> ## Documentation Index
> Fetch the complete documentation index at: https://docs.prem.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Claude Code

> Launch Claude Code through Prem's Confidential Proxy with the bundled confidential-claude wrapper.

The `@premai/api-sdk` package includes `confidential-claude`, a launcher that starts the Confidential Proxy in Anthropic mode and then runs the installed Claude Code CLI against it.

<Warning>
  This protects supported model traffic after the local proxy encrypts it. Claude Code, repository files, shell commands, MCP servers, hooks, and tool results remain on your machine or in their own external systems.
</Warning>

<Tabs>
  <Tab title="Confidential API">
    Use `confidential-claude` to connect Claude Code through the local Confidential Proxy. [Go to the confidential setup](#before-you-start).
  </Tab>

  <Tab title="Router (Beta)">
    <Badge color="blue">Beta</Badge>

    Router is not available for Claude Code. Claude Code requires the Anthropic Messages API, while Router supports OpenAI-compatible Chat Completions. Use [OpenCode](/guides/opencode), [OpenClaw](/guides/openclaw), [Hermes Agent](/guides/hermes), or [Goose](/guides/goose) for a Router coding workflow.
  </Tab>
</Tabs>

## How the launcher works

```mermaid theme={"system"}
flowchart TB
    subgraph Local["Your machine: plaintext is available"]
        C["Claude Code"] -->|"Anthropic Messages API"| P["Confidential Proxy<br/>127.0.0.1:8787"]
        T["Local tools and MCP servers"] <--> C
    end

    P -->|"Encrypt before network egress"| G["Prem API Gateway<br/>ciphertext and metadata"]
    G -->|"Encrypted request"| E["Prem confidential runtime<br/>decrypt, infer, encrypt"]
    E -.->|"Encrypted response"| P
    P -.->|"Anthropic SSE or message"| C
```

The launcher performs these steps on every run:

1. Requires an interactive terminal (TTY).
2. Reads the endpoint, key, and KEK configuration.
3. Starts or reuses the proxy on port `8787` in Anthropic mode with attestation enabled.
4. Displays the list of your enabled models.
5. Sets Claude Code's Anthropic base URL and model environment variables.
6. Forwards every remaining argument to the installed `claude` command.

## Before you start

You need:

* Claude Code installed and available as `claude` on `PATH`.
* A Prem API key.
* A 32-byte KEK encoded as 64 hexadecimal characters.
* A terminal with interactive input.
* `@premai/api-sdk`.

Check the installed Claude Code version:

```bash theme={"system"}
claude --version
```

## 1. Set the launcher values

```bash theme={"system"}
export API_KEY="your-prem-api-key"
export CLIENT_KEK="your-64-character-hex-kek"
export PROXY_URL="https://gateway.prem.io"
export ENCLAVE_URL="https://conf-engine.prem.io"
```

Generate the KEK once if you do not have one:

```bash theme={"system"}
openssl rand -hex 32
```

`confidential-claude` reads `API_KEY`, not `PREM_API_KEY`. Supplying it through the environment also prevents the launcher from prompting for and saving the API key in its application-data `.env` file. The launcher still saves the selected model ID there.

## 2. Run the first request

Use `--print` for a bounded first test:

```bash theme={"system"}
npx -p @premai/api-sdk@1.0.59 confidential-claude \
  --print "Reply with exactly OK. Do not use tools."
```

Choose an enabled model in the picker with the arrow keys or `j` and `k`, then press Enter.

<Note>
  `--print` still requires a TTY because the launcher always displays the model list before it starts Claude Code.
</Note>

## 3. Start an interactive session

```bash theme={"system"}
npx -p @premai/api-sdk@1.0.59 confidential-claude
```

Claude Code uses the Anthropic-compatible Messages route and receives Server-Sent Events while it works.

## Model selection

The picker calls the model-list endpoint on every run. This guide documents these chat models:

| Picker ID    | Display name | Current catalogue behavior                         |
| ------------ | ------------ | -------------------------------------------------- |
| `qwen36-27b` | Qwen 3.6     | Text, image, and video input metadata              |
| `glm-5.2`    | GLM 5.2      | Text chat alias that resolves to `zai-org/GLM-5.2` |

The Anthropic adapter returns the requested alias in its message `model` field. It does not expose the backend-resolved model ID or an assurance profile. Do not infer an assurance class from the picker label. See [Platform Status](/platform-status).

## Stop the local proxy

The launcher starts a detached proxy and does not stop it when Claude Code exits. Stop it explicitly when you finish:

```bash theme={"system"}
npx -p @premai/api-sdk@1.0.59 confidential-proxy stop
```

Check the status before another run when port `8787` appears occupied:

```bash theme={"system"}
npx -p @premai/api-sdk@1.0.59 confidential-proxy status
```

## Plaintext and tool boundary

| Component                      | Plaintext access                  | Notes                                                              |
| ------------------------------ | --------------------------------- | ------------------------------------------------------------------ |
| Claude Code                    | Yes                               | Reads prompts, selected repository files, and tool results locally |
| Confidential Proxy             | Yes, locally                      | Translates, encrypts, and decrypts model traffic                   |
| Prem API Gateway               | No content access                 | Receives ciphertext, authentication, and routing metadata          |
| Prem confidential runtime      | Yes, inside the protected runtime | Runs the selected model and encrypts the response                  |
| Shell, hooks, MCP, and plugins | Depends on the tool               | Outside the Prem inference boundary                                |

Review Claude Code permissions, hooks, MCP servers, and egress separately. A confidential model route does not make local tool execution confidential.

## Troubleshooting

<AccordionGroup>
  <Accordion title="TTY environment required">
    Run the command directly in an interactive terminal. Piping input or starting it from a non-interactive CI process does not provide the interactive terminal that model selection needs.
  </Accordion>

  <Accordion title="install claude code">
    Install Claude Code and confirm that `claude --version` succeeds in the same shell.
  </Accordion>

  <Accordion title="Failed to fetch models from proxy">
    Check `API_KEY`, `PROXY_URL`, `ENCLAVE_URL`, network access, and proxy logs. Confirm that the key can list models.
  </Accordion>

  <Accordion title="Port 8787 is occupied">
    Run `confidential-proxy status`, then stop the managed proxy. The launcher refuses to take over an unknown process on that port.
  </Accordion>

  <Accordion title="Attestation fails">
    Do not add `--no-attest` to work around the failure. Capture the error and verify the current Reticle boundary in [Attestation](/attestation).
  </Accordion>

  <Accordion title="The selected model behaves differently from Claude">
    The wrapper supplies an Anthropic-compatible API shape. It does not turn a Prem model into an Anthropic-hosted Claude model.
  </Accordion>
</AccordionGroup>

## Frequently asked questions

### Does `confidential-claude` install Claude Code?

No. It checks for an existing `claude` command and exits if Claude Code is not installed.

### Does it use my Anthropic API key?

No. `API_KEY` is the Prem API key. The launcher removes `ANTHROPIC_API_KEY` and passes the Prem key to Claude Code as the gateway authentication token.

### Does it remember the model?

It writes the selected model to its application-data `.env` file, but the current launcher still shows the model list on each run.

### Can I pass normal Claude Code arguments?

Yes. The launcher forwards its arguments to `claude`, including `--print`.

### Is the full coding session inside an enclave?

No. Only supported inference traffic uses the encrypted Prem path. Files and tools remain in their own local or external trust boundaries.

## Related

<CardGroup cols={2}>
  <Card title="Anthropic-compatible clients" icon="comments" href="/guides/anthropic-compatible-clients" arrow="true">
    Review the Messages translation and compatibility limits.
  </Card>

  <Card title="Confidential Proxy" icon="server" href="/confidential-proxy" arrow="true">
    Review proxy modes, routes, keys, and daemon controls.
  </Card>

  <Card title="Platform Status" icon="road" href="/platform-status" arrow="true">
    Review current behavior and assurance gaps.
  </Card>

  <Card title="Security Model" icon="shield-halved" href="/security-model" arrow="true">
    Review the protected and unprotected parts of the data flow.
  </Card>
</CardGroup>