Anthropic built the gate.
Metomic is the decision behind it.
The AI security server behind Claude's Inference Hooks
Claude's Inference Hooks send every Claude Enterprise prompt to an AI security server for an allow or deny verdict, before the model sees it. Metomic runs that server, classifying each transcript against your sensitive data policies, so your team configures rules instead of building infrastructure. Metomic is the AI security server behind Claude's Inference Hooks: real time verdicts on every prompt, no server to build.
Live in under 30 minutes · No agents on endpoints · SOC 2 Type II
Metomic verifies Anthropic's webhook signature, classifies the transcript against your sensitive data labels, and returns allow or deny inside the timeout you configure.
One webhook. Five things Metomic handles for you.
Anthropic calls your endpoint once per governed request. Metomic answers every time, so your security team spends time on policy, not plumbing.
Point the webhook at Metomic, not a server you build
Metomic exposes a signed HTTPS endpoint that speaks Anthropic's published Inference Hooks schema out of the box. Add the URL in your Claude Enterprise admin console and every request is verified against your Standard Webhooks secret automatically.
- No infrastructure to provision, host, or patch
- Compatible with Anthropic's published webhook schema on day one
- Works alongside an existing DLP or CASB vendor if you already report to one
Classify every transcript against data you defineEarly access
Metomic's content-aware detection reads what Anthropic sends, the transcript, prior tool calls, and their results, and checks it against your organization's own sensitive data labels: plain language descriptions your security and compliance teams write themselves, not a keyword list somebody maintains by hand.
Correctly classifying sensitive data and tracking when it moves is what Metomic has been mastering for years, not a capability built overnight for one integration.- Personalized labels describe what "sensitive" means for your business, in your words
- Detection covers full transcripts, tool call arguments, and tool results
- Role-aware policy statements, like restricting what one team can discuss, are next as identity provider enrichment lands
Return a verdict Anthropic can act on, every time
Metomic returns allow or deny inside the timeout your organization configures, with a clear deny reason your users actually see. Roll out gradually with shadow mode and percentage-based enforcement, so you can watch verdicts on live traffic before anything is blocked.
- Verdicts formatted to Anthropic's schema, signed and ready to act on
- Shadow mode, rollout percentage, and role exclusions supported from day one
- Fails safely to whichever failure handling mode your organization has set
Turn a deny into a teachable moment, not just friction
When a request is denied, the user sees a blocked-by-policy message built from the reason your security server supplies. Metomic writes that reason in plain language, tied to the label that triggered it, so the person who wrote the prompt understands what happened and what to do instead, using the same Human Firewall messaging Metomic already runs across Slack, email, and file sharing.
- Deny reasons written in plain language, not a policy code
- Consistent messaging with Metomic's Human Firewall, not a one-off for Claude
- Fewer repeat violations, because people learn instead of just getting blocked
Feed every verdict into the record you already keep
Every allow and deny streams to Metomic's audit trail and out to your SIEM alongside the rest of your agent and MCP activity, so Inference Hooks decisions sit next to everything else your AI governs, not in a separate silo.
- One record for Inference Hooks verdicts and MCP Gateway activity together
- Exportable for auditors, regulators, and your board
- Only findings and metadata retained, source content is inspected in flight
Claude's Inference Hooks send every governed prompt to your organization's own AI security server for an allow or deny verdict before inference runs. It is the first native, inline enforcement point that covers Claude chat, Claude Code, and Claude Cowork in one configuration. Before it, security teams could only audit Claude usage after the fact, through the Compliance API. Now nothing reaches the model until your security server answers, provided you have one ready to answer within the timeout.
Anthropic calls your endpoint, not the other way around. Your server has to verify a signed request, classify what is inside the transcript accurately enough to trust, and reply before the clock runs out, every single time, for every Claude Enterprise conversation in your organization.
Metomic is built to be that server, so your security team writes policy instead of maintaining a webhook.Signature verification
Every request is signed to the Standard Webhooks spec. Get it wrong and you either accept spoofed traffic or reject Anthropic's own calls.
A five second clock
Miss the timeout and your failure handling setting decides: block Claude for everyone, or let the prompt through uninspected.
Classification that holds up
A blanket keyword filter denies too much and trains people to route around it. Content-aware detection is what keeps a gate usable.
Nothing outside Claude
Inference hooks only see what happens inside Claude Enterprise. Every other agent, copilot, and MCP server your teams use is still invisible to it.
Inference Hooks and an MCP Gateway solve different problems
Anthropic's Inference Hooks and Metomic's MCP Gateway both sit in a request path and both return a decision. They are not the same control, and most enterprises will want both.
| Claude Inference Hooks | Metomic MCP Gateway | |
|---|---|---|
| What it governs | Prompts and tool results reaching Claude Enterprise | Every call any agent makes to any tool, on any model |
| Model coverage | Claude Enterprise only: chat, Code, Cowork | Any model, any MCP client, any agent |
| Decision | Allow or deny | Allow, redact, hold for approval, or block |
| Where the check runs | Your AI security server, called by Anthropic's webhook | Metomic's hosted gateway, in the agent-to-tool path |
| Shadow AI outside Claude | Not visible | Discovered and governed |
| Metomic's role | Operates the security server, returns the verdict | Is the gateway itself |
Use Inference Hooks to gate what reaches Claude. Use the MCP Gateway to govern what any agent, on any model, sanctioned or not, is allowed to touch. Metomic runs both from one platform, so the two controls share one policy and one audit trail instead of two consoles that never talk to each other.
Live before your next security review
Metomic already speaks Anthropic's Inference Hooks schema. Most teams are watching verdicts in shadow mode the same day.
Point the webhook at Metomic
Add Metomic's webhook URL in your Claude Enterprise admin console and generate your signing secret. Nothing to stand up on your side.
Define what "sensitive" means to you
Write your own sensitive data labels in plain language, or start from Metomic's defaults for payment data, credentials, and customer PII. Set your failure handling and rollout percentage.
Watch, then enforce at your pace
Review verdicts in shadow mode, then move to enforcing when you are ready. Every decision is logged from the first request.
Source content is inspected in flight. Only verdicts and findings are retained, for your audit trail. See Anthropic's own documentation on Inference Hooks →
Questions CISOs ask about Inference Hooks
What are Claude's Inference Hooks?
Inference hooks are a feature Anthropic built for Claude Enterprise. They route every governed prompt across Claude chat, Claude Code, and Claude Cowork to your organization's own AI security server, which returns an allow or deny verdict before inference runs.
Do we need to build our own AI security server?
Only if you do not use Metomic. Anthropic's webhook calls an HTTPS endpoint that verifies a Standard Webhooks signature, classifies the transcript, and answers inside your configured timeout, five seconds by default. Metomic operates that endpoint for you, so your security team configures policy instead of maintaining infrastructure.
What does Metomic see, and what does it keep?
Metomic receives exactly what Anthropic sends to the hook: transcript text, prior tool calls and their results, and text extracted from attachments. Raw file or image bytes, system prompts, and tool definitions are never sent. Metomic classifies in flight and retains only the verdict and findings for your audit trail.
How is this different from an MCP Gateway?
Inference hooks govern one path: prompts and tool results reaching Claude Enterprise, with a binary allow or deny verdict. Metomic's MCP Gateway governs a wider path: every agent's calls to every tool, on any model, with granular redact and hold-for-approval options. Most enterprises want both: inference hooks to gate what reaches Claude, and an MCP Gateway to govern what any agent, on any model, can reach.
Can Metomic redact instead of just blocking?
On the inference hooks path, Anthropic's verdict is allow or deny only; rewriting or redacting a prompt is not supported today. Metomic's own MCP Gateway can redact sensitive content inside a tool call before it reaches an agent, so pairing the two gives you a redaction option the hook alone does not.
Can we define our own sensitive data labels?
Yes, in early access. Security and compliance teams describe sensitive data in plain language, for example any value that would grant access to customer funds or identity, and Metomic classifies transcripts against those labels before returning a verdict. Role-based policy statements are on the roadmap as identity provider enrichment lands.
What happens if Metomic is unreachable?
Your organization's failure handling setting decides: block the request, or allow it through uninspected. Metomic is built to answer inside Anthropic's default five second timeout, and supports staged rollout, shadow mode, and role exclusions so you can prove reliability before enforcing broadly.
Does Metomic tell employees why a prompt was blocked?
Yes. When Metomic denies a request, it supplies the deny reason the user sees, written in plain language and tied to the label that triggered it, rather than a policy code. This uses the same Human Firewall messaging Metomic already runs across Slack, email, and file sharing, so people learn what to do differently instead of just hitting a wall.
Give Anthropic's gate a decision it can trust
Book a demo and watch Metomic classify your own Claude Enterprise transcripts, live, before you configure a single label.