Claude Code: Enforce Governed MCP and Plugin Usage

JFrog Agent Guard lets you govern which Model Context Protocol (MCP) servers a developer's coding assistant can use, and which plugins it can install. With Claude Code managed settings, you enforce that governance organization-wide. Claude Code runs only the MCP servers you approve in JFrog AI Catalog, routed through the @jfrog/agent-guard proxy, and only the plugins you approve from JFrog marketplaces.

Managed settings alone don't close every path around the policy. To enforce MCP usage across your organization, you also need to stop developers writing the managed-mcp.json file on their own machines.

JFrog AI Catalog generates the managed settings JSON for you. You copy it from the Claude Code card on the Coding Assistants page in AI/ML Settings, and apply it in the Claude.ai admin console, where it takes effect for every developer in your organization. For setup steps before enforcement, see Get Started with the JFrog MCP Registry and Use the MCP Registry with Agent Guard.

In this topic:

• Prerequisites
• Enforce managed settings in Claude Code
• Restrict write access to the managed-mcp.json file
• Verify enforcement
• Frequently Asked Questions

Prerequisites

• JFrog AI Catalog entitlement and MCP Registry enabled.
• JFrog Platform administrator access.
• Administrator permissions in the Claude.ai admin console.
• At least one MCP server allowed in your AI Catalog project.
• Claude Code versions 2.1.143 and later (support allowManagedMcpServersOnly) on every user machine.
• Developers must not have privileged administrator access on their machines.

Enforce Managed Settings in Claude Code

To enforce MCP and plugin usage in Claude Code with managed settings:

1. Navigate to JFrog's AI/ML settings: Select Administration > AI/ML Settings > Coding Assistants.

2. Set Enable MCP registry to active.

3. Click Discover MCP servers and allow each MCP server your organization approves. Only servers allowed to developers are available.

4. Return to the Coding Assistants (AI/ML Settings) page, select the Claude Code card, and copy the generated managed settings JSON. The JSON looks like the following:

   JSON

   {
     "allowManagedMcpServersOnly": true,
     "allowedMcpServers": [
       { "serverUrl": "https://<JPD HOSTNAME HERE>/mcp" },
       {
         "serverCommand": [
           "npx", "--yes", "--registry",
           "https://releases.jfrog.io/artifactory/api/npm/coding-agents-npm/",
           "@jfrog/agent-guard",
           "--server", "<SERVER NAME HERE>"
         ]
       },
       {
         "serverCommand": [
           "npx", "--yes", "--registry",
           "https://releases.jfrog.io/artifactory/api/npm/coding-agents-npm/",
           "@jfrog/agent-guard",
           "--server", "<SERVER NAME HERE>",
           "--source", "plugin"
         ]
       }
     ],
     "strictKnownMarketplaces": [
       { "source": "hostPattern", "hostPattern": "^<JPD HOSTNAME REGEX HERE>$" },
       {
         "source": "settings",
         "name": "jfrog-plugin",
         "plugins": [
           {
             "name": "jfrog",
             "source": { "source": "github", "repo": "jfrog/claude-plugin" }
           }
         ]
       }
     ],
     "extraKnownMarketplaces": {
       "jfrog-plugin": {
         "source": {
           "source": "settings",
           "name": "jfrog-plugin",
           "plugins": [
             {
               "name": "jfrog",
               "source": { "source": "github", "repo": "jfrog/claude-plugin" }
             }
           ]
         }
       }
     },
     "enabledPlugins": { "jfrog@jfrog-plugin": true },
     "disableSideloadFlags": true
   }

   Where:

   • allowManagedMcpServersOnly — Locks the allowlist to managed settings. Claude Code ignores allowedMcpServers entries in user, project, and local settings, so a developer can't widen your allowlist from ~/.claude/settings.json. Denylists still merge from every scope, so a developer can still block a server for themselves.
   • allowedMcpServers — Restricts Claude Code to the listed servers. The match is exact, by URL or by command argument, so any other MCP server a developer adds is blocked.
   • serverUrl — Allows the JFrog MCP at https://<JPD_HOSTNAME>/mcp. Same host as <JPD HOSTNAME HERE> in the sample.
   • --server — Pins Agent Guard to your JFrog Platform server name. To allow Agent Guard to be unpinned, drop --server and the server name from both serverCommand entries. Keep both entries (with and without --source plugin). Pinning is recommended.
   • --source plugin — Allows the Agent Guard command that a JFrog plugin starts. Without this entry, plugin-provided MCP servers may not be started.
   • --registry — The npm source for the @jfrog/agent-guard package. The default is the JFrog public source. For a restricted network, replace this value with your internal npm remote repository, https://<JFROG_URL>/artifactory/api/npm/<REPO_NAME>.
   • strictKnownMarketplaces — Restricts Claude Code to the listed marketplace sources. Developers can't register additional marketplace sources.
   • hostPattern — Copy this value from the Claude Code card. Don’t edit the regex.
   • extraKnownMarketplaces — Registers the JFrog plugin marketplace for every user. Required so that the JFrog plugin under enabledPlugins is trusted.
   • enabledPlugins — Approves and enables the JFrog plugin jfrog@jfrog-plugin for every developer.
   • disableSideloadFlags — Blocks the --plugin-dir, --plugin-url, --agents, and --mcp-config sideload flags. Users could otherwise bypass strictKnownMarketplaces.

   For more information about the JFrog plugin marketplaces this configuration locks down, see Get Started with the Plugins Registry.

   ❗️

   Important

   Existing deployments aren't updated automatically. If you saved these managed settings before the generated JSON included allowManagedMcpServersOnly, your organization still merges allowlists from developer settings. Copy the JSON from the Claude Code card again and save it.

5. If you have more than one JFrog Platform environment, repeat the following for each extra environment: another serverUrl, another Agent Guard serverCommand with --server and the platform name, the matching --source plugin command, and the matching hostPattern.

   ❗️

   Important

   Enable the MCP Registry for each JFrog Platform environment you add.

6. In the Claude.ai admin console, navigate to Settings > Organization > Claude Code > Managed Settings.

7. Merge the JSON into your existing managed settings. If your organization already uses managed settings, add these keys to the existing document instead of replacing it, and reconcile any key that's already set.

8. Review the merged settings, then click Save.

After you save the managed settings, Claude Code applies them to every developer in your organization, and developers can't broaden the allowlist in their own settings. To complete enforcement, restrict write access to the managed-mcp.json file.

Restrict Write Access to the managed-mcp.json File

managed-mcp.json is a Claude Code file that deploys a fixed set of MCP servers to a machine. From Claude Code version 2.1.259, the servers defined in this file skip the allowedMcpServers allowlist, so a server listed there runs even though your managed settings allow only JFrog Agent Guard. The allowlist now governs only the servers a developer, a plugin, or claude.ai adds.

The file isn't part of Claude.ai managed settings, so you can't govern it from the admin console. Any process with administrator privileges on the machine can deploy it, which makes file permissions the control.

Claude Code reads the file from one path per operating system.

To restrict write access to the managed-mcp.json file:

1. Check whether the file exists on your developer machines at the path for their operating system.

2. Set ownership and permissions so that only root, SYSTEM, or the local administrators group can write to it. If the file doesn't exist, restrict the parent directory so that developer accounts can't create it.

3. If you use a device management tool, confirm the restriction across the fleet and that it survives reimaging.

4. Confirm that a standard developer account can't create or modify the file.

For the full path list and Anthropic's own validation steps, see Control MCP server access for your organization.

Verify Enforcement

Run these checks on a managed developer machine after the developer restarts Claude Code.

To verify that enforcement is active:

1. Run claude mcp list. It returns the JFrog Agent Guard proxy and no servers the developer added.

2. Add an unapproved server to check that the policy rejects it:

   Shell

   claude mcp add --transport http test https://example.com/mcp

   The command fails with not allowed by enterprise policy. The URL doesn't need to point at a real server, because the policy check rejects the command first.

3. Confirm the machine has no managed-mcp.json file at the path for its operating system. If step 2 fails with an enterprise MCP configuration error instead, the file is present. Treat that as a policy gap unless your IT team deployed it deliberately.

Frequently Asked Questions

This section provides answers to frequently asked questions.

Related Topics

• Use the MCP Registry with Agent Guard
• Get Started with the JFrog MCP Registry
• Enforce Organization-Wide MCP Policies
• Configure Tool Policies
• Claude Code
• Troubleshoot MCP Registry