{
  "forceLoginMethod": "claudeai",
  "forceLoginOrgUUID": "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "allowedProviders": ["anthropic"],
  "allowManagedHooksOnly": true,
  "allowedHttpHookUrls": [],
  "allowManagedMcpServersOnly": true,
  "allowedMcpServers": [],
  "deniedMcpServers": [
    { "serverName": "claude-in-chrome" },
    { "serverName": "computer-use" },
    { "serverName": "ide" }
  ],
  "allowManagedPermissionRulesOnly": true,
  "forceRemoteSettingsRefresh": true,
  "disableRemoteControl": true,
  "permissions": {
    "deny": [
      "WebFetch",
      "Projects",
      "SendUserFile",
      "ShareOnboardingGuide",
      "Artifact",
      "Read(~/.ssh/**)",
      "Read(~/.aws/**)",
      "Read(~/.config/gh/**)",
      "Read(~/.npmrc)",
      "Read(~/.claude/.credentials.json)",
      "Read(~/.claude.json)",
      "Read(~/.claude.json.backup*)",
      "Read(~/.claude/backups/**)",
      "Read(~/.git-credentials)",
      "Read(~/.config/git/credentials)",
      "Read(~/.netrc)",
      "Read(~/_netrc)",
      "Edit(~/.ssh/**)",
      "Edit(~/.aws/**)",
      "Edit(~/.config/gh/**)",
      "Edit(~/.npmrc)",
      "Edit(~/.claude/.credentials.json)",
      "Edit(~/.claude.json)",
      "Edit(~/.claude.json.backup*)",
      "Edit(~/.claude/backups/**)",
      "Edit(~/.git-credentials)",
      "Edit(~/.config/git/credentials)",
      "Edit(~/.netrc)",
      "Edit(~/_netrc)"
    ],
    "disableBypassPermissionsMode": "disable"
  },
  "strictKnownMarketplaces": [],
  "strictPluginOnlyCustomization": true,
  "disableSideloadFlags": true,
  "crossSessionInbound": "refuse",
  "enableArtifact": false,
  "syncClaudeAiSkills": false,
  "syncClaudeAiPlugins": false,
  "skillOverrides": { "auto-mode-setup": "off" },
  "autoMode": {
    "environment": ["$defaults"],
    "soft_deny": ["$defaults"],
    "hard_deny": ["$defaults"],
    "classifyAllShell": true
  },
  "sandbox": {
    "enabled": true,
    "failIfUnavailable": true,
    "allowUnsandboxedCommands": false,
    "enableWeakerNestedSandbox": false,
    "enableWeakerNetworkIsolation": false,
    "filesystem": {
      "allowManagedReadPathsOnly": true,
      "denyWrite": [
        "~/.ssh",
        "~/.aws/credentials",
        "~/.aws/config",
        "~/.npmrc",
        "~/.git-credentials",
        "~/.config/git/credentials",
        "~/.netrc",
        "~/_netrc",
        "~/.claude/.credentials.json",
        "~/.claude.json",
        "~/.claude.json.backup*",
        "~/.claude/backups"
      ]
    },
    "credentials": {
      "files": [
        { "path": "~/.aws/credentials", "mode": "deny" },
        { "path": "~/.ssh", "mode": "deny" },
        { "path": "~/.npmrc", "mode": "deny" },
        { "path": "~/.git-credentials", "mode": "deny" },
        { "path": "~/.config/git/credentials", "mode": "deny" },
        { "path": "~/.netrc", "mode": "deny" },
        { "path": "~/_netrc", "mode": "deny" },
        { "path": "~/.claude/.credentials.json", "mode": "deny" },
        { "path": "~/.claude.json", "mode": "deny" },
        { "path": "~/.claude.json.backup*", "mode": "deny" },
        { "path": "~/.claude/backups", "mode": "deny" }
      ],
      "envVars": [
        { "name": "AWS_ACCESS_KEY_ID", "mode": "deny" },
        { "name": "AWS_SECRET_ACCESS_KEY", "mode": "deny" },
        { "name": "AWS_SESSION_TOKEN", "mode": "deny" },
        { "name": "GITHUB_TOKEN", "mode": "deny" },
        { "name": "GH_TOKEN", "mode": "deny" },
        { "name": "GH_ENTERPRISE_TOKEN", "mode": "deny" },
        { "name": "GITHUB_ENTERPRISE_TOKEN", "mode": "deny" },
        { "name": "NPM_TOKEN", "mode": "deny" },
        { "name": "NODE_AUTH_TOKEN", "mode": "deny" },
        { "name": "YARN_NPM_AUTH_TOKEN", "mode": "deny" },
        { "name": "YARN_NPM_AUTH_IDENT", "mode": "deny" },
        { "name": "COREPACK_NPM_TOKEN", "mode": "deny" },
        { "name": "COREPACK_NPM_PASSWORD", "mode": "deny" },
        { "name": "COREPACK_NPM_USERNAME", "mode": "deny" },
        { "name": "BUN_CONFIG_TOKEN", "mode": "deny" },
        { "name": "ANTHROPIC_API_KEY", "mode": "deny" },
        { "name": "ANTHROPIC_AUTH_TOKEN", "mode": "deny" }
      ]
    },
    "network": {
      "allowManagedDomainsOnly": true,
      "allowAllUnixSockets": false,
      "allowLocalBinding": false,
      "allowedDomains": ["github.example.com", "registry.example.com"]
    }
  },
  "cleanupPeriodDays": 30,
  "env": {
    "CLAUDE_CODE_ENABLE_TELEMETRY": "1",
    "CLAUDE_CODE_DISABLE_FEEDBACK_SURVEY": "1",
    "DISABLE_ERROR_REPORTING": "1",
    "DISABLE_FEEDBACK_COMMAND": "1",
    "DISABLE_INSTALL_GITHUB_APP_COMMAND": "1",
    "HTTPS_PROXY": "http://proxy.example.internal:8080",
    "https_proxy": "http://proxy.example.internal:8080",
    "HTTP_PROXY": "http://proxy.example.internal:8080",
    "http_proxy": "http://proxy.example.internal:8080",
    "NO_PROXY": "localhost,127.0.0.1,otel-collector.example.internal",
    "no_proxy": "localhost,127.0.0.1,otel-collector.example.internal",
    "OTEL_METRICS_EXPORTER": "otlp",
    "OTEL_LOGS_EXPORTER": "otlp",
    "OTEL_EXPORTER_OTLP_PROTOCOL": "http/protobuf",
    "OTEL_EXPORTER_OTLP_ENDPOINT": "https://otel-collector.example.internal:4318",
    "OTEL_LOG_USER_PROMPTS": "0",
    "OTEL_LOG_ASSISTANT_RESPONSES": "0",
    "OTEL_LOG_TOOL_DETAILS": "0",
    "OTEL_LOG_TOOL_CONTENT": "0",
    "OTEL_LOG_RAW_API_BODIES": "0"
  }
}