Using TameFlare with Claude Code: Govern Agentic Coding Sessions

What Claude Code does

Claude Code is Anthropic's agentic coding tool. It runs in your terminal and can:

Read and edit files on your filesystem

Execute shell commands (git, npm, curl, etc.)

Call external APIs (GitHub, npm registry, CI/CD webhooks)

Create and manage git branches, commits, and pull requests

Install dependencies and run build scripts

Unlike a chatbot, Claude Code acts autonomously. When you say "fix this bug and open a PR," it reads your code, edits files, runs tests, commits, pushes, and creates a pull request - all without asking for confirmation on each step.

The risk

Claude Code's power is also its risk. A single agentic coding session can:

Push to the wrong branch - force-pushing to main instead of a feature branch

Delete files or directories - misinterpreting "clean up" as "delete"

Leak secrets - committing .env files or hardcoded API keys

Make unwanted API calls - triggering CI pipelines, sending webhooks, creating GitHub issues

Install malicious packages - running npm install on an attacker-controlled dependency

Claude Code has built-in permission prompts for some actions, but these are client-side confirmations. Once you grant permission, there is no server-side enforcement layer.

How TameFlare governs Claude Code

TameFlare sits between Claude Code and the external APIs it calls. Every outbound HTTP request passes through the proxy, which enforces your policies.

Claude Code (terminal)
    ↓ HTTP requests
TameFlare Cloud Gateway (proxy.tameflare.com)
    ↓ policy check → allow / deny / require approval
GitHub API / npm / CI webhooks / etc.

What TameFlare intercepts

Claude Code makes HTTP calls for:

Action	HTTP target	TameFlare connector
Git push/pull	github.com	GitHub connector
Create PR	api.github.com	GitHub connector
npm install	registry.npmjs.org	Generic HTTP
API calls	Various	Generic HTTP / MCP
Webhook triggers	Your CI/CD URL	Generic HTTP

TameFlare's connectors parse these HTTP requests into structured actions like github.pr.create, github.branch.delete, or github.repo.push. Each action is evaluated against your policies before the request is forwarded.

Setup: 3 steps

1. Create a gateway

Sign in to the TameFlare dashboard and create a gateway for your Claude Code sessions. Add the GitHub connector and any other connectors for APIs Claude Code will call.

2. Configure permissions

Set up access rules for your gateway:

Connector	Rule	Decision
GitHub	github.pr.create	Allow
GitHub	github.pr.merge	Require approval
GitHub	github.branch.delete	Deny
GitHub	github.repo.push (branch: main)	Deny
GitHub	github.repo.push (branch: feature/*)	Allow
Generic HTTP	*	Deny (allowlist only)

This gives Claude Code enough access to create PRs and push to feature branches, while blocking destructive actions and requiring human approval for merges.

3. Run Claude Code through the proxy

# Install the CLI
npm install -g @tameflare/cli

# Run Claude Code through TameFlare
tf run -- "claude-code" claude

That's it. Claude Code runs normally, but every outbound HTTP request is routed through the TameFlare proxy. Claude Code doesn't know it's being governed - the proxy is transparent.

Policy examples for Claude Code

Block force-pushes to protected branches

In the TameFlare dashboard, create a policy:

Scope: github.repo.push

Rule: parameters.branch matches main|staging|production

Decision: Deny

Reason: "Direct pushes to protected branches are not allowed. Use a feature branch and open a PR."

Require approval for PR merges

Scope: github.pr.merge

Decision: Require approval

Reason: "PR merges require human review. Approval request sent to Slack."

Block npm publish

Scope: Generic HTTP

Rule: Domain matches registry.npmjs.org AND method is PUT

Decision: Deny

Reason: "Publishing to npm is not allowed from agent sessions."

Allow read-only GitHub operations

Scope: github.repos.get, github.pr.list, github.issues.list

Decision: Allow

What about MCP tool calls?

Claude Code can also use MCP (Model Context Protocol) to call tool servers. MCP's Streamable HTTP transport uses standard HTTP POST requests - which TameFlare intercepts automatically.

If Claude Code calls an MCP tool server at mcp-server.example.com, the request passes through the proxy just like any other HTTP call. Add a Generic HTTP connector for the MCP server's domain and set permissions accordingly.

No special MCP configuration needed - the same gateway that governs Claude Code's direct API calls also governs its MCP tool calls.

Comparison: Claude Code permissions vs TameFlare

Feature	Claude Code built-in	TameFlare
Permission prompts	Yes (client-side)	Server-side enforcement
Granular API rules	No	Yes (per action type, per branch, per connector)
Credential isolation	No (reads env vars)	Yes (encrypted vault, injected at proxy)
Audit trail	Conversation log	Structured action log with policy match
Kill switch	Close the terminal	Scoped kill switch (per connector or global)
Approval workflow	Accept/reject in terminal	Slack, dashboard, or CLI approval
Works offline	Yes	Gateway runs locally, works offline

Tips for Claude Code + TameFlare

1. Start in monitor mode. Set the gateway enforcement level to "monitor" first. Watch the traffic log to see what HTTP calls Claude Code makes, then write policies based on real traffic patterns.

1. Use wildcard permissions for reads. github.repos.get, github.pr.list, github.issues.list - read operations are low risk. Allow them with github.*.get and github.*.list wildcards.

1. Block by default, allow explicitly. TameFlare is deny-all by default. Only add allow rules for the specific actions Claude Code needs. If it tries something unexpected, the proxy blocks it and logs the attempt.

1. Review the audit trail after each session. The traffic page shows every action Claude Code took. Use it as a post-session review before merging any changes.

Next steps

Create a free account - 3 gateways, 1,000 actions/month

Read the quickstart - get running in under 5 minutes

Policy documentation - write rules for your Claude Code workflows

MCP support - how TameFlare governs MCP tool calls