Claude Code settings reference

​

Scopes

• User: ~/.claude/settings.json. Yours, in every project.
• Project: .claude/settings.json. Checked into the repository, so everyone who clones it gets these settings.
• Local: .claude/settings.local.json. Yours, in this project only. Claude Code keeps it out of git when it creates the file.
• Managed: settings your organization deploys; see Managed settings.

​

All settings

​

Model and responses

​

advisorModel

• Scope: Any file
• Type: string, one of the aliases "fable", "opus", or "sonnet", which resolve to Claude Code’s current default version of that model family, or a full model ID such as "claude-opus-5"
• Default: unset, so the advisor is off
• Per-session overrides: --advisor takes precedence over this key for one session. CLAUDE_CODE_DISABLE_ADVISOR_TOOL turns the advisor off, and this key can’t turn it back on

{
  "advisorModel": "opus"
}

​

alwaysThinkingEnabled

• Scope: Any file
• Type: Boolean
  • true: no effect; thinking is already on
  • false: Claude Code turns extended thinking off for every session
• Default: unset, so thinking is on for models that support it
• Per-session overrides: MAX_THINKING_TOKENS takes precedence over this key for one session: 0 turns thinking off, under the same model and provider limits as false, and a positive value turns thinking on even when this key is false. On adaptive-reasoning models the number itself is ignored

{
  "alwaysThinkingEnabled": false
}

​

availableModels

• Scope: Any file. Deploy it in managed settings to enforce it for an organization.
• Type: array of model aliases or IDs
• Default: unset, so every model is available

{
  "availableModels": ["sonnet", "haiku"]
}

​

effortLevel

• Scope: Any file
• Type: string, one of:
  • "low": the least reasoning, for short, scoped, latency-sensitive tasks that aren’t intelligence-sensitive
  • "medium": reduces token usage for cost-sensitive work that can trade off some intelligence
  • "high": balances token usage and intelligence
  • "xhigh": deeper reasoning at higher token spend
• Default: unset
• Per-session overrides: --effort takes precedence over this key for one session, and CLAUDE_CODE_EFFORT_LEVEL takes precedence over both

{
  "effortLevel": "xhigh"
}

​

enforceAvailableModels

• Scope: Any file
• Type: Boolean
  • true: when Default would resolve to a model outside availableModels, Claude Code resolves it to the first available model in the list
  • false: Default resolves as usual, even to a model outside availableModels
• Default: false

{
  "availableModels": ["sonnet", "haiku"],
  "enforceAvailableModels": true
}

​

fallbackModel

• Scope: Any file
• Type: array of model aliases or IDs; "default" expands to the default model
• Default: unset, so a failed request isn’t retried on another model
• Per-session overrides: --fallback-model takes precedence over this key for one session

{
  "fallbackModel": ["claude-sonnet-5", "claude-haiku-4-5"]
}

​

fastMode

• Scope: Any file
• Type: Boolean
  • true: Claude Code turns fast mode on for sessions where it’s available
  • false: fast mode stays off
• Default: unset, so fast mode is off
• Per-session overrides: CLAUDE_CODE_DISABLE_FAST_MODE turns fast mode off for one session, and this key can’t turn it back on

{
  "fastMode": true
}

​

fastModePerSessionOptIn

• Scope: Any file
• Type: Boolean
  • true: a saved fastMode: true no longer turns fast mode on at session start, so each person runs /fast in each session they want it; a fastMode: true passed with --settings still counts for that session unless managed settings set this key
  • false: a saved fastMode: true turns fast mode on at the start of every later session
• Default: false

{
  "fastModePerSessionOptIn": true
}

​

language

• Scope: Any file
• Type: string, any language name, such as "japanese", "spanish", or "french"; Claude Code doesn’t validate it
• Default: unset; session titles then match the language of your conversation

{
  "language": "japanese"
}

​

model

• Scope: Any file
• Type: string, a model alias or full model ID
• Default: unset, so Claude Code uses your account’s default model
• Per-session overrides: --model takes precedence over ANTHROPIC_MODEL, and both take precedence over this key for one session, including over a managed model; an availableModels list still applies to the pick

{
  "model": "claude-sonnet-5"
}

​

modelOverrides

• Scope: Any file
• Type: object mapping model ID to provider model ID
• Default: unset

{
  "modelOverrides": {
    "claude-opus-4-6": "arn:aws:bedrock:us-east-1:123456789012:inference-profile/example"
  }
}

​

outputStyle

• Scope: Any file
• Type: string, the name of a built-in or custom output style
• Default: unset, so Claude Code uses the default style

{
  "outputStyle": "Explanatory"
}

​

showThinkingSummaries

• Scope: Any file
• Type: Boolean
  • true: you see full thinking summaries when you expand thinking with Ctrl+O
  • false: the Anthropic API redacts thinking blocks and Claude Code shows a collapsed stub
• Default: false

{
  "showThinkingSummaries": true
}

​

switchModelsOnFlag

• Scope: Any file. Appears in /config as Switch models when a message is flagged.
• Type: Boolean
  • true: Claude Code switches to the fallback model and continues
  • false: in an interactive session Claude Code pauses so you can choose between switching and editing the prompt; where no dialog can show, such as a -p run, the flagged request ends as an error
• Default: true, switch automatically

{
  "switchModelsOnFlag": false
}

​

ultracode

• Scope: Any file
• Type: Boolean
  • true: sessions start at xhigh effort, with ultracode on when dynamic workflows are enabled for you and your model supports xhigh
  • false: sessions start with ultracode off
• Default: unset, so ultracode is off
• Per-session overrides: /effort ultracode turns ultracode on for one session without this key. So does --effort ultracode, which requires Claude Code v2.1.203 or later

{
  "ultracode": true
}

​

Permission settings

​

allowManagedPermissionRulesOnly

• Scope: Managed
• Type: Boolean
  • true: managed settings are the only source of allow, ask, and deny rules; Claude Code ignores rules from other files and --allowedTools, hides always-allow choices, and stops saving new rules
  • false: Claude Code applies permission rules from user, project, local, and --settings files in addition to the managed ones
• Default: unset, so Claude Code applies permission rules from user, project, and local settings and from --settings, in addition to the managed ones

{
  "allowManagedPermissionRulesOnly": true
}

​

autoMode

• Scope: User or managed
• Type: object with environment, allow, soft_deny, and hard_deny arrays of prose rules, plus the classifyAllShell Boolean
• Default: unset, so the classifier uses only its built-in rules

{
  "autoMode": {
    "soft_deny": ["$defaults", "Never run terraform apply"]
  }
}

​

autoMode.classifyAllShell

• Scope: User or managed. Read wherever autoMode is read.
• Type: Boolean
  • true: while auto mode is active, Claude Code sends every Bash and PowerShell command through the classifier and suspends your shell allow rules; outside auto mode the rules still apply
  • false: auto mode suspends only allow rules that could run arbitrary code, such as Bash(*) and Bash(python *); a command that any other allow rule matches skips the classifier, and every other shell command goes through it
• Default: false

{
  "autoMode": {
    "classifyAllShell": true
  }
}

​

disableAutoMode

• Scope: Any file. Most useful in managed settings, where users can’t override it. Also accepted under permissions as permissions.disableAutoMode.
• Type: the string "disable"
• Default: unset

{
  "disableAutoMode": "disable"
}

​

permissions

• Scope: Any file
• Type: object with allow, ask, deny, additionalDirectories, defaultMode, disableBypassPermissionsMode, and disableAutoMode
• Default: unset

{
  "permissions": {
    "allow": ["Bash(npm run *)"],
    "ask": ["Bash(git push *)"],
    "deny": ["Read(./.env)"],
    "defaultMode": "acceptEdits"
  }
}

​

useAutoModeDuringPlan

• Scope: User, local, or managed. A repository can’t turn it off for you.
• Type: Boolean
  • true: the same as unset; when auto mode is available, the classifier reviews each shell command during planning instead of prompting you for it. A false in any of these files still turns it off
  • false: you get a permission prompt for every command outside the built-in read-only set
• Default: true

{
  "useAutoModeDuringPlan": false
}

​

permissions.allow

• Scope: Any file
• Type: array of permission rule strings
• Default: unset
• Per-session overrides: --allowedTools adds allow rules for one session, and a deny rule from any settings file still blocks a tool it names

{
  "permissions": {
    "allow": ["Bash(git diff *)", "Read(~/.zshrc)"]
  }
}

​

Permission rule syntax

​

permissions.ask

• Scope: Any file
• Type: array of permission rule strings
• Default: unset

{
  "permissions": {
    "ask": ["Bash(git push *)"]
  }
}

​

permissions.deny

• Scope: Any file
• Type: array of permission rule strings
• Default: unset
• Per-session overrides: --disallowedTools adds deny rules for one session alongside this key

{
  "permissions": {
    "deny": [
      "Read(./.env)",
      "Read(./.env.*)",
      "Read(./secrets/**)",
      "Read(./config/credentials.json)",
      "Bash(curl *)"
    ]
  }
}

​

permissions.additionalDirectories

• Scope: Any file
• Type: array of directory paths
• Default: unset
• Per-session overrides: --add-dir and /add-dir add directories for one session alongside this key

{
  "permissions": {
    "additionalDirectories": ["../docs/"]
  }
}

​

permissions.defaultMode

• Scope: Any file. auto doesn’t take effect from project or local settings, so set it in ~/.claude/settings.json instead. Conversations the VS Code extension starts read only user, managed, and --settings values.
• Type: string, one of:
  • "default": Claude Code runs only reads without asking
  • "acceptEdits": Claude Code also runs file edits and common filesystem commands such as mkdir and mv without asking
  • "plan": Claude Code reads and plans but blocks edits until you approve a plan
  • "auto": Claude Code runs everything, with background safety checks
  • "dontAsk": Claude Code runs only pre-approved tools and auto-denies every call that would otherwise prompt
  • "bypassPermissions": Claude Code runs everything without asking
  • "manual": an alias for "default", in Claude Code v2.1.200 or later
• Default: unset
• Per-session overrides: --permission-mode, and its equivalent --dangerously-skip-permissions for bypassPermissions, take precedence over this key for one session

{
  "permissions": {
    "defaultMode": "acceptEdits"
  }
}

​

permissions.disableBypassPermissionsMode

• Scope: Any file. Typically set in managed settings to enforce organizational policy.
• Type: the string "disable"
• Default: unset
• Per-session overrides: this key takes precedence over --dangerously-skip-permissions, which Claude Code rejects while the key is set

{
  "permissions": {
    "disableBypassPermissionsMode": "disable"
  }
}

​

skipAutoPermissionPrompt

• Scope: User or managed. A repository can’t set it for you.
• Type: Boolean
  • true: Claude Code skips the notice
  • false: the same as unset; the notice appears once unless another of these files sets true
• Default: unset, so the notice appears once

{
  "skipAutoPermissionPrompt": true
}

​

skipDangerousModePermissionPrompt

• Scope: User, local, or managed. An untrusted repository can’t skip the dialog for you.
• Type: Boolean
  • true: Claude Code skips the confirmation dialog before a session enters bypassPermissions mode
  • false: the same as unset; the dialog appears unless another of these files sets true
• Default: unset, so the dialog appears

{
  "skipDangerousModePermissionPrompt": true
}

​

Sandbox settings

​

sandbox

• Scope: Any file
• Type: object with enabled, failIfUnavailable, autoAllowBashIfSandboxed, excludedCommands, allowUnsandboxedCommands, enableWeakerNestedSandbox, enableWeakerNetworkIsolation, allowAppleEvents, bwrapPath, socatPath, ignoreViolations, and ripgrep, plus the filesystem, network, and credentials objects
• Default: unset, so Claude Code runs commands without a sandbox

{
  "sandbox": {
    "enabled": true,
    "autoAllowBashIfSandboxed": true,
    "excludedCommands": ["docker *"],
    "filesystem": {
      "allowWrite": ["/tmp/build", "~/.kube"],
      "denyRead": ["~/.aws/credentials"]
    },
    "network": {
      "allowedDomains": ["github.com", "*.npmjs.org"]
    }
  }
}

​

sandbox.enabled

• Scope: Any file
• Type: Boolean
  • true: Claude Code sandboxes Bash commands
  • false: Bash commands run unsandboxed
• Default: false

{
  "sandbox": {
    "enabled": true
  }
}

​

sandbox.failIfUnavailable

• Scope: Any file
• Type: Boolean
  • true: Claude Code exits with an error at startup when sandbox.enabled is true but the sandbox can’t start
  • false: Claude Code shows a warning and runs commands unsandboxed
• Default: false

{
  "sandbox": {
    "enabled": true,
    "failIfUnavailable": true
  }
}

​

sandbox.autoAllowBashIfSandboxed

• Scope: Any file
• Type: Boolean
  • true: Claude Code runs sandboxed Bash commands without a permission prompt, subject to deny rules and content-scoped ask rules; CLAUDE_CODE_SUBPROCESS_ENV_SCRUB turns auto-allow off
  • false: sandboxed commands go through the regular permission flow, so your allow rules and permission mode decide. The /sandbox Mode tab calls this regular permissions mode
• Default: true

{
  "sandbox": {
    "enabled": true,
    "autoAllowBashIfSandboxed": false
  }
}

​

sandbox.excludedCommands

• Scope: Any file
• Type: array of command patterns
• Default: unset, so every command Claude Code can sandbox runs sandboxed

{
  "sandbox": {
    "excludedCommands": ["docker *"]
  }
}

​

sandbox.allowUnsandboxedCommands

• Scope: Any file
• Type: Boolean
  • true: Claude can retry a command outside the sandbox with the dangerouslyDisableSandbox parameter after the sandbox blocks it
  • false: Claude Code ignores that parameter, so every command runs sandboxed or appears in excludedCommands
• Default: true

{
  "sandbox": {
    "enabled": true,
    "allowUnsandboxedCommands": false
  }
}

​

sandbox.filesystem

• Scope: Any file
• Type: object with allowWrite, denyWrite, denyRead, and allowRead arrays, plus the allowManagedReadPathsOnly and disabled Booleans
• Default: unset, so the default read and write boundaries apply

{
  "sandbox": {
    "filesystem": {
      "allowWrite": ["/tmp/build", "~/.kube"],
      "denyRead": ["~/.aws/credentials"]
    }
  }
}

​

Sandbox path prefixes

• allowWrite and denyWrite: on macOS, wildcards work. On Linux and WSL2, the sandbox mounts concrete paths, so Claude Code skips an entry that contains *, ?, or [ once the trailing /** is removed, and that entry has no effect. Claude Code adds the paths from your Edit permission rules to these lists, so the same limit applies to them, and the Config tab of /sandbox warns about Edit and Read permission rules that contain wildcards.
• denyRead and allowRead: wildcards work on every platform. On Linux and WSL2, Claude Code expands a read entry to the concrete paths it matches, which it doesn’t do for the write lists.

​

sandbox.filesystem.allowWrite

• Scope: Any file
• Type: array of path strings, using the sandbox path prefixes
• Default: unset, so sandboxed commands can write only to the working directory and the session temp directory

{
  "sandbox": {
    "filesystem": {
      "allowWrite": ["/tmp/build", "~/.kube"]
    }
  }
}

​

sandbox.filesystem.denyWrite

• Scope: Any file
• Type: array of path strings, using the sandbox path prefixes
• Default: unset

{
  "sandbox": {
    "filesystem": {
      "denyWrite": ["/etc", "/usr/local/bin"]
    }
  }
}

​

sandbox.filesystem.denyRead

• Scope: Any file
• Type: array of path strings, using the sandbox path prefixes
• Default: unset, so sandboxed commands keep the default read access, which includes credential files such as ~/.aws/credentials

{
  "sandbox": {
    "filesystem": {
      "denyRead": ["~/.aws/credentials"]
    }
  }
}

​

sandbox.filesystem.allowRead

• Scope: Any file
• Type: array of path strings, using the sandbox path prefixes
• Default: unset

{
  "sandbox": {
    "filesystem": {
      "denyRead": ["~/"],
      "allowRead": ["."]
    }
  }
}

​

sandbox.filesystem.allowManagedReadPathsOnly

• Scope: Managed
• Type: Boolean
  • true: Claude Code honors only the allowRead entries from managed settings
  • false: allowRead entries merge from every settings file
• Default: false

{
  "sandbox": {
    "filesystem": {
      "denyRead": ["~/"],
      "allowRead": ["~/work"],
      "allowManagedReadPathsOnly": true
    }
  }
}

​

sandbox.filesystem.disabled

• Scope: User or managed. When managed settings configure sandbox.filesystem at all, or list a sandbox.credentials.files entry with "mode": "deny", only managed settings can set it.
• Type: Boolean
  • true: Claude Code skips filesystem isolation and keeps network isolation
  • false: filesystem isolation stays on
• Default: false, so filesystem isolation stays on

{
  "sandbox": {
    "enabled": true,
    "filesystem": {
      "disabled": true
    },
    "network": {
      "allowedDomains": ["github.com", "*.npmjs.org"]
    }
  }
}

​

sandbox.ignoreViolations

• Scope: Any file
• Type: object mapping a command substring to an array of violation substrings, usually paths
• Default: unset, so every violation is reported

{
  "sandbox": {
    "ignoreViolations": {
      "*": ["/etc/hosts"]
    }
  }
}

​

sandbox.enableWeakerNestedSandbox

• Scope: Any file
• Type: Boolean
  • true: the inner sandbox bind-mounts the container’s existing /proc instead of mounting a fresh one
  • false: the sandbox mounts a fresh /proc, which doesn’t work in an unprivileged Docker container
• Default: false

{
  "sandbox": {
    "enabled": true,
    "enableWeakerNestedSandbox": true
  }
}

​

sandbox.enableWeakerNetworkIsolation

• Scope: Any file
• Type: Boolean
  • true: sandboxed commands on macOS can reach com.apple.trustd.agent
  • false: sandboxed commands on macOS can’t reach the system TLS trust service
• Default: false

{
  "sandbox": {
    "enabled": true,
    "enableWeakerNetworkIsolation": true
  }
}

​

sandbox.allowAppleEvents

• Scope: User or managed
• Type: Boolean
  • true: sandboxed commands on macOS can send Apple Events
  • false: sandboxed commands on macOS can’t send Apple Events, so open and osascript fail with error -600
• Default: false

{
  "sandbox": {
    "enabled": true,
    "allowAppleEvents": true
  }
}

​

sandbox.ripgrep

• Scope: User or managed
• Type: object with command, the path to the ripgrep binary, and optional args, an array of arguments to prepend
• Default: unset, so the sandbox uses the same ripgrep binary as Claude Code. That is the bundled binary unless you set USE_BUILTIN_RIPGREP to 0

{
  "sandbox": {
    "ripgrep": {
      "command": "/usr/local/bin/rg"
    }
  }
}

​

sandbox.bwrapPath

• Scope: Managed. Claude Code reads it only from managed settings so that a user, project, or local file can’t point the sandbox at a different binary.
• Type: string, an absolute path; Claude Code drops a relative path and falls back to PATH lookup
• Default: unset, so Claude Code finds bwrap on PATH

{
  "sandbox": {
    "enabled": true,
    "bwrapPath": "/opt/admin/bwrap"
  }
}

​

sandbox.socatPath

• Scope: Managed
• Type: string, an absolute path; Claude Code drops a relative path and falls back to PATH lookup
• Default: unset, so Claude Code finds socat on PATH

{
  "sandbox": {
    "enabled": true,
    "socatPath": "/opt/admin/socat"
  }
}

​

sandbox.credentials

• Scope: Any file. deny entries merge from every scope, and Claude Code honors mask entries, allowPlaintextInject, awsPairs, and sigv4 only from user settings, managed settings, and the --settings flag.
• Type: object with files, envVars, allowPlaintextInject, awsPairs, and sigv4
• Default: unset, so no credentials are protected

{
  "sandbox": {
    "credentials": {
      "files": [{ "path": "~/.aws/credentials", "mode": "deny" }],
      "envVars": [{ "name": "GITHUB_TOKEN", "mode": "deny" }]
    }
  }
}

​

Invalid credential entries in managed settings

• An entry in files or envVars that still has a valid path or name and a mode of mask or deny, such as one whose extract pattern has no capturing group, is degraded to mode: "deny" with a warning, so the credential stays blocked, not masked, until you fix the entry. A degraded files entry pins filesystem.disabled like an explicit deny entry, and the warning notes that its read block isn’t enforced if managed settings turn filesystem isolation off.
• An entry with an unknown mode or an invalid path or name is stripped.
• Each case warns; whether an entry is degraded or stripped, the remaining valid entries are still enforced, and a wholly invalid credentials value is dropped while the rest of sandbox still applies.

​

sandbox.credentials.files

• Scope: Any file. Claude Code drops mask entries from project .claude/settings.json and local .claude/settings.local.json.
• Type: array of objects, each with path and a mode of "deny" or "mask", plus the optional mask fields for files
• Default: unset, so no credential files are protected

{
  "sandbox": {
    "credentials": {
      "files": [
        { "path": "~/.aws/credentials", "mode": "deny" },
        { "path": "~/.config/gh/hosts.yml", "mode": "mask", "injectHosts": ["api.github.com"] }
      ]
    }
  }
}

​

Mask fields for files

{
  "sandbox": {
    "credentials": {
      "files": [
        {
          "path": "~/.config/gh/hosts.yml",
          "mode": "mask",
          "extract": "oauth_token:\\s*(\\S+)",
          "maskDuplicates": true,
          "onExtractNoMatch": "deny",
          "injectHosts": ["api.github.com"]
        }
      ]
    }
  }
}

​

sandbox.credentials.envVars

• Scope: Any file. Claude Code drops mask entries from project .claude/settings.json and local .claude/settings.local.json.
• Type: array of objects, each with name and a mode of "deny" or "mask", plus the optional mask fields for environment variables
• Default: unset, so no environment variables are protected

{
  "sandbox": {
    "credentials": {
      "envVars": [
        { "name": "NPM_TOKEN", "mode": "deny" },
        { "name": "GITHUB_TOKEN", "mode": "mask", "injectHosts": ["api.github.com"] }
      ]
    }
  }
}

​

Mask fields for environment variables

{
  "sandbox": {
    "credentials": {
      "envVars": [
        {
          "name": "DATABASE_URL",
          "mode": "mask",
          "extract": "://[^:]+:([^@]+)@",
          "onExtractNoMatch": "deny"
        },
        {
          "name": "SERVICE_JWT",
          "mode": "mask",
          "decode": "jwt",
          "maskClaims": ["api_key"]
        }
      ]
    }
  }
}

​

sandbox.credentials.allowPlaintextInject

• Scope: User or managed
• Type: Boolean
  • true: Claude Code allows mask substitution on plain HTTP requests as well as TLS-terminated HTTPS
  • false: Claude Code allows mask substitution only on TLS-terminated HTTPS
• Default: false

{
  "sandbox": {
    "credentials": {
      "allowPlaintextInject": true
    }
  }
}

​

sandbox.credentials.awsPairs

• Scope: User or managed
• Type: array of objects, each with accessKeyIdVar, secretAccessKeyVar, and optionally sessionTokenVar, naming sandbox.credentials.envVars entries
• Default: unset, so only the conventional trio is paired

{
  "sandbox": {
    "credentials": {
      "awsPairs": [
        {
          "accessKeyIdVar": "MY_KEY_ID",
          "secretAccessKeyVar": "MY_SECRET_KEY",
          "sessionTokenVar": "MY_SESSION_TOKEN"
        }
      ]
    }
  }
}

​

sandbox.credentials.sigv4

• Scope: User or managed
• Type: object with streaming, presigned, and sigv4a, each one of:
  • "deny": the proxy fails the request
  • "passthrough": the proxy forwards the request signed with the masked placeholder, so the tool receives AWS’s own rejection
• Default: unset, so every form is "deny"

{
  "sandbox": {
    "credentials": {
      "sigv4": {
        "streaming": "passthrough"
      }
    }
  }
}

​

sandbox.network

• Scope: Any file. strictAllowlist, allowManagedDomainsOnly, and tlsTerminate are read from fewer sources, as their entries say.
• Type: object with the sub-keys below
• Default: unset, so no domains are pre-allowed and the sandbox prompts for each new host

{
  "sandbox": {
    "network": {
      "allowedDomains": ["github.com", "*.npmjs.org"],
      "deniedDomains": ["uploads.github.com"],
      "allowLocalBinding": true
    }
  }
}

​

sandbox.network.allowUnixSockets

• Scope: Any file
• Type: array of strings, each a socket path
• Default: unset, so the macOS sandbox blocks every Unix socket

{
  "sandbox": {
    "network": {
      "allowUnixSockets": ["~/.ssh/agent-socket"]
    }
  }
}

​

sandbox.network.allowAllUnixSockets

• Scope: Any file
• Type: Boolean
  • true: sandboxed commands can connect to every Unix socket
  • false: the sandbox blocks Unix-socket connections: on macOS except the paths in allowUnixSockets, and on Linux and WSL2 through the seccomp filter when it’s present
• Default: false

{
  "sandbox": {
    "network": {
      "allowAllUnixSockets": true
    }
  }
}

​

sandbox.network.allowLocalBinding

• Scope: Any file
• Type: Boolean
  • true: sandboxed commands can bind to localhost ports on macOS
  • false: sandboxed commands on macOS can’t bind to localhost ports
• Default: false

{
  "sandbox": {
    "network": {
      "allowLocalBinding": true
    }
  }
}

​

sandbox.network.allowMachLookup

• Scope: Any file
• Type: array of strings, each a service name; a single trailing * matches a prefix, and "*" alone matches every service
• Default: unset

{
  "sandbox": {
    "network": {
      "allowMachLookup": ["com.apple.coresimulator.*"]
    }
  }
}

​

sandbox.network.allowedDomains

• Scope: Any file. Only managed settings when allowManagedDomainsOnly is set.
• Type: array of strings, each a domain, wildcard pattern, or IP literal, with an optional :port suffix
• Default: unset, so the sandbox prompts the first time a command reaches a new host

{
  "sandbox": {
    "network": {
      "allowedDomains": ["github.com", "*.npmjs.org", "api.example.com:443"]
    }
  }
}

​

sandbox.network.deniedDomains

• Scope: Any file
• Type: array of strings, each a domain, wildcard pattern, or IP literal, with an optional :port suffix
• Default: unset

{
  "sandbox": {
    "network": {
      "deniedDomains": ["sensitive.cloud.example.com"]
    }
  }
}

​

sandbox.network.strictAllowlist

• Scope: User or managed. A repository can’t turn it on or off.
• Type: Boolean
  • true: Claude Code denies sandboxed commands access to hosts outside the allowlist
  • false: unless another trusted settings file sets true, Claude Code decides a host outside the allowlist by permission mode instead of denying it outright: it runs the classifier in auto mode, denies in dontAsk mode, allows in bypassPermissions mode and in plan mode when bypass is available, and otherwise asks you
• Default: false

{
  "sandbox": {
    "network": {
      "strictAllowlist": true
    }
  }
}

​

sandbox.network.allowManagedDomainsOnly

• Scope: Managed
• Type: Boolean
  • true: Claude Code honors only allowedDomains and WebFetch(domain:...) allow rules from managed settings and blocks a non-allowed domain instead of prompting
  • false: domains from user, project, local, and --settings settings merge into the allowlist
• Default: false

{
  "sandbox": {
    "network": {
      "allowManagedDomainsOnly": true,
      "allowedDomains": ["github.com", "*.npmjs.org"]
    }
  }
}

​

sandbox.network.httpProxyPort

• Scope: Any file
• Type: number, a local TCP port
• Default: unset, so Claude Code runs its own proxy

{
  "sandbox": {
    "network": {
      "httpProxyPort": 8080
    }
  }
}

​

sandbox.network.socksProxyPort

• Scope: Any file
• Type: number, a local TCP port
• Default: unset, so Claude Code runs its own proxy

{
  "sandbox": {
    "network": {
      "socksProxyPort": 8081
    }
  }
}

​

sandbox.network.tlsTerminate

• Scope: User or managed. A repository can’t switch it on or supply a certificate authority.
• Type: object with optional caCertPath and caKeyPath strings, each a file path
• Default: unset, so the proxy doesn’t terminate or inspect TLS

{
  "sandbox": {
    "network": {
      "tlsTerminate": {}
    }
  }
}

​

Memory and context

​

autoCompactEnabled

• Scope: Any file
• Type: Boolean
  • true: Claude Code compacts the conversation automatically when context approaches the limit
  • false: Claude Code doesn’t compact automatically
• Default: true
• Per-session overrides: DISABLE_AUTO_COMPACT turns auto-compact off for one session; whichever of the two turns it off, the other can’t turn it back on

{
  "autoCompactEnabled": false
}

​

autoCompactWindow

• Scope: Any file
• Type: number of tokens, from 100000 to 1000000. Claude Code caps the value at your model’s context window; the models overview lists each model’s window
• Default: unset, so Claude Code picks a window tuned for your model
• Per-session overrides: --autocompact takes precedence over this key for one session, and CLAUDE_CODE_AUTO_COMPACT_WINDOW takes precedence over both

{
  "autoCompactWindow": 500000
}

​

autoMemoryDirectory

• Scope: Any file
• Type: string, an absolute or ~/-prefixed directory path
• Default: unset, so Claude Code uses ~/.claude/projects/<project>/memory/

{
  "autoMemoryDirectory": "~/my-memory-dir"
}

​

autoMemoryEnabled

• Scope: Any file
• Type: Boolean
  • true: the same as unset; auto memory stays on unless something that outranks this key turns it off for the session, such as --bare, safe mode, or CLAUDE_CODE_DISABLE_AUTO_MEMORY
  • false: Claude doesn’t read from or write to the auto memory directory
• Default: true
• Per-session overrides: CLAUDE_CODE_DISABLE_AUTO_MEMORY takes precedence over this key for one session, in either direction

{
  "autoMemoryEnabled": false
}