Claude Cowork Security Guide

This presents a deployment guide that places Claude Cowork behind a middleman control plane.

The key points are as follows.

• Use managed devices and restricted working folders.
• Route Claude Desktop, Claude Code, browser, and local tool traffic through an on-device proxy or LLM gateway.
• Install the enterprise CA only on managed devices, and provide an example of connecting Claude Code to mitmproxy via HTTP_PROXY/HTTPS_PROXY/NO_PROXY settings.
• browser use and computer use require separate policies, paired with managed browser profiles, app blocking, approval flows, and endpoint telemetry.
• Treat plugins and MCP like a supply chain, recommending approved marketplaces, least privilege, tool-call logging, and secret masking.

Since the proxy cannot see every path, flows such as server-side web fetch/search, remote MCP, and local screen clicks must be supplemented with separate telemetry.