Metomic × Claude Enterprise

Anthropic built the gate.
Metomic is the decision behind it.

The AI security server behind Claude's Inference Hooks

Claude's Inference Hooks send every Claude Enterprise prompt to an AI security server for an allow or deny verdict, before the model sees it. Metomic runs that server, classifying each transcript against your sensitive data policies, so your team configures rules instead of building infrastructure. Metomic is the AI security server behind Claude's Inference Hooks: real time verdicts on every prompt, no server to build.

Live in under 30 minutes · No agents on endpoints · SOC 2 Type II

metomic × claude enterprise VERIFYING
Claude Enterprise surfaces
CClaude chatgoverned
Claude Codegoverned
Claude Coworkgoverned
Metomic Data Security Server
CLASSIFY · DECIDE · LOG
event prompt · signed webhook sees "…customer card 4929 6600 1122 9021 cvv 341…" label payment-credentials · high confidence verdict DENY · "card data not permitted here"
signature verified 4.2s avg · 5s SLA shadow mode ready
Model inference
MProceeds on allowallowed
×Blocked before it startson deny

Metomic verifies Anthropic's webhook signature, classifies the transcript against your sensitive data labels, and returns allow or deny inside the timeout you configure.

Trusted by security teams at
ZappiJuniZooplaEcoVadisWrapbookOysterCodat
SOC 2 Type II · AICPA ★★★★★  4.8 on G2
Inside the integration

One webhook. Five things Metomic handles for you.

Anthropic calls your endpoint once per governed request. Metomic answers every time, so your security team spends time on policy, not plumbing.

01 · Connect

Point the webhook at Metomic, not a server you build

Metomic exposes a signed HTTPS endpoint that speaks Anthropic's published Inference Hooks schema out of the box. Add the URL in your Claude Enterprise admin console and every request is verified against your Standard Webhooks secret automatically.

  • No infrastructure to provision, host, or patch
  • Compatible with Anthropic's published webhook schema on day one
  • Works alongside an existing DLP or CASB vendor if you already report to one
webhook · configuration CONNECTED
endpoint https://hooks.metomic.io/claude/{org_id} signing verified · standard webhooks timeout 4.2s avg response · 5s SLA status active · claude chat, code, cowork
one endpoint · every Claude Enterprise surface
02 · Classify

Classify every transcript against data you defineEarly access

Metomic's content-aware detection reads what Anthropic sends, the transcript, prior tool calls, and their results, and checks it against your organization's own sensitive data labels: plain language descriptions your security and compliance teams write themselves, not a keyword list somebody maintains by hand.

Correctly classifying sensitive data and tracking when it moves is what Metomic has been mastering for years, not a capability built overnight for one integration.
  • Personalized labels describe what "sensitive" means for your business, in your words
  • Detection covers full transcripts, tool call arguments, and tool results
  • Role-aware policy statements, like restricting what one team can discuss, are next as identity provider enrichment lands
label · payment-credentials
label payment-credentials covers "any value passed to or returned from a tool call that grants access to customer funds or identity: card numbers, CVVs, IBANs, bearer tokens, API keys, database credentials" match "…card ending 9021, cvv 341…" found
defined by your team · classified by Metomic
03 · Decide

Return a verdict Anthropic can act on, every time

Metomic returns allow or deny inside the timeout your organization configures, with a clear deny reason your users actually see. Roll out gradually with shadow mode and percentage-based enforcement, so you can watch verdicts on live traffic before anything is blocked.

  • Verdicts formatted to Anthropic's schema, signed and ready to act on
  • Shadow mode, rollout percentage, and role exclusions supported from day one
  • Fails safely to whichever failure handling mode your organization has set
verdicts · live traffic DECIDING
ALLOW claude-chat · sales-agent · 1.8s DENY claude-code · card data in tool result · 2.1s ALLOW claude-cowork · shadow mode, not enforced · 1.6s
every verdict inside the SLA · nothing left waiting
04 · Educate

Turn a deny into a teachable moment, not just friction

When a request is denied, the user sees a blocked-by-policy message built from the reason your security server supplies. Metomic writes that reason in plain language, tied to the label that triggered it, so the person who wrote the prompt understands what happened and what to do instead, using the same Human Firewall messaging Metomic already runs across Slack, email, and file sharing.

  • Deny reasons written in plain language, not a policy code
  • Consistent messaging with Metomic's Human Firewall, not a one-off for Claude
  • Fewer repeat violations, because people learn instead of just getting blocked

See how Human Firewall works →

user sees · blocked by policy
message "This prompt was blocked: it included a customer card number and CVV. Card data can't be shared in chat. Use the payments tool instead, or ask #security-help if you think this is wrong."
written by policy · understood by people
05 · Prove

Feed every verdict into the record you already keep

Every allow and deny streams to Metomic's audit trail and out to your SIEM alongside the rest of your agent and MCP activity, so Inference Hooks decisions sit next to everything else your AI governs, not in a separate silo.

  • One record for Inference Hooks verdicts and MCP Gateway activity together
  • Exportable for auditors, regulators, and your board
  • Only findings and metadata retained, source content is inspected in flight
audit · event stream STREAMING
{ hook: "prompt", surface: "claude-chat", verdict: "allow" } { hook: "prompt", surface: "claude-code", verdict: "deny" } { hook: "prompt", surface: "claude-cowork", verdict: "allow" }
streaming to SIEM · same trail as your MCP Gateway
Why it matters

Claude's Inference Hooks send every governed prompt to your organization's own AI security server for an allow or deny verdict before inference runs. It is the first native, inline enforcement point that covers Claude chat, Claude Code, and Claude Cowork in one configuration. Before it, security teams could only audit Claude usage after the fact, through the Compliance API. Now nothing reaches the model until your security server answers, provided you have one ready to answer within the timeout.

Anthropic calls your endpoint, not the other way around. Your server has to verify a signed request, classify what is inside the transcript accurately enough to trust, and reply before the clock runs out, every single time, for every Claude Enterprise conversation in your organization.

Metomic is built to be that server, so your security team writes policy instead of maintaining a webhook.

Signature verification

Every request is signed to the Standard Webhooks spec. Get it wrong and you either accept spoofed traffic or reject Anthropic's own calls.

A five second clock

Miss the timeout and your failure handling setting decides: block Claude for everyone, or let the prompt through uninspected.

Classification that holds up

A blanket keyword filter denies too much and trains people to route around it. Content-aware detection is what keeps a gate usable.

Nothing outside Claude

Inference hooks only see what happens inside Claude Enterprise. Every other agent, copilot, and MCP server your teams use is still invisible to it.

How it differs

Inference Hooks and an MCP Gateway solve different problems

Anthropic's Inference Hooks and Metomic's MCP Gateway both sit in a request path and both return a decision. They are not the same control, and most enterprises will want both.

 Claude Inference HooksMetomic MCP Gateway
What it governsPrompts and tool results reaching Claude EnterpriseEvery call any agent makes to any tool, on any model
Model coverageClaude Enterprise only: chat, Code, CoworkAny model, any MCP client, any agent
DecisionAllow or denyAllow, redact, hold for approval, or block
Where the check runsYour AI security server, called by Anthropic's webhookMetomic's hosted gateway, in the agent-to-tool path
Shadow AI outside ClaudeNot visibleDiscovered and governed
Metomic's roleOperates the security server, returns the verdictIs the gateway itself

Use Inference Hooks to gate what reaches Claude. Use the MCP Gateway to govern what any agent, on any model, sanctioned or not, is allowed to touch. Metomic runs both from one platform, so the two controls share one policy and one audit trail instead of two consoles that never talk to each other.

Deployment

Live before your next security review

Metomic already speaks Anthropic's Inference Hooks schema. Most teams are watching verdicts in shadow mode the same day.

Step 01 · Connect

Point the webhook at Metomic

Add Metomic's webhook URL in your Claude Enterprise admin console and generate your signing secret. Nothing to stand up on your side.

Step 02 · Configure

Define what "sensitive" means to you

Write your own sensitive data labels in plain language, or start from Metomic's defaults for payment data, credentials, and customer PII. Set your failure handling and rollout percentage.

Step 03 · Enforce

Watch, then enforce at your pace

Review verdicts in shadow mode, then move to enforcing when you are ready. Every decision is logged from the first request.

Source content is inspected in flight. Only verdicts and findings are retained, for your audit trail. See Anthropic's own documentation on Inference Hooks →

FAQ

Questions CISOs ask about Inference Hooks

What are Claude's Inference Hooks?

Inference hooks are a feature Anthropic built for Claude Enterprise. They route every governed prompt across Claude chat, Claude Code, and Claude Cowork to your organization's own AI security server, which returns an allow or deny verdict before inference runs.

Do we need to build our own AI security server?

Only if you do not use Metomic. Anthropic's webhook calls an HTTPS endpoint that verifies a Standard Webhooks signature, classifies the transcript, and answers inside your configured timeout, five seconds by default. Metomic operates that endpoint for you, so your security team configures policy instead of maintaining infrastructure.

What does Metomic see, and what does it keep?

Metomic receives exactly what Anthropic sends to the hook: transcript text, prior tool calls and their results, and text extracted from attachments. Raw file or image bytes, system prompts, and tool definitions are never sent. Metomic classifies in flight and retains only the verdict and findings for your audit trail.

How is this different from an MCP Gateway?

Inference hooks govern one path: prompts and tool results reaching Claude Enterprise, with a binary allow or deny verdict. Metomic's MCP Gateway governs a wider path: every agent's calls to every tool, on any model, with granular redact and hold-for-approval options. Most enterprises want both: inference hooks to gate what reaches Claude, and an MCP Gateway to govern what any agent, on any model, can reach.

Can Metomic redact instead of just blocking?

On the inference hooks path, Anthropic's verdict is allow or deny only; rewriting or redacting a prompt is not supported today. Metomic's own MCP Gateway can redact sensitive content inside a tool call before it reaches an agent, so pairing the two gives you a redaction option the hook alone does not.

Can we define our own sensitive data labels?

Yes, in early access. Security and compliance teams describe sensitive data in plain language, for example any value that would grant access to customer funds or identity, and Metomic classifies transcripts against those labels before returning a verdict. Role-based policy statements are on the roadmap as identity provider enrichment lands.

What happens if Metomic is unreachable?

Your organization's failure handling setting decides: block the request, or allow it through uninspected. Metomic is built to answer inside Anthropic's default five second timeout, and supports staged rollout, shadow mode, and role exclusions so you can prove reliability before enforcing broadly.

Does Metomic tell employees why a prompt was blocked?

Yes. When Metomic denies a request, it supplies the deny reason the user sees, written in plain language and tied to the label that triggered it, rather than a policy code. This uses the same Human Firewall messaging Metomic already runs across Slack, email, and file sharing, so people learn what to do differently instead of just hitting a wall.

Give Anthropic's gate a decision it can trust

Book a demo and watch Metomic classify your own Claude Enterprise transcripts, live, before you configure a single label.