Use Sentinel with Claude Code

To route Claude Code through an LLM gateway, set ANTHROPIC_BASE_URL to the gateway's Anthropic path, either in your shell or in the env block of Claude Code's settings.json (Anthropic: LLM gateway). SUPERWISE® Sentinel is that gateway: point Claude Code at it and each request is checked before it reaches Anthropic. The Windows app and the Sentinel CLI set the variable for you.

Claude Code sends your prompts, the files it reads, and command output to the model provider as part of each request (Anthropic: Data usage), so the gateway sees everything that would otherwise leave the machine.

There are two ways to set it up. Pick the one that matches the machine.

With the Windows app

1. Install and connect. Follow Sentinel for Windows: run the installer, click Connect, sign in, and approve this PC.
2. Check the Tools tab. The app lists the AI tools it found on the PC, Claude Code among them, and whether Sentinel is enforcing for each.
3. Run Claude Code. Open a new terminal and run claude. Its traffic now goes through the local gateway.

With the Sentinel CLI

1. Install the CLI.

   Shell

   pip install superwise-sentinel-cli
   sentinel --version

2. Run the guided setup.

   Shell

   sentinel quickstart

   Answer N to start a local gateway in Docker, or y to connect to a Sentinel your team already runs and paste its address. Press Enter to proxy for every provider. The CLI sets ANTHROPIC_BASE_URL to point at the gateway. See Install the Sentinel CLI for each prompt in detail.

3. Run Claude Code. The setting applies to new shells, so open a fresh terminal and run claude.

To route through a shared gateway in your own cloud account instead, deploy it first with Deploy a gateway, then choose y in step 2.

Set it in settings.json

To set the gateway yourself, or to make the setting survive new shells, put ANTHROPIC_BASE_URL in the env block of a Claude Code settings.json file. Claude Code applies every variable in env to each session (Anthropic: Settings). For a local gateway on port 8000:

{
  "env": {
    "ANTHROPIC_BASE_URL": "http://localhost:8000/anthropic"
  }
}

For a team gateway, use its URL with /anthropic on the end, as shown under Connect on the gateway's page in the SUPERWISE app. Which file you choose decides who the setting applies to:

A key set in a higher-precedence file wins: managed settings first, then project local, then shared project, then user. So a project's own .claude/settings.json that names a different ANTHROPIC_BASE_URL overrides your user file inside that project. To set the variable for one shell only, run export ANTHROPIC_BASE_URL="http://localhost:8000/anthropic" before claude. See Environment-variable instrumentation.

How do I confirm a guardrail fires?

sentinel test --text "My email is [email protected] and my key is sk-proj-abc123"

It prints whether the prompt passed, was redacted, or was blocked, with the redacted text. It never calls the model and is never recorded in telemetry (Gateway reference).

A prompt as Claude Code would send it, and as the provider receives it with the default placeholders:

Why does the export fail for [email protected]?
She called from 415-555-0132.
The job uses AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE

Why does the export fail for {{REDACTED}}?
She called from {{REDACTED}}.
The job uses AWS_ACCESS_KEY_ID={{REDACTED}}

Which values are caught, and whether each guardrail replaces or blocks, is set per Sentinel in Manage guardrails. The detected types are listed in PII redaction and Secret and credential detection.

How do I turn it off?

• CLI: run sentinel proxy off to restore direct routing to Anthropic. Run sentinel proxy on to turn it back on.
• Windows app: pause protection from the app's Protection view, where pausing is allowed on that PC, or uninstall as described in Sentinel for Windows.

What else should I set in Claude Code?

Sentinel cleans what is sent. Claude Code's own permission rules decide what it may read in the first place. Deny rules such as Read(./.env) and Read(./secrets/**) keep its file tools away from those paths (Anthropic: Configure permissions). Anthropic's security page covers permission modes, sandboxing, and prompt injection.

FAQ

Does SUPERWISE see my code or prompts?

No. Raw prompts and responses stay between the gateway and the provider. The control plane receives counts, which rule fired, and latency. See Data privacy.

Does this change how Claude Code works?

Claude Code works as before. Requests reach Anthropic through the gateway, with matched values replaced or the request blocked according to your guardrails.

Why does the same message keep getting blocked?

Claude Code resends the whole conversation on every turn, and Sentinel checks the whole prompt each time. If a blocking guardrail matched something earlier in the conversation, that content is replayed on every later turn and keeps getting blocked — even when your new message is fine. Prefer a remediate action for content that can recur in history, or start a new conversation to clear the triggering message. See Blocking and conversation history.

Do I need Docker?

Only to run a local gateway with the CLI. The Windows app and a connection to an existing team gateway need no Docker.

Which Claude Code setting points it at the gateway?

ANTHROPIC_BASE_URL, set as an environment variable or in the env block of settings.json. See Set it in settings.json.

Get Sentinel: Download for Windows. For why a gateway matters for Claude Code, see the Claude Code security guide on superwise.ai.

See also

• Sentinel CLI proxy: route every terminal with one toggle.
• Environment-variable instrumentation: set ANTHROPIC_BASE_URL by hand for one app.
• Sentinel for Windows: the desktop app for Windows 10 and 11.