Engineering teams deploy Claude Code faster than security and platform teams can govern its access, credentials, and actions. Organizations need two layers of governance: an LLM gateway to control model API traffic, and an MCP gateway to govern tool access. Without these controls, teams face unpredictable Claude Code spend, credential sprawl where API-key authentication is used, and fragmented visibility into AI coding activity. Anthropic reports average enterprise usage of about $13 per developer per active day and $150-250 per developer per month, with substantial variation by model, codebase size, and usage pattern. MintMCP's MCP Gateway governs Claude Code's access to enterprise tools through centralized authentication, credential handling, tool curation, access control, and audit logging. 

This article explains how to route Claude Code through governed infrastructure, covering architecture decisions, implementation steps, cost management strategies, security controls, and compliance requirements for enterprise AI deployments.

Key Takeaways

• Claude Code supports centralized LLM gateway routing: ANTHROPIC_BASE_URL points Claude Code at an LLM gateway, while organizations typically distribute a separate gateway credential and managed settings for consistent enforcement
• Anthropic provides native cost controls and reporting: Claude Enterprise supports per-user spend limits and Analytics API access, while Claude Platform provides Claude Code analytics and organization/workspace usage controls; organizations may add gateways for near-real-time telemetry or cross-infrastructure visibility
• Model selection can reduce unnecessary token spend: Anthropic recommends using Sonnet for most coding tasks, reserving Opus for complex reasoning, and using Haiku for suitable lightweight tasks
• Agent identity separates human and machine actions: Autonomous agents receive first-class non-human identities with independent credentials, scoped permissions, and attributable audit trails
• Two-layer visibility covers gateway and endpoint activity: MCP Gateway governs tool access while Agent Monitor captures prompts, commands, file access, and MCP tool calls across supported clients
• Runtime guardrails stop dangerous actions before execution: Managed detection policies screen for prompt injection, secrets, PII, and harmful content on governed MCP activity

Why Enterprises Need Governed Claude Code Infrastructure

The Ungoverned AI Coding Assistant Problem

Claude Code operates as an agentic coding assistant that autonomously reads files, executes commands, and calls external tools. Without governance, this creates enterprise risks:

Cost visibility gaps: Native Anthropic reporting provides usage and cost visibility, but organizations may still need more centralized or near-real-time attribution across teams, gateways, and AI infrastructure. Long-running sessions can become expensive because token usage scales with context size, model choice, and agentic activity.

Credential sprawl: Developers configure API keys locally when using API-key authentication, creating multiple installation points and potential leak vectors. A compromised laptop can expose keys to production systems.

Shadow AI proliferation: Personal Claude Pro subscriptions on corporate credit cards escape procurement visibility entirely. Research shows that 26 of the top 50 unsanctioned enterprise apps in 2026 are AI tools.

Audit visibility gaps: Local Claude Code session records alone do not provide a centralized organizational audit trail. Anthropic supports organization analytics and OpenTelemetry export, while gateways and endpoint monitoring can add centralized request, usage, and activity visibility.

The Strategic Case for Gateway Architecture

Governed infrastructure sits between Claude Code instances and both model APIs and enterprise tools, intercepting requests to enforce policy. This architecture enables:

• Real-time cost attribution across teams, developers, and projects
• Centralized credential management where platform teams hold API keys and developers authenticate via SSO
• Layered audit visibility where an LLM gateway logs routed model API requests and usage, MCP Gateway logs governed MCP interactions, and Agent Monitor provides visibility into supported endpoint activity
• Compliance-grade controls for SOC 2 and HIPAA requirements

MintMCP's approach starts from data-permissions-first architecture: governance is the foundation, and AI agent capabilities are enabled on top.

How Claude Code Gateway Architecture Works

Request Interception and Policy Enforcement

A Claude Code LLM gateway sits on the model API path: Claude Code sends inference requests to the configured gateway, the gateway authenticates the request, applies supported model and spend policies, and forwards approved traffic to the configured Claude provider.

MCP governance is a separate path. MintMCP's MCP Gateway controls which enterprise tools Claude Code can access, which credentials are used for those tools, and how those MCP interactions are logged and governed.

Gateway overhead varies by implementation and deployment topology. Measure latency in your own environment rather than assuming a fixed millisecond overhead.

Virtual MCPs as the Unit of Governance

MintMCP's MCP Gateway introduces Virtual MCPs (VMCPs) as the core abstraction. A Virtual MCP bundles approved connectors and a curated tool surface behind one governed endpoint for a particular team, role, use case, or agent.

What VMCPs enable:

• Per-role tool curation: Engineering sees GitHub, Datadog, and database connectors; marketing sees HubSpot and Google Analytics
• Read-only vs read-write separation: Same underlying connector, different tool exposure based on job function
• SCIM-driven membership: Directory groups automatically control who accesses which VMCP
• Unified audit trail: All activity through a VMCP flows to one audit stream regardless of underlying connectors

This means a security team can answer "what can the support team's Claude Code access?" by examining one VMCP configuration rather than auditing dozens of individual tool permissions.

Credential Injection Without Developer Exposure

Traditional MCP configurations require developers to manage API keys, OAuth tokens, and database credentials locally. MintMCP's credential injection model eliminates this risk:

• Platform team configures credentials once: API keys stored in the gateway's vault, encrypted at rest
• Per-call injection: Gateway injects appropriate credential for each tool call; developer never sees the secret
• Per-user OAuth where applicable: GitHub connector uses each developer's own OAuth token; database connector uses shared read-only credentials
• Independent rotation: Credentials rotate without touching developer machines

Implementing Claude Code Gateway Routing

Choose Your Gateway Deployment Model

Organizations face a decision: managed SaaS gateway or self-hosted infrastructure.

Use managed SaaS when:

• You want MintMCP to operate the managed infrastructure
• Your security, data residency, and network requirements are compatible with the managed deployment
• Your platform team wants to minimize infrastructure operations

Consider VPC or self-hosted deployment when:

• Internal security policy requires customer-controlled infrastructure
• Private-network or deployment architecture requirements make a managed deployment unsuitable
• Your organization requires greater control over infrastructure, networking, or data handling

MintMCP is managed SaaS-first, with VPC and self-hosted options available on request for enterprise requirements.

Configure the Gateway Infrastructure

Gateway setup (Platform Team, 1-2 hours for managed SaaS):

1. Create organization in gateway platform
2. Configure SSO integration (Okta, Azure AD, Google)
3. Set up SCIM provisioning for automatic user/group sync
4. Add Anthropic API key to gateway's secret store
5. Define initial budget limits where supported

Create Virtual MCP for engineering team:

Create an engineering Virtual MCP that bundles the approved connectors, exposes only the required tools, and grants access through the appropriate engineering directory group. Configure model API budgets separately in the LLM gateway or Anthropic administrative controls used for Claude Code inference.

Deploy to Developer Machines

Global configuration (all Claude Code sessions):

Developers edit ~/.claude/settings.json:

 

{

  "env": {

    "ANTHROPIC_BASE_URL": "https://your-gateway.example.com",

    "ANTHROPIC_AUTH_TOKEN": "your-sso-derived-token"

  }

}

 

Project-level configuration (team repositories):

A repository can commit shared Claude Code settings such as a gateway base URL where appropriate, but gateway credentials should not be committed to .claude/settings.json. Distribute credentials separately through managed settings, device or secrets tooling, or an apiKeyHelper.

MDM deployment (enterprise IT managed):

Platform team pushes managed-settings.json via Intune, Kandji, or JumpCloud for OS-level configuration that developers cannot override. Best for zero-trust environments requiring tamper-proof gateway routing.

MintMCP provides detailed Claude Code setup documentation covering each deployment method.

Verify Gateway Routing

Validation checklist:

• Run claude --version to confirm client installation
• Execute a simple prompt and verify activity appears in gateway dashboard
• Check that budget tracking shows token consumption where configured
• Confirm SSO identity attribution in audit logs
• Test budget cap by setting temporary low limit and verifying block behavior

Common issues and fixes:

Issue	Cause	Solution
"Connection refused"	Gateway not running or firewall blocking	Check gateway status; verify network path
"Model not available"	User's IdP group lacks model access	Update gateway policy configuration
Requests not reaching gateway	Gateway base URL missing or not active	Run /status and verify active Anthropic base URL and credential source
Tools not appearing	VMCP tool curation too restrictive	Review allowed tools list in VMCP config

Managing Claude Code Costs Through Gateway Controls

Understanding Claude Code Cost Drivers

Claude Code costs accumulate faster than traditional API usage because of agentic behavior patterns:

• Context accumulation: Each tool call includes full conversation history, rapidly consuming tokens
• Retry loops: Failed tool calls trigger retries with expanded context
• Model selection: Developers may default to Sonnet/Opus even for simple tasks
• Background processes: Agentic sessions running autonomously can execute hundreds of tool calls

Anthropic's official guidance reports $150-250/month typical enterprise usage, with 90% of enterprise users remaining below $30 per active day.

Implementing Hierarchical Budget Controls

Configure organization, group, or individual spend limits using the administrative controls provided by your chosen LLM gateway or Anthropic deployment. Supported policy controls can block access to specific models and limit the models presented to users.

Alert thresholds: Configure notifications at 80% budget consumption to give developers runway to request increases before hitting hard caps.

Model Selection for Cost Optimization

Use Claude Code's current haiku, sonnet, and opus model aliases where possible. Organizations can reduce unnecessary model spend by matching model capability to workload complexity, but savings vary significantly by model mix, workload, context size, and usage patterns.

Model selection strategy:

Task Type	Model	Use Case
Simple completions, comments, typo fixes	Haiku	Lightweight tasks
Standard code generation	Sonnet	Most coding work
Complex architecture, security review	Opus	Complex reasoning

Cost Attribution and Visibility

MintMCP's Agent Monitor provides visibility into token spend by model, user, agent, and session. This enables:

• Departmental attribution: Allocate AI costs to cost centers based on actual usage
• Usage attribution: Break down supported usage and token-cost data by dimensions such as user, agent, model, session, or team
• Anomaly detection: Flag users whose spend deviates significantly from peers
• Trend analysis: Identify which teams are scaling AI usage and budget accordingly

Securing Claude Code with Runtime Guardrails

The Runtime Security Challenge

Claude Code's agentic nature creates unique security risks:

• Tool poisoning: Malicious tool descriptions can inject instructions into the agent's prompt
• Command execution: Claude Code can run arbitrary shell commands, including curl to external sites
• File access: The agent reads .env files, SSH keys, and other sensitive configuration
• Data exfiltration: Prompts containing customer data flow to model provider APIs

Traditional security controls (firewall rules, endpoint protection) don't address these AI-specific risks. AI governance frameworks emphasize runtime controls at the agent-tool interaction layer.

MintMCP's Three-Layer Guardrail Architecture

MintMCP separates gateway guardrails from endpoint monitoring. Mint Guard, Rules, and Gateway Middleware apply runtime policy to governed MCP activity, while Agent Monitor can apply supported monitoring and security controls to local Claude Code activity such as commands, file access, prompts, and MCP tool calls.

Mint Guard (Managed Detection):

• Prompt injection detection blocking high-confidence attacks
• Credential and secret detection in prompts and responses
• PII detection with configurable enforcement
• Harmful content screening
• Available in Monitoring or Enforcing modes

Rules (Declarative Policy):

• Match tool names, argument patterns, or content via regex
• Actions: flag, block, ask-user, mask, or notify
• Example: Block any tool call containing rm -rf or database DROP statements

Gateway Middleware (Custom Logic):

• Customer-authored JavaScript running in a sandboxed environment
• Integrate external DLP systems, classifiers, or resource policies
• Transform, redact, or rewrite tool calls based on custom logic
• Fail-closed for policy-critical checks

Learn more about implementing runtime guardrails for Claude Code deployments.

Practical Guardrail Examples

Block dangerous shell commands:

rules:

- name: block-dangerous-commands

match:

tool: bash_execute

argument_contains: ["rm -rf", "curl | sh", "wget | bash"]

action: block

notify: security-channel

Detect PII in prompts:

Use Mint Guard's managed PII detection in Enforcing mode. For customer-defined regex patterns, use declarative Rules instead.

Agent Identity and Non-Human Principal Management

Why Agent Identity Matters

When Claude Code runs autonomously (CI pipelines, scheduled tasks, background agents), traditional human-centric identity breaks down:

• Agents inherit whichever developer's API key was configured, collapsing attribution
• Shared service accounts make "who did what" impossible to answer
• Credential rotation requires touching every agent configuration
• Revocation is all-or-nothing rather than per-agent

MintMCP's Agent Gateway treats autonomous agents as first-class non-human principals with their own identities, credentials, and audit trails.

Agent Identity Implementation

Creating an agent identity:

Each agent receives:

• Named identity scoped to the organization
• Its own VMCP with purpose-built tool access
• Independent credential with configurable expiry
• Attributable audit trail separate from human users

Authentication mechanisms:

Method	Security Level	Use Case
Bearer keys	Basic	Simple integrations, development
M2M tokens	Medium	Production services, OAuth client-credentials
Workload identity federation	Highest	K8s service accounts, cloud IAM roles

Credential lifecycle:

• Create agent identity with scoped permissions
• Generate bearer key or configure M2M client
• Agent authenticates independently from human users
• Rotate or revoke without impacting other agents
• Full audit trail of agent actions

Compliance and Audit Trail Requirements

SOC 2 and HIPAA Considerations

Regulated industries require demonstrable controls over AI tool access. A governed Claude Code infrastructure provides:

For SOC 2:

• Complete audit trail of tool calls, credential usage, and access policy changes
• Role-based access control with IdP integration
• Incident response capability via operational controls
• Evidence of security monitoring and alerting

For HIPAA:

• PII detection and configurable security controls that can support an organization's HIPAA-related data protection policies
• Audit logs showing who accessed what data via AI
• Access controls limiting which users can query healthcare systems
• Data residency options for VPC-native deployment

MintMCP maintains SOC 2 Type II attestation with continuous compliance monitoring. Customers handling protected health information can request HIPAA documentation and BAA signing.

Building Compliance-Ready Audit Trails

What gets logged:

• Every tool call with arguments and response
• User identity (SSO-derived)
• Timestamp and session context
• Token consumption and model used
• Policy decisions (allowed, blocked, transformed)

SIEM integration:

MintMCP supports SIEM export via OTLP or Splunk HEC, enabling:

• Centralized log aggregation with existing security infrastructure
• Correlation of AI activity with other security events
• Long-term retention per compliance requirements
• Alerting on anomalous AI usage patterns

Tamper-evident records: Access-grant history is signed at write time and verifiable offline via published JWKS, providing cryptographic assurance that audit records haven't been modified.

MintMCP's Unified Approach to Claude Code Governance

MintMCP brings multiple layers of Claude Code governance into one platform:

 

• Model API controls: LLM gateway functionality manages model routing, authentication, usage, and spend policies
• Tool access governance: MCP Gateway uses Virtual MCPs to control which enterprise tools users and agents can access
• Endpoint visibility: Agent Monitor captures supported activity such as prompts, commands, file access, MCP tool calls, usage, and token costs
• Agent identity: Agent Gateway gives autonomous agents independent identities, credentials, scoped permissions, and attributable audit trails

Virtual MCPs let platform teams configure connectors, credentials, and access policies centrally. Engineering might receive GitHub, Datadog, and database tools through one VMCP, while marketing receives HubSpot and analytics tools through another, all governed through SSO-backed access and centralized credential handling.

For autonomous workloads such as CI/CD jobs, scheduled tasks, and background agents, Agent Gateway separates machine activity from developer identities. Each agent can have its own credentials and permissions that can be independently rotated or revoked.

Organizations should calculate ROI using their own Claude Code spend, platform costs, and operational overhead. Centralized usage attribution can simplify cost reconciliation, while unified audit and activity data can reduce reliance on individually collected endpoint records during investigations.

Frequently Asked Questions

Can I route Claude Code through a gateway without any developer workflow changes?

Yes. Claude Code can be configured to use an LLM gateway through ANTHROPIC_BASE_URL, along with the gateway's required authentication configuration. Platform teams can distribute these settings through managed deployment tooling so developers can continue using the normal Claude Code workflow.`

How does the gateway handle Claude Code's streaming responses?

Modern LLM gateways fully support Server-Sent Events (SSE) streaming, which Claude Code uses for real-time response display. The gateway intercepts the stream, logs it for audit purposes, and passes it through to the developer. Throughput scales horizontally for high-volume teams.

What happens if the gateway goes down? Does Claude Code stop working?

If the configured gateway is unreachable, Claude Code requests normally fail unless the organization has explicitly designed a separate bypass path. High-availability deployments should instead use redundant gateway instances and, where supported, upstream failover behind the gateway so governance remains in place.

Can the gateway enforce different policies for different models within Claude Code?

Yes. Supported policy controls can block access to specific models and limit the models presented to users. For example, contractors might be limited to Haiku-tier models while senior engineers have full Opus access.

Does gateway routing work with Claude Code's MCP tool integrations?

Gateway routing for Claude Code API traffic is separate from MCP tool governance, though both can be addressed through a comprehensive platform. MintMCP's MCP Gateway governs tool access (which connectors, which tools, which credentials), while LLM gateway functionality controls the Claude Code to Anthropic communication path. For complete governance, organizations deploy both: API routing for cost control and audit, plus MCP Gateway for tool access control.

What visibility do I get into Claude Code activity beyond API costs?

MintMCP's Agent Monitor extends visibility beyond gateway traffic to capture activity at the endpoint level: file reads (including .env and SSH keys), shell commands, MCP tool calls, and prompt submissions. Coverage varies by supported client, agent, and hook phase, but combining gateway governance with Agent Monitor can provide broader visibility into both routed MCP activity and supported endpoint activity.