Core Concepts

Before diving deeper into SCC, it’s helpful to understand the key concepts that make it work.

Sessions

A session is a running Claude Code environment inside a Docker container. Each session:

Is tied to a specific workspace (git repository)
Uses a specific team profile
Can be named for easy identification
Can be resumed after stopping

# Start a new session
scc start ~/project

# Resume the most recent session
scc start --resume

# Pick from recent sessions interactively
scc start --select

Session Lifecycle

Sandboxes

A sandbox is the Docker container that isolates Claude Code from your host system. The sandbox:

Has access only to mounted directories (your project)
Cannot access sensitive files like ~/.ssh or ~/.aws
Uses your org’s network policy as a runtime posture (partial enforcement in v1)
Uses a specific base Docker image

Team Profiles

A team profile defines the configuration for a group of users. Each profile includes:

Setting	Description
`additional_plugins`	Extra plugins enabled for this team (added to org defaults)
`additional_mcp_servers`	MCP servers available to Claude for this team
`network_policy`	Network posture rules (unrestricted, corp-proxy-only, isolated)
`session`	Timeout settings (auto_resume is advisory in v1)

Profiles are defined in your organization’s config and can be:

Inline: Defined directly in the org config file
Federated: Defined in a separate team-managed repository

# List available teams/profiles
scc team

# Switch to a different team
scc team switch

# See current team
scc team current

# See team configuration
scc team info <team-name>

Personal Profiles

A personal profile captures your own Claude Code preferences for a specific project. It sits between team config and workspace overrides so you can add your own plugins or MCP servers without changing org or repo settings, while still respecting org security blocks.

# Save current workspace settings as a personal profile
scc profile save

# Apply personal profile on demand
scc profile apply

Learn more in Personal Profiles.

Worktrees

A worktree is a git feature that lets you check out multiple branches simultaneously in different directories. SCC uses worktrees to:

Isolate AI experiments from your main branch
Allow parallel development on multiple features
Keep your main branch clean

# Create a worktree for a new feature
scc worktree create ~/project feature-auth
# Creates: ~/project/.worktrees/feature-auth
# On branch: scc/feature-auth

# List all worktrees
scc worktree

# Enter a worktree (starts a subshell)
scc worktree enter feature-auth

# Switch between worktrees
scc worktree switch feature-auth

Configuration Layers

SCC uses layered configuration with personal profiles:

Order of precedence:

Organization → Team → Personal Profile → Workspace overrides

Plugins

Plugins extend Claude Code with additional capabilities. SCC manages plugins through:

Marketplaces: Repositories of approved plugins
Allowlists: Patterns defining which plugins are permitted
Blocklists: Patterns defining which plugins are forbidden

The most important official plugin is scc-safety-net, which blocks destructive git commands.

MCP Servers

MCP (Model Context Protocol) servers provide Claude with access to external tools and data. Types include:

Type	Description	Example
HTTP	Remote API endpoints	context7, shadcn
SSE	Server-Sent Events streaming	Real-time data feeds
Stdio	Local subprocess servers	Playwright, custom tools

Glossary

Term	Definition
Session	A running Claude Code environment in a container
Sandbox	The Docker container providing isolation
Profile	Team configuration (plugins, servers, policies)
Worktree	Isolated git checkout for parallel development
Marketplace	Repository of approved plugins
Safety Net	Plugin that blocks destructive git commands

Next Steps

Developer Guide

Learn the day-to-day workflow. Read guide →

Configuration Reference

Dive into config file details. See reference →