4 4
5Claude Code offers a variety of settings to configure its behavior to meet your needs. You can configure Claude Code by running the `/config` command when using the interactive REPL, which opens a tabbed Settings interface where you can view status information and modify configuration options.5Claude Code offers a variety of settings to configure its behavior to meet your needs. You can configure Claude Code by running the `/config` command when using the interactive REPL, which opens a tabbed Settings interface where you can view status information and modify configuration options.
6 6
7## Configuration scopes
8
9Claude Code uses a **scope system** to determine where configurations apply and who they're shared with. Understanding scopes helps you decide how to configure Claude Code for personal use, team collaboration, or enterprise deployment.
10
11### Available scopes
12
13| Scope | Location | Who it affects | Shared with team? |
14| :---------- | :----------------------------------- | :----------------------------------- | :--------------------- |
15| **Managed** | System-level `managed-settings.json` | All users on the machine | Yes (deployed by IT) |
16| **User** | `~/.claude/` directory | You, across all projects | No |
17| **Project** | `.claude/` in repository | All collaborators on this repository | Yes (committed to git) |
18| **Local** | `.claude/*.local.*` files | You, in this repository only | No (gitignored) |
19
20### When to use each scope
21
22**Managed scope** is for:
23
24* Security policies that must be enforced organization-wide
25* Compliance requirements that can't be overridden
26* Standardized configurations deployed by IT/DevOps
27
28**User scope** is best for:
29
30* Personal preferences you want everywhere (themes, editor settings)
31* Tools and plugins you use across all projects
32* API keys and authentication (stored securely)
33
34**Project scope** is best for:
35
36* Team-shared settings (permissions, hooks, MCP servers)
37* Plugins the whole team should have
38* Standardizing tooling across collaborators
39
40**Local scope** is best for:
41
42* Personal overrides for a specific project
43* Testing configurations before sharing with the team
44* Machine-specific settings that won't work for others
45
46### How scopes interact
47
48When the same setting is configured in multiple scopes, more specific scopes take precedence:
49
501. **Managed** (highest) - can't be overridden by anything
512. **Command line arguments** - temporary session overrides
523. **Local** - overrides project and user settings
534. **Project** - overrides user settings
545. **User** (lowest) - applies when nothing else specifies the setting
55
56For example, if a permission is allowed in user settings but denied in project settings, the project setting takes precedence and the permission is blocked.
57
58### What uses scopes
59
60Scopes apply to many Claude Code features:
61
62| Feature | User location | Project location | Local location |
63| :-------------- | :------------------------ | :--------------------------------- | :----------------------------- |
64| **Settings** | `~/.claude/settings.json` | `.claude/settings.json` | `.claude/settings.local.json` |
65| **Subagents** | `~/.claude/agents/` | `.claude/agents/` | — |
66| **MCP servers** | `~/.claude.json` | `.mcp.json` | `~/.claude.json` (per-project) |
67| **Plugins** | `~/.claude/settings.json` | `.claude/settings.json` | `.claude/settings.local.json` |
68| **CLAUDE.md** | `~/.claude/CLAUDE.md` | `CLAUDE.md` or `.claude/CLAUDE.md` | `CLAUDE.local.md` |
69
70***
71
7## Settings files72## Settings files
8 73
9The `settings.json` file is our official mechanism for configuring Claude74The `settings.json` file is our official mechanism for configuring Claude
14* **Project settings** are saved in your project directory:79* **Project settings** are saved in your project directory:
15 * `.claude/settings.json` for settings that are checked into source control and shared with your team80 * `.claude/settings.json` for settings that are checked into source control and shared with your team
16 * `.claude/settings.local.json` for settings that are not checked in, useful for personal preferences and experimentation. Claude Code will configure git to ignore `.claude/settings.local.json` when it is created.81 * `.claude/settings.local.json` for settings that are not checked in, useful for personal preferences and experimentation. Claude Code will configure git to ignore `.claude/settings.local.json` when it is created.
17* For enterprise deployments of Claude Code, we also support **enterprise82* **Managed settings**: For organizations that need centralized control, Claude Code supports `managed-settings.json` and `managed-mcp.json` files that can be deployed to system directories:
18 managed policy settings**. These take precedence over user and project83
19 settings. System administrators can deploy policies to:84 * macOS: `/Library/Application Support/ClaudeCode/`
20 * macOS: `/Library/Application Support/ClaudeCode/managed-settings.json`85 * Linux and WSL: `/etc/claude-code/`
21 * Linux and WSL: `/etc/claude-code/managed-settings.json`86 * Windows: `C:\Program Files\ClaudeCode\`
22 * Windows: `C:\ProgramData\ClaudeCode\managed-settings.json`87
23* Enterprise deployments can also configure **managed MCP servers** that override88 <Note>
24 user-configured servers. See [Enterprise MCP configuration](/en/docs/claude-code/mcp#enterprise-mcp-configuration):89 These are system-wide paths (not user home directories like `~/Library/...`) that require administrator privileges. They are designed to be deployed by IT administrators.
25 * macOS: `/Library/Application Support/ClaudeCode/managed-mcp.json`90 </Note>
26 * Linux and WSL: `/etc/claude-code/managed-mcp.json`91
27 * Windows: `C:\ProgramData\ClaudeCode\managed-mcp.json`92 See [Managed settings](/en/iam#managed-settings) and [Managed MCP configuration](/en/mcp#managed-mcp-configuration) for details.
93
94 <Note>
95 Managed deployments can also restrict **plugin marketplace additions** using
96 `strictKnownMarketplaces`. For more information, see [Managed marketplace restrictions](/en/plugin-marketplaces#managed-marketplace-restrictions).
97 </Note>
98* **Other configuration** is stored in `~/.claude.json`. This file contains your preferences (theme, notification settings, editor mode), OAuth session, [MCP server](/en/mcp) configurations for user and local scopes, per-project state (allowed tools, trust settings), and various caches. Project-scoped MCP servers are stored separately in `.mcp.json`.
28 99
29```JSON Example settings.json theme={null}100```JSON Example settings.json theme={null}
30{101{
44 "env": {115 "env": {
45 "CLAUDE_CODE_ENABLE_TELEMETRY": "1",116 "CLAUDE_CODE_ENABLE_TELEMETRY": "1",
46 "OTEL_METRICS_EXPORTER": "otlp"117 "OTEL_METRICS_EXPORTER": "otlp"
47 }118 },
119 "companyAnnouncements": [
120 "Welcome to Acme Corp! Review our code guidelines at docs.acme.com",
121 "Reminder: Code reviews required for all PRs",
122 "New security policy in effect"
123 ]
48}124}
49```125```
50 126
53`settings.json` supports a number of options:129`settings.json` supports a number of options:
54 130
55| Key | Description | Example |131| Key | Description | Example |
56| :--------------------------- | :-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :---------------------------------------------------------- |132| :--------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | :---------------------------------------------------------------------- |
57| `apiKeyHelper` | Custom script, to be executed in `/bin/sh`, to generate an auth value. This value will be sent as `X-Api-Key` and `Authorization: Bearer` headers for model requests | `/bin/generate_temp_api_key.sh` |133| `apiKeyHelper` | Custom script, to be executed in `/bin/sh`, to generate an auth value. This value will be sent as `X-Api-Key` and `Authorization: Bearer` headers for model requests | `/bin/generate_temp_api_key.sh` |
58| `cleanupPeriodDays` | How long to locally retain chat transcripts based on last activity date (default: 30 days) | `20` |134| `cleanupPeriodDays` | Sessions inactive for longer than this period are deleted at startup. Setting to `0` immediately deletes all sessions. (default: 30 days) | `20` |
135| `companyAnnouncements` | Announcement to display to users at startup. If multiple announcements are provided, they will be cycled through at random. | `["Welcome to Acme Corp! Review our code guidelines at docs.acme.com"]` |
59| `env` | Environment variables that will be applied to every session | `{"FOO": "bar"}` |136| `env` | Environment variables that will be applied to every session | `{"FOO": "bar"}` |
60| `includeCoAuthoredBy` | Whether to include the `co-authored-by Claude` byline in git commits and pull requests (default: `true`) | `false` |137| `attribution` | Customize attribution for git commits and pull requests. See [Attribution settings](#attribution-settings) | `{"commit": "🤖 Generated with Claude Code", "pr": ""}` |
138| `includeCoAuthoredBy` | **Deprecated**: Use `attribution` instead. Whether to include the `co-authored-by Claude` byline in git commits and pull requests (default: `true`) | `false` |
61| `permissions` | See table below for structure of permissions. | |139| `permissions` | See table below for structure of permissions. | |
62| `hooks` | Configure custom commands to run before or after tool executions. See [hooks documentation](hooks) | `{"PreToolUse": {"Bash": "echo 'Running command...'"}}` |140| `hooks` | Configure custom commands to run before or after tool executions. See [hooks documentation](/en/hooks) | `{"PreToolUse": {"Bash": "echo 'Running command...'"}}` |
63| `disableAllHooks` | Disable all [hooks](hooks) | `true` |141| `disableAllHooks` | Disable all [hooks](/en/hooks) | `true` |
142| `allowManagedHooksOnly` | (Managed settings only) Prevent loading of user, project, and plugin hooks. Only allows managed hooks and SDK hooks. See [Hook configuration](#hook-configuration) | `true` |
64| `model` | Override the default model to use for Claude Code | `"claude-sonnet-4-5-20250929"` |143| `model` | Override the default model to use for Claude Code | `"claude-sonnet-4-5-20250929"` |
65| `statusLine` | Configure a custom status line to display context. See [statusLine documentation](statusline) | `{"type": "command", "command": "~/.claude/statusline.sh"}` |144| `otelHeadersHelper` | Script to generate dynamic OpenTelemetry headers. Runs at startup and periodically (see [Dynamic headers](/en/monitoring-usage#dynamic-headers)) | `/bin/generate_otel_headers.sh` |
66| `outputStyle` | Configure an output style to adjust the system prompt. See [output styles documentation](output-styles) | `"Explanatory"` |145| `statusLine` | Configure a custom status line to display context. See [`statusLine` documentation](/en/statusline) | `{"type": "command", "command": "~/.claude/statusline.sh"}` |
146| `fileSuggestion` | Configure a custom script for `@` file autocomplete. See [File suggestion settings](#file-suggestion-settings) | `{"type": "command", "command": "~/.claude/file-suggestion.sh"}` |
147| `outputStyle` | Configure an output style to adjust the system prompt. See [output styles documentation](/en/output-styles) | `"Explanatory"` |
67| `forceLoginMethod` | Use `claudeai` to restrict login to Claude.ai accounts, `console` to restrict login to Claude Console (API usage billing) accounts | `claudeai` |148| `forceLoginMethod` | Use `claudeai` to restrict login to Claude.ai accounts, `console` to restrict login to Claude Console (API usage billing) accounts | `claudeai` |
68| `forceLoginOrgUUID` | Specify the UUID of an organization to automatically select it during login, bypassing the organization selection step. Requires `forceLoginMethod` to be set | `"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"` |149| `forceLoginOrgUUID` | Specify the UUID of an organization to automatically select it during login, bypassing the organization selection step. Requires `forceLoginMethod` to be set | `"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"` |
69| `enableAllProjectMcpServers` | Automatically approve all MCP servers defined in project `.mcp.json` files | `true` |150| `enableAllProjectMcpServers` | Automatically approve all MCP servers defined in project `.mcp.json` files | `true` |
70| `enabledMcpjsonServers` | List of specific MCP servers from `.mcp.json` files to approve | `["memory", "github"]` |151| `enabledMcpjsonServers` | List of specific MCP servers from `.mcp.json` files to approve | `["memory", "github"]` |
71| `disabledMcpjsonServers` | List of specific MCP servers from `.mcp.json` files to reject | `["filesystem"]` |152| `disabledMcpjsonServers` | List of specific MCP servers from `.mcp.json` files to reject | `["filesystem"]` |
72| `useEnterpriseMcpConfigOnly` | When set in managed-settings.json, restricts MCP servers to only those defined in managed-mcp.json. See [Enterprise MCP configuration](/en/docs/claude-code/mcp#enterprise-mcp-configuration) | `true` |153| `allowedMcpServers` | When set in managed-settings.json, allowlist of MCP servers users can configure. Undefined = no restrictions, empty array = lockdown. Applies to all scopes. Denylist takes precedence. See [Managed MCP configuration](/en/mcp#managed-mcp-configuration) | `[{ "serverName": "github" }]` |
73| `allowedMcpServers` | When set in managed-settings.json, allowlist of MCP servers users can configure. Undefined = no restrictions, empty array = lockdown. Applies to all scopes. Denylist takes precedence. See [Enterprise MCP configuration](/en/docs/claude-code/mcp#enterprise-mcp-configuration) | `[{ "serverName": "github" }]` |154| `deniedMcpServers` | When set in managed-settings.json, denylist of MCP servers that are explicitly blocked. Applies to all scopes including managed servers. Denylist takes precedence over allowlist. See [Managed MCP configuration](/en/mcp#managed-mcp-configuration) | `[{ "serverName": "filesystem" }]` |
74| `deniedMcpServers` | When set in managed-settings.json, denylist of MCP servers that are explicitly blocked. Applies to all scopes including enterprise servers. Denylist takes precedence over allowlist. See [Enterprise MCP configuration](/en/docs/claude-code/mcp#enterprise-mcp-configuration) | `[{ "serverName": "filesystem" }]` |155| `strictKnownMarketplaces` | When set in managed-settings.json, allowlist of plugin marketplaces users can add. Undefined = no restrictions, empty array = lockdown. Applies to marketplace additions only. See [Managed marketplace restrictions](/en/plugin-marketplaces#managed-marketplace-restrictions) | `[{ "source": "github", "repo": "acme-corp/plugins" }]` |
75| `awsAuthRefresh` | Custom script that modifies the `.aws` directory (see [advanced credential configuration](/en/docs/claude-code/amazon-bedrock#advanced-credential-configuration)) | `aws sso login --profile myprofile` |156| `awsAuthRefresh` | Custom script that modifies the `.aws` directory (see [advanced credential configuration](/en/amazon-bedrock#advanced-credential-configuration)) | `aws sso login --profile myprofile` |
76| `awsCredentialExport` | Custom script that outputs JSON with AWS credentials (see [advanced credential configuration](/en/docs/claude-code/amazon-bedrock#advanced-credential-configuration)) | `/bin/generate_aws_grant.sh` |157| `awsCredentialExport` | Custom script that outputs JSON with AWS credentials (see [advanced credential configuration](/en/amazon-bedrock#advanced-credential-configuration)) | `/bin/generate_aws_grant.sh` |
158| `alwaysThinkingEnabled` | Enable [extended thinking](/en/common-workflows#use-extended-thinking) by default for all sessions. Typically configured via the `/config` command rather than editing directly | `true` |
77 159
78### Permission settings160### Permission settings
79 161
80| Keys | Description | Example |162| Keys | Description | Example |
81| :----------------------------- | :---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :--------------------------------------------------------------------- |163| :----------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | :--------------------------------------------------------------------- |
82| `allow` | Array of [permission rules](/en/docs/claude-code/iam#configuring-permissions) to allow tool use. **Note:** Bash rules use prefix matching, not regex | `[ "Bash(git diff:*)" ]` |164| `allow` | Array of [permission rules](/en/iam#configuring-permissions) to allow tool use. **Note:** Bash rules use prefix matching, not regex | `[ "Bash(git diff:*)" ]` |
83| `ask` | Array of [permission rules](/en/docs/claude-code/iam#configuring-permissions) to ask for confirmation upon tool use. | `[ "Bash(git push:*)" ]` |165| `ask` | Array of [permission rules](/en/iam#configuring-permissions) to ask for confirmation upon tool use. | `[ "Bash(git push:*)" ]` |
84| `deny` | Array of [permission rules](/en/docs/claude-code/iam#configuring-permissions) to deny tool use. Use this to also exclude sensitive files from Claude Code access. **Note:** Bash patterns are prefix matches and can be bypassed (see [Bash permission limitations](/en/docs/claude-code/iam#tool-specific-permission-rules)) | `[ "WebFetch", "Bash(curl:*)", "Read(./.env)", "Read(./secrets/**)" ]` |166| `deny` | Array of [permission rules](/en/iam#configuring-permissions) to deny tool use. Use this to also exclude sensitive files from Claude Code access. **Note:** Bash patterns are prefix matches and can be bypassed (see [Bash permission limitations](/en/iam#tool-specific-permission-rules)) | `[ "WebFetch", "Bash(curl:*)", "Read(./.env)", "Read(./secrets/**)" ]` |
85| `additionalDirectories` | Additional [working directories](iam#working-directories) that Claude has access to | `[ "../docs/" ]` |167| `additionalDirectories` | Additional [working directories](/en/iam#working-directories) that Claude has access to | `[ "../docs/" ]` |
86| `defaultMode` | Default [permission mode](iam#permission-modes) when opening Claude Code | `"acceptEdits"` |168| `defaultMode` | Default [permission mode](/en/iam#permission-modes) when opening Claude Code | `"acceptEdits"` |
87| `disableBypassPermissionsMode` | Set to `"disable"` to prevent `bypassPermissions` mode from being activated. This disables the `--dangerously-skip-permissions` command-line flag. See [managed policy settings](iam#enterprise-managed-policy-settings) | `"disable"` |169| `disableBypassPermissionsMode` | Set to `"disable"` to prevent `bypassPermissions` mode from being activated. This disables the `--dangerously-skip-permissions` command-line flag. See [managed settings](/en/iam#managed-settings) | `"disable"` |
88 170
89### Sandbox settings171### Sandbox settings
90 172
91Configure advanced sandboxing behavior. Sandboxing isolates bash commands from your filesystem and network. See [Sandboxing](/en/docs/claude-code/sandboxing) for details.173Configure advanced sandboxing behavior. Sandboxing isolates bash commands from your filesystem and network. See [Sandboxing](/en/sandboxing) for details.
92 174
93**Filesystem and network restrictions** are configured via Read, Edit, and WebFetch permission rules, not via these sandbox settings.175**Filesystem and network restrictions** are configured via Read, Edit, and WebFetch permission rules, not via these sandbox settings.
94 176
99| `excludedCommands` | Commands that should run outside of the sandbox | `["git", "docker"]` |181| `excludedCommands` | Commands that should run outside of the sandbox | `["git", "docker"]` |
100| `allowUnsandboxedCommands` | Allow commands to run outside the sandbox via the `dangerouslyDisableSandbox` parameter. When set to `false`, the `dangerouslyDisableSandbox` escape hatch is completely disabled and all commands must run sandboxed (or be in `excludedCommands`). Useful for enterprise policies that require strict sandboxing. Default: true | `false` |182| `allowUnsandboxedCommands` | Allow commands to run outside the sandbox via the `dangerouslyDisableSandbox` parameter. When set to `false`, the `dangerouslyDisableSandbox` escape hatch is completely disabled and all commands must run sandboxed (or be in `excludedCommands`). Useful for enterprise policies that require strict sandboxing. Default: true | `false` |
101| `network.allowUnixSockets` | Unix socket paths accessible in sandbox (for SSH agents, etc.) | `["~/.ssh/agent-socket"]` |183| `network.allowUnixSockets` | Unix socket paths accessible in sandbox (for SSH agents, etc.) | `["~/.ssh/agent-socket"]` |
102| `network.allowLocalBinding` | Allow binding to localhost ports (MacOS only). Default: false | `true` |184| `network.allowLocalBinding` | Allow binding to localhost ports (macOS only). Default: false | `true` |
103| `network.httpProxyPort` | HTTP proxy port used if you wish to bring your own proxy. If not specified, Claude will run its own proxy. | `8080` |185| `network.httpProxyPort` | HTTP proxy port used if you wish to bring your own proxy. If not specified, Claude will run its own proxy. | `8080` |
104| `network.socksProxyPort` | SOCKS5 proxy port used if you wish to bring your own proxy. If not specified, Claude will run its own proxy. | `8081` |186| `network.socksProxyPort` | SOCKS5 proxy port used if you wish to bring your own proxy. If not specified, Claude will run its own proxy. | `8081` |
105| `enableWeakerNestedSandbox` | Enable weaker sandbox for unprivileged Docker environments (Linux only). **Reduces security.** Default: false | `true` |187| `enableWeakerNestedSandbox` | Enable weaker sandbox for unprivileged Docker environments (Linux only). **Reduces security.** Default: false | `true` |
128}210}
129```211```
130 212
131**Filesystem access** is controlled via Read/Edit permissions:213**Filesystem and network restrictions** use standard permission rules:
214
215* Use `Read` deny rules to block Claude from reading specific files or directories
216* Use `Edit` allow rules to let Claude write to directories beyond the current working directory
217* Use `Edit` deny rules to block writes to specific paths
218* Use `WebFetch` allow/deny rules to control which network domains Claude can access
219
220### Attribution settings
221
222Claude Code adds attribution to git commits and pull requests. These are configured separately:
223
224* Commits use [git trailers](https://git-scm.com/docs/git-interpret-trailers) (like `Co-Authored-By`) by default, which can be customized or disabled
225* Pull request descriptions are plain text
226
227| Keys | Description |
228| :------- | :----------------------------------------------------------------------------------------- |
229| `commit` | Attribution for git commits, including any trailers. Empty string hides commit attribution |
230| `pr` | Attribution for pull request descriptions. Empty string hides pull request attribution |
231
232**Default commit attribution:**
233
234```
235🤖 Generated with [Claude Code](https://claude.com/claude-code)
236
237 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
238```
239
240**Default pull request attribution:**
132 241
133* Read deny rules block file reads in sandbox242```
134* Edit allow rules permit file writes (in addition to the defaults, e.g. the current working directory)243🤖 Generated with [Claude Code](https://claude.com/claude-code)
135* Edit deny rules block writes within allowed paths244```
245
246**Example:**
247
248```json theme={null}
249{
250 "attribution": {
251 "commit": "Generated with AI\n\nCo-Authored-By: AI <ai@example.com>",
252 "pr": ""
253 }
254}
255```
256
257<Note>
258 The `attribution` setting takes precedence over the deprecated `includeCoAuthoredBy` setting. To hide all attribution, set `commit` and `pr` to empty strings.
259</Note>
136 260
137**Network access** is controlled via WebFetch permissions:261### File suggestion settings
138 262
139* WebFetch allow rules permit network domains263Configure a custom command for `@` file path autocomplete. The built-in file suggestion uses fast filesystem traversal, but large monorepos may benefit from project-specific indexing such as a pre-built file index or custom tooling.
140* WebFetch deny rules block network domains264
265```json theme={null}
266{
267 "fileSuggestion": {
268 "type": "command",
269 "command": "~/.claude/file-suggestion.sh"
270 }
271}
272```
273
274The command runs with the same environment variables as [hooks](/en/hooks), including `CLAUDE_PROJECT_DIR`. It receives JSON via stdin with a `query` field:
275
276```json theme={null}
277{"query": "src/comp"}
278```
279
280Output newline-separated file paths to stdout (currently limited to 15):
281
282```
283src/components/Button.tsx
284src/components/Modal.tsx
285src/components/Form.tsx
286```
287
288**Example:**
289
290```bash theme={null}
291#!/bin/bash
292query=$(cat | jq -r '.query')
293your-repo-file-index --query "$query" | head -20
294```
295
296### Hook configuration
297
298**Managed settings only**: Controls which hooks are allowed to run. This setting can only be configured in [managed settings](#settings-files) and provides administrators with strict control over hook execution.
299
300**Behavior when `allowManagedHooksOnly` is `true`:**
301
302* Managed hooks and SDK hooks are loaded
303* User hooks, project hooks, and plugin hooks are blocked
304
305**Configuration:**
306
307```json theme={null}
308{
309 "allowManagedHooksOnly": true
310}
311```
141 312
142### Settings precedence313### Settings precedence
143 314
144Settings are applied in order of precedence (highest to lowest):315Settings apply in order of precedence. From highest to lowest:
145 316
1461. **Enterprise managed policies** (`managed-settings.json`)3171. **Managed settings** (`managed-settings.json`)
147 * Deployed by IT/DevOps318 * Policies deployed by IT/DevOps to system directories
148 * Cannot be overridden319 * Cannot be overridden by user or project settings
149 320
1502. **Command line arguments**3212. **Command line arguments**
151 * Temporary overrides for a specific session322 * Temporary overrides for a specific session
1595. **User settings** (`~/.claude/settings.json`)3305. **User settings** (`~/.claude/settings.json`)
160 * Personal global settings331 * Personal global settings
161 332
162This hierarchy ensures that enterprise security policies are always enforced while still allowing teams and individuals to customize their experience.333This hierarchy ensures that organizational policies are always enforced while still allowing teams and individuals to customize their experience.
334
335For example, if your user settings allow `Bash(npm run:*)` but a project's shared settings deny it, the project setting takes precedence and the command is blocked.
163 336
164### Key points about the configuration system337### Key points about the configuration system
165 338
166* **Memory files (CLAUDE.md)**: Contain instructions and context that Claude loads at startup339* **Memory files (`CLAUDE.md`)**: Contain instructions and context that Claude loads at startup
167* **Settings files (JSON)**: Configure permissions, environment variables, and tool behavior340* **Settings files (JSON)**: Configure permissions, environment variables, and tool behavior
168* **Slash commands**: Custom commands that can be invoked during a session with `/command-name`341* **Slash commands**: Custom commands that can be invoked during a session with `/command-name`
169* **MCP servers**: Extend Claude Code with additional tools and integrations342* **MCP servers**: Extend Claude Code with additional tools and integrations
170* **Precedence**: Higher-level configurations (Enterprise) override lower-level ones (User/Project)343* **Precedence**: Higher-level configurations (Managed) override lower-level ones (User/Project)
171* **Inheritance**: Settings are merged, with more specific settings adding to or overriding broader ones344* **Inheritance**: Settings are merged, with more specific settings adding to or overriding broader ones
172 345
173### System prompt availability346### System prompt
174 347
175<Note>348Claude Code's internal system prompt is not published. To add custom instructions, use `CLAUDE.md` files or the `--append-system-prompt` flag.
176 Unlike for claude.ai, we do not publish Claude Code's internal system prompt on this website. Use CLAUDE.md files or `--append-system-prompt` to add custom instructions to Claude Code's behavior.
177</Note>
178 349
179### Excluding sensitive files350### Excluding sensitive files
180 351
181To prevent Claude Code from accessing files containing sensitive information (e.g., API keys, secrets, environment files), use the `permissions.deny` setting in your `.claude/settings.json` file:352To prevent Claude Code from accessing files containing sensitive information like API keys, secrets, and environment files, use the `permissions.deny` setting in your `.claude/settings.json` file:
182 353
183```json theme={null}354```json theme={null}
184{355{
203* **User subagents**: `~/.claude/agents/` - Available across all your projects374* **User subagents**: `~/.claude/agents/` - Available across all your projects
204* **Project subagents**: `.claude/agents/` - Specific to your project and can be shared with your team375* **Project subagents**: `.claude/agents/` - Specific to your project and can be shared with your team
205 376
206Subagent files define specialized AI assistants with custom prompts and tool permissions. Learn more about creating and using subagents in the [subagents documentation](/en/docs/claude-code/sub-agents).377Subagent files define specialized AI assistants with custom prompts and tool permissions. Learn more about creating and using subagents in the [subagents documentation](/en/sub-agents).
207 378
208## Plugin configuration379## Plugin configuration
209 380
216```json theme={null}387```json theme={null}
217{388{
218 "enabledPlugins": {389 "enabledPlugins": {
219 "formatter@company-tools": true,390 "formatter@acme-tools": true,
220 "deployer@company-tools": true,391 "deployer@acme-tools": true,
221 "analyzer@security-plugins": false392 "analyzer@security-plugins": false
222 },393 },
223 "extraKnownMarketplaces": {394 "extraKnownMarketplaces": {
224 "company-tools": {395 "acme-tools": {
225 "source": "github",396 "source": "github",
226 "repo": "company/claude-plugins"397 "repo": "acme-corp/claude-plugins"
227 }398 }
228 }399 }
229}400}
267```json theme={null}438```json theme={null}
268{439{
269 "extraKnownMarketplaces": {440 "extraKnownMarketplaces": {
270 "company-tools": {441 "acme-tools": {
271 "source": {442 "source": {
272 "source": "github",443 "source": "github",
273 "repo": "company-org/claude-plugins"444 "repo": "acme-corp/claude-plugins"
274 }445 }
275 },446 },
276 "security-plugins": {447 "security-plugins": {
277 "source": {448 "source": {
278 "source": "git",449 "source": "git",
279 "url": "https://git.company.com/security/plugins.git"450 "url": "https://git.example.com/security/plugins.git"
280 }451 }
281 }452 }
282 }453 }
289* `git`: Any git URL (uses `url`)460* `git`: Any git URL (uses `url`)
290* `directory`: Local filesystem path (uses `path`, for development only)461* `directory`: Local filesystem path (uses `path`, for development only)
291 462
463#### `strictKnownMarketplaces`
464
465**Managed settings only**: Controls which plugin marketplaces users are allowed to add. This setting can only be configured in [`managed-settings.json`](/en/iam#managed-settings) and provides administrators with strict control over marketplace sources.
466
467**Managed settings file locations**:
468
469* **macOS**: `/Library/Application Support/ClaudeCode/managed-settings.json`
470* **Linux and WSL**: `/etc/claude-code/managed-settings.json`
471* **Windows**: `C:\Program Files\ClaudeCode\managed-settings.json`
472
473**Key characteristics**:
474
475* Only available in managed settings (`managed-settings.json`)
476* Cannot be overridden by user or project settings (highest precedence)
477* Enforced BEFORE network/filesystem operations (blocked sources never execute)
478* Uses exact matching for source specifications (including `ref`, `path` for git sources)
479
480**Allowlist behavior**:
481
482* `undefined` (default): No restrictions - users can add any marketplace
483* Empty array `[]`: Complete lockdown - users cannot add any new marketplaces
484* List of sources: Users can only add marketplaces that match exactly
485
486**All supported source types**:
487
488The allowlist supports six marketplace source types. Each source must match exactly for a user's marketplace addition to be allowed.
489
4901. **GitHub repositories**:
491
492```json theme={null}
493{ "source": "github", "repo": "acme-corp/approved-plugins" }
494{ "source": "github", "repo": "acme-corp/security-tools", "ref": "v2.0" }
495{ "source": "github", "repo": "acme-corp/plugins", "ref": "main", "path": "marketplace" }
496```
497
498Fields: `repo` (required), `ref` (optional: branch/tag/SHA), `path` (optional: subdirectory)
499
5002. **Git repositories**:
501
502```json theme={null}
503{ "source": "git", "url": "https://gitlab.example.com/tools/plugins.git" }
504{ "source": "git", "url": "https://bitbucket.org/acme-corp/plugins.git", "ref": "production" }
505{ "source": "git", "url": "ssh://git@git.example.com/plugins.git", "ref": "v3.1", "path": "approved" }
506```
507
508Fields: `url` (required), `ref` (optional: branch/tag/SHA), `path` (optional: subdirectory)
509
5103. **URL-based marketplaces**:
511
512```json theme={null}
513{ "source": "url", "url": "https://plugins.example.com/marketplace.json" }
514{ "source": "url", "url": "https://cdn.example.com/marketplace.json", "headers": { "Authorization": "Bearer ${TOKEN}" } }
515```
516
517Fields: `url` (required), `headers` (optional: HTTP headers for authenticated access)
518
5194. **NPM packages**:
520
521```json theme={null}
522{ "source": "npm", "package": "@acme-corp/claude-plugins" }
523{ "source": "npm", "package": "@acme-corp/approved-marketplace" }
524```
525
526Fields: `package` (required, supports scoped packages)
527
5285. **File paths**:
529
530```json theme={null}
531{ "source": "file", "path": "/usr/local/share/claude/acme-marketplace.json" }
532{ "source": "file", "path": "/opt/acme-corp/plugins/marketplace.json" }
533```
534
535Fields: `path` (required: absolute path to marketplace.json file)
536
5376. **Directory paths**:
538
539```json theme={null}
540{ "source": "directory", "path": "/usr/local/share/claude/acme-plugins" }
541{ "source": "directory", "path": "/opt/acme-corp/approved-marketplaces" }
542```
543
544Fields: `path` (required: absolute path to directory containing `.claude-plugin/marketplace.json`)
545
546**Configuration examples**:
547
548Example - Allow specific marketplaces only:
549
550```json theme={null}
551{
552 "strictKnownMarketplaces": [
553 {
554 "source": "github",
555 "repo": "acme-corp/approved-plugins"
556 },
557 {
558 "source": "github",
559 "repo": "acme-corp/security-tools",
560 "ref": "v2.0"
561 },
562 {
563 "source": "url",
564 "url": "https://plugins.example.com/marketplace.json"
565 },
566 {
567 "source": "npm",
568 "package": "@acme-corp/compliance-plugins"
569 }
570 ]
571}
572```
573
574Example - Disable all marketplace additions:
575
576```json theme={null}
577{
578 "strictKnownMarketplaces": []
579}
580```
581
582**Exact matching requirements**:
583
584Marketplace sources must match **exactly** for a user's addition to be allowed. For git-based sources (`github` and `git`), this includes all optional fields:
585
586* The `repo` or `url` must match exactly
587* The `ref` field must match exactly (or both be undefined)
588* The `path` field must match exactly (or both be undefined)
589
590Examples of sources that **do NOT match**:
591
592```json theme={null}
593// These are DIFFERENT sources:
594{ "source": "github", "repo": "acme-corp/plugins" }
595{ "source": "github", "repo": "acme-corp/plugins", "ref": "main" }
596
597// These are also DIFFERENT:
598{ "source": "github", "repo": "acme-corp/plugins", "path": "marketplace" }
599{ "source": "github", "repo": "acme-corp/plugins" }
600```
601
602**Comparison with `extraKnownMarketplaces`**:
603
604| Aspect | `strictKnownMarketplaces` | `extraKnownMarketplaces` |
605| --------------------- | ------------------------------------ | ------------------------------------ |
606| **Purpose** | Organizational policy enforcement | Team convenience |
607| **Settings file** | `managed-settings.json` only | Any settings file |
608| **Behavior** | Blocks non-allowlisted additions | Auto-installs missing marketplaces |
609| **When enforced** | Before network/filesystem operations | After user trust prompt |
610| **Can be overridden** | No (highest precedence) | Yes (by higher precedence settings) |
611| **Source format** | Direct source object | Named marketplace with nested source |
612| **Use case** | Compliance, security restrictions | Onboarding, standardization |
613
614**Format difference**:
615
616`strictKnownMarketplaces` uses direct source objects:
617
618```json theme={null}
619{
620 "strictKnownMarketplaces": [
621 { "source": "github", "repo": "acme-corp/plugins" }
622 ]
623}
624```
625
626`extraKnownMarketplaces` requires named marketplaces:
627
628```json theme={null}
629{
630 "extraKnownMarketplaces": {
631 "acme-tools": {
632 "source": { "source": "github", "repo": "acme-corp/plugins" }
633 }
634 }
635}
636```
637
638**Important notes**:
639
640* Restrictions are checked BEFORE any network requests or filesystem operations
641* When blocked, users see clear error messages indicating the source is blocked by managed policy
642* The restriction applies only to adding NEW marketplaces; previously installed marketplaces remain accessible
643* Managed settings have the highest precedence and cannot be overridden
644
645See [Managed marketplace restrictions](/en/plugin-marketplaces#managed-marketplace-restrictions) for user-facing documentation.
646
292### Managing plugins647### Managing plugins
293 648
294Use the `/plugin` command to manage plugins interactively:649Use the `/plugin` command to manage plugins interactively:
299* View plugin details (commands, agents, hooks provided)654* View plugin details (commands, agents, hooks provided)
300* Add/remove marketplaces655* Add/remove marketplaces
301 656
302Learn more about the plugin system in the [plugins documentation](/en/docs/claude-code/plugins).657Learn more about the plugin system in the [plugins documentation](/en/plugins).
303 658
304## Environment variables659## Environment variables
305 660
310</Note>665</Note>
311 666
312| Variable | Purpose |667| Variable | Purpose |
313| :----------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |668| :-------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
314| `ANTHROPIC_API_KEY` | API key sent as `X-Api-Key` header, typically for the Claude SDK (for interactive usage, run `/login`) |669| `ANTHROPIC_API_KEY` | API key sent as `X-Api-Key` header, typically for the Claude SDK (for interactive usage, run `/login`) |
315| `ANTHROPIC_AUTH_TOKEN` | Custom value for the `Authorization` header (the value you set here will be prefixed with `Bearer `) |670| `ANTHROPIC_AUTH_TOKEN` | Custom value for the `Authorization` header (the value you set here will be prefixed with `Bearer `) |
316| `ANTHROPIC_CUSTOM_HEADERS` | Custom headers you want to add to the request (in `Name: Value` format) |671| `ANTHROPIC_CUSTOM_HEADERS` | Custom headers you want to add to the request (in `Name: Value` format) |
317| `ANTHROPIC_DEFAULT_HAIKU_MODEL` | See [Model configuration](/en/docs/claude-code/model-config#environment-variables) |672| `ANTHROPIC_DEFAULT_HAIKU_MODEL` | See [Model configuration](/en/model-config#environment-variables) |
318| `ANTHROPIC_DEFAULT_OPUS_MODEL` | See [Model configuration](/en/docs/claude-code/model-config#environment-variables) |673| `ANTHROPIC_DEFAULT_OPUS_MODEL` | See [Model configuration](/en/model-config#environment-variables) |
319| `ANTHROPIC_DEFAULT_SONNET_MODEL` | See [Model configuration](/en/docs/claude-code/model-config#environment-variables) |674| `ANTHROPIC_DEFAULT_SONNET_MODEL` | See [Model configuration](/en/model-config#environment-variables) |
320| `ANTHROPIC_MODEL` | Name of the model setting to use (see [Model Configuration](/en/docs/claude-code/model-config#environment-variables)) |675| `ANTHROPIC_FOUNDRY_API_KEY` | API key for Microsoft Foundry authentication (see [Microsoft Foundry](/en/microsoft-foundry)) |
321| `ANTHROPIC_SMALL_FAST_MODEL` | \[DEPRECATED] Name of [Haiku-class model for background tasks](/en/docs/claude-code/costs) |676| `ANTHROPIC_MODEL` | Name of the model setting to use (see [Model Configuration](/en/model-config#environment-variables)) |
677| `ANTHROPIC_SMALL_FAST_MODEL` | \[DEPRECATED] Name of [Haiku-class model for background tasks](/en/costs) |
322| `ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION` | Override AWS region for the Haiku-class model when using Bedrock |678| `ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION` | Override AWS region for the Haiku-class model when using Bedrock |
323| `AWS_BEARER_TOKEN_BEDROCK` | Bedrock API key for authentication (see [Bedrock API keys](https://aws.amazon.com/blogs/machine-learning/accelerate-ai-development-with-amazon-bedrock-api-keys/)) |679| `AWS_BEARER_TOKEN_BEDROCK` | Bedrock API key for authentication (see [Bedrock API keys](https://aws.amazon.com/blogs/machine-learning/accelerate-ai-development-with-amazon-bedrock-api-keys/)) |
324| `BASH_DEFAULT_TIMEOUT_MS` | Default timeout for long-running bash commands |680| `BASH_DEFAULT_TIMEOUT_MS` | Default timeout for long-running bash commands |
329| `CLAUDE_CODE_CLIENT_CERT` | Path to client certificate file for mTLS authentication |685| `CLAUDE_CODE_CLIENT_CERT` | Path to client certificate file for mTLS authentication |
330| `CLAUDE_CODE_CLIENT_KEY_PASSPHRASE` | Passphrase for encrypted CLAUDE\_CODE\_CLIENT\_KEY (optional) |686| `CLAUDE_CODE_CLIENT_KEY_PASSPHRASE` | Passphrase for encrypted CLAUDE\_CODE\_CLIENT\_KEY (optional) |
331| `CLAUDE_CODE_CLIENT_KEY` | Path to client private key file for mTLS authentication |687| `CLAUDE_CODE_CLIENT_KEY` | Path to client private key file for mTLS authentication |
688| `CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS` | Set to `1` to disable Anthropic API-specific `anthropic-beta` headers. Use this if experiencing issues like "Unexpected value(s) for the `anthropic-beta` header" when using an LLM gateway with third-party providers |
332| `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC` | Equivalent of setting `DISABLE_AUTOUPDATER`, `DISABLE_BUG_COMMAND`, `DISABLE_ERROR_REPORTING`, and `DISABLE_TELEMETRY` |689| `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC` | Equivalent of setting `DISABLE_AUTOUPDATER`, `DISABLE_BUG_COMMAND`, `DISABLE_ERROR_REPORTING`, and `DISABLE_TELEMETRY` |
333| `CLAUDE_CODE_DISABLE_TERMINAL_TITLE` | Set to `1` to disable automatic terminal title updates based on conversation context |690| `CLAUDE_CODE_DISABLE_TERMINAL_TITLE` | Set to `1` to disable automatic terminal title updates based on conversation context |
334| `CLAUDE_CODE_IDE_SKIP_AUTO_INSTALL` | Skip auto-installation of IDE extensions |691| `CLAUDE_CODE_IDE_SKIP_AUTO_INSTALL` | Skip auto-installation of IDE extensions |
335| `CLAUDE_CODE_MAX_OUTPUT_TOKENS` | Set the maximum number of output tokens for most requests |692| `CLAUDE_CODE_MAX_OUTPUT_TOKENS` | Set the maximum number of output tokens for most requests |
336| `CLAUDE_CODE_SKIP_BEDROCK_AUTH` | Skip AWS authentication for Bedrock (e.g. when using an LLM gateway) |693| `CLAUDE_CODE_OTEL_HEADERS_HELPER_DEBOUNCE_MS` | Interval for refreshing dynamic OpenTelemetry headers in milliseconds (default: 1740000 / 29 minutes). See [Dynamic headers](/en/monitoring-usage#dynamic-headers) |
337| `CLAUDE_CODE_SKIP_VERTEX_AUTH` | Skip Google authentication for Vertex (e.g. when using an LLM gateway) |694| `CLAUDE_CODE_SHELL_PREFIX` | Command prefix to wrap all bash commands (for example, for logging or auditing). Example: `/path/to/logger.sh` will execute `/path/to/logger.sh <command>` |
338| `CLAUDE_CODE_SUBAGENT_MODEL` | See [Model configuration](/en/docs/claude-code/model-config) |695| `CLAUDE_CODE_SKIP_BEDROCK_AUTH` | Skip AWS authentication for Bedrock (for example, when using an LLM gateway) |
339| `CLAUDE_CODE_USE_BEDROCK` | Use [Bedrock](/en/docs/claude-code/amazon-bedrock) |696| `CLAUDE_CODE_SKIP_FOUNDRY_AUTH` | Skip Azure authentication for Microsoft Foundry (for example, when using an LLM gateway) |
340| `CLAUDE_CODE_USE_VERTEX` | Use [Vertex](/en/docs/claude-code/google-vertex-ai) |697| `CLAUDE_CODE_SKIP_VERTEX_AUTH` | Skip Google authentication for Vertex (for example, when using an LLM gateway) |
341| `DISABLE_AUTOUPDATER` | Set to `1` to disable automatic updates. This takes precedence over the `autoUpdates` configuration setting. |698| `CLAUDE_CODE_SUBAGENT_MODEL` | See [Model configuration](/en/model-config) |
699| `CLAUDE_CODE_USE_BEDROCK` | Use [Bedrock](/en/amazon-bedrock) |
700| `CLAUDE_CODE_USE_FOUNDRY` | Use [Microsoft Foundry](/en/microsoft-foundry) |
701| `CLAUDE_CODE_USE_VERTEX` | Use [Vertex](/en/google-vertex-ai) |
702| `CLAUDE_CONFIG_DIR` | Customize where Claude Code stores its configuration and data files |
703| `DISABLE_AUTOUPDATER` | Set to `1` to disable automatic updates. |
342| `DISABLE_BUG_COMMAND` | Set to `1` to disable the `/bug` command |704| `DISABLE_BUG_COMMAND` | Set to `1` to disable the `/bug` command |
343| `DISABLE_COST_WARNINGS` | Set to `1` to disable cost warning messages |705| `DISABLE_COST_WARNINGS` | Set to `1` to disable cost warning messages |
344| `DISABLE_ERROR_REPORTING` | Set to `1` to opt out of Sentry error reporting |706| `DISABLE_ERROR_REPORTING` | Set to `1` to opt out of Sentry error reporting |
351| `HTTP_PROXY` | Specify HTTP proxy server for network connections |713| `HTTP_PROXY` | Specify HTTP proxy server for network connections |
352| `HTTPS_PROXY` | Specify HTTPS proxy server for network connections |714| `HTTPS_PROXY` | Specify HTTPS proxy server for network connections |
353| `MAX_MCP_OUTPUT_TOKENS` | Maximum number of tokens allowed in MCP tool responses. Claude Code displays a warning when output exceeds 10,000 tokens (default: 25000) |715| `MAX_MCP_OUTPUT_TOKENS` | Maximum number of tokens allowed in MCP tool responses. Claude Code displays a warning when output exceeds 10,000 tokens (default: 25000) |
354| `MAX_THINKING_TOKENS` | Enable [extended thinking](/en/docs/build-with-claude/extended-thinking) and set the token budget for the thinking process. Extended thinking improves performance on complex reasoning and coding tasks but impacts [prompt caching efficiency](/en/docs/build-with-claude/prompt-caching#caching-with-thinking-blocks). Disabled by default. |716| `MAX_THINKING_TOKENS` | Enable [extended thinking](https://docs.claude.com/en/docs/build-with-claude/extended-thinking) and set the token budget for the thinking process. Extended thinking improves performance on complex reasoning and coding tasks but impacts [prompt caching efficiency](https://docs.claude.com/en/docs/build-with-claude/prompt-caching#caching-with-thinking-blocks). Disabled by default. |
355| `MCP_TIMEOUT` | Timeout in milliseconds for MCP server startup |717| `MCP_TIMEOUT` | Timeout in milliseconds for MCP server startup |
356| `MCP_TOOL_TIMEOUT` | Timeout in milliseconds for MCP tool execution |718| `MCP_TOOL_TIMEOUT` | Timeout in milliseconds for MCP tool execution |
357| `NO_PROXY` | List of domains and IPs to which requests will be directly issued, bypassing proxy |719| `NO_PROXY` | List of domains and IPs to which requests will be directly issued, bypassing proxy |
358| `SLASH_COMMAND_TOOL_CHAR_BUDGET` | Maximum number of characters for slash command metadata shown to [SlashCommand tool](/en/docs/claude-code/slash-commands#slashcommand-tool) (default: 15000) |720| `SLASH_COMMAND_TOOL_CHAR_BUDGET` | Maximum number of characters for slash command metadata shown to [SlashCommand tool](/en/slash-commands#slashcommand-tool) (default: 15000) |
359| `USE_BUILTIN_RIPGREP` | Set to `0` to use system-installed `rg` intead of `rg` included with Claude Code |721| `USE_BUILTIN_RIPGREP` | Set to `0` to use system-installed `rg` instead of `rg` included with Claude Code |
360| `VERTEX_REGION_CLAUDE_3_5_HAIKU` | Override region for Claude 3.5 Haiku when using Vertex AI |722| `VERTEX_REGION_CLAUDE_3_5_HAIKU` | Override region for Claude 3.5 Haiku when using Vertex AI |
361| `VERTEX_REGION_CLAUDE_3_7_SONNET` | Override region for Claude 3.7 Sonnet when using Vertex AI |723| `VERTEX_REGION_CLAUDE_3_7_SONNET` | Override region for Claude 3.7 Sonnet when using Vertex AI |
362| `VERTEX_REGION_CLAUDE_4_0_OPUS` | Override region for Claude 4.0 Opus when using Vertex AI |724| `VERTEX_REGION_CLAUDE_4_0_OPUS` | Override region for Claude 4.0 Opus when using Vertex AI |
368Claude Code has access to a set of powerful tools that help it understand and modify your codebase:730Claude Code has access to a set of powerful tools that help it understand and modify your codebase:
369 731
370| Tool | Description | Permission Required |732| Tool | Description | Permission Required |
371| :--------------- | :----------------------------------------------------------------------------------- | :------------------ |733| :------------------ | :------------------------------------------------------------------------------------------------ | :------------------ |
372| **Bash** | Executes shell commands in your environment | Yes |734| **AskUserQuestion** | Asks the user multiple choice questions to gather information or clarify ambiguity | No |
735| **Bash** | Executes shell commands in your environment (see [Bash tool behavior](#bash-tool-behavior) below) | Yes |
736| **BashOutput** | Retrieves output from a background bash shell | No |
373| **Edit** | Makes targeted edits to specific files | Yes |737| **Edit** | Makes targeted edits to specific files | Yes |
738| **ExitPlanMode** | Prompts the user to exit plan mode and start coding | Yes |
374| **Glob** | Finds files based on pattern matching | No |739| **Glob** | Finds files based on pattern matching | No |
375| **Grep** | Searches for patterns in file contents | No |740| **Grep** | Searches for patterns in file contents | No |
741| **KillShell** | Kills a running background bash shell by its ID | No |
376| **NotebookEdit** | Modifies Jupyter notebook cells | Yes |742| **NotebookEdit** | Modifies Jupyter notebook cells | Yes |
377| **NotebookRead** | Reads and displays Jupyter notebook contents | No |
378| **Read** | Reads the contents of files | No |743| **Read** | Reads the contents of files | No |
379| **SlashCommand** | Runs a [custom slash command](/en/docs/claude-code/slash-commands#slashcommand-tool) | Yes |744| **Skill** | Executes a skill within the main conversation | Yes |
745| **SlashCommand** | Runs a [custom slash command](/en/slash-commands#slashcommand-tool) | Yes |
380| **Task** | Runs a sub-agent to handle complex, multi-step tasks | No |746| **Task** | Runs a sub-agent to handle complex, multi-step tasks | No |
381| **TodoWrite** | Creates and manages structured task lists | No |747| **TodoWrite** | Creates and manages structured task lists | No |
382| **WebFetch** | Fetches content from a specified URL | Yes |748| **WebFetch** | Fetches content from a specified URL | Yes |
383| **WebSearch** | Performs web searches with domain filtering | Yes |749| **WebSearch** | Performs web searches with domain filtering | Yes |
384| **Write** | Creates or overwrites files | Yes |750| **Write** | Creates or overwrites files | Yes |
385 751
386Permission rules can be configured using `/allowed-tools` or in [permission settings](/en/docs/claude-code/settings#available-settings). Also see [Tool-specific permission rules](/en/docs/claude-code/iam#tool-specific-permission-rules).752Permission rules can be configured using `/allowed-tools` or in [permission settings](/en/settings#available-settings). Also see [Tool-specific permission rules](/en/iam#tool-specific-permission-rules).
753
754### Bash tool behavior
755
756The Bash tool executes shell commands with the following persistence behavior:
757
758* **Working directory persists**: When Claude changes the working directory (for example, `cd /path/to/dir`), subsequent Bash commands will execute in that directory. You can use `CLAUDE_BASH_MAINTAIN_PROJECT_WORKING_DIR=1` to reset to the project directory after each command.
759* **Environment variables do NOT persist**: Environment variables set in one Bash command (for example, `export MY_VAR=value`) are **not** available in subsequent Bash commands. Each Bash command runs in a fresh shell environment.
760
761To make environment variables available in Bash commands, you have **three options**:
762
763**Option 1: Activate environment before starting Claude Code** (simplest approach)
764
765Activate your virtual environment in your terminal before launching Claude Code:
766
767```bash theme={null}
768conda activate myenv
769# or: source /path/to/venv/bin/activate
770claude
771```
772
773This works for shell environments but environment variables set within Claude's Bash commands will not persist between commands.
774
775**Option 2: Set CLAUDE\_ENV\_FILE before starting Claude Code** (persistent environment setup)
776
777Export the path to a shell script containing your environment setup:
778
779```bash theme={null}
780export CLAUDE_ENV_FILE=/path/to/env-setup.sh
781claude
782```
783
784Where `/path/to/env-setup.sh` contains:
785
786```bash theme={null}
787conda activate myenv
788# or: source /path/to/venv/bin/activate
789# or: export MY_VAR=value
790```
791
792Claude Code will source this file before each Bash command, making the environment persistent across all commands.
793
794**Option 3: Use a SessionStart hook** (project-specific configuration)
795
796Configure in `.claude/settings.json`:
797
798```json theme={null}
799{
800 "hooks": {
801 "SessionStart": [{
802 "matcher": "startup",
803 "hooks": [{
804 "type": "command",
805 "command": "echo 'conda activate myenv' >> \"$CLAUDE_ENV_FILE\""
806 }]
807 }]
808 }
809}
810```
811
812The hook writes to `$CLAUDE_ENV_FILE`, which is then sourced before each Bash command. This is ideal for team-shared project configurations.
813
814See [SessionStart hooks](/en/hooks#persisting-environment-variables) for more details on Option 3.
387 815
388### Extending tools with hooks816### Extending tools with hooks
389 817
390You can run custom commands before or after any tool executes using818You can run custom commands before or after any tool executes using
391[Claude Code hooks](/en/docs/claude-code/hooks-guide).819[Claude Code hooks](/en/hooks-guide).
392 820
393For example, you could automatically run a Python formatter after Claude821For example, you could automatically run a Python formatter after Claude
394modifies Python files, or prevent modifications to production configuration822modifies Python files, or prevent modifications to production configuration
396 824
397## See also825## See also
398 826
399* [Identity and Access Management](/en/docs/claude-code/iam#configuring-permissions) - Learn about Claude Code's permission system827* [Identity and Access Management](/en/iam#configuring-permissions) - Learn about Claude Code's permission system
400* [IAM and access control](/en/docs/claude-code/iam#enterprise-managed-policy-settings) - Enterprise policy management828* [IAM and access control](/en/iam#managed-settings) - Managed policy configuration
401* [Troubleshooting](/en/docs/claude-code/troubleshooting#auto-updater-issues) - Solutions for common configuration issues829* [Troubleshooting](/en/troubleshooting#auto-updater-issues) - Solutions for common configuration issues
830
831
832---
833
834> To find navigation and other pages in this documentation, fetch the llms.txt file at: https://code.claude.com/docs/llms.txt