> ## Documentation Index
> Fetch the complete documentation index at: https://docs.clarion.cantina.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# Claude Code

> Ingest OpenTelemetry from your developers' Claude Code installs to govern MCP servers, spot external accounts, and catch credential-shaped tool use.

Claude Code emits OpenTelemetry. Point it at Clarion and you get a security view of how your engineering org actually uses AI coding agents: which MCP servers they connect, whose accounts are outside your company, and which sessions read a credential and then reached the network.

<Note>
  **Estimated time:** 10 minutes. You will need admin access to your organization's Claude managed settings.
</Note>

## Prerequisites

* Claude Code deployed across your developer fleet
* Ability to push **managed settings** to those installs
* Your company's domains set in [Workspace settings](/learn/settings/workspace) — the external-account rule reads every account as external until they are

## Step 1 — Create the monitor in Clarion

1. In Clarion, open **Integrations** and find **Claude Code**.
2. Click **Connect** and create a monitor. Clarion generates:
   * An **ingest endpoint URL** carrying the monitor id.
   * A **bearer secret**, shown exactly once.

<Warning>
  Copy the secret when it is shown. Clarion does not display it again. The secret travels in an OTLP header, never in the URL.
</Warning>

## Step 2 — Push managed settings

Clarion generates the JSON block to paste into your Claude managed settings:

```json theme={null}
{
  "env": {
    "CLAUDE_CODE_ENABLE_TELEMETRY": "1",
    "OTEL_LOGS_EXPORTER": "otlp",
    "OTEL_METRICS_EXPORTER": "otlp",
    "OTEL_TRACES_EXPORTER": "otlp",
    "OTEL_EXPORTER_OTLP_PROTOCOL": "http/json",
    "OTEL_EXPORTER_OTLP_ENDPOINT": "https://<your-clarion-host>/api/webhooks/claude-code/<monitor-id>",
    "OTEL_EXPORTER_OTLP_HEADERS": "Authorization=Bearer <your-token>",
    "OTEL_LOG_TOOL_DETAILS": "1",
    "OTEL_METRICS_INCLUDE_ENTRYPOINT": "true"
  }
}
```

Copy it from the integration page rather than from here — it comes pre-filled with your endpoint and secret.

<Note>
  Findings are only as complete as your telemetry. If OTEL logging is partial across the fleet, so is the picture Clarion builds. `OTEL_LOG_TOOL_DETAILS` is what makes tool-level governance possible; without it, MCP server use is invisible.
</Note>

## What Clarion builds from it

**MCP server governance.** Every MCP server your developers connect is inventoried with who uses it and how often. Servers sit in an undecided bucket until somebody rules on them — and the [Claude Code Governance](/learn/agents/our-agents) agent sweeps that bucket weekly and puts the whole batch in front of a human as **one** decision rather than a trickle of prompts. Use of a server somebody already denied raises an issue immediately.

**Identity.** Telemetry reported from an account outside your company's domains is surfaced and triaged. This is how a personal account doing company work, or a contractor still connected after offboarding, shows up.

**Credential-shaped tool use.** Sessions that read a credential-shaped path and then reached the network are flagged for triage — the pattern behind an agent exfiltrating a key, whether deliberately or by accident.

## Related agent

The [Claude Code Governance](/learn/agents/our-agents) agent ships four skills: MCP server governance triage, MCP inventory review sweep, external account triage, and credential-harvesting triage.

## Disconnect

Click **Disconnect** on the integration page, then remove the OTEL environment variables from your managed settings. Telemetry sent after disconnection is rejected.