Claude Code

Connect Claude Code to LatchGate so every tool call goes through the execution security kernel.

Prerequisites

• LatchGate running (latchgate up or production deployment)
• latchgate-mcp binary on PATH (from GitHub Releases or brew install latchgate-ai/tap/latchgate)
• Claude Code installed (npm install -g @anthropic-ai/claude-code)

Automatic setup

latchgate-mcp install --ide claude-code

This writes the MCP server entry to ~/.claude/settings.json under the mcpServers key. Start a new Claude Code session to pick up the configuration.

Preview first without writing:

latchgate-mcp install --ide claude-code --dry-run

Manual setup

Add to ~/.claude/settings.json:

{
  "mcpServers": {
    "latchgate": {
      "command": "/usr/local/bin/latchgate-mcp",
      "args": ["serve", "--gate-url", "http://localhost:3000"],
      "env": {
        "LATCHGATE_AGENT_ID": "claude-code",
        "RUST_LOG": "warn"
      }
    }
  }
}

Adjust the binary path if installed elsewhere. Use which latchgate-mcp to find it.

Alternatively, use the Claude Code CLI:

claude mcp add latchgate \
  --scope user \
  --env LATCHGATE_AGENT_ID=claude-code \
  --env RUST_LOG=warn \
  -- latchgate-mcp serve --gate-url http://localhost:3000

Project-scoped configuration

For team sharing via git, use project scope. This writes to .mcp.json at the project root:

claude mcp add latchgate \
  --scope project \
  --env LATCHGATE_AGENT_ID=claude-code \
  --env RUST_LOG=warn \
  -- latchgate-mcp serve --gate-url http://localhost:3000

Every developer who clones the repo gets the same LatchGate MCP configuration automatically.

End-to-end verification

1. Start LatchGate: latchgate up --expose-http 127.0.0.1:3000
2. Install config: latchgate-mcp install --ide claude-code
3. Start a new Claude Code session.
4. Ask Claude Code to perform an HTTP request (e.g. “fetch https://httpbin.org/get via latchgate”).
5. Verify the audit trail: latchgate audit --limit 5
6. Confirm the full pipeline: lease ⇒ policy ⇒ WASM sandbox ⇒ receipt.

Combining with the agent sandbox

Claude Code is a terminal agent that can run shell commands and edit files. For defense-in-depth, run Claude Code inside LatchGate’s agent sandbox so the process itself is contained:

latchgate sandbox -- claude-code

Inside the sandbox, Claude Code runs in Linux namespaces with an empty network stack. It can only reach external systems through LatchGate (via the gate UDS) and the LLM API (via the HTTPS proxy). See Agent Sandbox for the full configuration reference.

When combining sandbox + MCP:

• The sandbox gives containment — Claude Code’s built-in tools (bash, file edit) are restricted to the sandbox namespace.
• The MCP adapter gives controlled external access — actions like HTTP calls, database writes, and email go through the gate’s full pipeline.

Production (UDS transport)

Replace --gate-url with UDS + public base URL for production:

{
  "mcpServers": {
    "latchgate": {
      "command": "/usr/local/bin/latchgate-mcp",
      "args": ["serve", "--public-base-url", "http://localhost:3000"],
      "env": {
        "LATCHGATE_AGENT_ID": "claude-code",
        "RUST_LOG": "warn"
      }
    }
  }
}

This connects via /run/latchgate/gate.sock (default) — no TCP exposure.

For production hardening with UDS transport, see Deployment.