Fragments (highest priority first): deptA-vendor-b=20, deptA-baseline=10, org-baseline=0, security-deny=0

── Claude Code · managed-settings → /Library/Application Support/ClaudeCode/managed-settings.json
{
  "allowedMcpServers" : [
    {
      "serverName" : "vendor-b"
    },
    {
      "serverName" : "vendor-a"
    }
  ],
  "allowManagedMcpServersOnly" : true,
  "cleanupPeriodDays" : 30,
  "deniedMcpServers" : [
    {
      "serverName" : "filesystem-unrestricted"
    }
  ],
  "permissions" : {
    "deny" : [
      "Read(./.env)",
      "Read(./secrets/**)",
      "Read(./.env.*)",
      "Read(~/.ssh/**)",
      "Read(~/.aws/**)"
    ],
    "disableBypassPermissionsMode" : "disable"
  }
}

── Claude Code · managed-mcp → /Library/Application Support/ClaudeCode/managed-mcp.json
{
  "mcpServers" : {
    "vendor-a" : {
      "type" : "http",
      "url" : "https://mcp.vendor-a.acme.example/mcp"
    },
    "vendor-b" : {
      "headers" : {
        "Authorization" : "Bearer MIMIR-ENC:v1:3d1d2a43fc2923df:BOKRLrz5056ehiuhYYfjCmMOngyn-gDUyC1maXar_3icmDoWd8_3Z0V4ilNsGYdjg0NKco4Anx0vLrImEGFEmZzMALfE5atqZ4uiLQcrDhOTTFekipOxuYiP05kvkapZ8ddGwILv1oE"
      },
      "type" : "http",
      "url" : "https://mcp.vendor-b.acme.example/mcp"
    }
  }
}

── Claude Desktop · managed-preferences → /Library/Managed Preferences/com.anthropic.claudefordesktop.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>autoUpdaterEnforcementHours</key>
	<integer>24</integer>
	<key>isDesktopExtensionDirectoryEnabled</key>
	<false/>
	<key>isLocalDevMcpEnabled</key>
	<false/>
</dict>
</plist>

── opencode · managed-config → /Library/Application Support/opencode/opencode.json
{
  "autoupdate" : "notify",
  "disabled_providers" : [
    "openrouter"
  ],
  "mcp" : {
    "vendor-a" : {
      "enabled" : true,
      "type" : "remote",
      "url" : "https://mcp.vendor-a.acme.example/mcp"
    },
    "vendor-b" : {
      "enabled" : true,
      "type" : "remote",
      "url" : "https://mcp.vendor-b.acme.example/mcp"
    }
  },
  "permission" : {
    "bash" : "ask",
    "edit" : "ask"
  },
  "share" : "disabled"
}

── OpenAI Codex CLI · requirements → /etc/codex/requirements.toml
# Managed by Mimir (com.spectrechen.mimir). Local changes are overwritten.
allowed_approval_policies = ["on-request", "untrusted"]
allowed_sandbox_modes = ["read-only"]

── OpenAI Codex CLI · managed-config → /etc/codex/managed_config.toml
# Managed by Mimir (com.spectrechen.mimir). Local changes are overwritten.
approval_policy = "on-request"
sandbox_mode = "read-only"

