“Not verified by Anthropic”: what the red banner on a Claude extension means

What the banner says

When you install a local extension (a .mcpb file) in Claude Desktop, the page shows: “Installing will grant this extension access to everything on your computer. Any developer information shown has not been verified by Anthropic. Ensure you trust the source of this extension before installation.”

What it means

• “Not verified” means the bundle is not signed with a certificate that Claude Desktop recognises, so the developer name on the page could have been typed by anyone. It is not a judgment about the code.
• “Access to everything” is the worst case for the category: a local extension is a program on your computer and could reach anything your user account can. Whether it does depends on the extension.

What to check instead

• Is the source code public? You or anyone you trust can read what it does.
• Does it have a terminal? A terminal means folder rules can be bypassed. If you do not need one, prefer an extension without it.
• Does it ask before deleting? Through a window on your computer, not just a question in the chat.
• Can changes be undone?
• Does it send anything anywhere? Read its privacy page.
• Where did you download it? Only from the developer's own site or their GitHub releases.

Claude Desktop's own safety net

Independently of the extension, Claude Desktop asks “Claude wants to use … from …” before each tool runs, with Allow once, Always allow, and Decline. If you choose Always allow, the extension's own rules are what is left, so pick extensions whose rules you understand.