NeuralTrust | Platform for Agent Security.

Claude is Anthropic’s AI assistant, available at claude.ai, in the desktop app, in Cowork, and as Claude Code. Claude Code can read repositories, edit files, run shell commands, and call external tools from a developer’s terminal. NeuralTrust integrates with Claude at three points. Anthropic’s organization-level inference hook evaluates model requests across Claude surfaces. The Claude Code plugin evaluates lifecycle events on the developer’s machine, including the commands and tool calls that the inference hook does not expose. A TrustGate organization connector controls the MCP tools available to Claude.

NeuralTrust controls

Product	Scope	Controls
TrustGuard	Evaluates prompts, tool calls, and tool results against an organization policy. Requests arrive either from Anthropic’s inference hook or from the Claude Code plugin.	Monitor · Block · Ask on Claude Code tool calls
TrustGate	Exposes the MCP registries and tools assigned to a consumer. MCP (Model Context Protocol) connects Claude to systems such as trackers, databases, and internal APIs.	Tool availability · identity-based access · per-tool rate limits

Deployment options

Goal	Configuration	Location
Evaluate Claude requests across the organization	Claude Enterprise using Anthropic’s inference hook	Anthropic’s servers; configured by an organization admin
Evaluate Claude Code commands and tool calls before execution	Claude Code using the `trustguard@neuraltrust` plugin	Each managed developer machine
Centrally manage the MCP tools available to Claude	Organization connectors using a TrustGate MCP consumer	Anthropic’s cloud calls the MCP endpoint

Use separate credentials for TrustGuard and TrustGate. TrustGuard uses a tgk_… collector key. Put it in Anthropic’s inference-hook Authorization header or in claude-code.json, depending on the deployment. MCP authenticates as a consumer with OAuth2 or an ag_… API key. A tgk_… key does not authenticate MCP, and the plugin’s managed settings do not accept an MCP URL.

Before you start

Requirement	Notes
Egress to `{TRUSTGUARD_URL}`	The console shows the URL for your workspace. The Enterprise path calls it from Anthropic’s servers; the plugin calls it from developer machines.
The Claude Enterprise collector type (Enterprise path)	Runtime → Collectors → Catalog → IDE & coding agents → Claude Enterprise. Create the `tgk_…` key on Auth, then assign a policy with the required Input rules on Policies. The key is shown once.
An Anthropic organization admin (Enterprise path)	The hook lives in the Anthropic admin console under Data and Privacy → Inference hooks.
The Claude Code collector type (plugin path)	Runtime → Collectors → Catalog → IDE & coding agents → Claude Code. Create its `tgk_…` key on Auth and assign the policy on Policies.
MDM (plugin path)	Deploys `claude-code.json`, and optionally `managed-settings.json` and a pinned binary.
Egress to GitHub Releases (plugin path)	On first use the plugin bootstrap downloads the platform `trustguard-claude-code` binary.
An MCP consumer (connector path)	Bind the required registries, then copy the endpoint from its Connect tab.
Owner role in the Anthropic organization (connector path)	Custom connectors are added from Organization settings.
A publicly reachable MCP host (connector path)	The connector is called from Anthropic’s cloud, not from the user’s machine.

Create the policy in Observe mode. Observe records decisions in Activity without enforcing them. Review the results, then switch the policy to Enforce. See Policies.

Developers do not need NeuralTrust accounts for the Claude Enterprise or plugin paths. On the connector path, each member completes an OAuth login against the IdP configured for the consumer, which may be NeuralTrust.

Claude Enterprise

Anthropic’s organization-level Inference Hooks call TrustGuard before the model answers. The hook applies across Claude surfaces, requires no laptop installation, and cannot be disabled by end users. Each Anthropic organization endpoint maps to one TrustGuard collector. TrustGuard records the originating surface in source.application; see Attributes. The verdict is binary: allow or deny. There is no Ask dialog, masking, or visibility into individual tool executions on this path. It sees the model request, not the command Claude Code is about to run. Data Loss Prevention therefore blocks or reports here; it cannot mask in flight.

In the Anthropic admin console, open Data and Privacy → Inference hooks.
Set Hook URL to {TRUSTGUARD_URL}/v1/evaluate/claude and Authorization to Bearer <collector API key>. Use the tgk_… key, not a tgcol_… key.
Save the endpoint in Anthropic. Saving is what generates the whsec_… signing secret.
Paste whsec_… into the collector’s Connection tab in TrustGuard.
Back in Anthropic, reopen Edit and run Test connection. The test fails until the secret has been added to TrustGuard.
Assign a default policy to the collector before enforcing in production.

This path installs no Claude Code lifecycle hooks. For control over individual actions on a developer machine, add the plugin as well.

Claude Code

The Claude Code plugin registers lifecycle hooks on the developer’s machine. Before an action runs, each hook calls POST /v1/evaluate with a collector tgk_… key. Unlike the inference hook, the plugin receives shell commands and supports Ask on tool calls. Hooks fire only when all three pieces are present:

Piece	What	If missing
Plugin `trustguard@neuraltrust`	Registers `hooks.json`	Claude Code never calls the bootstrap
Binary `trustguard-claude-code`	MDM `/Library/Application Support/TrustGuard/bin/`, or `~/.trustguard/bin`	Bootstrap fail-opens (`{}`)
Collector key `tgk_…`	In `claude-code.json`	Binary runs and allows the action without calling evaluate

Enable the plugin. Deploy this through server-managed settings (claude.ai Admin → Claude Code → Managed settings) or as the file /Library/Application Support/ClaudeCode/managed-settings.json:

{
  "extraKnownMarketplaces": {
    "neuraltrust": {
      "source": {
        "source": "github",
        "repo": "NeuralTrust/trustguard-claude-code-plugin"
      },
      "autoUpdate": true
    }
  },
  "enabledPlugins": {
    "trustguard@neuraltrust": true
  }
}

Do not add pluginConfigs, mcpServers, or an MCP URL. Organization-wide MCP access uses a separate organization connector.

Deploy the collector config with MDM, and optionally pin the binary:

{
  "data_url": "https://<your-trustguard-host>",
  "api_key": "tgk_…",
  "fail_mode": "open"
}

OS	Config	Binary (optional pin)
macOS	`/Library/Application Support/TrustGuard/claude-code.json`	`…/TrustGuard/bin/trustguard-claude-code`
Linux	`/etc/trustguard/claude-code.json`	`~/.trustguard/bin/`
Windows	`%ProgramData%\TrustGuard\claude-code.json`	`%ProgramData%\TrustGuard\bin\`

Confirm the plugin is enabled. An installed plugin, including one with Scope: managed, does not run until its status is enabled:

# Inside `claude`: /status  →  Enterprise managed settings: remote  (or file)
claude plugin list          # Status: enabled
claude plugin enable trustguard@neuraltrust   # if still disabled

Start a new Claude Code session so hooks.json loads.

enabledPlugins: true in the admin JSON does not always enable the plugin in the CLI. Claude Code skips server-managed settings entirely when ANTHROPIC_BASE_URL or any CLAUDE_CODE_USE_* variable is set. This includes sessions pointed at a TrustGate LLM proxy. Deploy the file path instead in that case.

Organization connectors

Add TrustGate to Claude as an organization connector. The connector is available in claude.ai, Desktop, Cowork, and Claude Code. Claude receives the merged toolkit assigned to the MCP consumer. Copy the URL from the consumer’s Connect tab:

https://<mcp-host>/<consumer-slug>/mcp

As Owner, open Organization settings → Connectors → Add → Custom → Web.
Set Name to TrustGate and URL to the Connect endpoint above.
Save. Each member then opens Customize → Connectors → TrustGate → Connect and completes OAuth.

See Anthropic’s own custom connectors guide.

The connector is called from Anthropic’s cloud, not from the user’s machine. The MCP URL must be reachable from the public internet, or from allowlisted Anthropic egress. A Hybrid-only MCP endpoint needs a public path or one of TrustGate’s private-network options before the connector can connect.

Prefer OAuth2 (or Use NeuralTrust): org connectors expect OAuth. API-key consumers work through the Claude Code CLI instead.

Claude Code CLI

Claude Code loads the organization connector after the user completes the connection. Confirm in /mcp that TrustGate is the org connector, not “Provided by a plugin”. For local testing only, use the following command. It does not replace the organization connector:

claude mcp add --transport http TrustGate https://<mcp-host>/<consumer-slug>/mcp

An API-key consumer sends the key as a header:

claude mcp add --transport http TrustGate https://<mcp-host>/<consumer-slug>/mcp \
  --header "X-AG-API-Key: ag_…"

On a private (Hybrid) data plane, add --header "X-AG-Gateway-Slug: <gateway-slug>" as well.

Verify

Claude Enterprise.

Run Test connection in Anthropic. It arrives in Activity with the collector’s connection-test event.
Send a prompt from claude.ai and confirm the event with source.application = claude-ai.

Claude Code.

ls -l "/Library/Application Support/TrustGuard/bin/trustguard-claude-code"
cat "/Library/Application Support/TrustGuard/claude-code.json"   # data_url + tgk_ prefix only

echo '{"hook_event_name":"PreToolUse","tool_name":"Bash","tool_input":{"command":"echo hi"},"session_id":"pilot"}' \
  | trustguard-claude-code hook

A manual probe that shows up in Activity with source.application = claude-code-plugin means the binary and key work. If Claude Code still never evaluates, the plugin is disabled or hooks did not reload. Organization connector.

claude.ai or Desktop: Connectors → TrustGate shows connected, and its tools are available in chat.
Claude Code: /mcp lists TrustGate; call a tool from a bound registry.
Confirm the call in TrustGate telemetry. See Metrics.

Reference

Coverage

Claude Enterprise

Surface	Monitor	Block	Redact
LLM input	✅	✅	❌
LLM output	➖	➖	➖
Tool listing	✅	⚠️	➖
Tool call	✅	⚠️	❌
Tool result	✅	⚠️	❌

⚠️ Tool content is visible in the transcript and can be blocked, but only by blocking the whole inference at the single pre-inference decision point. There is no per-tool verdict. Claude Code plugin

Surface	Monitor	Block	Redact
LLM input	✅	✅	❌
LLM output	➖	➖	➖
Tool call	✅	✅	❌
Tool result	✅	✅	❌

Use Claude Enterprise to evaluate model requests across the organization. Use the plugin to evaluate specific shell commands and MCP calls on managed developer machines. Neither path evaluates model responses. Ask. Only the plugin honors Ask, and only on tool calls, where it raises Claude Code’s native permission dialog. The subtitle is the generic TrustGuard sentence A TrustGuard policy needs your approval to continue.; the title is Claude Code’s tool name and the plugin cannot change it. An ask on UserPromptSubmit does not stop the prompt. Claude Code has no confirmation dialog for that event, so it submits the prompt with a warning. Use a block gate to stop a prompt. On the Enterprise path, ask becomes allowed. Limits. Neither path supports redaction. There is no hook for assistant output, so model responses, system prompts, token usage, and extended thinking are not evaluated. The plugin does not evaluate tool declarations. Route MCP through TrustGate if you need controls over the available tool set. On the Enterprise path, a non-2xx response from TrustGuard is a delivery failure, not a deny. Anthropic’s failure handling then applies, while TrustGuard-side failures allow the request. Full comparison: Coverage.

What is evaluated

Claude Enterprise: one decision point before the model answers.

Anthropic → POST /v1/evaluate/claude
  Authorization: Bearer tgk_…
  Standard Webhooks signature (whsec_)
  → TrustGuard allow | deny

This is not the generic POST /v1/evaluate path. The inference-hook endpoint returns only allow or deny. Claude Code plugin: one call per lifecycle hook.

Claude Code event	TrustGuard	What you can stop	Enforcement
`UserPromptSubmit`	`protocol: llm`, `direction: input`	Jailbreaks (Prompt Guard); secrets and PII pasted into the agent (DLP)	Block only
`PreToolUse` (`Bash` / `Shell`)	`protocol: all`, `{ "input": "<command>" }`, `direction: input`	Dangerous or out-of-policy shell commands. The full command line is `tool.command`, and `tool.name` is `Bash`	Block or Ask
`PreToolUse` (MCP and other tools)	`protocol: mcp`, `tools/call`, `direction: input`	Risky MCP tool calls	Block or Ask
`PostToolUse`	`protocol: mcp`, tool result, `direction: output`	Indirect prompt injection in MCP or tool output, and sensitive data in results, before the model consumes it	Block. Ask gates do not match on output

tool.name is payload.params.name: for mcp__<server>__<tool> that is the last segment. Gate on that short name, not the full hook tool_name. The policy’s detectors decide the verdict.

Configuration

Managed settings (plugin enablement only). managed-settings.json carries extraKnownMarketplaces and enabledPlugins. It does not hold a collector key or an MCP URL. claude-code.json (TrustGuard collector only). Keys: data_url, api_key, fail_mode. When the managed file contains api_key, that key plus data_url and fail_mode are locked. A user file cannot replace them. fail_mode: open plus an empty hook body {} means allow; that is also the response when evaluate returns allow. Binary discovery. The MDM path is checked first, then ~/.trustguard/bin. The user path is not required when the MDM binary exists. On a private fork of the plugin repository, an unauthenticated GitHub Releases request may return 404. Set TRUSTGUARD_GITHUB_TOKEN and pin the release version. If the download fails, the bootstrap fails open. Remote sessions. Over SSH or WSL, the hooks run on the remote host. An MDM-deployed binary on the Mac does not cover that session. The config and binary must exist where the agent runs. MCP auth. Organization connectors use OAuth2 (or Use NeuralTrust). Through the CLI, TrustGate also accepts an ag_… consumer key as X-AG-API-Key, and a private data plane needs X-AG-Gateway-Slug unless the MCP host already scopes the gateway. Which IdP backs the login is configured on the consumer. See Auth. Authenticating to TrustGate is separate from authenticating to the upstream servers; a registry using OAuth (forwarded) returns a connect link on the first call for a user without a stored credential. Deployment ownership.

Component	Owner	Configuration
Inference hook	Anthropic organization administrator	Hook URL + `Bearer tgk_…` + `whsec_…`
Plugin enablement	IT / MDM, or server-managed settings	`managed-settings.json`
Collector config	IT / MDM	`claude-code.json` with the organization `tgk_…` key
Organization connector	Anthropic organization owner	The MCP consumer’s Connect URL

Configure the consumer’s available tools under Routing in the NeuralTrust console, or through a role for Identity-based consumers. To limit MCP tool calls, attach the Per-Tool Rate Limiter policy.

Attributes

Claude Enterprise deliveries carry collector.type = anthropic_inference_hook, model.provider = anthropic, and consumer.id from the actor’s email or id. The surface arrives in source.application:

`source.application` (observed)	Product
`claude-ai`	Claude chat
`claude-code`	Claude Code, seen server-side

TrustGuard copies the frame’s source.application into the gate attribute map on every delivery. Unknown values are accepted as-is (open string). The Claude Code plugin stamps source.application = claude-code-plugin and a per-developer consumer_id. These values provide per-developer attribution in Activity. A gate on claude-code does not match the plugin. The collectors use different values, so configure their gates separately. Policy gates per surface. Use a collector and default policy for each integration path. Within Claude Enterprise, use a gate on source.application to apply different rules to each surface (Policies → Gates → Source application):

Goal	Condition	Then
Stricter on Claude Code only	`source.application` eq `claude-code`	Block or Report
Waive chat (detectors still run after Skip)	`source.application` eq `claude-ai`	Skip
Only the laptop plugin	`source.application` eq `claude-code-plugin`	Ask or Block

Gates run before detectors. In Observe policy mode, Block is recorded but not enforced. Test the condition on the policy Test tab with Extra parameter Source application set to the surface you care about.

Troubleshooting

Symptom	Cause
Test connection fails in Anthropic	The `whsec_…` secret is not on the collector’s Connection tab yet. Save in Anthropic, paste the secret, then test
No inference-hook events	The inference hook is not saved, or the collector has no policy assigned
TrustGuard is down and Claude still answers	Expected. Failures allow the request, and a non-2xx is a delivery failure rather than a deny. Anthropic’s failure handling applies
An `ask` gate did nothing on the Enterprise path	Expected. The inference-hook endpoint returns only allow or deny; `ask` becomes allowed
An `ask` gate on a prompt did not stop it in Claude Code	Expected. There is no confirmation dialog at `UserPromptSubmit`. Use a Block gate
A gate on `claude-code` never fires for the plugin	The plugin stamps `claude-code-plugin`. `claude-code` is Claude Code seen server-side
`claude plugin list` shows the plugin, no hooks fire	Status is `installed`, not `enabled`. Run `claude plugin enable trustguard@neuraltrust`, then start a new session
Managed settings ignored	`ANTHROPIC_BASE_URL` or a `CLAUDE_CODE_USE_*` variable is set, so Claude Code skips server-managed settings. Deploy the file instead
Hooks fire but nothing reaches Activity	`claude-code.json` has no `tgk_…` key, so the binary allows without calling evaluate, or `data_url` is incorrect
Hooks work locally but not over SSH / WSL	Hooks run on the remote host. The binary and config have to be there
Bootstrap returns `{}` without running the binary	An unauthenticated GitHub Releases request can return `404` for a private fork. Set `TRUSTGUARD_GITHUB_TOKEN`; otherwise the bootstrap allows the action
The plugin evaluates nothing in claude.ai or Desktop	Expected. Those surfaces have no lifecycle hooks. Use Claude Enterprise
The connector saves but never connects	The MCP URL is not reachable from Anthropic’s cloud
Claude Code shows TrustGate as “Provided by a plugin”	This is a local `claude mcp add` entry, not the organization connector. Confirm in `/mcp`
Connector connects, no tools	Consumer has no bound registries, tool restrictions exclude everything, or the upstream connect link was never authorized
`401` / repeated login on MCP	Wrong plane URL, revoked `ag_…` key, or `X-AG-Gateway-Slug` missing on Hybrid

Policies: Gates: Ask and Block configuration, including source.application values
Evaluate API: requests sent by the plugin hooks
Collectors: collector types and keys
MCP overview: consumers, catalog merging, and upstream authentication
TrustGate authentication: API key and OAuth2 authentication for MCP consumers
Coverage: comparison of the Claude collectors with other integrations
Plugin repository: source, releases, and the hook contract
Custom connectors (Anthropic): Anthropic’s reference

Start here

AI coding agents

AI gateways

Agent frameworks

Edge / WAF

Build your own

Claude

NeuralTrust controls

Deployment options

Before you start

Claude Enterprise

Claude Code

Organization connectors

Claude Code CLI

Verify

Reference

Coverage

What is evaluated

Configuration

Attributes

Troubleshooting

​NeuralTrust controls

​Deployment options

​Before you start

​Claude Enterprise

​Claude Code

​Organization connectors

​Claude Code CLI

​Verify

​Reference

​Coverage

​What is evaluated

​Configuration

​Attributes

​Troubleshooting

​Related

NeuralTrust controls

Deployment options

Before you start

Claude Enterprise

Claude Code

Organization connectors

Claude Code CLI

Verify

Reference

Coverage

What is evaluated

Configuration

Attributes

Troubleshooting

Related