Enabling and using the desktop extension allowlist (original) (raw)

This article introduces a desktop extension allowlist that Team and Enterprise plan Owners can use to manage their organization’s access to extensions.

How to enable the allowlist

The desktop extension allowlist is disabled by default, so an organization Owner will need to switch it on manually. Note that users will be able to access all desktop extensions in the registry until you enable the allowlist. To prevent this, ensure you activate the allowlist to block all desktop extensions by default, then add only the extensions your team needs access to.

To turn on the allowlist:

What happens after enabling the allowlist?

Once the allowlist is enabled:

Note that the allowlist does not guard against individuals tampering with local MCP file contents after installation.

Consider completing the allowlist setup during off-hours to minimize disruption to existing users. If a user's installed extension is deleted while the allowlist is being configured, they will need to manually re-install the extension.

Managing allowed extensions

After enabling the allowlist, you can choose which extensions to allow:

If you want to remove an extension from the allowlist, click the “...” button and “Remove from allowlist.”

Uploading custom extensions

You can also upload custom extensions to deploy across your organization via Organization settings > Connectors > Desktop.

When you allowlist a custom extension, it's scoped to your specific organization and can't be used across other organizations. For more in-depth information about creating custom extensions with MCP Bundles (.mcpb), please refer to our desktop extension developer documentation.

Updating custom extensions

We’ve also introduced the ability to update previously-installed custom extensions to new versions without having to remove and reinstall them.

You can update a new MCPB version by making changes to manifest.json, ensuring the version field for the update candidate is incremented from the current uploaded version, and that you leave the name value unchanged. Changing the name will create a new custom desktop extension rather than uploading a new version. Then navigate to the custom upload pane, select "Upload new version" via the kebab menu, and upload the new file.

Install Claude Desktop Getting Started with Local MCP Servers on Claude Desktop Deploy Claude Desktop for macOS Enterprise configuration for Claude Desktop Deploying enterprise-grade MCP servers with desktop extensions