Config Studio for Claude Code

Where it lives

Listed in order of precedence: the top one wins when two disagree.

1. 1

   /etc/claude-code/managed-settings.jsonwins

   enterpriseset by an administrator; you cannot override it

2. 2

   .claude/settings.local.json

   localyours, in this project, not committed

3. 3

   .claude/settings.json

   projectcommitted, so the whole team gets it

4. 4

   ~/.claude/settings.json

   useryours, on this machine, across every project

7 keys

permissions.denyarray

Rules that refuse a call outright. Checked first, and nothing overrides them.

permissions.askarray

Rules that force it to stop and ask, even when something else would have allowed the call.

permissions.allowarray

Rules that pre-approve a call so it stops asking about it.

permissions.defaultModeenum

What happens to a call no rule mentions.

• default Ask about anything that changes something.
• acceptEdits Edits go through without asking; commands still ask.
• plan It may read and think, but not act.
• auto No routine prompts: a classifier checks commands and network calls against what you asked for. Set it in ~/.claude/settings.json; project files cannot.
• dontAsk Anything that would ask is refused instead; reads and pre-approved calls still run.
• bypassPermissions Nothing asks. For a sandbox with no network, and nowhere else.

permissions.additionalDirectoriesarray

Directories outside the project it may also read and write.

permissions.blockReadsOutsideWorkingDirectoriesbooleandocumented

File tools refuse reads outside the working directories in every mode.

permissions.disableBypassPermissionsModestringdocumented

Set to "disable" so nobody can enter bypassPermissions mode.

Where it lives

Listed in order of precedence: the top one wins when two disagree.

1. 1

   /etc/claude-code/managed-settings.jsonwins

   enterpriseset by an administrator; you cannot override it

2. 2

   .claude/settings.local.json

   localyours, in this project, not committed

3. 3

   .claude/settings.json

   projectcommitted, so the whole team gets it

4. 4

   ~/.claude/settings.json

   useryours, on this machine, across every project

Where it lives

The documentation does not say which of these wins when two of them disagree, so this page does not guess.

1. ~/.claude/settings.json

   useryours, on this machine, across every project

2. .claude/settings.json

   projectcommitted, so the whole team gets it

5 keys

hooks.PreToolUsearray

Runs before a tool call. A non-zero exit stops the call.

hooks.PostToolUsearray

Runs after a tool call succeeded. Where a formatter belongs.

hooks.SessionStartarray

Runs when a session opens.

hooks.Stoparray

Runs when it finishes a turn.

hooks.UserPromptSubmitarray

Runs on every prompt you send, and can rewrite or refuse it.

Where it lives

The documentation does not say which of these wins when two of them disagree, so this page does not guess.

1. ~/.claude.json

   useryours, on this machine, across every project

2. .mcp.json

   projectcommitted, so the whole team gets it

3. ~/.claude.json

   localWhat claude mcp add writes by default: under this project's entry in projects, so only you get it, and only here.

6 keys

mcpServers.<name>.commandstring

The executable that starts the server.

mcpServers.<name>.argsarray

Arguments passed to it.

mcpServers.<name>.typeenumdocumented

How it is reached: stdio (a process it starts, the default when type is missing), http for a remote server, or the older sse. An entry with a url and no type is read as stdio and fails.

mcpServers.<name>.urlstringdocumented

The address of a remote server.

mcpServers.<name>.headersobjectdocumented

Headers sent to a remote server, which is where a token goes. ${VAR} pulls it from the environment.

mcpServers.<name>.envobject

Environment for the server process, which is where a token goes.

Where it lives

Listed in order of precedence: the top one wins when two disagree.

1. 1

   /etc/claude-code/managed-settings.jsonwins

   enterpriseset by an administrator; you cannot override it

2. 2

   /etc/claude-code/managed-mcp.json

   enterpriseset by an administrator; you cannot override it

2 keys

allowedMcpServersarray

The servers that may load. Undefined means every server may; an empty array means none may, which is the kill switch and reads like an unfilled list.

deniedMcpServersarray

The servers that may not, which wins over the allow list and merges from every scope, so a person can always deny more for themselves.

Where it lives

Listed in order of precedence: the top one wins when two disagree.

1. 1

   /etc/claude-code/managed-settings.jsonwins

   enterpriseEvery .json file in managed-settings.d/ beside it is merged in too, so teams that own parts of one policy each keep their own file.

2. 2

   /Library/Application Support/ClaudeCode/managed-settings.json

   enterpriseEvery .json file in managed-settings.d/ beside it is merged in too, so teams that own parts of one policy each keep their own file.

3. 3

   C:\Program Files\ClaudeCode\managed-settings.json

   enterpriseEvery .json file in managed-settings.d/ beside it is merged in too, so teams that own parts of one policy each keep their own file.

Where it lives

1. ~/.claude/plugins/

   useryours, on this machine, across every project

4 keys

claude plugin marketplace add <source>string

Add a marketplace from a URL, a path, or a GitHub repository. Nothing can be installed until one is added.

claude plugin install <plugin>string

Install from an added marketplace. `plugin@marketplace` picks a specific one when two offer the same name.

claude plugin details <name>string

A plugin’s component inventory and its projected token cost, which is the number nobody thinks to ask for.

claude plugin enable | disable [plugin]string

Turn one on or off without uninstalling it.

Where it lives

1. ~/.claude/keybindings.json

   useryours, on this machine, across every project

Where it lives

1. ~/.claude/settings.json

   useryours, on this machine, across every project

1 key

--add-dir <directories...>stringfrom the binary

Additional directories to allow tool access to.

Where it lives

1. ~/.claude/jobs/

   useryours, on this machine, across every project

Where it lives

The documentation does not say which of these wins when two of them disagree, so this page does not guess.

1. ~/.claude/projects/

   useryours, on this machine, across every project

2. ~/.claude/history.jsonl

   useryours, on this machine, across every project

Where it lives

The documentation does not say which of these wins when two of them disagree, so this page does not guess.

1. ~/.claude/CLAUDE.md

   userApplies to every project on this machine.

2. ./CLAUDE.md

   projectCommitted, so the whole team gets it.

3. ./CLAUDE.local.md

   localYours, and not committed.

4. ./.claude/rules/

   projectOne topic per .md file, found in subfolders too. A paths list in a file's frontmatter loads it only for matching files. ~/.claude/rules/ is the same for you, everywhere.

5. ./AGENTS.md

   projectRead instead of CLAUDE.md when there is no CLAUDE.md or CLAUDE.local.md here or above (2.1.277 and later). Project instructions in /config can read both, or only CLAUDE.md.

1 key

@importstring

Pulls another file in at this point, so one instruction file can be assembled from several.

Where it lives

The documentation does not say which of these wins when two of them disagree, so this page does not guess.

1. ~/.claude/agents/

   useryours, on this machine, across every project

2. .claude/agents/

   projectcommitted, so the whole team gets it

22 keys

namestring

How the agent is identified. The filename does not have to match.

descriptionstring

This is the only thing Claude reads when deciding whether to delegate. Name the trigger, not the implementation.

toolsarray

Leave empty to inherit everything a subagent can normally use.

disallowedToolsarray

Removed from whatever it would otherwise have.

modelenum

Defaults to inherit, which uses whatever the session is on.

effortenum

How much thinking this agent does per turn. Higher costs more and is worth it for design work, not for search.

permissionModeenum

The mode this agent runs under, whatever the session is in. plan is the useful one: it can read and reason but changes nothing.

maxTurnsnumber

A ceiling, not a target. It stops an agent that has misunderstood from working at it all afternoon.

autoCompactWindownumber

Lets this subagent auto-compact earlier than the main conversation's window. Needs Claude Code 2.1.296 or later.

skillsarray

The whole skill content is put into its context at startup.

memoryenum

Which memory scope this agent may write notes into. Empty means it remembers nothing between runs.

backgroundboolean

Starts it detached, so you keep working while it does. Its output arrives when it finishes.

isolationenum

Gives it an isolated copy of the repository. Cleaned up if it changes nothing.

colorenum

Cosmetic. Helps tell several running agents apart at a glance.

mcpServersobject

Started for this agent only, and gone when it finishes. Use it to give one agent a server the rest of your session has no reason to hold open.

hooksobject

The same shape as the hooks block in settings.json, registered only while this agent is running. A formatter that should follow the agent that writes code, rather than every edit you make yourself.

initialPromptstring

Submitted automatically when this agent is the main session, through --agent or the agent setting. Ignored when it is spawned as a subagent, so it is for an agent you start rather than one Claude delegates to.

observerstring

Names another agent, spawned in the background to watch this one work and told what it is doing as it goes.

observerMessagestring

Added after the standard digest that goes to the observer, so it knows what you want it watching for.

observeSubagentsboolean

On by default: agents this one spawns inherit the observer. Off keeps the watching to this agent alone.

omitClaudeMdboolean

As a subagent, it skips the user, project and local CLAUDE.md files and keeps managed ones. For an agent that takes everything it needs from the prompt it is given. No effect on the main session agent.

experimentalobject

A map of options that may still change. Its cacheTtl key, 5m or 1h, sets how long the prompt cache lives for this agent's requests. It goes inside this map, not at the top of the frontmatter.

Where it lives

The documentation does not say which of these wins when two of them disagree, so this page does not guess.

1. ~/.claude/skills/

   useryours, on this machine, across every project

2. .claude/skills/

   projectcommitted, so the whole team gets it

20 keys

namestring

Also the folder name, and what you type after the slash.

descriptionstring

Claude decides whether to load the skill from this alone. Put the trigger first.

when_to_usestring

Phrases or example requests. Added to the description, and counts toward the same 1,536 character budget.

argument-hintstring

Shown while you are typing the command.

argumentsarray

Maps names onto positions, so you can write $name instead of $0.

disable-model-invocationboolean

Stops Claude loading it on its own. Use for anything with a side effect.

user-invocableboolean

Off makes it something only Claude reaches for, never something you type.

allowed-toolsarray

Used without asking, for the one turn that runs the skill.

disallowed-toolsarray

Subtracted from whatever it would otherwise have. Use this rather than listing every tool you do want.

modelenum

Overrides the session model while this runs. Leave empty to inherit.

effortenum

How much thinking to spend while this runs. Leave empty to inherit.

pathsarray

Glob patterns. The skill stays out of the way until Claude touches a file that matches, which is how a skill about one corner of a codebase stops costing you context everywhere else.

contextenum

fork runs the skill in a subagent so it does not fill your conversation. inline is the default and says so out loud.

agentstring

Only used when the above is set to fork.

backgroundboolean

Only for fork. On, it reports back when it finishes and you keep working; off, you wait for it.

shellenum

Which shell runs the !`command` blocks in the body. Empty means bash, on every platform.

hooksobject

The same shape as the hooks block in settings.json, registered only while this skill is loaded. A check that belongs to one piece of work rather than to every session.

metadataobject

A free-form map for your own tooling, such as catalog or ownership fields. Claude Code does not act on it.

licensestring

The licence that covers the skill, from the Agent Skills spec. Claude Code does not act on it.

compatibilitystring

What the skill needs to run, such as the products it is meant for or tools on the machine, from the Agent Skills spec.

Where it lives

The documentation does not say which of these wins when two of them disagree, so this page does not guess.

1. ~/.claude/commands/

   useryours, on this machine, across every project

2. .claude/commands/

   projectcommitted, so the whole team gets it

11 keys

namestring

What you type after the slash.

namespacestring

Optional. Puts the file in a subfolder, so it is invoked as /folder:name.

descriptionstring

Shown in the slash menu.

argument-hintstring

Argument hint

allowed-toolsarray

Needed if the body runs a shell command with backticks.

modelenum

Overrides the session model while this runs. Leave empty to inherit.

disable-model-invocationboolean

Stops Claude running it on its own. Use for anything with a side effect.

disallowed-toolsarray

Removed while this command is active, and restored on your next message.

user-invocableboolean

Off makes it something only Claude reaches for, never something you type.

effortenum

How much thinking to spend on the turn this command starts. Leave empty to inherit.

shellenum

Which shell runs the !`command` blocks in the body. Empty means bash, on every platform.

Where it lives

The documentation does not say which of these wins when two of them disagree, so this page does not guess.

1. ~/.claude/output-styles/

   useryours, on this machine, across every project

2. .claude/output-styles/

   projectcommitted, so the whole team gets it

4 keys

namestring

Shown in the /config picker.

descriptionstring

What it does

keep-coding-instructionsboolean

On when you are still coding and only changing the voice. Off when Claude is doing something else entirely.

force-for-pluginboolean

For a style that ships in a plugin only: applied whenever the plugin is enabled, without anyone picking it, and over their outputStyle setting.

Where it lives

1. ~/.claude/settings.json

   useryours, on this machine, across every project

2 keys

statusLine.typeenum

How the line is produced.

• command Run a script and use what it prints.

statusLine.commandstring

The script to run. It is handed session JSON on stdin.

Where it lives

1. claude -p

   sessionthis run only

4 keys

-p, --printstringfrom the binary

Print response and exit (useful for pipes). Note: The workspace trust dialog is skipped when Claude is run in non-interactive mode (via -p, or when stdout is not a TTY, e.g. piped or redirected output). Only use this in directories you trust. Settings files that fail validation are silently ignored in this mode (no error dialog is shown).

--barestringfrom the binary

Minimal mode: skip hooks (those defined in settings and by installed plugins; features built into Claude Code are unaffected), LSP, plugin sync, attribution, auto-memory, background prefetches, keychain reads, and CLAUDE.md auto-discovery. Sets CLAUDE_CODE_SIMPLE=1. Anthropic auth is strictly ANTHROPIC_API_KEY or apiKeyHelper via --settings (OAuth and keychain are never read). 3P providers (Bedrock/Vertex/Foundry) use their own credentials. Skills still resolve via /skill-name. Explicitly provide context via: --system-prompt[-file], --append-system-prompt[-file], --add-dir (CLAUDE.md dirs), --mcp-config, --settings, --agents, --plugin-dir.

--allowedTools, --allowed-tools <tools...>stringfrom the binary

Comma or space-separated list of tool names to allow (e.g. "Bash(git *) Edit").

--append-system-prompt <prompt>stringfrom the binary

Append a system prompt to the default system prompt.

Where it lives

The documentation does not say which of these wins when two of them disagree, so this page does not guess.

1. ~/.claude/settings.json

   useryours, on this machine, across every project

2. environment

   sessionthis run only

Where it lives

1. ./<your server>/

   projectcommitted, so the whole team gets it

2 keys

tools[].descriptionstring

The only thing the model reads when deciding whether to call your tool, so a tool without one never fires.

tools[].paramsarray

The arguments it takes, as the JSON Schema subset a tool parameter actually needs.