Claude enterprise security: controls, risks, and best practices

In early 2026, Check Point Research disclosed CVE-2025-59536 - a CVSS 8.7 vulnerability in Claude Code that allows remote code execution through malicious project configuration files before any trust dialog appears. A second CVE, CVE-2026-21852, demonstrated how an attacker can redirect all Claude Code traffic to an attacker-controlled server by manipulating the ANTHROPIC_BASE_URL environment variable, silently exfiltrating API keys and conversation content.

These are not theoretical risks. They are documented, reproducible attack chains that affect any organization that has deployed Claude Code without centralized governance.

Claude Code is now running on developer machines across thousands of enterprises. Most of those deployments share the same characteristics: developers authenticate with personal Anthropic accounts, API keys live in environment variables or .bash_profile, there is no audit trail of what code context flows to Anthropic's servers, and there is no mechanism to revoke access when an engineer leaves the organization.

The security problem isn't Claude Code itself. It's the assumption that a developer tool requires developer-level governance.

This guide covers the six control layers every platform engineering and security team needs to deploy Claude Code safely at enterprise scale from SSO and identity to MCP governance, sandboxing, audit logging, and compliance. It also covers where TrueFoundry's AI Gateway and MCP Gateway fit as the centralized enforcement layer across all of them.

Secure Claude access across your engineering teams

Control model access, enforce security policies, and manage AI usage through a centralized gateway with TrueFoundry.

Book a Demo

What are the main Claude enterprise attack surfaces?

Before addressing security controls, you need to understand how each Claude interface interacts with your environment. Claude.ai primarily raises data exposure risks, Claude Desktop introduces local tool access, and Claude Code can access files, execute shell commands, and connect to external services. Each requires different security controls.

Claude.ai web

Claude.ai's main risks include sensitive data entering prompts, unauthorized file uploads, and employees using personal accounts outside enterprise policies.

Security priorities: Enforce SSO and domain capture, apply DLP policies, and manage data retention and access.

Claude desktop

Claude Desktop can connect Claude to local resources and external tools. Unvetted integrations may expose files, internal APIs, databases, or other enterprise systems.

Security priorities: Approve integrations, restrict resource access, manage endpoints through MDM, and require confirmation for sensitive actions.

Claude code

Claude Code operates in the developer's terminal with the local user's permissions, creating risks across four areas:

1. File system access. Without explicit deny rules, Claude Code can read .env files, SSH keys, credentials stored in ~/.aws/credentials, and any file the local user has access to. In a typical developer environment, this means access to secrets that were never intended to leave the machine.

2. Shell execution. Claude Code can run arbitrary bash commands in the developer's user context. A malicious prompt, either directly injected or arriving through an MCP tool's response can trigger shell commands without explicit per-command approval unless disableBypassPermissionsMode is set.

3. ANTHROPIC_BASE_URL manipulation (CVE-2026-21852). If an attacker can modify the environment where Claude Code runs — through a malicious .claude/settings.json in a repository, a compromised dotfile, or a hook injection — they can redirect all traffic to a server they control. Every prompt, response, and API key transmitted during that session is captured.

4. MCP tool misuse and prompt injection. MCP servers connect Claude to external systems. Without a governance layer, developers can connect Claude to any MCP server - including malicious ones with tool descriptions designed to alter Claude's behavior. Content retrieved by MCP tools from external sources (web pages, documents, API responses) can contain injected instructions that Claude executes silently.

Claude enterprise attack surfaces and security priorities

MCP-connected Claude is not a separate Claude application equivalent to Claude.ai, Claude Desktop, or Claude Code. It describes the integration layer through which an existing Claude interface or workflow accesses external tools and data. Its security controls should therefore complement the controls applied to the interface using it.

Identity and access configuration

SSO should be live before you hand Claude to a single developer — not after, and certainly not "soon."

Claude supports SAML 2.0 and OIDC with Okta, Azure AD (Entra ID), Auth0, and Google Workspace, and you can manage all of it from the Claude Admin Console (see the setup guide). Three settings matter most at this stage.

Critical SSO configuration steps

• Enable Require SSO for Console and Require SSO for Claude. Both settings enforce SSO-based authentication and inherit MFA from your identity provider.
• Claim your corporate email domains through domain capture. Once active, any sign-in attempt with a company address automatically routes to the enterprise workspace, preventing employees from reverting to personal accounts across any interface.
• Map your Identity Provider (IdP) groups to Claude roles. Primary Owner gets full admin access, including billing. Admin manages users, policies, and audit logs, but cannot touch billing, and Member uses Claude within admin-defined policies.

Revoking someone in your IdP drops their access across web, desktop, and CLI instantly.

API key management

SSO handles interactive logins, while API keys handle everything else — Claude Code sessions, CI/CD pipelines, and any automation hitting the API outside a browser.

You should issue keys through the Admin Console because developers should never use personal keys in a corporate context. Store them in AWS Secrets Manager, HashiCorp Vault, or Azure Key Vault, rotate them quarterly, and revoke them immediately on suspected compromise or when someone leaves the team.

RBAC and least privilege

Use role-based access control (RBAC) to ensure employees and AI agents access only the resources and tools required for their roles. Restrict access to sensitive repositories, internal APIs, and MCP tools, and avoid granting broad permissions by default.

Review permissions regularly and revoke access when roles change. For Claude Code, enforce centrally managed permission settings and limit file-system, shell, and tool access to approved workflows. For MCP integrations, apply least-privilege access to individual tools and connected data sources.

Model access and traffic routing

After identity, the next layer is model access and traffic routing. You need answers to two questions: which models can developers use, and where does their Claude traffic actually flow?

Restricting the model set

A simple allowlist in the Admin Console stops developers from switching to higher-cost or unapproved models:

{  "allowedModels": ["claude-sonnet-4-5", "claude-haiku-4-5"]}

Centralizing Claude API traffic through an AI gateway

Routing Claude traffic through your own LLM gateway lets you inspect, log, and govern requests at the network layer. You can set these environment variables on developer machines to get started:

export ANTHROPIC_BASE_URL=https://your-gateway.internal.corp

export HTTPS_PROXY=https://proxy.your-company.com:8080

One important detail is that these variables apply only to Claude Code and Claude Desktop. Web routing is controlled at the organization level through the Admin Console.

MDM vs server-managed settings vs direct cloud providers

Setting variables on one machine is easy, but doing it across 100 machines and ensuring nobody changes them is the real challenge.

You can enforce routing policies across developers’ machines in three ways:

• MDM / Endpoint-Managed Settings push a managed-settings.json file to every machine via Jamf, Kandji, or Intune. Claude Code reads the file at startup with no network dependency, and the settings are tamper-resistant at the OS level. The tradeoff is that MDM only works on corporate-owned devices.
• Server-Managed Settings (Beta) delivers configuration from Anthropic's servers when developers authenticate. No file deployment is needed, and the approach works on BYOD devices. The catch is that enforcement is client-side only, so a developer with sudo can tamper with it. The approach is also incompatible with custom ANTHROPIC_BASE_URL, so if you route through a gateway, this option is off the table.
• Direct Cloud Provider routes Claude Code to your AWS Bedrock or Google Vertex account. Traffic stays in your VPC with cloud-native audit logging, but the downside is single-provider lock-in and complex IAM setup.

Multi-provider routing

Instead of configuring each provider one by one, TrueFoundry AI Gateway gives you a single proxy layer between Claude Code and all your model providers. You can point Claude Code at it with one variable:

export ANTHROPIC_BASE_URL=https://<your-truefoundry-gateway-url>

From there, you add provider accounts in the Gateway dashboard, and Claude Code reaches all of them — Anthropic, Bedrock, Vertex — via a single endpoint. Virtual Models let you create a single model identifier that routes across providers with weight-based or latency-based logic, and you can switch providers without touching any client configuration.

The Gateway also enforces rate limits, budget limits, and access control on every request before it reaches the provider.

Claude traffic routing options

Local tool access and sandboxing

The mistake most teams make is treating all three interfaces the same, even though they are fundamentally different in what they can touch.

Claude.ai

The web interface has no local code execution, so the primary risks are data exfiltration through prompts and shadow IT from personal accounts. Domain capture solves the second problem. 

For the first, classify Claude.ai as a third-party SaaS tool in your data loss prevention (DLP) and AI security tooling and apply the same controls you would to Google Docs or Notion. The Admin Console also lets you restrict file uploads, disable Artifacts, and control conversation retention.

Claude desktop

The desktop app does not run arbitrary shell commands by default, but local tool integrations let developers connect Claude to scripts, file systems, and other resources. You should review each tool before approval and require explicit human confirmation before execution for anything with write access. Keeping the app current via MDM-enforced auto-update is also essential.

Claude Code

Claude Code has the broadest attack surface of the three interfaces. It can read .env files, SSH keys, and credentials, run arbitrary bash commands in the developer's user context, and send code and context to Anthropic's servers for processing.

The following baseline managed-settings.json blocks the most dangerous operations:

{  "permissions": {    "disableBypassPermissionsMode": "disable",    "deny": [      "Bash(curl:*)", "Bash(wget:*)",      "Read(**/.env)", "Read(**/.env.*)",      "Read(**/secrets/**)", "Read(**/.ssh/**)",      "Read(**/credentials/**)"    ],    "ask": ["Bash(git push:*)", "Write(**)"]  },  "allowManagedPermissionRulesOnly": true,  "allowManagedHooksOnly": true,  "transcriptRetentionDays": 14}‍

Here is what each key setting does:

• disableBypassPermissionsMode stops developers from using --dangerously-skip-permissions to override safety controls.
• allowManagedPermissionRulesOnly locks out project-level and user-level permission overrides entirely.
• deny rules block operations outright with no override possible.
• ask rules require explicit developer approval before each execution.

One more thing worth emphasizing: Claude Code should never run as root under any circumstances.

Native sandboxing and permission controls

Claude Code's native sandbox enforces filesystem and network isolation at the OS level, using Seatbelt on macOS and bubblewrap on Linux. Anthropic's own internal testing found that sandboxing reduces permission prompts by 84% while maintaining stronger execution boundaries. You should enable it for all developers:

{  "sandbox": {    "enabled": true,    "network": { "httpProxyPort": 8080, "socksProxyPort": 8081 }  }}

The sandbox prevents modification of system-level files, blocks contact with domains you have not allowed, and limits the blast radius of prompt injection attacks. You should also set "allowUnsandboxedCommands": false to close the escape hatch that would otherwise let commands run outside the sandbox.

MCP server governance

MCP servers connect Claude to external tools, databases, APIs, and SaaS applications. Without centralized governance, every new connection can introduce additional permissions, credentials, and potential entry points for attackers.

Why MCP expands Claude's attack surface

MCP extends Claude's access beyond conversations to systems that can read data or perform actions. An overly permissive server could expose sensitive records, while a malicious tool response could contain prompt injection instructions that attempt to trigger unauthorized actions.

What happens without MCP governance

Unmanaged MCP access creates several risks:

• Shadow MCP servers: Developers connect unapproved servers without security review.
• Credential sprawl: API keys and credentials are scattered across local configurations.
• Excessive permissions: Tools receive broader access to files, databases, or internal APIs than they need.
• Data exfiltration: Malicious tools or injected instructions cause sensitive data to be sent to external services.

Centralized MCP gateway

Route MCP connections through a centralized gateway instead of allowing developers to connect to arbitrary servers directly. TrueFoundry MCP Gateway provides a central registry for approved servers, authentication, role-based access control, and tool-level permissions. You can also restrict access to specific tools and apply guardrails before execution.

Configure Claude Code to allow only approved MCP gateway endpoints, and enforce the policy through managed settings. This reduces shadow MCP usage and makes access easier to govern across teams.

Monitoring MCP tool usage

Log MCP tool calls with user identity, the tool invoked, request and response details, and execution outcomes. Monitor unusual access patterns, repeated denied requests, and unexpected transfers of sensitive data. Integrate these logs with your existing security monitoring system so your team can investigate suspicious activity and trace actions back to the user or workflow that initiated them.

Data protection, retention, and compliance

Data protection requires more than choosing an enterprise plan. You need to define how long conversations are retained, where data is processed, who can access it, and which contractual safeguards apply to regulated workloads.

Data retention across Claude interfaces

Retention varies by interface and configuration. Claude.ai organization settings control conversation retention, while Claude Code stores local session transcripts under ~/.claude/. Check your organization's retention policy and configure managed settings to enforce approved limits. 

Zero data retention

Anthropic offers Zero Data Retention (ZDR) for eligible API usage through an approved arrangement. Contact your account team to confirm eligibility, contractual terms, and which features are covered. ZDR does not automatically apply to Claude.ai, Claude Desktop, or every Claude Code configuration.

SOC 2

Anthropic provides SOC 2 Type II compliance documentation through its Trust Center. Review the report's scope and date, then maintain your own access reviews, audit logs, vendor risk assessments, and provisioning and deprovisioning procedures. 

HIPAA

If you process protected health information (PHI), confirm that your specific Claude offering supports HIPAA-regulated workloads and that the required contractual arrangements are active. Verify feature eligibility, access controls, and audit requirements before sending PHI. ZDR alone does not establish HIPAA compliance.

GDPR

For GDPR-regulated workloads, document your lawful basis for processing, retention and deletion procedures, and applicable data-transfer safeguards. Where EU data residency is required, configure supported geographic controls and verify where inference and data storage occur. TrueFoundry's AI Gateway can help enforce approved routing policies.

EU AI Act

Assess how your organization uses Claude and whether your role and application fall under specific EU AI Act obligations. Depending on the use case, requirements may include risk management, documentation, human oversight, and transparency. Integrate applicable obligations into your AI governance process rather than assuming the model provider covers them all.

ISO 27001

Anthropic lists ISO 27001:2022 among its certifications. Review the certificate's scope and validity, and maintain your own information security controls, including risk assessments, access management, incident response, and supplier reviews.

Audit logging and cost controls

You need visibility into Claude usage across interfaces to investigate incidents, detect policy violations, and control spending. Centralize logs, attribute activity to users, and set budget limits before rolling out Claude across teams.

What to log across Claude interfaces

Capture the events relevant to each interface:

• Claude.ai: Session activity, file uploads, and conversation metadata.
• Claude Desktop: MCP server connections, tool invocations, and external service calls.
• Claude Code: Tool usage, file access, shell commands, and denied actions.

Export audit logs to your SIEM regularly. A 90-day retention period is a useful baseline, but verify the requirements of your compliance framework and internal policies before setting a final retention period.

Centralized observability

Route Claude requests through TrueFoundry AI Gateway to trace LLM and MCP activity with user attribution. Its unified observability dashboard helps teams monitor usage, latency, and errors. Export telemetry to tools such as Grafana, Datadog, or Splunk using OpenTelemetry.

You can also configure native OpenTelemetry export in Claude Code's managed settings for visibility into CLI activity.

Detecting policy violations and suspicious activity

Monitor repeated permission denials, unexpected shell commands, unusual MCP tool calls, access to sensitive files, and unexplained outbound data transfers. Alert your security team when activity deviates from approved usage patterns.

For cost control, configure monthly spending limits per user and team. Track usage by user and model to identify unexpected spikes, investigate misconfigured pipelines, and support internal chargeback reporting.

What to Log Across Claude Interfaces

Claude enterprise security checklist for engineering teams

Use this checklist to evaluate whether your Claude deployment has the right controls before rollout and as usage expands across engineering teams.

Authentication and access

• Enforce SSO and corporate identity policies.
• Apply RBAC and least-privilege access to users, teams, and resources.
• Review permissions regularly and revoke access when roles change.

Model and provider controls

• Maintain an approved list of models and providers.
• Route requests through approved endpoints and enforce provider policies.
• Restrict unauthorized model access and monitor usage by team.

Tool and MCP governance

• Maintain an allowlist of approved MCP servers.
• Review tool permissions and restrict access to required resources.
• Require approval for sensitive actions and monitor tool invocations.
• Block unapproved integrations and investigate shadow MCP usage.

Data protection

• Define retention policies for conversations, transcripts, and logs.
• Restrict sensitive data in prompts, uploads, and tool responses.
• Confirm ZDR eligibility and contractual requirements before processing regulated data.
• Enforce applicable data residency, deletion, and privacy requirements.

Observability and auditability

• Log user activity, tool calls, file access, and denied actions where supported.
• Export relevant logs and traces to your SIEM or observability platform.
• Configure alerts for suspicious activity, policy violations, and unusual usage.
• Establish appropriate log retention periods.

Compliance

• Review relevant SOC 2 reports and vendor security documentation.
• Validate HIPAA safeguards and contractual requirements before processing PHI.
• Document GDPR obligations and applicable EU AI Act requirements.
• Verify the scope of relevant ISO 27001 certifications and maintain your own security controls.

Claude Code execution controls

• Enable native sandboxing and restrict file-system and network access.
• Enforce managed permission settings and disable unauthorized permission-bypass modes.
• Protect API keys, environment variables, and other secrets.
• Restrict shell commands and require approval for high-impact operations.
• Review repository configuration and hooks before trusting a project.
• Test controls against prompt injection, malicious tool responses, and unauthorized command execution.

Bring MCP governance and AI visibility into one place

Manage approved MCP connections, apply access controls, and trace model and tool activity across your AI workflows with TrueFoundry.

Book a Demo

How TrueFoundry secures Claude at enterprise scale

TrueFoundry helps engineering and security teams govern Claude usage through a centralized AI Gateway. Instead of managing model access, credentials, policies, and monitoring separately across teams, you can apply consistent controls across approved Claude integrations.

• Centralized access control: Route model requests through approved endpoints and enforce authentication, RBAC, and team-level policies.
• MCP governance: Manage approved MCP servers, control tool access, and monitor interactions with external systems.
• Secure model access: Centralize provider credentials and govern access to approved models without distributing API keys across developer environments.
• Observability and cost management: Trace requests, attribute usage to users or teams, monitor errors, and track model spending.
• Deployment flexibility: Deploy within your cloud or infrastructure environment to align model access with your organization's security and data-handling requirements.

For engineering teams, the goal is to make Claude easier to adopt without losing visibility into who can access it, which tools it can use, and how requests are governed.

Conclusion

Securing Claude is not one decision but a stack of them — identity, model routing, sandboxing, MCP governance, data retention, audit logging, and cost controls — each applied differently depending on the interface. The web version needs DLP controls and domain capture. The desktop app needs a tool-by-tool review. Claude Code needs a locked-down managed-settings.json deployed via MDM with native sandboxing enabled.

The common thread across all three is that you should route traffic and MCP access through a centralized gateway you control. 

One endpoint, one policy set, and one audit trail. TrueFoundry AI Gateway provides that layer for both LLM traffic and MCP server governance, with built-in access control, rate limiting, guardrails, and observability. 

Book a demo to see how it works.

Start with SSO and domain capture today, then enforce managed settings across your fleet, and route everything through a gateway you control. The CVEs are real, and the exposure grows with every developer who opens Claude Code.