4 4
5Claude Code offers a variety of settings to configure its behavior to meet your needs. You can configure Claude Code by running the `/config` command when using the interactive REPL, which opens a tabbed Settings interface where you can view status information and modify configuration options.5Claude Code offers a variety of settings to configure its behavior to meet your needs. You can configure Claude Code by running the `/config` command when using the interactive REPL, which opens a tabbed Settings interface where you can view status information and modify configuration options.
6 6
7## Configuration scopes
8
9Claude Code uses a **scope system** to determine where configurations apply and who they're shared with. Understanding scopes helps you decide how to configure Claude Code for personal use, team collaboration, or enterprise deployment.
10
11### Available scopes
12
13| Scope | Location | Who it affects | Shared with team? |
14| :------------- | :----------------------------------- | :----------------------------------- | :--------------------- |
15| **Enterprise** | System-level `managed-settings.json` | All users on the machine | Yes (deployed by IT) |
16| **User** | `~/.claude/` directory | You, across all projects | No |
17| **Project** | `.claude/` in repository | All collaborators on this repository | Yes (committed to git) |
18| **Local** | `.claude/*.local.*` files | You, in this repository only | No (gitignored) |
19
20### When to use each scope
21
22**Enterprise scope** is for:
23
24* Security policies that must be enforced organization-wide
25* Compliance requirements that can't be overridden
26* Standardized configurations deployed by IT/DevOps
27
28**User scope** is best for:
29
30* Personal preferences you want everywhere (themes, editor settings)
31* Tools and plugins you use across all projects
32* API keys and authentication (stored securely)
33
34**Project scope** is best for:
35
36* Team-shared settings (permissions, hooks, MCP servers)
37* Plugins the whole team should have
38* Standardizing tooling across collaborators
39
40**Local scope** is best for:
41
42* Personal overrides for a specific project
43* Testing configurations before sharing with the team
44* Machine-specific settings that won't work for others
45
46### How scopes interact
47
48When the same setting is configured in multiple scopes, more specific scopes take precedence:
49
501. **Enterprise** (highest) - can't be overridden by anything
512. **Command line arguments** - temporary session overrides
523. **Local** - overrides project and user settings
534. **Project** - overrides user settings
545. **User** (lowest) - applies when nothing else specifies the setting
55
56For example, if a permission is allowed in user settings but denied in project settings, the project setting takes precedence and the permission is blocked.
57
58### What uses scopes
59
60Scopes apply to many Claude Code features:
61
62| Feature | User location | Project location | Local location |
63| :-------------- | :------------------------ | :--------------------------------- | :----------------------------- |
64| **Settings** | `~/.claude/settings.json` | `.claude/settings.json` | `.claude/settings.local.json` |
65| **Subagents** | `~/.claude/agents/` | `.claude/agents/` | — |
66| **MCP servers** | `~/.claude.json` | `.mcp.json` | `~/.claude.json` (per-project) |
67| **Plugins** | `~/.claude/settings.json` | `.claude/settings.json` | `.claude/settings.local.json` |
68| **CLAUDE.md** | `~/.claude/CLAUDE.md` | `CLAUDE.md` or `.claude/CLAUDE.md` | `CLAUDE.local.md` |
69
70***
71
7## Settings files72## Settings files
8 73
9The `settings.json` file is our official mechanism for configuring Claude74The `settings.json` file is our official mechanism for configuring Claude
14* **Project settings** are saved in your project directory:79* **Project settings** are saved in your project directory:
15 * `.claude/settings.json` for settings that are checked into source control and shared with your team80 * `.claude/settings.json` for settings that are checked into source control and shared with your team
16 * `.claude/settings.local.json` for settings that are not checked in, useful for personal preferences and experimentation. Claude Code will configure git to ignore `.claude/settings.local.json` when it is created.81 * `.claude/settings.local.json` for settings that are not checked in, useful for personal preferences and experimentation. Claude Code will configure git to ignore `.claude/settings.local.json` when it is created.
17* For enterprise deployments of Claude Code, we also support **enterprise82* **Managed settings** (Enterprise): Enterprise administrators can configure and distribute Claude Code settings to their organization through the [Claude.ai admin console](https://claude.ai/admin-settings/claude-code). These settings are fetched automatically when users authenticate, take precedence over user and project settings, and cannot be overridden locally. This feature is available to Claude for Enterprise customers. If you don't see this option in your admin console, contact your Anthropic account team to have the feature enabled.
18 managed policy settings**. These take precedence over user and project83
19 settings. System administrators can deploy policies to:84 For organizations that prefer file-based policy distribution, Claude Code also supports `managed-settings.json` and `managed-mcp.json` files that can be deployed to system directories:
20 * macOS: `/Library/Application Support/ClaudeCode/managed-settings.json`85
21 * Linux and WSL: `/etc/claude-code/managed-settings.json`86 * macOS: `/Library/Application Support/ClaudeCode/`
22 * Windows: `C:\ProgramData\ClaudeCode\managed-settings.json`87 * Linux and WSL: `/etc/claude-code/`
23* Enterprise deployments can also configure **managed MCP servers** that override88 * Windows: `C:\Program Files\ClaudeCode\`
24 user-configured servers. See [Enterprise MCP configuration](/en/mcp#enterprise-mcp-configuration):89
25 * macOS: `/Library/Application Support/ClaudeCode/managed-mcp.json`90 <Note>
26 * Linux and WSL: `/etc/claude-code/managed-mcp.json`91 These are system-wide paths (not user home directories like `~/Library/...`) that require administrator privileges. They are designed to be deployed by IT administrators.
27 * Windows: `C:\ProgramData\ClaudeCode\managed-mcp.json`92 </Note>
93
94 See [Enterprise managed settings](/en/iam#enterprise-managed-settings) and [Enterprise MCP configuration](/en/mcp#enterprise-mcp-configuration) for details.
95
96 <Note>
97 Enterprise deployments can also restrict **plugin marketplace additions** using
98 `strictKnownMarketplaces`. For more information, see [Enterprise marketplace restrictions](/en/plugin-marketplaces#enterprise-marketplace-restrictions).
99 </Note>
100* **Other configuration** is stored in `~/.claude.json`. This file contains your preferences (theme, notification settings, editor mode), OAuth session, [MCP server](/en/mcp) configurations for user and local scopes, per-project state (allowed tools, trust settings), and various caches. Project-scoped MCP servers are stored separately in `.mcp.json`.
28 101
29```JSON Example settings.json theme={null}102```JSON Example settings.json theme={null}
30{103{
58`settings.json` supports a number of options:131`settings.json` supports a number of options:
59 132
60| Key | Description | Example |133| Key | Description | Example |
61| :--------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :---------------------------------------------------------------------- |134| :--------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | :---------------------------------------------------------------------- |
62| `apiKeyHelper` | Custom script, to be executed in `/bin/sh`, to generate an auth value. This value will be sent as `X-Api-Key` and `Authorization: Bearer` headers for model requests | `/bin/generate_temp_api_key.sh` |135| `apiKeyHelper` | Custom script, to be executed in `/bin/sh`, to generate an auth value. This value will be sent as `X-Api-Key` and `Authorization: Bearer` headers for model requests | `/bin/generate_temp_api_key.sh` |
63| `cleanupPeriodDays` | How long to locally retain chat transcripts based on last activity date (default: 30 days) | `20` |136| `cleanupPeriodDays` | Sessions inactive for longer than this period are deleted at startup. Setting to `0` immediately deletes all sessions. (default: 30 days) | `20` |
64| `companyAnnouncements` | Announcement to display to users at startup. If multiple announcements are provided, they will be cycled through at random. | `["Welcome to Acme Corp! Review our code guidelines at docs.acme.com"]` |137| `companyAnnouncements` | Announcement to display to users at startup. If multiple announcements are provided, they will be cycled through at random. | `["Welcome to Acme Corp! Review our code guidelines at docs.acme.com"]` |
65| `env` | Environment variables that will be applied to every session | `{"FOO": "bar"}` |138| `env` | Environment variables that will be applied to every session | `{"FOO": "bar"}` |
66| `includeCoAuthoredBy` | Whether to include the `co-authored-by Claude` byline in git commits and pull requests (default: `true`) | `false` |139| `attribution` | Customize attribution for git commits and pull requests. See [Attribution settings](#attribution-settings) | `{"commit": "🤖 Generated with Claude Code", "pr": ""}` |
140| `includeCoAuthoredBy` | **Deprecated**: Use `attribution` instead. Whether to include the `co-authored-by Claude` byline in git commits and pull requests (default: `true`) | `false` |
67| `permissions` | See table below for structure of permissions. | |141| `permissions` | See table below for structure of permissions. | |
68| `hooks` | Configure custom commands to run before or after tool executions. See [hooks documentation](hooks) | `{"PreToolUse": {"Bash": "echo 'Running command...'"}}` |142| `hooks` | Configure custom commands to run before or after tool executions. See [hooks documentation](/en/hooks) | `{"PreToolUse": {"Bash": "echo 'Running command...'"}}` |
69| `disableAllHooks` | Disable all [hooks](hooks) | `true` |143| `disableAllHooks` | Disable all [hooks](/en/hooks) | `true` |
144| `allowManagedHooksOnly` | (Enterprise) Prevent loading of user, project, and plugin hooks. Only allows managed hooks and SDK hooks. See [Hook configuration](#hook-configuration) | `true` |
70| `model` | Override the default model to use for Claude Code | `"claude-sonnet-4-5-20250929"` |145| `model` | Override the default model to use for Claude Code | `"claude-sonnet-4-5-20250929"` |
71| `statusLine` | Configure a custom status line to display context. See [statusLine documentation](statusline) | `{"type": "command", "command": "~/.claude/statusline.sh"}` |146| `otelHeadersHelper` | Script to generate dynamic OpenTelemetry headers. Runs at startup and periodically (see [Dynamic headers](/en/monitoring-usage#dynamic-headers)) | `/bin/generate_otel_headers.sh` |
72| `outputStyle` | Configure an output style to adjust the system prompt. See [output styles documentation](output-styles) | `"Explanatory"` |147| `statusLine` | Configure a custom status line to display context. See [`statusLine` documentation](/en/statusline) | `{"type": "command", "command": "~/.claude/statusline.sh"}` |
148| `fileSuggestion` | Configure a custom script for `@` file autocomplete. See [File suggestion settings](#file-suggestion-settings) | `{"type": "command", "command": "~/.claude/file-suggestion.sh"}` |
149| `outputStyle` | Configure an output style to adjust the system prompt. See [output styles documentation](/en/output-styles) | `"Explanatory"` |
73| `forceLoginMethod` | Use `claudeai` to restrict login to Claude.ai accounts, `console` to restrict login to Claude Console (API usage billing) accounts | `claudeai` |150| `forceLoginMethod` | Use `claudeai` to restrict login to Claude.ai accounts, `console` to restrict login to Claude Console (API usage billing) accounts | `claudeai` |
74| `forceLoginOrgUUID` | Specify the UUID of an organization to automatically select it during login, bypassing the organization selection step. Requires `forceLoginMethod` to be set | `"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"` |151| `forceLoginOrgUUID` | Specify the UUID of an organization to automatically select it during login, bypassing the organization selection step. Requires `forceLoginMethod` to be set | `"xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"` |
75| `enableAllProjectMcpServers` | Automatically approve all MCP servers defined in project `.mcp.json` files | `true` |152| `enableAllProjectMcpServers` | Automatically approve all MCP servers defined in project `.mcp.json` files | `true` |
77| `disabledMcpjsonServers` | List of specific MCP servers from `.mcp.json` files to reject | `["filesystem"]` |154| `disabledMcpjsonServers` | List of specific MCP servers from `.mcp.json` files to reject | `["filesystem"]` |
78| `allowedMcpServers` | When set in managed-settings.json, allowlist of MCP servers users can configure. Undefined = no restrictions, empty array = lockdown. Applies to all scopes. Denylist takes precedence. See [Enterprise MCP configuration](/en/mcp#enterprise-mcp-configuration) | `[{ "serverName": "github" }]` |155| `allowedMcpServers` | When set in managed-settings.json, allowlist of MCP servers users can configure. Undefined = no restrictions, empty array = lockdown. Applies to all scopes. Denylist takes precedence. See [Enterprise MCP configuration](/en/mcp#enterprise-mcp-configuration) | `[{ "serverName": "github" }]` |
79| `deniedMcpServers` | When set in managed-settings.json, denylist of MCP servers that are explicitly blocked. Applies to all scopes including enterprise servers. Denylist takes precedence over allowlist. See [Enterprise MCP configuration](/en/mcp#enterprise-mcp-configuration) | `[{ "serverName": "filesystem" }]` |156| `deniedMcpServers` | When set in managed-settings.json, denylist of MCP servers that are explicitly blocked. Applies to all scopes including enterprise servers. Denylist takes precedence over allowlist. See [Enterprise MCP configuration](/en/mcp#enterprise-mcp-configuration) | `[{ "serverName": "filesystem" }]` |
157| `strictKnownMarketplaces` | When set in managed-settings.json, allowlist of plugin marketplaces users can add. Undefined = no restrictions, empty array = lockdown. Applies to marketplace additions only. See [Enterprise marketplace restrictions](/en/plugin-marketplaces#enterprise-marketplace-restrictions) | `[{ "source": "github", "repo": "acme-corp/plugins" }]` |
80| `awsAuthRefresh` | Custom script that modifies the `.aws` directory (see [advanced credential configuration](/en/amazon-bedrock#advanced-credential-configuration)) | `aws sso login --profile myprofile` |158| `awsAuthRefresh` | Custom script that modifies the `.aws` directory (see [advanced credential configuration](/en/amazon-bedrock#advanced-credential-configuration)) | `aws sso login --profile myprofile` |
81| `awsCredentialExport` | Custom script that outputs JSON with AWS credentials (see [advanced credential configuration](/en/amazon-bedrock#advanced-credential-configuration)) | `/bin/generate_aws_grant.sh` |159| `awsCredentialExport` | Custom script that outputs JSON with AWS credentials (see [advanced credential configuration](/en/amazon-bedrock#advanced-credential-configuration)) | `/bin/generate_aws_grant.sh` |
160| `alwaysThinkingEnabled` | Enable [extended thinking](/en/common-workflows#use-extended-thinking) by default for all sessions. Typically configured via the `/config` command rather than editing directly | `true` |
82 161
83### Permission settings162### Permission settings
84 163
87| `allow` | Array of [permission rules](/en/iam#configuring-permissions) to allow tool use. **Note:** Bash rules use prefix matching, not regex | `[ "Bash(git diff:*)" ]` |166| `allow` | Array of [permission rules](/en/iam#configuring-permissions) to allow tool use. **Note:** Bash rules use prefix matching, not regex | `[ "Bash(git diff:*)" ]` |
88| `ask` | Array of [permission rules](/en/iam#configuring-permissions) to ask for confirmation upon tool use. | `[ "Bash(git push:*)" ]` |167| `ask` | Array of [permission rules](/en/iam#configuring-permissions) to ask for confirmation upon tool use. | `[ "Bash(git push:*)" ]` |
89| `deny` | Array of [permission rules](/en/iam#configuring-permissions) to deny tool use. Use this to also exclude sensitive files from Claude Code access. **Note:** Bash patterns are prefix matches and can be bypassed (see [Bash permission limitations](/en/iam#tool-specific-permission-rules)) | `[ "WebFetch", "Bash(curl:*)", "Read(./.env)", "Read(./secrets/**)" ]` |168| `deny` | Array of [permission rules](/en/iam#configuring-permissions) to deny tool use. Use this to also exclude sensitive files from Claude Code access. **Note:** Bash patterns are prefix matches and can be bypassed (see [Bash permission limitations](/en/iam#tool-specific-permission-rules)) | `[ "WebFetch", "Bash(curl:*)", "Read(./.env)", "Read(./secrets/**)" ]` |
90| `additionalDirectories` | Additional [working directories](iam#working-directories) that Claude has access to | `[ "../docs/" ]` |169| `additionalDirectories` | Additional [working directories](/en/iam#working-directories) that Claude has access to | `[ "../docs/" ]` |
91| `defaultMode` | Default [permission mode](iam#permission-modes) when opening Claude Code | `"acceptEdits"` |170| `defaultMode` | Default [permission mode](/en/iam#permission-modes) when opening Claude Code | `"acceptEdits"` |
92| `disableBypassPermissionsMode` | Set to `"disable"` to prevent `bypassPermissions` mode from being activated. This disables the `--dangerously-skip-permissions` command-line flag. See [managed policy settings](iam#enterprise-managed-policy-settings) | `"disable"` |171| `disableBypassPermissionsMode` | Set to `"disable"` to prevent `bypassPermissions` mode from being activated. This disables the `--dangerously-skip-permissions` command-line flag. See [managed settings](/en/iam#enterprise-managed-settings) | `"disable"` |
93 172
94### Sandbox settings173### Sandbox settings
95 174
104| `excludedCommands` | Commands that should run outside of the sandbox | `["git", "docker"]` |183| `excludedCommands` | Commands that should run outside of the sandbox | `["git", "docker"]` |
105| `allowUnsandboxedCommands` | Allow commands to run outside the sandbox via the `dangerouslyDisableSandbox` parameter. When set to `false`, the `dangerouslyDisableSandbox` escape hatch is completely disabled and all commands must run sandboxed (or be in `excludedCommands`). Useful for enterprise policies that require strict sandboxing. Default: true | `false` |184| `allowUnsandboxedCommands` | Allow commands to run outside the sandbox via the `dangerouslyDisableSandbox` parameter. When set to `false`, the `dangerouslyDisableSandbox` escape hatch is completely disabled and all commands must run sandboxed (or be in `excludedCommands`). Useful for enterprise policies that require strict sandboxing. Default: true | `false` |
106| `network.allowUnixSockets` | Unix socket paths accessible in sandbox (for SSH agents, etc.) | `["~/.ssh/agent-socket"]` |185| `network.allowUnixSockets` | Unix socket paths accessible in sandbox (for SSH agents, etc.) | `["~/.ssh/agent-socket"]` |
107| `network.allowLocalBinding` | Allow binding to localhost ports (MacOS only). Default: false | `true` |186| `network.allowLocalBinding` | Allow binding to localhost ports (macOS only). Default: false | `true` |
108| `network.httpProxyPort` | HTTP proxy port used if you wish to bring your own proxy. If not specified, Claude will run its own proxy. | `8080` |187| `network.httpProxyPort` | HTTP proxy port used if you wish to bring your own proxy. If not specified, Claude will run its own proxy. | `8080` |
109| `network.socksProxyPort` | SOCKS5 proxy port used if you wish to bring your own proxy. If not specified, Claude will run its own proxy. | `8081` |188| `network.socksProxyPort` | SOCKS5 proxy port used if you wish to bring your own proxy. If not specified, Claude will run its own proxy. | `8081` |
110| `enableWeakerNestedSandbox` | Enable weaker sandbox for unprivileged Docker environments (Linux only). **Reduces security.** Default: false | `true` |189| `enableWeakerNestedSandbox` | Enable weaker sandbox for unprivileged Docker environments (Linux only). **Reduces security.** Default: false | `true` |
133}212}
134```213```
135 214
136**Filesystem access** is controlled via Read/Edit permissions:215**Filesystem and network restrictions** use standard permission rules:
216
217* Use `Read` deny rules to block Claude from reading specific files or directories
218* Use `Edit` allow rules to let Claude write to directories beyond the current working directory
219* Use `Edit` deny rules to block writes to specific paths
220* Use `WebFetch` allow/deny rules to control which network domains Claude can access
221
222### Attribution settings
223
224Claude Code adds attribution to git commits and pull requests. These are configured separately:
225
226* Commits use [git trailers](https://git-scm.com/docs/git-interpret-trailers) (like `Co-Authored-By`) by default, which can be customized or disabled
227* Pull request descriptions are plain text
228
229| Keys | Description |
230| :------- | :----------------------------------------------------------------------------------------- |
231| `commit` | Attribution for git commits, including any trailers. Empty string hides commit attribution |
232| `pr` | Attribution for pull request descriptions. Empty string hides pull request attribution |
233
234**Default commit attribution:**
235
236```
237🤖 Generated with [Claude Code](https://claude.com/claude-code)
238
239 Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
240```
241
242**Default pull request attribution:**
243
244```
245🤖 Generated with [Claude Code](https://claude.com/claude-code)
246```
247
248**Example:**
249
250```json theme={null}
251{
252 "attribution": {
253 "commit": "Generated with AI\n\nCo-Authored-By: AI <ai@example.com>",
254 "pr": ""
255 }
256}
257```
258
259<Note>
260 The `attribution` setting takes precedence over the deprecated `includeCoAuthoredBy` setting. To hide all attribution, set `commit` and `pr` to empty strings.
261</Note>
262
263### File suggestion settings
264
265Configure a custom command for `@` file path autocomplete. The built-in file suggestion uses fast filesystem traversal, but large monorepos may benefit from project-specific indexing such as a pre-built file index or custom tooling.
266
267```json theme={null}
268{
269 "fileSuggestion": {
270 "type": "command",
271 "command": "~/.claude/file-suggestion.sh"
272 }
273}
274```
275
276The command runs with the same environment variables as [hooks](/en/hooks), including `CLAUDE_PROJECT_DIR`. It receives JSON via stdin with a `query` field:
137 277
138* Read deny rules block file reads in sandbox278```json theme={null}
139* Edit allow rules permit file writes (in addition to the defaults, e.g. the current working directory)279{"query": "src/comp"}
140* Edit deny rules block writes within allowed paths280```
141 281
142**Network access** is controlled via WebFetch permissions:282Output newline-separated file paths to stdout (currently limited to 15):
143 283
144* WebFetch allow rules permit network domains284```
145* WebFetch deny rules block network domains285src/components/Button.tsx
286src/components/Modal.tsx
287src/components/Form.tsx
288```
289
290**Example:**
291
292```bash theme={null}
293#!/bin/bash
294query=$(cat | jq -r '.query')
295your-repo-file-index --query "$query" | head -20
296```
297
298### Hook configuration
299
300**Enterprise-only setting**: Controls which hooks are allowed to run. This setting can only be configured in [managed settings](#settings-files) and provides enterprise administrators with strict control over hook execution.
301
302**Behavior when `allowManagedHooksOnly` is `true`:**
303
304* Managed hooks and SDK hooks are loaded
305* User hooks, project hooks, and plugin hooks are blocked
306
307**Configuration:**
308
309```json theme={null}
310{
311 "allowManagedHooksOnly": true
312}
313```
146 314
147### Settings precedence315### Settings precedence
148 316
149Settings are applied in order of precedence (highest to lowest):317Settings apply in order of precedence. From highest to lowest:
150 318
1511. **Enterprise managed policies** (`managed-settings.json`)3191. **Managed settings** (Enterprise)
152 * Deployed by IT/DevOps320 * Remote settings configured via the [Claude.ai admin console](https://claude.ai/admin-settings/claude-code)
321 * Fetched automatically when users authenticate
153 * Cannot be overridden322 * Cannot be overridden
154 323
1552. **Command line arguments**3242. **File-based managed settings** (`managed-settings.json`)
325 * Policies deployed by IT/DevOps to system directories
326 * Cannot be overridden by user or project settings
327 * Ignored when remote managed settings are configured
328
3293. **Command line arguments**
156 * Temporary overrides for a specific session330 * Temporary overrides for a specific session
157 331
1583. **Local project settings** (`.claude/settings.local.json`)3324. **Local project settings** (`.claude/settings.local.json`)
159 * Personal project-specific settings333 * Personal project-specific settings
160 334
1614. **Shared project settings** (`.claude/settings.json`)3355. **Shared project settings** (`.claude/settings.json`)
162 * Team-shared project settings in source control336 * Team-shared project settings in source control
163 337
1645. **User settings** (`~/.claude/settings.json`)3386. **User settings** (`~/.claude/settings.json`)
165 * Personal global settings339 * Personal global settings
166 340
167This hierarchy ensures that enterprise security policies are always enforced while still allowing teams and individuals to customize their experience.341This hierarchy ensures that enterprise security policies are always enforced while still allowing teams and individuals to customize their experience.
168 342
343For example, if your user settings allow `Bash(npm run:*)` but a project's shared settings deny it, the project setting takes precedence and the command is blocked.
344
169### Key points about the configuration system345### Key points about the configuration system
170 346
171* **Memory files (CLAUDE.md)**: Contain instructions and context that Claude loads at startup347* **Memory files (`CLAUDE.md`)**: Contain instructions and context that Claude loads at startup
172* **Settings files (JSON)**: Configure permissions, environment variables, and tool behavior348* **Settings files (JSON)**: Configure permissions, environment variables, and tool behavior
173* **Slash commands**: Custom commands that can be invoked during a session with `/command-name`349* **Slash commands**: Custom commands that can be invoked during a session with `/command-name`
174* **MCP servers**: Extend Claude Code with additional tools and integrations350* **MCP servers**: Extend Claude Code with additional tools and integrations
175* **Precedence**: Higher-level configurations (Enterprise) override lower-level ones (User/Project)351* **Precedence**: Higher-level configurations (Enterprise) override lower-level ones (User/Project)
176* **Inheritance**: Settings are merged, with more specific settings adding to or overriding broader ones352* **Inheritance**: Settings are merged, with more specific settings adding to or overriding broader ones
177 353
178### System prompt availability354### System prompt
179 355
180<Note>356Claude Code's internal system prompt is not published. To add custom instructions, use `CLAUDE.md` files or the `--append-system-prompt` flag.
181 Unlike for claude.ai, we do not publish Claude Code's internal system prompt on this website. Use CLAUDE.md files or `--append-system-prompt` to add custom instructions to Claude Code's behavior.
182</Note>
183 357
184### Excluding sensitive files358### Excluding sensitive files
185 359
186To prevent Claude Code from accessing files containing sensitive information (e.g., API keys, secrets, environment files), use the `permissions.deny` setting in your `.claude/settings.json` file:360To prevent Claude Code from accessing files containing sensitive information like API keys, secrets, and environment files, use the `permissions.deny` setting in your `.claude/settings.json` file:
187 361
188```json theme={null}362```json theme={null}
189{363{
221```json theme={null}395```json theme={null}
222{396{
223 "enabledPlugins": {397 "enabledPlugins": {
224 "formatter@company-tools": true,398 "formatter@acme-tools": true,
225 "deployer@company-tools": true,399 "deployer@acme-tools": true,
226 "analyzer@security-plugins": false400 "analyzer@security-plugins": false
227 },401 },
228 "extraKnownMarketplaces": {402 "extraKnownMarketplaces": {
229 "company-tools": {403 "acme-tools": {
230 "source": "github",404 "source": "github",
231 "repo": "company/claude-plugins"405 "repo": "acme-corp/claude-plugins"
232 }406 }
233 }407 }
234}408}
272```json theme={null}446```json theme={null}
273{447{
274 "extraKnownMarketplaces": {448 "extraKnownMarketplaces": {
275 "company-tools": {449 "acme-tools": {
276 "source": {450 "source": {
277 "source": "github",451 "source": "github",
278 "repo": "company-org/claude-plugins"452 "repo": "acme-corp/claude-plugins"
279 }453 }
280 },454 },
281 "security-plugins": {455 "security-plugins": {
282 "source": {456 "source": {
283 "source": "git",457 "source": "git",
284 "url": "https://git.company.com/security/plugins.git"458 "url": "https://git.example.com/security/plugins.git"
285 }459 }
286 }460 }
287 }461 }
294* `git`: Any git URL (uses `url`)468* `git`: Any git URL (uses `url`)
295* `directory`: Local filesystem path (uses `path`, for development only)469* `directory`: Local filesystem path (uses `path`, for development only)
296 470
471#### `strictKnownMarketplaces`
472
473**Enterprise-only setting**: Controls which plugin marketplaces users are allowed to add. This setting can only be configured in [`managed-settings.json`](/en/iam#enterprise-managed-settings) and provides enterprise administrators with strict control over marketplace sources.
474
475**Managed settings file locations**:
476
477* **macOS**: `/Library/Application Support/ClaudeCode/managed-settings.json`
478* **Linux and WSL**: `/etc/claude-code/managed-settings.json`
479* **Windows**: `C:\ProgramData\ClaudeCode\managed-settings.json`
480
481**Key characteristics**:
482
483* Only available in enterprise managed settings (`managed-settings.json`)
484* Cannot be overridden by user or project settings (highest precedence)
485* Enforced BEFORE network/filesystem operations (blocked sources never execute)
486* Uses exact matching for source specifications (including `ref`, `path` for git sources)
487
488**Allowlist behavior**:
489
490* `undefined` (default): No restrictions - users can add any marketplace
491* Empty array `[]`: Complete lockdown - users cannot add any new marketplaces
492* List of sources: Users can only add marketplaces that match exactly
493
494**All supported source types**:
495
496The allowlist supports six marketplace source types. Each source must match exactly for a user's marketplace addition to be allowed.
497
4981. **GitHub repositories**:
499
500```json theme={null}
501{ "source": "github", "repo": "acme-corp/approved-plugins" }
502{ "source": "github", "repo": "acme-corp/security-tools", "ref": "v2.0" }
503{ "source": "github", "repo": "acme-corp/plugins", "ref": "main", "path": "marketplace" }
504```
505
506Fields: `repo` (required), `ref` (optional: branch/tag/SHA), `path` (optional: subdirectory)
507
5082. **Git repositories**:
509
510```json theme={null}
511{ "source": "git", "url": "https://gitlab.example.com/tools/plugins.git" }
512{ "source": "git", "url": "https://bitbucket.org/acme-corp/plugins.git", "ref": "production" }
513{ "source": "git", "url": "ssh://git@git.example.com/plugins.git", "ref": "v3.1", "path": "approved" }
514```
515
516Fields: `url` (required), `ref` (optional: branch/tag/SHA), `path` (optional: subdirectory)
517
5183. **URL-based marketplaces**:
519
520```json theme={null}
521{ "source": "url", "url": "https://plugins.example.com/marketplace.json" }
522{ "source": "url", "url": "https://cdn.example.com/marketplace.json", "headers": { "Authorization": "Bearer ${TOKEN}" } }
523```
524
525Fields: `url` (required), `headers` (optional: HTTP headers for authenticated access)
526
5274. **NPM packages**:
528
529```json theme={null}
530{ "source": "npm", "package": "@acme-corp/claude-plugins" }
531{ "source": "npm", "package": "@acme-corp/approved-marketplace" }
532```
533
534Fields: `package` (required, supports scoped packages)
535
5365. **File paths**:
537
538```json theme={null}
539{ "source": "file", "path": "/usr/local/share/claude/acme-marketplace.json" }
540{ "source": "file", "path": "/opt/acme-corp/plugins/marketplace.json" }
541```
542
543Fields: `path` (required: absolute path to marketplace.json file)
544
5456. **Directory paths**:
546
547```json theme={null}
548{ "source": "directory", "path": "/usr/local/share/claude/acme-plugins" }
549{ "source": "directory", "path": "/opt/acme-corp/approved-marketplaces" }
550```
551
552Fields: `path` (required: absolute path to directory containing `.claude-plugin/marketplace.json`)
553
554**Configuration examples**:
555
556Example - Allow specific marketplaces only:
557
558```json theme={null}
559{
560 "strictKnownMarketplaces": [
561 {
562 "source": "github",
563 "repo": "acme-corp/approved-plugins"
564 },
565 {
566 "source": "github",
567 "repo": "acme-corp/security-tools",
568 "ref": "v2.0"
569 },
570 {
571 "source": "url",
572 "url": "https://plugins.example.com/marketplace.json"
573 },
574 {
575 "source": "npm",
576 "package": "@acme-corp/compliance-plugins"
577 }
578 ]
579}
580```
581
582Example - Disable all marketplace additions:
583
584```json theme={null}
585{
586 "strictKnownMarketplaces": []
587}
588```
589
590**Exact matching requirements**:
591
592Marketplace sources must match **exactly** for a user's addition to be allowed. For git-based sources (`github` and `git`), this includes all optional fields:
593
594* The `repo` or `url` must match exactly
595* The `ref` field must match exactly (or both be undefined)
596* The `path` field must match exactly (or both be undefined)
597
598Examples of sources that **do NOT match**:
599
600```json theme={null}
601// These are DIFFERENT sources:
602{ "source": "github", "repo": "acme-corp/plugins" }
603{ "source": "github", "repo": "acme-corp/plugins", "ref": "main" }
604
605// These are also DIFFERENT:
606{ "source": "github", "repo": "acme-corp/plugins", "path": "marketplace" }
607{ "source": "github", "repo": "acme-corp/plugins" }
608```
609
610**Comparison with `extraKnownMarketplaces`**:
611
612| Aspect | `strictKnownMarketplaces` | `extraKnownMarketplaces` |
613| --------------------- | ------------------------------------ | ------------------------------------ |
614| **Purpose** | Enterprise policy enforcement | Team convenience |
615| **Settings file** | `managed-settings.json` only | Any settings file |
616| **Behavior** | Blocks non-allowlisted additions | Auto-installs missing marketplaces |
617| **When enforced** | Before network/filesystem operations | After user trust prompt |
618| **Can be overridden** | No (highest precedence) | Yes (by higher precedence settings) |
619| **Source format** | Direct source object | Named marketplace with nested source |
620| **Use case** | Compliance, security restrictions | Onboarding, standardization |
621
622**Format difference**:
623
624`strictKnownMarketplaces` uses direct source objects:
625
626```json theme={null}
627{
628 "strictKnownMarketplaces": [
629 { "source": "github", "repo": "acme-corp/plugins" }
630 ]
631}
632```
633
634`extraKnownMarketplaces` requires named marketplaces:
635
636```json theme={null}
637{
638 "extraKnownMarketplaces": {
639 "acme-tools": {
640 "source": { "source": "github", "repo": "acme-corp/plugins" }
641 }
642 }
643}
644```
645
646**Important notes**:
647
648* Restrictions are checked BEFORE any network requests or filesystem operations
649* When blocked, users see clear error messages indicating the source is blocked by enterprise policy
650* The restriction applies only to adding NEW marketplaces; previously installed marketplaces remain accessible
651* Enterprise managed settings have the highest precedence and cannot be overridden
652
653See [Enterprise marketplace restrictions](/en/plugin-marketplaces#enterprise-marketplace-restrictions) for user-facing documentation.
654
297### Managing plugins655### Managing plugins
298 656
299Use the `/plugin` command to manage plugins interactively:657Use the `/plugin` command to manage plugins interactively:
315</Note>673</Note>
316 674
317| Variable | Purpose |675| Variable | Purpose |
318| :----------------------------------------- | :--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |676| :-------------------------------------------- | :------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
319| `ANTHROPIC_API_KEY` | API key sent as `X-Api-Key` header, typically for the Claude SDK (for interactive usage, run `/login`) |677| `ANTHROPIC_API_KEY` | API key sent as `X-Api-Key` header, typically for the Claude SDK (for interactive usage, run `/login`) |
320| `ANTHROPIC_AUTH_TOKEN` | Custom value for the `Authorization` header (the value you set here will be prefixed with `Bearer `) |678| `ANTHROPIC_AUTH_TOKEN` | Custom value for the `Authorization` header (the value you set here will be prefixed with `Bearer `) |
321| `ANTHROPIC_CUSTOM_HEADERS` | Custom headers you want to add to the request (in `Name: Value` format) |679| `ANTHROPIC_CUSTOM_HEADERS` | Custom headers you want to add to the request (in `Name: Value` format) |
322| `ANTHROPIC_DEFAULT_HAIKU_MODEL` | See [Model configuration](/en/model-config#environment-variables) |680| `ANTHROPIC_DEFAULT_HAIKU_MODEL` | See [Model configuration](/en/model-config#environment-variables) |
323| `ANTHROPIC_DEFAULT_OPUS_MODEL` | See [Model configuration](/en/model-config#environment-variables) |681| `ANTHROPIC_DEFAULT_OPUS_MODEL` | See [Model configuration](/en/model-config#environment-variables) |
324| `ANTHROPIC_DEFAULT_SONNET_MODEL` | See [Model configuration](/en/model-config#environment-variables) |682| `ANTHROPIC_DEFAULT_SONNET_MODEL` | See [Model configuration](/en/model-config#environment-variables) |
683| `ANTHROPIC_FOUNDRY_API_KEY` | API key for Microsoft Foundry authentication (see [Microsoft Foundry](/en/microsoft-foundry)) |
325| `ANTHROPIC_MODEL` | Name of the model setting to use (see [Model Configuration](/en/model-config#environment-variables)) |684| `ANTHROPIC_MODEL` | Name of the model setting to use (see [Model Configuration](/en/model-config#environment-variables)) |
326| `ANTHROPIC_SMALL_FAST_MODEL` | \[DEPRECATED] Name of [Haiku-class model for background tasks](/en/costs) |685| `ANTHROPIC_SMALL_FAST_MODEL` | \[DEPRECATED] Name of [Haiku-class model for background tasks](/en/costs) |
327| `ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION` | Override AWS region for the Haiku-class model when using Bedrock |686| `ANTHROPIC_SMALL_FAST_MODEL_AWS_REGION` | Override AWS region for the Haiku-class model when using Bedrock |
334| `CLAUDE_CODE_CLIENT_CERT` | Path to client certificate file for mTLS authentication |693| `CLAUDE_CODE_CLIENT_CERT` | Path to client certificate file for mTLS authentication |
335| `CLAUDE_CODE_CLIENT_KEY_PASSPHRASE` | Passphrase for encrypted CLAUDE\_CODE\_CLIENT\_KEY (optional) |694| `CLAUDE_CODE_CLIENT_KEY_PASSPHRASE` | Passphrase for encrypted CLAUDE\_CODE\_CLIENT\_KEY (optional) |
336| `CLAUDE_CODE_CLIENT_KEY` | Path to client private key file for mTLS authentication |695| `CLAUDE_CODE_CLIENT_KEY` | Path to client private key file for mTLS authentication |
696| `CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS` | Set to `1` to disable Anthropic API-specific `anthropic-beta` headers. Use this if experiencing issues like "Unexpected value(s) for the `anthropic-beta` header" when using an LLM gateway with third-party providers |
337| `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC` | Equivalent of setting `DISABLE_AUTOUPDATER`, `DISABLE_BUG_COMMAND`, `DISABLE_ERROR_REPORTING`, and `DISABLE_TELEMETRY` |697| `CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC` | Equivalent of setting `DISABLE_AUTOUPDATER`, `DISABLE_BUG_COMMAND`, `DISABLE_ERROR_REPORTING`, and `DISABLE_TELEMETRY` |
338| `CLAUDE_CODE_DISABLE_TERMINAL_TITLE` | Set to `1` to disable automatic terminal title updates based on conversation context |698| `CLAUDE_CODE_DISABLE_TERMINAL_TITLE` | Set to `1` to disable automatic terminal title updates based on conversation context |
339| `CLAUDE_CODE_IDE_SKIP_AUTO_INSTALL` | Skip auto-installation of IDE extensions |699| `CLAUDE_CODE_IDE_SKIP_AUTO_INSTALL` | Skip auto-installation of IDE extensions |
340| `CLAUDE_CODE_MAX_OUTPUT_TOKENS` | Set the maximum number of output tokens for most requests |700| `CLAUDE_CODE_MAX_OUTPUT_TOKENS` | Set the maximum number of output tokens for most requests |
341| `CLAUDE_CODE_SKIP_BEDROCK_AUTH` | Skip AWS authentication for Bedrock (e.g. when using an LLM gateway) |701| `CLAUDE_CODE_OTEL_HEADERS_HELPER_DEBOUNCE_MS` | Interval for refreshing dynamic OpenTelemetry headers in milliseconds (default: 1740000 / 29 minutes). See [Dynamic headers](/en/monitoring-usage#dynamic-headers) |
342| `CLAUDE_CODE_SKIP_VERTEX_AUTH` | Skip Google authentication for Vertex (e.g. when using an LLM gateway) |702| `CLAUDE_CODE_SHELL_PREFIX` | Command prefix to wrap all bash commands (for example, for logging or auditing). Example: `/path/to/logger.sh` will execute `/path/to/logger.sh <command>` |
703| `CLAUDE_CODE_SKIP_BEDROCK_AUTH` | Skip AWS authentication for Bedrock (for example, when using an LLM gateway) |
704| `CLAUDE_CODE_SKIP_FOUNDRY_AUTH` | Skip Azure authentication for Microsoft Foundry (for example, when using an LLM gateway) |
705| `CLAUDE_CODE_SKIP_VERTEX_AUTH` | Skip Google authentication for Vertex (for example, when using an LLM gateway) |
343| `CLAUDE_CODE_SUBAGENT_MODEL` | See [Model configuration](/en/model-config) |706| `CLAUDE_CODE_SUBAGENT_MODEL` | See [Model configuration](/en/model-config) |
344| `CLAUDE_CODE_USE_BEDROCK` | Use [Bedrock](/en/amazon-bedrock) |707| `CLAUDE_CODE_USE_BEDROCK` | Use [Bedrock](/en/amazon-bedrock) |
708| `CLAUDE_CODE_USE_FOUNDRY` | Use [Microsoft Foundry](/en/microsoft-foundry) |
345| `CLAUDE_CODE_USE_VERTEX` | Use [Vertex](/en/google-vertex-ai) |709| `CLAUDE_CODE_USE_VERTEX` | Use [Vertex](/en/google-vertex-ai) |
346| `DISABLE_AUTOUPDATER` | Set to `1` to disable automatic updates. This takes precedence over the `autoUpdates` configuration setting. |710| `CLAUDE_CONFIG_DIR` | Customize where Claude Code stores its configuration and data files |
711| `DISABLE_AUTOUPDATER` | Set to `1` to disable automatic updates. |
347| `DISABLE_BUG_COMMAND` | Set to `1` to disable the `/bug` command |712| `DISABLE_BUG_COMMAND` | Set to `1` to disable the `/bug` command |
348| `DISABLE_COST_WARNINGS` | Set to `1` to disable cost warning messages |713| `DISABLE_COST_WARNINGS` | Set to `1` to disable cost warning messages |
349| `DISABLE_ERROR_REPORTING` | Set to `1` to opt out of Sentry error reporting |714| `DISABLE_ERROR_REPORTING` | Set to `1` to opt out of Sentry error reporting |
356| `HTTP_PROXY` | Specify HTTP proxy server for network connections |721| `HTTP_PROXY` | Specify HTTP proxy server for network connections |
357| `HTTPS_PROXY` | Specify HTTPS proxy server for network connections |722| `HTTPS_PROXY` | Specify HTTPS proxy server for network connections |
358| `MAX_MCP_OUTPUT_TOKENS` | Maximum number of tokens allowed in MCP tool responses. Claude Code displays a warning when output exceeds 10,000 tokens (default: 25000) |723| `MAX_MCP_OUTPUT_TOKENS` | Maximum number of tokens allowed in MCP tool responses. Claude Code displays a warning when output exceeds 10,000 tokens (default: 25000) |
359| `MAX_THINKING_TOKENS` | Enable [extended thinking](/en/docs/build-with-claude/extended-thinking) and set the token budget for the thinking process. Extended thinking improves performance on complex reasoning and coding tasks but impacts [prompt caching efficiency](/en/docs/build-with-claude/prompt-caching#caching-with-thinking-blocks). Disabled by default. |724| `MAX_THINKING_TOKENS` | Enable [extended thinking](https://docs.claude.com/en/docs/build-with-claude/extended-thinking) and set the token budget for the thinking process. Extended thinking improves performance on complex reasoning and coding tasks but impacts [prompt caching efficiency](https://docs.claude.com/en/docs/build-with-claude/prompt-caching#caching-with-thinking-blocks). Disabled by default. |
360| `MCP_TIMEOUT` | Timeout in milliseconds for MCP server startup |725| `MCP_TIMEOUT` | Timeout in milliseconds for MCP server startup |
361| `MCP_TOOL_TIMEOUT` | Timeout in milliseconds for MCP tool execution |726| `MCP_TOOL_TIMEOUT` | Timeout in milliseconds for MCP tool execution |
362| `NO_PROXY` | List of domains and IPs to which requests will be directly issued, bypassing proxy |727| `NO_PROXY` | List of domains and IPs to which requests will be directly issued, bypassing proxy |
363| `SLASH_COMMAND_TOOL_CHAR_BUDGET` | Maximum number of characters for slash command metadata shown to [SlashCommand tool](/en/slash-commands#slashcommand-tool) (default: 15000) |728| `SLASH_COMMAND_TOOL_CHAR_BUDGET` | Maximum number of characters for slash command metadata shown to [SlashCommand tool](/en/slash-commands#slashcommand-tool) (default: 15000) |
364| `USE_BUILTIN_RIPGREP` | Set to `0` to use system-installed `rg` intead of `rg` included with Claude Code |729| `USE_BUILTIN_RIPGREP` | Set to `0` to use system-installed `rg` instead of `rg` included with Claude Code |
365| `VERTEX_REGION_CLAUDE_3_5_HAIKU` | Override region for Claude 3.5 Haiku when using Vertex AI |730| `VERTEX_REGION_CLAUDE_3_5_HAIKU` | Override region for Claude 3.5 Haiku when using Vertex AI |
366| `VERTEX_REGION_CLAUDE_3_7_SONNET` | Override region for Claude 3.7 Sonnet when using Vertex AI |731| `VERTEX_REGION_CLAUDE_3_7_SONNET` | Override region for Claude 3.7 Sonnet when using Vertex AI |
367| `VERTEX_REGION_CLAUDE_4_0_OPUS` | Override region for Claude 4.0 Opus when using Vertex AI |732| `VERTEX_REGION_CLAUDE_4_0_OPUS` | Override region for Claude 4.0 Opus when using Vertex AI |
373Claude Code has access to a set of powerful tools that help it understand and modify your codebase:738Claude Code has access to a set of powerful tools that help it understand and modify your codebase:
374 739
375| Tool | Description | Permission Required |740| Tool | Description | Permission Required |
376| :--------------- | :------------------------------------------------------------------ | :------------------ |741| :------------------ | :------------------------------------------------------------------------------------------------ | :------------------ |
377| **Bash** | Executes shell commands in your environment | Yes |742| **AskUserQuestion** | Asks the user multiple choice questions to gather information or clarify ambiguity | No |
743| **Bash** | Executes shell commands in your environment (see [Bash tool behavior](#bash-tool-behavior) below) | Yes |
744| **BashOutput** | Retrieves output from a background bash shell | No |
378| **Edit** | Makes targeted edits to specific files | Yes |745| **Edit** | Makes targeted edits to specific files | Yes |
746| **ExitPlanMode** | Prompts the user to exit plan mode and start coding | Yes |
379| **Glob** | Finds files based on pattern matching | No |747| **Glob** | Finds files based on pattern matching | No |
380| **Grep** | Searches for patterns in file contents | No |748| **Grep** | Searches for patterns in file contents | No |
749| **KillShell** | Kills a running background bash shell by its ID | No |
381| **NotebookEdit** | Modifies Jupyter notebook cells | Yes |750| **NotebookEdit** | Modifies Jupyter notebook cells | Yes |
382| **NotebookRead** | Reads and displays Jupyter notebook contents | No |
383| **Read** | Reads the contents of files | No |751| **Read** | Reads the contents of files | No |
752| **Skill** | Executes a skill within the main conversation | Yes |
384| **SlashCommand** | Runs a [custom slash command](/en/slash-commands#slashcommand-tool) | Yes |753| **SlashCommand** | Runs a [custom slash command](/en/slash-commands#slashcommand-tool) | Yes |
385| **Task** | Runs a sub-agent to handle complex, multi-step tasks | No |754| **Task** | Runs a sub-agent to handle complex, multi-step tasks | No |
386| **TodoWrite** | Creates and manages structured task lists | No |755| **TodoWrite** | Creates and manages structured task lists | No |
390 759
391Permission rules can be configured using `/allowed-tools` or in [permission settings](/en/settings#available-settings). Also see [Tool-specific permission rules](/en/iam#tool-specific-permission-rules).760Permission rules can be configured using `/allowed-tools` or in [permission settings](/en/settings#available-settings). Also see [Tool-specific permission rules](/en/iam#tool-specific-permission-rules).
392 761
762### Bash tool behavior
763
764The Bash tool executes shell commands with the following persistence behavior:
765
766* **Working directory persists**: When Claude changes the working directory (for example, `cd /path/to/dir`), subsequent Bash commands will execute in that directory. You can use `CLAUDE_BASH_MAINTAIN_PROJECT_WORKING_DIR=1` to reset to the project directory after each command.
767* **Environment variables do NOT persist**: Environment variables set in one Bash command (for example, `export MY_VAR=value`) are **not** available in subsequent Bash commands. Each Bash command runs in a fresh shell environment.
768
769To make environment variables available in Bash commands, you have **three options**:
770
771**Option 1: Activate environment before starting Claude Code** (simplest approach)
772
773Activate your virtual environment in your terminal before launching Claude Code:
774
775```bash theme={null}
776conda activate myenv
777# or: source /path/to/venv/bin/activate
778claude
779```
780
781This works for shell environments but environment variables set within Claude's Bash commands will not persist between commands.
782
783**Option 2: Set CLAUDE\_ENV\_FILE before starting Claude Code** (persistent environment setup)
784
785Export the path to a shell script containing your environment setup:
786
787```bash theme={null}
788export CLAUDE_ENV_FILE=/path/to/env-setup.sh
789claude
790```
791
792Where `/path/to/env-setup.sh` contains:
793
794```bash theme={null}
795conda activate myenv
796# or: source /path/to/venv/bin/activate
797# or: export MY_VAR=value
798```
799
800Claude Code will source this file before each Bash command, making the environment persistent across all commands.
801
802**Option 3: Use a SessionStart hook** (project-specific configuration)
803
804Configure in `.claude/settings.json`:
805
806```json theme={null}
807{
808 "hooks": {
809 "SessionStart": [{
810 "matcher": "startup",
811 "hooks": [{
812 "type": "command",
813 "command": "echo 'conda activate myenv' >> \"$CLAUDE_ENV_FILE\""
814 }]
815 }]
816 }
817}
818```
819
820The hook writes to `$CLAUDE_ENV_FILE`, which is then sourced before each Bash command. This is ideal for team-shared project configurations.
821
822See [SessionStart hooks](/en/hooks#persisting-environment-variables) for more details on Option 3.
823
393### Extending tools with hooks824### Extending tools with hooks
394 825
395You can run custom commands before or after any tool executes using826You can run custom commands before or after any tool executes using
402## See also833## See also
403 834
404* [Identity and Access Management](/en/iam#configuring-permissions) - Learn about Claude Code's permission system835* [Identity and Access Management](/en/iam#configuring-permissions) - Learn about Claude Code's permission system
405* [IAM and access control](/en/iam#enterprise-managed-policy-settings) - Enterprise policy management836* [IAM and access control](/en/iam#enterprise-managed-settings) - Enterprise policy management
406* [Troubleshooting](/en/troubleshooting#auto-updater-issues) - Solutions for common configuration issues837* [Troubleshooting](/en/troubleshooting#auto-updater-issues) - Solutions for common configuration issues
838
839
840---
841
842> To find navigation and other pages in this documentation, fetch the llms.txt file at: https://code.claude.com/docs/llms.txt