surshar / claude-code
Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows - all through natural language commands.
Built by Anthropic · github.com/anthropics
| 1 | # Settings Examples |
| 2 | |
| 3 | Example Claude Code settings files, primarily intended for organization-wide deployments. Use these as starting points — adjust them to fit your needs. |
| 4 | |
| 5 | These may be applied at any level of the [settings hierarchy](https://code.claude.com/docs/en/settings#settings-files), though certain properties only take effect if specified in enterprise settings (e.g. `strictKnownMarketplaces`, `allowManagedHooksOnly`, `allowManagedPermissionRulesOnly`). |
| 6 | |
| 7 | |
| 8 | ## Configuration Examples |
| 9 | |
| 10 | > [!WARNING] |
| 11 | > These examples are community-maintained snippets which may be unsupported or incorrect. You are responsible for the correctness of your own settings configuration. |
| 12 | |
| 13 | | Setting | [`settings-lax.json`](./settings-lax.json) | [`settings-strict.json`](./settings-strict.json) | [`settings-bash-sandbox.json`](./settings-bash-sandbox.json) | |
| 14 | |---------|:---:|:---:|:---:| |
| 15 | | Disable `--dangerously-skip-permissions` | ✅ | ✅ | | |
| 16 | | Block plugin marketplaces | ✅ | ✅ | | |
| 17 | | Block user and project-defined permission `allow` / `ask` / `deny` | | ✅ | ✅ | |
| 18 | | Block user and project-defined hooks | | ✅ | | |
| 19 | | Deny web fetch and search tools | | ✅ | | |
| 20 | | Bash tool requires approval | | ✅ | | |
| 21 | | Bash tool must run inside of sandbox | | | ✅ | |
| 22 | |
| 23 | ## Tips |
| 24 | - Consider merging snippets of the above examples to reach your desired configuration |
| 25 | - Settings files must be valid JSON |
| 26 | - Before deploying configuration files to your organization, test them locally by applying to `managed-settings.json`, `settings.json` or `settings.local.json` |
| 27 | - The `sandbox` property only applies to the `Bash` tool; it does not apply to other tools (like Read, Write, WebSearch, WebFetch, MCPs), hooks, or internal commands |
| 28 | |
| 29 | ## Deploying via MDM |
| 30 | |
| 31 | To distribute these settings as enterprise-managed policy through Jamf, Iru (Kandji), Intune, or Group Policy, see the deployment templates in [`../mdm`](../mdm). |
| 32 | |
| 33 | ## HIPAA deployments |
| 34 | |
| 35 | For an organization that has the HIPAA configuration applied, [`settings-hipaa.json`](./settings-hipaa.json) and [`managed-mcp-hipaa.json`](./managed-mcp-hipaa.json) are a fuller `managed-settings.json` and `managed-mcp.json` pair with sandboxing, a network allowlist, credential protections, and local data retention. [`README-hipaa.md`](./README-hipaa.md) explains each choice and what to edit before deploying. |
| 36 | |
| 37 | ## Full Documentation |
| 38 | |
| 39 | See https://code.claude.com/docs/en/settings for complete documentation on all available managed settings. |