Unify Desktop .mcpb extension management with CLI managed-settings.json

[ssalzman-kobold]

Problem

Claude Code Desktop and Claude Code CLI each have half of a great enterprise MCP management story, but they don't share capabilities:

Claude Code Desktop has excellent .mcpb extension support:

• Users can upload custom MCP server bundles via the Extensions UI
• Extensions are tracked in extensions-installations.json with version hashes
• Per-extension settings live in Claude Extensions Settings/
• Organizations can distribute .mcpb files to users

Claude Code CLI has managed-settings.json:

• Enterprise-grade permission policies (allow/deny/ask for bash, file access, etc.)
• Centrally managed configuration
• Honors system-level settings at /Library/Application Support/ClaudeCode/managed-settings.json

But neither product has access to the other's capabilities:

• Desktop doesn't honor managed-settings.json for permissions (see Claude Code Desktop should honor managed-settings.json for all permissions #30953)
• CLI has no concept of .mcpb extensions or the Extensions management UI
• There's no built-in mechanism for organizations to auto-update managed .mcpb extensions — orgs have to build their own update infrastructure (e.g., scheduled scripts that compare SHA256 digests against a release and re-extract into the Extensions directory)

Request

Unify both systems so that organizations get a single, complete management plane:

1. Desktop should honor managed-settings.json for permissions (already filed as Claude Code Desktop should honor managed-settings.json for all permissions #30953)
2. CLI should support .mcpb extensions the same way Desktop does
3. Built-in auto-update for managed extensions — when an organization distributes .mcpb files, there should be a native mechanism to check for and apply updates without requiring custom deployment scripts
4. Single config surface — one place where orgs can define which MCPs are installed, what permissions they get, and how they're updated

Related Issues

• Claude Code Desktop should honor managed-settings.json for all permissions #30953 — Claude Code Desktop should honor managed-settings.json for all permissions
• [BUG] Claude Desktop Cowork: "Always allow" for MCP tools does not persist across sessions #24433 — MCP tool permissions don't persist across sessions
• [FEATURE] Flexible managed-settings hooks permissions #30715 — managed-settings.json for hooks permissions
• Permissions reset every session resume — causes approval fatigue and safety risk #30882 — Permissions reset every session

[github-actions]

Found 1 possible duplicate issue:

1. [FEATURE] Ability to enable or configure automatic updating of a marketplace and plugin #10265

This issue will be automatically closed as a duplicate in 3 days.

• If your issue is a duplicate, please close it and 👍 the existing issue instead
• To prevent auto-closure, add a comment or 👎 this comment

🤖 Generated with Claude Code

[github-actions]

This issue has been automatically closed as a duplicate of #10265.

If this is incorrect, please re-open this issue or create a new one.

🤖 Generated with Claude Code

[JABowie]

@ssalzman-kobold - I don't think this is a duplicate, do you want to re-open?

[github-actions]

This issue has been automatically locked since it was closed and has not had any activity for 7 days. If you're experiencing a similar issue, please file a new issue and reference this one if it's relevant.