Skip to content
Agentic Control Plane

Claude Desktop Audit Log & Governance — MCP Install Guide

Claude Desktop has no native audit log on the free or Pro tier, and the Team tier’s audit coverage has known gaps for Cowork sessions. Agentic Control Plane (ACP) closes that gap by adding itself as an MCP server in Claude Desktop’s config — every tool call routed through ACP is logged, scoped, and audited with full identity attribution. Works on any Claude Desktop tier.

New to MCP governance? See What is an MCP Control Plane? for the conceptual overview of how a governance layer sits between MCP clients and servers. This page is the concrete install guide for Claude Desktop specifically.

TL;DR

Edit claude_desktop_config.json:

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json Windows: %APPDATA%\Claude\claude_desktop_config.json Linux: ~/.config/Claude/claude_desktop_config.json

Add:

{
  "mcpServers": {
    "acp": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://mcp.agenticcontrolplane.com/mcp", "--header", "Authorization: Bearer gsk_yourslug_xxxxxxxxxxxx"]
    }
  }
}

Restart Claude Desktop. ACP appears in the MCP server menu (the hammer icon) and tool calls flow through your workspace.

How it works

Claude Desktop launches MCP servers as subprocesses (stdio transport) or connects to remote MCP endpoints (HTTP/SSE). ACP runs as a remote endpoint — mcp-remote is the standard wrapper that bridges Claude Desktop’s stdio expectations to ACP’s HTTPS server.

What you’ll see in the dashboard

Tool calls show up in cloud.agenticcontrolplane.com/activity with client.name: "claude-desktop" (or whatever clientInfo Claude Desktop reports during MCP initialize). The Agents page groups Claude Desktop traffic per identity.

Limitations

  • MCP-only governance. Claude Desktop has no equivalent of Claude Code’s PreToolUse hook. ACP only sees tool calls routed through MCP servers — not Claude’s internal model calls.
  • Restart required to load new MCP servers. Claude Desktop reads claude_desktop_config.json on launch only.
  • Per-machine, per-user config. No team-shared config option in Claude Desktop today; each user adds the MCP server config locally.
  • Token in plain text. The bearer token sits in claude_desktop_config.json. Use a workspace-scoped, rotateable gsk_ key — not a long-lived admin key.
  • Cline — VS Code extension with same MCP pattern
  • Claude Code — Anthropic’s terminal CLI with full hook integration
  • Anthropic Agent SDK — for building your own Claude-backed agents