Anthropic expands compliance visibility for local Claude Code sessions
Anthropic introduced Compliance API endpoints for local Claude Code sessions on 11 August 2026, giving security teams access to session metadata and message transcripts for agents running on developers’ endpoints. The additions include GET /v1/compliance/apps/sessions/local, a per-session metadata endpoint, and an endpoint for session messages.
The change addresses a visibility gap created by local AI harnesses. Claude Code can read files, run shell commands and invoke MCP tools while using the credentials, network position and permissions available on a developer’s machine. Token Security says local agents account for 68.6% of the AI agents it finds in customer environments.
What the new endpoints record
Claude Code sends session context to Anthropic’s models as it works. The Compliance API records content communicated to those models in text, tool_use and tool_result blocks. This can expose user prompts, bash commands, reads, writes and MCP commands, allowing teams to parse transcripts into an inventory of tools, skills, plugins and connected MCP servers.
That coverage is limited to interactions with Anthropic models. Claude Code sessions using models through Bedrock, Foundry or Google Cloud do not receive Compliance API coverage. The API also cannot show endpoint configurations or processes that operate outside a session.
The operational risk is heightened by the information contained in transcripts. They may include personally identifiable information, secrets and customer data, so retained API output requires the same safeguards applied to other sensitive data stores. Claude Code also keeps local session history for 30 days by default, creating another endpoint-resident record that must be considered in a coverage plan.
Why endpoint signals still matter
Managed settings provide a policy baseline through files on macOS and Linux or registry records on Windows. They can apply allow and deny lists for MCP servers, regex controls over bash commands, and restrictions on skills. But static policies do not establish the context or intent behind an action.
OpenTelemetry can fill part of the remaining gap because it logs atomic events, including tool-permission decisions and changes to bypassPermissions or auto mode that are not represented in the Compliance API. The implications of Claude Code Auto mode as default become more significant when such permission choices are evaluated alongside local execution and identity data.
Endpoint and EDR tooling can additionally collect configuration files, installed skills, plugin files and locally launched processes. Token Security reports finding more than 10 configuration files per local agent on average. It also says 35.1% of discovered MCP servers are community-built or of unknown origin.
Identity turns telemetry into governance
Neither transcripts, OpenTelemetry nor endpoint data alone can establish whether a plugin, credential or access path is legitimate for a particular agent. Security teams need to correlate those signals with the agent owner, purpose, identities, credentials, permissions and approved internal repositories.
The practical business implication is to treat compliance transcripts as one layer of control: enforce managed settings, protect and review sensitive session data, collect endpoint evidence, and use identity context to apply least privilege and revoke access when an agent’s purpose ends.