NeuralTrust | Platform for Agent Security.

Claude Code is an agent that acts — it runs shell commands, edits files, and calls MCP tools. The TrustGuard Claude Code plugin puts your org’s policy check at each of those moments, on the developer machine, before the action happens:

Moment	What you can stop	Enforcement
Prompt, before submit	Jailbreaks (Prompt Guard); secrets and PII pasted into the agent (DLP)	Block
Tool call, before it runs (shell, MCP, everything else)	Dangerous or out-of-policy commands; risky MCP tool calls — the full command line is evaluated as `tool.command`	Block or Ask (native Claude Code permission dialog)
Tool result, after it runs	Indirect prompt injection riding back in MCP / tool output before the model consumes it; sensitive data in results	Block

Every decision also lands in Activity with a per-developer consumer_id, so you get an audit trail of what the org’s coding agents actually did — in Report policy mode you can run all of this observe-only before enforcing. This complements Claude Enterprise: the hook screens the model request org-wide with zero endpoint install (allow/deny only); the plugin is per-machine and controls actions, with Ask. Most orgs run both — they stamp different source.application values (claude-code vs claude-code-plugin), so gate them separately. Under the hood the plugin registers Claude Code lifecycle hooks that call POST /v1/evaluate with a collector tgk_… key.

Coverage

Surface	Monitor	Block	Redact
LLM input	✅	✅	❌
LLM output	➖	➖	➖
Tool call	✅	✅	❌
Tool result	✅	✅	❌

Ask — honoured natively, through Claude Code’s own permission dialog, on prompts and on tool calls. Use it when you want to stop a specific shell command or MCP call on developer machines. Not when you expect to see or block the model’s responses. For coverage a developer cannot bypass, add Claude Enterprise. Limits. The model’s response is never evaluated — there is no hook on assistant output, and system prompts, token usage and extended thinking are not captured. ask on UserPromptSubmit does not stop the prompt: Claude Code has no confirmation dialog there. No redaction. Tool declarations are not evaluated. Full comparison: Coverage.

Three pieces

Hooks fire only when all three are present:

Piece	What	If missing
Plugin `trustguard@neuraltrust`	Registers `hooks.json`	Claude Code never calls bootstrap
Binary `trustguard-claude-code`	Kandji `/Library/Application Support/TrustGuard/bin/` or `~/.trustguard/bin`	Bootstrap fail-opens (`{}`)
Collector key `tgk_…`	`claude-code.json`	Binary runs and allows without evaluate

claude plugin list showing the plugin installed is not enough. Status must be enabled. Scope: managed only means the marketplace installed it.

Console setup

Runtime → Collectors → Catalog → IDE & coding agents → Claude Code (or the Claude Code collector type your workspace lists).
Auth — mint a tgk_… key (shown once).
Policies — assign a default policy. Gate Ask / Block on source.application eq claude-code-plugin if this collector also receives other traffic.

Enable the plugin

Server-managed settings (claude.ai Admin → Claude Code → Managed settings) or /Library/Application Support/ClaudeCode/managed-settings.json:

{
  "extraKnownMarketplaces": {
    "neuraltrust": {
      "source": {
        "source": "github",
        "repo": "NeuralTrust/trustguard-claude-code-plugin"
      },
      "autoUpdate": true
    }
  },
  "enabledPlugins": {
    "trustguard@neuraltrust": true
  }
}

No pluginConfigs. No MCP URL — org-wide MCP (claude.ai, Desktop, Cowork, Claude Code) is a separate organization connector, and the collector tgk_… key is never an MCP credential. enabledPlugins: true in the admin JSON does not always flip the CLI to enabled. Claude Code skips server-managed settings when ANTHROPIC_BASE_URL or CLAUDE_CODE_USE_* is set (including a TrustGate LLM proxy). In that case deploy the file path above (Kandji: TRUSTGUARD_DEPLOY_CLAUDE_MANAGED_SETTINGS=1). Check on the laptop:

# Inside `claude`: /status  →  Enterprise managed settings: remote  (or file)
claude plugin list          # Status: enabled
claude plugin enable trustguard@neuraltrust   # if still disabled

Then start a new Claude Code session so hooks.json loads.

Collector config + binary (MDM)

{
  "data_url": "https://<your-trustguard-host>",
  "api_key": "tgk_…",
  "fail_mode": "open"
}

OS	Config	Binary (optional pin)
macOS	`/Library/Application Support/TrustGuard/claude-code.json`	`…/TrustGuard/bin/trustguard-claude-code`
Linux	`/etc/trustguard/claude-code.json`	`~/.trustguard/bin/`
Windows	`%ProgramData%\TrustGuard\claude-code.json`	`%ProgramData%\TrustGuard\bin\`

If the managed file has api_key, that key, data_url, and fail_mode are locked. Missing ~/.trustguard/bin is fine when the MDM binary exists. Private GitHub repo: bootstrap curl of Releases 404s without a token (fail-open). Kandji install can set TRUSTGUARD_GITHUB_TOKEN and pin the release version. fail_mode: open + an empty hook body {} means allow. That is also the response when evaluate returns allow.

What is evaluated

Claude Code event	Protocol	Direction	Notes
`UserPromptSubmit`	`llm`	input	Block / Ask on the prompt
`PreToolUse` (`Bash` / `Shell`)	`all` (`{ "input": "<command>" }`)	input	`tool.command` is the line; `tool.name` is `Bash`
`PreToolUse` (MCP and other tools)	`mcp` `tools/call`	input	`tool.name` = `payload.params.name` (last segment of `mcp__server__tool`)
`PostToolUse`	`mcp` result	output	Ask gates do not match

Ask on PreToolUse shows Claude Code’s permission dialog. The subtitle is the generic TrustGuard sentence above. The title (tool name) is Claude Code’s; the plugin cannot change it.

Verify

ls -l "/Library/Application Support/TrustGuard/bin/trustguard-claude-code"
cat "/Library/Application Support/TrustGuard/claude-code.json"   # data_url + tgk_ prefix only

echo '{"hook_event_name":"PreToolUse","tool_name":"Bash","tool_input":{"command":"echo hi"},"session_id":"pilot"}' \
  | trustguard-claude-code hook

A manual probe that shows up in Activity with source.application = claude-code-plugin means the binary and key work. If Claude Code still never evaluates, the plugin is disabled or hooks did not reload. Remote SSH / WSL: hooks run on the remote host. A Kandji binary on the Mac does not cover that session. claude.ai / Desktop: no lifecycle hooks. Use Claude Enterprise and/or org Connectors, not this plugin.

Introduction

Resources

Detector catalog

Integrations

Evaluate API

Claude Code

Coverage

Three pieces

Console setup

Enable the plugin

Collector config + binary (MDM)

What is evaluated

Verify

​Coverage

​Three pieces

​Console setup

​Enable the plugin

​Collector config + binary (MDM)

​What is evaluated

​Verify

​Related

Coverage

Three pieces

Console setup

Enable the plugin

Collector config + binary (MDM)

What is evaluated

Verify

Related