Claude Cowork and Claude Code

The AgentID Security plugin (version 0.9.6) runs inside Claude on macOS, Windows and Linux. A plugin on a Claude account reaches Cowork and Code (the Desktop Code tab and Claude Code signed in with that account). Claude does not run plugins in ordinary chats; for those, install the Claude Desktop companion.

What it protects

Moment	What the plugin does
Prompt submit	Checks a prompt that looks sensitive. Claude cannot rewrite a prompt, so a prompt AgentID would mask is stopped and you get the protected version to send. Policy blocks stop the prompt.
Before every tool call	Inspects calls that can carry data off the device (shell, web, MCP actions other than reads). Supported documents (PDF, DOCX, XLSX, XLSM, PPTX, MD, TXT, CSV) are replaced with private masked text copies before a tool reads them.
After every tool call	Masks sensitive tool results before Claude sees them.
End of a response	Withdraws a response that breaks policy in the same turn.
Display and file writes	Shows the originals on screen, writes them into files Claude creates or edits, and masks them again when a tool reads such a file. Claude and the audit log keep the placeholders.

Originals live only in an encrypted per-session vault on the device (AES-256-GCM, kept for 7 days).

Requirements

An AI system with the Claude Desktop target. See Register an AI system.
Claude Code and the Desktop Code tab run plugin hooks on your computer and need Node.js 18 or later. Cowork provides Node.js in its sandbox. Without Node.js the plugin tells you once per session that protection is not active.

Set up for yourself

Download the plugin

Open the system's Integration tab, choose For me, and click Download Claude plugin. The ZIP is already connected to your AI system.

Add it to Claude

In Claude open Settings → Plugins → Add and choose the downloaded ZIP. This is needed once per Claude account; the plugin follows the account to every computer.

Allow the AgentID host in Cowork

In Settings → Capabilities, keep network egress enabled and add app.getagentid.com to the additional allowed domains. Start a new Cowork task: a running task does not receive the updated network rules.

Try it

Start a Cowork task or Claude Code session and send a prompt with a test name and e-mail address. It appears in the system's activity log.

A generic plugin package (for example one downloaded from the registration wizard) is not connected to a system. It asks for a setup code when you enable it; the Integration tab offers the setup code together with the generic packages.

Set up for the whole organization

Download the organization plugin

On the Integration tab choose Whole organization and click Organization plugin. Its activation is valid for one year and can be revoked.

Upload it once

In Claude Organization settings → Plugins & skills, upload the ZIP and set it to Required. It then covers Cowork and Code for every member without employee action.

Allow the AgentID host

In Organization settings → Capabilities, allow app.getagentid.com.

Every device and user still gets its own credential for Guard; the organization plugin runs as one installation.

Failure behaviour

Bundles follow the system's Strict Security (Fail-Closed) setting at download time; Claude systems start fail-open. The Integration tab shows the current behaviour: prompts continue (fail open) or prompts are blocked (fail closed). Download a new bundle after you change the setting.

Fail-open: Claude continues when AgentID is unreachable.
Fail-closed: protected document reads and calls that can carry data off the device do not run when AgentID cannot inspect them; local tools, prompts and responses continue. Without egress to the AgentID host, protected file reads and egress tools are blocked.

An explicit AgentID policy block is always enforced, independent of the failure mode.

Managing devices

The Integration tab lists Connected devices with version, last heartbeat and health. Admins can:

Revoke a single installation; it stops reaching AgentID Guard immediately, other devices keep working,
Stop new connections for an activation package; existing installations keep working.

Each personal installation creates its own credential, stored with private permissions on the device (Windows DPAPI, macOS Keychain, or an owner-only file elsewhere). A ZIP never contains an API key, only a revocable activation: seven days and a limited number of seats for the personal plugin, one year for the organization plugin.

Limits

The plugin can protect a document only when Claude exposes a local file path to a tool call.
Files dragged into a Claude chat are not covered by the plugin. On Windows, the companion protects files added with Add files or photos.