Claude Enterprise Security Guide For Developers

{
  "model": "sonnet",
  "availableModels": ["sonnet", "haiku"],
  "env": {
    "ANTHROPIC_BASE_URL": "https://your-gateway.internal.corp",
    "ANTHROPIC_DEFAULT_OPUS_MODEL": "your-opus-model-equivalent",
    "ANTHROPIC_DEFAULT_SONNET_MODEL": "your-sonnet-model-equivalent"
  }
}

#!/bin/bash
# =============================================================================
# MDM Deployment Script: Claude Code Managed Policy Files
# Must be run as root (e.g., via MDM such as Jamf, Mosyle, or Kandji).
#
# Deploys:
#   - managed-settings.json  → /Library/Application Support/ClaudeCode/
#   - managed-mcp.json       → /Library/Application Support/ClaudeCode/
#
# Files are owned by root:wheel with 644 permissions so that:
#   - root can read and write
#   - all users (including the logged-in developer) can only read
# =============================================================================

set -euo pipefail

# ---------------------------------------------------------------------------
# Guard: must run as root
# ---------------------------------------------------------------------------
if [[ "$(id -u)" -ne 0 ]]; then
  echo "ERROR: This script must be run as root." >&2
  exit 1
fi

CURRENT_LOGGEDIN_USER="$(/usr/sbin/scutil <<<"show State:/Users/ConsoleUser" | /usr/bin/awk '/Name :/ && ! /loginwindow/ { print $3 }' | /usr/bin/awk -F '@' '{print $1}')"

# ---------------------------------------------------------------------------
# Config
# ---------------------------------------------------------------------------
DEST_DIR="/Library/Application Support/ClaudeCode"

# File at which Users would mount their PAT
TOKEN_FILE="/Users/${CURRENT_LOGGEDIN_USER}/.truefoundry/tfy-pat"

# Your Gateway URL
GATEWAY_URL="https://gateway.truefoundry.ai"

# Your Control Plane URL
CONTROL_PLANE_URL="https://<tenantName>.truefoundry.cloud"

MANAGED_SETTINGS_DEST="${DEST_DIR}/managed-settings.json"
MANAGED_MCP_DEST="${DEST_DIR}/managed-mcp.json"

# ---------------------------------------------------------------------------
# Generate policy content by fetching from API
# ---------------------------------------------------------------------------
generate_policy_files() {
  log "Checking for token file..."

  local token=""

  if [[ ! -f "$TOKEN_FILE" ]]; then
    log "WARNING: Token file not found at $TOKEN_FILE. Skipping MCP fetch and using empty token."
  else
    token=$(cat "$TOKEN_FILE")

    if [[ -z "$token" ]]; then
      log "WARNING: Token file is empty. Skipping MCP fetch and using empty token."
    fi
  fi

  # Only fetch MCP servers if token is available
  if [[ -n "$token" ]]; then
    log "Fetching MCP servers from API..."
    local api_response
    api_response=$(curl -s --request GET \
      --url "$CONTROL_PLANE_URL/api/svc/v1/mcp-servers?limit=100" \
      --header "Authorization: Bearer $token")

    if [[ $? -ne 0 ]]; then
      log "WARNING: Failed to fetch MCP servers. Using empty MCP config."
      MANAGED_MCP_CONTENT=$(python3 -c "import json; print(json.dumps({'mcpServers': {}}, indent=2))")
    else
      log "Generating managed-mcp.json..."
      MANAGED_MCP_CONTENT=$(echo "$api_response" | python3 -c "
import json
import sys

try:
    response = json.load(sys.stdin)
    mcp_servers = {}

    for server in response.get('data', []):
        fqn_parts = server.get('fqn', '').split(':')
        server_name = fqn_parts[2] if len(fqn_parts) > 2 else server.get('id')

        proxy_url = server.get('proxyUrl', '')
        url = proxy_url.replace('{{mcpProxyBaseURL}}', '$GATEWAY_URL')

        mcp_servers[server_name] = {
            'type': 'http',
            'url': url
        }

    output = {'mcpServers': mcp_servers}
    print(json.dumps(output, indent=2))
except Exception as e:
    print(f'ERROR: Failed to parse API response: {e}', file=sys.stderr)
    sys.exit(1)
")

      if [[ $? -ne 0 ]]; then
        log "WARNING: Failed to generate managed-mcp.json. Using empty MCP config."
        MANAGED_MCP_CONTENT=$(python3 -c "import json; print(json.dumps({'mcpServers': {}}, indent=2))")
      fi
    fi
  else
    log "Skipping MCP server fetch. Using empty MCP config."
    MANAGED_MCP_CONTENT=$(python3 -c "import json; print(json.dumps({'mcpServers': {}}, indent=2))")
  fi

  log "Generating managed-settings.json..."
  MANAGED_SETTINGS_CONTENT=$(python3 <<EOF
import json

settings = {
  "permissions": {
    "disableBypassPermissionsMode": "disable",
    "deny": [
      "Bash(curl:*)",
      "Bash(wget:*)",
      "Read(**/.env)",
      "Read(**/.env.*)",
      "Read(**/secrets/**)",
      "Read(**/.ssh/**)",
      "Read(**/credentials/**)"
    ],
    "ask": ["Bash(git push:*)", "Write(**)"]
  },
  "allowManagedPermissionRulesOnly": true,
  "allowManagedHooksOnly": true,
  "transcriptRetentionDays": 14,
  "sandbox": {
    "enabled": true,
    "network": {
      "httpProxyPort": 8080,
      "socksProxyPort": 8081
    }
  },
  "allowedMcpServers": [
    { "serverUrl": "$GATEWAY_URL/*" }
  ],
  "strictKnownMarketplaces": [],
  "env": {
      "ANTHROPIC_BASE_URL": "$GATEWAY_URL",
      "ANTHROPIC_CUSTOM_HEADERS": "Authorization: Bearer $token",
      "ANTHROPIC_MODEL": "claude-code/claude-sonnet",
      "ANTHROPIC_DEFAULT_OPUS_MODEL": "claude-code/claude-opus",
      "ANTHROPIC_DEFAULT_SONNET_MODEL": "claude-code/claude-sonnet",
      "ANTHROPIC_DEFAULT_HAIKU_MODEL": "claude-code/claude-haiku",
      "CLAUDE_CODE_DISABLE_EXPERIMENTAL_BETAS": "1"
  }
}

print(json.dumps(settings, indent=2))
EOF
)
}

# ---------------------------------------------------------------------------
# Helpers
# ---------------------------------------------------------------------------
log() { echo "[$(date '+%Y-%m-%d %H:%M:%S')] $*"; }

deploy_file() {
  local content="$1"
  local dest="$2"

  log "Deploying $(basename "$dest")"
  echo "$content" > "$dest"

  # root owns the file; group wheel; users can read but not write
  chown root:wheel "$dest"
  chmod 644 "$dest"

  # Lock with macOS immutable flag — requires root to explicitly unset before editing
  chflags schg "$dest"

  log "$(basename "$dest") deployed and locked (schg)."
}

# ---------------------------------------------------------------------------
# Create destination directory
# ---------------------------------------------------------------------------
if [[ ! -d "$DEST_DIR" ]]; then
  log "Creating directory: $DEST_DIR"
  mkdir -p "$DEST_DIR"
fi

# Ensure the directory is owned by root and not writable by users
chown root:wheel "$DEST_DIR"
chmod 755 "$DEST_DIR"

# ---------------------------------------------------------------------------
# Generate and deploy policy files
# ---------------------------------------------------------------------------
generate_policy_files

# Unlock first in case files already exist and are flagged immutable
chflags noschg "$MANAGED_SETTINGS_DEST" 2>/dev/null || true
chflags noschg "$MANAGED_MCP_DEST" 2>/dev/null || true

deploy_file "$MANAGED_SETTINGS_CONTENT" "$MANAGED_SETTINGS_DEST"
deploy_file "$MANAGED_MCP_CONTENT" "$MANAGED_MCP_DEST"

# ---------------------------------------------------------------------------
# Verify
# ---------------------------------------------------------------------------
log "--- Deployment complete. Verifying permissions ---"
ls -lO "$MANAGED_SETTINGS_DEST"
ls -lO "$MANAGED_MCP_DEST"

log "Done. Claude Code will enforce these policies for all users on this machine."