Stream Claude Audit and Compliance Activity Into Safeguard

To get a reviewable audit trail of what happens inside your Claude organization, turn on Anthropic's Compliance API, create a key that carries only the read:compliance_activities scope, and have a monitoring system poll the Activity Feed at GET /v1/compliance/activities on a schedule. That gives you per-event records (who did what, when, from which IP address and user agent) without handing any tool the right to read chats, files, projects or session transcripts. The hard parts are not the API call. They are picking the right key, keeping the scope narrow, deciding which events deserve an alert, and making sure recording never silently stops.

This post walks through the whole job as the person who owns Claude governance would do it: what the logging standards ask for, what Anthropic's Compliance API actually exposes, how to build the pipeline with any tool, and then how the Anthropic Claude Compliance integration in Safeguard does the polling, storage and alerting for you.

Key takeaways

• Anthropic's Compliance API serves Claude Enterprise and Claude Console organizations. The Activity Feed is the only part an audit pipeline needs, and the only scope it needs is read:compliance_activities.
• Two key types reach the Activity Feed: a Compliance Access Key (sk-ant-api01-, created in claude.ai by the primary owner or an organization owner) and an Admin API key (sk-ant-admin01-, created in the Claude Console, Activity Feed only). Claude API keys and Analytics API keys cannot call it.
• An Admin API key carries the Activity Feed scope only if the Compliance API was already enabled when the key was created. An older key returns 403.
• Turning the Compliance API off stops recording, and Anthropic says activity that was not recorded cannot be recovered later. Watch the setting itself.
• The Safeguard Anthropic Claude Compliance integration (GA) polls the Activity Feed on an interval you set, shows recent events on the card's page, and raises a warning alert when an event touches API keys, roles, permissions, MCP or compliance settings. It reads the Activity Feed only.
• The companion Claude (Anthropic) compliance connector (GA) adds continuous compliance tests such as access reviews and key age, and, with a Claude Console Admin key, daily usage and cost baselines that feed AI Detection and Response.
• Safeguard OpenTelemetry (OTLP) ingest (GA) covers the other half: live Claude Code telemetry from engineers' machines, sent to Detection and Response and Security Operations.
• None of this blocks or changes what people do in Claude. The Activity Feed is an after-the-fact record.

The situation

Claude rolled out across the company faster than the controls around it. The security team approved it, legal signed the enterprise agreement, and now the compliance lead is being asked questions that the claude.ai admin screens answer one click at a time. Who created API keys last month? Did anyone change a role or a group? Did an organization owner switch on an MCP connector or a new integration? Was the Compliance API itself ever turned off?

The usual trigger is an audit or an internal control review. Your auditor samples a quarter and asks for evidence that changes to privileged access in a business system are logged and reviewed. Claude is now a business system. The first answer most teams reach for is the audit log CSV export in claude.ai settings. Anthropic describes that export as significantly narrower than the Compliance API: a capped lookback window, CSV download only, and meant for occasional use rather than ongoing programmatic collection.

A bad week looks like this. Someone creates a Compliance Access Key with every scope "to be safe", pastes it into a log forwarder's config file, and commits that file to a repository. That key can read every chat, file, project and session transcript in every linked organization, and with the delete scope it can permanently delete them. Meanwhile, nobody notices that the Compliance API toggle was switched off for an afternoon during a settings cleanup, and the activity from that afternoon was never recorded. The rest of this post is about never having that week.

If you are still deciding how far to let Claude and its coding agents into your environment, start with our governance guide for AI coding agents and the overview of Claude Enterprise security features.

What the rules ask you to log

None of the major US frameworks names Claude. They do not need to. They describe the controls you owe for any system that holds company data and lets people change who has access. Reading the requirement text directly is the fastest way to decide what your Claude audit pipeline must do. This section is a reading aid, not legal or audit advice; your auditor and counsel decide what applies to you.

NIST SP 800-53 Rev. 5, the AU family

NIST SP 800-53 Rev. 5 is the control catalog that FedRAMP, many state programs and a large share of private control frameworks borrow from. Its Audit and Accountability family maps cleanly onto a Claude audit pipeline:

• AU-2 Event Logging asks you to decide which event types the system must be able to log, and to coordinate that decision with the people who need the records. For Claude, that is the list of Activity Feed event types you care about.
• AU-3 Content of Audit Records asks that each record say what happened, when, where, the source, the outcome and the identity of who or what was involved. The Activity Feed's actor block (type, email address, user ID, IP address, user agent), timestamp and event type cover most of this.
• AU-6 Audit Record Review, Analysis, and Reporting asks you to review records at a defined frequency for signs of inappropriate or unusual activity and report what you find. A feed nobody reads does not satisfy it.
• AU-9 Protection of Audit Information asks you to protect records and logging tools from unauthorized access, change and deletion. That covers the key that reads the feed, not just the stored events.
• AU-11 Audit Record Retention asks you to keep records for a defined period that supports after-the-fact investigation and your retention obligations.
• AU-12 Audit Record Generation asks that the system actually generate records for the event types you chose in AU-2. If the Compliance API is off, Claude generates no records, which is an AU-12 problem you cannot fix later.

Two controls outside the AU family matter just as much. AC-6 Least Privilege is the reason the key should carry read:compliance_activities and nothing else. IA-5 Authenticator Management covers how you create, store, rotate and revoke that key. For a deeper walk through the AU family in general, see how to meet SOC 2 audit logging requirements.

CISA and partner guidance on event logging

CISA co-published "Best Practices for Event Logging and Threat Detection" with the Australian Signals Directorate and other partner agencies. It asks organizations to write an enterprise-approved logging policy, centralize logs, protect them from tampering, keep timestamps consistent, and focus detection on behaviour that only makes sense for an intruder, such as changes to identity and privilege. Its emphasis on cloud and software as a service logging applies directly: a hosted AI service you do not run still produces the identity and configuration events you need, and you only see them if you collect them.

HIPAA, if Claude touches health data

If your Claude organization processes electronic protected health information under a business associate agreement, the HIPAA Security Rule at 45 CFR 164.312(b) requires audit controls: hardware, software or procedural mechanisms that record and examine activity in systems that contain or use ePHI. The Activity Feed is one of those mechanisms for Claude. It does not replace your review procedure.

NIST AI RMF 1.0

The NIST AI Risk Management Framework is voluntary, but many AI governance programs use its functions as their outline. Its GOVERN function covers policies, roles and accountability for AI use, and its MANAGE function covers responding to and tracking AI risks once a system is in use. An Activity Feed pipeline is evidence for both: it shows who has administrative control of the AI system and records the changes they make.

What Anthropic's Compliance API actually exposes

Everything in this section comes from Anthropic's own documentation. Read the current pages before you build anything, because the API is under active development.

The shape of the API

The Compliance API gives Claude Enterprise and Claude Console customers programmatic access to their organization's Activity Feed. For Claude Enterprise organizations it also covers the directory of users, roles and groups, the effective settings in force for each organization, chats, files and projects in claude.ai, and session transcripts from Claude apps such as Cowork and Claude Code. Every endpoint lives under /v1/compliance/ on https://api.anthropic.com, authenticates with the x-api-key header and takes an anthropic-version header on every request.

A Claude Enterprise tenant has one parent organization that centralizes identity, SSO and SCIM, with linked organizations beneath it. Some linked organizations are claude.ai organizations, where people chat and store content. Others are Claude Console organizations, where teams run Claude API workloads. A key that covers the parent organization reads Activity Feed events for the parent and every linked organization. A standalone Claude Console organization, one with no parent, uses Admin API keys and can query the Activity Feed only.

The keys

Only the primary owner or an organization owner can create a Compliance Access Key. A primary owner's key can cover every organization under the parent organization; an organization owner's key covers their own organization only. Organization admins create Admin API keys in the Claude Console.

The scopes

Anthropic lets you choose scopes when you create a Compliance Access Key, and the choice is permanent for that key. To change scopes you create a new key and delete the old one.

Anthropic's own guidance is to choose the smallest scope set the integration needs, and it gives the audit pipeline as its first example: an audit pipeline that reads the Activity Feed only needs read:compliance_activities. Anthropic also warns that a key with read:compliance_user_data can read every chat, file, project and session transcript in every linked organization, including content the primary owner has not seen, and tells you to treat Compliance Access Keys like production database credentials: keep them in a secrets manager and never in source control or SIEM forwarder configuration.

The records

A call to the Activity Feed returns a JSON object with a data array of activity records plus has_more, first_id and last_id for paging. Each record carries an id, a created_at timestamp, the organization ID and UUID, an actor object and a type, plus fields specific to the event, such as the chat or project the event concerns. For a user actor, the actor object includes the email address, user ID, IP address and user agent. For an API actor, it identifies the API key that made the call.

Two behaviours matter for anyone running a pipeline. First, Anthropic says that turning the Compliance API off stops activity recording, that activity not recorded while it is off cannot be recovered, and that turning it back on resumes recording from that point forward. Second, deleting a key takes effect on the next request with no grace period, while pagination cursors stored before a rotation remain valid because they are scoped to the organization rather than the key.

What the Compliance API is not

Anthropic's documentation separates the Compliance API from several neighbours. Knowing the difference saves you from building the wrong pipeline.

The Activity Feed records what happened. It does not stop anything. If you need to block a prompt before it reaches the model, that is a different control with a different design.

Step by step, with any log pipeline

These steps work whether the events end up in a SIEM, a data lake, a ticketing queue or Safeguard. Do them in order.

1. Write down the purpose and the owner

Before you create a key, write two sentences: what the pipeline is for, and who reviews it. "Collect Claude organization activity for access and configuration change review; reviewed weekly by the GRC lead, with alerts to the security on-call channel." That sentence is your AU-2 decision and your AU-6 review frequency. It also tells you which scope you need, which is the next decision.

2. Enable the Compliance API in the right place

Where you turn it on depends on how your organization is set up, according to Anthropic:

• Claude Enterprise. The primary owner enables it at claude.ai, Organization settings, API. Enablement happens at the parent organization and cascades to every linked organization, both claude.ai and Claude Console.
• Standalone Claude Console organization. An organization admin turns on the Compliance API toggle on the Console's Compliance page. If the section is missing, the admin role is missing, the organization is linked to a parent, or the organization is not eligible for self-service.
• Console organization linked to a parent. There is nothing to turn on in the Console. Ask the primary owner of the parent organization.

Record the date you enabled it. Recording is not retroactive, so the enablement date is the start of your evidence.

3. Pick the key type and the single scope

If you are on Claude Enterprise, create a Compliance Access Key with read:compliance_activities only, scoped to the parent organization if you want every linked organization covered. If you run a standalone Claude Console organization, create a new Admin API key after enablement. Do not reuse an Admin key created before enablement; it will not carry the Activity Feed scope.

4. Store the key like a production credential

Put the secret in your secrets manager the moment it is shown, because Anthropic displays it only once. Do not put it in a forwarder's config file, an environment file in a repository, a ticket or a chat message. Write down who can read the secret, when it was created and when you will rotate it. Compliance Access Keys do not expire on their own, so the rotation date is entirely yours.

5. Test the key with one call

Anthropic's documentation shows this request, which returns the most recent activity event:

curl --fail-with-body -sS \
  "https://api.anthropic.com/v1/compliance/activities?limit=1" \
  -H "x-api-key: $ANTHROPIC_COMPLIANCE_ACCESS_KEY" \
  -H "anthropic-version: 2023-06-01"

We have not run this snippet for this post; it is copied from Anthropic's docs. A 200 with a data array means the key works. A 403 usually means the scope is missing or the Admin key predates enablement. A 404 usually means the Compliance API is not enabled or the key is the wrong type.

6. Poll with a cursor, not a time window

The Activity Feed has no webhooks, so every consumer polls. Store the last activity ID you processed and page forward from it on each run, rather than asking for "the last ten minutes" and hoping clocks agree. Because cursors are scoped to the organization, a key rotation does not lose your place. Handle 429 responses by backing off and retrying on the next cycle; the Compliance API shares one rate limit across all compliance endpoints for each parent organization.

7. Decide which events page someone

Most Activity Feed events are routine: people creating chats and projects. A small set deserves attention every time. Start with these categories and tune from there:

8. Set retention on purpose

Pick a retention period that covers your audit period plus your investigation window, write it in the logging policy, and apply it in the store. AU-11 asks for a defined period; it does not ask you to keep everything forever. Remember that actor records hold email addresses and IP addresses, which are personal data under many privacy laws.

9. Rehearse a key leak

Anthropic documents the drill. Delete the leaked key at once; deletion takes effect on the next request. Then query the Activity Feed for compliance_api_accessed activities, keep those whose actor is an API actor with the compromised key's ID, and rotate any downstream credentials the key could have reached. Run it once on a test key so the steps are familiar before you need them.

10. Rotate without an outage

Anthropic's rotation order is simple: create a new key with the same scopes, update the integration, confirm it works, then delete the old key. A 90-day cycle is a common choice and matches the Safeguard docs recommendation.

A one-page checklist

Which key should a monitoring tool get?

One key per job, each with the narrowest scope that job needs. A tool that only reads the Activity Feed gets a Compliance Access Key with read:compliance_activities. A tool that runs access reviews needs to read members and organization settings, so it gets a separate key with the extra read scopes it documents. An eDiscovery tool that must read chats gets read:compliance_user_data on its own key, held by legal, and never the delete scope unless deletion is its job. Anthropic suggests exactly this split when a workflow both reads and deletes: two keys, so a leaked read key cannot delete data.

The mistake to avoid is a single all-scope key shared by every tool. It is convenient for a week and a standing liability after that.

Activity Feed, OpenTelemetry or the CSV export?

They answer different questions, and most organizations end up using more than one.

The Activity Feed tells you what happened in the Claude organization: administrative and user activity recorded by Anthropic, retrievable by API after the fact. It is the right source for access reviews, configuration change review and investigations into who did what.

OpenTelemetry from Claude Code and Cowork tells you what agents did on machines, as it happened: sessions, tool decisions, token use and host details, streamed to a collector you run. It is the right source for watching agent behaviour on endpoints. Anthropic notes that OpenTelemetry logging can capture prompts and responses if you turn that on, but recommends the Compliance API for retrieving session content.

The CSV export is fine for a one-off answer and not for a control. It has a capped lookback and needs a person to download it.

Should a security tool ever read chat content?

Usually no. For audit and access review, metadata answers the question: who changed what, when and from where. Content scopes turn your monitoring tool into a store of the most sensitive text in the company, and every person with access to that tool inherits access to it. If you have a legal hold, an eDiscovery request or a specific investigation that needs content, give that job its own key, its own owner and its own retention, and keep it away from the always-on monitoring pipeline.

How fresh is the data?

As fresh as your polling interval allows. The Activity Feed has no push mechanism, so the delay between an event and your alert is roughly the time until the next poll plus processing time. For access and configuration review that is fine. For anything that must be stopped in the moment, the Activity Feed is the wrong control; look at inline controls such as Anthropic's inference hooks for prompts, or at the settings that restrict who can make changes at all.

How Safeguard does this

Safeguard's Anthropic Claude Compliance integration (GA) does steps 6 to 8 for you: it polls the Activity Feed on the interval you set, keeps the events, shows them on the card's page and raises warning alerts for the high-value categories. Everything below comes from the Safeguard docs page for the integration. If you just want the announcement view, our launch post for the Claude Compliance API connector covers it; this section is the operator's version.

1. Create the key in Claude

For Claude Enterprise, as the primary owner:

1. Open claude.ai, Organization settings, API, and enable the Compliance API if it is not on yet.
2. In the Keys section, click Create key, name it (for example Safeguard) and select only read:compliance_activities. Click Create.
3. Copy the key, which starts with sk-ant-api01-. Anthropic shows it only once.

For a standalone Claude Console organization, as an organization admin:

1. Turn on the Compliance API toggle on the Console's Compliance page.
2. Create a new key on the Admin keys page and copy it. It starts with sk-ant-admin01-.

The Safeguard docs are explicit about what to leave off a Compliance Access Key: read:compliance_user_data, because it reads every chat, file, project and transcript; delete:compliance_user_data, which should never be granted to Safeguard; and read:compliance_org_data. A key with extra scopes still works, but the docs advise against it because extra scopes widen what a leaked key could read or delete.

2. Check the key before you paste it

Anthropic has no CLI that creates these keys. The Safeguard docs give the same check as Anthropic's:

curl --fail-with-body -sS "https://api.anthropic.com/v1/compliance/activities?limit=1" \
  --header "x-api-key: $ANTHROPIC_COMPLIANCE_ACCESS_KEY" \
  --header "anthropic-version: 2023-06-01"

As above, we did not run this for the post.

3. Connect the card

1. In Safeguard, open Integrations and choose the Project/Product tab.
2. Click Connect on the Anthropic Claude Compliance card.
3. Paste the key into Access Key.
4. Leave Stream activity on and set the Poll interval in minutes. The minimum is 1.
5. Click Connect, then Sync now to read the first events. They appear in the recent activity list on the card's page.

There is no public mode for this integration. It always needs a key for your own Claude organization.

4. Understand the polling schedule

Because Anthropic's Activity Feed has no webhooks, Safeguard polls it. The docs say Safeguard's scheduler runs every 10 minutes and honours your interval, and Sync now reads new events at once. In practice that means a very short poll interval does not make the feed arrive faster than the scheduler runs; it makes sure each scheduled run picks up new events. To pause polling without disconnecting, turn Stream activity off. Remember that pausing Safeguard does not pause Anthropic's recording; events wait in the feed until the next sync.

5. Review events and alerts

Recent events appear on the card's page. Events that touch API keys, roles, permissions, MCP or compliance settings raise a warning alert. Those are the same categories the step by step section above recommends watching, so the default behaviour lines up with a sensible starting rule set. Route Safeguard alerts to the channel your team already watches; the Safeguard docs for ChatOps cover Slack, Teams and similar destinations.

6. Know what Safeguard reads and stores

From the Safeguard docs:

7. Rotate and disconnect

To rotate, create a new key with the same scope, paste it into Access Key on the card's page and save, check that Sync now works, then delete the old key in claude.ai or the Claude Console. Leaving the field blank keeps the existing key. The Safeguard docs recommend rotating every 90 days and deleting the key at once if it leaks.

To disconnect, click Disconnect on the card's page, then delete the key in claude.ai, Organization settings, API, or on the Console's Admin keys page. Deletion takes effect on Anthropic's side at once.

Troubleshooting from the docs

The companion connector: compliance tests and usage baselines

The Anthropic Claude Compliance card is the audit stream. Safeguard has a second, separate connector for Claude that does a different job, and it needs a different key. The Claude (Anthropic) connector (GA) lives under Compliance, Connectors, in Business Applications. With your own Anthropic key it reads members, invites, API key metadata and compliance settings for continuous compliance tests such as access reviews and key age. With a Claude Console Admin API key it also reads daily usage, cost and Claude Code analytics, builds per-person, per-key and per-workspace baselines, and turns days well above a baseline into AI Detection and Response detections.

Create one key per card. Do not widen the audit stream's key to cover the compliance tests. The Safeguard docs say the compliance tests and the usage pulls are switched on per workspace; if you do not see the card or the usage panel, ask your Safeguard contact. For Claude Code activity on engineers' machines, the OpenTelemetry (OTLP) ingest (GA) is the third piece, and our OTLP guide walks through it.

Where this fits with the rest of Safeguard

The Claude feed sits next to the rest of your AI and supply chain record. AI-BOM discovery and AI agent discovery (GA) inventory where models and agents are used. MCP Guardrail (GA) generates guardrail proxy URLs for MCP servers, which pairs naturally with alerts on MCP settings changes in Claude. The compliance and GRC suite (GA) is where control evidence lives. And if you want Claude to read Safeguard rather than the other way round, Safeguard is listed as a community connector in the Claude directory; see how to connect Safeguard to Claude over MCP.

What Safeguard does not do

• It does not read conversation content. The Anthropic Claude Compliance integration reads the Activity Feed only. If you need chats, files or transcripts for eDiscovery or a legal hold, that is a separate tool and a separate, tightly held key.
• It does not block, restrict or change anything in Claude. The Activity Feed is an after-the-fact record. Safeguard policies and gates (GA) act on builds and pull requests with Block, Warn and Notify actions, with approval handled through exceptions; they do not sit in front of Claude prompts. Inline prompt control is a different category of control.
• It cannot recover activity Claude never recorded. If the Compliance API is off, Anthropic records nothing, and Safeguard has nothing to read. Watch the toggle and alert on compliance settings changes.
• It does not create or manage your Anthropic keys. You create, store and delete them in claude.ai or the Claude Console. Safeguard stores the key you paste, encrypted, and never changes anything in your Claude organization.
• It does not receive pushes. Anthropic's Activity Feed has no webhooks, so events arrive on the polling schedule, not the instant they happen.
• It does not cover usage through other clouds. The companion connector's docs say usage through Amazon Bedrock, Google Vertex AI or Microsoft Foundry is not reported by Anthropic and is not covered.
• It does not decide what your review means. Safeguard collects and flags. Someone in your organization still reviews the events, judges whether a change was approved, and signs the access review.

Common mistakes

• Granting every scope "to be safe". The audit stream needs one scope. Every extra scope widens what a leaked key can read or delete, and scopes cannot be removed from a key later.
• Reusing an old Admin key. An Admin API key created before the Compliance API was enabled returns 403. Create a new one.
• Pasting a Claude API key. Keys that start with sk-ant-api03- call models; they cannot call the Compliance API.
• Putting the key in forwarder config. Anthropic specifically warns against keeping Compliance Access Keys in SIEM forwarder configuration or source control.
• Not alerting on the Compliance API toggle. Turning it off stops recording, and the gap cannot be filled later.
• Treating the CSV export as the control. It has a capped lookback and depends on a person remembering to download it.
• One key for every tool. When something leaks, you cannot tell which tool it came from, and rotating it breaks everything at once.
• Collecting without reviewing. AU-6 asks for review at a defined frequency. A feed that nobody reads is storage, not a control.
• Forgetting that actor records are personal data. Email addresses and IP addresses fall under privacy rules; set retention and access accordingly.

FAQ

What is the Claude Compliance API?

It is Anthropic's API for Claude Enterprise and Claude Console customers to access their organization's Activity Feed and, for Claude Enterprise, users, settings, content and session transcripts. Security, legal and compliance teams use it to audit activity and feed events into their own tools.

What scope does a Claude audit log integration need?

Only read:compliance_activities. Anthropic's docs give the audit pipeline as the example of a job that needs that scope and nothing else, and the Safeguard docs recommend exactly that key.

Can I use a Claude Console Admin API key instead of a Compliance Access Key?

Yes, for a standalone Claude Console organization. An Admin API key reaches the Activity Feed only, and only if the Compliance API was enabled before the key was created.

Does Safeguard read my Claude chats?

No. The Anthropic Claude Compliance integration reads Activity Feed events: ID, time, type and actor. It does not read chats, files, projects, session transcripts, users or organization settings.

How often does Safeguard pull Claude activity?

On the poll interval you set, with a minimum of 1 minute. The docs say Safeguard's scheduler runs every 10 minutes and honours your interval, and Sync now reads new events immediately.

Which Claude events raise an alert in Safeguard?

Events that touch API keys, roles, permissions, MCP or compliance settings raise a warning alert. Other events appear in the recent activity list on the card's page.

What happens if someone turns off the Claude Compliance API?

Anthropic stops recording activity for your organization, and activity that was not recorded cannot be recovered later. Turning it back on resumes recording from that point.

Do Compliance Access Keys expire?

No. Anthropic says they do not expire on their own. Rotate on a schedule you set; the Safeguard docs recommend every 90 days, and immediate deletion if a key leaks.

Is the Activity Feed the same as Claude Code OpenTelemetry?

No. The Activity Feed is Anthropic's after-the-fact record of organization activity. Claude Code OpenTelemetry streams live telemetry from engineers' machines to a collector you run. Safeguard handles the second through its OTLP ingest.

Is Safeguard an Anthropic partner?

No. Safeguard is an independent company. It is listed as a community connector in the Claude directory, and this integration uses Anthropic's public Compliance API with your own key.

Fixing what the audit trail points to

An audit trail tells you that someone connected a new MCP server or created a key; it does not fix the vulnerable dependency inside the tool they connected. When the trail leads you to code and components you build and ship, the next step is remediation, and the section below covers how Safeguard handles it.

Fix it without waiting for upstream

Whatever the vulnerability, most of the risk sits in two gaps. The first is the time between a fix being published and that fix actually running in your production builds. The second, and worse, is the time before any fix exists at all, while a maintainer works out a patch and a release schedule. Waiting through both gaps is a habit, not a requirement. Safeguard gives teams three ways to close them.

1. Autonomous remediation: pull requests, not tickets

When a fixed version exists, Safeguard's Griffin models open a tested, policy gated pull request that moves the affected dependency to the safe version. You can run it on one repository or in bulk across every project that carries the vulnerable version. Remediation categories include dependencies, licenses, security posture and findings, and each one is set separately. Reachability analysis ranks the vulnerable code paths your application actually calls first, so the first pull requests you merge are the ones that matter most. Autonomous remediation ships switched off, with every category set to Manual, so your team decides how much runs on its own and what still needs a human approval.

2. Gold Open Source: the safe version in seconds, free

gold.safeguard.sh is free and needs no login. Search any CVE or package to see affected and fixed versions, CVSS, EPSS, CISA KEV status and a recommended safe version, or use the "Am I affected?" checker. The same data is available through a free read API, README status badges and RSS threat feeds.

3. Gold Registry: start from components that are already fixed

Gold Registry provides hardened, drop in replacements for upstream packages and container images. Every Gold artifact is held continuously to zero exploitable critical or high CVEs and a completed license check, with signed build provenance (signed with Safeguard's key and verifiable with cosign, SLSA Build Level 3 as the design target) and a public evidence page you can hand to an auditor. An artifact loses its Gold badge if it regresses. Teams can point their own package directory at the registry so hardened equivalents resolve without changing how developers install anything.

When upstream has no fix yet, or will not ship one, Safeguard first works to get the fix accepted upstream. If the issue is severe or upstream will not move, Safeguard builds a fork, fixes the vulnerability there and publishes a hardened Gold build, so you are not stuck on a maintainer's release schedule. You can also request a hardened, compatibility tested build of a specific package. Ask which packages it covers before you plan around it.

One honest limit: when the vulnerable code lives in a vendor appliance, a hosted service or an operating system runtime you do not build yourself, the fix still has to come from that vendor or distribution. The steps above apply to the open source dependencies and container images you build and ship, which is where most teams carry the largest and least tracked share of their exposure.

See how Safeguard would help

The first demo shows the opposite direction of the integration in this post: connecting Claude to the Safeguard MCP server with OAuth and choosing which tools Claude can use. Together with the Activity Feed stream, it gives you both views, Claude reading Safeguard and Safeguard watching the Claude organization.

Click through it at your own pace, or open it full screen.

The second demo is a real Safeguard CLI session: it installs the CLI, opens the interactive terminal, asks it to fix a lodash CVE, and shows the CLI asking before any command that changes something, editing package.json, running npm install and npm test with approval, and pushing nothing. It is the remediation side of the story when an alert from the Claude feed leads you to code you own.

Click through it at your own pace, or open it full screen.

Quick check

Related reading

• Safeguard Is Now a Connector in Claude
• Send Claude Code and Codex telemetry to Safeguard with OTLP
• How to meet SOC 2 audit logging requirements
• AI coding agent governance
• AI keys are production credentials

Sources

• Safeguard docs: Anthropic Claude Compliance integration
• Safeguard docs: Claude (Anthropic) connector
• Safeguard docs: Integrations
• Anthropic: Compliance API
• Anthropic: Set up the Compliance API

Download Safeguard at safeguard.sh/download, and read the product documentation at docs.safeguard.sh.

Last reviewed: 25 October 2026. Product capabilities change; check docs.safeguard.sh for the current state.