# Claude Desktop Audit Log & Governance — MCP Install Guide

Add audit logging and policy to Claude Desktop via MCP. Per-tool-call audit, identity attribution, SOC 2-ready trail. macOS, Windows, Linux.

# Claude Desktop Audit Log & Governance — MCP Install Guide

[Claude Desktop](https://claude.ai/download) has no native audit log on the free or Pro tier, and the Team tier's audit coverage has [known gaps for Cowork sessions](https://www.mintmcp.com/blog/claude-cowork-audit-logging-gap). Agentic Control Plane (ACP) closes that gap by adding itself as an MCP server in Claude Desktop's config — every tool call routed through ACP is logged, scoped, and audited with full identity attribution. Works on any Claude Desktop tier.

> **New to MCP governance?** See [What is an MCP Control Plane?](/what-is-an-mcp-control-plane) for the conceptual overview of how a governance layer sits between MCP clients and servers. This page is the concrete install guide for Claude Desktop specifically.

## TL;DR

Edit `claude_desktop_config.json`:

**macOS:** `~/Library/Application Support/Claude/claude_desktop_config.json`
**Windows:** `%APPDATA%\Claude\claude_desktop_config.json`
**Linux:** `~/.config/Claude/claude_desktop_config.json`

Add:

```json
{
  "mcpServers": {
    "acp": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://mcp.agenticcontrolplane.com/mcp", "--header", "Authorization: Bearer gsk_yourslug_xxxxxxxxxxxx"]
    }
  }
}
```

Restart Claude Desktop. ACP appears in the MCP server menu (the hammer icon) and tool calls flow through your workspace.

## How it works

Claude Desktop launches MCP servers as subprocesses (stdio transport) or connects to remote MCP endpoints (HTTP/SSE). ACP runs as a remote endpoint — `mcp-remote` is the standard wrapper that bridges Claude Desktop's stdio expectations to ACP's HTTPS server.

## What you'll see in the dashboard

Tool calls show up in [cloud.agenticcontrolplane.com/activity](https://cloud.agenticcontrolplane.com/activity) with `client.name: "claude-desktop"` (or whatever clientInfo Claude Desktop reports during MCP `initialize`). The Agents page groups Claude Desktop traffic per identity.

## Limitations

- **MCP-only governance.** Claude Desktop has no equivalent of Claude Code's PreToolUse hook. ACP only sees tool calls routed through MCP servers — not Claude's internal model calls.
- **Restart required to load new MCP servers.** Claude Desktop reads `claude_desktop_config.json` on launch only.
- **Per-machine, per-user config.** No team-shared config option in Claude Desktop today; each user adds the MCP server config locally.
- **Token in plain text.** The bearer token sits in `claude_desktop_config.json`. Use a workspace-scoped, rotateable `gsk_` key — not a long-lived admin key.

## Related integrations

- [Cline](/integrations/cline) — VS Code extension with same MCP pattern
- [Claude Code](/integrations/claude-code) — Anthropic's terminal CLI with full hook integration
- [Anthropic Agent SDK](/integrations/anthropic-agent-sdk) — for building your own Claude-backed agents

<script type="application/ld+json">
{"@context":"https://schema.org","@type":"HowTo","name":"Add Agentic Control Plane to Claude Desktop","step":[{"@type":"HowToStep","name":"Get an ACP API key","text":"Sign up at cloud.agenticcontrolplane.com and create a gsk_ key."},{"@type":"HowToStep","name":"Edit claude_desktop_config.json","text":"Open ~/Library/Application Support/Claude/claude_desktop_config.json (macOS)."},{"@type":"HowToStep","name":"Add ACP MCP server","text":"Add the mcp.agenticcontrolplane.com/mcp entry with mcp-remote wrapper and bearer auth."},{"@type":"HowToStep","name":"Restart Claude Desktop","text":"Relaunch the app to load the new MCP server."}]}
</script>