Managed MCP - Claude Code

Managed MCP lets admins define which MCP servers are permitted organization-wide. Individual users can only connect to servers the org has approved.

What it does

Admins publish a managed configuration via the admin console. It lists allowed servers, denied servers, and defaults. Claude Code on managed devices respects the list - you can't add a blocked server, and the allowed ones may come pre-configured. It's how enterprises control the blast radius of MCP.

When to use it

• Any organization using Claude Code at scale.
• Regulated industries where exfiltration risk matters.
• Teams standardizing on a specific MCP toolkit.
• Compliance scenarios where unauthorized MCP servers would violate policy.

Gotchas

• Users can't work around managed MCP on their device. Escalations have to go through admins.
• Managed lists take precedence over user config. Local additions for blocked servers silently fail.
• Admins should document what's allowed and why - opaque deny lists frustrate everyone.

Official docs: https://code.claude.com/docs/en/mcp.md#managed-mcp-configuration