Skip to main content
Claude Code emits OpenTelemetry. Point it at Clarion and you get a security view of how your engineering org actually uses AI coding agents: which MCP servers they connect, whose accounts are outside your company, and which sessions read a credential and then reached the network.
Estimated time: 10 minutes. You will need admin access to your organization’s Claude managed settings.

​
Prerequisites

  • Claude Code deployed across your developer fleet
  • Ability to push managed settings to those installs
  • Your company’s domains set in Workspace settings — the external-account rule reads every account as external until they are

​
Step 1 — Create the monitor in Clarion

  1. In Clarion, open Integrations and find Claude Code.
  2. Click Connect and create a monitor. Clarion generates:
    • An ingest endpoint URL carrying the monitor id.
    • A bearer secret, shown exactly once.
Copy the secret when it is shown. Clarion does not display it again. The secret travels in an OTLP header, never in the URL.

​
Step 2 — Push managed settings

Clarion generates the JSON block to paste into your Claude managed settings:
Copy it from the integration page rather than from here — it comes pre-filled with your endpoint and secret.
Findings are only as complete as your telemetry. If OTEL logging is partial across the fleet, so is the picture Clarion builds. OTEL_LOG_TOOL_DETAILS is what makes tool-level governance possible; without it, MCP server use is invisible.

​
What Clarion builds from it

MCP server governance. Every MCP server your developers connect is inventoried with who uses it and how often. Servers sit in an undecided bucket until somebody rules on them — and the Claude Code Governance agent sweeps that bucket weekly and puts the whole batch in front of a human as one decision rather than a trickle of prompts. Use of a server somebody already denied raises an issue immediately. Identity. Telemetry reported from an account outside your company’s domains is surfaced and triaged. This is how a personal account doing company work, or a contractor still connected after offboarding, shows up. Credential-shaped tool use. Sessions that read a credential-shaped path and then reached the network are flagged for triage — the pattern behind an agent exfiltrating a key, whether deliberately or by accident. The Claude Code Governance agent ships four skills: MCP server governance triage, MCP inventory review sweep, external account triage, and credential-harvesting triage.

​
Disconnect

Click Disconnect on the integration page, then remove the OTEL environment variables from your managed settings. Telemetry sent after disconnection is rejected.