---
title: "Claude Code"
description: "IAM for your Claude Code agent"
url: "https://gazebohq.com/agents/claude-code"
---

Claude Code is a terminal-based coding agent that can inspect a working directory, edit code, run commands, and invoke configured tools from a development environment. Terminal access makes it effective for real maintenance work, but it also means an agent may encounter shell configuration, local credential helpers, checked-out repositories, generated logs, and environment variables that were never intended for a particular task. A request from an issue, a README, test fixture, or dependency output can also shape the commands it proposes. The safe operating model is to start in a minimal workspace, make the task and allowed repositories explicit, and provide external-service access through a separate identity rather than through every secret available to the shell.

## Why does Claude Code need scoped credentials?

Claude Code sessions can be extended, iterative, and partly unattended. If a shell-exported token is available, the agent can use whatever that token permits when it reaches GitHub, Stripe, Supabase, Cloudflare, or a deployment service. That is a poor match for a narrowly defined task such as reviewing a pull request, querying a staging table, or preparing a release. A bounded identity separates the agent from a developer's accumulated workstation access and reduces the chance that a secret is exposed through a command, a debug print, or a conversation transcript. Gazebo lets you assign a profile to the Claude Code workload, record each credential retrieval, and revoke that profile when its purpose ends. Continue to use repository protections, confirmation gates for destructive commands, provider-side least privilege, and environment separation; credential mediation is a boundary, not evidence that an autonomous command is safe.

## How it works

1. Connect only the services needed for the work and choose a provider credential whose permissions and environment already match the task. For example, use a repository-limited GitHub token or a staging database credential rather than a personal administrator token.
2. Create a distinct Claude Code access profile for the task, repository, or environment. Keep production, staging, and experimentation separate so a local debugging session cannot retrieve a production credential by default.
3. Configure Claude Code to use Gazebo's MCP server for credential retrieval. Remove or avoid broad service secrets from the shell environment used for the session, and keep MCP bearer tokens out of committed configuration.
4. When a tool needs a credential, Claude Code requests it through get_credential. Gazebo checks the profile and records the retrieval, providing a controlled path instead of asking the agent to discover or echo a secret in terminal output.
5. Review retrievals with the commands, changed files, pull request, and provider logs. Revoke the profile when a session, handoff, or incident ends. If the same work resumes, issue access deliberately rather than assuming a long-lived terminal session should retain it.

## Use cases

**Context-aware credential scoping:** For review, use a repository-limited credential that can read the pull request and checks without creating branches, changing settings, or merging. If the agent later needs to open a branch or comment, make that a deliberate expansion. Keep merge authority behind your normal branch-protection and human approval process rather than treating a successful agent analysis as a release decision.

**Prevent credential leakage into prompts:** Do not paste secrets into a task prompt, shell command, or troubleshooting transcript. Use MCP retrieval at the point a configured tool needs a credential, and design scripts so they do not print headers, environment dumps, or connection strings. Redaction and careful logging still matter: any tool that receives a secret can leak it if its output is mishandled.

**Per-project access profiles:** Run separate sessions and profiles for separate repositories or clients. A migration assistant for one Supabase project should not inherit the GitHub, Cloudflare, or billing access used by another. At completion, revoke the profile and preserve the task, code review, and credential-access records needed for an audit or handoff.

**Safer database investigation:** For a production incident, begin with a read-only credential limited to the affected database or reporting path, and use a separate staging profile to reproduce a fix. Do not let a troubleshooting session inherit migration or administrator rights merely because it may eventually need them. If a schema change becomes necessary, review the proposed migration, backups, target environment, and rollback plan before enabling a distinct write-capable profile.

**Primary integrations:** github, stripe, vercel, supabase, cloudflare, linear