Claude Code

Claude Code is Anthropic’s coding agent. It can read repositories, edit files, run shell commands, and call external tools from a developer’s terminal. The TrustGuard plugin evaluates these actions through lifecycle hooks on the machine where Claude Code runs. TrustGate provides access to the MCP tools assigned to an application. For organization-wide inference hooks or managed MCP connectors, see Claude Enterprise.

NeuralTrust controls

Product	Scope	Controls
TrustGuard	Evaluates prompts, commands, tool calls, and tool results against an organization policy.	Monitor · Block · Ask on tool calls
TrustGate	Exposes the MCP registries and tools assigned to an application, and can proxy Claude Code’s model traffic through an LLM application. MCP (Model Context Protocol) connects Claude Code to systems such as trackers, databases, and internal APIs.	Tool availability · application authentication · per-tool rate limits · model routing and budgets

Use the TrustGuard plugin to evaluate individual actions. Add TrustGate when Claude Code needs controlled access to MCP tools. Each has its own configuration and credentials.

TrustGuard uses a tgk_… collector key in claude-code.json. TrustGate authenticates MCP applications with OAuth2 or an ag_… API key. A tgk_… key does not authenticate MCP, and the plugin’s managed settings do not accept an MCP URL.

Before you start

Requirement	Notes
Egress to `{TRUSTGUARD_BASE_URL}`	The console shows the base URL for your workspace. The plugin calls it from the machine where Claude Code runs.
The Claude Code collector type	Agent Security → Collectors → Catalog → Coding agents → Claude Code. Create its `tgk_…` key on Auth and assign the policy on Policies. The key is shown once.
MDM	Deploys `claude-code.json`, and optionally `managed-settings.json` and a pinned binary.
Egress to GitHub Releases	On first use the plugin bootstrap downloads the platform `trustguard-claude-code` binary.
An MCP application, if using TrustGate	Bind the required registries, then copy the endpoint from its Connect tab.

Create the policy in Observe mode. Observe records decisions in Activity without enforcing them. Review the results, then switch the policy to Enforce. See Policies. Developers do not need NeuralTrust accounts to use the TrustGuard plugin. An OAuth-backed MCP application requires a login against the identity provider it trusts.

TrustGuard plugin

The Claude Code plugin registers lifecycle hooks on the developer’s machine. Before an action runs, each hook calls POST /v1/evaluate with a collector tgk_… key. Unlike the Enterprise inference hook, the plugin receives shell commands and supports Ask on tool calls. Hooks fire only when all three pieces are present:

Piece	What	If missing
Plugin `trustguard@neuraltrust`	Registers `hooks.json`	Claude Code never calls the bootstrap
Binary `trustguard-claude-code`	MDM `/Library/Application Support/TrustGuard/bin/`, or `~/.trustguard/bin`	Bootstrap fail-opens (`{}`)
Collector key `tgk_…`	In `claude-code.json`	Binary runs and allows the action without calling evaluate

Enable the plugin. Deploy this through server-managed settings (claude.ai Admin → Claude Code → Managed settings) or as the file /Library/Application Support/ClaudeCode/managed-settings.json:

{
  "extraKnownMarketplaces": {
    "neuraltrust": {
      "source": {
        "source": "github",
        "repo": "NeuralTrust/trustguard-claude-code-plugin"
      },
      "autoUpdate": true
    }
  },
  "enabledPlugins": {
    "trustguard@neuraltrust": true
  }
}

Do not add pluginConfigs, mcpServers, or an MCP URL. Organization-wide MCP access uses a separate organization connector.

Deploy the collector config with MDM, and optionally pin the binary:

{
  "data_url": "https://<your-trustguard-host>",
  "api_key": "tgk_…",
  "fail_mode": "open"
}

OS	Config	Binary (optional pin)
macOS	`/Library/Application Support/TrustGuard/claude-code.json`	`…/TrustGuard/bin/trustguard-claude-code`
Linux	`/etc/trustguard/claude-code.json`	`~/.trustguard/bin/`
Windows	`%ProgramData%\TrustGuard\claude-code.json`	`%ProgramData%\TrustGuard\bin\`

Confirm the plugin is enabled. An installed plugin, including one with Scope: managed, does not run until its status is enabled:

# Inside `claude`: /status  →  Enterprise managed settings: remote  (or file)
claude plugin list          # Status: enabled
claude plugin enable trustguard@neuraltrust   # if still disabled

Start a new Claude Code session so hooks.json loads.

enabledPlugins: true in the admin JSON does not always enable the plugin in the CLI. Claude Code skips server-managed settings entirely when ANTHROPIC_BASE_URL or any CLAUDE_CODE_USE_* variable is set. This includes sessions pointed at a TrustGate LLM proxy. Deploy the file path instead in that case.

Connect to TrustGate

For centrally managed access, use a Claude organization connector. Claude Code loads that connector after the user completes the connection. Confirm in /mcp that TrustGate is the org connector, not “Provided by a plugin”. For local testing, add the MCP application directly to the CLI. This does not replace the organization connector. Copy the endpoint from the application’s Connect tab:

claude mcp add --transport http TrustGate https://<mcp-host>/<application-slug>/mcp

An API-key application sends the key as a header:

claude mcp add --transport http TrustGate https://<mcp-host>/<application-slug>/mcp \
  --header "X-AG-API-Key: ag_…"

The MCP plane also accepts the key as Authorization: Bearer ag_… or x-api-key, for clients that can only set one of those headers. On a private (Hybrid) data plane, add --header "X-AG-Gateway-Slug: <gateway-slug>" as well.

Route model traffic through TrustGate

Claude Code can send its own model requests through an LLM application instead of straight to Anthropic, so the same rate limits, budgets, guardrails, and traces apply to the coding agent as to any other application. Claude Code speaks the Anthropic Messages API; TrustGate serves it at /{application-slug}/v1/messages and routes it to whichever registry the application binds — an Anthropic registry, or a cross-format route to an OpenAI or Gemini registry.

Create an LLM application, bind the registries and models it may use, and issue an ag_… API key. Copy the LLM host from the Connect tab.
Point Claude Code at the application:
export ANTHROPIC_BASE_URL="https://<llm-host>/<application-slug>" export ANTHROPIC_AUTH_TOKEN="ag_…" # sent as Authorization: Bearer # or: export ANTHROPIC_API_KEY="ag_…" # sent as x-api-key
Both header forms authenticate the API key. On a private (Hybrid) data plane add the gateway header:
export ANTHROPIC_CUSTOM_HEADERS="X-AG-Gateway-Slug: <gateway-slug>"
The key identifies the application, not the person using it, so model traffic shows no user in Activity until Claude Code names one. Send it in X-NeuralTrust-End-User (one header per line, so a Hybrid plane keeps X-AG-Gateway-Slug on the line above):
export ANTHROPIC_CUSTOM_HEADERS="X-NeuralTrust-End-User: ana@example.com"
The value is attribution only: it lands on the trace and in Activity, and grants nothing. ANTHROPIC_CUSTOM_HEADERS reaches model requests only; MCP traffic needs none of this, because there the person signs in and the gateway already knows them.
Start a new session and send a prompt. The request appears in TrustGate traces under the application, with the user you named.

Claude Code names Anthropic models. On a route to an Anthropic registry they pass through. On a cross-format route a bound registry must serve the model name Claude Code sends — TrustGate walks the application’s registries in order and answers 404 model_not_supported when none does — so point Claude Code at a model the registry offers (ANTHROPIC_MODEL for one session, or ANTHROPIC_DEFAULT_OPUS_MODEL / ANTHROPIC_DEFAULT_SONNET_MODEL / ANTHROPIC_DEFAULT_HAIKU_MODEL for the aliases), and expect TrustGate to adapt the request:

On a cross-format route TrustGate…	Detail
Clamps `max_tokens`	Values above the resolved model’s output limit are lowered to it. The response carries `X-Max-Tokens-Clamped`; the metric is `trustgate.proxy.max_tokens_clamped`.
Rejects context-window overflow early	A request whose text is far larger than the model’s context window returns `400` with the Anthropic error envelope before any upstream call, naming the window and the estimated size. Not applied to `openai_compatible` registries or models with an unknown window.
Rewrites upstream errors	Provider errors come back as Anthropic `{"type":"error","error":{"type":"invalid_request_error",…}}` bodies (and SSE error events), so Claude Code can parse them.
Drops nameless server-tool blocks	Anthropic server-side tool blocks that carry only a `type` (for example `web_search_20250305`) are removed so the OpenAI or Gemini upstream never sees a function without a name. Anthropic-to-Anthropic traffic is untouched.

The Warning above still applies: with ANTHROPIC_BASE_URL set, Claude Code skips server-managed settings, so deploy the TrustGuard plugin enablement as the managed-settings.json file.

Verify

TrustGuard plugin

Check that the binary and collector config are installed, then send a test lifecycle event:

ls -l "/Library/Application Support/TrustGuard/bin/trustguard-claude-code"
cat "/Library/Application Support/TrustGuard/claude-code.json"   # data_url + tgk_ prefix only

echo '{"hook_event_name":"PreToolUse","tool_name":"Bash","tool_input":{"command":"echo hi"},"session_id":"pilot"}' \
  | trustguard-claude-code hook

A manual probe that shows up in Activity with source.application = claude-code-plugin means the binary and key work. If Claude Code still never evaluates, the plugin is disabled or hooks did not reload.

TrustGate MCP connection

Confirm that /mcp lists TrustGate, then call a tool from a bound registry.
Confirm the call in TrustGate Activity.

TrustGate inference

With ANTHROPIC_BASE_URL set, run /status inside claude and confirm the API base URL is the application URL, then send a prompt and open the trace in the console. A 401 means the key is wrong or revoked; a 404 means the slug or the path is wrong (the base URL must end with the application slug, no /v1).

Reference

Coverage

This table describes the TrustGuard plugin, not the TrustGate MCP connection.

Surface	Monitor	Block	Redact
LLM input	✅	✅	❌
LLM output	➖	➖	➖
Tool call	✅	✅	❌
Tool result	✅	✅	❌

Ask. The plugin honors Ask on tool calls by raising Claude Code’s native permission dialog. The subtitle is the generic TrustGuard sentence A TrustGuard policy needs your approval to continue.; the title is Claude Code’s tool name and the plugin cannot change it. An ask on UserPromptSubmit does not stop the prompt. Claude Code has no confirmation dialog for that event, so it submits the prompt with a warning. Use a Block gate to stop a prompt. Limits. The plugin does not support redaction or evaluate tool declarations. There is no hook for assistant output, so model responses, system prompts, token usage, and extended thinking are not evaluated. Route MCP through TrustGate if you need controls over the available tool set. The plugin does not run in claude.ai or Desktop; use the Enterprise inference hook to evaluate model requests across the organization.

What is evaluated

The plugin sends one evaluation call per lifecycle hook.

Claude Code event	TrustGuard	What you can stop	Enforcement
`UserPromptSubmit`	`protocol: llm`, `direction: input`	Jailbreaks (Prompt Guard); secrets and PII pasted into the agent (DLP)	Block only
`PreToolUse` (`Bash` / `Shell`)	`protocol: all`, `{ "input": "<command>" }`, `direction: input`	Dangerous or out-of-policy shell commands. The full command line is `tool.command`, and `tool.name` is `Bash`	Block or Ask
`PreToolUse` (MCP and other tools)	`protocol: mcp`, `tools/call`, `direction: input`	Risky MCP tool calls	Block or Ask
`PostToolUse`	`protocol: mcp`, tool result, `direction: output`	Indirect prompt injection in MCP or tool output, and sensitive data in results, before the model consumes it	Block. Ask gates do not match on output

tool.name is payload.params.name: for mcp__<server>__<tool> that is the last segment. Gate on that short name, not the full hook tool_name. The policy’s detectors decide the verdict.

Configuration

Managed settings (plugin enablement only). managed-settings.json carries extraKnownMarketplaces and enabledPlugins. It does not hold a collector key or an MCP URL. claude-code.json (TrustGuard collector only). Keys: data_url, api_key, fail_mode. When the managed file contains api_key, that key plus data_url and fail_mode are locked. A user file cannot replace them. fail_mode: open plus an empty hook body {} means allow; that is also the response when evaluate returns allow. When a detector cannot run. The hooks always block, with no setting to change it: in Enforce the prompt or tool call is denied, and in Observe it is only recorded. The user sees a message that the request could not be evaluated. In Activity the detector shows as not executed, with the action it applied, and it is not listed as a detection. Binary discovery. The MDM path is checked first, then ~/.trustguard/bin. The user path is not required when the MDM binary exists. On a private fork of the plugin repository, an unauthenticated GitHub Releases request may return 404. Set TRUSTGUARD_GITHUB_TOKEN and pin the release version. If the download fails, the bootstrap fails open. Remote sessions. Over SSH or WSL, the hooks run on the remote host. An MDM-deployed binary on the Mac does not cover that session. The config and binary must exist where the agent runs. MCP auth. The CLI accepts OAuth2 or an ag_… application key as X-AG-API-Key (the plane also takes it as Authorization: Bearer ag_… or x-api-key). A private data plane needs X-AG-Gateway-Slug unless the MCP host already scopes the gateway. Which IdP backs the OAuth login is configured on the application. See Auth. Authenticating to TrustGate is separate from authenticating to the upstream servers; a registry using OAuth (forwarded) returns a connect link on the first call for a user without a stored credential. Deployment ownership. IT manages plugin enablement through managed-settings.json or server-managed settings, and deploys the organization collector key in claude-code.json through MDM. An Anthropic organization owner manages organization connectors. Configure the application’s available tools on General in the NeuralTrust console; every caller the application admits sees the same tool set. To limit MCP tool calls, attach the Per-Tool Rate Limiter policy.

Attributes

The plugin stamps source.application = claude-code-plugin and a per-developer consumer_id. These values provide per-developer attribution in Activity. A gate on claude-code does not match the plugin. That value identifies Claude Code requests seen server-side by the Enterprise inference hook. Use a collector and default policy for each integration path, and configure their gates separately. To target the plugin, create a gate with source.application eq claude-code-plugin, then choose Ask or Block as appropriate for the event. The field is under Policies → Gates → Source application. Gates run before detectors. In Observe mode, Block is recorded but not enforced. Test the condition on the policy Test tab with Extra parameter Source application set to claude-code-plugin.

Troubleshooting

Symptom	Cause
An `ask` gate on a prompt did not stop it	There is no confirmation dialog at `UserPromptSubmit`. Use a Block gate
A gate on `claude-code` never fires for the plugin	The plugin stamps `claude-code-plugin`. `claude-code` is Claude Code seen server-side
`claude plugin list` shows the plugin, no hooks fire	Status is `installed`, not `enabled`. Run `claude plugin enable trustguard@neuraltrust`, then start a new session
Managed settings ignored	`ANTHROPIC_BASE_URL` or a `CLAUDE_CODE_USE_*` variable is set, so Claude Code skips server-managed settings. Deploy the file instead
Hooks fire but nothing reaches Activity	`claude-code.json` has no `tgk_…` key, so the binary allows without calling evaluate, or `data_url` is incorrect
Hooks work locally but not over SSH / WSL	Hooks run on the remote host. The binary and config have to be there
Bootstrap returns `{}` without running the binary	An unauthenticated GitHub Releases request can return `404` for a private fork. Set `TRUSTGUARD_GITHUB_TOKEN`; otherwise the bootstrap allows the action
The plugin evaluates nothing in claude.ai or Desktop	Those surfaces have no lifecycle hooks. Use Claude Enterprise
Claude Code shows TrustGate as “Provided by a plugin”	This is a local `claude mcp add` entry, not the organization connector. Confirm in `/mcp`
MCP connects, no tools	Application has no bound registries, tool restrictions exclude everything, or the upstream connect link was never authorized
`401` / repeated login on MCP	Wrong plane URL, revoked `ag_…` key, or `X-AG-Gateway-Slug` missing on Hybrid

Claude Enterprise: organization inference hooks and managed MCP connectors
Policies: Gates: Ask and Block configuration, including source.application values
Evaluate API: requests sent by the plugin hooks
Collectors: collector types and keys
MCP overview: applications, catalog merging, and upstream authentication
TrustGate authentication: API key and OAuth2 authentication for MCP applications
How TrustGuard works: evaluation and enforcement across integrations
Plugin repository: source, releases, and the hook contract

Catalog

AI coding agents

Agent platforms

AI gateways

Agent frameworks

Observability

Build your own

NeuralTrust controls

Before you start

TrustGuard plugin

Connect to TrustGate

Route model traffic through TrustGate

Verify

TrustGuard plugin

TrustGate MCP connection

TrustGate inference

Reference

Coverage

What is evaluated

Configuration

Attributes

Troubleshooting

​NeuralTrust controls

​Before you start

​TrustGuard plugin

​Connect to TrustGate

​Route model traffic through TrustGate

​Verify

​TrustGuard plugin

​TrustGate MCP connection

​TrustGate inference

​Reference

​Coverage

​What is evaluated

​Configuration

​Attributes

​Troubleshooting

​Related

NeuralTrust controls

Before you start

TrustGuard plugin

Connect to TrustGate

Route model traffic through TrustGate

Verify

TrustGuard plugin

TrustGate MCP connection

TrustGate inference

Reference

Coverage

What is evaluated

Configuration

Attributes

Troubleshooting

Related