Claude Code Settings Builder

Craft a secure claude code settings.json or managed-settings.json enterprise security policy.

Claude Code Settings Builder

Toggle options to craft a claude code settings policy.

Craft Your Settings



Deny Permissions

Allow Permissions

Ask Permissions

Claude Code should always Prompt or Ask the user before performing these tool calls:



Advanced Options

Your settings.json or managed-settings.json File

{
    "env": {
        "CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC": 1
    },
    "cleanupPeriodDays": 7,
    "permissions": {
        "disableBypassPermissionsMode": "disable",
        "deny": [
            "Read(**/.env)",
            "Bash(sudo:*)",
            "Bash(su:*)",
            "Bash(curl:*)",
            "Bash(wget:*)",
            "Bash(ssh:*)"
        ]
    }
}

managed-settings.json
vs
settings.json

Both files share the same format, however settings.json files can be overridden by the managed-settings.json file.

According to claude code documentation, the managed-settings.json files "cannot be overridden by user or project settings". That feature makes them especially well suited to enforce enterprise wide security policies.

Where is managed-settings.json stored?

Depending on your operating system claude code will look in three different locations for the managed-settings.json file:

  • Windows: C:\ProgramData\ClaudeCode\managed-settings.json
  • Mac: /Library/Application Support/ClaudeCode/managed-settings.json
  • Linux or WSL: /etc/claude-code/managed-settings.json
Tip: Even if you are not part of an enterprise, you can still use the managed-settings.json file as your master claude code settings policy. This is useful because it cannot be overridden by project or user level settings.

Claude Code Settings Quick Reference

cleanupPeriodDays

The cleanupPeriodDays setting tells claude code how many days to retain a local copy of session transcripts. Default is 30 days.

env

The env setting is a JSON object with environment variable name / value pairs. Here are some of the most useful environment variables:

Environment Variable Purpose
ANTHROPIC_MODEL Name of custom model to use
ANTHROPIC_SMALL_FAST_MODEL Name of Haiku-class model for background tasks
BASH_DEFAULT_TIMEOUT_MS Default timeout for long-running bash commands
BASH_MAX_TIMEOUT_MS Maximum timeout the model can set for long-running bash commands
BASH_MAX_OUTPUT_LENGTH Maximum number of characters in bash outputs before they are middle-truncated
CLAUDE_BASH_MAINTAIN_PROJECT_WORKING_DIR Return to the original working directory after each Bash command
CLAUDE_CODE_API_KEY_HELPER_TTL_MS Interval in milliseconds at which credentials should be refreshed (when using apiKeyHelper)
CLAUDE_CODE_IDE_SKIP_AUTO_INSTALL Skip auto-installation of IDE extensions
CLAUDE_CODE_MAX_OUTPUT_TOKENS Set the maximum number of output tokens for most requests
CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC Equivalent of setting DISABLE_AUTOUPDATER, DISABLE_BUG_COMMAND, DISABLE_ERROR_REPORTING, and DISABLE_TELEMETRY
CLAUDE_CODE_DISABLE_TERMINAL_TITLE Set to 1 to disable automatic terminal title updates based on conversation context
DISABLE_AUTOUPDATER Set to 1 to disable automatic updates. This takes precedence over the autoUpdates configuration setting.
DISABLE_BUG_COMMAND Set to 1 to disable the /bug command
DISABLE_COST_WARNINGS Set to 1 to disable cost warning messages
DISABLE_ERROR_REPORTING Set to 1 to opt out of Sentry error reporting
DISABLE_NON_ESSENTIAL_MODEL_CALLS Set to 1 to disable model calls for non-critical paths like flavor text. Flavor text may include generating transitional text like "Great, now lets...". Ideally this setting would reduce the total number of tokens used to accomplish the task.
DISABLE_TELEMETRY Set to 1 to opt out of Statsig telemetry (note that Statsig events do not include user data like code, file paths, or bash commands)
HTTP_PROXY Specify HTTP proxy server for network connections
HTTPS_PROXY Specify HTTPS proxy server for network connections
MAX_THINKING_TOKENS Force a thinking for the model budget
MCP_TIMEOUT Timeout in milliseconds for MCP server startup
MCP_TOOL_TIMEOUT Timeout in milliseconds for MCP tool execution
MAX_MCP_OUTPUT_TOKENS Maximum number of tokens allowed in MCP tool responses (default: 25000)
USE_BUILTIN_RIPGREP Set to 0 to use system-installed rg instead of the version included with Claude Code

See the full list of supported environment variables

permissions

The permissions JSON object is primarily used for the deny, allow, and ask arrays. These three arrays hold the name of a Tool, some tools support additional syntax Tool(pattern). See the claude code tools reference below for details.

Beyond the deny, allow, and ask permission arrays the permissions object also holds additional settings such as: additionalDirectories, defaultMode, and disableBypassPermissionsMode

permissions.additionalDirectories

The additionalDirectories array inside the permissions object can be used as an allow-list for additional directories which claude code my use as part of its context.

Be sure that you are ok with the content any of these directories being added to the session context before configuring this.

permissions.defaultMode

The defaultMode string inside the permissions object it supports four possible values:

permissions.disableBypassPermissionsMode

The disableBypassPermissionsMode string inside the permissions object when set to "disable" prevents the dangerous bypassPermissions mode (see above) from being used.


Example Tool Permissions

These tool names can go into the deny, allow, and ask permission arrays the permissions object of the settings.json or managed-settings.json file.

WebFetch

The WebFetch tool can make HTTPS requests to external servers. This tool supports specifying a domain, such as WebFetch(domain:example.com)

WebSearch

This tool performs web searches, it does not accept any arguments, so you can only add WebSearch to the ask, allow or deny arrays.

Read

The Read permission supports file path patterns using gitignore syntax. This can be useful to add to deny or ask permissions to avoid accidentally adding sensitive content to the session context.

Edit

The Edit permission supports file path patterns using gitignore syntax. See above for example patterns.

Bash

The Bash tool permission also supports patterns.

mcp__tool_name

You can add names as defined in the mcp configuration (for example the .mcp.json file). These do not support wild cards so you have to list each one.