Claude Code

Claude Code has three integration paths. The plugin is the recommended one — it auto-records every session via hooks, no manual treeship session start to remember.

Method 1: Official plugin (recommended)

The Treeship Claude Code plugin ships every session as a portable, signed receipt with zero configuration. SessionStart / PostToolUse / SubagentStart / SubagentStop / SessionEnd hooks fire automatically; the bundled @treeship/mcp server captures any MCP-routed tool calls; built-in tools (Read, Write, Edit, Bash, Grep, Glob) are captured via the PostToolUse hook.

claude plugin marketplace add zerkerlabs/treeship
claude plugin install treeship@treeship

cd your-project
treeship init   # if you haven't already

What the plugin ships

The gate (PreToolUse)

Register the session's actor with a card and the plugin enforces it before each tool runs:

treeship agent register --name claude-code \
  --tools file.read,file.write,shell.exec,net.fetch \
  --escalation "mcp__postgres__*" \
  --network api.example.com,*.internal.net

Claude Code tools map onto the card's vocabulary: Read, Grep and Glob are file.read; Write, Edit, MultiEdit and NotebookEdit are file.write; Bash is shell.exec; WebFetch and WebSearch are net.fetch; Agent and Task are agent.spawn; an MCP tool mcp__server__tool is server.tool. The card's patterns take one *, the same rule verify-capability uses.

The session's actor is what the gate looks a card up by. The plugin starts sessions as agent://claude-code (override with TREESHIP_ACTOR), the same actor the bridge signs as; a session started by hand under another actor has no card and the gate says nothing. The model recorded on the receipt comes from TREESHIP_MODEL or ~/.claude/settings.json at session start, not from the running session, so the two can differ if the model is switched mid-session. The network scope reaches what the harness routes through WebFetch. A curl inside Bash is a shell command to the gate, judged as shell.exec; its destination is not inspected here. The sealed receipt still records every agent.connected_network event and judges it against the declared scope (see network scope in the receipt).

The kill switch is treeship halt agent://claude-code --reason "…"; treeship halt --lift agent://claude-code ends it, and both are signed receipts on the session chain. A refusal is a signed artifact, sealed with the session like any action, so "the gate stopped it" is a claim a stranger can verify. The gate fails open on every error path: a broken Treeship never blocks a tool call by accident. It is a boundary on what the harness routes through hooks, not on what a process spawned outside them can do; the coverage level says where that boundary is.

The judge is opt-in and runs after the card, never instead of it. With TREESHIP_JUDGE=1 the built-in rules judge is deterministic and replayable, so a stranger can re-run it on the sealed state and check the answer; with a URL, any judge that speaks the contract sits in the same slot and leaves the same receipt. No model is in the decision path unless the operator points at one. | skills/treeship-verify | How to verify a receipt URL someone shares with you | | skills/treeship-report | How to publish + share a session report URL |

Method 2: CLAUDE.md instruction file (no plugin)

For users who don't want to install the plugin but still want Claude Code to use Treeship intentionally:

curl -fsSL https://www.treeship.dev/setup | sh

curl -o CLAUDE.md https://raw.githubusercontent.com/zerkerlabs/treeship/main/integrations/claude-code/CLAUDE.md

Method 3: MCP server only

If you don't want hooks but want MCP tool calls captured, add the server yourself. Claude Code reads MCP servers from a project's .mcp.json (project-scoped) or ~/.claude.json (user-scoped, under a top-level mcpServers key) -- not from ~/.claude/mcp.json, which Claude Code never reads:

// .mcp.json (project root)
{
  "mcpServers": {
    "treeship": {
      "command": "npx",
      "args": ["-y", "@treeship/mcp"],
      "env": {
        "TREESHIP_ACTOR": "agent://claude-code",
        "TREESHIP_HUB_ENDPOINT": "https://api.treeship.dev"
      }
    }
  }
}

Restart Claude Code after adding the config. This catches MCP-routed tool calls (e.g. brave_search, notion) but not Claude Code's built-in tools (Read, Write, Edit, Bash) — those bypass MCP entirely. For full coverage, use Method 1.

Start the session as the same actor the bridge signs as (treeship session start --actor agent://claude-code, which the plugin's SessionStart hook does by default, or TREESHIP_ACTOR for another name). The bridge's intents and results chain onto the open session. The actor is signed into each artifact.

Live monitoring

While Claude Code works, watch the session in real time:

treeship session status --watch

The plugin also streams live receipt/event counters into Claude's context via its background monitor, so the agent itself can see the receipt being built without polluting the chat.

What appears in the receipt

Verifying a session report

The URL printed by treeship session report is the human-readable session report at treeship.dev/receipt/<id>. Anyone you share it with can verify the embedded receipt themselves:

treeship verify https://treeship.dev/receipt/<id>

Verification is pure WASM (@treeship/core-wasm), works entirely offline, doesn't phone home.