Claude Code security
Claude Code can touch your whole stack. Decide what it's allowed to do.
What actually goes wrong
A coding agent is a privileged developer runtime. The risk isn't that Claude Code is careless, it's that attacker-controlled text and standing credentials share the same context.
Prompt injection
Malicious instructions hidden in a README, a ticket, a web page, or an MCP tool response. The model can't reliably separate data from commands, so it follows both. OWASP's 2026 Top 10 for Agentic Applications ranks agent goal hijacking the number-one risk.
Approval fatigue
Permission prompts only work if a human reads them. Developers rubber-stamp dozens per session, and the --dangerously-skip-permissions flag removes the prompt entirely.
Credential exposure
API keys and tokens sit on the developer's machine. Anything the agent can read, env vars, config, or a leaked transcript, can leak the live secret.
Drift across a team
Built-in permissions and managed settings are configured per device. Without a central enforcement point, every laptop runs a slightly different policy.
One line to wire it up
Point Claude Code at the gateway.
Add the Clawvisor skill and Claude Code fetches data through the gateway on port 25297 instead of calling services directly. Every tool call now passes through a gateway that verifies, vaults, and logs, without changing how your team works.
Containment
Agents start with zero standing access and get tools per task, revoked when the task ends. A compromised prompt can only reach what the task already needed.
Credentials
Real secrets stay in the vault, and the agent is handed nothing that stands in for them. Clawvisor attaches the real key inside the gateway at call time. This is exactly the security boundary Anthropic's own secure-deployment guide recommends: inject credentials via a gateway outside the agent's environment so the agent never sees them.
Observability
Every tool call, argument, and decision lands in a complete, replayable audit trail tied to the task and the human who approved it. Audit by default, not telemetry you have to wire up.
Built-in controls, plus a gatekeeper
Claude Code's permissions, sandbox, and write restrictions are genuinely good defaults. Clawvisor adds an independent enforcement layer in front, so a bypass inside the agent never reaches your data.
| Capability | Clawvisoragent gatekeeper | Claude Code built-in |
|---|---|---|
| Enforcement point | In the network path (gateway) | Inside the agent process |
| Credential handling | Vaulted; agent never gets a credential | Stored on the dev machine; readable by the agent |
| Prompt-injection blast radius | Scoped per task, fail-closed | Permission prompts (subject to approval fatigue) |
| Audit trail | Complete, replayable, per task by default | Telemetry, self-configured |
| Team policy | Central, enforced for every task | Managed settings, per device |
| Coverage | Any agent or MCP server | Claude Code only |
Frequently asked
Does Clawvisor replace Claude Code's permissions?
No. It adds an independent layer in front. Keep your permission rules and sandbox; Clawvisor enforces scope, vaults credentials, and logs every call at the gateway.
How does Clawvisor stop prompt injection?
It can't stop the model from being talked to, but it contains the result: an injected instruction can only use tools the task already authorized, and high-blast-radius actions stop for a human.
Do I have to change my Claude Code setup?
You add the Clawvisor skill once. It routes data access through the gateway. There are no agent code changes.
Does the agent ever see our real API keys?
No. Secrets stay encrypted in the vault, and the agent gets no credential at all — the gateway attaches it server-side at call time.
Can we self-host?
Yes. The gateway source is public — read it, audit it, and run it inside your own infrastructure.
Does this work for agents other than Claude Code?
Yes. The same gateway governs MCP servers and other agents.
Put a gateway in front of Claude Code.
Run the gateway yourself, or point your agents at the Clawvisor gateway in one line.