Anthropic built the gate.
Metomic is the decision behind it.

The AI security server behind Claude's Inference Hooks

Claude's Inference Hooks send every Claude Enterprise prompt to an AI security server for an allow or deny verdict, before the model sees it. Metomic runs that server, classifying each transcript against your sensitive data policies, so your team configures rules instead of building infrastructure.Metomic is the AI security server behind Claude's Inference Hooks: real time verdicts on every prompt, no server to build.

Live in under 30 minutes · No agents on endpoints · SOC 2 Type II

metomic × claude enterpriseVERIFYING
Claude Enterprise surfaces
CClaude chatgoverned
Claude Codegoverned
Claude Coworkgoverned
Metomic Data Security Server
CLASSIFY · DECIDE · LOG
event prompt · signed webhooksees "…customer card 4929 6600 1122 9021 cvv 341…"label payment-credentials · high confidenceverdict DENY · "card data not permitted here"
signature verified4.2s avg · 5s SLAshadow mode ready
Model inference
MProceeds on allowallowed
×Blocked before it startson deny

Metomic verifies Anthropic's webhook signature, classifies the transcript against your sensitive data labels, and returns allow or deny inside the timeout you configure.

Trusted by security teams at
ZappiJuniZooplaEcoVadisWrapbookOysterCodat
SOC 2 Type II · AICPA★★★★★  4.8 on G2
Inside the integration

One webhook. Five things Metomic handles for you.

Anthropic calls your endpoint once per governed request. Metomic answers every time, so your security team spends time on policy, not plumbing.

01 · Connect

Point the webhook at Metomic, not a server you build

Metomic exposes a signed HTTPS endpoint that speaks Anthropic's published Inference Hooks schema out of the box. Add the URL in your Claude Enterprise admin console and every request is verified against your Standard Webhooks secret automatically.

  • No infrastructure to provision, host, or patch
  • Compatible with Anthropic's published webhook schema on day one
  • Works alongside an existing DLP or CASB vendor if you already report to one
webhook · configurationCONNECTED
endpoint https://hooks.metomic.io/claude/{org_id}signing verified · standard webhookstimeout 4.2s avg response · 5s SLAstatus active · claude chat, code, cowork
one endpoint · every Claude Enterprise surface
02 · Classify

Classify every transcript against data you defineEarly access

Metomic's content-aware detection reads what Anthropic sends, the transcript, prior tool calls, and their results, and checks it against your organization's own sensitive data labels: plain language descriptions your security and compliance teams write themselves, not a keyword list somebody maintains by hand.

Correctly classifying sensitive data and tracking when it moves is what Metomic has been mastering for years, not a capability built overnight for one integration.
  • Personalized labels describe what "sensitive" means for your business, in your words
  • Detection covers full transcripts, tool call arguments, and tool results
  • Role-aware policy statements, like restricting what one team can discuss, are next as identity provider enrichment lands
label · payment-credentials
label payment-credentialscovers "any value passed to or returned from a tool call that grants access to customer funds or identity: card numbers, CVVs, IBANs, bearer tokens, API keys, database credentials"match "…card ending 9021, cvv 341…" found
defined by your team · classified by Metomic
03 · Decide

Return a verdict Anthropic can act on, every time

Metomic returns allow or deny inside the timeout your organization configures (1 to 10,000 ms, 5 seconds by default), with a clear deny reason your users actually see. Roll out gradually with shadow mode and percentage-based enforcement, so you can watch verdicts on live traffic before anything is blocked.

  • Verdicts formatted to Anthropic's schema, signed and ready to act on
  • Shadow mode, rollout percentage, and role exclusions supported from day one
  • Fails safely to whichever Mode your organization has set: allow, block, or shadow mode
verdicts · live trafficDECIDING
ALLOW claude-chat · sales-agent · 1.8sDENY claude-code · card data in tool result · 2.1sALLOW claude-cowork · shadow mode, not enforced · 1.6s
every verdict inside the SLA · nothing left waiting
04 · Educate

Turn a deny into a teachable moment, not just friction

When a request is denied, the user sees a blocked-by-policy message built from the reason your security server supplies. Metomic writes that reason in plain language, tied to the label that triggered it, so the person who wrote the prompt understands what happened and what to do instead, using the same Human Firewall messaging Metomic already runs across Slack, email, and file sharing.

  • Deny reasons written in plain language, not a policy code
  • Consistent messaging with Metomic's Human Firewall, not a one-off for Claude
  • Fewer repeat violations, because people learn instead of just getting blocked

See how Human Firewall works →

user sees · blocked by policy
message"This prompt was blocked: it included a customer card number and CVV. Card data can't be shared in chat. Use the payments tool instead, or ask #security-help if you think this is wrong."
written by policy · understood by people
05 · Prove

Feed every verdict into the record you already keep

Every allow and deny streams to Metomic's audit trail and out to your SIEM alongside the rest of your agent and MCP activity, so Inference Hooks decisions sit next to everything else your AI governs, not in a separate silo.

  • One record for Inference Hooks verdicts and MCP Gateway activity together
  • Exportable for auditors, regulators, and your board
  • Only findings and metadata retained, source content is inspected in flight
audit · event streamSTREAMING
{ hook: "prompt", surface: "claude-chat", verdict: "allow" } { hook: "prompt", surface: "claude-code", verdict: "deny" } { hook: "prompt", surface: "claude-cowork", verdict: "allow" }
streaming to SIEM · same trail as your MCP Gateway

See these hooks classify your own Claude traffic

Book a demo and watch Metomic classify real Claude Enterprise transcripts from your own stack, live.

Why it matters

Claude's Inference Hooks send every governed prompt to your organization's own AI security server for an allow or deny verdict before inference runs. It is the first native, inline enforcement point that covers Claude chat, Claude Code, and Claude Cowork in one configuration. Before it, security teams could only audit Claude usage after the fact, through the Compliance API. Now nothing reaches the model until your security server answers, provided you have one ready to answer within the timeout.

Anthropic calls your endpoint, not the other way around. Your server has to verify a signed request, classify what is inside the transcript accurately enough to trust, and reply before the clock runs out, every single time, for every Claude Enterprise conversation in your organization.

Metomic is built to be that server, so your security team writes policy instead of maintaining a webhook.

Signature verification

Every request is signed to the Standard Webhooks spec. Get it wrong and you either accept spoofed traffic or reject Anthropic's own calls.

A configurable clock

Miss the timeout (1 to 10,000 ms, 5 seconds by default) and your Mode setting decides: block Claude for everyone, let the prompt through uninspected, or fall back to shadow mode. See what happens when the security service is unavailable for what each option means in practice.

Classification that holds up

A blanket keyword filter denies too much and trains people to route around it. Content-aware detection is what keeps a gate usable.

Nothing outside Claude

Inference hooks only see what happens inside Claude Enterprise. Every other agent, copilot, and MCP server your teams use is still invisible to it.

How it differs

Inference Hooks and an MCP Gateway solve different problems

Anthropic's Inference Hooks and Metomic's MCP Gateway both sit in a request path and both return a decision. They are not the same control, and most enterprises will want both.

 Claude Inference HooksMetomic MCP Gateway
What it governsPrompts and tool results reaching Claude EnterpriseEvery call any agent makes to any tool, on any model
Model coverageClaude Enterprise only: chat, Code, CoworkAny model, any MCP client, any agent
DecisionAllow or deny natively, per request; account-wide Mode setting adds a native shadow optionAllow, redact, hold for approval, inspect-only, or block
Endpoint unreachable or slowMode setting decides: allow, block, or shadow modeNot applicable, the gateway is the request path itself
Where the check runsMetomic's AI security server, called by Anthropic's webhookMetomic's hosted gateway, in the agent-to-tool path
Shadow AI outside ClaudeNot visibleDiscovered and governed
Metomic's roleOperates the security server, returns the verdictIs the gateway itself

Use Inference Hooks to gate what reaches Claude. Use the MCP Gateway to govern what any agent, on any model, sanctioned or not, is allowed to touch. Metomic runs both from one platform, so the two controls share one policy and one audit trail instead of two consoles that never talk to each other. See the full breakdown in MCP Gateway vs. Inference Hooks.

Deployment

Live before your next security review

Metomic already speaks Anthropic's Inference Hooks schema. Most teams are watching verdicts in shadow mode the same day.

Step 01 · Connect

Point the webhook at Metomic

Add Metomic's webhook URL in your Claude Enterprise admin console and generate your signing secret. Nothing to stand up on your side.

Step 02 · Configure

Define what "sensitive" means to you

Write your own sensitive data labels in plain language, or start from Metomic's defaults for payment data, credentials, and customer PII. Set your failure handling and rollout percentage.

Step 03 · Enforce

Watch, then enforce at your pace

Review verdicts in shadow mode, then move to enforcing when you are ready. Every decision is logged from the first request.

Source content is inspected in flight. Only verdicts and findings are retained, for your audit trail. See Anthropic's own documentation on Inference Hooks →

FAQ

Questions CISOs ask about Inference Hooks

What are Claude's Inference Hooks?

Inference hooks are a feature Anthropic built for Claude Enterprise. They route every governed prompt across Claude chat, Claude Code, and Claude Cowork to your organization's own AI security server, which returns an allow or deny verdict before inference runs.

Do we need to build our own AI security server?

Only if you do not use Metomic. Anthropic's webhook calls an HTTPS endpoint that verifies a Standard Webhooks signature, classifies the transcript, and answers inside your configured timeout, adjustable from 1 to 10,000 ms, 5 seconds by default. Metomic operates that endpoint for you, so your security team configures policy instead of maintaining infrastructure.

What does Metomic see, and what does it keep?

Metomic receives exactly what Anthropic sends to the hook: transcript text, prior tool calls and their results, and text extracted from attachments. Raw file or image bytes, system prompts, and tool definitions are never sent. Metomic classifies in flight and retains only the verdict and findings for your audit trail.

How is this different from an MCP Gateway?

Inference hooks govern one path: prompts and tool results reaching Claude Enterprise, with a binary allow or deny verdict. Metomic's MCP Gateway governs a wider path: every agent's calls to every tool, on any model, with granular redact, hold-for-approval, and inspect-only options, the last of which allows a request through while logging any policy violation. Most enterprises want both: inference hooks to gate what reaches Claude, and an MCP Gateway to govern what any agent, on any model, can reach.

Can Metomic redact instead of just blocking?

On the inference hooks path, Anthropic's verdict is allow or deny only; rewriting or redacting a prompt is not supported today. Metomic's own MCP Gateway can redact sensitive content inside a tool call before it reaches an agent, so pairing the two gives you a redaction option the hook alone does not.

Can we define our own sensitive data labels?

Yes, in early access. Security and compliance teams describe sensitive data in plain language, for example any value that would grant access to customer funds or identity, and Metomic classifies transcripts against those labels before returning a verdict. Role-based policy statements are on the roadmap as identity provider enrichment lands.

What happens if Metomic is unreachable?

Your organization's failure handling Mode setting decides: allow the request through uninspected (fail open), block it (fail closed), or shadow mode, where Claude keeps calling and logging Metomic's verdict but always lets the request through. This kicks in whenever the endpoint can't be reached or a verdict is slower than your configured timeout, adjustable from 1 to 10,000 ms, 5 seconds by default. If Anthropic's circuit breaker trips after sustained failures, enforcement stops and Claude applies that same Mode setting until you restore the connection. Metomic also supports staged rollout and role exclusions so you can prove reliability before enforcing broadly.

What are the three failure handling modes for Claude's Inference Hooks?

Claude Enterprise's admin console offers three Mode options for Inference Hooks failure handling. Allow the request lets inference proceed without inspection when the endpoint can't be reached or a verdict times out (fail open). Block the request stops inference in that case instead (fail closed). Shadow mode keeps calling your endpoint and recording its verdict, but always lets the request through regardless. Metomic supports all three, plus a configurable prompt verdict timeout from 1 to 10,000 ms, 5 seconds by default.

Does Metomic tell employees why a prompt was blocked?

Yes. When Metomic denies a request, it supplies the deny reason the user sees, written in plain language and tied to the label that triggered it, rather than a policy code. This uses the same Human Firewall messaging Metomic already runs across Slack, email, and file sharing, so people learn what to do differently instead of just hitting a wall.

Does Inference Hooks cover model responses or voice mode?

Not yet. Anthropic currently sends only prompt-side events to the hook, so today's verdict happens before inference runs; enforcement on what the model responds with is planned by Anthropic as a later event, not live today. Voice mode conversations are not covered either. As Anthropic extends the hook to these paths, Metomic's server will support them without any change needed on your side.

Give Anthropic's gate a decision it can trust

Book a demo and watch Metomic classify your own Claude Enterprise transcripts, live, before you configure a single label.