Workstations

Fleet management for every Claude Code developer machine in your organization. Know who is coding with AI, what they are working on, whether their environment is hardened, and which versions are deployed -- all from a single dashboard.

Why fleet visibility matters

Claude Code gives developers extraordinary power. A single session can read files, execute shell commands, make web requests, and modify your codebase. Without centralized visibility, security teams are blind to:

• How many developers are using Claude Code
• Whether sandbox mode is enabled across the fleet
• Which workstations are running outdated versions with known issues
• What projects Claude Code is being used on right now

Clawkeeper Workstations solves this. Every Claude Code session automatically registers with your dashboard, giving you real-time fleet intelligence with zero developer friction.

How it works

When a developer starts a Claude Code session, the SessionStart hook fires an HTTP request to POST /api/v1/claude-code/checkin. This call:

1. Authenticates the request using the API key in the hook configuration
2. Extracts identity -- hostname from the X-Hostname header or derived from the working directory (e.g., /Users/jimmy/project yields jimmy)
3. Creates or updates the workstation record in the database with platform, Claude Code version, sandbox status, and git remote
4. Records a session with the working directory, git remote URL, and session ID for activity tracking
5. Returns the shield policy so the Claude Code session knows the enforcement configuration (strict/moderate, warn/block)

Subsequent hook calls (PreToolUse, PostToolUse) update the heartbeat timestamp, keeping the online status current throughout the session.

Developer starts Claude Code
        |
        v
SessionStart hook fires --> POST /api/v1/claude-code/checkin
        |
        v
Host record created/updated in database
        |
        v
Shield policy returned to session context
        |
        v
PreToolUse / PostToolUse hooks keep heartbeat alive

No manual registration. No CLI commands. The developer installs the plugin or adds the hooks config, and their workstation appears in your fleet automatically.

Fleet table

The Workstations page at /claude-code displays every registered workstation in a sortable table.

Active sessions are shown inline next to the hostname when a developer is currently working.

Source filtering

If your organization uses both Claude Code and Claude Cowork, filter buttons appear above the table: All, Claude Code, and Cowork. Each filter shows a count badge. Workstations connected to both products show both source badges.

Fleet stats

Four stat cards sit above the fleet table, giving you an at-a-glance health summary:

Version distribution

When your fleet runs multiple Claude Code versions, a visual bar chart appears below the stat cards. Each version gets a colored segment proportional to its count, so you can see at a glance how fragmented your fleet is and who needs to update.

Workstation limits by plan

All workstations register regardless of plan -- they appear in the fleet table so you always have full visibility. Workstations beyond your plan limit are locked: visible but not clickable, with an "Upgrade" link instead of host detail access.

Locked workstations still register via SessionStart and show in the fleet table with a lock icon and dimmed styling. This is intentional -- you can see your full fleet size to understand the value of upgrading before you commit. The upgrade banner shows exactly how many workstations are monitored vs. total.

Upgrade your plan -->

Onboarding

First-time users who visit the Workstations page see a wizard-style setup flow instead of an empty table. The wizard:

1. Asks which product you are securing: Claude Code or Claude Cowork
2. Shows install commands for the Clawkeeper plugin (/plugin marketplace add and /plugin install)
3. Reminds you to restart Claude Code -- hooks are loaded at startup, so a restart is required before the plugin fires
4. Generates an API key inline with a one-click button -- no need to navigate to Settings
5. Shows the connect command (/clawkeeper-code:connect) to link the plugin to your dashboard
6. Polls for the first workstation and auto-refreshes the page when it connects

For team deployments, an expandable section shows push-hooks commands (clawkeeper claude-code init for project-level or --global for machine-level) and GitHub App integration for automatic hook distribution to every repo.

Hooks configuration

Under the setup wizard, an advanced panel shows the raw hooks JSON configuration with your API key pre-filled. This is the configuration that gets written to .claude/settings.json (project) or ~/.claude/settings.json (global):

{
  "hooks": {
    "UserPromptSubmit": [
      { "matcher": "*", "hooks": [{ "type": "http", "url": "https://clawkeeper.dev/api/v1/claude-code/evaluate", "headers": { "Authorization": "Bearer ck_live_..." }, "timeout": 10 }] }
    ],
    "PreToolUse": [
      { "matcher": "Bash|Edit|Write|Read|Glob|Grep|WebFetch|WebSearch", "hooks": [{ "type": "http", "url": "https://clawkeeper.dev/api/v1/claude-code/evaluate", "headers": { "Authorization": "Bearer ck_live_..." }, "timeout": 10 }] }
    ],
    "PostToolUse": [
      { "matcher": "Bash|Edit|Write|Read|Glob|Grep|WebFetch|WebSearch", "hooks": [{ "type": "http", "url": "https://clawkeeper.dev/api/v1/claude-code/audit", "headers": { "Authorization": "Bearer ck_live_..." }, "timeout": 10 }] }
    ],
    "SessionStart": [
      { "matcher": "*", "hooks": [{ "type": "http", "url": "https://clawkeeper.dev/api/v1/claude-code/checkin", "headers": { "Authorization": "Bearer ck_live_..." }, "timeout": 10 }] }
    ]
  }
}

A copy button lets developers paste the entire configuration in one step.

Adding workstations

The Add workstation button in the top-right corner opens a slide-out panel with the same plugin install + connect flow as onboarding. This is useful when onboarding new team members or setting up additional machines.

Next to the Add button, a Deploy Cloud VM link takes you to the Cloud Deploy wizard for provisioning managed AI agent instances -- a different use case, but conveniently accessible from the same page.

Developer identity enrichment

When your organization has an Identity Provider connected (Okta, Azure AD, Google Workspace, etc.) via the Identity Providers integration, Clawkeeper enriches the Developer column:

• Display name from the directory replaces the raw username
• Department and job title appear as secondary text below the name
• Matching uses the session's user hint against the directory user's email prefix and display name

This transforms the fleet table from a list of hostnames into a people-centric view of who is using Claude Code and where they sit in the organization.

Session tracking

Every SessionStart creates a session record with:

• Hostname and developer username
• Claude Code version and OS
• Sandbox enabled/disabled
• Working directory (cwd)
• Git remote URL (the project being worked on)
• Start time, last seen time, and end time

Sessions feed the Sessions (7d) column in the fleet table and the sessions today count in the page header. The working directory and git remote are used to determine the current project shown in the fleet table.

Host detail

Clicking a workstation hostname navigates to the host detail page, which provides deeper information:

• Overview -- shield status, security insights, score history, scan history
• Checks -- phase-by-phase pass/fail details from the CLI scanner
• Monitoring -- shield events, threat detection timeline, active sessions

Each workstation is a full host record in Clawkeeper, meaning it gets the same security intelligence (insights, CVE audit, score tracking) as any other monitored host.

Frequently asked questions

Do developers need to do anything special?

No. Once the plugin is installed or hooks are configured, every new Claude Code session automatically registers with the dashboard. There is no separate "register workstation" step.

What if a developer changes machines?

Each machine gets its own workstation record based on hostname. When a developer moves to a new laptop, the new machine registers as a new workstation. The old one will show as offline after 15 minutes of inactivity.

Can I remove a workstation?

Workstation records are managed from the host detail page. Removing a host removes it from the fleet table. The workstation will re-register on the next Claude Code session unless the hooks are removed.

What data is sent during checkin?

The SessionStart hook sends the working directory, git remote URL, Claude Code version, OS platform, sandbox status, and session ID. No file contents, code, or conversation history is transmitted during checkin. Tool-level data is only sent during PreToolUse and PostToolUse hooks for threat detection.

Does this work with the plugin or only push-hooks?

Both. The plugin method (/plugin install clawkeeper-code@clawkeeper) and the push-hooks method (clawkeeper claude-code init) both configure the same SessionStart hook. Workstations register regardless of which installation method was used.

What happens when I exceed my workstation limit?

Extra workstations still register and appear in the fleet table. They are shown with a lock icon and dimmed styling. You can see the hostname, developer, and status, but cannot click through to the host detail page. Upgrade to unlock full access to all workstations.