Distributing MCP servers to your organization

Claude provides admin-level controls that allow organizations to distribute MCP servers to their teams through private marketplaces and managed settings. This guide shows you how to use these features to securely deploy Gram-hosted MCP servers across your organization.

Overview

Claude’s admin MCP controls enable:

• Private plugin marketplaces: Create organization-specific marketplaces to distribute approved MCP servers to your team.
• Desktop extension allowlists: Control which MCP extensions your users can access in Claude Desktop.
• Managed MCP settings: Enforce organization-wide MCP server configurations in Claude Code.
• Unified customization: A centralized “Customize” menu for managing plugins, skills, and connectors.

These controls help IT administrators maintain security standards while giving teams access to the tools they need.

Prerequisites

To configure organization-wide MCP distribution, you need:

• A Gram account  with an MCP server ready to distribute
• Claude Team or Enterprise plan with admin (Owner or Primary Owner) permissions

Distributing MCP servers with Claude Desktop

Desktop extension allowlist

Organization owners can control which desktop extensions their users have access to through the desktop extension allowlist. This allows you to:

1. Upload custom extensions: Add proprietary MCP extensions directly to your organization.
2. Manage access: Define which desktop extensions users can install with one click.
3. Remove public extensions: Disable access to public desktop extensions based on your security requirements.

Setting up the allowlist

To configure the desktop extension allowlist:

1. Sign in to the Claude admin console as an Owner or Primary Owner.
2. Navigate to Settings > Desktop Extensions.
3. Enable or disable public desktop extensions based on your organization’s security standards.
4. Upload custom desktop extensions (including your Gram-hosted MCP servers) and make them available to your team.

Once configured, your team members can install approved extensions with a single click through Claude Desktop’s Connectors interface.

Adding a Gram-hosted MCP server to your allowlist

To distribute a Gram-hosted MCP server to your organization:

1. In the Gram dashboard, go to your toolset’s installation page.
2. Export the server configuration (see Exporting server configuration).
3. In the Claude admin console, upload the configuration as a custom desktop extension.
4. Add the extension to your organization’s allowlist.

Your team can now install the MCP server directly from Claude Desktop’s extension marketplace.

Distributing MCP servers with Claude Code

Claude Code supports managed settings for centralized organizational control. These settings cannot be overridden by users or projects, making them ideal for enforcing security policies.

Deployment mechanisms

Managed settings can be deployed through several mechanisms:

File-based managed settings locations

• macOS: /Library/Application Support/ClaudeCode/
• Linux/WSL: /etc/claude-code/
• Windows: C:\Program Files\ClaudeCode\

Configuring MCP server allowlists

Use the allowedMcpServers and deniedMcpServers settings to control which MCP servers your organization can use:

{
  "allowedMcpServers": [
    { "serverName": "gram-taskmaster" },
    { "serverName": "gram-internal-api" }
  ],
  "deniedMcpServers": [
    { "serverName": "filesystem" }
  ]
}

• allowedMcpServers: When set, acts as an allowlist. An empty array [] locks down all MCP servers.
• deniedMcpServers: Blocklist that takes precedence over the allowlist.

Restricting to managed MCP servers only

For stricter control, enable allowManagedMcpServersOnly:

{
  "allowManagedMcpServersOnly": true,
  "allowedMcpServers": [
    { "serverName": "gram-taskmaster" }
  ]
}

When enabled:

• Only MCP servers in the managed allowedMcpServers list are accessible.
• Users can still attempt to add servers, but only admin-defined servers will function.
• deniedMcpServers still applies from all sources.

Plugin marketplace controls

Use strictKnownMarketplaces to define which plugin marketplaces your organization can access:

{
  "strictKnownMarketplaces": [
    { "source": "url", "url": "https://plugins.yourcompany.com/marketplace.json" },
    { "source": "github", "repo": "yourcompany/approved-plugins" }
  ]
}

Supported marketplace sources:

Setting strictKnownMarketplaces to an empty array [] prevents users from adding any marketplaces, creating a complete lockdown.

Deploying Gram-hosted MCP servers to your organization

Here’s how to distribute a Gram-hosted MCP server across your organization using Claude Code managed settings:

Step 1: Create the MCP server configuration

Create a managed-mcp.json file with your Gram-hosted MCP server configuration:

{
  "mcpServers": {
    "gram-taskmaster": {
      "command": "npx",
      "args": [
        "mcp-remote",
        "https://app.getgram.ai/mcp/your-toolset-slug",
        "--header",
        "Authorization: Bearer ${GRAM_API_KEY}"
      ]
    }
  }
}

Replace your-toolset-slug with your actual toolset slug from the Gram dashboard.

Step 2: Create the managed settings

Create a managed-settings.json file to enforce the MCP server:

{
  "allowManagedMcpServersOnly": true,
  "allowedMcpServers": [
    { "serverName": "gram-taskmaster" }
  ]
}

Step 3: Deploy to your organization

Deploy the configuration files to the appropriate system directory based on your operating system:

• macOS: /Library/Application Support/ClaudeCode/
• Linux: /etc/claude-code/
• Windows: C:\Program Files\ClaudeCode\

For MDM-managed deployments, configure the settings through your MDM solution (Jamf, Kandji, Intune, etc.).

Step 4: Verify deployment

Users can verify the managed settings are active by running /status inside Claude Code. The output shows active settings sources and their origins (Enterprise managed settings from remote, plist, HKLM registry, or file).

Security considerations

When distributing MCP servers across your organization:

• Authentication: Use managed authentication for Gram-hosted MCP servers to centralize credential management.
• Audit logging: Enable audit logging in Gram to track all tool calls made through your MCP servers.
• Network boundaries: Desktop extensions operate within corporate network boundaries, using existing authenticated contexts without additional firewall rules.
• Zero-trust compliance: Gram-hosted MCP servers support zero-trust architecture with complete control over access, authentication, and logging.

Comparison of distribution methods

What’s next

• Create your first MCP server to distribute to your organization.
• Learn about adding OAuth authentication for secure managed authentication.
• Explore public and private server visibility options for your MCP servers.