Identra Logo
IDENTRA
CODING AGENT SECURITY

Secure Claude Code and Codex on developer machines

Your developers’ coding agents can run shell commands, read secrets and call MCP tools on company laptops. Identra helps you see what they run, block sensitive prompts and destructive commands by policy, and trace each run to a user and device.

WORKS INEndpoint
See Identra on the endpoint
Coding agentsCOVERED
  1. See the tools developers actually run01
  2. Block risky prompts before send02
  3. Put boundaries on agent actions03
  4. Protect local files on macOS04
  5. Know who ran what05
ONE IDENTITY · ONE TIMELINEEndpoint
01What goes wrong today

The risk is already in use.

What security teams run into with coding agents today, before a control is in place.

  • 01

    Approval misses what comes next

    Approving a coding assistant does not settle which MCP servers, skills or plugins developers add. Each addition can change what the agent can do.

  • 02

    Secrets sit beside the code

    Local credentials and configuration files share a workspace with source code. A coding task can put sensitive material within an agent’s reach.

  • 03

    A suggestion becomes an action

    Coding agents can execute commands and call tools. A mistaken instruction can become a destructive action on a developer’s laptop.

  • 04

    Investigations need a clear owner

    When an agent does something risky, security needs to know who ran it, on which device and what happened. An approved app list cannot answer those questions.

02What Identra does

What changes with Identra.

Covered by Identra on macOS and Windows, tied to one identity and one timeline.

Identra on macOS and WindowsSee Identra on the endpoint
  • 01

    See the tools developers actually run

    Identra discovers coding agents, desktop AI apps, MCP servers, skills and plugins on macOS and Windows. Bring the tools behind each workflow into your AI inventory.

  • 02

    Block risky prompts before send

    Identra checks prompts to Claude Code and Codex on the device before they are sent. Prompts that violate policy can be blocked when enforcement is active.

  • 03

    Put boundaries on agent actions

    Identra checks AI agent tool calls against policy. Destructive shell commands are denied when policy is set to block.

  • 04

    Protect local files on macOS

    On macOS, Identra can deny AI agents access to protected files. Set a boundary around files agents should not read.

  • 05

    Know who ran what

    Identra records each AI agent run with the user, device, AI client and allowed or blocked outcome. Where the person is known, endpoint activity joins browser and provider activity in one identity timeline.

03Before and after

A routine code change reaches local secrets

The same moment, played twice. Once without Identra, once with it.

WITHOUT IDENTRA

EXPOSED

  1. A developer asks Claude Code to fix a failing build on a company Mac.

  2. The task leads the agent to read a local file containing credentials.

  3. The agent attempts a destructive cleanup command.

  4. Security must piece together who ran the agent and what happened.

WITH IDENTRA

CONTAINED

  1. Identra discovers Claude Code and the MCP servers, skills and plugins on the laptop.

  2. Access to the protected credentials file is denied on macOS.

  3. With policy set to block, the destructive shell command is denied.

  4. The agent run is recorded with the developer, device, AI client and blocked outcome.

04How it works

Four steps. One timeline.

  1. 01

    See

    Bring coding agents, MCP servers, skills and plugins on developer laptops into your AI inventory.

  2. 02

    Decide

    Set policy boundaries for coding agent prompts and tool calls.

  3. 03

    Enforce

    Block policy-violating Claude Code and Codex prompts, deny destructive shell commands and protect files on macOS.

  4. 04

    Record

    Review each agent run with its user, device, AI client and allowed or blocked outcome.

QUESTIONS

What buyers ask us about coding agents.

Where are developer prompts checked?

Prompts to Claude Code and Codex are checked on the device before they are sent. When policy is active, prompts that violate it are blocked.

Where can we deploy Identra for coding agents?

The Identra endpoint agent supports macOS and Windows. It discovers coding agents, desktop AI apps, MCP servers, skills and plugins on those devices.

Can developers keep using Claude Code and Codex?

Yes. Identra provides policy controls for their prompts and AI agent tool calls. You can set boundaries for sensitive prompts and destructive shell commands while allowing permitted activity.

Are the controls the same for every agent and operating system?

Coverage is specific to the control. Prompt checks cover Claude Code and Codex, AI agent tool calls are checked against policy, and protected-file access controls apply on macOS.

How does this help us investigate an agent action?

Identra records each run with the user, device, AI client and allowed or blocked outcome. Where the person is known, activity connects to one identity timeline for an AI audit trail.

KEEP READING

The terms, comparisons and essays behind this page.

GLOSSARY

COMPARE AND READ

MORE AI PROBLEMS IDENTRA SOLVES

All solutions
SEE IT IN YOUR ENVIRONMENT

See Identra handle coding agents.

A walkthrough with a security engineer.

See Identra on the endpoint