Anthropic built the gate.
Metomic is the decision behind it.
The AI security server behind Claude's Inference Hooks
Claude's Inference Hooks send every Claude Enterprise prompt to an AI security server for an allow or deny verdict, before the model sees it. Metomic runs that server, classifying each transcript against your sensitive data policies, so your team configures rules instead of building infrastructure.Metomic is the AI security server behind Claude's Inference Hooks: real time verdicts on every prompt, no server to build.
Live in under 30 minutes · No agents on endpoints · SOC 2 Type II
Metomic verifies Anthropic's webhook signature, classifies the transcript against your sensitive data labels, and returns allow or deny inside the timeout you configure.
One webhook. Five things Metomic handles for you.
Anthropic calls your endpoint once per governed request. Metomic answers every time, so your security team spends time on policy, not plumbing.
Point the webhook at Metomic, not a server you build
Metomic exposes a signed HTTPS endpoint that speaks Anthropic's published Inference Hooks schema out of the box. Add the URL in your Claude Enterprise admin console and every request is verified against your Standard Webhooks secret automatically.
- No infrastructure to provision, host, or patch
- Compatible with Anthropic's published webhook schema on day one
- Works alongside an existing DLP or CASB vendor if you already report to one
Classify every transcript against data you defineEarly access
Metomic's content-aware detection reads what Anthropic sends, the transcript, prior tool calls, and their results, and checks it against your organization's own sensitive data labels: plain language descriptions your security and compliance teams write themselves, not a keyword list somebody maintains by hand.
Correctly classifying sensitive data and tracking when it moves is what Metomic has been mastering for years, not a capability built overnight for one integration.- Personalized labels describe what "sensitive" means for your business, in your words
- Detection covers full transcripts, tool call arguments, and tool results
- Role-aware policy statements, like restricting what one team can discuss, are next as identity provider enrichment lands
Return a verdict Anthropic can act on, every time
Metomic returns allow or deny inside the timeout your organization configures (1 to 10,000 ms, 5 seconds by default), with a clear deny reason your users actually see. Roll out gradually with shadow mode and percentage-based enforcement, so you can watch verdicts on live traffic before anything is blocked.
- Verdicts formatted to Anthropic's schema, signed and ready to act on
- Shadow mode, rollout percentage, and role exclusions supported from day one
- Fails safely to whichever Mode your organization has set: allow, block, or shadow mode
Turn a deny into a teachable moment, not just friction
When a request is denied, the user sees a blocked-by-policy message built from the reason your security server supplies. Metomic writes that reason in plain language, tied to the label that triggered it, so the person who wrote the prompt understands what happened and what to do instead, using the same Human Firewall messaging Metomic already runs across Slack, email, and file sharing.
- Deny reasons written in plain language, not a policy code
- Consistent messaging with Metomic's Human Firewall, not a one-off for Claude
- Fewer repeat violations, because people learn instead of just getting blocked
Feed every verdict into the record you already keep
Every allow and deny streams to Metomic's audit trail and out to your SIEM alongside the rest of your agent and MCP activity, so Inference Hooks decisions sit next to everything else your AI governs, not in a separate silo.
- One record for Inference Hooks verdicts and MCP Gateway activity together
- Exportable for auditors, regulators, and your board
- Only findings and metadata retained, source content is inspected in flight
See these hooks classify your own Claude traffic
Book a demo and watch Metomic classify real Claude Enterprise transcripts from your own stack, live.
Claude's Inference Hooks send every governed prompt to your organization's own AI security server for an allow or deny verdict before inference runs. It is the first native, inline enforcement point that covers Claude chat, Claude Code, and Claude Cowork in one configuration. Before it, security teams could only audit Claude usage after the fact, through the Compliance API. Now nothing reaches the model until your security server answers, provided you have one ready to answer within the timeout.
Anthropic calls your endpoint, not the other way around. Your server has to verify a signed request, classify what is inside the transcript accurately enough to trust, and reply before the clock runs out, every single time, for every Claude Enterprise conversation in your organization.
Metomic is built to be that server, so your security team writes policy instead of maintaining a webhook.Signature verification
Every request is signed to the Standard Webhooks spec. Get it wrong and you either accept spoofed traffic or reject Anthropic's own calls.
A configurable clock
Miss the timeout (1 to 10,000 ms, 5 seconds by default) and your Mode setting decides: block Claude for everyone, let the prompt through uninspected, or fall back to shadow mode. See what happens when the security service is unavailable for what each option means in practice.
Classification that holds up
A blanket keyword filter denies too much and trains people to route around it. Content-aware detection is what keeps a gate usable.
Nothing outside Claude
Inference hooks only see what happens inside Claude Enterprise. Every other agent, copilot, and MCP server your teams use is still invisible to it.
Inference Hooks and an MCP Gateway solve different problems
Anthropic's Inference Hooks and Metomic's MCP Gateway both sit in a request path and both return a decision. They are not the same control, and most enterprises will want both.
| Claude Inference Hooks | Metomic MCP Gateway | |
|---|---|---|
| What it governs | Prompts and tool results reaching Claude Enterprise | Every call any agent makes to any tool, on any model |
| Model coverage | Claude Enterprise only: chat, Code, Cowork | Any model, any MCP client, any agent |
| Decision | Allow or deny natively, per request; account-wide Mode setting adds a native shadow option | Allow, redact, hold for approval, inspect-only, or block |
| Endpoint unreachable or slow | Mode setting decides: allow, block, or shadow mode | Not applicable, the gateway is the request path itself |
| Where the check runs | Metomic's AI security server, called by Anthropic's webhook | Metomic's hosted gateway, in the agent-to-tool path |
| Shadow AI outside Claude | Not visible | Discovered and governed |
| Metomic's role | Operates the security server, returns the verdict | Is the gateway itself |
Use Inference Hooks to gate what reaches Claude. Use the MCP Gateway to govern what any agent, on any model, sanctioned or not, is allowed to touch. Metomic runs both from one platform, so the two controls share one policy and one audit trail instead of two consoles that never talk to each other. See the full breakdown in MCP Gateway vs. Inference Hooks.
Live before your next security review
Metomic already speaks Anthropic's Inference Hooks schema. Most teams are watching verdicts in shadow mode the same day.
Point the webhook at Metomic
Add Metomic's webhook URL in your Claude Enterprise admin console and generate your signing secret. Nothing to stand up on your side.
Define what "sensitive" means to you
Write your own sensitive data labels in plain language, or start from Metomic's defaults for payment data, credentials, and customer PII. Set your failure handling and rollout percentage.
Watch, then enforce at your pace
Review verdicts in shadow mode, then move to enforcing when you are ready. Every decision is logged from the first request.
Source content is inspected in flight. Only verdicts and findings are retained, for your audit trail. See Anthropic's own documentation on Inference Hooks →
Questions CISOs ask about Inference Hooks
What are Claude's Inference Hooks?
Inference hooks are a feature Anthropic built for Claude Enterprise. They route every governed prompt across Claude chat, Claude Code, and Claude Cowork to your organization's own AI security server, which returns an allow or deny verdict before inference runs.
Do we need to build our own AI security server?
Only if you do not use Metomic. Anthropic's webhook calls an HTTPS endpoint that verifies a Standard Webhooks signature, classifies the transcript, and answers inside your configured timeout, adjustable from 1 to 10,000 ms, 5 seconds by default. Metomic operates that endpoint for you, so your security team configures policy instead of maintaining infrastructure.
What does Metomic see, and what does it keep?
Metomic receives exactly what Anthropic sends to the hook: transcript text, prior tool calls and their results, and text extracted from attachments. Raw file or image bytes, system prompts, and tool definitions are never sent. Metomic classifies in flight and retains only the verdict and findings for your audit trail.
How is this different from an MCP Gateway?
Inference hooks govern one path: prompts and tool results reaching Claude Enterprise, with a binary allow or deny verdict. Metomic's MCP Gateway governs a wider path: every agent's calls to every tool, on any model, with granular redact, hold-for-approval, and inspect-only options, the last of which allows a request through while logging any policy violation. Most enterprises want both: inference hooks to gate what reaches Claude, and an MCP Gateway to govern what any agent, on any model, can reach.
Can Metomic redact instead of just blocking?
On the inference hooks path, Anthropic's verdict is allow or deny only; rewriting or redacting a prompt is not supported today. Metomic's own MCP Gateway can redact sensitive content inside a tool call before it reaches an agent, so pairing the two gives you a redaction option the hook alone does not.
Can we define our own sensitive data labels?
Yes, in early access. Security and compliance teams describe sensitive data in plain language, for example any value that would grant access to customer funds or identity, and Metomic classifies transcripts against those labels before returning a verdict. Role-based policy statements are on the roadmap as identity provider enrichment lands.
What happens if Metomic is unreachable?
Your organization's failure handling Mode setting decides: allow the request through uninspected (fail open), block it (fail closed), or shadow mode, where Claude keeps calling and logging Metomic's verdict but always lets the request through. This kicks in whenever the endpoint can't be reached or a verdict is slower than your configured timeout, adjustable from 1 to 10,000 ms, 5 seconds by default. If Anthropic's circuit breaker trips after sustained failures, enforcement stops and Claude applies that same Mode setting until you restore the connection. Metomic also supports staged rollout and role exclusions so you can prove reliability before enforcing broadly.
What are the three failure handling modes for Claude's Inference Hooks?
Claude Enterprise's admin console offers three Mode options for Inference Hooks failure handling. Allow the request lets inference proceed without inspection when the endpoint can't be reached or a verdict times out (fail open). Block the request stops inference in that case instead (fail closed). Shadow mode keeps calling your endpoint and recording its verdict, but always lets the request through regardless. Metomic supports all three, plus a configurable prompt verdict timeout from 1 to 10,000 ms, 5 seconds by default.
Does Metomic tell employees why a prompt was blocked?
Yes. When Metomic denies a request, it supplies the deny reason the user sees, written in plain language and tied to the label that triggered it, rather than a policy code. This uses the same Human Firewall messaging Metomic already runs across Slack, email, and file sharing, so people learn what to do differently instead of just hitting a wall.
Does Inference Hooks cover model responses or voice mode?
Not yet. Anthropic currently sends only prompt-side events to the hook, so today's verdict happens before inference runs; enforcement on what the model responds with is planned by Anthropic as a later event, not live today. Voice mode conversations are not covered either. As Anthropic extends the hook to these paths, Metomic's server will support them without any change needed on your side.
Give Anthropic's gate a decision it can trust
Book a demo and watch Metomic classify your own Claude Enterprise transcripts, live, before you configure a single label.