# Anthropic

Plugins reach Anthropic surfaces through the org's GitHub-backed plugin marketplace. This page covers connecting that marketplace to a Claude org, distributing plugins to Claude Code and Claude Cowork, and wiring up the observability plugin's telemetry so sessions are attributed to users.

The observability plugin and Claude's OTEL exporter together are the prerequisite for most governance features on Anthropic surfaces: observability of AI usage across the company (tokens, cost, clients, MCP, skills), security flagging and blocking, [shadow MCP detection](/docs/ai-control-plane/secure/shadow-mcp), and more. Claude Code and Claude Cowork are configured separately.

> In Claude and Cursor, a plugin marketplace is a shareable, configurable
> collection of plugins backed by a GitHub repo. The platform hosts a
> marketplace on the org's behalf containing the observability plugin and any
> custom plugins. Once the marketplace is connected to the Claude org, each
> plugin can be enabled, disabled, or required from Claude admin settings.

## Access requirements

> Publishing the marketplace requires the `project:write` scope and creating the
> API key requires the `org:admin` scope, both held by the default [Admin
> role](/docs/ai-control-plane/org-admin/roles-and-permissions). The Claude-side
> steps require admin access to the Claude organization.

> **Why OTEL is required**
> The platform uses Claude's OTEL exporter to associate Claude sessions with
> users. Without it there is no way of knowing who performed which action, so
> most features will not work. The same telemetry powers cost and token metrics
> when that setting is enabled. A project-scoped [data
> export](/docs/ai-control-plane/observe/opentelemetry) can send the normalized
> OTLP signals to an external collector.

## Create an API key

In the dashboard, open **Organization settings > Settings > API Keys** (see [API keys](/docs/ai-control-plane/org-admin/api-keys)) and create a new key with the **Hooks** scope. Copy the key. It replaces the `` placeholder below, producing a header string like `"Gram-Project=default,Gram-Key=gram_live_abc..."`. The same key works for both Claude Code and Cowork.

## Claude Code

> **Alternative paths**
> The [device agent](/docs/ai-control-plane/reference/device-agent) applies the
> same marketplace, plugin, and OTEL settings to Claude Code on its own and
> reapplies them every minute, so organizations running it can skip this
> section for Claude Code on developer machines. It writes the user-level
> settings file rather than the admin-owned managed settings, and the telemetry
> block only lands once Claude Code has cloned the marketplace on its next
> launch. These settings can also be distributed via MDM, which gives more
> control over the rollout at the cost of a more involved setup.
>
> Claude Code on the web does not use this laptop path. Instrument those
> sessions with the device agent in a shared Anthropic-hosted environment; see
> [Claude Code on the web](/docs/ai-control-plane/reference/device-agent#claude-code-on-the-web).
>
> Claude Cowork is not covered by either alternative, so the
> [Claude Cowork](#claude-cowork) steps below always apply.

In the Claude org settings, open the **Claude Code** tab (claude.ai/admin-settings/claude-code), scroll to **Managed settings**, and click **Manage**. Merge the following JSON into the dialog, replacing the marketplace values with the ones shown in the **Install instructions** sheet on the dashboard's **MCP Gateway > Plugins** page (open the **Install** menu on the **Observability** card and choose **GitHub installation (preferred)**, then **Claude Code**) and the API key placeholder with the key created above. The marketplace name after the `@` is the one set on the marketplace card, so replace `-speakeasy` with the project's own marketplace name if it was renamed.

```json
{
  "extraKnownMarketplaces": {
    "<org>-gram": {
      "autoUpdate": true,
      "source": {
        "url": "<marketplace-git-url>",
        "source": "git"
      }
    }
  },
  "enabledPlugins": {
    "<org>-observability@<org>-speakeasy": true
  },
  "env": {
    "CLAUDE_CODE_ENABLE_TELEMETRY": "1",
    "OTEL_EXPORTER_OTLP_ENDPOINT": "https://app.getgram.ai/rpc/hooks.otel",
    "OTEL_EXPORTER_OTLP_HEADERS": "Gram-Project=default,Gram-Key=<MY_KEY>",
    "OTEL_EXPORTER_OTLP_PROTOCOL": "http/json",
    "OTEL_LOGS_EXPORTER": "otlp",
    "OTEL_METRICS_EXPORTER": "otlp"
  }
}
```

> **Trust prompt**
> Claude treats the OTEL exporter settings as sensitive. After this step,
> everyone in the Claude org is asked whether they trust the settings the next
> time they start Claude Code, and must mark them as trusted to continue (this
> just requires hitting Enter).

### Confirm the plugin is installed

Restart Claude Code and confirm the plugin appears under `/plugins` → **Installed** (it may require scrolling).

### Confirm telemetry is flowing

- Execute any tool call: use an MCP server, or ask Claude to run `echo hi there`.
- Open [Tool Logs](/docs/ai-control-plane/observe/tool-logs) in the dashboard. The tool call should appear immediately (for a local tool call, set the **Type** filter to include local tools).

## Claude Cowork

### Add a user to the plugin marketplace

On the dashboard's **MCP Gateway > Plugins** page, click **Manage collaborators** on the marketplace card, enter a GitHub username under **GitHub Usernames**, and click **Add collaborators**. (If the marketplace has never been published, **Setup** asks for a marketplace name first and then opens the **Publish Plugins** dialog, which takes the same usernames.) Then follow the link to the plugin repo and accept the invitation to collaborate (check email or GitHub notifications if it doesn't appear). Collaborators are added as repository admins, which is what Claude, Cursor, and other marketplaces require of the person connecting the repository. Only the user who will add the marketplace to the company Claude org needs this step.

### Add the marketplace to Claude Cowork

In the **Plugins** tab of the Claude organization settings, click **Add Plugins**, then **Sync from GitHub**. If a message appears about enabling the GitHub connector for the Claude org, enable it and repeat this step. In the repo dropdown, select the org's plugin repo, which is named `--plugins` under the `speakeasy-plugins` GitHub org. The repository link on the marketplace card opens the same repo.

### Update plugin availability

Scroll down to the newly added marketplace. It may say "Syncing plugins from repository..." for a short while. Once the plugins load, a plugin named after the org (for example, ` observability`) appears. It contains the agent hooks that power most control plane features, so mark it **Required** for a real rollout (**Available to install** works for a proof of concept). Set any other plugins, such as default MCPs, to **Available to install** so users can opt in.

### Enable OTEL export

In the **Cowork** tab of the Claude org settings, scroll to **Monitoring** and set:

- OTLP endpoint: `https://app.getgram.ai/rpc/hooks.otel`
- OTLP protocol: `http/json`
- OTLP headers: `Gram-Project=default,Gram-Key=`

Save the settings.

### Verify

Restart Claude Desktop, use a connector or MCP server from the Cowork tab, and confirm the call appears immediately in [Tool Logs](/docs/ai-control-plane/observe/tool-logs).

### Manually enable a non-required plugin

Skip this step for plugins marked **Required**. In the Claude Desktop app's **Cowork** tab, click **Customize** in the left nav, click the **+** icon next to **Organization plugins**, and in the modal click the **+** icon on the desired plugin's card.