TL;DR:
Claude has quietly become the model that touches the most sensitive surface in a lot of companies. Not through the chat window, but through Claude Code reading a repository and querying a database, through Claude Desktop connected to internal systems, and through Agent SDK workflows that act on customer records. Every one of those paths sends real data to an API endpoint you do not control.
That is what people are actually looking for when they search for a Claude gateway. This guide covers what one is, how the Claude Code case differs from the rest, and how to govern it without turning a useful agent into a broken one.
A Claude gateway is a proxy between your Claude clients and the Anthropic API. Instead of each machine, service and agent holding its own key and calling the provider directly, everything points at the gateway, and the gateway decides what happens before the request continues.
Three jobs justify putting one in the path:
For the vendor-neutral version of this, see what is an AI gateway. For the provider-routing angle, see what is an LLM gateway.
Claude Code is the reason most security teams start caring about this. A chat assistant leaks whatever a human pastes into it. A coding agent leaks whatever it decides to read, which is a much larger and far less predictable surface.
The pattern repeats across almost every team we talk to. An engineer asks Claude Code to debug a failing order. The agent does the sensible thing and queries the database, which in dev and test is frequently a copy of production. Four hundred rows of names, emails and card numbers land in the context window, and all of them go to the provider on the next turn. Nobody decided that should happen, and nobody can say afterwards what was retained.
Blocking the request is not a fix, because the agent needs the rows to do the work. Strac substitutes them instead, so the query returns, the agent reasons over tokens, and the debugging session proceeds normally.
If the data is shared in advance rather than queried live, you can also redact at the source with Postgres masking so the agent only ever reads masked rows, or with Endpoint DLP for files on the machine itself. Use either layer or both.
Claude Code is not the only path. Claude Desktop connects to internal systems, apps and connectors reach into SaaS tools, and Agent SDK workflows run unattended. Governing those one at a time does not scale, and the gaps are exactly where incidents happen.
Because Strac sits at the API boundary rather than inside any one client, every surface that speaks the Anthropic Messages API inherits the same policy. You define data elements, actions and exclusions once, and they apply whether the request came from a terminal, a desktop app or an unattended job.
For the inbound half, meaning what agents are allowed to pull in from your tools over the Model Context Protocol, pair this with an MCP gateway and read MCP DLP.
Search for a Claude Code LLM gateway and most of what comes back is about provider management: spreading traffic across models, failing over, tracking spend. Those are real operational needs and the incumbents handle them competently.
They also do not change your exposure by one byte. Routing decides where a request goes. It never touches what is inside it. A team can deploy a perfectly engineered routing layer, watch their cost dashboard improve, and still be sending every customer record their coding agent reads straight to a provider.
So the useful way to evaluate a gateway for Claude Code is to ignore the routing feature grid, which is converging anyway, and ask the content question instead.
Governance is the word that shows up once a security reviewer gets involved, and it usually means five specific things. Here is how the realistic options compare on them.
| Capability | Strac | Cloudflare AI Gateway | Kong | Azure API Management |
|---|---|---|---|---|
| Detects sensitive data in requests | Yes, 255 element types | Yes | Yes, AI PII Sanitizer plugin | Via Azure AI Content Safety and Foundry filters, not APIM itself |
| Behaviour on a hit | Substitutes and restores | Flags or blocks | Substitutes, restores in response only | Annotates or blocks |
| Agent still completes the task | Yes | No | No | No |
| Restores values inside tool calls | Yes | No | No | No |
| Images and PDFs via OCR | Yes | Limited | No | No |
| Deterministic tokens, caching survives | Yes | Not applicable | Not applicable | Not applicable |
| Runs fully in your own network | Yes, no calls home | No | Self-managed or Konnect SaaS control plane | Your Azure tenant |
Strac is first on governance for one reason the table makes plain: it is the only option that restores values inside tool calls. Kong comes closest of the incumbents, and its AI PII Sanitizer genuinely substitutes and can restore originals, but restoration lands in the response body rather than in the tool call an agent is about to execute. For a chat product that distinction is academic. For Claude Code, the tool call is the work. Everywhere else on this table, enforcing the policy means the agent stops, so the policy gets switched off within a month and the governance is theoretical.
The honest gap: Strac does not ship routing, failover or cost dashboards today. Those are on the roadmap. We built the classifier and the token vault first because that is the part that is genuinely hard and the part a reviewer actually blocks on.
See it on your own data. Send a few examples of what your Claude agents handle and Strac returns a tuned policy plus a report of exactly what Anthropic would have received. Book a demo or browse the integrations your agents already touch.
Tokens are deterministic rather than random, which is what keeps Claude useful. It can tell that two rows belong to the same customer, group by email address and refer back to a specific person later in a long session. It simply never learns who that person is.
This deserves its own section because it is how most redaction layers die. Anthropic's prompt caching works by matching a prefix of the conversation. Claude Code sessions are long and resend a lot of history, so caching is doing real work on your bill. Any filter that generates a fresh placeholder per request changes that prefix every turn, the cache stops hitting, and costs climb for reasons nobody connects to the security tool they installed six weeks earlier.
Deterministic tokenization sidesteps it entirely. Strac also re-checks the agent's history on every request before it leaves, so a value that slipped in earlier does not quietly persist across a session.
An agent asked to refund an order and email the customer, start to finish.
Step 1, in your environment. The agent queries the orders table and gets back real values:
SELECT name, email, card FROM orders WHERE id = 88213;
Jane Doe | jane.doe@example.com | 4111 1111 1111 1111
Step 2, at the provider. The gateway substitutes before the request leaves, so Claude receives:
[[NAME_ecc4dcdbb381c137]] | [[EMAIL_ADDRESS_f785576eceba2a00]] | [[CREDIT_CARD_c8d0a2f9aeab4158]]
Step 3, at the provider. Claude cannot send mail itself. It replies with a tool call, still using tokens:
send_email(to="[[EMAIL_ADDRESS_f785576eceba2a00]]", body="Hi [[NAME_ecc4dcdbb381c137]], your refund for order 88213 is on its way.")
Step 4, in your environment. The gateway restores the tokens in that tool call before your agent sees it, so your own code sends the real message:
send_email(to="jane.doe@example.com", body="Hi Jane Doe, your refund for order 88213 is on its way.")
Coding agents send far more than prompt text. Command output, stack traces, CSV exports, screenshots pasted into a session and scanned PDFs all carry values, and a gateway that only inspects the prompt string will pass your evaluation and miss all of it. Detection spans 255 data element types across PII, PHI, PCI and secrets, including 160 national ID formats, plus custom elements and exclusions you define.
| SaaS (default) | Self-hosted | |
|---|---|---|
| Where it runs | Strac-managed, on Strac's AWS | Docker container in your VPC, on-prem, or your customer's infrastructure |
| Connect a Claude client | One environment variable | One environment variable |
| Where real values go | Your environment and Strac | Nowhere outside your environment |
| Detection models | Run by Strac | Bundled in the image, run on your CPUs, no calls home |
| Token vault | Encrypted, held by Strac | AES-256-GCM on your storage, under a secret you hold |
| Policy and audit | Strac console | Console or local policy file, JSON audit events to your SIEM |
There is no SDK to adopt and no wrapper to import. Point the client at the gateway and start it as normal:
export ANTHROPIC_BASE_URL="https://gw.yourtenant.strac.io"
claude
The same variable covers Claude Desktop, the Claude Agent SDK and any other client of the Anthropic Messages API. Agent code, prompts, tools and MCP configuration are untouched, which is usually what makes this deployable without a platform-team project.
The gateway runs the same detection and remediation engine Strac applies wherever your sensitive data lives.
Strac detecting and remediating sensitive data in Slack. The Claude gateway applies the same detection engine to the Anthropic API path.
If Claude Code is already in use in your organization, the fastest useful exercise is to find out what it has been sending. Point one developer's client at a gateway for a week and read the audit log. The volume of real customer data in a normal debugging session is usually the thing that settles the internal argument.
From there, see AI agent security for the controls around the agent itself, shadow AI for discovering clients nobody registered, and the best AI gateway comparison for how the wider field handles this.
A Claude gateway is a proxy that sits between your Claude clients and the Anthropic API, so every request passes through one control point before it reaches the provider. Teams put one in place for three reasons: to centralize API keys instead of scattering them across machines and repositories, to get an audit trail of what agents are actually doing, and above all to control what leaves the building. Strac's gateway does the third one by substituting sensitive values for tokens on the way out and restoring them on the way back, which is what lets a Claude agent work with real data without the provider ever receiving it.
People use the phrase two ways. Sometimes they mean Anthropic's own surface for connecting Claude to apps and connectors. More often, when a security team says it, they mean the control point they want in front of all of that: one place that governs every Claude client in the organization, Desktop and Code and custom SDK agents alike, under a single policy. Strac is the second thing. Any client that speaks the Anthropic Messages API is covered by pointing it at the gateway, and the same data policy applies no matter which Claude surface the request came from.
It should not, and this is the exact test to run. Claude Code's value is that it can read your repository, query a database and then act on what it found. A gateway that blocks requests containing sensitive data turns that into a broken tool, and a gateway that deletes values leaves the agent unable to write the follow-up query. Strac substitutes instead: the model reasons over tokens, and real values are restored inside tool calls before your agent executes them, so the agent behaves normally.
Only if the gateway is careless about it. Anthropic's prompt caching matches on a prefix of the conversation, so if your gateway emits a different placeholder for the same value on every request, the resent history changes each turn, the prefix stops matching and you pay full price on every call. Strac maps each value to a stable token, so the serialized history is byte-identical between turns and caching behaves exactly as it did before the gateway existed.
One environment variable. Set ANTHROPIC_BASE_URL to your gateway URL and start Claude Code as usual. There are no changes to agent code, prompts, tools or MCP configuration, which matters because the people who own the agents and the people who own the risk are rarely the same team. The same variable works for Claude Desktop, the Claude Agent SDK and any other client of the Anthropic Messages API.
Yes. Strac ships a self-hosted Docker container that runs in your VPC, on-prem, or inside your customer's infrastructure. Detection models are bundled in the image and run on your own CPUs with no calls home, the token vault is AES-256-GCM encrypted on storage you control, and the gateway's only outbound path is to the Anthropic API. Your agents can sit on a network with no other route out.
Whatever you sent it, which is the point. Anthropic's own retention and training commitments are a contractual control, not a technical one, and a security reviewer will treat them that way. A gateway converts the question from a policy promise into an architectural fact: if the values were tokenized before the request left your boundary, the provider never held them, and your audit log proves which values were substituted on every single request.
“Don’t just alert on problems, fix them.”
Scott Roberts, Chief Information Security Officer, UiPath
.webp)
.avif){kind=icon}
Customers include
.gif)
.webp)
