Govern Claude Code

Claude Code is a coding assistant that reads and writes source on a developer's machine. The CID plugin puts every prompt and every tool result through the same detection pipeline as the rest of the product, and reports what happened. Detection & Filtering → Claude Code is where you read that: who worked on which repositories, when, and which filters fired.

How Claude Code reaches CID222

Two independent layers, and only the first is on by default.

Inspection is always on once the plugin is installed. Claude Code hooks send each prompt and the output of Read, Grep and Bash tool calls to the appliance's /inspect/v1 endpoint under the claude-code hostname, which runs them through the guardrails and the tenant group's filter overrides, and records the telemetry this page shows. Provider traffic is untouched.

Routing is optional. Pointing Claude Code's Anthropic base URL at the appliance's passthrough proxy puts the gateway in the request path, so it can inspect, mask or block before a request reaches the model.

Connect one developer's Claude Code

curl -fsSL https://<appliance-fqdn>/claude/install.sh | CID_HOST=https://<appliance-fqdn> bash

export CID_INSPECT_KEY=cid_key_0123456789abcdef
export CID_GATEWAY_URL=https://<appliance-fqdn>

Roll it out to a team

The wizard's bundle sets an Anthropic base URL; the template shipped with the appliance's deployment files deliberately does not. Decide which of the two you are deploying before you hand the file to a team.

Set the filter profile

Claude Code is a coding surface. It legitimately reads and writes text that a chat-tuned toxicity or jailbreak model flags, and its payload is source code rather than prose. The recommended profile is therefore log-first, expressed entirely as filter overrides on a tenant group — there is no separate Claude Code policy screen.

Two behaviours are worth knowing before you choose actions:

• A reject rule blocks the prompt, and the developer is told which categories matched.
• A mask rule cannot mask a prompt in place — the hook protocol does not allow it. The shipped plugin records the prompt, warns the developer and passes it through unchanged. Tool output on the same session is masked properly. Set the plugin's prompt-mask action to block if you would rather refuse those prompts than pass them.

Read the page

The toolbar filters everything below it: a range of Last 24 hours, Last 7 days (the default), Last 30 days or Last 90 days, plus exact-match boxes for Developer email, Repository (full git remote) and Branch. They are exact matches, not searches — there is no content search here because content is never stored. Export offers CSV, Excel (.xlsx), PDF and HTML, for the current tab or any named view.

Tabs

Selecting a developer, repository or session row opens a drawer that re-queries everything scoped to that entity, so the numbers always match the tables.

Counters

Attribution

A seat is attributed to a CID222 account by matching the seat's email to a tenant's contact email. Unmatched seats are shown as unmapped with the explanation No tenant carries this seat email, so activity cannot be attributed to a CID user. Set the tenant's contact_email to link them. Attribution is stamped when each event is written, so linking a tenant today does not retroactively attribute yesterday's events — a partially linked seat shows {n}/{m} attributed.

Optional: route provider traffic through the appliance

Routing puts the gateway in the request path so it can mask or block a prompt before Anthropic sees it. It is off by default: the proxy's inspect URL is unset and passthrough masking is false, so the proxy forwards without inspecting.

When routing is on, a blocked prompt returns an HTTP 400 reading Blocked by your organization's CID222 AI-usage policy. Detected: … Remove the sensitive content and try again. — a 400 rather than a 403 deliberately, because Claude Code reads an authorisation status as a credential failure and sends the developer chasing a login problem that does not exist.

Verify

1. After a developer starts a session, the Developers tab lists their seat and Sessions is at least 1.
2. Have them send a prompt containing a test value your profile flags. Within the refresh, the Policy tab shows the rule with a non-zero hit count.
3. Open Event logs and filter for the developer. Clean activity is written as CLAUDE_CODE_ACTIVITY, token counts as CLAUDE_CODE_USAGE, and a policy decision as MESSAGE_BLOCKED or MESSAGE_MASKED — the outcomes are recorded with the product's general security event types, not with Claude-Code-specific ones.
4. The same events appear on All detections with the source set to Claude Code.
5. If you enabled routing, /health on the proxy host reports the Anthropic mode as passthrough.

If it fails

• Could not load activity. The plugin telemetry endpoint may not be reachable yet. — the page could not read the activity endpoint. It appears before any plugin has ever reported in, and also on a genuine failure; there is no retry button.
• No Claude Code activity yet with No agent has reported in this window. — nothing has reported. Check that a developer has actually started a session since the plugin was installed, and widen the range.
• A seat shows as unmapped — set that tenant's contact email to the seat's email. Existing events stay unattributed; only newer activity is linked.
• The developer's session banner says the gateway rejected the inspection key — the key is wrong, revoked, or absent. Issue a new one on Access keys and redistribute.
• The developer's session banner reports a 404 from the inspect endpoint — the gateway address is wrong, so nothing is being inspected and the hooks are failing open. Fix the plugin's gateway setting.
• CID_HOST is not set. Run: CID_HOST=https://cid.company.local bash install.sh — the installer was piped to a shell without the host prefix.
• claude CLI not found — install Claude Code first. / unzip not found — install it first. — install prerequisites missing on the developer's machine.
• could not create the Claude Code group in the setup wizard — the tenant group could not be created. Create it by hand on Tenant groups and retry.
• A PDF export downloads but will not open — the renderer was unavailable and the appliance returned an explanatory response the browser saved as the .pdf file. Export as CSV, XLSX or HTML instead.

Known gaps

• The install URL is not settled. The plugin distribution files are served by the dashboard's web server, so the installer lives on the dashboard origin, while one repository document claims the API origin. Fetch the URL once before you circulate it to developers.
• The code-safety gate is plugin-side only. The plugin's pre-tool-use gate, session audit and repository baseline expect endpoints this build does not serve, so those hooks fail open into a no-op. Nothing about them appears on this page.
• Numbers can differ slightly between tabs. The Overview counts a hit as flagged only when a detection count is present; the Policy tab counts any non-blocked, non-masked row that carries a reason.
• Parts of the page are hard-coded English, including the chart subtitles, the day names on the heatmap, the export format names and the whole setup-wizard step.
• Sessions before plugin 0.5.1 are missing, because those versions sent no session id. The page says so above the table.

Next steps

• Security filters — where the group overrides that make up the Claude Code profile are set.
• All detections — Claude Code verdicts beside every other surface.
• Repository tracking — the other code-safety surface: scanning the repositories themselves rather than what a developer typed.
• Access keys — issue and rotate the key the plugin authenticates with.