Claude Security Tool Architecture: How the Pieces Fit

The first time you ask Claude to "check whether this S3 bucket is publicly exposed and open a ticket if it is," something quietly profound happens under the hood. A natural-language request becomes a sequence of authenticated API calls against a cloud security tool, a structured finding, a policy decision, and a write into a ticketing system — all while leaving a trail an auditor can read. Most engineers treat this as magic. It is not. It is an architecture, and if you are connecting Claude to security and compliance tools, understanding that architecture end to end is the difference between a useful assistant and a liability.

This post walks the whole path: how a prompt turns into tool calls, where the Model Context Protocol fits, how skills shape behavior, and where the policy and audit boundaries live. The goal is a mental model you can draw on a whiteboard before you write a line of integration code.

Why security tooling stresses the agent model

Generic agent demos move fast because the blast radius is small — summarize a doc, query a read-only database, fetch a web page. Security and compliance tooling inverts every one of those assumptions. The actions are high-consequence: quarantining a host, revoking a credential, modifying a firewall rule, closing a control as "remediated." The data is sensitive: vulnerability findings, identity graphs, secrets metadata, audit evidence. And the work is regulated, meaning every action may need to be explained months later to someone who was not in the room.

That changes what "good architecture" means. You are no longer optimizing only for capability; you are optimizing for least privilege, determinism at the boundaries, and provable auditability. The Claude ecosystem gives you primitives for all three, but only if you assemble them deliberately. The model is the reasoning core, but the architecture around it is what makes it safe to point at a CSPM or an EDR console.

The layers, from prompt to action

It helps to think in five layers stacked between the human and the security tool. At the top is the reasoning layer — Claude itself, an Opus or Sonnet model interpreting intent and deciding what to do. Below it sits the skill layer, which supplies domain procedure: how your organization triages a critical CVE, which evidence a control needs, what "done" looks like. Beneath that is the tool layer exposed over MCP, where each security system advertises typed operations. Then a policy and gate layer intercepts proposed actions and decides whether they proceed, pause for approval, or get denied. At the bottom is the audit and state layer that records every step durably.

flowchart TD
 A["Engineer prompt"] --> B["Claude reasoning core"]
 B --> C{"Skill matches task?"}
 C -->|Yes| D["Load security skill: triage steps & evidence rules"]
 C -->|No| E["Reason from base policy"]
 D --> F["Propose MCP tool call"]
 E --> F
 F --> G{"Policy gate: scope & risk OK?"}
 G -->|Deny| H["Refuse & log reason"]
 G -->|Approve| I["MCP server executes against tool"]
 I --> J["Structured finding + audit record"]
 J --> B

The arrows matter as much as the boxes. Notice that everything flows back up to the reasoning core after each action, and that the policy gate sits between intent and execution. The model never touches the security tool directly; it proposes, and a deterministic gate disposes. That single inversion of control is the architectural heart of doing this safely.

Where MCP draws the boundary

Model Context Protocol is an open standard, introduced by Anthropic in November 2024, that lets Claude connect to external tools and data through MCP servers exposing typed operations and resources. In a security architecture, the MCP boundary is your trust boundary. Each server is a small, auditable program that owns exactly one system — a Wiz or Prisma Cloud server for posture, a CrowdStrike or SentinelOne server for endpoints, a Vanta or Drata server for compliance evidence, a Vault server for secrets metadata.

Drawing the boundary at the MCP server gives you several architectural wins at once. Credentials live in the server's environment, never in the model context, so Claude reasons about findings without ever seeing the API key that produced them. The server normalizes each tool's idiosyncratic API into clean, typed operations, which means the model sees a consistent shape — listFindings, getAsset, createTicket — regardless of vendor. And because the server is ordinary code, you can put your hardest guarantees there: input validation, rate limits, and the enforcement of read-versus-write separation.

A pattern I push hard on: split read and write into separate MCP servers, or at least separate, individually-permissioned tools. A posture-read server can be broadly available; a remediation-write server should require an explicit approval token in its request path. The model can call both, but the architecture makes the dangerous one harder to invoke by accident.

How skills encode your compliance opinion

An MCP server tells Claude what it can do; a skill tells Claude how your organization wants it done. Agent Skills are folders of instructions, scripts, and resources that Claude loads dynamically when a task matches. For security work, this is where institutional knowledge lives: your CVE severity matrix, the exact fields a PCI evidence package must contain, the escalation chain for a confirmed breach, the difference between a finding you auto-remediate and one a human must approve.

The architectural value is separation of concerns. Models improve and swap; vendors change APIs; but your compliance posture is your own and should be versioned independently. By keeping it in skills — plain text and small scripts in a Git repo — you can review changes to your security procedures the same way you review code, with pull requests and approvals. When an auditor asks "how does the agent decide what counts as remediated," you point at a file with a commit history, not at a model's opaque weights.

The audit path is part of the architecture, not an afterthought

In a regulated environment, an action that is not recorded effectively did not happen — or worse, happened without accountability. So the audit layer cannot be bolted on; it has to be a first-class part of the data path. The cleanest design routes every proposed action, every gate decision, and every tool result through a single append-only log before the model ever sees the outcome.

Concretely, the MCP server (or a thin proxy in front of it) writes a structured record for each call: who initiated the session, the resolved identity and scope, the tool and arguments, the gate decision and its rationale, the result hash, and a timestamp. Claude then receives the result and a reference to its audit record, so the model can cite the evidence trail in its own summaries. This closes a loop that compliance teams love: the agent's narrative explanation and the immutable log are linked, and you can reconstruct exactly what happened from either end.

Putting it together without over-engineering

It is easy to read the above and build a cathedral. Resist that. The minimal viable secure architecture is smaller than you think: one model, a couple of read-only MCP servers for your most-queried tools, one skill encoding your triage procedure, a single policy gate that hard-denies writes until you are ready, and an append-only audit sink. That alone is enough to safely answer "what's our exposure right now" across multiple tools — which is where most teams get their first real value.

Add write capability one tool at a time, each behind explicit approval, each with its own audit assertions and a rollback story. The architecture scales by addition, not by rewrite, precisely because the boundaries — model, MCP, skill, gate, audit — are clean. When something goes wrong, you will know which layer to look in, and that diagnosability is itself a security property.

Frequently asked questions

Does Claude ever see my security tool credentials?

In a correctly built architecture, no. Credentials live in the MCP server's environment and are used only when the server executes a call. Claude sees the typed operations and their structured results, never the API keys or tokens. Keeping the secret on the server side of the MCP boundary is one of the main reasons MCP is a good fit for security tooling.

Where should I enforce least privilege — in the model or in the tools?

In the tools and the policy gate, never in the model alone. Prompts and skills can guide behavior, but they are not an enforcement mechanism; a sufficiently confused or adversarial request can talk a model into trying something. The deterministic gate and the scoped credentials in each MCP server are what actually constrain the blast radius. Treat the model's restraint as a usability feature and the gate as the real control.

How is this different from just scripting the security APIs directly?

Scripts handle the known cases you anticipated; the agent architecture handles the long tail of ad hoc investigative questions that you did not pre-write. The value is letting Claude compose existing typed operations in novel orders to answer questions like "which internet-facing hosts have both a critical CVE and an over-privileged role." The architecture keeps that flexibility while constraining the actions to safe, audited operations.

Can one MCP server front multiple security tools?

It can, but for security work prefer one server per system. Single-system servers keep credentials, rate limits, and audit semantics cleanly separated, and they let you grant or revoke a tool's access without touching the others. A multi-tool server becomes a high-value target and a tangled audit surface; the modest extra plumbing of separate servers pays for itself the first time you need to isolate one tool.

Bringing agentic AI to your phone lines

CallSphere takes these same architectural ideas — typed tools behind clean boundaries, policy gates, and full audit trails — and applies them to voice and chat: multi-agent assistants that answer every call, pull from your systems mid-conversation, and act safely on your behalf around the clock. See it live at callsphere.ai.

Source & attribution: This is an independent, original explainer inspired by Anthropic's coverage on the Claude blog. Claude, Claude Code, Claude Cowork, Claude Opus, and the Model Context Protocol are products and trademarks of Anthropic. CallSphere is not affiliated with or endorsed by Anthropic.