Claude Desktop

com.anthropic.claudefordesktop

Claude Desktop enterprise configuration settings

macOS

Configuration Keys (11)

Key	Type	Title	Description	Default	Range
`forceLoginOrgUUID` Require login to belong to a specific organization. Accepts a single UUID string, which also pre-selects that organization during login, or an array of UUIDs where any listed organization is accepted without pre-selection. Login fails if the authenticated account does not belong to a listed organization.	array	Force Login Organization UUID(s)	Require login to belong to a specific organization. Accepts a single UUID string, which also pre-selects that organization during login, or an array of UUIDs where any listed organization is accepted without pre-selection. Login fails if the authenticated account does not belong to a listed organization.	—	—
`disableAutoUpdates` Disable automatic updates for Claude Desktop. Default: false	boolean	Disable Auto Updates	Disable automatic updates for Claude Desktop.	false	—
`autoUpdaterEnforcementHours` Hours before forcefully restarting Claude to apply a prepared update. Must be between 1 and 72 hours. Default: 72 Range: 1 – 72	integer	Auto Update Enforcement Hours	Hours before forcefully restarting Claude to apply a prepared update. Must be between 1 and 72 hours.	72
`isDesktopExtensionEnabled` Enable or disable Claude Desktop extensions. Default: true	boolean	Enable Desktop Extensions	Enable or disable Claude Desktop extensions.	true	—
`isDesktopExtensionDirectoryEnabled` Enable or disable access to the extension directory. Default: true	boolean	Enable Extension Directory	Enable or disable access to the extension directory.	true	—
`isLocalDevMcpEnabled` Enable or disable local Model Context Protocol (MCP) servers. Default: true	boolean	Enable Local MCP Servers	Enable or disable local Model Context Protocol (MCP) servers.	true	—
`isClaudeCodeForDesktopEnabled` Enable Claude code access in desktop. Default: true	boolean	Enable Claude Code for Desktop	Enable Claude code access in desktop.	true	—
`secureVmFeaturesEnabled` Enable Cowork access in desktop Default: true	boolean	Enable Secure VM Features	Enable Cowork access in desktop	true	—
`isDesktopExtensionSignatureRequired` When true, Claude Desktop rejects extensions that aren't signed by a trusted publisher. Default: false	boolean	Require Signed Desktop Extensions	When true, Claude Desktop rejects extensions that aren't signed by a trusted publisher.	false	—
`disabledBuiltinTools` Removes the listed built-in tools from the available set in Claude Desktop. Known tools: Task, Bash, Glob, Grep, Read, Edit, Write, NotebookEdit, WebFetch, TodoWrite, WebSearch, Skill, REPL, JavaScript, AskUserQuestion. ToolSearch and SendUserMessage are also available under specific conditions.	array	Disabled Built-in Tools	Removes the listed built-in tools from the available set in Claude Desktop. Known tools: Task, Bash, Glob, Grep, Read, Edit, Write, NotebookEdit, WebFetch, TodoWrite, WebSearch, Skill, REPL, JavaScript, AskUserQuestion. ToolSearch and SendUserMessage are also available under specific conditions.	—	—
`managedMcpServers` Distributes remote MCP (Model Context Protocol) servers to users. Each entry requires a unique name and an HTTPS URL. Optional fields include transport, headers, OAuth, and tool-level policies. Used in Claude Cowork deployments on third-party platforms (Bedrock, Vertex AI, Azure AI Foundry, LLM gateways).	array	Managed MCP Servers	Distributes remote MCP (Model Context Protocol) servers to users. Each entry requires a unique name and an HTTPS URL. Optional fields include transport, headers, OAuth, and tool-level policies. Used in Claude Cowork deployments on third-party platforms (Bedrock, Vertex AI, Azure AI Foundry, LLM gateways).	—	—
	string	Organization UUID	—	—	—
`disabledBuiltinToolsItem` Name of a built-in tool to disable.	string	Tool	Name of a built-in tool to disable.	—	—
`managedMcpServersItem`	dict	Managed MCP Server	—	—	—
`name`required Unique name identifying this MCP server.	string	Name	Unique name identifying this MCP server.	—	—
`url`required HTTPS URL of the remote MCP server.	string	URL	HTTPS URL of the remote MCP server.	—	—
`transport` Transport protocol used to reach the MCP server. Default: "http" Range: HTTP (http), SSE (sse)	string	Transport	Transport protocol used to reach the MCP server.	"http"
`headers` Static request headers used to authenticate to the MCP server (for example, Authorization). Mutually exclusive with the OAuth field.	dict	Headers	Static request headers used to authenticate to the MCP server (for example, Authorization). Mutually exclusive with the OAuth field.	—	—
`oauth` When true, Claude Desktop runs a PKCE OAuth flow at first use to acquire user credentials. Mutually exclusive with the Headers field. Default: false	boolean	OAuth	When true, Claude Desktop runs a PKCE OAuth flow at first use to acquire user credentials. Mutually exclusive with the Headers field.	false	—
`toolPolicy` Maps tool names exposed by the MCP server to a policy. Allowed values per tool: allow, ask, blocked. The "ask" policy prompts the user to confirm before the tool runs.	dict	Tool Policy	Maps tool names exposed by the MCP server to a policy. Allowed values per tool: allow, ask, blocked. The "ask" policy prompts the user to confirm before the tool runs.	—	—
`{{key}}`	string	Header Name	—	—	—
`{{value}}`	string	Header Value	—	—	—
`{{key}}`	string	Tool Name	—	—	—
`{{value}}` Range: Allow (allow), Ask (ask), Block (blocked)	string	Policy	—	—