Claude Tag

Claude Tag runs Claude Code in an Anthropic-hosted sandbox. It loads project hooks committed to the repository, but it does not run the local Watcher client. Watcher collects these sessions through an observe-only Remote Collector.

Requirements

• The Watcher binary must be installed on the machine used to prepare the repository.
• The repository must be available to Claude Tag.
• The Watcher deployment must have an HTTPS hostname that Anthropic's sandbox can reach. A deployment available only through a private network or VPN cannot receive uploads directly.

Install the project hooks

Select the Watcher deployment that should receive the sessions, then install the project hooks:

# Choose one target if this Watcher installation does not already have one.
watcher target set --cloud
# watcher target set --url https://watcher.example.com

watcher hooks install-project --project /path/to/repository

Review and commit the resulting .claude/settings.json and .claude/hooks/watcher_remote_collector/ changes. Re-running the command refreshes Watcher's collector files and hook entries while preserving other Claude settings and hooks.

Configure authentication

Watcher Cloud or self-hosted SSO mode

1. In the Analyzer, open the Organization page and create a dedicated organization API key with the sessions:ingest permission.
2. In Claude's administration settings, create or open an Access bundle and add a Custom tool API credential.
3. Set Allowed websites to the Watcher hostname. In the Bearer credential form, replace the default Authorization header with x-api-key, leave its prefix empty, and enter the organization API key as its value.
4. Attach the Access bundle only to the Slack workspaces or channels whose Claude Tag sessions Watcher should collect.

Claude's Agent Proxy injects the key only for requests to the allowed hostname. The key is not committed to the repository or exposed to the sandbox.

Self-hosted proxy mode

Create a dedicated credential that the public proxy accepts, configure the proxy to map it to a fixed Claude Tag service identity, and add that credential and hostname to the Access bundle. The proxy then supplies Watcher's configured identity headers as it does for other authenticated requests.

See Self-hosted client deployment for the authentication modes available to a self-hosted deployment.

Collection behavior

The project hooks run only in remote Claude Code sessions. The first lifecycle event uploads the available transcript to the Watcher API, and later events append new entries to the same session. Collection fails open: an upload failure does not stop Claude, but the missing transcript tail may not reach Watcher.

The Remote Collector supports recording and trailing review only. It does not yet gate tool calls or provide human escalation.