surshar / claude-code

Claude Code is an agentic coding tool that lives in your terminal, understands your codebase, and helps you code faster by executing routine tasks, explaining complex code, and handling git workflows - all through natural language commands.

Built by Anthropic · github.com/anthropics

claude-code / examples / settings / settings-hipaa.json

Sarah DeatonMerge pull request #100293 from anthropics/sarahdeaton/managed-settings-hipaa-example 3f349d4 · 14 days ago History

152 lines · 5.3 KBRaw

1	{
2	"forceLoginMethod": "claudeai",
3	"forceLoginOrgUUID": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
4	"allowedProviders": ["anthropic"],
5	"allowManagedHooksOnly": true,
6	"allowedHttpHookUrls": [],
7	"allowManagedMcpServersOnly": true,
8	"allowedMcpServers": [],
9	"deniedMcpServers": [
10	{ "serverName": "claude-in-chrome" },
11	{ "serverName": "computer-use" },
12	{ "serverName": "ide" }
13	],
14	"allowManagedPermissionRulesOnly": true,
15	"forceRemoteSettingsRefresh": true,
16	"disableRemoteControl": true,
17	"permissions": {
18	"deny": [
19	"WebFetch",
20	"Projects",
21	"SendUserFile",
22	"ShareOnboardingGuide",
23	"Artifact",
24	"Read(~/.ssh/**)",
25	"Read(~/.aws/**)",
26	"Read(~/.config/gh/**)",
27	"Read(~/.npmrc)",
28	"Read(~/.claude/.credentials.json)",
29	"Read(~/.claude.json)",
30	"Read(~/.claude.json.backup*)",
31	"Read(~/.claude/backups/**)",
32	"Read(~/.git-credentials)",
33	"Read(~/.config/git/credentials)",
34	"Read(~/.netrc)",
35	"Read(~/_netrc)",
36	"Edit(~/.ssh/**)",
37	"Edit(~/.aws/**)",
38	"Edit(~/.config/gh/**)",
39	"Edit(~/.npmrc)",
40	"Edit(~/.claude/.credentials.json)",
41	"Edit(~/.claude.json)",
42	"Edit(~/.claude.json.backup*)",
43	"Edit(~/.claude/backups/**)",
44	"Edit(~/.git-credentials)",
45	"Edit(~/.config/git/credentials)",
46	"Edit(~/.netrc)",
47	"Edit(~/_netrc)"
48	],
49	"disableBypassPermissionsMode": "disable"
50	},
51	"strictKnownMarketplaces": [],
52	"strictPluginOnlyCustomization": true,
53	"disableSideloadFlags": true,
54	"crossSessionInbound": "refuse",
55	"enableArtifact": false,
56	"syncClaudeAiSkills": false,
57	"syncClaudeAiPlugins": false,
58	"skillOverrides": { "auto-mode-setup": "off" },
59	"autoMode": {
60	"environment": ["$defaults"],
61	"soft_deny": ["$defaults"],
62	"hard_deny": ["$defaults"],
63	"classifyAllShell": true
64	},
65	"sandbox": {
66	"enabled": true,
67	"failIfUnavailable": true,
68	"allowUnsandboxedCommands": false,
69	"enableWeakerNestedSandbox": false,
70	"enableWeakerNetworkIsolation": false,
71	"filesystem": {
72	"allowManagedReadPathsOnly": true,
73	"denyWrite": [
74	"~/.ssh",
75	"~/.aws/credentials",
76	"~/.aws/config",
77	"~/.npmrc",
78	"~/.git-credentials",
79	"~/.config/git/credentials",
80	"~/.netrc",
81	"~/_netrc",
82	"~/.claude/.credentials.json",
83	"~/.claude.json",
84	"~/.claude.json.backup*",
85	"~/.claude/backups"
86	]
87	},
88	"credentials": {
89	"files": [
90	{ "path": "~/.aws/credentials", "mode": "deny" },
91	{ "path": "~/.ssh", "mode": "deny" },
92	{ "path": "~/.npmrc", "mode": "deny" },
93	{ "path": "~/.git-credentials", "mode": "deny" },
94	{ "path": "~/.config/git/credentials", "mode": "deny" },
95	{ "path": "~/.netrc", "mode": "deny" },
96	{ "path": "~/_netrc", "mode": "deny" },
97	{ "path": "~/.claude/.credentials.json", "mode": "deny" },
98	{ "path": "~/.claude.json", "mode": "deny" },
99	{ "path": "~/.claude.json.backup*", "mode": "deny" },
100	{ "path": "~/.claude/backups", "mode": "deny" }
101	],
102	"envVars": [
103	{ "name": "AWS_ACCESS_KEY_ID", "mode": "deny" },
104	{ "name": "AWS_SECRET_ACCESS_KEY", "mode": "deny" },
105	{ "name": "AWS_SESSION_TOKEN", "mode": "deny" },
106	{ "name": "GITHUB_TOKEN", "mode": "deny" },
107	{ "name": "GH_TOKEN", "mode": "deny" },
108	{ "name": "GH_ENTERPRISE_TOKEN", "mode": "deny" },
109	{ "name": "GITHUB_ENTERPRISE_TOKEN", "mode": "deny" },
110	{ "name": "NPM_TOKEN", "mode": "deny" },
111	{ "name": "NODE_AUTH_TOKEN", "mode": "deny" },
112	{ "name": "YARN_NPM_AUTH_TOKEN", "mode": "deny" },
113	{ "name": "YARN_NPM_AUTH_IDENT", "mode": "deny" },
114	{ "name": "COREPACK_NPM_TOKEN", "mode": "deny" },
115	{ "name": "COREPACK_NPM_PASSWORD", "mode": "deny" },
116	{ "name": "COREPACK_NPM_USERNAME", "mode": "deny" },
117	{ "name": "BUN_CONFIG_TOKEN", "mode": "deny" },
118	{ "name": "ANTHROPIC_API_KEY", "mode": "deny" },
119	{ "name": "ANTHROPIC_AUTH_TOKEN", "mode": "deny" }
120	]
121	},
122	"network": {
123	"allowManagedDomainsOnly": true,
124	"allowAllUnixSockets": false,
125	"allowLocalBinding": false,
126	"allowedDomains": ["github.example.com", "registry.example.com"]
127	}
128	},
129	"cleanupPeriodDays": 30,
130	"env": {
131	"CLAUDE_CODE_ENABLE_TELEMETRY": "1",
132	"CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY": "1",
133	"DISABLE_ERROR_REPORTING": "1",
134	"DISABLE_FEEDBACK_COMMAND": "1",
135	"DISABLE_INSTALL_GITHUB_APP_COMMAND": "1",
136	"HTTPS_PROXY": "http://proxy.example.internal:8080",
137	"https_proxy": "http://proxy.example.internal:8080",
138	"HTTP_PROXY": "http://proxy.example.internal:8080",
139	"http_proxy": "http://proxy.example.internal:8080",
140	"NO_PROXY": "localhost,127.0.0.1,otel-collector.example.internal",
141	"no_proxy": "localhost,127.0.0.1,otel-collector.example.internal",
142	"OTEL_METRICS_EXPORTER": "otlp",
143	"OTEL_LOGS_EXPORTER": "otlp",
144	"OTEL_EXPORTER_OTLP_PROTOCOL": "http/protobuf",
145	"OTEL_EXPORTER_OTLP_ENDPOINT": "https://otel-collector.example.internal:4318",
146	"OTEL_LOG_USER_PROMPTS": "0",
147	"OTEL_LOG_ASSISTANT_RESPONSES": "0",
148	"OTEL_LOG_TOOL_DETAILS": "0",
149	"OTEL_LOG_TOOL_CONTENT": "0",
150	"OTEL_LOG_RAW_API_BODIES": "0"
151	}
152	}