Safeguard
Developer Tools•

Claude Code OpenTelemetry: what gets logged by default

Claude Code telemetry is off until you enable it, and prompt text is redacted by default. Which switches add prompts, tool details and raw API bodies, and who controls them.

Safeguard Security Team
3 min read

Claude Code sends no OpenTelemetry data until you set CLAUDE_CODE_ENABLE_TELEMETRY to 1. Even then, prompt text and assistant responses are redacted by default, with only lengths recorded. Separate switches add prompt text, tool details or full API bodies, so each exposure is a deliberate choice.

What you can collect

Per Anthropic's monitoring documentation, Claude Code exports metrics and events through standard exporters. Metrics include session count, lines of code, pull requests, commits, cost in dollars, token usage, code edit tool decisions and active time. Events include user prompts, assistant responses, tool results, API requests and errors, tool decisions, permission mode changes, authentication, MCP server connections and plugin loads. Traces are beta and need an extra variable.

The interval defaults are 60 seconds for metrics and 5 seconds for logs. To check your setup, look for the session count metric, or for the user prompt event in a logs-only setup.

Privacy defaults

The docs set these defaults:

  • Prompt text is redacted unless OTEL_LOG_USER_PROMPTS is set to 1. Prompt length is still recorded.
  • Assistant response text is redacted unless OTEL_LOG_ASSISTANT_RESPONSES is set, and if unset it follows the prompt setting.
  • Tool parameters need OTEL_LOG_TOOL_DETAILS, and tool content needs OTEL_LOG_TOOL_CONTENT, which also needs tracing.
  • Raw API request and response bodies need OTEL_LOG_RAW_API_BODIES, and the page warns bodies include the entire conversation history.
  • The user id is a random anonymous identifier, not derived from the account.

If you turn on prompt or body logging, you are creating a store of source code and possibly secrets. Decide retention and access for it before enabling.

Who controls it

Administrators can set these variables for everyone in the managed settings file, in an env block. The documentation says a repository's own project settings files cannot enable telemetry, choose its destination or capture content, though a repository can switch a signal off. When managed settings set the endpoint, developer-set per-signal endpoints are removed at startup. Exporter selectors follow normal precedence, so set them in managed settings too if you need them locked.

Claude Code does not pass these OTEL variables to subprocesses such as the Bash tool, hooks or MCP servers.

A sensible starting point

  1. Enable metrics and logs to an internal collector.
  2. Leave prompt, response, tool and body logging off.
  3. Build dashboards on cost, tokens, and tool decisions per user.
  4. Add content logging only for a defined investigation, with a time limit.

For cloud provider setups, the cost page notes that Anthropic's dashboards do not cover that usage, so OpenTelemetry is one of the ways to see per-user numbers.

Quick check

Is prompt text exported once telemetry is on?

No. It is redacted unless you set the prompt logging variable.

Can a repository turn on content logging for its contributors?

No. Per the docs, project settings cannot enable telemetry or capture content.

Sources

Last reviewed: 19 October 2026.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.

Self-healing security runs on Safeguard.

Your first fix PR is minutes away.

No sales call required, even your agent can complete the purchase over MCP.