Configuration file reference

Claude Science reads optional settings from a TOML file at ~/.claude-science/config.toml on macOS and Linux. Every key has a default, so the app starts with no file present; administrators deploy the file with device management to set fleet policy. The file is read once at startup, so changes take effect after a restart. The claude-science command accepts --config <file> to read a different file for one run.

Network configuration

The network-related keys, grouped by the TOML table each belongs to. For the package-mirror keys ([conda] channel_mirror, pip_index_url, and ca_bundle) and the proxy key ([network] proxy), a value set in the file takes precedence over the matching Settings control, which then shows as managed by your organization so a member cannot override it. The [sandbox.network] lists are additive instead: they add to the member-managed lists under Settings > Network and lock nothing. On Team and Enterprise plans, two settings made for the whole organization under Organization settings > Claude Science sit above both the file and the Settings page. An organization package mirror takes precedence over the mirror keys, and while the organization manages the network allowlist, the file’s allowed_domains are set aside and its denied_domains still apply. The [network] ca_bundle, no_proxy, and mcp_x509_strict keys and [conda] allow_insecure_mirror have no in-app control.

App connection keys

The [network] table configures the app’s own connections.

Key	Type	Default	Effect
`proxy`	string (URL)	unset	The outbound proxy for the app’s HTTP and HTTPS connections, for example `http://proxy.example.corp:8080`. Supply Basic-authentication credentials in the address. An `https://` (TLS-to-proxy) address applies to the app’s own connections only; sandboxed package downloads connect directly when the proxy is `https://`, so prefer `http://`. A proxy variable in the app’s environment (including `ALL_PROXY`) takes precedence over this key, which takes precedence over the Settings proxy field and the macOS system proxy settings.
`no_proxy`	string (comma-separated)	unset	Hosts that bypass the proxy, as exact hostnames or domain suffixes in one comma-separated string, for example `".example.corp,registry.example.corp"`. Combined with the `NO_PROXY` environment variable and, when the macOS system settings supply the proxy address, the system’s bypass list. Loopback addresses always bypass the proxy.
`ca_bundle`	string (absolute path)	unset	PEM file added to the app’s default TLS trust for sign-in, the Claude API, Anthropic-hosted connectors, update checks, and cloud storage access from Settings (Amazon S3, S3-compatible stores, and Google Cloud Storage with an HMAC key); use it for a corporate root behind TLS inspection. It covers the app’s own connections only, while package downloads use `[conda] ca_bundle`. The value must be an absolute path outside the app’s data directory (`~/.claude-science`), temporary directories, and any directory you have granted Claude write access to; a system location such as `/etc/claude-science/corporate-ca.pem` is recommended. The file must exist, parse as a PEM bundle, and contain no private key; a failing value is ignored with a warning.
`mcp_x509_strict`	`"auto"`, `"relaxed"`, or `"strict"`	`"auto"`	How strictly local connectors check a corporate certificate’s profile. With `"auto"`, Claude Science relaxes the strict check when it detects TLS inspection from a configured `[network] ca_bundle`. Connectors pick up a change at their next relaunch.

Package download keys

The [conda] table configures where analysis environments fetch packages from and how those downloads verify certificates.

Key	Type	Default	Effect
`channel_mirror`	string (URL)	unset	Base URL of an internal conda mirror. Channel names resolve beneath it, so `<channel_mirror>/conda-forge/noarch/repodata.json` must return the conda-forge index. Setting it removes the public conda hosts from the sandbox allowlist and admits the mirror host, which environment builds contact directly from the workstation, not through an outbound proxy. Must be `https://` on port 443 or 8443 (an `http://` URL is accepted only when `allow_insecure_mirror` is set), by DNS name, with no embedded credentials. A deployed value these rules reject prevents the app from starting. An organization package mirror set under Organization settings > Claude Science takes precedence over this key.
`pip_index_url`	string (URL)	unset	A PEP 503 simple index for Python packages, for example an Artifactory or Nexus PyPI remote ending in `/simple`. Setting it removes the public Python hosts from the sandbox allowlist. Same URL rules as `channel_mirror`, including the startup failure on an invalid value, and the same precedence of an organization package mirror.
`ca_bundle`	string (absolute path)	unset	A complete PEM bundle (public roots plus your corporate roots) that package downloads verify against, replacing the default trust list; in this release the bundle alone may not be sufficient for pip, which verifies against the operating system’s trust store. This key affects package downloads only and never fixes sign-in; behind TLS inspection, set `[network] ca_bundle` as well. When unset, Linux uses your distribution’s system certificate bundle. Same path rules as `[network] ca_bundle`.
`allow_insecure_mirror`	boolean	`false`	Allows `http://` mirror URLs in this file (the Settings page accepts `https://` only). Off by default because a plaintext mirror lets an on-path attacker substitute packages.

Sandbox network keys

The [sandbox.network] table adjusts the network allowlist the analysis sandbox enforces. Members see the same allowlist under Settings > Network.

Key	Type	Default	Effect
`enabled`	boolean	`true`	When `false`, code Claude runs has no network access: package installs and data fetches inside the analysis fail, while the app’s own connections are unaffected. This is a no-network mode, not a way to skip the allowlist.
`allowed_domains`	array of strings	`[]`	Domains added to the built-in allowlist, as exact hostnames or wildcards such as `.example.org`. While the organization manages the network allowlist under Organization settings* > Claude Science, these domains are set aside and the organization’s list applies.
`denied_domains`	array of strings	`[]`	Domains added to the built-in denylist. A denied domain is blocked even if it also appears on the allowlist, and the built-in denylist entries cannot be removed.

Use Claude Science on a corporate network: how to apply these keys for a proxy, TLS inspection, or an internal mirror
Network requirements: the built-in allowlist and denylist these keys adjust
Manage Claude Science on devices: deploying config.toml with device management
Command line settings: the --config and --data-dir flags

Use Claude Science

Integrations & skills

For administrators

Reference

Resources

Network configuration

App connection keys

Package download keys

Sandbox network keys

​Network configuration

​App connection keys

​Package download keys

​Sandbox network keys

​Related resources

Network configuration

App connection keys

Package download keys

Sandbox network keys

Related resources