Choosing a control
When to use Claude Inference Hooks, IDE hooks, the Claude Compliance API, and the MCP Gateway, and what each one can and cannot stop.
Nightfall protects AI use at four different points. They overlap. None of them replaces the others.
Where it sits
Inside Claude, before the model runs
On the laptop, inside the coding agent
After the fact, via Anthropic's API
On the path to remote MCP servers
Can it stop the action?
Yes. A denied prompt never reaches the model.
Yes. A denied prompt, tool call, or shell command never runs.
No. Monitor and alert only.
Yes, for remote tools. A disabled tool or blocked server cannot be called through the gateway.
Needs the Nightfall agent or MDM?
No.
Yes. Agent plus a hook deployment.
No.
No. Clients must use the Nightfall URL.
What it covers
Claude Enterprise: claude.ai, Claude Desktop, mobile, Cowork, Claude Code, Claude in Slack
Claude Code, Cursor, VS Code Copilot on managed devices
Claude Enterprise chats and uploaded files
Any MCP client pointed at the gateway: Cursor, Claude, VS Code, Windsurf, ChatGPT, and others
What it does not cover
Cursor, VS Code, Copilot, Windsurf. Claude Team. Bedrock, Vertex, and the Claude Platform API. Shell and tool calls before they execute.
claude.ai, Cowork, and any machine that never received the hooks.
Inline blocking. Claude Team. Bedrock, Vertex, and Platform API traffic.
Local stdio MCP. Clients that still point at a vendor URL. Prompt text that never becomes a tool call.
The short answer
Use Inference Hooks when the job is: stop sensitive text from reaching Claude, for the whole Claude Enterprise organization, including people who never installed anything.
Use IDE hooks when the job is: stop the action itself, a shell command, an MCP tool call, or a file read, before it executes, on Claude Code, Cursor, or VS Code.
Use the Compliance API when the job is an org-wide record of Claude Enterprise chats and files after they exist, for investigation and evidence.
Use the MCP Gateway when the job is one sanctioned front door for remote tools, with credentials you can revoke and a log of who called what.
Most Claude Enterprise customers run all four.
What each layer actually sees
Two facts decide which control you need.
Inference Hooks run after the request has left the device, and before the model. Anthropic sends the conversation Nightfall can see: the transcript, tool calls and their results, and text extracted from attachments. A deny stops that inference. The model never sees the content.
By the time a tool call is in that transcript, the tool has already run. Inference Hooks can stop the model from reading a secret a command just printed. They cannot un-run the command. IDE hooks are the control that fires before cat, before an MCP tool, and before a file read.
The Compliance API runs later still. It reads chats and files Anthropic has already stored. It never sits on the request.
The MCP Gateway sits on a different path entirely: the call from a client to a remote MCP server. It does not scan the prompt, and it does not see local servers.
What is covered, by content
Five kinds of content show up in an agent session. Each control sees a different subset, and seeing content is not the same as being able to stop the action.
User prompt
Block before the prompt is submitted
Block before the model runs
Scan the stored chat afterward. No block
Not seen
MCP tool call
Block before the tool runs
Scanned only after the tool has already run, inside the next prompt check. A deny stops the model. It does not stop the call
Not a tool log
Disable the tool or block the server, so the call never happens through the gateway. Request arguments are written to Audit, capped at 8 KiB. They are not scanned for sensitive data
Tool response
Monitor after the tool has finished. The policy wizard does not offer Block
Scanned after the tool has finished, before the model reads the result. A deny stops the model from seeing it. The call already happened
No
Tool responses are not stored. Content scanning of the response is not available in this release
Shell command
Block before the command runs
Not a separate check. A shell command arrives as a tool call after it has executed. The command string and its output can be inside the next prompt check. The command already ran
No
Not seen
Model response
Monitor after the model has replied. No block
Not a separate check. Text the model already wrote can sit inside a later prompt frame, and a match denies that later turn
Scan the stored assistant message afterward. No block
Not seen
How to read the Inference Hooks column
Anthropic sends one frame per governed inference, before the model runs, containing the conversation so far. Nightfall scans the new text in that frame. New text can be the user's prompt, a tool call's arguments, a tool's result, or text extracted from an attachment. A finding denies the whole inference.
That is why a secret typed into the prompt is stopped before Claude can act on it, and a secret a tool just printed is stopped before Claude can read it, while the tool itself is already done.
A policy that selects only Tool Calls, Tool Responses, Shell Commands, or Model Responses never matches an Inference Hooks delivery. Those toggles are for IDE hooks. They do not apply on this integration.
How to read the IDE hooks column
The policy wizard is the contract. Each hook type is independent.
User Prompts
Before the prompt is sent to the model
Yes
Tool Calls
Before the tool executes. Name and arguments
Yes
Shell Commands
Before the shell command executes
Yes
Tool Responses
After the tool finishes. Name and output
No. Monitor only
Model Responses
After the model replies
No. Monitor only
Cursor's pre-action hooks (beforeSubmitPrompt, preToolUse) are fail-closed: if the hook crashes, times out, or returns invalid JSON, the action is blocked. The post-action hooks observe only. VS Code Copilot does not support blocking tool responses.
How to read the gateway column
Server and tool governance is live. Block a server, or disable write and delete tools. Clients stop listing those tools and cannot call them. This does not look at the arguments.
Content scanning is not available on the gateway in this release. Do not write a gateway content policy and expect a block. Use IDE hooks or Inference Hooks for the content, and the gateway for which tools exist.
Audit records who called which tool and the request arguments. It does not record the tool's response.
Use cases
A person pastes a customer list or an API key into claude.ai, Cowork, or Claude Code, including on a laptop with no agent
Inference Hooks, User Prompts, Block
The check is in Claude's cloud, before the model
A coding agent runs a shell command or an MCP write tool
IDE hooks, Tool Calls and Shell Commands, Block
The check is before the process starts
You want a record of what the tool returned
IDE hooks, Tool Responses, Monitor
The tool has finished
You want the model's reply in the incident
IDE hooks, Model Responses, Monitor. Compliance API for the stored Claude Enterprise chat
The reply has already been generated
GitHub MCP should be searchable and not able to delete
MCP Gateway: keep the server, disable the delete tools
The tool disappears from the client
You do not know which MCP servers developers already added
MCP Server Visibility
The gateway only sees clients that use its URL
Legal needs the chat that already happened
Compliance API
Inference Hooks have no retrospective view
Claude Code on Bedrock, Vertex, or a Console API key
IDE hooks only
Inference Hooks and the Compliance API do not see that traffic
Best practices
Write separate policies per control. An Inference Hooks policy selects User Prompts only. An IDE policy selects the hook types that client can actually fire.
Turn on content inspection and add detection rules. A policy with no rules inspects nothing and creates no violations.
Leave Inference Hooks tool scope on All MCP servers. A rule narrowed to one tool does not apply to an ordinary chat turn, which names no tool.
Start IDE hook policies in Monitor for a week, except credentials. Credential detectors are specific enough to Block on day one.
Start Inference Hooks in Anthropic shadow mode, failure handling Allow the request, timeout at least 5,000 ms, 100% inspected. Move to enforce after a business day of decisions.
Name the policies so an admin can tell them apart. On IDE hooks, Tool Calls blocks before the tool runs. On Inference Hooks, tool text is scanned after the tool ran.
Pair the gateway with Visibility. Disabling a tool on the gateway does not remove a vendor URL from a local config file.
Keep the Compliance API on when Inference Hooks are on. Circuit-breaker trips and hook denials are recorded in Claude's activity feed only when that API is enabled.
Policy templates, Inference Hooks setup, and the deployment matrix are on Hook policy recommendations.
Was this helpful?