Claude Chat Setup

Claude Chat runs inside the Claude Desktop app. AgentKeeper protects Chat MCP tool calls by routing Claude Desktop through AgentKeeper MCP Gateway, then evaluating each tool call against policy before it reaches the upstream MCP server.

This is separate from Claude Cowork. The Cowork hook plugin covers Claude Desktop Local Agent Mode events such as UserPromptSubmit and PreToolUse; it does not attach to ordinary Claude Desktop Chat prompts. Use this guide when ordinary Claude Desktop Chat needs MCP tools through AgentKeeper.

Coverage

Claude Desktop reads MCP servers from claude_desktop_config.json, then loads them after restart. AgentKeeper Gateway becomes the local MCP server that proxies the configured upstream MCP servers.

Complete Claude Desktop Coverage

Use the complete path when an organization wants all supported Claude Desktop signals:

1. Claude Chat MCP Gateway for ordinary Chat MCP tool calls.
2. Claude Cowork hooks for Local Agent Mode prompt and tool events.
3. Claude Compliance API for Enterprise Chat prompt and response history.

This is intentionally three pieces. Claude Desktop Chat does not currently expose the Claude Code hook lifecycle for normal chat prompts, so the Cowork plugin should not be represented as a Chat prompt hook. The dashboard setup page includes a Complete Claude Desktop coverage path under More setup paths that walks through all three pieces for macOS, Linux, and Windows.

What the Cowork hook plugin covers

The Cowork plugin ZIP installs UserPromptSubmit and PreToolUse hooks inside Claude Desktop's Cowork / Local Agent Mode plugin system. Those hooks can evaluate Cowork prompts, Cowork tool actions, sensitive data patterns, and local hook health.

The plugin does not monitor ordinary Claude Desktop Chat messages unless those messages are part of a supported Cowork / Local Agent Mode flow.

What Gateway covers

Gateway protects MCP activity from ordinary Claude Desktop Chat. It sees MCP server names, tool names, tool arguments, workstation identity, and verdicts. Use Gateway for MCP inventory, allow/block policy, and MCP data-risk detection.

What Compliance API covers

For raw Claude Chat prompt and response visibility, connect the Claude Enterprise Compliance API in AgentKeeper. Compliance API is the supported path for conversation content from Enterprise Claude Chat; configure it once per Claude organization.

macOS and Linux

Create a setup key from the dashboard, then run:

curl -fsSL https://www.agentkeeper.dev/install-gateway.sh | \
  AGENTKEEPER_API_URL=https://www.agentkeeper.dev \
  AGENTKEEPER_API_KEY=ak_live_REPLACE_ME \
  bash

If Gateway is already installed and you intentionally want a Claude Desktop-only repair, reapply only the Claude Desktop wiring:

agentkeeper-mcp-gateway configure-ide --ide=claude-desktop

Then quit Claude Desktop completely and reopen it.

Windows

Install the native Gateway binary from elevated PowerShell or Intune/SYSTEM:

$ErrorActionPreference='Stop'; $scriptPath=Join-Path $env:TEMP 'agentkeeper-windows-mcp-gateway-install.ps1'; $scriptUri='https://www.agentkeeper.dev/mdm/intune/agentkeeper-windows-mcp-gateway-install.ps1'; for($i=1;$i -le 5;$i++){try{Invoke-WebRequest -UseBasicParsing $scriptUri -OutFile $scriptPath -TimeoutSec 60; break}catch{if($i -eq 5){throw}; Start-Sleep -Seconds ([Math]::Min(($i * 2),10))}}; $nativePowerShell=if($env:PROCESSOR_ARCHITEW6432){Join-Path $env:WINDIR 'Sysnative\WindowsPowerShell\v1.0\powershell.exe'}else{Join-Path $env:WINDIR 'System32\WindowsPowerShell\v1.0\powershell.exe'}; if(-not (Test-Path $nativePowerShell)){$nativePowerShell='powershell.exe'}; & $nativePowerShell -NoProfile -ExecutionPolicy Bypass -File $scriptPath -AgentKeeperApiUrl 'https://www.agentkeeper.dev' -AgentKeeperApiKey 'ak_live_REPLACE_ME'; if($LASTEXITCODE -ne 0){throw ('AgentKeeper MCP Gateway installer exited with code ' + $LASTEXITCODE)}

Then run the Claude Desktop configure step from the signed-in developer's normal PowerShell profile:

& 'C:\Program Files\AgentKeeper\agentkeeper-mcp-gateway.exe' configure-ide --ide=claude-desktop

This second command must run as the user who launches Claude Desktop so AgentKeeper updates that user's claude_desktop_config.json.

Quit Claude Desktop completely and reopen it after both commands.

Verify

Ask Claude Chat to use a configured MCP tool, then check Gateway health:

agentkeeper-mcp-gateway list --health

On Windows:

& 'C:\Program Files\AgentKeeper\agentkeeper-mcp-gateway.exe' list --health

configure-ide writes agentkeeper-mcp-gateway server into Claude Desktop MCP config. The restarted client launches Gateway during real MCP tool use. A healthy setup produces:

1. A Gateway check-in on /gateway.
2. MCP server inventory on /gateway/servers.
3. A tool-call activity event with the Claude Chat source for the workstation.

If Chat can see tools but AgentKeeper shows no activity, open Setup Health and confirm Gateway health from the same profile that Claude Desktop uses.

Roll Out With Cowork

You can install Claude Chat and Claude Cowork on the same workstation:

1. Install Claude Chat through Gateway using this guide.
2. Install Cowork through the Cowork setup guide.
3. Connect Claude Compliance API when Enterprise Chat prompt history is required.
4. Verify one Chat MCP tool call, one Cowork prompt or tool action, and one Compliance API sync.

Do not use the Cowork plugin ZIP for Chat-only MCP routing. Do not use /plugin install or /agentkeeper:connect inside Claude Desktop Chat; those commands are for Claude Code.

References

• Anthropic MCP overview
• MCP user quickstart for Claude Desktop