xCLAUDE docs

How it works

Claude Desktop talks to tools through two separate channels. The first is local MCP servers — your filesystem tools, custom MCP servers, and any other MCP configured in claude_desktop_config.json. The second is native Connectors (Gmail, Drive, GitHub, Slack, etc.), which you connect through Settings → Connectors and which Claude reaches as remote MCPs on the providers' servers.

xCLAUDE rewrites the local config file. After install, each of your local MCP servers is wrapped individually: its entry keeps its own name, but now points to the xCLAUDE proxy, which launches the real server and relays its traffic unchanged. Claude Desktop sees the same servers, with the same names and the same tools. Native Connectors are unaffected — they continue to work directly between Claude Desktop and the providers' servers, outside xCLAUDE's path.

Because every local MCP tool call now passes through xCLAUDE, it sees both sides of the conversation: what Claude Desktop asks your tools to do — which tool, with what parameters — and what those tools send back. That gives xCLAUDE a local audit log and lets it check the content for credentials, personal data, and prompt-injection patterns. The proxy forwards each message as it arrives and analyzes a copy, so detection doesn't delay the call. Tool calls to native Connectors are not visible to xCLAUDE.

  Claude Desktop
       │
       ├──► Native Connectors (Gmail, Drive, ...)
       │    not visible to xCLAUDE
       │
       ▼
    xCLAUDE (one proxy per wrapped server) ← audit + detection + scanning
       │
       ├──► Local MCPs (FileSystem, custom tools...)
       │    stdio — traffic stays on your machine
       │
       └──► Remote Connectors (Notion, Slack, GitHub...)
            http bridge — traffic goes to provider servers

Claude Code is a separate source. A hook records each tool call after it finishes, plus session starts and ends and MCP elicitations. The hook is added once to Claude Code's settings; its MCP servers are left as they are. Wrapping them is optional and adds the protocol-level view. See the Claude Code section below.

What it covers

• ✓Every tool call through wrapped and remote MCP servers: name, parameters, and result
• ✓Claude Code: tool calls after they finish (built-in and MCP tools), session starts and ends, MCP elicitations, and optional wrapping of its MCP servers for the protocol-level view
• ✓Structured PII: well-formed identifiers such as emails, international phone numbers, IBANs, credit cards, passports, and national IDs from several countries, checksum-confirmed where the format has a checksum
• ✓Named entities: person names, organizations, and locations in tool arguments on wrapped and remote servers (async, best-effort)
• ✓Prompt-injection patterns (English) in tool arguments and responses
• ✓Credentials: known API key and token formats, masked before they reach the log
• ✓Email send detection (English and Spanish) in tool arguments, responses, and tool names
• ✓Data export detection (English and Spanish) in tool arguments, and in responses when an explicit destination is given
• ✓Audit trail modification: Claude Code tool calls that write to or delete xCLAUDE's own data
• ✓Protocol tripwires: server requests to the client, unknown methods or protocol versions, and input_required responses
• ✓Connector changes: what each connector advertises and how it signs in, compared over time in MCP Changes
• ✓Local audit log: per-session JSONL files, consolidated into daily files as sessions finish, under ~/Library/Application Support/xCLAUDE Gateway/wrappers/
• ✓A desktop app with a menu bar icon for alerts

Dashboard

xCLAUDE is a desktop app with a menu bar icon. You can open it from the menu bar at any time. Detections refreshes every 2 seconds and shows each event's severity, source, and tool call details. MCP Changes shows how connector definitions and sign-ins change over time. No telemetry leaves your Mac.

MCP Changes

MCP Changes tracks what a connector advertises and how its sign-ins change over time. It works on the proxy path: wrapped and remote MCP servers.

Connector surface

xCLAUDE keeps a reference snapshot of what each server advertises — tools/list, resources/list, resources/templates/list, prompts/list, and server discovery — and records one row per comparison, regardless of how many items changed.

• The change itself (a description, an input schema, an added or removed item) carries no severity.
• Findings come from rules: a sensitive parameter being added, a reference to a credential file path, instruction-shaped text (including phrasing aimed at other tools), and invisible characters. Each finding carries its rule's ID and version.
• Review recommended is a heuristic for text added to an existing description on a single tool, even when no rule matches.
• Tool catalog review. The first tool catalog a connector shows is reviewed for instruction-shaped text, credential file paths, and invisible characters. Each stored tool catalog is reviewed once more when one of those rules is updated. A clean review is silent. A review with findings appears as "Existing tool definition flagged". These are specific patterns, not a detector for tool poisoning in general.

Authorization

Each OAuth sign-in that exchanges an authorization code records the authorization server, the resource, and the granted permissions. It is compared with the previous sign-in. A different authorization server is flagged HIGH, while expanded permissions are flagged MEDIUM. Both trigger a macOS notification. Reduced permissions and a different resource are recorded without a severity.

Reviewing

The tab opens on Needs review only: changes with a finding or review recommendation that have not been marked as reviewed. A change with no finding shows NONE. It does not count toward the severity cards, menu bar, or connector card. The panel highlights inserted text and opens the full before/after diff. Rows can be marked as reviewed and exported as a versioned JSON document. Changes recorded before this format existed appear under the Previous format status option. The menu bar shows how many changes rated MEDIUM or above from the last 24 hours are waiting for review.

Verify it works

The Sources tab includes a Verify detection button — a safe, self-contained end-to-end check. It runs a synthetic risky payload through the audit pipeline and confirms the event is recorded and flagged, so you can see the detectors working without touching any real connector. The result appears in the Sources view.

Connectors

xCLAUDE includes a catalog of common MCP connectors routed through its local proxy. Connect them through xCLAUDE instead of Claude Desktop's native Settings → Connectors. If a service is connected in both places, Claude may use the native, unaudited path, so disconnect it there first.

One-click connectors

Notion, GitHub, Linear, Atlassian, Stripe, and Apollo connect with one click. No Terminal needed.

1. Open xCLAUDE Gateway → Sources tab → + Add source.
2. Select the connector you want → Connect.
3. Authorize in the browser that opens.
4. Restart Claude Desktop.

Slack

Slack has a 2-step in-app wizard: the Set up button opens Slack with your app pre-configured from a manifest (scopes, redirect and MCP included) — pick your workspace and hit Create — then paste your app's Client ID. No client secret involved (Slack uses public PKCE). Slack asks you to re-authorize about once a month — that's how Slack designed it, not an error. Your workspace admin may need to approve the app.

Google connectors (Gmail, Calendar, Drive)

Google connectors run on your own key: xCLAUDE embeds no Client ID, so you create a Google Cloud project of your own and paste your credentials into the app. The Set up button walks you through a guided 4-step wizard — Cloud project, OAuth client, Preview enrollment, paste your credentials — with deep links at every step. One free OAuth client serves all three; your credentials are stored in the macOS Keychain.

Step-by-step Google setup — docs on GitHub →

Claude Code

xCLAUDE audits Claude Code as a source of its own, independent of Claude Desktop.

Auditing Claude Code (one click)

Open the Sources tab → + Add source → Claude Code → Install hook. After that, Claude Code tool calls, built-in and MCP alike, are recorded after they finish and classified. The Claude Code view has severity cards, filters, search, and export. To stop, open the Claude Code source and click Uninstall.

xCLAUDE installs the hook in ~/.claude. If you use another Claude Code profile (a ~/.claude-* folder), the app shows a notice with the hook configuration to add manually.

Wrapping Claude Code's MCP servers (optional)

Wrapping adds what only the protocol level can show: what each server advertises, its stderr, and server-initiated requests. Calls seen by both sources are correlated by tool-use ID. Setup is manual for now and documented step by step on GitHub:

Wrapping Claude Code's MCP servers — docs on GitHub →

Uninstall

If you installed the Claude Code hook, remove it first: open the Claude Code source in the Sources tab and click Uninstall.

1. Open xCLAUDE Gateway → Settings (gear icon) → Uninstall. This restores your original MCP configuration.
2. Click the xCLAUDE icon in your menu bar → Quit xCLAUDE Gateway.
3. Drag xCLAUDE Gateway.app to the Trash.
4. Restart Claude Desktop.

Optional cleanup:

• To delete all local data (audit logs, settings, connector baselines), run in Terminal:

  rm -rf ~/Library/Application\ Support/xCLAUDE\ Gateway/

• Google/OAuth credentials live in the macOS Keychain and are NOT removed by the step above. To clear them, run one line per connector you had connected (e.g. gmail, calendar, drive, notion):

  for k in tokens client verifier; do
    security delete-generic-password -s com.xclaude.gateway -a "gmail:$k" 2>/dev/null
  done

  Or open Keychain Access and delete the com.xclaude.gateway items.