[ CLAUDE CODE SECURITY ]
Claude Code with production access is a production actor.
It runs shell commands, edits files, and calls MCP tools carrying your credentials — GitHub, AWS, databases, internal APIs. Securing it means constraining what it can execute, not trusting the model to behave.
[ THE RISK IN ONE PARAGRAPH ]
Claude Code reads untrusted content as part of its job — issue threads, pull-request comments, documentation, web pages. Prompt injection in any of it can steer what the agent does next, and what this agent does next is executed against real systems. The blast radius is exactly whatever its credentials and connected tools allow. That is the number to shrink.
[ THREE LAYERS OF CONTROL ]
In-agent controls
Claude Code ships with permission prompts, allowlists, and hooks that can veto a tool call before it executes. Configure all of it — it is the cheapest control you have. sentnel is our free, open-source PreToolUse hook that blocks dangerous calls against YAML rules, from inside the agent's own lifecycle.
Credential scoping
Every deployment gets its own dedicated identity and least-privilege tokens scoped to the task — never a human's credentials, never a shared bot account. Whatever steers the agent, it cannot use permissions its tokens do not carry.
Out-of-process enforcement
The SentnelOps MCP firewall — a proxy in your VPC between Claude Code and its MCP servers. Every tool call is evaluated against YAML policy before the server sees it — permit, block, or a Slack approval — under 15ms p99, with every decision logged to your own database.
[ WHY IN-PROCESS ISN'T ENOUGH ]
Settings, allowlists, and hooks run inside the agent's environment — inside the blast radius, in the same process and context an injected prompt influences. A proxy in the request path shares none of that: policy is enforced in a separate process no prompt can reach, so a blocked call never leaves your network, no matter what happened inside the session. That is AI agent runtime governance applied to a coding agent: put the control where the agent cannot reach it, and keep the audit trail on the far side too — every call, permitted or blocked, attributed to a specific deployment.
Put policy between Claude Code and production
Point Claude Code's MCP configuration at the proxy — first call logged in under 10 minutes, Scout is free. Or see what your agents can actually do first: we run a 10-day governance assessment in your own VPC.
Related: MCP firewall · MCP security