Claude Firewall

The surface

Claude on the endpoint

Anthropic ships four distinct agent runtimes that read, write, and execute on the device — sanctioned or not.

CLI agent

Claude Code

Terminal agent that reads/writes files, runs shell commands, and spawns sub-agents. Configured in ~/.claude/ and ~/.claude.json; a bypassPermissions mode disables prompts entirely.

Desktop agent

Claude Desktop & Cowork

The same agentic engine, no terminal required. Runs inside a local VM with read/write access to user folders, parallel sub-agents, and scheduled recurring tasks.

Browser agent

Claude in Chrome

Extension that navigates, clicks, fills forms, and reads page and network content on the user's behalf.

Full desktop control

Computer Use

Screen, mouse, and keyboard control across applications — actions that land outside any Claude-managed sandbox.

Where the risk lives

An unsigned, auto-loading supply chain

Attack surface

Skills — SKILL.md files in ~/.claude/skills/ auto-load next session. No signing, no sandbox, no review; distributed through open registries.
MCP servers — local stdio servers spawn arbitrary processes; credentials sit in plaintext in ~/.claude.json and .mcp.json. One rewrite redirects authenticated traffic.
Hooks — event-driven shell commands in hooks/hooks.json execute on session start and around every tool call.
Context files — CLAUDE.md injects instructions into every session in a project.
Personal accounts — personal Pro/Max logins run the full agent stack on corp machines, outside enterprise tenancy.

Documented in the wild

Poisoned skills at scale — independent research found roughly a third of publicly shared skills carried flaws, from embedded secrets to malware droppers.
MCP command injection — stdio command-injection issues across official MCP SDKs; malicious npm packages observed rewriting ~/.claude.json post-install.
Hook-based RCE — project-file hooks used as a remote-code-execution vector (patched, class persists).
Browser injection — zero-click prompt-injection chains against the Chrome extension's allowlist.

Native controls stop at policy files. Anthropic's managed-settings.json gives static allow/deny lists, and enterprise audit surfaces cover chat — but desktop agent activity runs in a VM your EDR can't see into, MCP payloads are never inspected, and skills load with no scan. Personal accounts see none of it.

Admin plane integration

We plug into your Claude admin console

Ospiri connects to Anthropic's enterprise admin surfaces and correlates what the console reports with what actually happened on the device.

What Anthropic's admin plane exposes

Claude admin console — seat & member management, connector/MCP enablement, and server-pushed Claude Code managed settings that override local policy.
Compliance API (Enterprise) — an audit feed of 150+ activity types plus on-demand retrieval of conversations, projects, memories, and uploaded files.
Claude Code Analytics & Usage/Cost APIs — per-user sessions, lines of code, acceptance rates, and spend by model.
SCIM & Admin API — directory sync, org members, workspaces, API keys.

What Ospiri does with it

Ingest & correlate — the Compliance API activity feed and Code analytics are joined with kernel-level endpoint telemetry: the console says a session happened; Ospiri shows what it touched.
Close the console's blind spots — Cowork VM activity and personal-account sessions never reach the admin plane; Ospiri sees both and reconciles them against the tenant.
Push policy back — findings map onto managed-settings deny rules and connector permissioning, so enforcement lands in both planes.

Endpoint or cloud — same firewall. The same coverage applies whether Claude runs on a laptop, in VDI, or as an API-built agent on AWS Bedrock or Anthropic's platform: admin-plane signals in, runtime control at the point of action.

The fix

How Ospiri governs Claude

Visibility

Inventory every Claude runtime on the fleet — Code, Desktop, Cowork, extension — including activity inside the local VM. Flag personal-key sessions vs. enterprise accounts, the gap no tenant control closes.

Sandboxing

Path and secret fences keep Claude Code out of .env, /secrets, and production paths. Risky writes land in a copy-on-write sandbox — the agent keeps working, your data never moves.

Anomalies

Per-agent baselines catch the session that suddenly touches /finance, spawns unusual sub-agents, or calls new domains at 3am — correlated across endpoint, browser, and identity.

Skills

Every SKILL.md, hook, and CLAUDE.md is scanned pre-flight and re-scanned on update — poisoned instructions, embedded secrets, and unapproved workflows blocked before a line executes.

MCP

Discover every server configured in ~/.claude.json and .mcp.json, monitor tool-call traffic in flight, and enforce per-agent allow-lists — rogue and look-alike servers surfaced, every call logged and replayable.

The Claude Firewall