreen rendering is on.
truetrue Claude Code copies text to your clipboard when you finish selecting itfalse selecting text leaves your clipboard unchanged, and you copy the selection with a keyboard shortcut instead{ "copyOnSelect": false }
defaultToAgentsViewOpen agent view instead of a new conversation when you run claude with no argumentsOpen agent view instead of a new conversation when you run claude with no arguments. Appears in /config as Open agents view by default unless agent view is turned off.
falsetrue claude with no arguments opens agent view, unless agent view is turned offfalse claude with no arguments starts a new conversation{ "defaultToAgentsView": true }
diffToolChoose whether Claude's proposed file changes open in the VS Code or JetBrains diff viewer or stay in the terminalChoose where Claude Code shows the diff of an Edit or Write change it proposes when a VS Code or JetBrains IDE is connected: "auto" opens it in the IDE's diff viewer, "terminal" keeps it in the terminal. Appears in /config as Diff tool only while Claude Code is connected to a VS Code or JetBrains IDE.
"auto""auto" Claude Code opens the diff in the IDE's diff viewer when a VS Code or JetBrains IDE is connected"terminal" Claude Code keeps the diff in the terminal{ "diffTool": "terminal" }
externalEditorContextShow Claude's last response as comments when you press Ctrl+G to editWhen you press Ctrl+G, Claude Code opens the prompt you're typing in your external editor. With this key on, the editor buffer starts with Claude's previous response as # comment lines, so you can read it while you write, and Claude Code strips those lines when you save. Appears in /config as Show last response in external editor.
falsetrue the editor buffer starts with Claude's previous response as # comment lines, which Claude Code strips when you savefalse the editor buffer opens with only your prompt{ "externalEditorContext": true }
leftArrowOpensAgentsTurn off the ← shortcut that backgrounds the session and opens agent viewPress ← on an empty prompt to background the session and open agent view. Set this key to false to turn the shortcut off. Appears in /config as ← opens agents when agent view is available.
truetrue pressing ← on an empty prompt in a session you started in the terminal backgrounds it and opens agent viewfalse Claude Code turns the shortcut off; in a session you attached to from agent view, ← on an empty prompt still detaches{ "leftArrowOpensAgents": false }
permissionExplainerEnabledRemoved in v2.1.257, together with the Ctrl+E command explanation on shell permission promptsThrough v2.1.256, you could press Ctrl+E on a Bash or PowerShell permission prompt to see a model-generated explanation of the command, and set this key to false to turn that shortcut off.
trueteammateDefaultModelRemoved in v2.1.234; see Specify teammates and models for how Claude Code picks a teammate's modelThrough v2.1.233, you set this key to the model for agent team teammates your prompt didn't name a model for: an alias such as "sonnet", or null to follow the lead's model. For the model Claude Code picks for such teammates now, see specify teammates and models.
nullmodelModel to use (e.g., gpt-6.1-sol).review_modelOptional model override used by /review (defaults to the current session model).model_providerProvider id from model_providers (default: openai).openaiopenai_base_urlBase URL override for the built-in openai model provider.model_context_windowContext window tokens available to the active model.model_auto_compact_token_limitToken threshold that triggers automatic history compaction (unset uses model defaults).model_auto_compact_token_limit_scopeControls whether the auto-compaction threshold counts the full active context (total, the default) or only growth after the carried compaction-window prefix (body_after_prefix).model_catalog_jsonOptional path to a JSON model catalog loaded on startup. A selected $CODEX_HOME/profile-name.config.toml profile file can override this per profile.oss_providerDefault local provider used when running with --oss (defaults to prompting if unset).approval_policyControls when Codex pauses for approval before executing commands. You can also use approval_policy = { granular = { ... } } to allow or auto-reject specific prompt categories while keeping other prompts interactive. untrusted is unsupported, and on-failure is deprecated; use on-request for interactive runs or never for non-interactive runs.approval_policy.granular.sandbox_approvalWhen true, sandbox escalation approval prompts are allowed to surface.approval_policy.granular.rulesWhen true, approvals triggered by execpolicy prompt rules are allowed to surface.approval_policy.granular.mcp_elicitationsWhen true, MCP elicitation prompts are allowed to surface instead of being auto-rejected.approval_policy.granular.request_permissionsWhen true, prompts from the request_permissions tool are allowed to surface.approval_policy.granular.skill_approvalWhen true, skill-script approval prompts are allowed to surface.approvals_reviewerWho reviews eligible approval prompts under on-request or granular approval policies. Defaults to user; auto_review uses the reviewer subagent. This setting doesn't change sandboxing or review actions already allowed inside the sandbox.userauto_review.policyLocal Markdown policy instructions for automatic review. Managed guardian_policy_config takes precedence. Blank values are ignored.auto_review.extra_policyAdditional local Markdown policy for automatic review, included alongside the main policy. Managed guardian_extra_policy takes precedence. Blank values are ignored.allow_login_shellAllow shell-based tools to use login-shell semantics. Defaults to true; when false, login = true requests are rejected and omitted login defaults to non-login shells.truesandbox_modeSandbox policy for filesystem and network access during command execution.sandbox_workspace_write.writable_rootsAdditional writable roots when sandbox_mode = "workspace-write".sandbox_workspace_write.network_accessAllow outbound network access inside the workspace-write sandbox.sandbox_workspace_write.exclude_tmpdir_env_varExclude $TMPDIR from writable roots in workspace-write mode.sandbox_workspace_write.exclude_slash_tmpExclude /tmp from writable roots in workspace-write mode.windows.sandboxWindows-only native sandbox mode when running Codex natively on Windows.browser_use.allow_history_accessSet to false to restrict browser-history access. Managed requirements can enforce this restriction.browser_use.default_origin_policyFallback browser-origin restrictions. Supports access, uploads, downloads, and full_cdp_access, each set to allow or deny.browser_use.origins.<origin>Per-origin browser restrictions with the same fields as browser_use.default_origin_policy. Include an HTTP or HTTPS scheme and optional port; omit paths, queries, and fragments. Local values cannot relax managed denies.computer_use.default_app_accessFallback native-app access policy for Computer Use. App-specific entries can supply a policy; local configuration cannot relax managed restrictions.computer_use.macos.bundle_idsNative macOS app access keyed by bundle identifier.computer_use.windows.aumidsPackaged Windows app access keyed by Application User Model ID (AUMID).computer_use.windows.exesWindows executable access rules. Each rule requires publisher_name, product_name, and access (allow or deny); binary_name is optional.computer_use.windows.always_allowed_app_idsWindows app identifiers that Computer Use can open without prompting. Apps not in the list require approval; remove saved entries from the ChatGPT desktop app's Computer Use settings.notifyCommand invoked for notifications; receives a JSON payload from Codex.check_for_update_on_startupCheck for Codex updates on startup (set to false only when updates are centrally managed).feedback.enabledEnable feedback submission via /feedback across local clients (default: true).analytics.enabledEnable or disable analytics for this machine/profile. When unset, the client default applies.instructionsReserved for future use; prefer model_instructions_file or AGENTS.md.developer_instructionsAdditional developer instructions injected into the session (optional).log_dirDirectory where Codex writes log files; defaults to $CODEX_HOME/log. Setting this explicitly also enables the opt-in plaintext TUI log, codex-tui.log, in that directory.$CODEX_HOME/logsqlite_homeDirectory where Codex stores the SQLite-backed state DB used by agent jobs and other resumable runtime state.compact_promptInline override for the history compaction prompt.model_instructions_fileReplacement for built-in instructions instead of AGENTS.md.personalityDefault communication style for models that advertise supportsPersonality; can be overridden per thread/turn or via /personality.service_tierPreferred service tier for new turns. Use fast or another tier advertised by the active model; fast maps to the request value priority.experimental_compact_prompt_fileLoad the compaction prompt override from a file (experimental).skills.max_context_tokensToken budget for the available-skills catalog. Defaults to 2% of the model's context window. Explicit values are capped at 10000 tokens.skills.configPer-skill enablement overrides stored in config.toml.skills.config.<index>.pathPath to a skill folder containing SKILL.md.skills.config.<index>.enabledEnable or disable the referenced skill.apps.<id>.enabledEnable or disable a specific app/connector by id (default: true).apps._default.enabledDefault app enabled state for all apps unless overridden per app.apps._default.destructive_enabledDefault allow/deny for app tools with destructive_hint = true.apps._default.open_world_enabledDefault allow/deny for app tools with open_world_hint = true.apps._default.approvals_reviewerDefault reviewer for app tool approval prompts unless overridden per app. When omitted, apps inherit the top-level approvals_reviewer value.apps._default.default_tools_approval_modeDefault approval behavior for app tools without per-app or per-tool overrides.apps.<id>.destructive_enabledAllow or block tools in this app that advertise destructive_hint = true.apps.<id>.open_world_enabledAllow or block tools in this app that advertise open_world_hint = true.apps.<id>.default_tools_enabledDefault enabled state for tools in this app unless a per-tool override exists.apps.<id>.approvals_reviewerReviewer for this app's tool approval prompts. Overrides apps._default.approvals_reviewer.apps.<id>.default_tools_approval_modeDefault approval behavior for tools in this app unless a per-tool override exists.apps.<id>.tools.<tool>.enabledPer-tool enabled override for an app tool (for example repos/list).apps.<id>.tools.<tool>.approval_modePer-tool approval behavior override for a single app tool.tool_suggest.discoverablesAllow tool suggestions for additional discoverable connectors or plugins. Each entry uses type = "connector" or "plugin" and an id.tool_suggest.disabled_toolsDisable suggestions for specific discoverable connectors or plugins. Each entry uses type = "connector" or "plugin" and an id.features.appsEnable app (connector) integrations (stable; on by default). App and connector traffic is not controlled by the sandboxed-command network proxy or its domain allowlist.features.hooksEnable lifecycle hooks loaded from hooks.json or inline [hooks] config. features.codex_hooks is a deprecated alias.features.code_mode.enabledEnable code mode feature configuration. This feature is under development and off by default.features.code_mode.excluded_tool_namespacesTool namespaces code mode excludes from nested code-mode tool guidance and executor exposure.features.code_mode.direct_only_tool_namespacesTool namespaces code mode can use only through direct tool calls.features.context_management.experimental_modeExperimental context-management setting. The feature is not currently available.features.rollout_budget.enabledEnable rollout budget tracking. This feature is under development and off by default. When enabled, features.rollout_budget.limit_tokens is required.features.rollout_budget.limit_tokensPositive token limit for rollout budget tracking. Required when rollout budget is enabled.features.rollout_budget.reminder_interval_tokensPositive token interval between rollout budget reminders. Defaults to 10% of limit_tokens, with a minimum of 1 token.limit_tokens, with a minimum of 1 tokenfeatures.rollout_budget.sampling_token_weightFinite non-negative multiplier for sampled tokens in rollout budget accounting. Defaults to 1.0.1features.rollout_budget.prefill_token_weightFinite non-negative multiplier for prefill tokens in rollout budget accounting. Defaults to 1.0.1hooksLifecycle hooks configured inline in config.toml. Uses the same event schema as hooks.json; see the Hooks guide for examples and supported events.hooks.<Event>Matcher groups for hook events such as PreToolUse, PermissionRequest, PostToolUse, PreCompact, PostCompact, SessionStart, SessionEnd, SubagentStart, SubagentStop, UserPromptSubmit, Stop, or Interrupt.hooks.<Event>[].hooksHook handlers for a matcher group. Command and MCP tool hooks are supported while prompt and agent hook handlers are parsed but skipped.hooks.<Event>[].hooks[].asyncRun a command hook in the background without delaying the triggering operation. Defaults to false; SessionEnd always runs synchronously. See Run hooks in the background.falsehooks.<Event>[].hooks[].additionalContextLimitApproximate per-handler token threshold for saving oversized additionalContext to disk and showing the model a shorter preview. Defaults to 2500; 0 passes the full context directly to the model. See Large hook output.2500hooks.<Event>[].hooks[].commandWindowsWindows-only command override for command hooks. The TOML alias command_windows is also accepted.features.memoriesEnable Memories (off by default).mcp_optional_startup_grace_msShared wait for optional MCP servers when building the initial tool catalog. Defaults to 1000. Set to 0 to wait for each server's startup_timeout_sec instead.1000mcp_servers.<id>.commandLauncher command for an MCP stdio server.mcp_servers.<id>.argsArguments passed to the MCP stdio server command.mcp_servers.<id>.envEnvironment variables forwarded to the MCP stdio server.mcp_servers.<id>.env_varsAdditional environment variables to whitelist for an MCP stdio server. String entries default to source = "local"; use source = "remote" only with executor-backed remote stdio.source = "local"mcp_servers.<id>.cwdWorking directory for the MCP stdio server process.mcp_servers.<id>.urlEndpoint for an MCP streamable HTTP server.mcp_servers.<id>.authAuthentication fallback for an MCP HTTP server after configured bearer tokens and authorization headers. oauth (default) uses stored MCP OAuth credentials when available. chatgpt uses the current ChatGPT session for the trusted first-party ChatGPT origin, then falls back to stored OAuth. Both modes can connect without authentication if no credential source resolves.mcp_servers.<id>.oauth.client_idPre-registered OAuth client ID used for authorization and token exchange with this MCP server.mcp_servers.<id>.oauth.callback_urlServer-specific OAuth callback. Pre-registered clients reuse it when issuer identification is supported or the URL already ends in the server-specific callback ID. Otherwise, Codex uses the global or default callback with that ID appended. Clients without a pre-registered ID use this callback during client registration.mcp_servers.<id>.oauth.callback_portFixed OAuth callback listener port for this MCP server. Overrides mcp_oauth_callback_port. For a direct loopback callback with an explicit URL port, configure the same listener port.mcp_servers.<id>.bearer_token_env_varEnvironment variable sourcing the bearer token for an MCP HTTP server.mcp_servers.<id>.http_headersStatic HTTP headers included with each MCP HTTP request.mcp_servers.<id>.http_headers_helperLocal command that prints a JSON object of HTTP header names and values. Supported only for locally connected HTTP MCP servers. Explicit bearer tokens and OAuth credentials take precedence over helper-provided Authorization headers.mcp_servers.<id>.env_http_headersHTTP headers populated from environment variables for an MCP HTTP server.mcp_servers.<id>.enabledDisable an MCP server without removing its configuration.mcp_servers.<id>.requiredWhen true, fail startup/resume if this enabled MCP server cannot initialize.mcp_servers.<id>.startup_timeout_secOverride the default 10s startup timeout for an MCP server.mcp_servers.<id>.startup_timeout_msAlias for startup_timeout_sec in milliseconds.mcp_servers.<id>.tool_timeout_secOverride the default 60s per-tool timeout for an MCP server.mcp_servers.<id>.enabled_toolsAllow list of tool names exposed by the MCP server.mcp_servers.<id>.disabled_toolsDeny list applied after enabled_tools for the MCP server.mcp_servers.<id>.default_tools_approval_modeDefault approval behavior for MCP tools on this server unless a per-tool override exists.mcp_servers.<id>.tools.<tool>.approval_modePer-tool approval behavior override for one MCP tool on this server.mcp_servers.<id>.tools.<tool>.output_token_limitToken budget for one MCP tool's output, before the standard 20% serialization allowance. Overrides the model's default output truncation budget for that tool.mcp_servers.<id>.scopesOAuth scopes to request when authenticating to that MCP server.mcp_servers.<id>.oauth_resourceOptional RFC 8707 OAuth resource parameter to include during MCP login.mcp_servers.<id>.experimental_environmentExperimental placement for an MCP server. remote starts stdio servers through a remote executor environment; streamable HTTP remote placement is not implemented.agentsMulti-agent settings and custom role declarations. Scalar setting names are reserved and can't be used as custom role names.agents.enabledEnable or disable multi-agent tools (default: true).agents.max_concurrent_threads_per_sessionMaximum number of spawned-agent threads that can be open concurrently, excluding the primary thread. When unset, Codex chooses the default.agents.max_threadsLegacy alias for agents.max_concurrent_threads_per_session.agents.default_subagent_modelDefault model for spawned agents. An explicit spawn model takes precedence.agents.default_subagent_reasoning_effortDefault reasoning effort for spawned agents. An explicit spawn effort takes precedence.agents.interrupt_messageRecord a model-visible message when an agent turn is interrupted (default: true).agents.<name>.descriptionRole guidance shown to Codex when choosing and spawning that agent type.agents.<name>.config_filePath to a TOML config layer for that role; relative paths resolve from the config file that declares the role.memories.generate_memoriesWhen false, newly created threads are not stored as memory-generation inputs. Defaults to true.truememories.use_memoriesWhen false, Codex skips injecting existing memories into future sessions. Defaults to true.truememories.disable_on_external_contextWhen true, threads that use external context such as MCP tool calls, web search, or tool search are kept out of memory generation. Defaults to false. Legacy alias: memories.no_memories_if_mcp_or_web_search.falsememories.max_raw_memories_for_consolidationMaximum recent raw memories retained for global consolidation. Defaults to 256 and is capped at 4096.256 and is capped at 4096memories.max_unused_daysMaximum days since a memory was last used before it becomes ineligible for consolidation. Defaults to 30 and is clamped to 0-365.30 and is clamped to 0-365memories.max_rollout_age_daysMaximum age of threads considered for memory generation. Defaults to 30 and is clamped to 0-90.30 and is clamped to 0-90memories.max_rollouts_per_startupMaximum rollout candidates processed per startup pass. Defaults to 16 and is capped at 128.16 and is capped at 128memories.min_rollout_idle_hoursMinimum idle time before a thread is considered for memory generation. Defaults to 6 and is clamped to 1-48.6 and is clamped to 1-48memories.min_rate_limit_remaining_percentMinimum remaining percentage required in Codex rate-limit windows before memory generation starts. Defaults to 25 and is clamped to 0-100.25 and is clamped to 0-100memories.extract_modelOptional model override for per-thread memory extraction.memories.consolidation_modelOptional model override for global memory consolidation.features.unified_execUse the unified PTY-backed exec tool (stable; enabled by default except on Windows).features.shell_snapshotSnapshot shell environment to speed up repeated commands (stable; on by default).features.multi_agentEnable multi-agent collaboration tools (spawn_agent, send_input, resume_agent, wait_agent, and close_agent) (stable; on by default).features.goalsEnable persisted goals and automatic continuation (stable; on by default).features.remote_pluginEnable the remote plugin catalog (stable; on by default).features.personalityEnable personality selection controls (stable; on by default).features.network_proxyStart the network proxy for sandboxed commands (experimental; off by default). Required to enforce permission-profile domain rules unless enabled administrator-managed experimental_network requirements start the proxy. Use a table when setting feature-level policy options such as domains. Does not filter web search, apps, MCP, or other hosted tools.features.network_proxy.enabledStart the sandboxed-command network proxy when command network access is enabled. Defaults to false; permission-profile domain rules are not enforced while the proxy is off.falsefeatures.network_proxy.domainsDomain policy for sandboxed networking. Unset by default, which means no external destinations are allowed until you add allow rules. Supports exact hosts, *.example.com for subdomains only, **.example.com for apex plus subdomains, and global * allow rules. Prefer scoped rules because * broadly opens public outbound access. Add deny rules for blocked destinations; deny wins on conflicts.features.network_proxy.unix_socketsUnix socket policy for sandboxed networking. Unset by default; add allow entries for permitted sockets.features.network_proxy.allow_local_bindingAllow broader local/private-network access. Defaults to false; exact local IP literal or localhost allow rules can still permit specific local targets.falsefeatures.network_proxy.enable_socks5Expose SOCKS5 support. Defaults to true.truefeatures.network_proxy.enable_socks5_udpAllow UDP over SOCKS5. Defaults to true.truefeatures.network_proxy.allow_upstream_proxyAllow chaining through an upstream proxy from the environment. Defaults to true.truefeatures.network_proxy.dangerously_allow_non_loopback_proxyPermit non-loopback listener addresses. Defaults to false; enabling it can expose proxy listeners beyond localhost.falsefeatures.network_proxy.dangerously_allow_all_unix_socketsPermit arbitrary Unix socket destinations instead of allowlist-only access. Defaults to false; use only in tightly controlled environments.falsefeatures.network_proxy.proxy_urlHTTP listener URL for sandboxed networking. Defaults to "http://127.0.0.1:3128"."http://127features.network_proxy.socks_urlSOCKS5 listener URL. Defaults to "http://127.0.0.1:8081"."http://127features.web_searchDeprecated legacy toggle; prefer the top-level web_search setting.features.web_search_cachedDeprecated legacy toggle. When web_search is unset, true maps to web_search = "cached".features.web_search_requestDeprecated legacy toggle. When web_search is unset, true maps to web_search = "live".features.shell_toolEnable the default shell tool for running commands (stable; on by default).features.enable_request_compressionCompress streaming request bodies with zstd when supported (stable; on by default).features.skill_mcp_dependency_installAllow prompting and installing missing MCP dependencies for skills (stable; on by default).features.fast_modeEnable model-catalog service tier selection in the TUI, including Fast-tier commands when the active model advertises them (stable; on by default).features.prevent_idle_sleepPrevent the machine from sleeping while a turn is actively running (experimental; off by default).suppress_unstable_features_warningSuppress the warning that appears when under-development feature flags are enabled.model_providers.<id>Custom provider definition. Built-in provider IDs (openai, ollama, and lmstudio) are reserved and cannot be overridden.model_providers.<id>.nameDisplay name for a custom model provider.model_providers.<id>.base_urlAPI base URL for the model provider.model_providers.<id>.env_keyEnvironment variable supplying the provider API key.model_providers.<id>.env_key_instructionsOptional setup guidance for the provider API key.model_providers.<id>.experimental_bearer_tokenDirect bearer token for the provider (discouraged; use env_key).model_providers.<id>.requires_openai_authThe provider uses OpenAI authentication (defaults to false).model_providers.<id>.wire_apiProtocol used by the provider. responses is the only supported value, and it is the default when omitted.model_providers.<id>.query_paramsExtra query parameters appended to provider requests.model_providers.<id>.http_headersStatic HTTP headers added to provider requests.model_providers.<id>.env_http_headersHTTP headers populated from environment variables when present.model_providers.<id>.request_max_retriesRetry count for HTTP requests to the provider (default: 4).model_providers.<id>.stream_max_retriesRetry count for SSE streaming interruptions (default: 5).model_providers.<id>.stream_idle_timeout_msIdle timeout for SSE streams in milliseconds (default: 300000).model_providers.<id>.supports_websocketsWhether that provider supports the Responses API WebSocket transport.model_providers.<id>.supports_standalone_web_searchAdvertise support for a compatible standalone web search endpoint (default: false). Standalone search remains under development and off by default; provider compatibility alone doesn't enable it.model_providers.<id>.authCommand-backed bearer token configuration for a custom provider. Do not combine with env_key, experimental_bearer_token, or requires_openai_auth.model_providers.<id>.auth.commandCommand to run when Codex needs a bearer token. The command must print the token to stdout.model_providers.<id>.auth.argsArguments passed to the token command.model_providers.<id>.auth.timeout_msMaximum token command runtime in milliseconds (default: 5000).model_providers.<id>.auth.refresh_interval_msHow often Codex proactively refreshes the token in milliseconds (default: 300000). Set to 0 to refresh only after an authentication retry.model_providers.<id>.auth.cwdWorking directory for the token command.model_providers.amazon-bedrock.aws.profileAWS profile name used by the built-in amazon-bedrock provider.model_providers.amazon-bedrock.aws.regionAWS region used by the built-in amazon-bedrock provider.model_reasoning_effortReasoning effort advertised by the selected model, such as low, medium, high, xhigh, max, or ultra. Available levels depend on the model and client.plan_mode_reasoning_effortPlan-mode-specific reasoning override using a level supported by the selected model. When unset, Plan mode uses its built-in preset default.model_reasoning_summarySelect reasoning summary detail or disable summaries entirely.model_verbosityOptional GPT-5 Responses API verbosity override; when unset, the selected model/preset default is used.model_supports_reasoning_summariesForce Codex to send or not send reasoning metadata.shell_environment_policy.inheritBaseline environment inheritance when spawning subprocesses.shell_environment_policy.ignore_default_excludesKeep variables containing KEY, SECRET, or TOKEN before other filters run (default: true). Set to false to apply automatic secret-name exclusions.shell_environment_policy.filtersCanonical case-insensitive environment-variable pattern filters. Include entries create an allowlist and can't restore excluded values. Explicit set values apply after exclusions. Don't combine filters with legacy exclude or include_only arrays in the same layer.shell_environment_policy.excludeLegacy environment-variable exclusion patterns. Use shell_environment_policy.filters for new configuration; don't combine both forms in the same layer.shell_environment_policy.include_onlyLegacy allowlist of environment-variable patterns. Use shell_environment_policy.filters for new configuration; don't combine both forms in the same layer.shell_environment_policy.setExplicit environment values injected after exclusions; include filters can still remove them.shell_environment_policy.experimental_use_profileUse the user shell profile when spawning subprocesses.project_root_markersList of project root marker filenames; used when searching parent directories for the project root.project_doc_max_bytesMaximum bytes read from AGENTS.md when building project instructions.project_doc_fallback_filenamesAdditional filenames to try when AGENTS.md is missing.history.persistenceControl whether Codex saves session transcripts to history.jsonl.tool_output_token_limitToken budget for storing individual tool/function outputs in history.background_terminal_max_timeoutMaximum poll window in milliseconds for empty write_stdin polls (background terminal polling). Default: 300000 (5 minutes). Replaces the older background_terminal_timeout key.history.max_bytesIf set, caps the history file size in bytes by dropping oldest entries.file_openerURI scheme used to open citations from Codex output (default: vscode).vscodeotel.environmentEnvironment tag applied to emitted OpenTelemetry events (default: dev).devotel.exporterSelect the OpenTelemetry exporter and provide any endpoint metadata.otel.trace_exporterSelect the OpenTelemetry trace exporter and provide any endpoint metadata.otel.metrics_exporterSelect the OpenTelemetry metrics exporter (defaults to statsig).statsigotel.log_user_promptOpt in to exporting raw user prompts with OpenTelemetry logs.otel.exporter.<id>.endpointExporter endpoint for OTEL logs.otel.exporter.<id>.protocolProtocol used by the OTLP/HTTP exporter.otel.exporter.<id>.headersStatic headers included with OTEL exporter requests.otel.trace_exporter.<id>.endpointTrace exporter endpoint for OTEL logs.otel.trace_exporter.<id>.protocolProtocol used by the OTLP/HTTP trace exporter.otel.trace_exporter.<id>.headersStatic headers included with OTEL trace exporter requests.otel.exporter.<id>.tls.ca-certificateCA certificate path for OTEL exporter TLS.otel.exporter.<id>.tls.client-certificateClient certificate path for OTEL exporter TLS.otel.exporter.<id>.tls.client-private-keyClient private key path for OTEL exporter TLS.otel.trace_exporter.<id>.tls.ca-certificateCA certificate path for OTEL trace exporter TLS.otel.trace_exporter.<id>.tls.client-certificateClient certificate path for OTEL trace exporter TLS.otel.trace_exporter.<id>.tls.client-private-keyClient private key path for OTEL trace exporter TLS.desktop.custom_file_handlers.<id>User-level only. Defines an additional Open in target for the ChatGPT desktop app. See Add custom file handlers for examples and handler ID constraints.desktop.custom_file_handlers.<id>.labelDisplay name shown in Open in menus. Required.desktop.custom_file_handlers.<id>.iconBundled asset path, Base64-encoded data:image/... URL, file URI, or absolute local path for the handler icon. Required; unsupported sources use the default VS Code icon.desktop.custom_file_handlers.<id>.commandExecutable path or command name to detect and launch. Required.desktop.custom_file_handlers.<id>.argsArguments inserted between the command and file input (default: []).[]desktop.custom_file_handlers.<id>.inputHow the app sends file input to the handler (default: path).pathdesktop.custom_file_handlers.<id>.supports_sshOffer the handler for files in SSH workspaces (default: false).falsetuiTUI-specific options such as enabling inline desktop notifications.tui.notificationsEnable TUI notifications; optionally restrict to specific event types.tui.notification_methodNotification method for terminal notifications (default: auto).tui.notification_conditionControl whether TUI notifications fire only when the terminal is unfocused or regardless of focus. Defaults to unfocused.unfocusedtui.animationsEnable terminal animations (welcome screen, shimmer, spinner) (default: true).tui.alternate_screenControl alternate screen usage for the TUI (default: auto; auto skips it in Zellij to preserve scrollback).tui.resume_cwdWorking directory to use when resuming or forking a session. When unset, Codex asks you to choose if your current directory differs from the session's saved directory.tui.vim_mode_defaultStart the composer in Vim normal mode instead of insert mode (default: false). You can still toggle it per session with /vim.tui.raw_output_modeStart the TUI in raw scrollback mode for copy-friendly terminal selection (default: false). You can toggle it with /raw or the default alt-r key binding.tui.show_tooltipsShow onboarding tooltips in the TUI welcome screen (default: true).tui.status_lineOrdered list of TUI footer status-line item identifiers. null disables the status line.tui.terminal_titleOrdered list of terminal window/tab title item identifiers. Defaults to ["spinner", "project"]; null disables title updates.["spinner", "project"]tui.themeSyntax-highlighting theme override (kebab-case theme name).tui.keymap.<context>.<action>Keyboard shortcut binding for a TUI action. Supported contexts include global, chat, composer, editor, vim_normal, vim_operator, vim_text_object, pager, list, and approval. Selected composer actions fall back to matching tui.keymap.global bindings; context-specific bindings take precedence when supported.tui.keymap.<context>.<action> = []Unbind the action in that keymap context. Key names use normalized strings such as ctrl-a, shift-enter, page-down, or minus.marketplaces.<name>.source_typeSource kind for a configured plugin marketplace. Marketplaces can be defined in system, cloud-managed, user, or trusted-project config.toml.marketplaces.<name>.sourceGit repository location or local marketplace root directory. Use an absolute path for a local source; the directory contains .agents/plugins/marketplace.json.marketplaces.<name>.refOptional Git branch, tag, or commit for the marketplace.marketplaces.<name>.sparse_pathsOptional sparse checkout paths for a Git marketplace. Include the marketplace catalog and any local plugin directories it references.plugins.<plugin>.enabledEnable or disable a local-marketplace plugin using a plugin-name@marketplace-name key. Read from the effective merged config; trusted-project settings can override user, cloud-managed, and system defaults. Marketplace refresh can install or refresh configured plugins even when disabled. This does not override workspace-managed enabled states.plugins.<plugin>.mcp_servers.<server>.enabledEnable or disable an MCP server bundled by an installed plugin without changing the plugin manifest.plugins.<plugin>.mcp_servers.<server>.default_tools_approval_modeDefault approval behavior for tools on a plugin-provided MCP server.plugins.<plugin>.mcp_servers.<server>.enabled_toolsAllow list of tools exposed from a plugin-provided MCP server.plugins.<plugin>.mcp_servers.<server>.disabled_toolsDeny list applied after enabled_tools for a plugin-provided MCP server.plugins.<plugin>.mcp_servers.<server>.tools.<tool>.approval_modePer-tool approval behavior override for a plugin-provided MCP tool.tui.model_availability_nux.<model>Internal startup-tooltip state keyed by model slug.hide_agent_reasoningSuppress reasoning events in both the TUI and codex exec output.show_raw_agent_reasoningSurface raw reasoning content when the active model emits it.disable_paste_burstDisable burst-paste detection in the TUI.windows_wsl_setup_acknowledgedTrack Windows onboarding acknowledgement (Windows only).chatgpt_base_urlOverride the base URL used during the ChatGPT login flow.cli_auth_credentials_storeControl where the CLI stores cached credentials.mcp_oauth_credentials_storePreferred store for MCP OAuth credentials.mcp_oauth_callback_portOptional global fixed port for the local HTTP callback server used during MCP OAuth login. A server-specific oauth.callback_port takes precedence. When neither is set, Codex binds to an ephemeral port chosen by the OS.mcp_oauth_callback_urlOptional base callback URL for MCP OAuth login, such as a devbox ingress URL. Newly added pre-registered clients use this URL unchanged when the authorization server supports issuer identification; existing clients without a saved callback append a server-specific callback ID. Without issuer support, any pre-registered MCP server whose configured callback lacks the required ID falls back to this URL with the ID appended. Callback URL ports don't select the listener port.experimental_use_unified_exec_toolLegacy name for enabling unified exec; prefer [features].unified_exec or codex --enable unified_exec.tools.web_searchOptional web search tool configuration. The object form can set search context size, allowed search domains, and approximate user location. These search-domain filters are separate from sandboxed-command network domain rules and do not restrict connectors or MCP servers.tools.view_imageEnable the local-image attachment tool view_image.web_searchWeb search mode (default: "cached"; cached uses an OpenAI-maintained index without external web access; indexed permits external access only when gated by the search index; if you use --yolo or another full access sandbox setting, it defaults to "live"). Use "live" for unrestricted live retrieval, or "disabled" to remove the tool."cached"; cached uses an OpenAI-maintained index without external web access; indexed permits external access only when gated by the search index; if you use --yolo or another full access sandbox setting, it defaults to "live"default_permissionsName of the default permissions profile to apply to sandboxed tool calls. Built-ins are :read-only, :workspace, and :danger-full-access; custom profile names require matching [permissions.<name>] tables. Don't combine with sandbox_mode or [sandbox_workspace_write].permissions.<name>.descriptionHuman-readable description for this named profile. A profile does not inherit its parent's description through extends.permissions.<name>.extendsOptional parent profile applied before this named profile. Set it to another named profile, :read-only, or :workspace; :danger-full-access, undefined parents, and cycles are rejected.permissions.<name>.workspace_rootsProfile-defined workspace roots that receive :workspace_roots filesystem rules alongside the session's runtime workspace roots.permissions.<name>.workspace_roots.<path>Opt a path into the profile's workspace root set when true. Disabled entries remain inactive.permissions.<name>.filesystemNamed filesystem permission profile. Each key is an absolute path or special token such as :minimal or :workspace_roots.permissions.<name>.filesystem.glob_scan_max_depthMaximum depth for expanding deny-read glob patterns on platforms that snapshot matches before sandbox startup. Must be at least 1 when set.permissions.<name>.filesystem.<path-or-glob>Grant direct access for a path, glob pattern, or special token, or scope nested entries under that root. Use "deny" to deny reads for matching paths.permissions.<name>.filesystem.":workspace_roots".<subpath-or-glob>Scoped filesystem access relative to each effective workspace root. Use "." for the root itself; glob subpaths such as "**/*.env" can deny reads with "deny".permissions.<name>.network.enabledEnable network access for commands in this permission profile. This does not start the network proxy. Without features.network_proxy or enabled administrator-managed networking requirements, command network access is direct and profile domain rules are not enforced.permissions.<name>.network.proxy_urlHTTP listener URL used when this permissions profile enables sandboxed networking.permissions.<name>.network.enable_socks5Expose SOCKS5 support when this permissions profile enables sandboxed networking.permissions.<name>.network.socks_urlSOCKS5 proxy endpoint used by this permissions profile.permissions.<name>.network.enable_socks5_udpAllow UDP over the SOCKS5 listener when enabled.permissions.<name>.network.allow_upstream_proxyAllow sandboxed networking to chain through another upstream proxy.permissions.<name>.network.dangerously_allow_non_loopback_proxyPermit non-loopback bind addresses for sandboxed networking listeners. Enabling it can expose listeners beyond localhost.permissions.<name>.network.dangerously_allow_all_unix_socketsAllow arbitrary Unix socket destinations instead of the default restricted set. Use only in tightly controlled environments.permissions.<name>.network.modeNetwork proxy mode used for subprocess traffic.permissions.<name>.network.domainsDomain rules for sandboxed commands. Enforced only when features.network_proxy or enabled administrator-managed networking requirements activate the proxy. Supports exact hosts, *.example.com, **.example.com, and global * allow rules; deny wins. Does not restrict web search, apps, or MCP servers.permissions.<name>.network.domains.<pattern>Allow or deny an exact host or scoped wildcard pattern such as *.example.com or **.example.com.permissions.<name>.network.unix_socketsUnix socket allowlist overrides for sandboxed networking. Use socket paths as keys; allow adds a path, and deny rejects it.permissions.<name>.network.unix_sockets.<path>Add an absolute Unix socket path to the effective allowlist with allow, or reject it with deny. Denied entries are omitted from the effective allowlist.permissions.<name>.network.allow_local_bindingPermit broader local/private-network access through sandboxed networking. Exact local IP literal or localhost allow rules can still permit specific local targets when this stays false.projects.<path>.trust_levelMark a project or worktree as trusted or untrusted ("trusted" | "untrusted"). Untrusted projects skip project-scoped .codex/ layers, including project-local config, hooks, and rules.notice.hide_full_access_warningTrack acknowledgement of the full access warning prompt.notice.hide_world_writable_warningTrack acknowledgement of the Windows world-writable directories warning.notice.hide_rate_limit_model_nudgeTrack opt-out of the rate limit model switch reminder.notice.hide_gpt5_1_migration_promptTrack acknowledgement of the GPT-5.1 migration prompt.notice.hide_gpt-5.1-codex-max_migration_promptTrack acknowledgement of the gpt-5.1-codex-max migration prompt.notice.model_migrationsTrack acknowledged model migrations as old->new mappings.forced_login_methodRestrict Codex to a specific authentication method.forced_chatgpt_workspace_idLimit ChatGPT logins to a specific workspace identifier.sqlite_homeEnforce the directory where Codex stores SQLite-backed runtime state.log_dirEnforce the directory where Codex writes local log files.model_catalog_jsonEnforce the JSON model catalog Codex uses at startup.check_for_update_on_startupEnforce whether Codex checks for updates when it starts.allow_login_shellEnforce whether shell tools can start a login shell.allowed_login_methodsAllow chatgpt, api, or both. If omitted, this setting doesn't restrict login methods. If set, the list must contain at least one method. api permits API authentication, including Amazon Bedrock. Set through the local system requirements file or macOS MDM. Cloud-managed values are ignored.allowed_chatgpt_workspacesRestrict ChatGPT login, including Codex access tokens, to the listed workspace IDs. An empty list disables ChatGPT login; API authentication remains available when permitted. Set through the local system requirements file or macOS MDM; cloud-managed values are ignored.cli_auth_credentials_storeEnforce the CLI credential store before authentication loads. file uses CODEX_HOME/auth.json; keyring requires the OS credential store; auto falls back to a file if the credential store is unavailable; ephemeral keeps credentials in memory for the current process. Set through the local system requirements file or macOS MDM; cloud-managed values are ignored.chatgpt_base_urlEnforce the ChatGPT service base URL before authentication and cloud-policy retrieval. This doesn't configure every Codex network destination. Set through the local system requirements file or macOS MDM; cloud-managed values are ignored.feedbackManaged feedback settings.feedback.enabledEnforce whether users can submit feedback across Codex clients.allowed_approval_policiesAllowed approval policies, such as on-request, never, and granular. Include untrusted to permit the stricter policy derived from an untrusted project; it cannot be selected directly with approval_policy.allowed_approvals_reviewersAllowed values for approvals_reviewer, such as user and auto_review.guardian_policy_configManaged Markdown policy instructions for automatic review. This takes precedence over local [auto_review].policy. Blank values are ignored.guardian_extra_policyAdditional managed Markdown policy for automatic review, included alongside the main policy. This takes precedence over local [auto_review].extra_policy. Blank values are ignored.additional_developer_instructionsManaged developer instructions added as a separate developer message. Codex rejects instructions that exceed a limit of 10,000 estimated tokens, including context markers.auto_reviewManaged automatic-review requirements.auto_review.required_on_modelsModel slugs that must use automatic review. Slugs must be non-empty, omit provider namespaces, and have no surrounding whitespace. Lists from multiple requirements sources are combined.auto_review.ignore_rulesFull model slugs for which Codex ignores allow prefix rules in command execution policy. Match the slug exactly, including its provider namespace when present; unlike required_on_models, this does not accept a namespace-free alias. Deny and network rules still apply.allowed_permission_profilesComplete list of allowed permission profiles. Profiles set to true are allowed. Profiles that are omitted or set to false are denied, including profiles added in future versions. When requirements sources are combined, entries are matched by profile name.allowed_permission_profiles.<name>Allow or deny a built-in or custom permission profile defined in a loaded config or requirements source. A later, higher-precedence requirements source can use false to turn off a profile allowed by an earlier, lower-precedence source.default_permissionsManaged default permission profile. The profile must be allowed by allowed_permission_profiles. Set this explicitly for predictable behavior; if omitted, Codex defaults to :workspace only when both :workspace and :read-only are explicitly allowed.:workspace only when both :workspace and :read-only are explicitly allowedenforce_residencyRequire Codex service traffic to use a supported data residency. Currently accepts us.model_providerEnforce the model provider ID, overriding local and session configuration.model_providersManaged model provider definitions. Each entry replaces the complete configured provider with the same ID; fields aren't merged with the user's definition. Providers with other IDs remain available.model_providers.<id>Complete managed provider definition. Uses the same provider fields as config.toml, including name, base_url, authentication, and transport settings.modelsContains the [models.new_thread] table.models.new_threadOptional defaults to apply when a new local thread starts. They take priority over user and project defaults, but can be superseded by explicit overrides.models.new_thread.modelDefault model for new threads. An explicit override of either the model or reasoning effort causes both fields to be ignored.models.new_thread.model_reasoning_effortDefault reasoning effort for new threads. An explicit override of either the model or reasoning effort causes both fields to be ignored.models.new_thread.service_tierDefault service tier for new threads. An explicit service-tier override causes this field to be ignored.permissionsAdmin-defined permission profiles keyed by profile name. Uses the same profile fields as config.toml.permissions.<name>Admin-defined permission profile. The name can't start with :, use the reserved name filesystem, or duplicate a profile from a loaded config. Uses the same profile fields as config.toml; see the Permissions guide for the complete profile schema.allowed_sandbox_modesAllowed values for sandbox_mode.windowsNative Windows sandbox requirements.windows.allowed_sandbox_implementationsAllowed legacy native Windows sandbox implementations (elevated and unelevated). The list must not be empty. When both are allowed and no mode is selected, Codex prefers elevated. This list does not restrict the mxc sandbox when it is available.remote_sandbox_configHost-specific sandbox requirements. The first entry whose hostname_patterns match the resolved host name overrides top-level allowed_sandbox_modes for that requirements source. Host-specific entries currently override sandbox modes only.remote_sandbox_config[].hostname_patternsCase-insensitive host name patterns. Supports * for any sequence of characters and ? for one character.remote_sandbox_config[].allowed_sandbox_modesAllowed sandbox modes to apply when this host-specific entry matches.allowed_web_search_modesAllowed values for web_search (disabled, cached, indexed, live). disabled is always allowed; an empty list effectively allows only disabled.allow_managed_hooks_onlyWhen true, Codex skips user, project, session, and plugin hooks while still allowing managed hooks from requirements.toml and other managed config layers.allow_appshotsSet to false to disable Appshots for managed users. If omitted, Appshots remain unconstrained by requirements and follow normal product availability.allow_remote_controlSet to false to disable device remote control for managed users. If omitted, device remote control remains unconstrained by requirements and follows normal product availability.allow_browser_and_computer_useSet to false to block both agent-driven Browser Use and native-app Computer Use. Setting it to true or omitting it does not enable either feature; the remaining feature, policy, and approval checks still apply.features.plugin_sharingSet to false in cloud-managed requirements.toml to disable workspace sharing for locally built plugins.featuresPinned feature values. Use canonical names from config.toml for runtime features; documented app-only requirement keys are also supported here.features.<name>Require a documented runtime or app feature to stay enabled or disabled.features.appsPin Apps integration availability on or off for managed users.features.in_app_updatesSet to false in requirements.toml to disable in-app updates. Updates remain enabled by default when this requirement is omitted.features.in_app_browserSet to false in requirements.toml to disable the built-in browser pane that users open and control directly.features.in_app_chatSet to false to hide ChatGPT and ChatGPT Work conversation screens and related cloud automation UI in the ChatGPT desktop app. This setting does not block ChatGPT Voice or stop existing cloud tasks. Setting it to true does not bypass account, workspace-permission, or rollout checks.features.in_app_dictationSet to false to disable in-app dictation in the desktop app. Setting it to true does not bypass other availability checks.features.in_app_local_automationSet to false to disable local scheduled tasks in the desktop app. Setting it to true does not bypass other availability checks.features.browser_useSet to false in requirements.toml to disable agent-driven Browser Use.features.browser_use_externalSet to false in requirements.toml to prevent Codex from operating supported browsers through the ChatGPT browser extension, including existing tabs and signed-in sessions.features.browser_use_full_cdp_accessSet to false in requirements.toml to disable full Chrome DevTools Protocol access in the local runtime, including Browser Developer mode, and prevent the ChatGPT desktop app from enabling the corresponding setting. If omitted, normal product availability applies.features.fast_modePin the canonical fast_mode feature on or off for managed users.features.guardian_approvalPin Guardian approval availability on or off for managed users.features.memoriesPin Memories availability on or off for managed users.features.multi_agentPin multi-agent availability on or off for managed users.features.pluginsPin plugin availability on or off for managed users.features.remote_pluginPin remote plugin catalog availability on or off for managed users.features.realtime_conversationSet to false to disable the experimental /voice command in the Codex CLI. Do not rely on this setting to block ChatGPT Voice in the desktop app or app-server voice sessions. Setting it to true does not bypass client or rollout checks.features.computer_useSet to false in requirements.toml to disable Computer Use, Record & Replay, and related install or enablement flows.features.workspace_dependenciesPin bundled workspace-dependency runtime availability on or off for managed users.in_app_browserRequirements for the built-in browser pane. These settings do not control agent-driven Browser Use.in_app_browser.allow_external_browser_settings_importSet to false to prevent users from importing settings or browsing data from an external browser into the built-in browser. Setting it to true or omitting it leaves the import available when other product checks allow it. This is a managed-only setting with no config.toml override.browser_useManaged requirements for agent-driven Browser Use.browser_use.allow_history_accessSet to false to prevent Browser Use from reading browser history. Setting it to true or omitting it leaves normal history settings and availability checks in place.browser_use.disable_auto_reviewSet to true to skip automatic review for Browser Use and ask the user for approval instead. Setting it to false or omitting it leaves automatic review available when other settings allow it.browser_use.allow_global_persistent_approvalSet to false to prevent Browser Use from creating or honoring Always allow approvals that cover every site, such as allowing downloads from any site. Existing saved approvals are ignored, not deleted. Setting it to true or omitting it does not create an approval.browser_use.default_origin_policyFallback for each Browser Use setting when no matching entry under browser_use.origins defines it. A matching origin rule replaces the fallback for that source. Codex then applies the stricter result from managed requirements and user configuration.browser_use.default_origin_policy.accessUse deny to block Browser Use on origins that use the fallback. A denied origin also blocks uploads, downloads, full browser debugging access, and automatic review there. allow only lets normal approval and policy checks continue.browser_use.default_origin_policy.downloadsUse deny to block Browser Use downloads on origins that use the fallback. allow only lets normal approval and policy checks continue.browser_use.default_origin_policy.uploadsUse deny to block Browser Use uploads on origins that use the fallback. allow only lets normal approval and policy checks continue.browser_use.default_origin_policy.full_cdp_accessUse deny to block full Chrome DevTools Protocol (CDP) access on origins that use the fallback. allow only lets normal opt-in and approval checks continue.browser_use.default_origin_policy.auto_reviewUse deny to skip automatic review on origins that use the fallback and ask the user for approval instead. allow leaves automatic review available when other settings allow it.browser_use.default_origin_policy.persistent_approvalSet to false to prevent Browser Use from saving or honoring an Always allow approval on origins that use the fallback. Approvals for the current turn or thread can still apply. true makes Always allow available when otherwise permitted but does not create an approval.browser_use.default_origin_policy.access_approval_lifetimeSet how long a non-persistent site-access approval lasts: turn limits it to the current turn, and thread keeps it for the rest of the current thread. persistent_approval separately controls whether Always allow is available. The product default is thread.browser_use.originsOrigin-specific Browser Use policies. Keys use <scheme>://<host-pattern>[:<port>] with http or https. Use an exact host, *.example.com for subdomains only, or **.example.com for the base domain and its subdomains. Other * wildcards can span dots, so region*.example.com also matches region.api.example.com; a host of * matches every host for that scheme. Schemes and nondefault ports are significant; explicit default ports are normalized away. Paths, queries, embedded usernames or passwords, and wildcard schemes or ports are invalid. Quote the pattern in TOML, for example [browser_use.origins."https://**.example.com"].browser_use.origins.<pattern>Policy for origins matching this pattern. If several patterns match, Codex uses the most restrictive value for each capability: deny over allow, false over true, and turn over thread.browser_use.origins.<pattern>.accessUse deny to block Browser Use on matching origins. Denial also blocks uploads, downloads, full browser debugging access, and automatic review there. allow only lets normal approval and policy checks continue.browser_use.origins.<pattern>.downloadsUse deny to block Browser Use downloads on matching origins. allow only lets normal approval and policy checks continue.browser_use.origins.<pattern>.uploadsUse deny to block Browser Use uploads on matching origins. allow only lets normal approval and policy checks continue.browser_use.origins.<pattern>.full_cdp_accessUse deny to block full Chrome DevTools Protocol (CDP) access on matching origins. allow only lets normal opt-in and approval checks continue.browser_use.origins.<pattern>.auto_reviewUse deny to skip automatic review on matching origins and ask the user for approval instead. allow leaves automatic review available when other settings allow it.browser_use.origins.<pattern>.persistent_approvalSet to false to prevent Browser Use from saving or honoring an Always allow approval on matching origins. Approvals for the current turn or thread can still apply. true makes Always allow available when otherwise permitted but does not create an approval.browser_use.origins.<pattern>.access_approval_lifetimeSet how long a non-persistent site-access approval for matching origins lasts: turn limits it to the current turn, and thread keeps it for the rest of the current thread. persistent_approval separately controls whether Always allow is available.computer_useManaged requirements for agent-driven work in native desktop apps. Managed app rules and config.toml app rules are both enforced; an app must be allowed by each policy source.computer_use.allow_locked_computer_useSet to false to prevent users from enabling Locked Use on a managed macOS device. This requirement removes the enablement controls; it does not turn off Locked Use if it is already enabled. If omitted, normal product availability applies.computer_use.allow_persistent_approvalSet to false to remove the option to save app approvals across sessions. Approvals for the current session remain available. Setting it to true or omitting it does not approve an app.computer_use.default_app_accessFallback access for native apps that do not match a platform-specific rule. deny blocks access. allow only lets normal approval and policy checks continue. The product default is allow.computer_use.macosComputer Use app rules for macOS.computer_use.macos.bundle_idsMap exact macOS bundle identifiers to allow or deny. A matching rule replaces computer_use.default_app_access within the same policy source. A deny from either managed requirements or user configuration still blocks access.computer_use.macos.bundle_ids.<bundle-id>Use deny to block the exact bundle identifier. allow overrides only this policy source's default and still requires any other policy source and the normal approval flow to allow the app.computer_use.windowsComputer Use app rules for packaged and unpackaged Windows apps.computer_use.windows.aumidsMap exact, registered Application User Model IDs (AUMIDs) for signed packaged apps to allow or deny. A matching rule replaces computer_use.default_app_access within the same policy source.computer_use.windows.aumids.<aumid>Use deny to block the exact packaged-app identity. allow overrides only this policy source's default and still requires any other policy source and the normal approval flow to allow the app.computer_use.windows.exesRules for signed, unpackaged Windows executables. Rules match the executable's verified publisher and signed version information, not its path or current file name. A matching deny takes precedence over matching allows. Unsigned executables use computer_use.default_app_access; executables whose signed identity cannot be verified unambiguously are blocked.computer_use.windows.exes[].publisher_nameRequired exact publisher name from the executable's trusted signing certificate, formatted as a Windows X.500 distinguished name.computer_use.windows.exes[].product_nameRequired exact ProductName from the executable's signed version information.computer_use.windows.exes[].binary_nameOptional OriginalFilename from the executable's signed version information. Matching is case-insensitive. If a matching publisher and product rule requires this value but the executable does not provide it, Computer Use blocks the executable.computer_use.windows.exes[].accessRequired access decision for matching executables. deny blocks access. allow overrides only this policy source's default and still requires any other policy source and the normal approval flow to allow the app.experimental_networkAdministrator-managed network requirements for sandboxed local commands, enforced from requirements.toml. When enabled, these requirements can start the command network proxy without features.network_proxy. Browser tools separately check managed network denies and exclusive allowlists. These requirements do not route browser traffic through the proxy or control web search, apps, MCP servers, native-app traffic, or other capability-specific traffic. On supported managed Codex Cloud paths, these requirements constrain command networking alongside separate Cloud environment internet settings. Approved full sandbox escalation can bypass the command proxy where policy permits it. Work Cloud does not inherit these requirements.experimental_network.enabledEnable sandboxed networking requirements. This does not grant network access when the active sandbox keeps command networking off.experimental_network.http_portLoopback HTTP listener port to use for [experimental_network] requirements.experimental_network.socks_portLoopback SOCKS5 listener port to use for [experimental_network] requirements.experimental_network.allow_upstream_proxyAllow sandboxed networking to chain through an upstream proxy from the environment.experimental_network.dangerously_allow_non_loopback_proxyPermit non-loopback listener addresses for [experimental_network] requirements. Enabling it can expose listeners beyond localhost.experimental_network.dangerously_allow_all_unix_socketsPermit arbitrary Unix socket destinations instead of allowlist-only access. Use only in tightly controlled environments.experimental_network.domainsMap-shaped administrator domain policy for sandboxed networking. Supports exact hosts, *.example.com for subdomains only, **.example.com for apex plus subdomains, and global * allow rules. Prefer scoped rules because * broadly opens public outbound access. Environment rules can replace the same Global domain key within a policy. Higher-priority values replace the same key, while other inherited keys remain. After composition, a different matching deny, including an inherited wildcard, still blocks a request. Empty environment maps do not clear Global rules. Verify executor support. Do not combine this with experimental_network.allowed_domains or experimental_network.denied_domains.experimental_network.domains.<pattern>Allow or deny sandboxed network access for the matching domain pattern. A deny rule wins when several patterns match.experimental_network.allowed_domainsAdministrator allow rules for sandboxed-command networking while the managed network proxy is enabled. These rules do not apply to web search, apps, or MCP servers. Do not combine this with experimental_network.domains.experimental_network.denied_domainsList-shaped administrator deny rules for sandboxed networking. Do not combine this with experimental_network.domains.experimental_network.managed_allowed_domains_onlyWhen networking requirements are enabled and this is true, ordinary user configuration and per-domain approvals cannot expand the managed proxy allowlist. With no effective configured or inherited Allow entries, ordinary managed commands have no allowed destinations. A deny-only policy does not allow the rest of the internet. This does not cover every tool or approved full sandbox escalation.experimental_network.unix_socketsAdministrator-managed Unix socket allowlist for sandboxed networking on macOS. Paths must be absolute.experimental_network.unix_sockets.<path>On macOS, allow adds an absolute Unix socket path to the allowlist; deny leaves it out. A deny entry cannot block a socket when allow-all Unix sockets is enabled.experimental_network.allow_local_bindingPermit broader local/private-network access for sandboxed networking. On the supported Codex Cloud proxy path, an explicit false can prevent upstream-proxy access even if a domain is allowed. It defaults to true only if no applicable requirement, selected network profile, or proxy feature setting provides a value. Inherited false remains explicit. A supported higher-priority Cloud override can change it without broadening Global for Local or adding domain Allow entries. Verify executor support. Do not apply this Cloud default to Local.hooksAdmin-enforced managed lifecycle hooks. Requires a managed hook directory and uses the same event schema as inline [hooks] in config.toml.hooks.managed_dirDirectory containing managed hook scripts on macOS and Linux. Codex validates that it is absolute and exists before loading managed hooks.hooks.windows_managed_dirDirectory containing managed hook scripts on Windows. Codex validates that it is absolute and exists before loading managed hooks.hooks.<Event>Matcher groups for a hook event such as PreToolUse, PermissionRequest, PostToolUse, PreCompact, PostCompact, SessionStart, SessionEnd, SubagentStart, SubagentStop, UserPromptSubmit, or Stop.hooks.<Event>[].hooksHook handlers for a matcher group. Command and MCP tool hooks are supported while prompt and agent hook handlers are parsed but skipped.hooks.<Event>[].hooks[].asyncRun a command hook in the background without delaying the triggering operation. Defaults to false; SessionEnd always runs synchronously. See Run hooks in the background.falsehooks.<Event>[].hooks[].additionalContextLimitApproximate per-handler token threshold for saving oversized additionalContext to disk and showing the model a shorter preview. Defaults to 2500; 0 passes the full context directly to the model. See Large hook output.2500hooks.<Event>[].hooks[].commandWindowsWindows-only command override for command hooks. The TOML alias command_windows is also accepted.permissions.filesystem.deny_readAdmin-enforced filesystem read denials. Entries can be paths or glob patterns, and users cannot weaken them with local config.mcp_serversAllowlist of MCP servers that may be enabled. Both the server name (<id>) and its identity must match for the MCP server to be enabled. Any configured MCP server not in the allowlist (or with a mismatched identity) is disabled.mcp_servers.<id>.identityIdentity rule for a single MCP server. Set either command (stdio) or url (streamable HTTP).mcp_servers.<id>.identity.commandAllow an MCP stdio server by exact command string, or use a matcher table to require an exact executable and ordered argument matchers. The string form doesn't inspect arguments, cwd, env, or env_vars.mcp_servers.<id>.identity.command.executableExecutable that the stdio server's configured command must match exactly.mcp_servers.<id>.identity.command.argsOrdered argument matchers for a stdio server. The configured argument list must have the same length, and every position must match. Command matchers don't inspect cwd, env, or env_vars.mcp_servers.<id>.identity.command.args[].matchMatch operation for this argument position.mcp_servers.<id>.identity.command.args[].valueValue used by an exact or prefix argument matcher.mcp_servers.<id>.identity.command.args[].expressionRegular expression used by a regex argument matcher. The expression must be valid and match the complete argument value.mcp_servers.<id>.identity.urlAllow an MCP streamable HTTP server by exact URL string, or use an exact, prefix, or regex value matcher table.mcp_servers.<id>.identity.url.matchMatch operation for the configured MCP server URL.mcp_servers.<id>.identity.url.valueValue used by an exact or prefix URL matcher.mcp_servers.<id>.identity.url.expressionRegular expression used by a regex URL matcher. The expression must be valid and match the complete URL value.pluginsPlugin-specific MCP server allowlists keyed by plugin identifier. When this table is present, plugin-bundled servers without a matching plugin and server entry are disabled.plugins.<plugin>.mcp_serversAllowlist for MCP servers bundled with one plugin. Plugin server requirements use the same exact identity and matcher forms as top-level mcp_servers requirements.plugins.<plugin>.mcp_servers.<server>.identityIdentity rule for one plugin-bundled MCP server. Set either command (stdio) or url (streamable HTTP).plugins.<plugin>.mcp_servers.<server>.identity.commandAllow a plugin's stdio MCP server by exact command string, or use a matcher table to require an exact executable and ordered argument matchers.plugins.<plugin>.mcp_servers.<server>.identity.command.executableExecutable that the plugin-bundled stdio server's configured command must match exactly.plugins.<plugin>.mcp_servers.<server>.identity.command.argsOrdered argument matchers for a plugin-bundled stdio server. The configured argument list must have the same length, and every position must match.plugins.<plugin>.mcp_servers.<server>.identity.command.args[].matchMatch operation for this argument position.plugins.<plugin>.mcp_servers.<server>.identity.command.args[].valueValue used by an exact or prefix argument matcher.plugins.<plugin>.mcp_servers.<server>.identity.command.args[].expressionRegular expression used by a regex argument matcher. The expression must match the complete argument value.plugins.<plugin>.mcp_servers.<server>.identity.urlAllow a plugin's streamable HTTP MCP server by exact URL string, or use an exact, prefix, or regex value matcher table.plugins.<plugin>.mcp_servers.<server>.identity.url.matchMatch operation for the plugin-bundled MCP server URL.plugins.<plugin>.mcp_servers.<server>.identity.url.valueValue used by an exact or prefix URL matcher.plugins.<plugin>.mcp_servers.<server>.identity.url.expressionRegular expression used by a regex URL matcher. The expression must match the complete URL value.marketplacesAdmin requirements for plugin marketplace sources. Rules take effect when restrict_to_allowed_sources is true.marketplaces.restrict_to_allowed_sourcesWhen true, require configured marketplace sources to match allowed_sources for marketplace add, plugin install, refresh, and runtime loading. OpenAI-curated Git catalogs, including the API-key catalog, must also match the allowlist. Bundled and remotely installed workspace plugins are separate from this curated Git source policy.marketplaces.allowed_sourcesAllowed marketplace sources keyed by administrator-chosen rule name. Distinct names accumulate across requirements layers; fields under the same name use normal layer precedence.marketplaces.allowed_sources.<name>One allowed source rule. The final source value after requirements merge determines which sibling fields Codex interprets.marketplaces.allowed_sources.<name>.sourceMarketplace source matcher type. Use git for one repository, host_pattern for Git hosts matched by regular expression, or local for one directory.marketplaces.allowed_sources.<name>.urlGit repository URL required when source = "git". Codex normalizes the configured and allowed URLs before requiring an exact repository match.marketplaces.allowed_sources.<name>.refOptional exact Git ref for a git rule. When omitted, the rule allows any ref for the matching repository.marketplaces.allowed_sources.<name>.host_patternRegular expression required when source = "host_pattern". Codex matches it against the lowercase hostname parsed from an HTTPS, SSH, or SCP-style Git source. Use ^ and $ to require a whole-host match.marketplaces.allowed_sources.<name>.pathLocal marketplace directory required when source = "local". Codex requires an absolute path and compares paths after normalization.appsManaged app requirements keyed by app identifier. Requirements can disable an app or constrain approval behavior for individual tools.apps.<id>.enabledSet to false to disable an app. A disabled requirement remains restrictive when multiple requirements sources are merged.apps.<id>.tools.<tool>.approval_modeSet the managed approval mode for one app tool.rulesAdmin-enforced command rules merged with .rules files. Requirements rules must be restrictive.rules.prefix_rulesList of enforced prefix rules. Each rule must include pattern and decision.rules.prefix_rules[].patternCommand prefix expressed as pattern tokens. Each token sets either token or any_of.rules.prefix_rules[].pattern[].tokenA single literal token at this position.rules.prefix_rules[].pattern[].any_ofA list of allowed alternative tokens at this position.rules.prefix_rules[].decisionRequired. Requirements rules can only prompt or forbid (not allow).rules.prefix_rules[].justificationOptional non-empty rationale surfaced in approval prompts or rejection messages.同じキーを複数の場所に書いたときは、上にあるものが勝ちます。
managed-settings.json組織が配布claude --settings …そのセッションだけ.claude/settings.local.jsongit に入れない.claude/settings.jsonチームでコミット~/.claude/settings.json全プロジェクト共通配列(allow / deny など)は上書きではなく結合されます。Windows では %USERPROFILE%\.claude\settings.json。一部の項目は ~/.claude.json 側に入ります。
-c key=valueそのセッションだけ.codex/config.toml信頼したプロジェクトのみ~/.codex/<名前>.config.toml--profile で選択~/.codex/config.toml普段はここ/etc/codex/config.toml管理者は requirements.toml で値を強制できます。プロバイダ・通知・テレメトリ系のキーはプロジェクト設定からは無視されます。