{ "$schema": "http://json-schema.org/draft-07/schema#", "$id": "https://claude.com/docs/cowork/3p/schemas/bootstrap-config-v2.schema.json", "$ref": "#/definitions/BootstrapConfig", "definitions": { "BootstrapConfig": { "type": "object", "properties": { "$schemaVersion": { "description": "Marks the nested format. Optional: a response carrying any cluster key is read as nested regardless; set it to state the format explicitly.", "type": "number", "const": 2 }, "expiresAt": { "description": "Unix epoch (seconds or milliseconds) after which the client should re-fetch this document. Optional; when absent the client uses its default refresh interval.", "type": "number", "exclusiveMinimum": 0 }, "inference": { "oneOf": [ { "type": "object", "properties": { "provider": { "type": "string", "const": "gateway", "title": "Inference provider", "description": "Selects the inference backend. Setting this key activates third-party mode.", "x-flatKey": "inferenceProvider", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "baseUrl": { "type": "string", "format": "uri", "title": "Gateway base URL", "description": "Full URL of the inference gateway endpoint.", "x-consentRequired": true, "x-flatKey": "inferenceGatewayBaseUrl", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-originPinned": "server-issued-credential" }, "streamIdleTimeoutSec": { "type": "integer", "minimum": 300, "maximum": 1800, "title": "Stream idle timeout", "description": "Extra seconds to wait for model output on a streaming response that is sending only keep-alive pings. Gateway provider only. Default 300.", "x-flatKey": "inferenceStreamIdleTimeoutSec", "x-availableInVersion": "1.44121.1", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "customHeaders": { "title": "Custom inference headers", "description": "Extra headers on every inference request — routing and tenant headers only (org IDs, Bedrock Guardrails). No credentials; use the credential helper for tokens.", "x-flatKey": "inferenceCustomHeaders", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.8089.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "string" } }, "sessionLifetimeSec": { "title": "Sign-in session lifetime", "description": "How long a sign-in stays valid under your IdP’s session policy. Shows a re-authenticate banner before it expires.", "x-flatKey": "inferenceSessionLifetimeSec", "x-availableInVersion": "1.14271.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991 }, "credential": { "oneOf": [ { "type": "object", "properties": { "kind": { "type": "string", "const": "static", "title": "Credential kind", "description": "Selects the credential source. When set, only that source is used (no fallback).", "x-flatKey": "inferenceCredentialKind", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.8555.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-deprecations": [ { "path": "inferenceCredentialKind: \"interactive\" together with inferenceGatewayOidc (gateway)", "use": "\"external-idp\" once every desktop in the fleet is on a release that reads it", "effect": "the original spelling will keep working (\"interactive\" with inferenceGatewayOidc is read as \"external-idp\"); no end date has been set" } ] }, "apiKey": { "type": "string", "title": "Gateway API key", "description": "API key for the configured inference gateway.", "x-flatKey": "inferenceGatewayApiKey", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "authScheme": { "title": "Gateway auth scheme", "description": "How the gateway credential is sent on the wire (Authorization: Bearer vs x-api-key header).", "default": "bearer", "x-flatKey": "inferenceGatewayAuthScheme", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.3036.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-deprecations": [ { "path": "inferenceGatewayAuthScheme: \"sso\"", "use": "inferenceCredentialKind: \"interactive\"", "effect": "the original spelling will keep working; no end date has been set" } ], "type": "string", "enum": [ "bearer", "x-api-key" ] } }, "required": [ "kind" ] }, { "type": "object", "properties": { "kind": { "type": "string", "const": "interactive", "title": "Credential kind", "description": "Selects the credential source. When set, only that source is used (no fallback).", "x-flatKey": "inferenceCredentialKind", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.8555.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-deprecations": [ { "path": "inferenceCredentialKind: \"interactive\" together with inferenceGatewayOidc (gateway)", "use": "\"external-idp\" once every desktop in the fleet is on a release that reads it", "effect": "the original spelling will keep working (\"interactive\" with inferenceGatewayOidc is read as \"external-idp\"); no end date has been set" } ] }, "authFlow": { "type": "string", "enum": [ "browser", "broker" ], "title": "Gateway sign-in flow", "description": "How the IdP sign-in runs: system browser (default) or the OS Microsoft Entra broker.", "x-flatKey": "inferenceGatewayOidcAuthFlow", "x-availableInVersion": "1.25927.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-deprecations": [ { "path": "inferenceGatewayOidcAuthFlow", "use": "inferenceIdpAuthFlow together with inferenceIdpOidc once every desktop in the fleet is on a release that reads them", "effect": "the original spelling will keep working; no end date has been set" } ] }, "oidc": { "type": "object", "properties": { "clientId": { "type": "string", "minLength": 1, "title": "Client ID", "description": "OAuth client ID of the desktop app registration at your identity provider (public client, PKCE).", "x-consentRequired": false }, "issuer": { "title": "Issuer URL", "description": "HTTPS issuer with OIDC discovery. Set this, or set the authorization and token URLs instead.", "x-consentRequired": false, "type": "string", "format": "uri" }, "authorizationUrl": { "title": "Authorization URL", "description": "HTTPS authorization endpoint. Used with the token URL when no issuer is set.", "x-consentRequired": false, "type": "string", "format": "uri" }, "tokenUrl": { "title": "Token URL", "description": "HTTPS token endpoint. Used with the authorization URL when no issuer is set.", "x-consentRequired": false, "type": "string", "format": "uri" }, "bearerTokenType": { "default": "id_token", "title": "Bearer token", "description": "Which token to send as the bearer. Use access token for a gateway or proxy that validates as an OAuth resource server.", "x-consentRequired": false, "type": "string", "enum": [ "id_token", "access_token" ] }, "scopes": { "title": "Scopes", "description": "Space-separated scopes. Required in access-token mode: set the gateway or proxy API scope. offline_access is appended automatically unless disabled below.", "x-consentRequired": false, "type": "string", "minLength": 1 }, "appendOfflineAccess": { "default": true, "title": "Append offline_access", "description": "Automatically append offline_access to scopes so the IdP returns a refresh token for silent refresh.", "x-consentRequired": false, "type": "boolean", "x-availableInVersionOverride": "1.11847.0" }, "resource": { "title": "Resource indicator (RFC 8707)", "description": "Access-token audience of the gateway or proxy: an https URL or an AD FS relying-party identifier, sent as the RFC 8707 resource. Leave unset for Entra ID.", "x-consentRequired": false, "type": "string", "minLength": 1, "x-availableInVersionOverride": "1.30096.1" }, "redirectPort": { "title": "Redirect port", "description": "Fixed loopback port for the sign-in redirect. Leave unset to use a free port each time.", "x-consentRequired": false, "type": "integer", "minimum": 1024, "maximum": 65535 }, "redirectHost": { "title": "Redirect host", "description": "Use localhost only if your IdP’s registered redirect URI specifies it.", "x-consentRequired": false, "type": "string", "enum": [ "127.0.0.1", "localhost" ], "x-availableInVersionOverride": "2.110.0" }, "additionalRedirectReferrerHosts": { "title": "Additional redirect referrer hosts", "description": "Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host.", "x-consentRequired": false, "type": "string", "x-availableInVersionOverride": "1.20186.0" } }, "required": [ "clientId" ], "title": "Gateway SSO IdP (OIDC)", "description": "External IdP for gateway sign-in. The user’s token from this issuer is sent to the gateway as the Bearer credential.", "x-flatKey": "inferenceGatewayOidc", "x-availableInVersion": "1.6889.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "x-deprecations": [ { "path": "inferenceGatewayOidc", "use": "inferenceIdpOidc with inferenceCredentialKind: \"external-idp\" once every desktop in the fleet is on a release that reads them", "effect": "the original spelling will keep working; no end date has been set" } ] } }, "required": [ "kind" ] }, { "type": "object", "properties": { "kind": { "type": "string", "const": "external-idp", "title": "Credential kind", "description": "Selects the credential source. When set, only that source is used (no fallback).", "x-flatKey": "inferenceCredentialKind", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.8555.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-deprecations": [ { "path": "inferenceCredentialKind: \"interactive\" together with inferenceGatewayOidc (gateway)", "use": "\"external-idp\" once every desktop in the fleet is on a release that reads it", "effect": "the original spelling will keep working (\"interactive\" with inferenceGatewayOidc is read as \"external-idp\"); no end date has been set" } ], "x-valueAvailableInVersionOverride": [ { "value": "external-idp", "availableInVersion": "2.7032.0" } ] }, "authFlow": { "type": "string", "enum": [ "browser", "broker" ], "title": "Identity provider sign-in flow", "description": "How the identity-provider sign-in runs: system browser (default) or the OS Microsoft Entra broker.", "x-flatKey": "inferenceIdpAuthFlow", "x-availableInVersion": "2.7032.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "oidc": { "type": "object", "properties": { "clientId": { "type": "string", "minLength": 1, "title": "Client ID", "description": "OAuth client ID of the desktop app registration at your identity provider (public client, PKCE).", "x-consentRequired": false }, "issuer": { "title": "Issuer URL", "description": "HTTPS issuer with OIDC discovery. Set this, or set the authorization and token URLs instead.", "x-consentRequired": false, "type": "string", "format": "uri" }, "authorizationUrl": { "title": "Authorization URL", "description": "HTTPS authorization endpoint. Used with the token URL when no issuer is set.", "x-consentRequired": false, "type": "string", "format": "uri" }, "tokenUrl": { "title": "Token URL", "description": "HTTPS token endpoint. Used with the authorization URL when no issuer is set.", "x-consentRequired": false, "type": "string", "format": "uri" }, "bearerTokenType": { "default": "id_token", "title": "Bearer token", "description": "Which token to send as the bearer. Use access token for a gateway or proxy that validates as an OAuth resource server.", "x-consentRequired": false, "type": "string", "enum": [ "id_token", "access_token" ] }, "scopes": { "title": "Scopes", "description": "Space-separated scopes. Required in access-token mode: set the gateway or proxy API scope. offline_access is appended automatically unless disabled below.", "x-consentRequired": false, "type": "string", "minLength": 1 }, "appendOfflineAccess": { "default": true, "title": "Append offline_access", "description": "Automatically append offline_access to scopes so the IdP returns a refresh token for silent refresh.", "x-consentRequired": false, "type": "boolean" }, "resource": { "title": "Resource indicator (RFC 8707)", "description": "Access-token audience of the gateway or proxy: an https URL or an AD FS relying-party identifier, sent as the RFC 8707 resource. Leave unset for Entra ID.", "x-consentRequired": false, "type": "string", "minLength": 1 }, "redirectPort": { "title": "Redirect port", "description": "Fixed loopback port for the sign-in redirect. Leave unset to use a free port each time.", "x-consentRequired": false, "type": "integer", "minimum": 1024, "maximum": 65535 }, "redirectHost": { "title": "Redirect host", "description": "Use localhost only if your IdP’s registered redirect URI specifies it.", "x-consentRequired": false, "type": "string", "enum": [ "127.0.0.1", "localhost" ] }, "additionalRedirectReferrerHosts": { "title": "Additional redirect referrer hosts", "description": "Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host.", "x-consentRequired": false, "type": "string" } }, "required": [ "clientId" ], "title": "Identity provider (OIDC)", "description": "Your organization’s OpenID Connect identity provider. The user’s token is sent as the Bearer credential to the gateway or the Bedrock proxy.", "x-flatKey": "inferenceIdpOidc", "x-availableInVersion": "2.7032.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false } }, "required": [ "kind" ] }, { "type": "object", "properties": { "kind": { "type": "string", "const": "helper-script", "title": "Credential kind", "description": "Selects the credential source. When set, only that source is used (no fallback).", "x-flatKey": "inferenceCredentialKind", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.8555.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-deprecations": [ { "path": "inferenceCredentialKind: \"interactive\" together with inferenceGatewayOidc (gateway)", "use": "\"external-idp\" once every desktop in the fleet is on a release that reads it", "effect": "the original spelling will keep working (\"interactive\" with inferenceGatewayOidc is read as \"external-idp\"); no end date has been set" } ] }, "command": { "title": "Helper script", "description": "Absolute path to an executable that prints the credential, optionally with per-request headers.", "x-flatKey": "inferenceCredentialHelper", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "string" }, "commandWindows": { "title": "Helper script (Windows)", "description": "Absolute path of the helper executable on Windows devices, used there instead of Helper script. Leave unset to use Helper script on every operating system.", "x-flatKey": "inferenceCredentialHelperWindows", "x-availableInVersion": "2.2553.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "string", "minLength": 1, "pattern": "^[A-Za-z]:[\\\\/]" }, "args": { "title": "Helper script arguments", "description": "Arguments passed to the helper script, one per entry, in order. Leave unset to run it with none.", "x-flatKey": "inferenceCredentialHelperArgs", "x-availableInVersion": "2.110.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "array", "items": { "type": "string", "maxLength": 1024, "pattern": "^[^\"%\\x00-\\x1f]+$" } }, "ttlSec": { "title": "Helper script TTL", "description": "Helper output is cached for this many seconds; once it expires the helper re-runs without a relaunch (before the next turn when set above 120).", "default": 3600, "x-flatKey": "inferenceCredentialHelperTtlSec", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991 }, "timeoutSec": { "title": "Credential helper timeout", "description": "Maximum wait for the helper executable to finish. Raise this if the helper opens a browser for interactive sign-in.", "default": 60, "x-flatKey": "inferenceCredentialHelperTimeoutSec", "x-availableInVersion": "1.8089.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "integer", "exclusiveMinimum": 0, "maximum": 600 }, "silentRefreshEnabled": { "title": "Re-run helper for silent refresh", "description": "On credential expiry, re-run the helper (CLAUDE_HELPER_CONTEXT=mid-session-refresh) to recover silently. Turn off if the helper can’t run non-interactively.", "default": true, "x-flatKey": "inferenceCredentialHelperSilentRefreshEnabled", "x-whenUnreadable": { "applies": false }, "x-availableInVersion": "1.10628.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "boolean" }, "awsEnv": { "type": "object", "properties": { "profile": { "type": "string", "title": "AWS profile name", "description": "Passed to the helper script as AWS_PROFILE.", "x-flatKey": "inferenceBedrockProfile", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "x-alias": true }, "awsDir": { "type": "string", "title": "AWS config directory", "description": "Directory holding the AWS config and credentials files. Passed to the helper script as AWS_CONFIG_FILE and AWS_SHARED_CREDENTIALS_FILE.", "x-flatKey": "inferenceBedrockAwsDir", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "x-alias": true }, "awsCliPath": { "type": "string", "title": "AWS CLI path", "description": "Absolute path to the aws executable, shared with the Bedrock profile setting. Not passed to the helper script.", "x-flatKey": "inferenceBedrockAwsCliPath", "x-availableInVersion": "1.13576.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "x-alias": true }, "region": { "type": "string", "pattern": "^[a-z]{2,}(-[a-z]+)+-\\d{1,2}$", "title": "AWS region", "description": "Passed to the helper script as AWS_REGION.", "x-flatKey": "inferenceBedrockRegion", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-alias": true } } }, "authScheme": { "title": "Gateway auth scheme", "description": "How the gateway credential is sent on the wire (Authorization: Bearer vs x-api-key header).", "default": "bearer", "x-flatKey": "inferenceGatewayAuthScheme", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.3036.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-deprecations": [ { "path": "inferenceGatewayAuthScheme: \"sso\"", "use": "inferenceCredentialKind: \"interactive\"", "effect": "the original spelling will keep working; no end date has been set" } ], "type": "string", "enum": [ "bearer", "x-api-key" ] } }, "required": [ "kind" ] } ] } }, "required": [ "provider" ] }, { "type": "object", "properties": { "provider": { "type": "string", "const": "anthropic", "title": "Inference provider", "description": "Selects the inference backend. Setting this key activates third-party mode.", "x-flatKey": "inferenceProvider", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "customHeaders": { "title": "Custom inference headers", "description": "Extra headers on every inference request — routing and tenant headers only (org IDs, Bedrock Guardrails). No credentials; use the credential helper for tokens.", "x-flatKey": "inferenceCustomHeaders", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.8089.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "string" } }, "sessionLifetimeSec": { "title": "Sign-in session lifetime", "description": "How long a sign-in stays valid under your IdP’s session policy. Shows a re-authenticate banner before it expires.", "x-flatKey": "inferenceSessionLifetimeSec", "x-availableInVersion": "1.14271.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991 }, "credential": { "oneOf": [ { "type": "object", "properties": { "kind": { "type": "string", "const": "static", "title": "Credential kind", "description": "Selects the credential source. When set, only that source is used (no fallback).", "x-flatKey": "inferenceCredentialKind", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.8555.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "apiKey": { "type": "string", "title": "Claude API key", "description": "Leave blank to fetch a key via browser sign-in, or to supply the key via a credential helper.", "x-flatKey": "inferenceAnthropicApiKey", "x-availableInVersion": "1.8089.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false } }, "required": [ "kind" ] }, { "type": "object", "properties": { "kind": { "type": "string", "const": "interactive", "title": "Credential kind", "description": "Selects the credential source. When set, only that source is used (no fallback).", "x-flatKey": "inferenceCredentialKind", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.8555.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false } }, "required": [ "kind" ] }, { "type": "object", "properties": { "kind": { "type": "string", "const": "helper-script", "title": "Credential kind", "description": "Selects the credential source. When set, only that source is used (no fallback).", "x-flatKey": "inferenceCredentialKind", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.8555.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "command": { "title": "Helper script", "description": "Absolute path to an executable that prints the credential, optionally with per-request headers.", "x-flatKey": "inferenceCredentialHelper", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "string" }, "commandWindows": { "title": "Helper script (Windows)", "description": "Absolute path of the helper executable on Windows devices, used there instead of Helper script. Leave unset to use Helper script on every operating system.", "x-flatKey": "inferenceCredentialHelperWindows", "x-availableInVersion": "2.2553.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "string", "minLength": 1, "pattern": "^[A-Za-z]:[\\\\/]" }, "args": { "title": "Helper script arguments", "description": "Arguments passed to the helper script, one per entry, in order. Leave unset to run it with none.", "x-flatKey": "inferenceCredentialHelperArgs", "x-availableInVersion": "2.110.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "array", "items": { "type": "string", "maxLength": 1024, "pattern": "^[^\"%\\x00-\\x1f]+$" } }, "ttlSec": { "title": "Helper script TTL", "description": "Helper output is cached for this many seconds; once it expires the helper re-runs without a relaunch (before the next turn when set above 120).", "default": 3600, "x-flatKey": "inferenceCredentialHelperTtlSec", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991 }, "timeoutSec": { "title": "Credential helper timeout", "description": "Maximum wait for the helper executable to finish. Raise this if the helper opens a browser for interactive sign-in.", "default": 60, "x-flatKey": "inferenceCredentialHelperTimeoutSec", "x-availableInVersion": "1.8089.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "integer", "exclusiveMinimum": 0, "maximum": 600 }, "silentRefreshEnabled": { "title": "Re-run helper for silent refresh", "description": "On credential expiry, re-run the helper (CLAUDE_HELPER_CONTEXT=mid-session-refresh) to recover silently. Turn off if the helper can’t run non-interactively.", "default": true, "x-flatKey": "inferenceCredentialHelperSilentRefreshEnabled", "x-whenUnreadable": { "applies": false }, "x-availableInVersion": "1.10628.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "boolean" }, "awsEnv": { "type": "object", "properties": { "profile": { "type": "string", "title": "AWS profile name", "description": "Passed to the helper script as AWS_PROFILE.", "x-flatKey": "inferenceBedrockProfile", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "x-alias": true }, "awsDir": { "type": "string", "title": "AWS config directory", "description": "Directory holding the AWS config and credentials files. Passed to the helper script as AWS_CONFIG_FILE and AWS_SHARED_CREDENTIALS_FILE.", "x-flatKey": "inferenceBedrockAwsDir", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "x-alias": true }, "awsCliPath": { "type": "string", "title": "AWS CLI path", "description": "Absolute path to the aws executable, shared with the Bedrock profile setting. Not passed to the helper script.", "x-flatKey": "inferenceBedrockAwsCliPath", "x-availableInVersion": "1.13576.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "x-alias": true }, "region": { "type": "string", "pattern": "^[a-z]{2,}(-[a-z]+)+-\\d{1,2}$", "title": "AWS region", "description": "Passed to the helper script as AWS_REGION.", "x-flatKey": "inferenceBedrockRegion", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-alias": true } } } }, "required": [ "kind" ] } ] } }, "required": [ "provider" ] }, { "type": "object", "properties": { "provider": { "type": "string", "const": "bedrock", "title": "Inference provider", "description": "Selects the inference backend. Setting this key activates third-party mode.", "x-flatKey": "inferenceProvider", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "region": { "title": "AWS region", "description": "AWS region for the Bedrock runtime endpoint.", "x-flatKey": "inferenceBedrockRegion", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "type": "string", "pattern": "^[a-z]{2,}(-[a-z]+)+-\\d{1,2}$" }, "baseUrl": { "title": "Bedrock base URL", "description": "For VPC endpoints or gateway proxies. Host origin only.", "x-flatKey": "inferenceBedrockBaseUrl", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": "local-credential", "type": "string", "format": "uri" }, "serviceTier": { "type": "string", "enum": [ "flex", "priority" ], "title": "Bedrock service tier", "description": "Sent as the X-Amzn-Bedrock-Service-Tier header. Leave unset for on-demand.", "x-flatKey": "inferenceBedrockServiceTier", "x-availableInVersion": "1.5186.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "customHeaders": { "title": "Custom inference headers", "description": "Extra headers on every inference request — routing and tenant headers only (org IDs, Bedrock Guardrails). No credentials; use the credential helper for tokens.", "x-flatKey": "inferenceCustomHeaders", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.8089.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "string" } }, "sessionLifetimeSec": { "title": "Sign-in session lifetime", "description": "How long a sign-in stays valid under your IdP’s session policy. Shows a re-authenticate banner before it expires.", "x-flatKey": "inferenceSessionLifetimeSec", "x-availableInVersion": "1.14271.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991 }, "credential": { "oneOf": [ { "type": "object", "properties": { "kind": { "type": "string", "const": "static", "title": "Credential kind", "description": "Selects the credential source. When set, only that source is used (no fallback).", "x-flatKey": "inferenceCredentialKind", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.8555.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "bearerToken": { "type": "string", "title": "AWS bearer token", "description": "Static bearer token for inference. For providers that support profile or helper-script credentials, prefer those.", "x-flatKey": "inferenceBedrockBearerToken", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false } }, "required": [ "kind" ] }, { "type": "object", "properties": { "kind": { "type": "string", "const": "interactive", "title": "Credential kind", "description": "Selects the credential source. When set, only that source is used (no fallback).", "x-flatKey": "inferenceCredentialKind", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.8555.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "ssoStartUrl": { "type": "string", "format": "uri", "title": "AWS SSO start URL", "description": "Enables in-app AWS sign-in (no AWS CLI needed). Set with the three SSO fields below.", "x-flatKey": "inferenceBedrockSsoStartUrl", "x-availableInVersion": "1.6259.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "ssoRegion": { "type": "string", "pattern": "^[a-z]{2,}(-[a-z]+)+-\\d{1,2}$", "title": "AWS SSO region", "description": "IAM Identity Center home region.", "x-flatKey": "inferenceBedrockSsoRegion", "x-availableInVersion": "1.6259.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "ssoAccountId": { "type": "string", "minLength": 1, "title": "AWS SSO account ID", "description": "12-digit AWS account ID assigned to users in IAM Identity Center.", "x-flatKey": "inferenceBedrockSsoAccountId", "x-availableInVersion": "1.6259.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "ssoRoleName": { "type": "string", "minLength": 1, "title": "AWS SSO role name", "description": "IAM Identity Center permission-set name granting bedrock:InvokeModel* on the account above.", "x-flatKey": "inferenceBedrockSsoRoleName", "x-availableInVersion": "1.6259.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false } }, "required": [ "kind" ] }, { "type": "object", "properties": { "kind": { "type": "string", "const": "vendor-profile", "title": "Credential kind", "description": "Selects the credential source. When set, only that source is used (no fallback).", "x-flatKey": "inferenceCredentialKind", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.8555.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "profile": { "type": "string", "title": "AWS profile name", "description": "AWS named profile to use for Bedrock inference credentials.", "x-flatKey": "inferenceBedrockProfile", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "awsDir": { "type": "string", "title": "AWS config directory", "description": "Folder with AWS config/credentials. Defaults to ~/.aws when no bearer token is set.", "x-flatKey": "inferenceBedrockAwsDir", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "awsCliPath": { "type": "string", "title": "AWS CLI path", "description": "Absolute path to the aws executable. Leave unset to find it on PATH.", "x-flatKey": "inferenceBedrockAwsCliPath", "x-availableInVersion": "1.13576.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false } }, "required": [ "kind" ] }, { "type": "object", "properties": { "kind": { "type": "string", "const": "external-idp", "title": "Credential kind", "description": "Selects the credential source. When set, only that source is used (no fallback).", "x-flatKey": "inferenceCredentialKind", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.8555.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-valueAvailableInVersionOverride": [ { "value": "external-idp", "availableInVersion": "2.7032.0" } ] }, "authFlow": { "type": "string", "enum": [ "browser", "broker" ], "title": "Identity provider sign-in flow", "description": "How the identity-provider sign-in runs: system browser (default) or the OS Microsoft Entra broker.", "x-flatKey": "inferenceIdpAuthFlow", "x-availableInVersion": "2.7032.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "oidc": { "type": "object", "properties": { "clientId": { "type": "string", "minLength": 1, "title": "Client ID", "description": "OAuth client ID of the desktop app registration at your identity provider (public client, PKCE).", "x-consentRequired": false }, "issuer": { "title": "Issuer URL", "description": "HTTPS issuer with OIDC discovery. Set this, or set the authorization and token URLs instead.", "x-consentRequired": false, "type": "string", "format": "uri" }, "authorizationUrl": { "title": "Authorization URL", "description": "HTTPS authorization endpoint. Used with the token URL when no issuer is set.", "x-consentRequired": false, "type": "string", "format": "uri" }, "tokenUrl": { "title": "Token URL", "description": "HTTPS token endpoint. Used with the authorization URL when no issuer is set.", "x-consentRequired": false, "type": "string", "format": "uri" }, "bearerTokenType": { "default": "id_token", "title": "Bearer token", "description": "Which token to send as the bearer. Use access token for a gateway or proxy that validates as an OAuth resource server.", "x-consentRequired": false, "type": "string", "enum": [ "id_token", "access_token" ] }, "scopes": { "title": "Scopes", "description": "Space-separated scopes. Required in access-token mode: set the gateway or proxy API scope. offline_access is appended automatically unless disabled below.", "x-consentRequired": false, "type": "string", "minLength": 1 }, "appendOfflineAccess": { "default": true, "title": "Append offline_access", "description": "Automatically append offline_access to scopes so the IdP returns a refresh token for silent refresh.", "x-consentRequired": false, "type": "boolean" }, "resource": { "title": "Resource indicator (RFC 8707)", "description": "Access-token audience of the gateway or proxy: an https URL or an AD FS relying-party identifier, sent as the RFC 8707 resource. Leave unset for Entra ID.", "x-consentRequired": false, "type": "string", "minLength": 1 }, "redirectPort": { "title": "Redirect port", "description": "Fixed loopback port for the sign-in redirect. Leave unset to use a free port each time.", "x-consentRequired": false, "type": "integer", "minimum": 1024, "maximum": 65535 }, "redirectHost": { "title": "Redirect host", "description": "Use localhost only if your IdP’s registered redirect URI specifies it.", "x-consentRequired": false, "type": "string", "enum": [ "127.0.0.1", "localhost" ] }, "additionalRedirectReferrerHosts": { "title": "Additional redirect referrer hosts", "description": "Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host.", "x-consentRequired": false, "type": "string" } }, "required": [ "clientId" ], "title": "Identity provider (OIDC)", "description": "Your organization’s OpenID Connect identity provider. The user’s token is sent as the Bearer credential to the gateway or the Bedrock proxy.", "x-flatKey": "inferenceIdpOidc", "x-availableInVersion": "2.7032.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false } }, "required": [ "kind" ] }, { "type": "object", "properties": { "kind": { "type": "string", "const": "helper-script", "title": "Credential kind", "description": "Selects the credential source. When set, only that source is used (no fallback).", "x-flatKey": "inferenceCredentialKind", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.8555.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "command": { "title": "Helper script", "description": "Absolute path to an executable that prints the credential, optionally with per-request headers.", "x-flatKey": "inferenceCredentialHelper", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "string" }, "commandWindows": { "title": "Helper script (Windows)", "description": "Absolute path of the helper executable on Windows devices, used there instead of Helper script. Leave unset to use Helper script on every operating system.", "x-flatKey": "inferenceCredentialHelperWindows", "x-availableInVersion": "2.2553.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "string", "minLength": 1, "pattern": "^[A-Za-z]:[\\\\/]" }, "args": { "title": "Helper script arguments", "description": "Arguments passed to the helper script, one per entry, in order. Leave unset to run it with none.", "x-flatKey": "inferenceCredentialHelperArgs", "x-availableInVersion": "2.110.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "array", "items": { "type": "string", "maxLength": 1024, "pattern": "^[^\"%\\x00-\\x1f]+$" } }, "ttlSec": { "title": "Helper script TTL", "description": "Helper output is cached for this many seconds; once it expires the helper re-runs without a relaunch (before the next turn when set above 120).", "default": 3600, "x-flatKey": "inferenceCredentialHelperTtlSec", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991 }, "timeoutSec": { "title": "Credential helper timeout", "description": "Maximum wait for the helper executable to finish. Raise this if the helper opens a browser for interactive sign-in.", "default": 60, "x-flatKey": "inferenceCredentialHelperTimeoutSec", "x-availableInVersion": "1.8089.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "integer", "exclusiveMinimum": 0, "maximum": 600 }, "silentRefreshEnabled": { "title": "Re-run helper for silent refresh", "description": "On credential expiry, re-run the helper (CLAUDE_HELPER_CONTEXT=mid-session-refresh) to recover silently. Turn off if the helper can’t run non-interactively.", "default": true, "x-flatKey": "inferenceCredentialHelperSilentRefreshEnabled", "x-whenUnreadable": { "applies": false }, "x-availableInVersion": "1.10628.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "boolean" }, "awsEnv": { "type": "object", "properties": { "profile": { "type": "string", "title": "AWS profile name", "description": "Passed to the helper script as AWS_PROFILE.", "x-flatKey": "inferenceBedrockProfile", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "x-alias": true }, "awsDir": { "type": "string", "title": "AWS config directory", "description": "Directory holding the AWS config and credentials files. Passed to the helper script as AWS_CONFIG_FILE and AWS_SHARED_CREDENTIALS_FILE.", "x-flatKey": "inferenceBedrockAwsDir", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "x-alias": true }, "awsCliPath": { "type": "string", "title": "AWS CLI path", "description": "Absolute path to the aws executable, shared with the Bedrock profile setting. Not passed to the helper script.", "x-flatKey": "inferenceBedrockAwsCliPath", "x-availableInVersion": "1.13576.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "x-alias": true }, "region": { "type": "string", "pattern": "^[a-z]{2,}(-[a-z]+)+-\\d{1,2}$", "title": "AWS region", "description": "Passed to the helper script as AWS_REGION.", "x-flatKey": "inferenceBedrockRegion", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-alias": true } } } }, "required": [ "kind" ] } ] } }, "required": [ "provider" ] }, { "type": "object", "properties": { "provider": { "type": "string", "const": "mantle", "title": "Inference provider", "description": "Selects the inference backend. Setting this key activates third-party mode.", "x-flatKey": "inferenceProvider", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-valueAvailableInVersionOverride": [ { "value": "mantle", "availableInVersion": "1.13576.0" } ] }, "region": { "title": "AWS region", "description": "AWS region for the Bedrock runtime endpoint.", "x-flatKey": "inferenceBedrockRegion", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "type": "string", "pattern": "^[a-z]{2,}(-[a-z]+)+-\\d{1,2}$" }, "baseUrl": { "title": "Bedrock base URL", "description": "For VPC endpoints or gateway proxies. Host origin only.", "x-flatKey": "inferenceBedrockBaseUrl", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": "local-credential", "type": "string", "format": "uri" }, "customHeaders": { "title": "Custom inference headers", "description": "Extra headers on every inference request — routing and tenant headers only (org IDs, Bedrock Guardrails). No credentials; use the credential helper for tokens.", "x-flatKey": "inferenceCustomHeaders", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.8089.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "string" } }, "sessionLifetimeSec": { "title": "Sign-in session lifetime", "description": "How long a sign-in stays valid under your IdP’s session policy. Shows a re-authenticate banner before it expires.", "x-flatKey": "inferenceSessionLifetimeSec", "x-availableInVersion": "1.14271.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991 }, "credential": { "oneOf": [ { "type": "object", "properties": { "kind": { "type": "string", "const": "static", "title": "Credential kind", "description": "Selects the credential source. When set, only that source is used (no fallback).", "x-flatKey": "inferenceCredentialKind", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.8555.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "bearerToken": { "type": "string", "title": "AWS bearer token", "description": "Static bearer token for inference. For providers that support profile or helper-script credentials, prefer those.", "x-flatKey": "inferenceBedrockBearerToken", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false } }, "required": [ "kind" ] }, { "type": "object", "properties": { "kind": { "type": "string", "const": "helper-script", "title": "Credential kind", "description": "Selects the credential source. When set, only that source is used (no fallback).", "x-flatKey": "inferenceCredentialKind", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.8555.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "command": { "title": "Helper script", "description": "Absolute path to an executable that prints the credential, optionally with per-request headers.", "x-flatKey": "inferenceCredentialHelper", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "string" }, "commandWindows": { "title": "Helper script (Windows)", "description": "Absolute path of the helper executable on Windows devices, used there instead of Helper script. Leave unset to use Helper script on every operating system.", "x-flatKey": "inferenceCredentialHelperWindows", "x-availableInVersion": "2.2553.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "string", "minLength": 1, "pattern": "^[A-Za-z]:[\\\\/]" }, "args": { "title": "Helper script arguments", "description": "Arguments passed to the helper script, one per entry, in order. Leave unset to run it with none.", "x-flatKey": "inferenceCredentialHelperArgs", "x-availableInVersion": "2.110.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "array", "items": { "type": "string", "maxLength": 1024, "pattern": "^[^\"%\\x00-\\x1f]+$" } }, "ttlSec": { "title": "Helper script TTL", "description": "Helper output is cached for this many seconds; once it expires the helper re-runs without a relaunch (before the next turn when set above 120).", "default": 3600, "x-flatKey": "inferenceCredentialHelperTtlSec", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991 }, "timeoutSec": { "title": "Credential helper timeout", "description": "Maximum wait for the helper executable to finish. Raise this if the helper opens a browser for interactive sign-in.", "default": 60, "x-flatKey": "inferenceCredentialHelperTimeoutSec", "x-availableInVersion": "1.8089.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "integer", "exclusiveMinimum": 0, "maximum": 600 }, "silentRefreshEnabled": { "title": "Re-run helper for silent refresh", "description": "On credential expiry, re-run the helper (CLAUDE_HELPER_CONTEXT=mid-session-refresh) to recover silently. Turn off if the helper can’t run non-interactively.", "default": true, "x-flatKey": "inferenceCredentialHelperSilentRefreshEnabled", "x-whenUnreadable": { "applies": false }, "x-availableInVersion": "1.10628.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "boolean" }, "awsEnv": { "type": "object", "properties": { "profile": { "type": "string", "title": "AWS profile name", "description": "Passed to the helper script as AWS_PROFILE.", "x-flatKey": "inferenceBedrockProfile", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "x-alias": true }, "awsDir": { "type": "string", "title": "AWS config directory", "description": "Directory holding the AWS config and credentials files. Passed to the helper script as AWS_CONFIG_FILE and AWS_SHARED_CREDENTIALS_FILE.", "x-flatKey": "inferenceBedrockAwsDir", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "x-alias": true }, "awsCliPath": { "type": "string", "title": "AWS CLI path", "description": "Absolute path to the aws executable, shared with the Bedrock profile setting. Not passed to the helper script.", "x-flatKey": "inferenceBedrockAwsCliPath", "x-availableInVersion": "1.13576.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "x-alias": true }, "region": { "type": "string", "pattern": "^[a-z]{2,}(-[a-z]+)+-\\d{1,2}$", "title": "AWS region", "description": "Passed to the helper script as AWS_REGION.", "x-flatKey": "inferenceBedrockRegion", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-alias": true } } } }, "required": [ "kind" ] } ] } }, "required": [ "provider" ] }, { "type": "object", "properties": { "provider": { "type": "string", "const": "vertex", "title": "Inference provider", "description": "Selects the inference backend. Setting this key activates third-party mode.", "x-flatKey": "inferenceProvider", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "projectId": { "type": "string", "pattern": "^[a-z0-9][a-z0-9.:-]*$", "title": "GCP project ID", "description": "Google Cloud project ID for Vertex AI inference.", "x-flatKey": "inferenceVertexProjectId", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "region": { "type": "string", "pattern": "^([a-z]+-[a-z]+\\d{1,2}|global|eu|us)$", "title": "GCP region", "description": "GCP region where your Vertex AI Claude models are deployed.", "x-flatKey": "inferenceVertexRegion", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "baseUrl": { "type": "string", "format": "uri", "title": "Vertex AI base URL", "description": "PSC endpoint, if using one.", "x-consentRequired": true, "x-flatKey": "inferenceVertexBaseUrl", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-originPinned": "local-credential" }, "customHeaders": { "title": "Custom inference headers", "description": "Extra headers on every inference request — routing and tenant headers only (org IDs, Bedrock Guardrails). No credentials; use the credential helper for tokens.", "x-flatKey": "inferenceCustomHeaders", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.8089.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "string" } }, "sessionLifetimeSec": { "title": "Sign-in session lifetime", "description": "How long a sign-in stays valid under your IdP’s session policy. Shows a re-authenticate banner before it expires.", "x-flatKey": "inferenceSessionLifetimeSec", "x-availableInVersion": "1.14271.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991 }, "credential": { "oneOf": [ { "type": "object", "properties": { "kind": { "type": "string", "title": "Credential kind", "description": "Selects the credential source. When set, only that source is used (no fallback).", "x-flatKey": "inferenceCredentialKind", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.8555.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-deprecations": [ { "path": "inferenceCredentialKind: \"oauth\" (Vertex AI)", "use": "\"interactive\" — the same Google sign-in under its new name (in hosted or nested documents, switch once every desktop is on a release that knows the Vertex \"interactive\" kind)", "effect": "\"oauth\" will no longer be a Vertex AI credential kind: the value will be reported as invalid and ignored — the device will then derive the kind from the credential fields present (Google sign-in when an OAuth client id is set), and the hosted editor will refuse to save the configuration until the kind is changed", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" }, { "path": "inferenceCredentialKind: \"interactive\" together with inferenceVertexWorkforceAudience (Vertex AI)", "use": "\"workforce\" — or remove inferenceVertexWorkforceAudience if Google sign-in (\"interactive\") is what is meant", "effect": "the audience will no longer imply Workforce Identity: the kind will stay \"interactive\" (Google sign-in), which needs inferenceVertexOAuthClientId — without it the configuration will be reported as incomplete and inference will not start", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ], "enum": [ "interactive", "oauth" ], "x-deprecatedValues": [ { "value": "oauth", "use": "interactive", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ], "x-valueAvailableInVersionOverride": [ { "value": "oauth", "availableInVersion": "1.15200.0" } ] }, "clientId": { "type": "string", "minLength": 1, "title": "Vertex OAuth client ID", "description": "Desktop-app OAuth client ID. Enables Sign in with Google instead of a credentials file.", "x-flatKey": "inferenceVertexOAuthClientId", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "clientSecret": { "type": "string", "minLength": 1, "title": "Vertex OAuth client secret", "description": "Secret for the Desktop-app OAuth client above. Google classifies installed-app client secrets as non-confidential, so this may be set from hosted config.", "x-flatKey": "inferenceVertexOAuthClientSecret", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "scopes": { "type": "string", "minLength": 1, "title": "Vertex OAuth scopes", "description": "Override the Google OAuth scopes (space-separated). Leave blank for the default.", "x-flatKey": "inferenceVertexOAuthScopes", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "loginHint": { "type": "string", "minLength": 1, "title": "Vertex OAuth login hint", "description": "Pre-fill Google's account chooser and forward to your federated IdP. {username} expands to the OS login name.", "x-flatKey": "inferenceVertexOAuthLoginHint", "x-availableInVersion": "1.12603.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false } }, "required": [ "kind" ] }, { "type": "object", "properties": { "kind": { "type": "string", "const": "workforce", "title": "Credential kind", "description": "Selects the credential source. When set, only that source is used (no fallback).", "x-flatKey": "inferenceCredentialKind", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.8555.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-deprecations": [ { "path": "inferenceCredentialKind: \"oauth\" (Vertex AI)", "use": "\"interactive\" — the same Google sign-in under its new name (in hosted or nested documents, switch once every desktop is on a release that knows the Vertex \"interactive\" kind)", "effect": "\"oauth\" will no longer be a Vertex AI credential kind: the value will be reported as invalid and ignored — the device will then derive the kind from the credential fields present (Google sign-in when an OAuth client id is set), and the hosted editor will refuse to save the configuration until the kind is changed", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" }, { "path": "inferenceCredentialKind: \"interactive\" together with inferenceVertexWorkforceAudience (Vertex AI)", "use": "\"workforce\" — or remove inferenceVertexWorkforceAudience if Google sign-in (\"interactive\") is what is meant", "effect": "the audience will no longer imply Workforce Identity: the kind will stay \"interactive\" (Google sign-in), which needs inferenceVertexOAuthClientId — without it the configuration will be reported as incomplete and inference will not start", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ], "x-valueAvailableInVersionOverride": [ { "value": "workforce", "availableInVersion": "1.15200.0" } ] }, "audience": { "type": "string", "minLength": 1, "title": "Workforce Identity audience", "description": "Workforce-pool provider audience. When set, sign-in uses your own IdP plus a GCP STS exchange instead of a Google identity.", "x-flatKey": "inferenceVertexWorkforceAudience", "x-availableInVersion": "1.10628.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "userProject": { "type": "string", "pattern": "^[a-z0-9][a-z0-9.:-]*$", "title": "Workforce Identity billing project", "description": "GCP project for STS billing and quota. Defaults to the Vertex project ID above.", "x-flatKey": "inferenceVertexWorkforceUserProject", "x-availableInVersion": "1.10628.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "authFlow": { "type": "string", "enum": [ "browser", "broker" ], "title": "Workforce Identity sign-in flow", "description": "How the IdP sign-in runs: system browser (default) or the OS Microsoft Entra broker.", "x-flatKey": "inferenceVertexWorkforceAuthFlow", "x-availableInVersion": "1.25927.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "oidc": { "type": "object", "properties": { "clientId": { "type": "string", "minLength": 1, "title": "Client ID", "description": "OAuth client ID of the desktop app registration at your identity provider (public client, PKCE).", "x-consentRequired": false }, "issuer": { "title": "Issuer URL", "description": "HTTPS issuer with OIDC discovery. Set this, or set the authorization and token URLs instead.", "x-consentRequired": false, "type": "string", "format": "uri" }, "authorizationUrl": { "title": "Authorization URL", "description": "HTTPS authorization endpoint. Used with the token URL when no issuer is set.", "x-consentRequired": false, "type": "string", "format": "uri" }, "tokenUrl": { "title": "Token URL", "description": "HTTPS token endpoint. Used with the authorization URL when no issuer is set.", "x-consentRequired": false, "type": "string", "format": "uri" }, "scopes": { "title": "Scopes", "description": "Space-separated scopes. Defaults to openid profile email offline_access.", "x-consentRequired": false, "type": "string", "minLength": 1 }, "redirectPort": { "title": "Redirect port", "description": "Fixed loopback port for the sign-in redirect. Leave unset to use a free port each time.", "x-consentRequired": false, "type": "integer", "minimum": 1024, "maximum": 65535 }, "redirectHost": { "title": "Redirect host", "description": "Use localhost only if your IdP’s registered redirect URI specifies it.", "x-consentRequired": false, "type": "string", "enum": [ "127.0.0.1", "localhost" ], "x-availableInVersionOverride": "2.110.0" }, "omitOfflineAccess": { "title": "Omit offline_access", "description": "Only enable if your IdP rejects the offline_access scope on this client. Without it the app prompts for sign-in each time the token expires.", "x-consentRequired": false, "type": "boolean", "x-availableInVersionOverride": "1.17377.1" }, "additionalRedirectReferrerHosts": { "title": "Additional redirect referrer hosts", "description": "Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host.", "x-consentRequired": false, "type": "string", "x-availableInVersionOverride": "1.20186.0" } }, "required": [ "clientId" ], "title": "Workforce Identity IdP (OIDC)", "description": "Your organization’s OIDC IdP. The app runs an authorization-code-with-PKCE flow against this issuer and exchanges the returned ID token at GCP STS.", "x-flatKey": "inferenceVertexWorkforceOidc", "x-availableInVersion": "1.10628.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false } }, "required": [ "kind" ] }, { "type": "object", "properties": { "kind": { "type": "string", "const": "vendor-profile", "title": "Credential kind", "description": "Selects the credential source. When set, only that source is used (no fallback).", "x-flatKey": "inferenceCredentialKind", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.8555.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-deprecations": [ { "path": "inferenceCredentialKind: \"oauth\" (Vertex AI)", "use": "\"interactive\" — the same Google sign-in under its new name (in hosted or nested documents, switch once every desktop is on a release that knows the Vertex \"interactive\" kind)", "effect": "\"oauth\" will no longer be a Vertex AI credential kind: the value will be reported as invalid and ignored — the device will then derive the kind from the credential fields present (Google sign-in when an OAuth client id is set), and the hosted editor will refuse to save the configuration until the kind is changed", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" }, { "path": "inferenceCredentialKind: \"interactive\" together with inferenceVertexWorkforceAudience (Vertex AI)", "use": "\"workforce\" — or remove inferenceVertexWorkforceAudience if Google sign-in (\"interactive\") is what is meant", "effect": "the audience will no longer imply Workforce Identity: the kind will stay \"interactive\" (Google sign-in), which needs inferenceVertexOAuthClientId — without it the configuration will be reported as incomplete and inference will not start", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ] }, "credentialsFile": { "type": "string", "title": "GCP credentials file path", "description": "Absolute path to service-account JSON. Leave blank to fall back to ADC.", "x-flatKey": "inferenceVertexCredentialsFile", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false } }, "required": [ "kind" ] }, { "type": "object", "properties": { "kind": { "type": "string", "const": "helper-script", "title": "Credential kind", "description": "Selects the credential source. When set, only that source is used (no fallback).", "x-flatKey": "inferenceCredentialKind", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.8555.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-deprecations": [ { "path": "inferenceCredentialKind: \"oauth\" (Vertex AI)", "use": "\"interactive\" — the same Google sign-in under its new name (in hosted or nested documents, switch once every desktop is on a release that knows the Vertex \"interactive\" kind)", "effect": "\"oauth\" will no longer be a Vertex AI credential kind: the value will be reported as invalid and ignored — the device will then derive the kind from the credential fields present (Google sign-in when an OAuth client id is set), and the hosted editor will refuse to save the configuration until the kind is changed", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" }, { "path": "inferenceCredentialKind: \"interactive\" together with inferenceVertexWorkforceAudience (Vertex AI)", "use": "\"workforce\" — or remove inferenceVertexWorkforceAudience if Google sign-in (\"interactive\") is what is meant", "effect": "the audience will no longer imply Workforce Identity: the kind will stay \"interactive\" (Google sign-in), which needs inferenceVertexOAuthClientId — without it the configuration will be reported as incomplete and inference will not start", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ] }, "command": { "title": "Helper script", "description": "Absolute path to an executable that prints the credential, optionally with per-request headers.", "x-flatKey": "inferenceCredentialHelper", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "string" }, "commandWindows": { "title": "Helper script (Windows)", "description": "Absolute path of the helper executable on Windows devices, used there instead of Helper script. Leave unset to use Helper script on every operating system.", "x-flatKey": "inferenceCredentialHelperWindows", "x-availableInVersion": "2.2553.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "string", "minLength": 1, "pattern": "^[A-Za-z]:[\\\\/]" }, "args": { "title": "Helper script arguments", "description": "Arguments passed to the helper script, one per entry, in order. Leave unset to run it with none.", "x-flatKey": "inferenceCredentialHelperArgs", "x-availableInVersion": "2.110.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "array", "items": { "type": "string", "maxLength": 1024, "pattern": "^[^\"%\\x00-\\x1f]+$" } }, "ttlSec": { "title": "Helper script TTL", "description": "Helper output is cached for this many seconds; once it expires the helper re-runs without a relaunch (before the next turn when set above 120).", "default": 3600, "x-flatKey": "inferenceCredentialHelperTtlSec", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991 }, "timeoutSec": { "title": "Credential helper timeout", "description": "Maximum wait for the helper executable to finish. Raise this if the helper opens a browser for interactive sign-in.", "default": 60, "x-flatKey": "inferenceCredentialHelperTimeoutSec", "x-availableInVersion": "1.8089.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "integer", "exclusiveMinimum": 0, "maximum": 600 }, "silentRefreshEnabled": { "title": "Re-run helper for silent refresh", "description": "On credential expiry, re-run the helper (CLAUDE_HELPER_CONTEXT=mid-session-refresh) to recover silently. Turn off if the helper can’t run non-interactively.", "default": true, "x-flatKey": "inferenceCredentialHelperSilentRefreshEnabled", "x-whenUnreadable": { "applies": false }, "x-availableInVersion": "1.10628.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "boolean" }, "awsEnv": { "type": "object", "properties": { "profile": { "type": "string", "title": "AWS profile name", "description": "Passed to the helper script as AWS_PROFILE.", "x-flatKey": "inferenceBedrockProfile", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "x-alias": true }, "awsDir": { "type": "string", "title": "AWS config directory", "description": "Directory holding the AWS config and credentials files. Passed to the helper script as AWS_CONFIG_FILE and AWS_SHARED_CREDENTIALS_FILE.", "x-flatKey": "inferenceBedrockAwsDir", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "x-alias": true }, "awsCliPath": { "type": "string", "title": "AWS CLI path", "description": "Absolute path to the aws executable, shared with the Bedrock profile setting. Not passed to the helper script.", "x-flatKey": "inferenceBedrockAwsCliPath", "x-availableInVersion": "1.13576.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "x-alias": true }, "region": { "type": "string", "pattern": "^[a-z]{2,}(-[a-z]+)+-\\d{1,2}$", "title": "AWS region", "description": "Passed to the helper script as AWS_REGION.", "x-flatKey": "inferenceBedrockRegion", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-alias": true } } } }, "required": [ "kind" ] } ] } }, "required": [ "provider" ] }, { "type": "object", "properties": { "provider": { "type": "string", "const": "foundry", "title": "Inference provider", "description": "Selects the inference backend. Setting this key activates third-party mode.", "x-flatKey": "inferenceProvider", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "resource": { "type": "string", "pattern": "^[a-z0-9][a-z0-9-]{0,62}[a-z0-9]$", "title": "Azure AI Foundry resource name", "description": "Azure AI Foundry resource name used to construct the endpoint URL.", "x-flatKey": "inferenceFoundryResource", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "baseUrl": { "type": "string", "format": "uri", "title": "Azure AI Foundry base URL", "description": "Full base URL for a gateway or proxy in front of Foundry, path included (replaces https://RESOURCE.services.ai.azure.com/anthropic).", "x-consentRequired": true, "x-flatKey": "inferenceFoundryBaseUrl", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "2.110.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-originPinned": "local-credential" }, "customHeaders": { "title": "Custom inference headers", "description": "Extra headers on every inference request — routing and tenant headers only (org IDs, Bedrock Guardrails). No credentials; use the credential helper for tokens.", "x-flatKey": "inferenceCustomHeaders", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.8089.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "string" } }, "sessionLifetimeSec": { "title": "Sign-in session lifetime", "description": "How long a sign-in stays valid under your IdP’s session policy. Shows a re-authenticate banner before it expires.", "x-flatKey": "inferenceSessionLifetimeSec", "x-availableInVersion": "1.14271.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991 }, "credential": { "oneOf": [ { "type": "object", "properties": { "kind": { "type": "string", "const": "static", "title": "Credential kind", "description": "Selects the credential source. When set, only that source is used (no fallback).", "x-flatKey": "inferenceCredentialKind", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.8555.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "apiKey": { "type": "string", "title": "Azure AI Foundry API key", "description": "API key for Azure AI Foundry inference.", "x-flatKey": "inferenceFoundryApiKey", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false } }, "required": [ "kind" ] }, { "type": "object", "properties": { "kind": { "type": "string", "const": "interactive", "title": "Credential kind", "description": "Selects the credential source. When set, only that source is used (no fallback).", "x-flatKey": "inferenceCredentialKind", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.8555.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "tenantId": { "type": "string", "minLength": 1, "title": "Entra ID tenant ID", "description": "Directory (tenant) ID of the Entra ID app registration that has the Cognitive Services scope.", "x-flatKey": "inferenceFoundryTenantId", "x-availableInVersion": "1.9255.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "clientId": { "type": "string", "minLength": 1, "title": "Entra ID client ID", "description": "Application (client) ID of the Entra ID app registration. Device-code sign-in requires the app to allow public client flows.", "x-flatKey": "inferenceFoundryClientId", "x-availableInVersion": "1.9255.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "authFlow": { "type": "string", "enum": [ "device-code", "browser", "broker" ], "title": "Entra ID sign-in flow", "description": "How Entra sign-in runs: device code (default), system browser, or the OS identity broker.", "x-flatKey": "inferenceFoundryAuthFlow", "x-availableInVersion": "1.19367.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-valueAvailableInVersionOverride": [ { "value": "broker", "availableInVersion": "1.24012.0" } ] } }, "required": [ "kind" ] }, { "type": "object", "properties": { "kind": { "type": "string", "const": "helper-script", "title": "Credential kind", "description": "Selects the credential source. When set, only that source is used (no fallback).", "x-flatKey": "inferenceCredentialKind", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.8555.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "command": { "title": "Helper script", "description": "Absolute path to an executable that prints the credential, optionally with per-request headers.", "x-flatKey": "inferenceCredentialHelper", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "string" }, "commandWindows": { "title": "Helper script (Windows)", "description": "Absolute path of the helper executable on Windows devices, used there instead of Helper script. Leave unset to use Helper script on every operating system.", "x-flatKey": "inferenceCredentialHelperWindows", "x-availableInVersion": "2.2553.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "string", "minLength": 1, "pattern": "^[A-Za-z]:[\\\\/]" }, "args": { "title": "Helper script arguments", "description": "Arguments passed to the helper script, one per entry, in order. Leave unset to run it with none.", "x-flatKey": "inferenceCredentialHelperArgs", "x-availableInVersion": "2.110.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "array", "items": { "type": "string", "maxLength": 1024, "pattern": "^[^\"%\\x00-\\x1f]+$" } }, "ttlSec": { "title": "Helper script TTL", "description": "Helper output is cached for this many seconds; once it expires the helper re-runs without a relaunch (before the next turn when set above 120).", "default": 3600, "x-flatKey": "inferenceCredentialHelperTtlSec", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991 }, "timeoutSec": { "title": "Credential helper timeout", "description": "Maximum wait for the helper executable to finish. Raise this if the helper opens a browser for interactive sign-in.", "default": 60, "x-flatKey": "inferenceCredentialHelperTimeoutSec", "x-availableInVersion": "1.8089.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "integer", "exclusiveMinimum": 0, "maximum": 600 }, "silentRefreshEnabled": { "title": "Re-run helper for silent refresh", "description": "On credential expiry, re-run the helper (CLAUDE_HELPER_CONTEXT=mid-session-refresh) to recover silently. Turn off if the helper can’t run non-interactively.", "default": true, "x-flatKey": "inferenceCredentialHelperSilentRefreshEnabled", "x-whenUnreadable": { "applies": false }, "x-availableInVersion": "1.10628.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "type": "boolean" }, "awsEnv": { "type": "object", "properties": { "profile": { "type": "string", "title": "AWS profile name", "description": "Passed to the helper script as AWS_PROFILE.", "x-flatKey": "inferenceBedrockProfile", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "x-alias": true }, "awsDir": { "type": "string", "title": "AWS config directory", "description": "Directory holding the AWS config and credentials files. Passed to the helper script as AWS_CONFIG_FILE and AWS_SHARED_CREDENTIALS_FILE.", "x-flatKey": "inferenceBedrockAwsDir", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "x-alias": true }, "awsCliPath": { "type": "string", "title": "AWS CLI path", "description": "Absolute path to the aws executable, shared with the Bedrock profile setting. Not passed to the helper script.", "x-flatKey": "inferenceBedrockAwsCliPath", "x-availableInVersion": "1.13576.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false, "x-alias": true }, "region": { "type": "string", "pattern": "^[a-z]{2,}(-[a-z]+)+-\\d{1,2}$", "title": "AWS region", "description": "Passed to the helper script as AWS_REGION.", "x-flatKey": "inferenceBedrockRegion", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-alias": true } } } }, "required": [ "kind" ] } ] } }, "required": [ "provider" ] } ] }, "otlp": { "type": "object", "properties": { "endpoint": { "type": "string", "format": "uri", "title": "OpenTelemetry collector endpoint", "description": "Where OpenTelemetry logs and metrics are sent. Leave blank to disable.", "x-flatKey": "otlpEndpoint", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "protocol": { "type": "string", "enum": [ "http/protobuf", "http/json", "grpc" ], "title": "OpenTelemetry exporter protocol", "description": "Transport protocol for the OpenTelemetry exporters.", "default": "http/protobuf", "x-flatKey": "otlpProtocol", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "headers": { "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "string" }, "title": "OpenTelemetry exporter headers", "description": "Static collector headers — routing and tenant headers only. No credentials here; use Collector authentication or the headers helper script for tokens.", "x-flatKey": "otlpHeaders", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "authMode": { "type": "string", "enum": [ "none", "inference-credential" ], "title": "Collector authentication", "description": "inference-credential sends the user’s inference bearer token to the collector as Authorization: Bearer.", "x-flatKey": "otlpAuthMode", "x-availableInVersion": "1.30096.1", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "headersHelper": { "type": "string", "minLength": 1, "title": "OpenTelemetry headers helper script", "description": "Absolute path to an executable that prints a JSON object of collector headers. Merged over the static headers and Collector authentication; the helper wins.", "x-flatKey": "otlpHeadersHelper", "x-availableInVersion": "1.30096.1", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": true, "x-originPinned": false }, "resourceAttributes": { "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "string" }, "title": "OpenTelemetry resource attributes", "description": "Extra resource attributes to attach to every span/metric. A static enduser.id set here always wins over the runtime identity.", "x-flatKey": "otlpResourceAttributes", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.5354.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "desktopLogLevel": { "type": "string", "enum": [ "off", "error", "warn", "info", "debug" ], "title": "Desktop telemetry export level", "description": "Controls the Claude Desktop application’s events, separate from Cowork and Code sessions. Defaults to error.", "default": "error", "x-flatKey": "otlpDesktopLogLevel", "x-availableInVersion": "1.9255.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "contentCapture": { "type": "array", "items": { "anyOf": [ { "type": "string", "enum": [ "userPrompts", "assistantResponses", "toolDetails", "toolContent", "rawApiBodies" ] }, { "type": "string" } ], "description": "Known values are listed; a client ignores a value it does not know, so a newer client's vocabulary is storable as is." }, "title": "Content capture categories", "description": "Content categories Claude Desktop sends unredacted to your collector. `userPrompts` also sends Claude’s responses. Leave empty to redact all content (default).", "x-flatKey": "otlpContentCapture", "x-readers": [ "desktop", "m365" ], "x-whenUnreadable": { "applies": [] }, "x-availableInVersion": "1.15962.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "tracesEnabled": { "type": "boolean", "title": "Export traces", "description": "Also export OpenTelemetry traces from Cowork tasks and Code sessions. Uses Claude Code’s session tracing.", "x-flatKey": "otlpTracesEnabled", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.22209.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "attrMaxChars": { "type": "integer", "minimum": 256, "maximum": 15000000, "title": "Telemetry attribute length limit", "description": "Maximum length, in characters, of captured content such as a raw API body (256–15,000,000). Cowork tasks and Code sessions use 61,440 when unset.", "x-flatKey": "otlpAttrMaxChars", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "2.31226.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false } } }, "tokenLimits": { "type": "object", "properties": { "maxPerWindow": { "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991, "title": "Max tokens per window", "description": "Limits each person’s input and output tokens per window on each device. Cached tokens do not count, so this does not cap your provider’s bill.", "x-flatKey": "inferenceMaxTokensPerWindow", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "windowHours": { "type": "integer", "exclusiveMinimum": 0, "maximum": 720, "title": "Token cap window", "description": "The count resets to zero at the end of each window. A window can last 1 to 720 hours (30 days).", "x-flatKey": "inferenceTokenWindowHours", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false } } }, "coworkSurface": { "type": "object", "properties": { "enabled": { "type": "boolean", "title": "Allow Cowork", "description": "Enable Cowork. Claude works on longer tasks like research, analysis, and documents.", "default": true, "x-flatKey": "coworkTabEnabled", "x-whenUnreadable": { "applies": false }, "x-availableInVersion": "1.9659.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false } } }, "codeSurface": { "type": "object", "properties": { "enabled": { "type": "boolean", "title": "Allow Code", "description": "Enable Code. Claude writes and runs code.", "default": true, "x-flatKey": "isClaudeCodeForDesktopEnabled", "x-whenUnreadable": { "applies": false }, "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "sshHostAllowlist": { "type": "array", "items": { "type": "string", "minLength": 1 }, "title": "SSH host allowlist", "description": "SSH hosts for Code sessions. Unset: off unless the device’s Claude Code managed settings list hosts. An admin’s empty list: off even then. * allows any host.", "x-flatKey": "sshHostAllowlist", "x-whenUnreadable": { "applies": [] }, "x-availableInVersion": "1.40609.0", "x-availability": "both", "x-deprecated": false, "x-beta": true, "x-consentRequired": false, "x-originPinned": false }, "sshClientPath": { "type": "string", "minLength": 1, "title": "SSH client program", "description": "Absolute path to the OpenSSH ssh program the app runs for SSH sessions. Unset: the first ssh on the user’s PATH.", "x-flatKey": "sshClientPath", "x-whenUnreadable": { "unusable": true }, "x-availableInVersion": "1.46388.1", "x-availability": "both", "x-deprecated": false, "x-beta": true, "x-consentRequired": true, "x-originPinned": false }, "sshTransport": { "type": "string", "enum": [ "auto", "system-openssh", "builtin" ], "title": "SSH connection engine", "description": "Which SSH engine carries Code sessions: the OpenSSH ssh program on the device, or the app’s built-in SSH library. Unset or auto: the build’s default.", "x-flatKey": "sshTransport", "x-whenUnreadable": { "applies": "builtin" }, "x-availableInVersion": "1.52386.0", "x-availability": "both", "x-deprecated": false, "x-beta": true, "x-consentRequired": false, "x-originPinned": false } } }, "chatSurface": { "type": "object", "properties": { "enabled": { "type": "boolean", "title": "Allow Chat", "description": "Enable Chat. Quick questions and drafting.", "x-flatKey": "chatTabEnabled", "x-availableInVersion": "1.13576.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "advancedFileAnalysis": { "type": "boolean", "title": "Advanced file analysis", "description": "Allow Claude to run code in a local sandbox to analyze attached files it can’t read natively — like Excel and PowerPoint. Off by default.", "x-flatKey": "chatAdvancedFileAnalysisEnabled", "x-availableInVersion": "1.14271.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "desktopHome": { "type": "string", "enum": [ "standard", "simple", "no-vm", "off" ], "title": "Desktop home", "description": "Unifies Chat and Cowork into one home. When set, it replaces Allow Chat, Advanced file analysis, and Allow Cowork. Leave unset to keep those.", "x-flatKey": "desktopHome", "x-whenUnreadable": { "applies": "off" }, "x-availableInVersion": "1.52386.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-valueAvailableInVersionOverride": [ { "value": "no-vm", "availableInVersion": "2.2553.0" } ] } } }, "sessionRetention": { "type": "object", "properties": { "chatDays": { "type": "integer", "minimum": 1, "maximum": 3650, "title": "Chat retention period", "description": "Delete chats, with their files, after this many days without activity. Unset: kept until the user deletes them. Projects and memory stay.", "x-flatKey": "chatSessionRetentionDays", "x-availableInVersion": "1.52386.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "coworkDays": { "type": "integer", "minimum": 1, "maximum": 3650, "title": "Cowork retention period", "description": "Delete Cowork tasks, with their uploads and outputs, after this many days without activity. Unset: kept until the user deletes them. Spaces and memory stay.", "x-flatKey": "coworkSessionRetentionDays", "x-availableInVersion": "1.52386.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "codeDays": { "type": "integer", "minimum": 1, "maximum": 3650, "title": "Code retention period", "description": "Delete Code sessions, conversation included, after this many days without activity. Unset: kept until the user deletes them. Uncommitted work stays on disk.", "x-flatKey": "codeSessionRetentionDays", "x-availableInVersion": "1.52386.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "legalHold": { "type": "boolean", "title": "Suspend session deletion", "description": "Suspend all automatic session deletion for these users (legal hold). While on, the retention periods above delete nothing.", "x-flatKey": "sessionRetentionHold", "x-whenUnreadable": { "applies": true }, "x-availableInVersion": "1.52386.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false } } }, "extensions": { "type": "object", "properties": { "enabled": { "type": "boolean", "title": "Allow desktop extensions", "description": ".dxt and .mcpb installs.", "default": false, "x-flatKey": "isDesktopExtensionEnabled", "x-whenUnreadable": { "applies": false }, "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "signatureRequired": { "type": "boolean", "title": "Require signed extensions", "description": "Reject desktop extensions that are not signed by a trusted publisher.", "default": false, "x-flatKey": "isDesktopExtensionSignatureRequired", "x-whenUnreadable": { "applies": true }, "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false } } }, "autoUpdate": { "type": "object", "properties": { "disabled": { "type": "boolean", "title": "Block auto-updates", "description": "Stop Claude Desktop from fetching updates entirely (no time limit). You’ll need to push new versions yourself.", "default": false, "x-flatKey": "disableAutoUpdates", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "enforcementHours": { "type": "integer", "exclusiveMinimum": 0, "maximum": 72, "title": "Auto-update enforcement window", "description": "Hours before a downloaded update force-installs. Only applies when auto-updates are enabled. Blank = 72-hour default.", "x-flatKey": "autoUpdaterEnforcementHours", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "viaUpdatesHost": { "type": "boolean", "title": "Check for updates on releases.claude.com", "description": "Read the update feed from releases.claude.com so api.anthropic.com can stay blocked.", "default": false, "x-flatKey": "updateViaUpdatesHost", "x-availableInVersion": "1.26832.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false } } }, "featureDiscovery": { "type": "object", "properties": { "disabled": { "type": "boolean", "title": "Hide feature announcements", "description": "Suppress unprompted feature-announcement UI: the post-update “What’s new” nudge and new-feature tips. Users can still open release notes themselves.", "default": false, "x-flatKey": "disableFeatureDiscovery", "x-whenUnreadable": { "applies": true }, "x-availableInVersion": "1.21459.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false } } }, "lifecycle": { "type": "object", "properties": { "relaunchEnforcementHours": { "type": "integer", "minimum": 0, "maximum": 336, "title": "Configuration relaunch window", "description": "Hours a user may keep working on the old configuration after a managed-configuration change is detected. 0 = restart required at once. Blank = 24 hours.", "default": 24, "x-flatKey": "relaunchEnforcementHours", "x-availableInVersion": "1.40609.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "configRecheckIntervalMinutes": { "type": "integer", "minimum": 2, "maximum": 30, "title": "Configuration re-check interval", "description": "Minutes between the running app’s checks for a changed managed configuration. Blank = 10 minutes.", "default": 10, "x-flatKey": "configRecheckIntervalMinutes", "x-availableInVersion": "1.46388.1", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false } } }, "models": { "type": "object", "properties": { "discoveryEnabled": { "type": "boolean", "title": "Model discovery", "description": "Auto-populate the model picker from the provider at launch.", "x-flatKey": "modelDiscoveryEnabled", "x-availableInVersion": "1.8089.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "prefer1mContext": { "type": "boolean", "title": "Use 1M wherever it’s available", "description": "Every model that offers 1M, in your list or from your gateway, shows one option and requests 1M.", "x-flatKey": "modelPrefer1mContext", "x-availableInVersion": "1.28929.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "list": { "minItems": 1, "type": "array", "items": { "anyOf": [ { "type": "string", "minLength": 1 }, { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "title": "Model ID", "description": "Model ID exactly as the provider expects it. The first entry is the default model.", "x-consentRequired": false }, "labelOverride": { "type": "string", "title": "Display name", "description": "Shown in the model picker. Leave blank to auto-format from the ID.", "x-consentRequired": false }, "supports1m": { "type": "boolean", "title": "Offer 1M-context variant", "description": "Adds a 1M-context variant of this model to the picker. Set only if the deployment accepts 1M-token context for it.", "x-consentRequired": false }, "prefer1m": { "type": "boolean", "title": "Only show the 1M option", "description": "Shows one option for this model and requests 1M from your provider. Does nothing unless the entry offers 1M.", "x-consentRequired": false, "x-availableInVersionOverride": "1.21459.0" }, "anthropicFamilyTier": { "type": "string", "enum": [ "sonnet", "opus", "haiku", "fable", "mythos" ], "title": "Tier alias", "description": "Which Claude tier this model stands in for. Pins the bare alias (e.g. ‘opus’) and, for opus/fable, the refusal fallback.", "x-consentRequired": false, "x-availableInVersionOverride": "1.13576.0" }, "isFamilyDefault": { "type": "boolean", "title": "Default for tier", "description": "When several models share a tier alias, marks this one as the model the alias resolves to. Otherwise the first listed wins.", "x-consentRequired": false, "x-availableInVersionOverride": "1.13576.0" }, "maxEffort": { "type": "string", "enum": [ "low", "medium", "high", "xhigh", "max" ], "title": "Max effort", "description": "Highest effort level offered for this model; higher levels are hidden and never requested by Claude Desktop. An unrecognized value caps the model at low.", "x-consentRequired": false, "x-availableInVersionOverride": "2.110.0" } }, "required": [ "name" ] } ] }, "title": "Model list", "description": "Override the auto-discovered model list. First entry is the default.", "x-flatKey": "inferenceModels", "x-readers": [ "desktop", "m365" ], "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "defaultEffort": { "type": "string", "enum": [ "low", "medium", "high", "xhigh", "max" ], "title": "Default model effort", "description": "Effort level the default model (the first listed model) starts at, instead of Anthropic’s recommended level: low, medium, high, xhigh or max.", "x-flatKey": "defaultModelEffort", "x-availableInVersion": "2.110.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "alwaysStartWithDefault": { "type": "boolean", "title": "Always start with the default model", "description": "When true, each new conversation or task starts on the default model, and a person’s model and effort changes are no longer saved as their default.", "x-flatKey": "alwaysStartWithDefaultModel", "x-whenUnreadable": { "applies": true }, "x-availableInVersion": "2.110.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "pricing": { "type": "object", "properties": { "enabled": { "type": "boolean", "title": "Show estimated cost", "description": "Show an estimated cost on the Usage page at Anthropic list price; turn on to set a multiplier or per-model rates.", "x-flatKey": "inferenceModelPricingEnabled", "x-availableInVersion": "1.37937.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "multiplier": { "type": "number", "exclusiveMinimum": 0, "maximum": 1, "title": "Price multiplier", "description": "Scales every estimated cost (0.85 = 85% of the price); between 0 and 1.", "x-flatKey": "inferenceModelPricingMultiplier", "x-availableInVersion": "1.37937.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "models": { "type": "array", "items": { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "title": "Model ID", "description": "A model ID from the list above, or any other ID or alias your provider serves. A built-in Claude ID also covers its dated and provider forms.", "x-consentRequired": false }, "inputPerMtok": { "type": "number", "minimum": 0, "maximum": 10000, "title": "Input", "description": "USD per million input tokens.", "x-consentRequired": false }, "outputPerMtok": { "type": "number", "minimum": 0, "maximum": 10000, "title": "Output", "description": "USD per million output tokens.", "x-consentRequired": false }, "cacheReadPerMtok": { "type": "number", "minimum": 0, "maximum": 10000, "title": "Cache read", "description": "USD per million prompt-cache read tokens.", "x-consentRequired": false }, "cacheWritePerMtok": { "type": "number", "minimum": 0, "maximum": 10000, "title": "Cache write", "description": "USD per million prompt-cache write tokens (5-minute and 1-hour writes alike).", "x-consentRequired": false } }, "required": [ "name", "inputPerMtok", "outputPerMtok", "cacheReadPerMtok", "cacheWritePerMtok" ] }, "title": "Model pricing", "description": "Per-model rates replacing Anthropic list price in the Usage page’s estimate.", "x-flatKey": "inferenceModelPricing", "x-availableInVersion": "1.37937.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false } } }, "catalogEnabled": { "type": "boolean", "title": "Model catalog metadata", "description": "Fetch the published Claude Code model catalog to get model picker names, descriptions, and effort options. When off, the app uses only its bundled copy.", "x-flatKey": "modelCatalogEnabled", "x-whenUnreadable": { "applies": false }, "x-availableInVersion": "2.110.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "catalogUrl": { "type": "string", "format": "uri", "title": "Model catalog URL", "description": "Fetch the model catalog and its signature file from this URL (a mirror inside your network serving Anthropic’s published files) instead of downloads.claude.ai.", "x-consentRequired": false, "x-flatKey": "modelCatalogUrl", "x-whenUnreadable": { "unusable": true }, "x-availableInVersion": "2.110.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-originPinned": false } } }, "plugins": { "type": "object", "properties": { "settings": { "type": "array", "items": { "anyOf": [ { "type": "object", "properties": { "serverName": { "type": "string", "minLength": 1, "title": "Server name", "description": "Name of the plugin-delivered MCP server this policy applies to.", "x-consentRequired": false, "x-availableInVersionOverride": "1.15200.0" }, "tools": { "type": "array", "items": { "anyOf": [ { "type": "object", "properties": { "toolName": { "type": "string", "minLength": 1, "title": "Tool", "description": "MCP tool name as the server reports it.", "x-consentRequired": false }, "permission": { "type": "string", "enum": [ "allow", "ask", "ask-session", "blocked" ], "title": "Permission", "description": "Approval state locked for this tool. Unlisted tools stay user-controlled.", "x-consentRequired": false, "x-deprecatedValues": [ { "value": "ask-session", "use": "ask", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ], "x-valueAvailableInVersionOverride": [ { "value": "ask-session", "availableInVersion": "1.21459.0" } ] } }, "required": [ "toolName", "permission" ] }, { "type": "null" } ] }, "title": "Tool policy", "description": "Per-tool approval locks for this server.", "x-consentRequired": false, "x-availableInVersionOverride": "1.15200.0" } }, "required": [ "serverName" ] }, { "type": "null" } ] }, "title": "Organization plugin settings", "description": "Admin policy applied to plugin-delivered MCP servers.", "x-flatKey": "orgPluginSettings", "x-whenUnreadable": { "unusable": true }, "x-availableInVersion": "1.8089.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "marketplaces": { "type": "array", "items": { "anyOf": [ { "oneOf": [ { "type": "object", "properties": { "source": { "type": "string", "const": "github", "title": "Source", "description": "Where the marketplace is fetched from: a GitHub repository (set repo), any Git remote (set url), or a hosted marketplace.json file (set url).", "x-consentRequired": false }, "repo": { "type": "string", "pattern": "^[^\\s/]+\\/[^\\s/]+$", "title": "Repository", "description": "GitHub repository in owner/repo form. Case-insensitive.", "x-consentRequired": false }, "ref": { "title": "Ref", "description": "Commit SHA, branch, or tag. Leave empty to track the default branch; auto_install and required need a full 40-character commit SHA.", "x-consentRequired": false, "type": "string", "minLength": 1 }, "path": { "title": "Subpath", "description": "Folder within the repository that contains the marketplace, when it isn’t at the root.", "x-consentRequired": false, "type": "string", "minLength": 1 }, "expectedName": { "title": "Expected name", "description": "Rejects the marketplace if its manifest name differs.", "x-consentRequired": false, "type": "string", "pattern": "^[A-Za-z0-9](?:[A-Za-z0-9._-]{0,126}[A-Za-z0-9_-])?$" }, "installationPreference": { "title": "Installation", "description": "Whether users install plugins themselves or get them automatically.", "x-consentRequired": false, "type": "string", "enum": [ "available", "auto_install", "required" ] }, "credentialKind": { "title": "Auth", "description": "How fetches authenticate: anonymously, with the user’s git credentials, via a helper executable, or as the app does to its gateway or bootstrap server (url).", "x-consentRequired": false, "type": "string", "enum": [ "anonymous", "userGit", "credentialHelper" ] }, "credentialHelper": { "title": "Credential helper", "description": "Executable that prints an access token for this marketplace.", "x-consentRequired": true, "type": "string", "minLength": 1 } }, "required": [ "source", "repo" ] }, { "type": "object", "properties": { "source": { "type": "string", "const": "git", "title": "Source", "description": "Where the marketplace is fetched from: a GitHub repository (set repo), any Git remote (set url), or a hosted marketplace.json file (set url).", "x-consentRequired": false }, "url": { "title": "URL", "description": "HTTPS Git remote of the marketplace repository (git), or direct HTTPS URL of a hosted marketplace.json file (url).", "x-consentRequired": false, "type": "string", "format": "uri" }, "ref": { "title": "Ref", "description": "Commit SHA, branch, or tag. Leave empty to track the default branch; auto_install and required need a full 40-character commit SHA.", "x-consentRequired": false, "type": "string", "minLength": 1 }, "path": { "title": "Subpath", "description": "Folder within the repository that contains the marketplace, when it isn’t at the root.", "x-consentRequired": false, "type": "string", "minLength": 1 }, "expectedName": { "title": "Expected name", "description": "Rejects the marketplace if its manifest name differs.", "x-consentRequired": false, "type": "string", "pattern": "^[A-Za-z0-9](?:[A-Za-z0-9._-]{0,126}[A-Za-z0-9_-])?$" }, "installationPreference": { "title": "Installation", "description": "Whether users install plugins themselves or get them automatically.", "x-consentRequired": false, "type": "string", "enum": [ "available", "auto_install", "required" ] }, "credentialKind": { "title": "Auth", "description": "How fetches authenticate: anonymously, with the user’s git credentials, via a helper executable, or as the app does to its gateway or bootstrap server (url).", "x-consentRequired": false, "type": "string", "enum": [ "anonymous", "userGit", "credentialHelper" ] }, "credentialHelper": { "title": "Credential helper", "description": "Executable that prints an access token for this marketplace.", "x-consentRequired": true, "type": "string", "minLength": 1 } }, "required": [ "source", "url" ] }, { "type": "object", "properties": { "source": { "type": "string", "const": "url", "title": "Source", "description": "Where the marketplace is fetched from: a GitHub repository (set repo), any Git remote (set url), or a hosted marketplace.json file (set url).", "x-consentRequired": false, "x-valueAvailableInVersionOverride": [ { "value": "url", "availableInVersion": "1.32352.0" } ] }, "url": { "title": "URL", "description": "HTTPS Git remote of the marketplace repository (git), or direct HTTPS URL of a hosted marketplace.json file (url).", "x-consentRequired": false, "type": "string", "format": "uri" }, "manifestSha256": { "type": "string", "pattern": "^[0-9a-fA-F]{64}$", "title": "Manifest SHA-256", "description": "SHA-256 of the exact marketplace.json to accept. Without it auto_install and required act as available; a served manifest with any other digest is refused.", "x-consentRequired": false, "x-availableInVersionOverride": "1.32352.0" }, "expectedName": { "title": "Expected name", "description": "Rejects the marketplace if its manifest name differs.", "x-consentRequired": false, "type": "string", "pattern": "^[A-Za-z0-9](?:[A-Za-z0-9._-]{0,126}[A-Za-z0-9_-])?$" }, "installationPreference": { "title": "Installation", "description": "Whether users install plugins themselves or get them automatically.", "x-consentRequired": false, "type": "string", "enum": [ "available", "auto_install", "required" ] }, "credentialKind": { "type": "string", "enum": [ "anonymous", "userGit", "credentialHelper", "inferenceCredential" ], "title": "Auth", "description": "How fetches authenticate: anonymously, with the user’s git credentials, via a helper executable, or as the app does to its gateway or bootstrap server (url).", "x-consentRequired": false, "x-valueAvailableInVersionOverride": [ { "value": "inferenceCredential", "availableInVersion": "1.32352.0" } ] }, "credentialHelper": { "title": "Credential helper", "description": "Executable that prints an access token for this marketplace.", "x-consentRequired": true, "type": "string", "minLength": 1 } }, "required": [ "source", "url" ] } ] }, { "type": "null" } ] }, "title": "Plugin marketplaces", "description": "Git repositories or hosted marketplace.json URLs to surface as plugin marketplaces in the Directory’s Organization tab. The app re-fetches each periodically.", "x-flatKey": "allowedPluginMarketplaces", "x-whenUnreadable": { "applies": [] }, "x-availableInVersion": "1.17377.1", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "userPluginMarketplacesEnabled": { "type": "boolean", "title": "Allow user-added plugin marketplaces", "description": "Allow users to add plugin marketplaces. When off, marketplaces your organization did not provision are hidden and the app’s sessions do not load their plugins.", "x-flatKey": "userPluginMarketplacesEnabled", "x-whenUnreadable": { "applies": false }, "x-availableInVersion": "1.37937.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "userPluginUploadsEnabled": { "type": "boolean", "title": "Allow user-added plugins", "description": "Allow users to add their own plugins. When off, every in-app option for adding one is hidden and uploads that still reach the app are refused.", "x-flatKey": "userPluginUploadsEnabled", "x-whenUnreadable": { "applies": false }, "x-availableInVersion": "1.37937.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false } } }, "telemetry": { "type": "object", "properties": { "orgUuid": { "type": "string", "title": "Organization UUID", "description": "A UUID you generate. Tags telemetry so Anthropic support can locate your fleet’s events, and namespaces each user’s local data. Not used for auth.", "x-flatKey": "deploymentOrganizationUuid", "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "disableEssential": { "type": "boolean", "title": "Block essential telemetry", "description": "Crash and performance reports to Anthropic.", "default": false, "x-flatKey": "disableEssentialTelemetry", "x-whenUnreadable": { "applies": true }, "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "disableNonessential": { "type": "boolean", "title": "Block nonessential telemetry", "description": "Product-usage analytics (no message content) and diagnostic-report uploads.", "default": false, "x-flatKey": "disableNonessentialTelemetry", "x-whenUnreadable": { "applies": true }, "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "disableNonessentialServices": { "type": "boolean", "title": "Block nonessential services", "description": "Connector favicons, artifact-preview and MCP Apps iframes, and the Linux spellcheck dictionary. Connector widgets fall back to text; spellcheck is off on Linux.", "default": false, "x-flatKey": "disableNonessentialServices", "x-whenUnreadable": { "applies": true }, "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false } } }, "mcp": { "type": "object", "properties": { "managedServers": { "type": "array", "items": { "anyOf": [ { "anyOf": [ { "anyOf": [ { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "title": "Name", "description": "Unique name for this server. Shown to users and used to key tool policy and sign-in state.", "x-consentRequired": false }, "transport": { "not": {} }, "url": { "not": {} }, "command": { "not": {} }, "oauth": { "not": {} }, "headers": { "not": {} }, "headersHelper": { "not": {} }, "headersHelperTtlSec": { "not": {} }, "headersHelperRefreshBufferSec": { "not": {} }, "args": { "not": {} }, "env": { "not": {} }, "envHelper": { "not": {} }, "envHelperTtlSec": { "not": {} }, "startupTimeoutSec": { "not": {} }, "authorityHost": { "not": {} }, "server": { "type": "string", "const": "microsoft365", "title": "Server", "description": "Which bundled connector this entry turns on. Set instead of a transport; each built-in server has its own fields.", "x-consentRequired": false, "x-availableInVersionOverride": "1.19367.0" }, "tenantId": { "anyOf": [ { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$" }, { "enum": [ "common", "organizations", "consumers" ], "type": "string", "x-valueAvailableInVersionOverride": [ { "value": "common", "availableInVersion": "1.22209.0" }, { "value": "organizations", "availableInVersion": "1.22209.0" }, { "value": "consumers", "availableInVersion": "1.22209.0" } ] } ], "title": "Tenant ID", "description": "Your organization’s Microsoft Entra directory (tenant) ID.", "x-consentRequired": false, "x-availableInVersionOverride": "1.19367.0" }, "clientId": { "type": "string", "minLength": 1, "title": "Client ID", "description": "OAuth app client ID for this built-in server.", "x-consentRequired": false, "x-availableInVersionOverride": "1.19367.0" }, "azureCloud": { "title": "Azure cloud", "description": "Microsoft cloud for sign-in and Graph. Leave as global for commercial Microsoft 365; US Government clouds require your own app registration (Client ID).", "x-consentRequired": false, "type": "string", "enum": [ "global", "us-gov-high", "us-gov-dod" ], "x-availableInVersionOverride": "1.19367.0" }, "continuousAccessEvaluation": { "title": "Continuous Access Evaluation", "description": "Request CAE-capable Microsoft Graph tokens: long-lived (up to about 28 hours) but revocable within minutes. Set “disabled” to keep standard one-hour tokens.", "default": "enabled", "x-consentRequired": false, "type": "string", "enum": [ "enabled", "disabled" ], "x-availableInVersionOverride": "1.49585.0" }, "scope": { "title": "Access", "description": "What the server may request at sign-in. If blank, Desktop’s default read set is used.", "x-consentRequired": false, "type": "string", "x-availableInVersionOverride": "1.19367.0" }, "toolPolicy": { "title": "Tool policy", "description": "Lock the approval state for specific tools. Unlisted tools stay user-controlled.", "x-consentRequired": false, "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "string", "enum": [ "allow", "ask", "ask-session", "blocked" ], "x-deprecatedValues": [ { "value": "ask-session", "use": "ask", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ], "x-valueAvailableInVersionOverride": [ { "value": "ask-session", "availableInVersion": "1.21459.0" } ] } }, "scopes": { "not": {} } }, "required": [ "name", "server", "tenantId", "clientId" ] }, { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "title": "Name", "description": "Unique name for this server. Shown to users and used to key tool policy and sign-in state.", "x-consentRequired": false }, "transport": { "not": {} }, "url": { "not": {} }, "command": { "not": {} }, "oauth": { "not": {} }, "headers": { "title": "Headers", "description": "Static headers sent on every request — routing and tenant headers only. No credentials here; use the headers helper script for tokens and rotating values.", "x-consentRequired": false, "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "string" }, "x-availableInVersionOverride": "1.19367.0" }, "headersHelper": { "title": "Headers helper script", "description": "Script that prints the auth header as a JSON object to stdout. Runs before each request (cached for the TTL below).", "x-consentRequired": true, "type": "string", "minLength": 1, "x-availableInVersionOverride": "1.19367.0" }, "headersHelperTtlSec": { "title": "Helper cache TTL (sec)", "description": "How long the helper’s headers are reused before it runs again, in seconds. Defaults to 300.", "x-consentRequired": false, "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991, "x-availableInVersionOverride": "1.19367.0" }, "headersHelperRefreshBufferSec": { "title": "Helper refresh buffer (sec)", "description": "Seconds before the TTL expires at which the helper re-runs mid-session. Defaults to 60. Keep it larger than the helper’s typical runtime.", "x-consentRequired": false, "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991, "x-availableInVersionOverride": "1.21459.0" }, "args": { "not": {} }, "env": { "not": {} }, "envHelper": { "not": {} }, "envHelperTtlSec": { "not": {} }, "startupTimeoutSec": { "not": {} }, "server": { "type": "string", "const": "websearch", "title": "Server", "description": "Which bundled connector this entry turns on. Set instead of a transport; each built-in server has its own fields.", "x-consentRequired": false, "x-availableInVersionOverride": "1.19367.0" }, "provider": { "type": "string", "enum": [ "brave", "tavily", "exa", "custom" ], "title": "Search provider", "description": "Runs search from the desktop, for inference providers without native web search. Supply the provider’s API key through the headers helper script below.", "x-consentRequired": false, "x-availableInVersionOverride": "1.19367.0" }, "customUrl": { "title": "Custom URL", "description": "POST endpoint accepting {q} JSON and returning a results[] array. Only used when provider is Custom.", "x-consentRequired": false, "type": "string", "format": "uri", "x-availableInVersionOverride": "1.19367.0" }, "toolPolicy": { "title": "Tool policy", "description": "Lock the approval state for specific tools. Unlisted tools stay user-controlled.", "x-consentRequired": false, "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "string", "enum": [ "allow", "ask", "ask-session", "blocked" ], "x-deprecatedValues": [ { "value": "ask-session", "use": "ask", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ], "x-valueAvailableInVersionOverride": [ { "value": "ask-session", "availableInVersion": "1.21459.0" } ] } } }, "required": [ "name", "server", "provider" ] }, { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "title": "Name", "description": "Unique name for this server. Shown to users and used to key tool policy and sign-in state.", "x-consentRequired": false }, "transport": { "not": {} }, "url": { "not": {} }, "command": { "not": {} }, "oauth": { "not": {} }, "headers": { "not": {} }, "headersHelper": { "not": {} }, "headersHelperTtlSec": { "not": {} }, "headersHelperRefreshBufferSec": { "not": {} }, "args": { "not": {} }, "env": { "not": {} }, "envHelper": { "not": {} }, "envHelperTtlSec": { "not": {} }, "startupTimeoutSec": { "not": {} }, "server": { "type": "string", "const": "github", "title": "Server", "description": "Which bundled connector this entry turns on. Set instead of a transport; each built-in server has its own fields.", "x-consentRequired": false, "x-availableInVersionOverride": "1.25927.0" }, "clientId": { "type": "string", "title": "Client ID", "description": "GitHub OAuth app client ID (device flow must be enabled on the app).", "x-consentRequired": false, "x-availableInVersionOverride": "1.25927.0" }, "host": { "type": "string", "format": "uri", "title": "GitHub Enterprise Server URL", "description": "Leave blank for github.com. For GitHub Enterprise Server, your instance’s base URL.", "x-consentRequired": false, "x-availableInVersionOverride": "1.25927.0" }, "scope": { "type": "string", "title": "Access", "description": "Space-separated GitHub OAuth scopes. If blank, Desktop’s default read set is used. Ignored for GitHub Apps (permissions come from the app registration).", "x-consentRequired": false, "x-availableInVersionOverride": "1.25927.0" }, "toolsets": { "type": "string", "title": "Toolsets", "description": "Comma-separated github-mcp-server toolsets to enable. If blank, the bundled server’s default toolsets are used.", "x-consentRequired": false, "x-availableInVersionOverride": "1.25927.0" }, "readOnly": { "type": "boolean", "title": "Read-only", "description": "Offer only read tools — the server registers no write tools at all.", "x-consentRequired": false, "x-availableInVersionOverride": "1.25927.0" }, "toolPolicy": { "title": "Tool policy", "description": "Lock the approval state for specific tools. Unlisted tools stay user-controlled.", "x-consentRequired": false, "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "string", "enum": [ "allow", "ask", "ask-session", "blocked" ], "x-deprecatedValues": [ { "value": "ask-session", "use": "ask", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ], "x-valueAvailableInVersionOverride": [ { "value": "ask-session", "availableInVersion": "1.21459.0" } ] } }, "scopes": { "not": {} } }, "required": [ "name", "server", "clientId" ] } ] }, { "oneOf": [ { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "title": "Name", "description": "Unique name for this server. Shown to users and used to key tool policy and sign-in state.", "x-consentRequired": false }, "server": { "not": {} }, "transport": { "type": "string", "enum": [ "http", "sse" ], "title": "Transport", "description": "How the app connects: Streamable HTTP, legacy SSE, or a local command (stdio). policy-only connects to nothing; it only sets a plugin server’s tool policy.", "x-consentRequired": false }, "url": { "type": "string", "format": "uri", "title": "URL", "description": "HTTPS endpoint of the remote MCP server.", "x-consentRequired": false }, "oauth": { "anyOf": [ { "type": "boolean", "const": true }, { "type": "object", "properties": { "scope": { "title": "Scope", "description": "Space-separated scopes sent on the authorize request. Leave unset to use the scopes the server advertises. Required when Tenant ID is set.", "x-consentRequired": false, "type": "string", "minLength": 1 }, "appendOfflineAccess": { "title": "Request offline_access", "description": "Adds offline_access to the authorize request so the IdP returns a refresh token for silent renewal.", "x-consentRequired": false, "type": "boolean", "x-availableInVersionOverride": "1.13576.0" }, "scopes": { "not": {} }, "additionalRedirectReferrerHosts": { "title": "Additional redirect referrer hosts", "description": "Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host.", "x-consentRequired": false, "type": "string", "x-availableInVersionOverride": "1.24012.0" } } }, { "type": "object", "properties": { "clientId": { "type": "string", "minLength": 1 }, "clientSecret": { "title": "Client secret", "description": "Only for IdPs that require one (e.g. Box). Hosted config can store only a Google Desktop-app secret (GOCSPX-…); for other IdPs use the client secret helper.", "x-consentRequired": false, "type": "string", "minLength": 1 }, "clientSecretHelper": { "title": "Client secret helper script", "description": "Executable that prints the client secret on stdout as a JSON object with a single clientSecret key; any other output is rejected. Overrides the inline value.", "x-consentRequired": true, "type": "string", "minLength": 1, "x-availableInVersionOverride": "1.19367.0" }, "authorizationServer": { "title": "Authorization server", "description": "Issuer URLs the OAuth sign-in may use, as a JSON array. Pre-filled by presets; ask your IdP admin if unsure.", "x-consentRequired": false, "minItems": 1, "type": "array", "items": { "type": "string", "format": "uri" } }, "authorizationUrl": { "title": "Authorization URL", "description": "Only for IdPs that don’t serve a .well-known discovery document. Set together with Token URL; requires Client ID.", "x-consentRequired": false, "type": "string", "format": "uri", "x-availableInVersionOverride": "1.24012.0" }, "tokenUrl": { "title": "Token URL", "description": "Only for IdPs that don’t serve a .well-known discovery document. Set together with Authorization URL; requires Client ID.", "x-consentRequired": false, "type": "string", "format": "uri", "x-availableInVersionOverride": "1.24012.0" }, "tenantId": { "title": "Tenant ID", "description": "Required for single-tenant Entra apps. Leave blank for multi-tenant or non-Microsoft IdPs.", "x-consentRequired": false, "anyOf": [ { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$" }, { "type": "string", "enum": [ "common", "organizations", "consumers" ] } ] }, "authFlow": { "title": "Sign-in flow", "description": "How Entra sign-in runs for this server: the system browser (default) or the OS identity broker.", "x-consentRequired": false, "type": "string", "enum": [ "browser", "broker" ], "x-availableInVersionOverride": "1.25927.0" }, "scope": { "title": "Scope", "description": "Space-separated scopes sent on the authorize request. Leave unset to use the scopes the server advertises. Required when Tenant ID is set.", "x-consentRequired": false, "type": "string", "minLength": 1 }, "appendOfflineAccess": { "title": "Request offline_access", "description": "Adds offline_access to the authorize request so the IdP returns a refresh token for silent renewal.", "x-consentRequired": false, "type": "boolean", "x-availableInVersionOverride": "1.13576.0" }, "callbackHost": { "title": "Callback host", "description": "Use localhost only if your IdP’s registered redirect URI specifies it.", "x-consentRequired": false, "type": "string", "enum": [ "127.0.0.1", "localhost" ] }, "callbackPort": { "title": "Callback port", "description": "Only set if your IdP requires an exact-match redirect port. Entra accepts any.", "x-consentRequired": false, "type": "integer", "minimum": 1024, "maximum": 65535 }, "additionalRedirectReferrerHosts": { "title": "Additional redirect referrer hosts", "description": "Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host.", "x-consentRequired": false, "type": "string", "x-availableInVersionOverride": "1.24012.0" }, "scopes": { "not": {} }, "mode": { "not": {} } }, "required": [ "clientId" ] }, { "oneOf": [ { "type": "object", "properties": { "mode": { "type": "string", "const": "dcr", "x-availableInVersionOverride": "1.15200.0" } }, "required": [ "mode" ] }, { "type": "object", "properties": { "mode": { "type": "string", "const": "byo", "x-availableInVersionOverride": "1.15200.0" }, "clientId": { "type": "string", "minLength": 1, "title": "Client ID", "description": "OAuth client ID from your IdP app registration. Leave unset to auto-register (dynamic client registration) and only narrow scopes.", "x-consentRequired": false }, "clientSecret": { "title": "Client secret", "description": "Only for IdPs that require one (e.g. Box). Hosted config can store only a Google Desktop-app secret (GOCSPX-…); for other IdPs use the client secret helper.", "x-consentRequired": false, "type": "string", "minLength": 1 }, "clientSecretHelper": { "title": "Client secret helper script", "description": "Executable that prints the client secret on stdout as a JSON object with a single clientSecret key; any other output is rejected. Overrides the inline value.", "x-consentRequired": true, "type": "string", "minLength": 1, "x-availableInVersionOverride": "1.19367.0" }, "authorizationServer": { "title": "Authorization server", "description": "Issuer URLs the OAuth sign-in may use, as a JSON array. Pre-filled by presets; ask your IdP admin if unsure.", "x-consentRequired": false, "minItems": 1, "type": "array", "items": { "type": "string", "format": "uri" } }, "authorizationUrl": { "title": "Authorization URL", "description": "Only for IdPs that don’t serve a .well-known discovery document. Set together with Token URL; requires Client ID.", "x-consentRequired": false, "type": "string", "format": "uri", "x-availableInVersionOverride": "1.24012.0" }, "tokenUrl": { "title": "Token URL", "description": "Only for IdPs that don’t serve a .well-known discovery document. Set together with Authorization URL; requires Client ID.", "x-consentRequired": false, "type": "string", "format": "uri", "x-availableInVersionOverride": "1.24012.0" }, "tenantId": { "title": "Tenant ID", "description": "Required for single-tenant Entra apps. Leave blank for multi-tenant or non-Microsoft IdPs.", "x-consentRequired": false, "anyOf": [ { "type": "string", "format": "uuid", "pattern": "^([0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12})$" }, { "type": "string", "enum": [ "common", "organizations", "consumers" ] } ] }, "authFlow": { "title": "Sign-in flow", "description": "How Entra sign-in runs for this server: the system browser (default) or the OS identity broker.", "x-consentRequired": false, "type": "string", "enum": [ "browser", "broker" ], "x-availableInVersionOverride": "1.25927.0" }, "scope": { "title": "Scope", "description": "Space-separated scopes sent on the authorize request. Leave unset to use the scopes the server advertises. Required when Tenant ID is set.", "x-consentRequired": false, "type": "string", "minLength": 1 }, "appendOfflineAccess": { "title": "Request offline_access", "description": "Adds offline_access to the authorize request so the IdP returns a refresh token for silent renewal.", "x-consentRequired": false, "type": "boolean", "x-availableInVersionOverride": "1.13576.0" }, "callbackHost": { "title": "Callback host", "description": "Use localhost only if your IdP’s registered redirect URI specifies it.", "x-consentRequired": false, "type": "string", "enum": [ "127.0.0.1", "localhost" ] }, "callbackPort": { "title": "Callback port", "description": "Only set if your IdP requires an exact-match redirect port. Entra accepts any.", "x-consentRequired": false, "type": "integer", "minimum": 1024, "maximum": 65535 }, "additionalRedirectReferrerHosts": { "title": "Additional redirect referrer hosts", "description": "Space-separated hostnames also accepted as the referrer of the sign-in callback. Only needed when the IdP completes sign-in from a different host.", "x-consentRequired": false, "type": "string", "x-availableInVersionOverride": "1.24012.0" }, "scopes": { "not": {} } }, "required": [ "mode" ] }, { "type": "object", "properties": { "mode": { "type": "string", "const": "hosted", "x-availableInVersionOverride": "1.32885.1" }, "clientId": { "type": "string", "format": "uri", "title": "Client ID", "description": "Set by the Claude.ai control plane when it serves this configuration (the URL of Anthropic’s hosted client-metadata document); not authored.", "x-consentRequired": false, "x-availableInVersionOverride": "1.32885.1" }, "authorizationServer": { "minItems": 1, "type": "array", "items": { "type": "string", "format": "uri" }, "title": "Authorization server", "description": "The exact issuer string(s) the server’s OAuth authorization server advertises in its metadata, as a JSON array — matched exactly, including path and any trailing slash. Required: Anthropic signs the client identity only for an authorization server listed here.", "x-consentRequired": false, "x-availableInVersionOverride": "1.32885.1" }, "scope": { "title": "Scope", "description": "Space-separated scopes sent on the authorize request. Leave unset to use the scopes the server advertises. Required when Tenant ID is set.", "x-consentRequired": false, "type": "string", "minLength": 1 }, "scopes": { "not": {} } }, "required": [ "mode", "authorizationServer" ] } ] } ], "title": "OAuth", "description": "OAuth for a remote server: true to auto-register a client, a pre-registered client ID with tenant and scope, or mode “hosted” for an Anthropic-signed identity.", "x-consentRequired": false }, "headers": { "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "string" }, "title": "Headers", "description": "Static headers sent on every request — routing and tenant headers only. No credentials here; use the headers helper script for tokens and rotating values.", "x-consentRequired": false }, "headersHelper": { "type": "string", "minLength": 1, "title": "Headers helper script", "description": "Absolute path to an executable that prints a JSON object of HTTP headers on stdout. Merged over static headers; the helper wins on conflict.", "x-consentRequired": true, "x-availableInVersionOverride": "1.19367.0" }, "headersHelperTtlSec": { "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991, "title": "Helper cache TTL (sec)", "description": "How long the helper’s headers are reused before it runs again, in seconds. Defaults to 300.", "x-consentRequired": false, "x-availableInVersionOverride": "1.19367.0" }, "headersHelperRefreshBufferSec": { "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991, "title": "Helper refresh buffer (sec)", "description": "Seconds before the TTL expires at which the helper re-runs mid-session. Defaults to 60. Keep it larger than the helper’s typical runtime.", "x-consentRequired": false, "x-availableInVersionOverride": "1.21459.0" }, "toolPolicy": { "title": "Tool policy", "description": "Lock the approval state for specific tools. Unlisted tools stay user-controlled.", "x-consentRequired": false, "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "string", "enum": [ "allow", "ask", "ask-session", "blocked" ], "x-deprecatedValues": [ { "value": "ask-session", "use": "ask", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ], "x-valueAvailableInVersionOverride": [ { "value": "ask-session", "availableInVersion": "1.21459.0" } ] } } }, "required": [ "name", "transport", "url" ] }, { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "title": "Name", "description": "Unique name for this server. Shown to users and used to key tool policy and sign-in state.", "x-consentRequired": false }, "server": { "not": {} }, "transport": { "type": "string", "const": "stdio", "title": "Transport", "description": "How the app connects: Streamable HTTP, legacy SSE, or a local command (stdio). policy-only connects to nothing; it only sets a plugin server’s tool policy.", "x-consentRequired": false, "x-availableInVersionOverride": "1.19367.0" }, "command": { "type": "string", "minLength": 1, "title": "Command", "description": "Absolute path to the server executable, run on the user’s machine.", "x-consentRequired": true, "x-availableInVersionOverride": "1.19367.0" }, "args": { "type": "array", "items": { "type": "string" }, "title": "Arguments", "description": "Arguments passed to the command, one per entry.", "x-consentRequired": true, "x-availableInVersionOverride": "1.19367.0" }, "env": { "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "string" }, "title": "Environment variables", "description": "Environment variables set for the command.", "x-consentRequired": true, "x-availableInVersionOverride": "1.19367.0" }, "envHelper": { "type": "string", "minLength": 1, "title": "Environment helper script", "description": "Script that prints environment variables as a JSON object to stdout. Runs when the local server starts (cached for the TTL below).", "x-consentRequired": true, "x-availableInVersionOverride": "1.21459.0" }, "envHelperTtlSec": { "type": "integer", "exclusiveMinimum": 0, "maximum": 9007199254740991, "title": "Helper cache TTL (sec)", "description": "Maximum age of a cached helper result, in seconds (default 300). Applies when the server starts or restarts.", "default": 300, "x-consentRequired": false, "x-availableInVersionOverride": "1.21459.0" }, "startupTimeoutSec": { "type": "integer", "minimum": 5, "maximum": 600, "title": "Startup timeout", "description": "Maximum wait in seconds for the server to start and list its tools.", "default": 120, "x-consentRequired": false, "x-availableInVersionOverride": "1.19367.0" }, "toolPolicy": { "title": "Tool policy", "description": "Lock the approval state for specific tools. Unlisted tools stay user-controlled.", "x-consentRequired": false, "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "string", "enum": [ "allow", "ask", "ask-session", "blocked" ], "x-deprecatedValues": [ { "value": "ask-session", "use": "ask", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ], "x-valueAvailableInVersionOverride": [ { "value": "ask-session", "availableInVersion": "1.21459.0" } ] } } }, "required": [ "name", "transport", "command" ] }, { "type": "object", "properties": { "name": { "type": "string", "minLength": 1, "title": "Name", "description": "Unique name for this server. Shown to users and used to key tool policy and sign-in state.", "x-consentRequired": false }, "server": { "not": {} }, "transport": { "type": "string", "const": "policy-only", "title": "Transport", "description": "How the app connects: Streamable HTTP, legacy SSE, or a local command (stdio). policy-only connects to nothing; it only sets a plugin server’s tool policy.", "x-consentRequired": false, "x-availableInVersionOverride": "2.110.0" }, "url": { "not": {} }, "command": { "not": {} }, "oauth": { "not": {} }, "headers": { "not": {} }, "headersHelper": { "not": {} }, "headersHelperTtlSec": { "not": {} }, "headersHelperRefreshBufferSec": { "not": {} }, "args": { "not": {} }, "env": { "not": {} }, "envHelper": { "not": {} }, "envHelperTtlSec": { "not": {} }, "startupTimeoutSec": { "not": {} }, "toolPolicy": { "title": "Tool policy", "description": "Lock the approval state for specific tools. Unlisted tools stay user-controlled.", "x-consentRequired": false, "type": "object", "propertyNames": { "type": "string" }, "additionalProperties": { "type": "string", "enum": [ "allow", "ask", "ask-session", "blocked" ], "x-deprecatedValues": [ { "value": "ask-session", "use": "ask", "warnFrom": "2026-09-10", "supportEnds": "2026-10-07" } ], "x-valueAvailableInVersionOverride": [ { "value": "ask-session", "availableInVersion": "1.21459.0" } ] } } }, "required": [ "name", "transport" ] } ] } ] }, { "type": "null" } ] }, "title": "Managed MCP servers", "description": "Org-pushed MCP servers: remote (HTTP/SSE) or local (stdio command). May embed bearer tokens.", "x-flatKey": "managedMcpServers", "x-readers": [ "desktop", "m365" ], "x-whenUnreadable": { "unusable": true }, "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "persistentAlwaysAllowEnabled": { "type": "boolean", "title": "Allow persistent tool approvals", "description": "Offer the persistent “Always allow” approval options for MCP tools. Disable to keep tool approvals per-call or session-scoped only.", "default": true, "x-flatKey": "mcpPersistentAlwaysAllowEnabled", "x-whenUnreadable": { "applies": false }, "x-availableInVersion": "1.24012.9", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "scheduledTaskApprovalLifetimeDays": { "type": "integer", "minimum": 0, "maximum": 3650, "title": "Scheduled-task tool approval lifetime", "description": "How many days a scheduled task may reuse a lasting MCP-tool approval before it asks again. 0 removes the lasting option.", "x-flatKey": "mcpScheduledTaskApprovalLifetimeDays", "x-whenUnreadable": { "applies": 0 }, "x-availableInVersion": "2.7032.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "localStdioEnabled": { "type": "boolean", "title": "Allow user-added MCP servers", "description": "Local stdio servers added via the Developer settings. Remote servers come from the managed list above or organization plugins.", "default": true, "x-flatKey": "isLocalDevMcpEnabled", "x-whenUnreadable": { "applies": false }, "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "allowedPluginServers": { "type": "array", "items": { "anyOf": [ { "type": "object", "properties": { "serverUrl": { "type": "string", "minLength": 1, "title": "Server URL pattern", "description": "URL pattern a plugin’s remote server must match, with * wildcards.", "x-consentRequired": false } }, "required": [ "serverUrl" ] }, { "type": "null" } ] }, "title": "Allowed plugin MCP servers", "description": "Servers plugins may connect in sessions, beyond the managed list above and organization plugins. An empty list allows none; unset keeps today’s rules.", "x-flatKey": "allowedPluginMcpServers", "x-whenUnreadable": { "applies": [] }, "x-availableInVersion": "2.2553.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "deniedPluginServers": { "type": "array", "items": { "type": "object", "properties": { "serverUrl": { "type": "string", "minLength": 1, "title": "Server URL pattern", "description": "URL pattern of the remote servers to block, with * wildcards.", "x-consentRequired": false } }, "required": [ "serverUrl" ] }, "title": "Blocked plugin MCP servers", "description": "Remote servers plugins may not connect, even if the allowed list admits them; in Code sessions, configuration-file servers too. Unset or empty blocks none.", "x-flatKey": "deniedPluginMcpServers", "x-whenUnreadable": { "applies": [ { "serverUrl": "*" } ] }, "x-availableInVersion": "2.16120.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "toolTimeoutSec": { "type": "integer", "minimum": 60, "maximum": 3600, "title": "MCP tool call timeout", "description": "Per-call timeout for MCP tool calls, in seconds. Default 180 (3 minutes).", "x-flatKey": "mcpToolTimeoutSec", "x-availableInVersion": "1.37937.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false } } }, "workspace": { "type": "object", "properties": { "disabledBuiltinTools": { "type": "array", "items": { "type": "string" }, "title": "Disabled built-in tools", "description": "Built-in tools, or argument-scoped permission rules such as Read(//**/.env), denied in Cowork and Code.", "x-flatKey": "disabledBuiltinTools", "x-whenUnreadable": { "applies": [ "Bash", "Read", "Write", "Edit", "Glob", "Grep", "NotebookEdit", "WebFetch", "WebSearch", "Task", "TodoWrite", "TaskCreate", "TaskUpdate", "TaskGet", "TaskList", "TaskStop", "Skill", "REPL", "JavaScript", "AskUserQuestion", "ToolSearch", "SendUserMessage" ] }, "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "disableBundledSkills": { "type": "boolean", "title": "Disable bundled skills and workflows", "description": "Disables Claude Code’s bundled skills and workflows (deep-research and similar). Use where WebFetch/WebSearch aren’t available.", "x-flatKey": "disableBundledSkills", "x-whenUnreadable": { "applies": true }, "x-availableInVersion": "1.15962.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "skillCreationEnabled": { "type": "boolean", "title": "Allow user-created skills", "description": "Allow users to create and upload their own skills. When off, the creation and upload surfaces are hidden and the agent’s skill-creation tools are disabled.", "x-flatKey": "skillCreationEnabled", "x-whenUnreadable": { "applies": false }, "x-availableInVersion": "1.25927.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "scheduledTasksEnabled": { "type": "boolean", "title": "Allow scheduled tasks", "description": "Allow scheduled tasks in Cowork and Code. When off, the Scheduled page is hidden, existing tasks stop running, and Claude cannot create new ones.", "x-flatKey": "scheduledTasksEnabled", "x-whenUnreadable": { "applies": false }, "x-availableInVersion": "2.110.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "keepAwakeEnabled": { "type": "boolean", "title": "Allow keep awake", "description": "Let Claude keep the computer awake. When off, Claude never prevents sleep and hides the keep-awake switches in Settings, the Scheduled page and the Code tab.", "x-flatKey": "keepAwakeEnabled", "x-whenUnreadable": { "applies": false }, "x-availableInVersion": "2.7032.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "developerModeEnabled": { "type": "boolean", "title": "Allow Developer Mode", "description": "Let users turn on Developer Mode. When off, the app’s developer tools and the option to install an unpacked extension are unavailable.", "x-flatKey": "developerModeEnabled", "x-whenUnreadable": { "applies": false }, "x-availableInVersion": "2.37337.1", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "builtinToolPolicy": { "type": "object", "propertyNames": { "type": "string", "pattern": "^(?:(Bash|Read|Write|Edit|Glob|Grep|NotebookEdit|Task|TodoWrite|TaskCreate|TaskUpdate|TaskGet|TaskList|TaskStop|Skill|REPL|JavaScript|AskUserQuestion|ToolSearch|SendUserMessage)(?:\\((\\S[^\\r\\n]*)\\))?|(WebSearch|WebFetch))$" }, "additionalProperties": { "type": "string", "enum": [ "allow", "ask" ] }, "title": "Built-in tool policy", "description": "Approval policy per built-in tool or argument-scoped rule such as Bash(curl *). “ask” requires user approval before each matching call; “allow” is the default.", "x-flatKey": "builtinToolPolicy", "x-whenUnreadable": { "applies": { "Bash": "ask", "Read": "ask", "Write": "ask", "Edit": "ask", "Glob": "ask", "Grep": "ask", "NotebookEdit": "ask", "WebFetch": "ask", "WebSearch": "ask", "Task": "ask", "TodoWrite": "ask", "TaskCreate": "ask", "TaskUpdate": "ask", "TaskGet": "ask", "TaskList": "ask", "TaskStop": "ask", "Skill": "ask", "REPL": "ask", "JavaScript": "ask", "AskUserQuestion": "ask", "ToolSearch": "ask", "SendUserMessage": "ask" } }, "x-availableInVersion": "1.8089.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "autoModeEnabled": { "type": "boolean", "title": "Allow Auto mode", "description": "Offer Auto mode in the Code permission selector (on unless set to false); set to true to also offer it in Cowork. Claude decides which actions need approval.", "x-flatKey": "autoModeEnabled", "x-whenUnreadable": { "applies": false }, "x-availableInVersion": "1.10628.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "disableBypassPermissionsMode": { "type": "boolean", "title": "Disable bypass permissions mode", "description": "Remove the bypass permissions mode from Code sessions and Cowork tasks, so Claude always follows the permission policy. Off by default.", "x-flatKey": "disableBypassPermissionsMode", "x-whenUnreadable": { "applies": true }, "x-availableInVersion": "1.46388.1", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "toolSearchEnabled": { "type": "boolean", "title": "Enable tool search", "description": "Load MCP tool schemas on demand (tool search) instead of inlining every schema into context.", "default": false, "x-flatKey": "toolSearchEnabled", "x-availableInVersion": "1.21459.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "skipWebFetchPreflight": { "type": "boolean", "title": "Skip WebFetch domain check", "description": "Skip Claude Code’s WebFetch domain lookup against api.anthropic.com in Code sessions. Off by default; turn on when that host is blocked.", "x-flatKey": "skipWebFetchPreflight", "x-availableInVersion": "1.37937.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "allowedFolders": { "type": "array", "items": { "anyOf": [ { "type": "string", "minLength": 1 }, { "type": "object", "properties": { "path": { "type": "string", "minLength": 1, "title": "Path", "description": "Absolute folder path. May start with ~ or one of the listed %VAR% tokens, expanded per user. Subfolders are included.", "x-consentRequired": false, "x-availableInVersionOverride": "1.14271.0" }, "isDefaultSelected": { "type": "boolean", "title": "Pre-select on new task", "description": "Shows as a folder chip on the new-task page and skips the trust prompt. Users can remove it.", "x-consentRequired": false, "x-availableInVersionOverride": "1.14271.0" }, "mode": { "type": "string", "enum": [ "rw", "ro" ], "title": "Access mode", "description": "Read-only folders can be viewed and searched but not modified in Cowork. In Code, applies to file tools only. Over SSH, also to Bash in its sandbox.", "x-consentRequired": false, "x-availableInVersionOverride": "1.26832.0" } }, "required": [ "path" ] } ] }, "title": "Allowed workspace folders", "description": "Folders where Claude may work. Applies to Cowork and Code sessions and to the project folders a chat reads. Leave unset for unrestricted access.", "x-flatKey": "allowedWorkspaceFolders", "x-whenUnreadable": { "applies": [] }, "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "blockReadsOutsideWorkingDirectories": { "type": "boolean", "title": "Block reads outside working directories", "description": "Keep Claude from reading files outside a Code session’s working directories. File tools refuse such reads; sandboxed shell commands lose the home directory.", "x-flatKey": "blockReadsOutsideWorkingDirectories", "x-whenUnreadable": { "applies": true }, "x-availableInVersion": "1.46388.1", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "allowedEgressHosts": { "type": "array", "items": { "type": "string", "minLength": 1 }, "title": "Allowed egress hosts", "description": "Hosts agent tools may reach in Cowork and Chat (Code: in part). An empty list acts as unset for tools, but stops Claude opening sites in the built-in browser.", "x-flatKey": "coworkEgressAllowedHosts", "x-whenUnreadable": { "applies": [] }, "x-availableInVersion": "1.2581.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "vmIpv6Enabled": { "type": "boolean", "title": "Enable IPv6 in the workspace VM", "description": "Give the Cowork workspace VM an IPv6 address and route so the agent’s tools can reach IPv6-only hosts through the device. macOS and Windows; off by default.", "x-flatKey": "coworkVmIpv6Enabled", "x-availableInVersion": "1.52386.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "endUserAttribution": { "type": "boolean", "title": "End-user attribution", "description": "Show the signed-in user’s identity-provider identity in the sidebar and account menu, and emit it as the OpenTelemetry enduser.id resource attribute.", "x-flatKey": "endUserAttribution", "x-whenUnreadable": { "applies": false }, "x-availableInVersion": "1.25927.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "userContentRendererUrl": { "type": "string", "format": "uri", "title": "Artifact preview iframe origin", "description": "HTTPS origin of the user-content-renderer deployment used for artifact and file previews. Defaults to the commercial host when unset.", "x-flatKey": "userContentRendererUrl", "x-availableInVersion": "1.24012.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "organizationInstructions": { "type": "string", "minLength": 1, "maxLength": 3000, "title": "Organization instructions", "description": "Appended to Claude’s system prompt in Chat, Cowork, and Code. Guidance the model follows, not an enforced control. Up to 3,000 characters.", "x-flatKey": "organizationInstructions", "x-availableInVersion": "1.37937.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false } } }, "builtinBrowser": { "type": "object", "properties": { "enabled": { "type": "boolean", "title": "Allow the built-in browser", "description": "Offer the built-in browser in Cowork and Code sessions so users and Claude can open and work with web pages. Site sign-ins stay on the device until cleared.", "default": false, "x-flatKey": "builtinBrowserEnabled", "x-availableInVersion": "2.2553.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "defaultDomainPolicy": { "type": "string", "enum": [ "allow", "block" ], "title": "Default site policy in the built-in browser", "description": "Whether Claude may open sites in the built-in browser by default; the allowed or blocked list is the exception. Mirrors the Claude in Chrome site policy.", "default": "allow", "x-flatKey": "builtinBrowserDefaultDomainPolicy", "x-whenUnreadable": { "applies": "block" }, "x-availableInVersion": "2.2553.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "allowedDomains": { "type": "array", "items": { "type": "string", "minLength": 1 }, "title": "Allowed sites in the built-in browser", "description": "Sites Claude may open, read, and act on in the built-in browser when the default site policy is block. Users can still view other sites.", "x-flatKey": "builtinBrowserAllowedDomains", "x-whenUnreadable": { "applies": [] }, "x-availableInVersion": "2.2553.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "blockedDomains": { "type": "array", "items": { "type": "string", "minLength": 1 }, "title": "Blocked sites in the built-in browser", "description": "Sites Claude may not open, read, or act on in the built-in browser when the default site policy is allow. Users can still view them.", "x-flatKey": "builtinBrowserBlockedDomains", "x-whenUnreadable": { "applies": [ "*" ] }, "x-availableInVersion": "2.2553.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false } } }, "authentication": { "type": "object", "properties": { "disableClaudeAiSignIn": { "type": "boolean", "title": "Disable Claude.ai sign-in", "description": "Users see only this provider at the login screen. The option to sign in to Claude.ai is hidden.", "default": false, "x-flatKey": "disableDeploymentModeChooser", "x-whenUnreadable": { "applies": true }, "x-availableInVersion": "1.3834.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "disableDeepLinks": { "type": "boolean", "title": "Disable claude:// deep-link handling", "description": "Stop external apps and websites from opening Claude Desktop via claude:// links.", "default": false, "x-flatKey": "disableDeepLinkRegistration", "x-whenUnreadable": { "applies": true }, "x-availableInVersion": "1.6889.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "microsoftAuthBroker": { "type": "string", "enum": [ "auto", "disabled", "required" ], "title": "Microsoft 365 native sign-in broker", "description": "“disabled” forces browser-based Microsoft 365 sign-in; “required” fails sign-in when the OS broker is unavailable, so the refresh token stays broker-held.", "default": "auto", "x-flatKey": "microsoftAuthBroker", "x-whenUnreadable": { "applies": "disabled" }, "x-availableInVersion": "1.19367.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false, "x-valueAvailableInVersionOverride": [ { "value": "required", "availableInVersion": "1.49585.0" } ] }, "microsoftAuthDefaultAccount": { "type": "string", "enum": [ "enabled", "disabled" ], "title": "Microsoft 365 sign-in with the Windows account", "description": "“enabled”: when a user clicks Connect on Windows, Microsoft 365 signs in with the work account already signed in to Windows, without the account picker.", "default": "disabled", "x-flatKey": "microsoftAuthDefaultAccount", "x-whenUnreadable": { "applies": "disabled" }, "x-availableInVersion": "2.26454.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false } } }, "appearance": { "type": "object", "properties": { "deploymentDisplayName": { "type": "string", "minLength": 1, "maxLength": 60, "title": "Deployment display name", "description": "Overrides the provider label shown in the sidebar footer, user-menu header, and connection-error banner.", "x-flatKey": "deploymentDisplayName", "x-availableInVersion": "1.24012.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "deploymentDisplaySubtitle": { "type": "string", "minLength": 1, "maxLength": 60, "title": "Deployment display subtitle", "description": "Optional detail shown after the deployment display name in the account-menu header.", "x-flatKey": "deploymentDisplaySubtitle", "x-availableInVersion": "1.24012.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "disableConfigDeprecationWarnings": { "type": "boolean", "title": "Hide configuration deprecation warnings", "description": "Don’t show users the in-app warning that this configuration uses a deprecated field. The final reminder in the 24 hours before the cut-off still appears.", "x-flatKey": "disableConfigDeprecationWarnings", "x-availableInVersion": "1.40609.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false } } }, "claudeAiImport": { "type": "object", "properties": { "enabled": { "default": false, "title": "Enable import", "description": "Lets users import a Claude.ai data export and earlier Claude sessions on this computer from Settings → Import. Doesn’t affect a provisioned sign-in import.", "x-consentRequired": false, "type": "boolean", "x-availableInVersionOverride": "1.28929.0" }, "allowedOrganizationUuids": { "title": "Organizations users may import from", "description": "When set, users import by sign-in only, and only from the Claude.ai organizations with these IDs.", "x-consentRequired": false, "type": "array", "items": { "type": "string" }, "x-availableInVersionOverride": "2.26454.0" }, "automatic3pImport": { "title": "Automatically import earlier third-party sessions", "description": "Copy this computer’s earlier third-party sessions into the app once, in the background. Independent of `enabled`.", "x-consentRequired": false, "type": "boolean", "x-availableInVersionOverride": "1.40609.0" }, "exportEnabled": { "default": false, "title": "Enable session export", "description": "Lets users export this computer’s chats, Cowork tasks, and Code sessions as a zip another install can import. No effect unless `enabled` is true.", "x-consentRequired": false, "type": "boolean", "x-availableInVersionOverride": "1.32352.0" }, "bannerBehavior": { "title": "Import prompt banner", "description": "Prompt to import on a new chat or task. Off if unset. `show`: always; needs `enabled` or a sign-in import. `detect`: if `enabled` finds earlier Claude sessions.", "x-consentRequired": false, "type": "string", "enum": [ "off", "detect", "show" ], "x-availableInVersionOverride": "1.28929.0" } }, "title": "Claude.ai data import", "description": "Lets users import Claude.ai chats and projects, plus earlier Claude sessions on this computer, when `enabled` is true. `automatic3pImport` is a separate switch.", "x-flatKey": "claudeAiImport", "x-availableInVersion": "1.10628.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false }, "banner": { "type": "object", "properties": { "enabled": { "type": "boolean", "title": "Show banner", "description": "Turns the banner on. When false or unset, the other banner fields are ignored.", "x-consentRequired": false }, "text": { "type": "string", "title": "Banner text", "description": "Single line, truncated on overflow. Maximum 200 characters.", "x-consentRequired": false }, "backgroundColor": { "type": "string", "title": "Background color", "description": "Six-digit hex (#RRGGBB). Applied exactly as configured; not theme-adapted.", "default": "#F5F5F5", "x-consentRequired": false }, "textColor": { "type": "string", "title": "Text color", "description": "Six-digit hex (#RRGGBB). Applied exactly as configured; not theme-adapted.", "default": "#000000", "x-consentRequired": false }, "linkUrl": { "type": "string", "title": "Link URL", "description": "Optional HTTPS URL. The banner text becomes a link when set.", "x-consentRequired": false } }, "title": "Organization banner", "description": "A persistent banner across the top of the app window after sign-in.", "x-flatKey": "banner", "x-availableInVersion": "1.7196.0", "x-availability": "both", "x-deprecated": false, "x-beta": false, "x-consentRequired": false, "x-originPinned": false } }, "description": "Per-user bootstrap configuration response in the nested format (`$schemaVersion` 2): a subset of managed configuration grouped into cluster objects (bootstrapable keys only). Structural reference for editor autocomplete — the client applies further validation that this schema does not express (https-only and non-loopback URLs, origin-pinning under gateway SSO). Unrecognised keys are ignored. The flat key names of bootstrap-config-v1 are also accepted at top level beside clusters. A node marked `x-readers` is read by the clients it names (`desktop` = Claude Desktop, `m365` = the Claude add-in for Microsoft 365); an unmarked node is read by Claude Desktop only. The marker is per key; which providers a client supports is that client's own list. A key node's `x-whenUnreadable` says what Claude Desktop does when the key is present but its value is invalid (wrong type, malformed, or no usable entry; `null` and a blank string count as not set): `{\"applies\": value}` means it applies that value; `{\"unusable\": true}` means it treats the key as set but unusable (an invalid managed MCP server list keeps plugin-provided servers' tools blocked rather than allowing them), and a server that mirrors the app should do the same. A key node without it is treated as not set in that case. Each key node's `x-availableInVersion` is the first Claude Desktop release that reads the key; the app names its version as `Claude/` in the User-Agent of the request, so a server can leave out keys the requesting build does not read yet. Below a key, releases are stated by exception: a property node carries `x-availableInVersionOverride` only when it is first read by a later release than the node above it, and an `enum` or `const` node's `x-valueAvailableInVersionOverride` lists `{value, availableInVersion}` only for the values first read by a later release than the node. The release from which a location in a document is read is the newest one stated on the path from the root to it: the key's `x-availableInVersion`, any override on a property node along the way (array items, map values and union alternatives add no level of their own), the value's own entry, and — inside a union alternative (a managed MCP server, OAuth, marketplace or inference-provider variant) — the release stated on that alternative's discriminator property (`server`, `mode`, `transport`, `source`, `provider`, …): its override, or the entry for its value; the alternative's other properties and any key repeated inside it are read no earlier than that." } } }