Skip to main content
The @premai/api-sdk package includes confidential-claude, a launcher that starts the Confidential Proxy in Anthropic mode and then runs the installed Claude Code CLI against it.
This protects supported model traffic after the local proxy encrypts it. Claude Code, repository files, shell commands, MCP servers, hooks, and tool results remain on your machine or in their own external systems.
Use confidential-claude to connect Claude Code through the local Confidential Proxy. Go to the confidential setup.

​
How the launcher works

The launcher performs these steps on every run:
  1. Requires an interactive terminal (TTY).
  2. Reads the endpoint, key, and KEK configuration.
  3. Starts or reuses the proxy on port 8787 in Anthropic mode with attestation enabled.
  4. Displays the list of your enabled models.
  5. Sets Claude Code’s Anthropic base URL and model environment variables.
  6. Forwards every remaining argument to the installed claude command.

​
Before you start

You need:
  • Claude Code installed and available as claude on PATH.
  • A Prem API key.
  • A 32-byte KEK encoded as 64 hexadecimal characters.
  • A terminal with interactive input.
  • @premai/api-sdk.
Check the installed Claude Code version:

​
1. Set the launcher values

Generate the KEK once if you do not have one:
confidential-claude reads API_KEY, not PREM_API_KEY. Supplying it through the environment also prevents the launcher from prompting for and saving the API key in its application-data .env file. The launcher still saves the selected model ID there.

​
2. Run the first request

Use --print for a bounded first test:
Choose an enabled model in the picker with the arrow keys or j and k, then press Enter.
--print still requires a TTY because the launcher always displays the model list before it starts Claude Code.

​
3. Start an interactive session

Claude Code uses the Anthropic-compatible Messages route and receives Server-Sent Events while it works.

​
Model selection

The picker calls the model-list endpoint on every run. This guide documents these chat models: The Anthropic adapter returns the requested alias in its message model field. It does not expose the backend-resolved model ID or an assurance profile. Do not infer an assurance class from the picker label. See Platform Status.

​
Stop the local proxy

The launcher starts a detached proxy and does not stop it when Claude Code exits. Stop it explicitly when you finish:
Check the status before another run when port 8787 appears occupied:

​
Plaintext and tool boundary

Review Claude Code permissions, hooks, MCP servers, and egress separately. A confidential model route does not make local tool execution confidential.

​
Troubleshooting

Run the command directly in an interactive terminal. Piping input or starting it from a non-interactive CI process does not provide the interactive terminal that model selection needs.
Install Claude Code and confirm that claude --version succeeds in the same shell.
Check API_KEY, PROXY_URL, ENCLAVE_URL, network access, and proxy logs. Confirm that the key can list models.
Run confidential-proxy status, then stop the managed proxy. The launcher refuses to take over an unknown process on that port.
Do not add --no-attest to work around the failure. Capture the error and verify the current Reticle boundary in Attestation.
The wrapper supplies an Anthropic-compatible API shape. It does not turn a Prem model into an Anthropic-hosted Claude model.

​
Frequently asked questions

​
Does confidential-claude install Claude Code?

No. It checks for an existing claude command and exits if Claude Code is not installed.

​
Does it use my Anthropic API key?

No. API_KEY is the Prem API key. The launcher removes ANTHROPIC_API_KEY and passes the Prem key to Claude Code as the gateway authentication token.

​
Does it remember the model?

It writes the selected model to its application-data .env file, but the current launcher still shows the model list on each run.

​
Can I pass normal Claude Code arguments?

Yes. The launcher forwards its arguments to claude, including --print.

​
Is the full coding session inside an enclave?

No. Only supported inference traffic uses the encrypted Prem path. Files and tools remain in their own local or external trust boundaries.

Anthropic-compatible clients

Review the Messages translation and compatibility limits.

Confidential Proxy

Review proxy modes, routes, keys, and daemon controls.

Platform Status

Review current behavior and assurance gaps.

Security Model

Review the protected and unprotected parts of the data flow.