allowManagedModsOnly in Claude Code: does hosted Sume MCP still load?

Mods and MCP servers are separate switches in Claude Code. allowManagedModsOnly stops every mod a user brings from loading, and Claude Code's docs say it leaves users' settings hooks, status lines, and /goal working. The overview adds that when a mod is stopped by this kind of setting, the rest of its plugin stays in place: its skills, commands, agents, and MCP servers still load. Nothing on those pages ties a Sume connection to the option, so a hosted Sume server that you or your administrators configured stays configured.

This post reads Claude Code's organization guide and mods overview, read 2026-10-03, for people who deploy Claude Code settings and also want developers to reach https://mcp.sume.com/mcp.

What does the setting look like?

It is an option on the built-in guard, cc-plugin-sec-default@builtin, and goes in managed settings under pluginConfigs. The guard reads it from managed settings only, so the same entry in a user, project, or local settings file changes nothing.

{
  "pluginConfigs": {
    "cc-plugin-sec-default@builtin": {
      "options": {
        "allowManagedModsOnly": true
      }
    }
  }
}

What does it stop and what does it keep?

The admin guide spells out what the option covers. The table compresses it and notes the one detail that matters for Sume: the stopped mod is a piece of code, and MCP servers are a separate part of a plugin.

How does a developer still connect Sume?

The connection is an ordinary MCP server, not a mod. Sume's quickstart uses claude mcp add --transport http sume https://mcp.sume.com/mcp and then claude mcp login sume; consent happens on Sume's MCP host with Read on and Write off by default. If your organization restricts which MCP servers users may add, that is a different control. The managed-settings post covers the refusal and the exclusive allow post covers a managed list that names the Sume server.

A quick check after rollout: on a test machine, start Claude Code, confirm Sume's server is connected, and call mcp_health, which reports the endpoint, the auth source and the safety posture. Then load a sample mod with --plugin-dir; the guide says its hooks should not run and the debug log should name allowManagedModsOnly. Both checks should pass at once.

Can I allow some user mods and refuse others?

Yes, with a policy mod of your own. A mod listed in prependPlugins receives a plugin.register event each time another mod is about to load, with e.tier and e.uses.calls, the same list claude plugin validate prints. Returning { refuse: 'reason' } keeps the mod from loading. This example, adapted from the guide's own policy mod, refuses a user's mod that both reads the environment and uses the network, and fails closed:

const NEEDS = ['env.get', 'http.fetch']

export function register(on) {
  on('plugin.register', async ($, e, next) => {
    const risky = NEEDS.every((call) => e.uses.calls.includes(call))
    if (e.tier === 'user' && risky) {
      return { refuse: 'Policy: a mod may not both read the environment and use the network' }
    }
    return next(e)
  }).catch(async ($, e, next) => {
    if (e.tier !== 'user') return next(e)
    return { refuse: 'Policy check failed, so this mod was not loaded' }
  })
}

What should I still keep in mind?

A few limits apply whichever policy you choose. They come straight from the guide and apply to Sume users as much as to anyone else.

• Your policy mod must count as the organization's: enabled in managed enabledPlugins, with its marketplace named as an absolute directory path and the plugin listed by a relative path. A plugin Claude Code copies from a GitHub, git, URL, or npm source counts as a user's.
• Deny rules and managed hooks do not cover a mod's own $.fs and $.process calls, so refusing the mod is the control, not a deny rule on a file.
• A worker crash can turn mods off. The guide says that if the thread that runs installed mods crashes three times, Claude Code unloads every mod that is not built in, yours included, until /reload-plugins or a new session.
• For Sume credentials, prefer OAuth with Write off for read work (OAuth and API keys); see the credential post.