Claude Code security hardening for engineering teams

Claude Code security hardening matters because the agent operates at the boundary between a model and a workstation: it reads code, edits files, executes commands and connects to MCP services. The permission system constrains some risks, but cannot know the value of every file or impact of every command.

Begin with the assumption that repositories, documentation and tool output can contain prompt injection.

Deny by default

Claude Code uses a permission architecture in which sensitive operations require approval. Do not turn it into a broad automatic allowlist after one day.

Review /permissions and separate:

• safe project-scoped read-only activity;
• constrained build and test commands;
• operations requiring one-time approval;
• prohibited tools and paths.

The --dangerously-skip-permissions flag bypasses prompts and the documentation warns users to take care. Do not use it on a workstation containing secrets, production credentials or broad network access.

Isolate the filesystem

Run the agent in a worktree or devcontainer. Mount only required directories. Home directories, Docker sockets, SSH keys, cloud profiles and caches should not be available without a specific need.

Anthropic describes write restrictions to the starting directory and its descendants unless more access is approved. Still inspect symlinks, mounts and tools capable of writing outside the project.

In CI, use an ephemeral runner, read-only base image and separate output volume. Destroy the environment after the task.

Keep secrets outside context

Never paste tokens into prompts, CLAUDE.md, issues or logs. Inject them directly into a constrained process from a secrets manager. Tokens need short TTLs, one audience and minimal scope.

Scan for secrets before sending context and before commits. If the agent reads a secret, treat it as potentially exposed and inspect logs and retention.

Safe Bash rules

An allowlist should constrain exact prefixes and arguments rather than all of bash. A test command may execute hooks, package scripts and dependency code. Therefore:

• pin lockfiles and trusted registries;
• disable unnecessary install scripts;
• run as an unprivileged user;
• restrict egress;
• inspect diffs after formatters and generators;
• require approval for interpreters executing arbitrary inline code.

A read-looking command can execute project configuration. Evaluate effect rather than executable name.

MCP is an external trust boundary

Anthropic states that it does not manage or audit arbitrary MCP servers. Install only servers with a confirmed owner, version and source. Give each a separate identity and tool set.

Block repository content from adding unknown MCP services dynamically. Validate argument schemas on the server and require confirmation for high-impact actions. Use the full MCP security model.

Proxy and network access

Route enterprise traffic through a proxy or LLM gateway for central authentication, limits, model controls and audit. Claude Code documentation lists API, telemetry and error-reporting endpoints; allow only required domains.

Do not hard-code proxy passwords. For a private CA, configure a certificate bundle and verify the chain instead of disabling TLS.

Team monitoring

Collect OpenTelemetry metrics and log user, repository, model version, permission decisions, tool calls and effects. Redact secrets and specially protected code.

Alert on --dangerously-skip-permissions, new MCP services, unusual write scope, production tokens and egress to new domains.

Hardening checklist

1. Run in an isolated workspace or devcontainer.
2. Use deny-by-default and narrow tool rules.
3. Remove standing secrets from repositories and context.
4. Restrict network and identities.
5. Pin and assess MCP servers.
6. Require approval for publishing, IAM and production.
7. Log decisions and actual effects.
8. Keep the client updated and regression-test policy.

Claude Code can accelerate engineering, but it should operate like an unprivileged developer in a controlled environment. Convenience does not justify bypassing boundaries applied to human operators.

---

A safe workspace and pipeline

Repositories, issues, documentation and tool output are untrusted input. Run the agent in a separate account or container without default access to the home directory, production cloud or Docker socket. Supply secrets on demand through a short-lived broker, not an environment file visible to the full session.

In CI, require diff review, tests, dependency scanning and branch protection exactly as for human code. Do not let an agent approve and merge its own change. Log commands, permission decisions and artefact IDs while redacting secrets. Confirm current flag names and permission modes in documentation for the installed version.

Sources: Anthropic — Claude Code Security, CLI Reference, Corporate Proxy, LLM Gateway.