Disclosure first, as with the prompt-injection piece: this site's research runs in a Claude Code local session. The transcript these endpoints expose is, for us, the record of every page fetched and every command run to produce these articles.

What shipped

On 11 August 2026, Anthropic added three Compliance API endpoints covering local sessions: one listing session metadata, one returning a single session's metadata, and one returning the transcript.

The transcript logs three block types — text, tool_use and tool_result — which is to say, whatever is communicated to the model. In practice that means user prompts, bash commands, file reads and writes, and MCP calls.

Parsed, it also reveals which MCP servers were used (the tool names carry the server), which Skills were loaded (inferred from SKILL.md reads) and which plugins are present (from path conventions).

Before this, organisations running Claude Code on developer machines had limited visibility into what those agents were actually doing.

Why local was the gap

Because that is where the agents are. One vendor puts local agents at 68.6% of the AI agents it discovers in customer environments.

A cloud-hosted assistant is somebody else's audited surface. An agent on a developer laptop runs bash locally, holds whatever credentials that laptop holds, and reaches third-party services through MCP servers the organisation may never have inventoried. That was previously invisible to everyone except the developer.

What it still does not tell you

The honest part, and the source is unusually clear about it: even with managed settings, the Compliance API and endpoint collection together, none of them captures the context of the enterprise.

Concretely:

  • A transcript is not an identity. It does not connect the activity to the agent's owner, its purpose, its credentials, its permissions, or its access paths.
  • A static policy cannot tell legitimate from malicious. A bash command that reads a secrets file looks the same either way, and only context distinguishes them.
  • Point Claude Code at a non-Anthropic model and you get no Compliance API coverage at all. The visibility is a property of the vendor relationship, not of the tool.

That last one is worth dwelling on. The control is not a control on the software; it is a control on the service. It disappears the moment the software is used the way it also supports being used.

The transcript is itself sensitive

Local session transcripts are stored on the endpoint for 30 days by default.

That is a log containing prompts, file contents the agent read, and command output — on the same laptop the agent is running on, retained for a month. It is a useful audit trail and it is also a concentrated target, and it deserves the handling you would give any credential store.

For this site, that record would include every fetched page and every draft. Nothing dangerous, but it is not nothing, and anyone deploying this across an engineering team should think about who can read those files.

Where the framing comes from

Worth flagging: the write-up that surfaced this reads as vendor-contributed. It carries a single company's product framing — identity as the control plane that turns endpoint and session data into enforceable AI agent security — and its own discovery statistic.

That does not make the technical description wrong; the endpoints exist and do what is described. It does mean the conclusion that you need an identity governance layer is the argument of a company selling one. The gaps it identifies are real. Whether the answer is a product is a separate question.

What to do

  • Turn it on if you run Claude Code at any scale. Visibility you do not have cannot be reasoned about.
  • Decide who can read the transcripts before they accumulate, and shorten the retention if 30 days is longer than you need.
  • Do not mistake logging for control. It records what happened; it prevents nothing, which is the same point the prompt-injection research made about the Auto Mode classifier.
  • Inventory your MCP servers. The transcripts will tell you which ones are actually being used, which is likely to differ from what you approved.

What is not established

  • Availability by plan or tier. Not specified in the material available.
  • What the endpoints cost, in rate limits or otherwise.
  • Whether transcripts can be centralised by default or require endpoint collection.
  • How this interacts with local privacy expectations for developers whose prompts are now readable by a security team.