Secure Anthropic Claude organizations with cnspec

Scan your Anthropic Claude organization to review who has access and how its credentials are managed. cnspec queries the Claude API and Admin API to evaluate organization members and invites, API key lifecycle, service accounts, workspace data residency, and activity log visibility.

Claude is one of the AI targets cnspec can assess. For the full list, see the AI infrastructure overview. New to cnspec? Start with the quickstart.

Prerequisites

To scan a Claude organization with cnspec, you must have:

• cnspec installed on your workstation
• A Claude Admin API key for organization and workspace resources, a Claude API key for resources such as models, files, and agents, or both

Connect to Claude

Organization, workspace, member, and API key resources require an Admin API key. Pass it with --admin-token, or set the ANTHROPIC_ADMIN_API_KEY environment variable:

cnspec shell claude --admin-token YOUR_ADMIN_API_KEY

To query resources that use a regular Claude API key, pass it with --token, or set the ANTHROPIC_API_KEY environment variable. You can supply both keys at once:

export ANTHROPIC_API_KEY='YOUR_API_KEY'
export ANTHROPIC_ADMIN_API_KEY='YOUR_ADMIN_API_KEY'
cnspec shell claude

Verify the connection by querying the organization:

cnspec> claude.organization { id name }

Authenticate with Workload Identity Federation

Instead of a long-lived API key, cnspec can authenticate with Anthropic Workload Identity Federation (WIF). Pass the path to an OIDC identity token file together with your federation rule, organization, and service account:

cnspec shell claude --identity-token-file /path/to/token \
  --federation-rule-id fdrl_YOUR_RULE_ID --organization-id YOUR_ORG_ID \
  --service-account-id svac_YOUR_SERVICE_ACCOUNT_ID

Connection options

Scan a Claude organization

With an Admin API key, cnspec discovers the organization and each of its workspaces as separate assets. To scan only the organization, or only the workspaces, pass --discover organization or --discover workspaces:

cnspec scan claude --admin-token YOUR_ADMIN_API_KEY

When the scan completes, cnspec prints a pass or fail result for each check and an overall risk score. To output results in other formats such as JSON, JUnit, or SARIF, read Report Results.

Scan with the Mondoo Anthropic Claude Security policy

Mondoo maintains an out of the box Mondoo Anthropic Claude Security policy that checks organization admin count, pending admin invites, stale invites, API key expiration, API keys without a known creator, workspace inference regions, and activity log access. Its checks require an Admin API key.

Mondoo Platform users: Enable the policy in your space. In the Mondoo App, go to Findings > Policies, search for "Claude", and add the policy. All future scans of your Claude organization automatically evaluate against it. To learn more, read Manage policies in Mondoo Platform.

Open source users: Pass the policy bundle URL directly to cnspec:

cnspec scan claude --admin-token YOUR_ADMIN_API_KEY \
  --policy-bundle https://raw.githubusercontent.com/mondoohq/cnspec/refs/heads/main/content/mondoo-anthropic-security.mql.yaml

You can also create your own policies to meet your specific requirements.

Explore a Claude organization

Run cnspec shell claude --admin-token YOUR_ADMIN_API_KEY to open the interactive shell.

List organization members and their roles

cnspec> claude.organization.members { name email role }

Review API keys

cnspec> claude.organization.apiKeys { name status createdAt expiresAt }

Review workspace data residency

cnspec> claude.organization.workspaces { name workspaceGeo defaultInferenceGeo allowedInferenceGeos }

Example security checks

Ensure no more than three organization admins

cnspec> claude.organization.members.where(role == "admin").length <= 3

Ensure no pending invitations grant admin access

cnspec> claude.organization.invites.where(status == "pending" && role == "admin").length == 0

Ensure active API keys have an expiration date

cnspec> claude.organization.apiKeys.where(status == "active").all(expiresAt != empty)

Ensure active workspaces pin a default inference region

cnspec> claude.organization.workspaces.where(archivedAt == empty).all(defaultInferenceGeo != empty)

Learn more

• To learn more about how the MQL query language works, read Write Effective MQL.

• To learn about all the Claude resources and properties you can query, read the Mondoo Claude Resource Pack Reference.