> ## Documentation Index
> Fetch the complete documentation index at: https://mintlify.hoop.dev/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Claude Code

> Proxy Claude Code to ensure sensitive data won’t leak.

export const ConnectionTemplate = ({config}) => {
  const defaultConfig = {
    name: "Connection",
    description: "Connection description",
    coverImage: "",
    features: {
      tlsTerminationProxy: {
        native: false,
        oneOff: false
      },
      audit: {
        native: false,
        oneOff: false
      },
      dataMaskingGoogleDLP: {
        native: false,
        oneOff: false
      },
      dataMaskingMSPresidio: {
        native: false,
        oneOff: false
      },
      guardrails: {
        native: false,
        oneOff: false
      },
      credentialsOffload: {
        native: false,
        oneOff: false
      },
      interactiveAccess: {
        native: false,
        oneOff: false
      }
    }
  };
  const finalConfig = Object.assign({}, defaultConfig, config);
  const renderIcon = enabled => {
    return enabled ? <Icon icon="check" /> : <Icon icon="xmark" />;
  };
  return <div>
      <h2>Before you start</h2>
      <p>To get the most out of this guide, you will need to:</p>
      <ul>
        <li>Either <a href="https://use.hoop.dev">create an account in our managed instance</a> or <a href="/getting-started/installation/overview">deploy your own hoop.dev instance</a></li>
        <li>You must be your account administrator to perform the following commands</li>
      </ul>

      {finalConfig.requirements && <>
          <h2>Requirements</h2>
          <p>{finalConfig.requirements.description}</p>
          {finalConfig.requirements.items && <ul>
            {finalConfig.requirements.items.map(item => <li>{item}</li>)}
          </ul>}
        </>}

      <h2>Features</h2>
      <p>The table below outlines the features available for this type of connection.</p>

      <ul>
        <li><strong>Native</strong> - Accessible via a native connection using hoop as proxy protocol to the resource.</li>
        <li><strong>One Off</strong> - This term refers to accessing the resource from Hoop Web Console.</li>
      </ul>

      <table>
        <thead>
          <tr>
            <th>Feature</th>
            <th>Native</th>
            <th>One Off</th>
            <th>Description</th>
          </tr>
        </thead>
        <tbody>
          <tr>
            <td>TLS Termination Proxy</td>
            <td>{renderIcon(finalConfig.features?.tlsTerminationProxy?.native)}</td>
            <td>{renderIcon(finalConfig.features?.tlsTerminationProxy?.oneOff)}</td>
            <td>The local proxy terminates the connection with TLS, enabling the connection with the remote server to be TLS encrypted.</td>
          </tr>
          <tr>
            <td>Audit</td>
            <td>{renderIcon(finalConfig.features?.audit?.native)}</td>
            <td>{renderIcon(finalConfig.features?.audit?.oneOff)}</td>
            <td>The gateway stores and audits the queries being issued by the client.</td>
          </tr>
          <tr>
            <td>Data Masking (Google DLP)</td>
            <td>{renderIcon(finalConfig.features?.dataMaskingGoogleDLP?.native)}</td>
            <td>{renderIcon(finalConfig.features?.dataMaskingGoogleDLP?.oneOff)}</td>
            <td>A policy can be enabled to mask sensitive fields dynamically when performing queries in the database.</td>
          </tr>
          <tr>
            <td>Data Masking (MS Presidio)</td>
            <td>{renderIcon(finalConfig.features?.dataMaskingMSPresidio?.native)}</td>
            <td>{renderIcon(finalConfig.features?.dataMaskingMSPresidio?.oneOff)}</td>
            <td>A policy can be enabled to mask sensitive fields dynamically when performing queries in the database.</td>
          </tr>
          <tr>
            <td>Guardrails</td>
            <td>{renderIcon(finalConfig.features?.guardrails?.native)}</td>
            <td>{renderIcon(finalConfig.features?.guardrails?.oneOff)}</td>
            <td>An intelligent layer of protection with smart access controls and monitoring mechanisms.</td>
          </tr>
          <tr>
            <td>Credentials Offload</td>
            <td>{renderIcon(finalConfig.features?.credentialsOffload?.native)}</td>
            <td>{renderIcon(finalConfig.features?.credentialsOffload?.oneOff)}</td>
            <td>The user authenticates via SSO instead of using database credentials.</td>
          </tr>
          <tr>
            <td>Interactive Access</td>
            <td>{renderIcon(finalConfig.features?.interactiveAccess?.native)}</td>
            <td>{renderIcon(finalConfig.features?.interactiveAccess?.oneOff)}</td>
            <td>Interactive access is available when using an IDE or connecting via a terminal to perform analysis exploration.</td>
          </tr>
        </tbody>
      </table>

      {finalConfig.resourceConfiguration?.credentials && <>
      <h2>Configuration</h2>
      <table>
        <thead>
          <tr>
            <th>Name</th>
            <th>Type</th>
            <th>Required</th>
            <th>Description</th>
          </tr>
        </thead>
        <tbody>
          {Object.entries(finalConfig.resourceConfiguration.credentials).map(([key, credential]) => {
    if (typeof credential === 'string' || credential.hidden) return null;
    return <tr key={key}>
                <td>{credential.name}</td>
                <td>{credential.type}</td>
                <td>{credential.required ? 'yes' : 'no'}</td>
                <td>
                  {credential.description?.split(/(\[[^\]]+\]\([^)]+\))/).map((part, index) => {
      const linkMatch = part.match(/\[([^\]]+)\]\(([^)]+)\)/);
      if (linkMatch) {
        return <a key={index} href={linkMatch[2]} target="_blank" rel="noopener noreferrer">{linkMatch[1]}</a>;
      }
      return part;
    })}
                </td>
              </tr>;
  }).filter(Boolean)}
        </tbody>
      </table>
      </>}
    </div>;
};

<Frame>
  <img src="https://mintcdn.com/hoopdev/eBJ_qColeJpg8LDD/images/quickstarts/claude-code.png?fit=max&auto=format&n=eBJ_qColeJpg8LDD&q=85&s=7064e1facb9a921de6244d7394527a0f" alt="Claude Code Resource type at hoop.dev" width="3068" height="1726" data-path="images/quickstarts/claude-code.png" />
</Frame>

Once a coding assistant has API connectivity, it is no longer making suggestions. It is reading production data, ingesting environment variables, and operating inside the same execution path as your engineers.

The default response has been to restrict access to a sandbox, remove production context, and accept reduced usefulness.

That tradeoff is no longer necessary.

The Claude Code connection type routes Claude Code's API traffic through hoop.dev before it reaches your infrastructure. With it, you can give Claude Code production access while maintaining the controls your security and compliance teams require:

* Sensitive data is masked before Claude Code sees it. PII, credentials, and secrets in query results are redacted in real time. The model works with the schema and structure, not the raw values.
* Credentials are never handed to the model. Claude Code authenticates through hoop.dev's SSO integration. Database credentials are retrieved just-in-time and never exposed to the model or its context window.
* Every query is logged at the command level. More granular than session-level access records, with hoop.dev every individual query is logged, with full context, in a structured and searchable audit trail.
* Guardrails can block or gate actions outside approved patterns. Queries or commands that fall outside policy can be blocked outright or routed through an approval workflow, without changing how Claude Code is invoked.

The result is that Claude Code interrogates real schemas, surfaces actual data anomalies, and generates migration scripts against live table structures without your credentials or PII leaving the controlled environment.

<ConnectionTemplate
  config={{
"id": "claude-code",
"name": "Claude Code",
"description": "Proxy Claude Code to ensure sensitive data won’t leak.",
"category": "ai-and-llms",
"icon-name": "claude",
"coverImageAlt": "Claude Code Resource type at hoop.dev",
"tags": [
"ai",
"llm",
"security",
"proxy"
],
"overview": {
"description": "Claude Code has never been safer. Use all Hoop features in front of Claude Code and gain the safety of ensuring sensitive data won’t be leaked to LLMs. Create Guardrails and Data Masking rules on top of a centralized API Key and distribute it to everyone in your organization through Hoop."
},
"setupGuide": {
"accessMethods": {
  "webapp": false,
  "cli": false,
  "native": true,
  "runbooks": false
}
},
"resourceConfiguration": {
"type": "httpproxy",
"subtype": "claude-code"
},
"features": {
"tlsTerminationProxy": {
  "native": true,
  "oneOff": false
},
"audit": {
  "native": true,
  "oneOff": false
},
"dataMaskingGoogleDLP": {
  "native": false,
  "oneOff": false
},
"dataMaskingMSPresidio": {
  "native": true,
  "oneOff": false
},
"guardrails": {
  "native": true,
  "oneOff": false
},
"credentialsOffload": {
  "native": true,
  "oneOff": false
},
"interactiveAccess": {
  "native": false,
  "oneOff": false
}
},
"documentationConfig": {
"path": "quickstart/ai-and-llms/claude-code"
}
}}
/>

### Claude Code is only as useful as the context you give it

Unproxied access for coding assistants to production resources has three primary risks: what commands a model can execute, what sensitive data a model can see, and what it can send.

Hoop.dev elegantly solves all three risks with controls embedded into the application protocols. Guardrails filter and block dangerous actions. Dynamic data masking ensures the model never sees or sends sensitive data outside of the boundary. Every action taken by Claude is logged with full context and the evidence is made immediately exportable via webhooks.

With hoop.dev, you can confidently give Claude the context and access it needs to be valuable without jeopardizing your security posture or uptime. Talk to our team if you want to discuss your setup before deploying.

[Talk to our team](https://dub.sh/G85aUr8) if you want to discuss your setup before deploying.