# Claude Connector

Blekline’s **official Claude connector** provides ingress governance: mask PII and secrets, simulate policy, evaluate tool calls, and log metadata audit events — before content reaches Claude or downstream MCP tools.

## Install (directory)

When listed in the Claude connectors directory, choose **Connect** and sign in with your Blekline workspace. OAuth scopes:

| Scope | Purpose |
|-------|---------|
| `mcp:mask` | Mask prompts via cloud control plane |
| `mcp:policy:read` | Read-only policy simulation |
| `mcp:enforce` | Evaluate tool call policy |
| `mcp:events:write` | Metadata governance events |

Requires **Basic** plan or active tryout. [Billing](/docs/introduction/quick-start)

## Remote MCP URL

```
https://app.blekline.com/api/mcp/remote
```

Authenticate with `Authorization: Bearer <access_token>` from OAuth token exchange.

## Tools

| Tool | Type | Purpose |
|------|------|---------|
| `blekline_mask_prompt` | Write | Mask PII/secrets in prompt text |
| `blekline_simulate_policy` | Read | Policy simulation without masking |
| `blekline_evaluate_tool_call` | Read | Tool allow/mask/block evaluation |
| `blekline_log_governance_event` | Write | Metadata audit event |

Deprecated aliases `blekline_classify_risk` and `blekline_emit_event` remain supported.

## Manual setup (stdio)

See [Claude Desktop](/docs/mcp/claude-desktop) for local `npx @blekline/mcp-server` config with a workspace API key.

## Privacy

- Masking calls process prompt text in transit; see [Trust boundaries](/docs/security/trust-boundaries).
- Governance events are metadata-only (no raw prompt storage in audit stream).
- Privacy policy: https://blekline.com/privacy

## Revoke access

Workspace **Operations → MCP → Claude Desktop connector → Revoke**, or Admin → API keys (revokes connector token).

---

**Next steps:** [Claude Desktop manual setup](/docs/mcp/claude-desktop) · [MCP server](/docs/mcp/server) · [Open workspace](https://app.blekline.com)