Config Setup

This guide walks through creating your organization’s SCC configuration file.

Configuration File Structure

The org config is a JSON file with these main sections:

org-config.json

{
  "schema_version": "1.0.0",
  "organization": {
    "name": "Acme Corp",
    "id": "acme"
  },
  "marketplaces": { },
  "security": { },
  "defaults": { },
  "delegation": { },
  "profiles": { }
}

Creating Your Config

1. Start with the basics

   org-config.json

   {
     "schema_version": "1.0.0",
     "organization": {
       "name": "Your Company",
       "id": "your-company"
     }
   }

2. Add plugin marketplaces

   {
     "marketplaces": {
       "sandboxed-code-official": {
         "source": "github",
         "owner": "CCimen",
         "repo": "sandboxed-code-plugins"
       },
       "internal": {
         "source": "github",
         "owner": "your-org",
         "repo": "scc-plugins"
       }
     }
   }

3. Define security policies

   {
     "security": {
       "blocked_plugins": ["*experimental*", "*beta*"],
       "blocked_base_images": ["*:latest"],
       "allow_stdio_mcp": false
     }
   }

4. Set organization defaults

   {
     "defaults": {
       "enabled_plugins": [
         "scc-safety-net@sandboxed-code-official"
       ],
       "session": {
         "timeout_hours": 12,
         "auto_resume": true
       }
     }
   }

5. Create team profiles

   {
     "profiles": {
       "backend": {
         "description": "Backend development team",
         "additional_plugins": [
           "java-analyzer@internal"
         ]
       },
       "frontend": {
         "description": "Frontend development team",
         "additional_plugins": [
           "react-tools@internal"
         ]
       }
     }
   }

6. Validate

   scc org validate org-config.json

Complete Example

org-config.json

{
  "schema_version": "1.0.0",
  "organization": {
    "name": "Acme Corp",
    "id": "acme"
  },
  "marketplaces": {
    "sandboxed-code-official": {
      "source": "github",
      "owner": "CCimen",
      "repo": "sandboxed-code-plugins"
    },
    "internal": {
      "source": "github",
      "owner": "acme",
      "repo": "scc-plugins"
    }
  },
  "security": {
    "blocked_plugins": ["*experimental*"],
    "blocked_mcp_servers": ["*.untrusted.com"],
    "blocked_base_images": ["*:latest"],
    "allow_stdio_mcp": false
  },
  "defaults": {
    "enabled_plugins": [
      "scc-safety-net@sandboxed-code-official"
    ],
    "session": {
      "timeout_hours": 12,
      "auto_resume": true
    }
  },
  "delegation": {
    "teams": {
      "allow_additional_plugins": ["*"],
      "allow_additional_mcp_servers": ["platform", "data"]
    }
  },
  "profiles": {
    "backend": {
      "description": "Backend development",
      "additional_plugins": ["java-analyzer@internal"],
      "delegation": {
        "allow_project_overrides": true
      }
    },
    "frontend": {
      "description": "Frontend development",
      "additional_plugins": ["react-tools@internal"],
      "delegation": {
        "allow_project_overrides": true
      }
    },
    "platform": {
      "description": "Platform engineering",
      "additional_plugins": ["k8s-tools@internal"],
      "additional_mcp_servers": {
        "monitoring": {
          "type": "http",
          "url": "https://monitoring.internal/mcp"
        }
      }
    }
  }
}

Hosting Your Config

GitHub (Public)

Host in a public GitHub repository:

https://raw.githubusercontent.com/your-org/scc-config/main/org-config.json

Developers configure with:

scc setup --org-url https://raw.githubusercontent.com/your-org/scc-config/main/org-config.json

GitHub (Private)

Host in a private repository with token auth:

export SCC_ORG_TOKEN="ghp_xxxxx"
scc setup --org-url https://api.github.com/repos/your-org/scc-config/contents/org-config.json

HTTPS Endpoint

Host on any HTTPS server:

https://config.your-company.com/scc/org-config.json

Developers configure with:

scc setup --org-url https://config.your-company.com/scc/org-config.json

Environment Variable

Developers can set the org URL as an environment variable:

export SCC_ORG_URL="https://config.your-company.com/scc/org-config.json"

This avoids needing to specify --org-url on every command.

Config Caching

SCC caches the org config locally:

Setting	Value
Cache location	~/.cache/scc/org-config/
Cache TTL	24 hours
Force refresh	scc update --force

Tip

After updating the org config, have developers run scc update to get the latest version.

Validation Commands

# Validate config syntax
scc org validate org-config.json

# Check org status and cache
scc org status

# Force refresh from remote
scc org update --force