Claude Desktop

Connect Claude Desktop to LatchGate so every tool call goes through the execution security kernel.

Prerequisites

• LatchGate running (latchgate up or production deployment)
• latchgate-mcp binary on PATH (from GitHub Releases or brew install latchgate-ai/tap/latchgate)

Automatic setup

latchgate-mcp install --ide claude

This writes the MCP server entry to Claude Desktop’s config file:

• macOS: ~/Library/Application Support/Claude/claude_desktop_config.json
• Linux: ~/.config/Claude/claude_desktop_config.json
• Windows: %APPDATA%/Claude/claude_desktop_config.json

Restart Claude Desktop to pick up the new configuration.

Manual setup

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "latchgate": {
      "command": "/usr/local/bin/latchgate-mcp",
      "args": ["serve", "--gate-url", "http://localhost:3000"],
      "env": {
        "LATCHGATE_AGENT_ID": "claude-desktop",
        "RUST_LOG": "warn"
      }
    }
  }
}

Adjust the binary path if installed elsewhere. Use which latchgate-mcp to find it.

End-to-end verification

1. Start LatchGate: latchgate up
2. Install config: latchgate-mcp install --ide claude
3. Restart Claude Desktop — LatchGate tools should appear in the tools list.
4. Ask Claude to perform an action (e.g. “fetch https://httpbin.org/get”).
5. Verify the audit trail: latchgate audit --limit 5
6. Confirm the full pipeline: lease => policy => WASM sandbox => receipt.

Production (UDS transport)

For production, replace --gate-url with UDS + public base URL:

{
  "mcpServers": {
    "latchgate": {
      "command": "/usr/local/bin/latchgate-mcp",
      "args": ["serve", "--public-base-url", "http://localhost:3000"],
      "env": {
        "LATCHGATE_AGENT_ID": "claude-desktop",
        "RUST_LOG": "warn"
      }
    }
  }
}

This connects via /run/latchgate/gate.sock (default) — no TCP exposure.

For production hardening with UDS transport, see Deployment.