A Claude Enterprise organisation can hold each governed prompt until a security server of its own answers allow or deny. Anthropic calls the feature Inference hooks, in beta. It is a real control point for Claude, and where its view ends decides what else you need.
What Inference hooks are
Once an Owner turns it on, Anthropic sends the conversation transcript, signed per Standard Webhooks, to the organisation’s AI security server before inference runs, and waits up to a timeout the organisation sets (5,000 ms by default). A denied request never reaches the model; the user sees the server’s reason, and the denial is recorded in the Activity Feed.
prompt fires once per governed request. tool_call fires before the tool calls in Claude’s response run, when Validate tool calls is on (the default in a new configuration). The hook runs on Anthropic’s servers, so nothing is installed on devices, and one hook covers claude.ai, Cowork, Claude Code and Claude Tag.
Security vendors are building on it. Anthropic’s launch post names Netskope, Palo Alto Networks, Proofpoint and Zscaler, and Zscaler has announced that its AI Guard evaluates Claude Enterprise conversations through the hooks, with policy defined in the Zscaler platform.
What they see
- The transcript as the user sees it: typed text, prior turns, tool calls and their results, and text extracted from attachments, untruncated, up to 64 MiB.
- Tool calls before they run, with Validate tool calls on. Each names the tool, its arguments and who runs it: the Claude platform, the Claude app, a third-party server such as a connector, or the client, which includes Claude Code’s shell and local MCP servers.
- Tool results, from connectors, MCP servers, skills and plugins, as they return to the model in the next prompt.
What they don’t see
- Raw files and images. Attachments arrive as extracted text, so a screenshot of a document is not inspected. System prompts and tool definitions are never sent.
- Claude’s reply. Anthropic’s own flow diagram marks the prompt, the tool call and the tool result as checked, and the response as not.
- What a tool does on the user’s machine. Claude Code’s shell and local MCP servers run on the device, and the endpoint documentation says that exchange does not pass through Anthropic. The hook can deny the call from its text, but sees the result only in the next prompt, after the tool has run.
- Everything outside Claude Enterprise. API access through the Claude Platform is out of scope, as are Amazon Bedrock and Google Cloud. Codex, Cursor, Copilot, Gemini CLI, custom agents on other providers and local models never send Anthropic a request, so the hook never sees them.
- Some requests inside it. Title generation, some of claude.ai’s own tools, a small share of voice-mode tool calls and hosted features such as Code Review are not sent. Excluded roles, and requests outside the rollout percentage, are not inspected.
- Anything but allow or deny. Redaction is not supported.
When the server cannot answer
If the server is unreachable, errs or misses the timeout, the organisation’s failure handling decides: Block the request (fail closed) or Allow the request (fail open), the default. Sustained failures trip a circuit breaker that applies that choice to every request. A body the server rejects as too large is a failure too, so under the default an oversized prompt reaches the model uninspected. Choose on purpose, and size the server for 64 MiB.
Where the inspection happens matters
The hook sends the whole transcript, including whatever a user pasted or attached, to the server’s URL. If that URL is a vendor’s cloud, every governed prompt also goes to a second company. If the server runs on infrastructure you operate, the transcript goes from Anthropic to you and stops there. Anthropic needs a public https:// URL on port 443 with a trusted certificate, which a reverse proxy in your own data centre or cloud account provides.
The same applies to what the server sends onward. Anthropic asks that the reference id it records carry no request content or personal data; alerts to your SIEM deserve the same rule.
A checklist for a hook server
1. Deny reasons and alerts without content
Does a deny name the threat without echoing the text? Do alerts and logs leave the prompt out?
2. Signature verification
Is every request checked in constant time against the HMAC over the id, timestamp and raw body, with the previous secret still accepted briefly after a rotation?
3. Replay protection
Does it reject a timestamp more than five minutes off, as Anthropic specifies, and a webhook-id it has already accepted?
4. A fail mode the admin chooses
When the server cannot judge an item (too large, too slow, an engine error), does an administrator decide whether that means allow or deny?
5. Runs where your data must stay
Can it run on infrastructure you operate?
6. Covers the agents the hook can’t
Does the same policy reach other agents, local models and the device?
Where MoorAI fits
MoorAI ships moorai-inference-hook, an Inference hooks server that runs on a host you operate, behind your own TLS proxy. It verifies signatures in constant time against the current and previous secret, rejects stale timestamps and repeated ids, and judges prompts, tool results, attachment text and tool calls with the same runtime as MoorAI’s other surfaces. A deny names threat ids and categories, never the content, and alerts are content-free. --fail open|closed decides what happens when it cannot judge an item. For the agents the hook cannot see, the same policy runs in MoorAI’s on-device hooks for Claude Code, Codex, Copilot CLI, Gemini CLI and Cursor, a model proxy (Anthropic, OpenAI, Gemini, local Ollama) and an MCP gateway.
Its limits: the hook server is tested against signed sample frames built from Anthropic’s published schema, not Anthropic’s live service, and it judges a tool call by its content only, because the files a call names are on the user’s machine.
Sources
- Overview, coverage and limits. Inference hooks, Claude Docs, Anthropic.
- Protocol, signing and tool calls. Develop an Inference hooks integration, Claude Docs, Anthropic.
- Failure handling and rollout. Configure Inference hooks, Claude Docs, Anthropic.
- Launch. Inference hooks: inline data loss prevention for Claude Enterprise, Anthropic, August 5, 2026.
- Zscaler. Zscaler Integrates With Claude Inference Hooks, Zscaler, August 5, 2026.
- MoorAI. MoorAI on GitHub, README section on Claude Enterprise Inference hooks.
See also: The layer above the model, Choosing an agentic security vendor, and MoorAI vs Zscaler.