Anthropic’s Claude Code Security scans your codebase for vulnerabilities and suggests patches for human review. It doesn’t govern what Claude Code does at runtime: which hosts it calls, which API keys sit in its environment, which git pushes its shell commands make. To secure Claude Code in the enterprise, that layer needs a control outside the agent, which is what Formal Endpoint provides.

What does Claude Code Security cover, and which Claude Code risks remain?

Anthropic announced Claude Code Security on February 20, 2026, as a research preview for Enterprise and Team customers. It reasons about code, verifies its findings and proposes patches a developer approves. As of November 2026, Anthropic documents a managed Claude Security service (Enterprise plan) and a plugin that scans inside a Claude Code session. Both look at code.

Claude Code also has runtime controls, listed in Anthropic’s security docs: permission modes, a sandboxed bash tool with filesystem and network isolation, managed settings, OpenTelemetry monitoring and ConfigChange hooks. Turn them on. Anthropic also notes that “no system is completely immune to all attacks.”

What’s left is the network and credential layer. Claude Code can read your terminal’s environment variables and the files in the directory where you run claude, .env files included. Every allowed domain is still an exfiltration channel, and allowlisting a few bash commands is often the same as allowlisting all of them.

What can Claude Code reach on the network?

The Endpoint runs on the developer’s laptop. In Transparent Mode it intercepts TCP connections at the operating system’s network layer (a Network Extension on macOS), so Claude Code needs no proxy settings, only trust in Formal’s local CA. CEL network rules select which connections Formal intercepts, logs and evaluates against policies.

process.is_claude_cli is true when the connecting process or any ancestor is Claude Code, so one rule covers the CLI and every bash command, script and git process it spawns. On macOS, Formal recognizes Claude Code by its code-signing identity (team ID Q6L2SF6YDW); on Linux, by process name. This rule from the network rules docs intercepts AWS API traffic from Claude Code for users in the Infra group:

{
  "condition": {
    "pre_tcp": process.ancestors.exists(p, p.signing.team_id == "Q6L2SF6YDW" && p.signing.bundle_identifier == "com.anthropic.claude-code"),
    "pre_tls": "Infra" in user.groups,
    "post_tls": technology == "aws"
  }
}

Traffic that matches no rule passes through untouched and isn’t logged.

How do you keep secrets out of Claude Code?

Don’t give it the secrets. The Connector stores the real Anthropic API key as a Native User. A network rule forwards Claude Code’s Anthropic traffic from the Endpoint to the Connector with the developer’s Formal identity, and the Connector sets the x-api-key header upstream. Claude Code runs with a placeholder: ANTHROPIC_API_KEY=sk-ant-dummy claude.

The same pattern works for other APIs that Claude Code or the code it runs calls. The real credential is injected only after the request has left Claude Code, its sandbox and the laptop. The Terraform walkthrough is in our post on how to route Claude Code through a proxy.

How do you monitor Claude Code usage and tie it to a person?

Each intercepted request is logged with the Formal identity of the developer signed in to the Endpoint, plus the connecting process and its ancestors. Policies see input.agent, whose type is claude-cli for Claude Code. On an OIDC machine session, end_user carries the human behind the machine identity.

For LLM traffic, Formal captures the model, the full prompt and completion, tool calls with arguments and results, and token usage. The AI Usage pages roll this up by application, model and user.

Which Claude Code actions can you block?

Policies are Rego, evaluated on each session, request and response. Documented examples that apply to Claude Code:

  • Pushes to sensitive repositories: one rule and one policy block agent git pushes over SSH and HTTPS on macOS, while pushes from the developer’s own terminal go through.
  • Tokens on a command line: a response policy blocks tool calls whose arguments contain a GitHub token or a URL with credentials.
  • Specific API calls: a policy on the Anthropic resource blocks POST /v1/files uploads.
  • Skip-permissions sessions: input.agent.yolo_mode is true when Claude Code was launched with --dangerously-skip-permissions, and a session policy can block those sessions.
  • Off-task tool calls: assessments score each tool call for risk and alignment with the user’s intent, and response policies act on the scores.

Instead of blocking, an mfa action pauses the agent until the developer confirms on their device.

Claude Code governance: skills, MCP servers and spend

Formal’s shadow AI review lists MCP servers people use that have no Formal resource, and the skills listed as available or loaded in Claude Code’s requests (skill detection works on Claude Code traffic only). Approve or block each one; guardrails set the default for the rest. Approved MCP servers can run on the MCP gateway.

A policy on input.user.spend caps what each user spends, and a rewrite policy injects Anthropic’s anthropic-allowed-org-ids header so only accounts in your organization can sign in.

Where does Formal stop?

  • Formal doesn’t scan code. Keep Claude Code Security or your static analysis for that.
  • Transparent Mode and network rules run on macOS and Linux. On Windows, the Endpoint connects through formal connect only.
  • On Linux, Claude Code is matched by process name, not code signature.
  • Agent rules match known agents. A tool Formal doesn’t recognize isn’t caught by them.
  • By default, the Endpoint adds its CA variables to Claude Code’s ~/.claude/settings.json so intercepted TLS is trusted.