{"resources":{"claude":{"id":"claude","name":"claude","fields":{"agent":{"name":"agent","type":"\u001bclaude.agent","title":"Claude managed agent","desc":"Managed agent definition created through the Beta Agents API and executed within sessions. Auditing an agent surfaces the model it runs on, its system prompt, and its version and archival state, which together govern the instructions in effect for every session that uses it. It also surfaces what the agent is permitted to do: the toolsets it can call and the permission policy on each tool, the MCP servers it reaches out to, the skills it loads, and the roster of other agents it may spawn.","provider":"go.mondoo.com/mql/providers/claude","is_implicit_resource":true},"agents":{"name":"agents","type":"\u0019\u001bclaude.agent","title":"Managed agents","provider":"go.mondoo.com/mql/providers/claude"},"asset":{"name":"asset","type":"\u001basset","title":"Asset this root belongs to","desc":"Platform, version, identity and labels of the asset this root describes.","provider":"go.mondoo.com/mql/providers/claude","is_implicit_resource":true},"environment":{"name":"environment","type":"\u001bclaude.environment","title":"Claude execution environment","desc":"Execution environment that defines the compute context and visibility scope in which agent sessions run. Audit environments to see where agents execute and how broadly they are exposed. The `scope` field is one of organization or account, distinguishing an environment shared across the whole organization from one confined to a single account. The network policy states which hosts a session can reach from inside the environment, and the package fields list what is installed in the sandbox the agent runs in.","provider":"go.mondoo.com/mql/providers/claude","is_implicit_resource":true},"environments":{"name":"environments","type":"\u0019\u001bclaude.environment","title":"Execution environments","provider":"go.mondoo.com/mql/providers/claude"},"file":{"name":"file","type":"\u001bclaude.file","title":"Claude uploaded file","desc":"File uploaded to the Claude platform and managed through the Beta Files API, exposing its original filename, MIME type, size in bytes, and whether it can be downloaded, along with its upload timestamp. Useful for inventorying which files are available to agents and auditing their download exposure.","provider":"go.mondoo.com/mql/providers/claude","is_implicit_resource":true},"files":{"name":"files","type":"\u0019\u001bclaude.file","title":"Uploaded files","provider":"go.mondoo.com/mql/providers/claude"},"host":{"name":"host","type":"\u0007","title":"API host address","provider":"go.mondoo.com/mql/providers/claude"},"memoryStore":{"name":"memoryStore","type":"\u001bclaude.memoryStore","title":"Claude memory store","desc":"Memory store used to persist context across agent sessions. Memory stores are mounted under `/mnt/memory/` in the agent environment, and their description is included in the system prompt, so their name, description, and archival state are worth auditing to understand what long-lived context agents can read and write.","provider":"go.mondoo.com/mql/providers/claude","is_implicit_resource":true},"memoryStores":{"name":"memoryStores","type":"\u0019\u001bclaude.memoryStore","title":"Memory stores","provider":"go.mondoo.com/mql/providers/claude"},"messageBatch":{"name":"messageBatch","type":"\u001bclaude.messageBatch","title":"Claude message batch","desc":"Message batch job that submits multiple message requests for asynchronous processing, exposing its processing status and lifecycle timestamps (creation, expiration, end, cancellation, and archival). Useful for auditing in-flight and completed batch workloads and their retention. The `processingStatus` field is one of in_progress, canceling, or ended.","provider":"go.mondoo.com/mql/providers/claude","is_implicit_resource":true},"messageBatches":{"name":"messageBatches","type":"\u0019\u001bclaude.messageBatch","title":"Message batches","provider":"go.mondoo.com/mql/providers/claude"},"model":{"name":"model","type":"\u001bclaude.model","title":"Claude AI model","desc":"AI model available through the Claude API, including its token limits and capability flags. The `id` field is the canonical model identifier (for example `claude-opus-4-6`) and serves as the selection key for `claude.model(id: \"claude-opus-4-6\")`.","provider":"go.mondoo.com/mql/providers/claude","is_implicit_resource":true},"models":{"name":"models","type":"\u0019\u001bclaude.model","title":"Available models","provider":"go.mondoo.com/mql/providers/claude"},"organization":{"name":"organization","type":"\u001bclaude.organization","title":"Claude organization","desc":"Organizational resources managed through the Claude Admin API: identity, workspaces, members, pending invites, API keys, usage, cost, and rate limits. Requires an admin API key configured via `--admin-token` or the `ANTHROPIC_ADMIN_API_KEY` environment variable.","provider":"go.mondoo.com/mql/providers/claude","is_implicit_resource":true},"session":{"name":"session","type":"\u001bclaude.session","title":"Claude agent session","desc":"Agent session in the Claude platform, including its execution status, the environment it runs in, and its lifecycle timestamps. Auditing sessions shows which agent work is active or idle and which environment each session is bound to. The `status` field is one of rescheduling, running, idle, or terminated.","provider":"go.mondoo.com/mql/providers/claude","is_implicit_resource":true},"sessions":{"name":"sessions","type":"\u0019\u001bclaude.session","title":"Agent sessions","provider":"go.mondoo.com/mql/providers/claude"},"skill":{"name":"skill","type":"\u001bclaude.skill","title":"Claude registered skill","desc":"Skill registered in the Claude platform, packaging reusable instructions that extend agent capabilities. Skills can be Anthropic-provided or custom, letting you audit which extensions are available to agents and where they originate. The `source` field is one of custom or anthropic.","provider":"go.mondoo.com/mql/providers/claude","is_implicit_resource":true},"skills":{"name":"skills","type":"\u0019\u001bclaude.skill","title":"Registered skills","provider":"go.mondoo.com/mql/providers/claude"},"userProfile":{"name":"userProfile","type":"\u001bclaude.userProfile","title":"Claude user profile","desc":"User profile representing an entity that interacts with the Claude platform. The `accessType` field describes how the platform uses the API on behalf of the entity, and `externalUserOnboardedAt` records when the platform onboarded the end user behind the profile.","provider":"go.mondoo.com/mql/providers/claude","is_implicit_resource":true},"userProfiles":{"name":"userProfiles","type":"\u0019\u001bclaude.userProfile","title":"User profiles","provider":"go.mondoo.com/mql/providers/claude"},"vault":{"name":"vault","type":"\u001bclaude.vault","title":"Claude secret vault","desc":"Secret vault used to store credentials for agent sessions. Vaults hold credentials that agents can access at runtime without exposing secrets in prompts.","provider":"go.mondoo.com/mql/providers/claude","is_implicit_resource":true},"vaults":{"name":"vaults","type":"\u0019\u001bclaude.vault","title":"Secret vaults","provider":"go.mondoo.com/mql/providers/claude"}},"title":"Claude AI platform","desc":"Models available through the Claude API, along with managed agents, execution environments, agent sessions, uploaded files, registered skills, secret vaults, memory stores, message batches, and user profiles. When an admin API key is configured, organizational resources such as workspaces, members, invites, API keys, usage, cost, and rate limits also become queryable.","min_provider_version":"13.0.0","defaults":"host","provider":"go.mondoo.com/mql/providers/claude","root":true},"claude.agent":{"id":"claude.agent","name":"claude.agent","fields":{"advisorModels":{"name":"advisorModels","type":"\u0019\u0007","is_mandatory":true,"title":"Models backing the advisors in the multiagent roster","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/providers/claude"},"archivedAt":{"name":"archivedAt","type":"\t","is_mandatory":true,"title":"Archive timestamp, if applicable","provider":"go.mondoo.com/mql/providers/claude"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Agent creation timestamp","provider":"go.mondoo.com/mql/providers/claude"},"customTool":{"name":"customTool","type":"\u001bclaude.agent.customTool","title":"Custom tool defined on a Claude agent","desc":"Tool declared inline on an agent rather than supplied by a built-in toolset or an MCP server. The description is the text the model reads when deciding whether to call it, and the input schema states the parameters it accepts.","is_private":true,"provider":"go.mondoo.com/mql/providers/claude","is_implicit_resource":true},"customTools":{"name":"customTools","type":"\u0019\u001bclaude.agent.customTool","is_mandatory":true,"title":"Custom tools defined on the agent","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/providers/claude"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Agent description","provider":"go.mondoo.com/mql/providers/claude"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Agent identifier","provider":"go.mondoo.com/mql/providers/claude"},"mcpServers":{"name":"mcpServers","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"MCP servers the agent can reach","desc":"Maps each configured server name to its URL. Every entry is a network destination the agent may call during a session, so an unrecognized host, or a plaintext one, widens what the agent can talk to.","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/providers/claude"},"metadata":{"name":"metadata","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"User-provided metadata key-value pairs","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/providers/claude"},"model":{"name":"model","type":"\u0007","is_mandatory":true,"title":"Model identifier used by this agent","provider":"go.mondoo.com/mql/providers/claude"},"modelEffort":{"name":"modelEffort","type":"\u0007","is_mandatory":true,"title":"Reasoning effort applied on each turn","desc":"One of low, medium, high, xhigh, or max. Empty when the agent does not pin an effort level.","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/providers/claude"},"modelInferenceGeo":{"name":"modelInferenceGeo","type":"\u0007","is_mandatory":true,"title":"Geographic region for model inference","desc":"Empty when the agent inherits the default inference region of the workspace it runs in.","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/providers/claude"},"modelSpeed":{"name":"modelSpeed","type":"\u0007","is_mandatory":true,"title":"Inference speed mode","desc":"One of standard or fast.","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/providers/claude"},"multiagentType":{"name":"multiagentType","type":"\u0007","is_mandatory":true,"title":"Multiagent topology","desc":"Set to coordinator when the agent may spawn other agents as session threads, and empty when the agent runs alone.","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/providers/claude"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Agent name","provider":"go.mondoo.com/mql/providers/claude"},"skill":{"name":"skill","type":"\u001bclaude.agent.skill","title":"Skill attached to a Claude agent","desc":"Version-pinned skill an agent loads at runtime, extending it with reusable instructions. The source separates Anthropic-provided skills from custom ones authored inside the organization, which is the line between vendor-reviewed instructions and instructions anyone with skill-write access can change under a running agent.","is_private":true,"provider":"go.mondoo.com/mql/providers/claude","is_implicit_resource":true},"skills":{"name":"skills","type":"\u0019\u001bclaude.agent.skill","is_mandatory":true,"title":"Skills attached to the agent","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/providers/claude"},"subagents":{"name":"subagents","type":"\u0019\u001bclaude.agent","title":"Agents this agent may spawn as session threads","desc":"The roster the coordinator draws from, which is how far a single session can reach beyond the agent that started it.","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/providers/claude"},"system":{"name":"system","type":"\u0007","is_mandatory":true,"title":"System prompt","provider":"go.mondoo.com/mql/providers/claude"},"toolset":{"name":"toolset","type":"\u001bclaude.agent.toolset","title":"Toolset available to a Claude agent","desc":"Group of tools an agent can call, together with the permission policy governing them. A built-in toolset covers the agent's own capabilities such as shell, file, and web access, while an MCP toolset exposes the tools published by one connected MCP server. The default policy applies to every tool in the group that carries no entry of its own, so a default of always_allow means those tools run without a confirmation step.","is_private":true,"provider":"go.mondoo.com/mql/providers/claude","is_implicit_resource":true},"toolsets":{"name":"toolsets","type":"\u0019\u001bclaude.agent.toolset","is_mandatory":true,"title":"Toolsets available to the agent","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/providers/claude"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Object type","provider":"go.mondoo.com/mql/providers/claude"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/claude"},"version":{"name":"version","type":"\u0005","is_mandatory":true,"title":"Agent version number","provider":"go.mondoo.com/mql/providers/claude"}},"title":"Claude managed agent","desc":"Managed agent definition created through the Beta Agents API and executed within sessions. Auditing an agent surfaces the model it runs on, its system prompt, and its version and archival state, which together govern the instructions in effect for every session that uses it. It also surfaces what the agent is permitted to do: the toolsets it can call and the permission policy on each tool, the MCP servers it reaches out to, the skills it loads, and the roster of other agents it may spawn.","min_provider_version":"13.0.0","defaults":"id name","provider":"go.mondoo.com/mql/providers/claude"},"claude.agent.customTool":{"id":"claude.agent.customTool","name":"claude.agent.customTool","fields":{"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Tool description","provider":"go.mondoo.com/mql/providers/claude"},"inputSchema":{"name":"inputSchema","type":"\n","is_mandatory":true,"title":"JSON Schema for the tool's input parameters","provider":"go.mondoo.com/mql/providers/claude"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Tool name","provider":"go.mondoo.com/mql/providers/claude"}},"title":"Custom tool defined on a Claude agent","desc":"Tool declared inline on an agent rather than supplied by a built-in toolset or an MCP server. The description is the text the model reads when deciding whether to call it, and the input schema states the parameters it accepts.","private":true,"min_provider_version":"13.0.13","defaults":"name","provider":"go.mondoo.com/mql/providers/claude"},"claude.agent.skill":{"id":"claude.agent.skill","name":"claude.agent.skill","fields":{"skill":{"name":"skill","type":"\u001bclaude.skill","title":"Skill attached to the agent","provider":"go.mondoo.com/mql/providers/claude"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Skill source","desc":"One of anthropic or custom.","provider":"go.mondoo.com/mql/providers/claude"},"version":{"name":"version","type":"\u0007","is_mandatory":true,"title":"Pinned skill version","provider":"go.mondoo.com/mql/providers/claude"}},"title":"Skill attached to a Claude agent","desc":"Version-pinned skill an agent loads at runtime, extending it with reusable instructions. The source separates Anthropic-provided skills from custom ones authored inside the organization, which is the line between vendor-reviewed instructions and instructions anyone with skill-write access can change under a running agent.","private":true,"min_provider_version":"13.0.13","defaults":"source version","provider":"go.mondoo.com/mql/providers/claude"},"claude.agent.toolset":{"id":"claude.agent.toolset","name":"claude.agent.toolset","fields":{"defaultEnabled":{"name":"defaultEnabled","type":"\u0004","is_mandatory":true,"title":"Whether tools without an entry of their own are enabled","provider":"go.mondoo.com/mql/providers/claude"},"defaultPermissionPolicy":{"name":"defaultPermissionPolicy","type":"\u0007","is_mandatory":true,"title":"Permission policy for tools without an entry of their own","desc":"One of always_allow or always_ask.","provider":"go.mondoo.com/mql/providers/claude"},"mcpServerName":{"name":"mcpServerName","type":"\u0007","is_mandatory":true,"title":"MCP server supplying the tools","desc":"Empty for built-in toolsets.","provider":"go.mondoo.com/mql/providers/claude"},"tool":{"name":"tool","type":"\u001bclaude.agent.toolset.tool","title":"Tool configured on a Claude agent toolset","desc":"Single tool carrying its own enablement and permission policy, which override the toolset default. For a built-in toolset the name is one of bash, edit, read, write, glob, grep, web_fetch, or web_search. For an MCP toolset it is a tool name published by the connected server.","is_private":true,"provider":"go.mondoo.com/mql/providers/claude","is_implicit_resource":true},"tools":{"name":"tools","type":"\u0019\u001bclaude.agent.toolset.tool","is_mandatory":true,"title":"Tools configured individually within the toolset","provider":"go.mondoo.com/mql/providers/claude"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Toolset type","desc":"One of agent_toolset_20260401 or mcp_toolset.","provider":"go.mondoo.com/mql/providers/claude"}},"title":"Toolset available to a Claude agent","desc":"Group of tools an agent can call, together with the permission policy governing them. A built-in toolset covers the agent's own capabilities such as shell, file, and web access, while an MCP toolset exposes the tools published by one connected MCP server. The default policy applies to every tool in the group that carries no entry of its own, so a default of always_allow means those tools run without a confirmation step.","private":true,"min_provider_version":"13.0.13","defaults":"type defaultPermissionPolicy","provider":"go.mondoo.com/mql/providers/claude"},"claude.agent.toolset.tool":{"id":"claude.agent.toolset.tool","name":"claude.agent.toolset.tool","fields":{"enabled":{"name":"enabled","type":"\u0004","is_mandatory":true,"title":"Whether the tool is enabled","provider":"go.mondoo.com/mql/providers/claude"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Tool name","provider":"go.mondoo.com/mql/providers/claude"},"permissionPolicy":{"name":"permissionPolicy","type":"\u0007","is_mandatory":true,"title":"Permission policy for tool execution","desc":"One of always_allow or always_ask.","provider":"go.mondoo.com/mql/providers/claude"}},"title":"Tool configured on a Claude agent toolset","desc":"Single tool carrying its own enablement and permission policy, which override the toolset default. For a built-in toolset the name is one of bash, edit, read, write, glob, grep, web_fetch, or web_search. For an MCP toolset it is a tool name published by the connected server.","private":true,"min_provider_version":"13.0.13","defaults":"name enabled permissionPolicy","provider":"go.mondoo.com/mql/providers/claude"},"claude.environment":{"id":"claude.environment","name":"claude.environment","fields":{"allowMcpServers":{"name":"allowMcpServers","type":"\u0004","is_mandatory":true,"title":"Whether MCP servers are reachable under a limited network policy","desc":"Null when the network policy is unrestricted.","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/providers/claude"},"allowPackageManagers":{"name":"allowPackageManagers","type":"\u0004","is_mandatory":true,"title":"Whether package registries are reachable under a limited network policy","desc":"Null when the network policy is unrestricted.","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/providers/claude"},"allowedHosts":{"name":"allowedHosts","type":"\u0019\u0007","is_mandatory":true,"title":"Hosts reachable from the environment","desc":"The allowlist in force under a limited network policy. Empty when the policy is unrestricted, where no allowlist applies.","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/providers/claude"},"aptPackages":{"name":"aptPackages","type":"\u0019\u0007","is_mandatory":true,"title":"Ubuntu and Debian packages installed in the environment","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/providers/claude"},"archivedAt":{"name":"archivedAt","type":"\t","is_mandatory":true,"title":"Archive timestamp, if applicable","provider":"go.mondoo.com/mql/providers/claude"},"cargoPackages":{"name":"cargoPackages","type":"\u0019\u0007","is_mandatory":true,"title":"Rust packages installed in the environment","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/providers/claude"},"configType":{"name":"configType","type":"\u0007","is_mandatory":true,"title":"Environment configuration type","desc":"One of cloud or self_hosted.","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/providers/claude"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/claude"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Environment description","provider":"go.mondoo.com/mql/providers/claude"},"gemPackages":{"name":"gemPackages","type":"\u0019\u0007","is_mandatory":true,"title":"Ruby packages installed in the environment","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/providers/claude"},"goPackages":{"name":"goPackages","type":"\u0019\u0007","is_mandatory":true,"title":"Go packages installed in the environment","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/providers/claude"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Environment identifier","provider":"go.mondoo.com/mql/providers/claude"},"metadata":{"name":"metadata","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"User-provided metadata key-value pairs","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/providers/claude"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Environment name","provider":"go.mondoo.com/mql/providers/claude"},"networkingType":{"name":"networkingType","type":"\u0007","is_mandatory":true,"title":"Network policy","desc":"One of unrestricted or limited. An unrestricted environment can reach any host from an agent session, so nothing constrains where data goes once an agent is running in it.","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/providers/claude"},"npmPackages":{"name":"npmPackages","type":"\u0019\u0007","is_mandatory":true,"title":"Node.js packages installed in the environment","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/providers/claude"},"pipPackages":{"name":"pipPackages","type":"\u0019\u0007","is_mandatory":true,"title":"Python packages installed in the environment","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/providers/claude"},"scope":{"name":"scope","type":"\u0007","is_mandatory":true,"title":"Visibility scope","desc":"One of organization or account.","provider":"go.mondoo.com/mql/providers/claude"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Object type","provider":"go.mondoo.com/mql/providers/claude"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/claude"}},"title":"Claude execution environment","desc":"Execution environment that defines the compute context and visibility scope in which agent sessions run. Audit environments to see where agents execute and how broadly they are exposed. The `scope` field is one of organization or account, distinguishing an environment shared across the whole organization from one confined to a single account. The network policy states which hosts a session can reach from inside the environment, and the package fields list what is installed in the sandbox the agent runs in.","min_provider_version":"13.0.0","defaults":"id name","provider":"go.mondoo.com/mql/providers/claude"},"claude.file":{"id":"claude.file","name":"claude.file","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Upload timestamp","provider":"go.mondoo.com/mql/providers/claude"},"downloadable":{"name":"downloadable","type":"\u0004","is_mandatory":true,"title":"Whether the file can be downloaded","provider":"go.mondoo.com/mql/providers/claude"},"filename":{"name":"filename","type":"\u0007","is_mandatory":true,"title":"Original filename","provider":"go.mondoo.com/mql/providers/claude"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"File identifier","provider":"go.mondoo.com/mql/providers/claude"},"mimeType":{"name":"mimeType","type":"\u0007","is_mandatory":true,"title":"MIME type","provider":"go.mondoo.com/mql/providers/claude"},"sizeBytes":{"name":"sizeBytes","type":"\u0005","is_mandatory":true,"title":"File size in bytes","provider":"go.mondoo.com/mql/providers/claude"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Object type","provider":"go.mondoo.com/mql/providers/claude"}},"title":"Claude uploaded file","desc":"File uploaded to the Claude platform and managed through the Beta Files API, exposing its original filename, MIME type, size in bytes, and whether it can be downloaded, along with its upload timestamp. Useful for inventorying which files are available to agents and auditing their download exposure.","min_provider_version":"13.0.0","defaults":"id filename","provider":"go.mondoo.com/mql/providers/claude"},"claude.memoryStore":{"id":"claude.memoryStore","name":"claude.memoryStore","fields":{"archivedAt":{"name":"archivedAt","type":"\t","is_mandatory":true,"title":"Archive timestamp, if applicable","provider":"go.mondoo.com/mql/providers/claude"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/claude"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Memory store description","provider":"go.mondoo.com/mql/providers/claude"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Memory store identifier","provider":"go.mondoo.com/mql/providers/claude"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Memory store name","provider":"go.mondoo.com/mql/providers/claude"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Object type","provider":"go.mondoo.com/mql/providers/claude"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/claude"}},"title":"Claude memory store","desc":"Memory store used to persist context across agent sessions. Memory stores are mounted under `/mnt/memory/` in the agent environment, and their description is included in the system prompt, so their name, description, and archival state are worth auditing to understand what long-lived context agents can read and write.","min_provider_version":"13.0.0","defaults":"id name","provider":"go.mondoo.com/mql/providers/claude"},"claude.messageBatch":{"id":"claude.messageBatch","name":"claude.messageBatch","fields":{"archivedAt":{"name":"archivedAt","type":"\t","is_mandatory":true,"title":"Archive timestamp, if applicable","provider":"go.mondoo.com/mql/providers/claude"},"cancelInitiatedAt":{"name":"cancelInitiatedAt","type":"\t","is_mandatory":true,"title":"Cancellation initiation timestamp, if applicable","provider":"go.mondoo.com/mql/providers/claude"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Batch creation timestamp","provider":"go.mondoo.com/mql/providers/claude"},"endedAt":{"name":"endedAt","type":"\t","is_mandatory":true,"title":"Processing end timestamp, if applicable","provider":"go.mondoo.com/mql/providers/claude"},"expiresAt":{"name":"expiresAt","type":"\t","is_mandatory":true,"title":"Batch expiration timestamp","provider":"go.mondoo.com/mql/providers/claude"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Batch identifier","provider":"go.mondoo.com/mql/providers/claude"},"processingStatus":{"name":"processingStatus","type":"\u0007","is_mandatory":true,"title":"Processing status","desc":"One of in_progress, canceling, or ended.","provider":"go.mondoo.com/mql/providers/claude"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Object type","provider":"go.mondoo.com/mql/providers/claude"}},"title":"Claude message batch","desc":"Message batch job that submits multiple message requests for asynchronous processing, exposing its processing status and lifecycle timestamps (creation, expiration, end, cancellation, and archival). Useful for auditing in-flight and completed batch workloads and their retention. The `processingStatus` field is one of in_progress, canceling, or ended.","min_provider_version":"13.0.0","defaults":"id processingStatus","provider":"go.mondoo.com/mql/providers/claude"},"claude.model":{"id":"claude.model","name":"claude.model","fields":{"batchSupported":{"name":"batchSupported","type":"\u0004","is_mandatory":true,"title":"Whether batch processing is supported","provider":"go.mondoo.com/mql/providers/claude"},"citationsSupported":{"name":"citationsSupported","type":"\u0004","is_mandatory":true,"title":"Whether citation extraction is supported","provider":"go.mondoo.com/mql/providers/claude"},"codeExecutionSupported":{"name":"codeExecutionSupported","type":"\u0004","is_mandatory":true,"title":"Whether code execution is supported","provider":"go.mondoo.com/mql/providers/claude"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Model creation timestamp","provider":"go.mondoo.com/mql/providers/claude"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Human-readable display name","provider":"go.mondoo.com/mql/providers/claude"},"family":{"name":"family","type":"\u0007","is_mandatory":true,"title":"Model family","desc":"Parsed from the model identifier, for example opus, sonnet, or haiku.","provider":"go.mondoo.com/mql/providers/claude"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Canonical model identifier","provider":"go.mondoo.com/mql/providers/claude"},"imageInputSupported":{"name":"imageInputSupported","type":"\u0004","is_mandatory":true,"title":"Whether image input is supported","provider":"go.mondoo.com/mql/providers/claude"},"maxInputTokens":{"name":"maxInputTokens","type":"\u0005","is_mandatory":true,"title":"Maximum input context window size in tokens","provider":"go.mondoo.com/mql/providers/claude"},"maxTokens":{"name":"maxTokens","type":"\u0005","is_mandatory":true,"title":"Maximum output tokens","provider":"go.mondoo.com/mql/providers/claude"},"pdfInputSupported":{"name":"pdfInputSupported","type":"\u0004","is_mandatory":true,"title":"Whether PDF input is supported","provider":"go.mondoo.com/mql/providers/claude"},"structuredOutputsSupported":{"name":"structuredOutputsSupported","type":"\u0004","is_mandatory":true,"title":"Whether structured output is supported","provider":"go.mondoo.com/mql/providers/claude"},"thinkingSupported":{"name":"thinkingSupported","type":"\u0004","is_mandatory":true,"title":"Whether extended thinking is supported","provider":"go.mondoo.com/mql/providers/claude"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Object type","desc":"Always \"model\" for Claude model resources.","provider":"go.mondoo.com/mql/providers/claude"},"vendor":{"name":"vendor","type":"\u0007","is_mandatory":true,"title":"Model vendor","desc":"Always \"Anthropic\" for models served through the Claude API.","provider":"go.mondoo.com/mql/providers/claude"}},"init":{"args":[{"name":"id","type":"\u0007"}]},"title":"Claude AI model","desc":"AI model available through the Claude API, including its token limits and capability flags. The `id` field is the canonical model identifier (for example `claude-opus-4-6`) and serves as the selection key for `claude.model(id: \"claude-opus-4-6\")`.","min_provider_version":"13.0.0","defaults":"id displayName","provider":"go.mondoo.com/mql/providers/claude"},"claude.organization":{"id":"claude.organization","name":"claude.organization","fields":{"activities":{"name":"activities","type":"\u0019\u001bclaude.organization.activity","title":"Compliance activity log entries","provider":"go.mondoo.com/mql/providers/claude"},"activity":{"name":"activity","type":"\u001bclaude.organization.activity","title":"Claude organization compliance activity","desc":"Entry from the Claude compliance activity feed. The activity feed captures security-relevant events such as logins, permission changes, API key operations, and workspace modifications. Requires either a Compliance Access Key or an Admin API key.","provider":"go.mondoo.com/mql/providers/claude","is_implicit_resource":true},"apiKey":{"name":"apiKey","type":"\u001bclaude.organization.apiKey","title":"Claude organization API key","desc":"API key in the Claude organization, including its status, associated workspace, and creation metadata. The `status` field is one of active, inactive, archived, or expired.","provider":"go.mondoo.com/mql/providers/claude","is_implicit_resource":true},"apiKeys":{"name":"apiKeys","type":"\u0019\u001bclaude.organization.apiKey","title":"API keys in the organization","provider":"go.mondoo.com/mql/providers/claude"},"costEntry":{"name":"costEntry","type":"\u001bclaude.organization.costEntry","title":"Claude organization cost report bucket","desc":"Daily cost bucket from the Admin API cost report. Each bucket covers a time window with cost amounts broken down by workspace and cost type.","provider":"go.mondoo.com/mql/providers/claude","is_implicit_resource":true},"costReport":{"name":"costReport","type":"\u0019\u001bclaude.organization.costEntry","title":"Cost report entries","provider":"go.mondoo.com/mql/providers/claude"},"federationIssuer":{"name":"federationIssuer","type":"\u001bclaude.organization.federationIssuer","title":"Claude workload identity federation issuer","desc":"External token issuer the organization trusts to authenticate workloads, so that code running outside Claude can obtain credentials without a long-lived API key. The issuer is the trust anchor: `issuerUrl` names whose tokens are accepted, `maxJwtLifetimeSeconds` caps how long one of those tokens stays valid, and `checkJti` reports whether replayed tokens are rejected. `archivedAt` separates a retired trust anchor from one still in force. The rules deciding what an accepted token may reach are reached through `rules`.","provider":"go.mondoo.com/mql/providers/claude","is_implicit_resource":true},"federationIssuers":{"name":"federationIssuers","type":"\u0019\u001bclaude.organization.federationIssuer","title":"Workload identity federation issuers the organization trusts","min_provider_version":"13.1.3","provider":"go.mondoo.com/mql/providers/claude"},"federationRule":{"name":"federationRule","type":"\u001bclaude.organization.federationRule","title":"Claude workload identity federation rule","desc":"Rule deciding which federated identities from a trusted issuer receive access, and what that access reaches. This is where an external workload becomes a principal inside the organization, so a rule that matches too broadly is a standing grant to anyone who can obtain a matching token. Read `matchSubjectPrefix`, `matchAudience`, `matchClaims` and `matchCondition` together to see how narrowly the rule matches, and `appliesToAllWorkspaces` with `workspaces` to see how far the resulting access reaches.","provider":"go.mondoo.com/mql/providers/claude","is_implicit_resource":true},"federationRules":{"name":"federationRules","type":"\u0019\u001bclaude.organization.federationRule","title":"Rules mapping federated identities onto organization access","min_provider_version":"13.1.3","provider":"go.mondoo.com/mql/providers/claude"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Organization identifier","provider":"go.mondoo.com/mql/providers/claude"},"invite":{"name":"invite","type":"\u001bclaude.organization.invite","title":"Claude organization invite","desc":"Pending invitation to the Claude organization. The `status` field is one of pending, accepted, expired, or deleted.","provider":"go.mondoo.com/mql/providers/claude","is_implicit_resource":true},"invites":{"name":"invites","type":"\u0019\u001bclaude.organization.invite","title":"Pending invitations","provider":"go.mondoo.com/mql/providers/claude"},"member":{"name":"member","type":"\u001bclaude.organization.member","title":"Claude organization member","desc":"Member of the Claude organization, including their role assignment. The `role` field is one of user, developer, billing, admin, or claude_code_user.","provider":"go.mondoo.com/mql/providers/claude","is_implicit_resource":true},"members":{"name":"members","type":"\u0019\u001bclaude.organization.member","title":"Organization members","provider":"go.mondoo.com/mql/providers/claude"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Organization display name","provider":"go.mondoo.com/mql/providers/claude"},"rateLimit":{"name":"rateLimit","type":"\u001bclaude.organization.rateLimit","title":"Claude organization rate limit group","desc":"Organization-level or workspace-level rate limit group. Each group covers a category of API usage such as model_group, batch, web_search, or files, and lists the models it applies to along with per-minute request and token limits.","provider":"go.mondoo.com/mql/providers/claude","is_implicit_resource":true},"rateLimits":{"name":"rateLimits","type":"\u0019\u001bclaude.organization.rateLimit","title":"Organization-level rate limits","provider":"go.mondoo.com/mql/providers/claude"},"serviceAccount":{"name":"serviceAccount","type":"\u001bclaude.organization.serviceAccount","title":"Claude organization service account","desc":"Non-human principal in the Claude organization, holding its own API keys and its own organization role. A service account is standing, unattended access: it does not expire with a person leaving, so its role and its archive state are worth auditing directly. Read `organizationRole` to see how much the account can reach and `archivedAt` to tell a retired account from a live one, and reach its keys through claude.organization.apiKey where principalServiceAccount names this account.","provider":"go.mondoo.com/mql/providers/claude","is_implicit_resource":true},"serviceAccounts":{"name":"serviceAccounts","type":"\u0019\u001bclaude.organization.serviceAccount","title":"Service accounts in the organization","min_provider_version":"13.1.3","provider":"go.mondoo.com/mql/providers/claude"},"usageEntry":{"name":"usageEntry","type":"\u001bclaude.organization.usageEntry","title":"Claude organization usage report bucket","desc":"Daily usage bucket from the Admin API usage report. Each bucket covers a time window and contains per-model, per-workspace token consumption breakdowns for the last seven days.","provider":"go.mondoo.com/mql/providers/claude","is_implicit_resource":true},"usageReport":{"name":"usageReport","type":"\u0019\u001bclaude.organization.usageEntry","title":"Token usage report entries","provider":"go.mondoo.com/mql/providers/claude"},"workspace":{"name":"workspace","type":"\u001bclaude.organization.workspace","title":"Claude organization workspace","desc":"Workspace within the Claude organization, including its name, display color, creation date, archive status, data residency configuration, and workspace-level members and rate limits.","provider":"go.mondoo.com/mql/providers/claude","is_implicit_resource":true},"workspaces":{"name":"workspaces","type":"\u0019\u001bclaude.organization.workspace","title":"Workspaces in the organization","provider":"go.mondoo.com/mql/providers/claude"}},"title":"Claude organization","desc":"Organizational resources managed through the Claude Admin API: identity, workspaces, members, pending invites, API keys, usage, cost, and rate limits. Requires an admin API key configured via `--admin-token` or the `ANTHROPIC_ADMIN_API_KEY` environment variable.","min_provider_version":"13.0.0","defaults":"id name","provider":"go.mondoo.com/mql/providers/claude"},"claude.organization.activity":{"id":"claude.organization.activity","name":"claude.organization.activity","fields":{"actorEmail":{"name":"actorEmail","type":"\u0007","is_mandatory":true,"title":"Actor email address","provider":"go.mondoo.com/mql/providers/claude"},"actorId":{"name":"actorId","type":"\u0007","is_mandatory":true,"title":"Actor identifier","provider":"go.mondoo.com/mql/providers/claude"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Timestamp when the activity was created","provider":"go.mondoo.com/mql/providers/claude"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Activity event identifier","provider":"go.mondoo.com/mql/providers/claude"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Event type","desc":"For example claude_chat_created, claude_file_uploaded, or organization.user.added.","provider":"go.mondoo.com/mql/providers/claude"}},"title":"Claude organization compliance activity","desc":"Entry from the Claude compliance activity feed. The activity feed captures security-relevant events such as logins, permission changes, API key operations, and workspace modifications. Requires either a Compliance Access Key or an Admin API key.","min_provider_version":"13.0.0","defaults":"id type actorEmail","provider":"go.mondoo.com/mql/providers/claude"},"claude.organization.apiKey":{"id":"claude.organization.apiKey","name":"claude.organization.apiKey","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Timestamp when the key was created","provider":"go.mondoo.com/mql/providers/claude"},"createdBy":{"name":"createdBy","type":"\u001bclaude.organization.member","title":"User who created this key","provider":"go.mondoo.com/mql/providers/claude"},"expiresAt":{"name":"expiresAt","type":"\t","is_mandatory":true,"title":"Timestamp when the key expires, if applicable","provider":"go.mondoo.com/mql/providers/claude"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"API key identifier","provider":"go.mondoo.com/mql/providers/claude"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"API key display name","provider":"go.mondoo.com/mql/providers/claude"},"partialKeyHint":{"name":"partialKeyHint","type":"\u0007","is_mandatory":true,"title":"Partial key hint for identification","provider":"go.mondoo.com/mql/providers/claude"},"principalServiceAccount":{"name":"principalServiceAccount","type":"\u001bclaude.organization.serviceAccount","title":"Service account the key acts as, when it is bound to one","min_provider_version":"13.1.3","provider":"go.mondoo.com/mql/providers/claude"},"principalType":{"name":"principalType","type":"\u0007","is_mandatory":true,"title":"Kind of principal the key acts as","desc":"One of user_actor when the key acts as an organization member, or service_account_actor when it acts as a service account. Null when the key is bound to no principal at all, which covers legacy keys and keys minted through workload identity federation.","min_provider_version":"13.1.3","provider":"go.mondoo.com/mql/providers/claude"},"principalUser":{"name":"principalUser","type":"\u001bclaude.organization.member","title":"Organization member the key acts as, when it is bound to one","min_provider_version":"13.1.3","provider":"go.mondoo.com/mql/providers/claude"},"scopeType":{"name":"scopeType","type":"\u0007","is_mandatory":true,"title":"Extent of the key's access","desc":"One of workspace when the key is confined to a single workspace, or organization when it is a principal-bound key with no workspace and so reaches the whole organization. An organization-scoped key is the broader credential of the two.","min_provider_version":"13.1.3","provider":"go.mondoo.com/mql/providers/claude"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"API key status","desc":"One of active, inactive, archived, or expired.","provider":"go.mondoo.com/mql/providers/claude"},"workspace":{"name":"workspace","type":"\u001bclaude.organization.workspace","title":"Workspace this key belongs to","provider":"go.mondoo.com/mql/providers/claude"}},"title":"Claude organization API key","desc":"API key in the Claude organization, including its status, associated workspace, and creation metadata. The `status` field is one of active, inactive, archived, or expired.","min_provider_version":"13.0.0","defaults":"id name status","provider":"go.mondoo.com/mql/providers/claude"},"claude.organization.costEntry":{"id":"claude.organization.costEntry","name":"claude.organization.costEntry","fields":{"amount":{"name":"amount","type":"\u0007","is_mandatory":true,"title":"Cost amount","desc":"Decimal string of the cost in the units given by the `currency` field (for example USD).","provider":"go.mondoo.com/mql/providers/claude"},"costType":{"name":"costType","type":"\u0007","is_mandatory":true,"title":"Cost type","desc":"One of tokens, web_search, code_execution, or session_usage.","provider":"go.mondoo.com/mql/providers/claude"},"currency":{"name":"currency","type":"\u0007","is_mandatory":true,"title":"Currency code","provider":"go.mondoo.com/mql/providers/claude"},"endingAt":{"name":"endingAt","type":"\t","is_mandatory":true,"title":"Bucket end timestamp","provider":"go.mondoo.com/mql/providers/claude"},"model":{"name":"model","type":"\u0007","is_mandatory":true,"title":"Model identifier","provider":"go.mondoo.com/mql/providers/claude"},"startingAt":{"name":"startingAt","type":"\t","is_mandatory":true,"title":"Bucket start timestamp","provider":"go.mondoo.com/mql/providers/claude"},"workspace":{"name":"workspace","type":"\u001bclaude.organization.workspace","title":"Workspace the cost is attributed to","desc":"Null for buckets that are not scoped to a single workspace.","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/providers/claude"}},"title":"Claude organization cost report bucket","desc":"Daily cost bucket from the Admin API cost report. Each bucket covers a time window with cost amounts broken down by workspace and cost type.","min_provider_version":"13.0.0","defaults":"startingAt costType","provider":"go.mondoo.com/mql/providers/claude"},"claude.organization.federationIssuer":{"id":"claude.organization.federationIssuer","name":"claude.organization.federationIssuer","fields":{"archivedAt":{"name":"archivedAt","type":"\t","is_mandatory":true,"title":"Timestamp when the issuer was archived","desc":"Null while the issuer is trusted. An archived issuer no longer authenticates workloads.","provider":"go.mondoo.com/mql/providers/claude"},"checkJti":{"name":"checkJti","type":"\u0004","is_mandatory":true,"title":"Whether the JWT ID is checked so replayed tokens are rejected","provider":"go.mondoo.com/mql/providers/claude"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Timestamp when the issuer was registered","provider":"go.mondoo.com/mql/providers/claude"},"createdByActorId":{"name":"createdByActorId","type":"\u0007","is_mandatory":true,"title":"Tagged identifier of the actor that registered the issuer","desc":"Prefixed user_ or svac_.","provider":"go.mondoo.com/mql/providers/claude"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Issuer identifier","provider":"go.mondoo.com/mql/providers/claude"},"issuerUrl":{"name":"issuerUrl","type":"\u0007","is_mandatory":true,"title":"URL of the external token issuer","desc":"A token is accepted only when its iss claim matches this URL, so this names exactly whose identities the organization trusts.","provider":"go.mondoo.com/mql/providers/claude"},"jwks":{"name":"jwks","type":"\n","is_mandatory":true,"title":"Key material configuration for the issuer","desc":"Either a discovery URL the organization polls, or keys supplied inline.","provider":"go.mondoo.com/mql/providers/claude"},"jwksPollingDisabledAt":{"name":"jwksPollingDisabledAt","type":"\t","is_mandatory":true,"title":"Timestamp when JWKS polling was switched off","desc":"Null while polling is active. With polling off, the organization stops picking up the issuer's key rotations.","provider":"go.mondoo.com/mql/providers/claude"},"maxJwtLifetimeSeconds":{"name":"maxJwtLifetimeSeconds","type":"\u0005","is_mandatory":true,"title":"Longest lifetime, in seconds, accepted on a token from this issuer","desc":"A token presented more than this many seconds after it was issued is rejected regardless of its own expiry claim.","provider":"go.mondoo.com/mql/providers/claude"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Issuer display name","provider":"go.mondoo.com/mql/providers/claude"},"pollStatus":{"name":"pollStatus","type":"\n","is_mandatory":true,"title":"Result of the most recent attempt to fetch the issuer's keys","desc":"Keys include `status` and the timestamps of the last attempt, so a trust anchor whose key fetch has been failing is visible here.","provider":"go.mondoo.com/mql/providers/claude"},"rules":{"name":"rules","type":"\u0019\u001bclaude.organization.federationRule","title":"Rules that accept tokens from this issuer","provider":"go.mondoo.com/mql/providers/claude"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Timestamp when the issuer was last updated","provider":"go.mondoo.com/mql/providers/claude"}},"title":"Claude workload identity federation issuer","desc":"External token issuer the organization trusts to authenticate workloads, so that code running outside Claude can obtain credentials without a long-lived API key. The issuer is the trust anchor: `issuerUrl` names whose tokens are accepted, `maxJwtLifetimeSeconds` caps how long one of those tokens stays valid, and `checkJti` reports whether replayed tokens are rejected. `archivedAt` separates a retired trust anchor from one still in force. The rules deciding what an accepted token may reach are reached through `rules`.","min_provider_version":"13.1.3","defaults":"id name issuerUrl","provider":"go.mondoo.com/mql/providers/claude"},"claude.organization.federationRule":{"id":"claude.organization.federationRule","name":"claude.organization.federationRule","fields":{"appliesToAllWorkspaces":{"name":"appliesToAllWorkspaces","type":"\u0004","is_mandatory":true,"title":"Whether the rule grants access to every workspace","desc":"True makes the rule organization-wide, so `workspaces` does not bound it and a new workspace is covered as soon as it is created.","provider":"go.mondoo.com/mql/providers/claude"},"archivedAt":{"name":"archivedAt","type":"\t","is_mandatory":true,"title":"Timestamp when the rule was archived","desc":"Null while the rule is in force. An archived rule no longer grants access.","provider":"go.mondoo.com/mql/providers/claude"},"attributes":{"name":"attributes","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Attributes recorded on the rule","provider":"go.mondoo.com/mql/providers/claude"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Timestamp when the rule was created","provider":"go.mondoo.com/mql/providers/claude"},"createdByActorId":{"name":"createdByActorId","type":"\u0007","is_mandatory":true,"title":"Tagged identifier of the actor that created the rule","desc":"Prefixed user_ or svac_.","provider":"go.mondoo.com/mql/providers/claude"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description recorded on the rule","provider":"go.mondoo.com/mql/providers/claude"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Rule identifier","provider":"go.mondoo.com/mql/providers/claude"},"issuer":{"name":"issuer","type":"\u001bclaude.organization.federationIssuer","title":"Issuer whose tokens this rule accepts","provider":"go.mondoo.com/mql/providers/claude"},"matchAudience":{"name":"matchAudience","type":"\u0007","is_mandatory":true,"title":"Audience a token must carry to match","desc":"Null when the rule does not constrain the aud claim, which widens the rule to tokens minted for any audience.","provider":"go.mondoo.com/mql/providers/claude"},"matchClaims":{"name":"matchClaims","type":"\u001a\u0007\u0007","is_mandatory":true,"title":"Claims a token must carry, as claim name to required value","desc":"Empty when the rule matches on no claims beyond the subject and the audience.","provider":"go.mondoo.com/mql/providers/claude"},"matchCondition":{"name":"matchCondition","type":"\u0007","is_mandatory":true,"title":"Additional expression a token must satisfy to match","desc":"Null when the rule carries no extra condition.","provider":"go.mondoo.com/mql/providers/claude"},"matchSubjectPrefix":{"name":"matchSubjectPrefix","type":"\u0007","is_mandatory":true,"title":"Prefix a token's subject must start with to match","desc":"Null when the rule does not constrain the sub claim. A short or absent prefix matches many more identities than a full subject.","provider":"go.mondoo.com/mql/providers/claude"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Rule display name","provider":"go.mondoo.com/mql/providers/claude"},"oauthScope":{"name":"oauthScope","type":"\u0007","is_mandatory":true,"title":"OAuth scope granted to a matching identity","provider":"go.mondoo.com/mql/providers/claude"},"serviceAccount":{"name":"serviceAccount","type":"\u001bclaude.organization.serviceAccount","title":"Service account a matching identity acts as","provider":"go.mondoo.com/mql/providers/claude"},"tokenLifetimeSeconds":{"name":"tokenLifetimeSeconds","type":"\u0005","is_mandatory":true,"title":"Lifetime, in seconds, of the credential issued to a matching identity","provider":"go.mondoo.com/mql/providers/claude"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Timestamp when the rule was last updated","provider":"go.mondoo.com/mql/providers/claude"},"workspaces":{"name":"workspaces","type":"\u0019\u001bclaude.organization.workspace","title":"Workspaces the rule grants access to","desc":"Empty when appliesToAllWorkspaces is true, in which case the rule is not confined to a workspace list.","provider":"go.mondoo.com/mql/providers/claude"}},"title":"Claude workload identity federation rule","desc":"Rule deciding which federated identities from a trusted issuer receive access, and what that access reaches. This is where an external workload becomes a principal inside the organization, so a rule that matches too broadly is a standing grant to anyone who can obtain a matching token. Read `matchSubjectPrefix`, `matchAudience`, `matchClaims` and `matchCondition` together to see how narrowly the rule matches, and `appliesToAllWorkspaces` with `workspaces` to see how far the resulting access reaches.","min_provider_version":"13.1.3","defaults":"id name","provider":"go.mondoo.com/mql/providers/claude"},"claude.organization.invite":{"id":"claude.organization.invite","name":"claude.organization.invite","fields":{"email":{"name":"email","type":"\u0007","is_mandatory":true,"title":"Invitee email address","provider":"go.mondoo.com/mql/providers/claude"},"expiresAt":{"name":"expiresAt","type":"\t","is_mandatory":true,"title":"Timestamp when the invite expires","provider":"go.mondoo.com/mql/providers/claude"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Invite identifier","provider":"go.mondoo.com/mql/providers/claude"},"invitedAt":{"name":"invitedAt","type":"\t","is_mandatory":true,"title":"Timestamp when the invite was sent","provider":"go.mondoo.com/mql/providers/claude"},"role":{"name":"role","type":"\u0007","is_mandatory":true,"title":"Assigned role","desc":"One of user, developer, billing, admin, or claude_code_user.","provider":"go.mondoo.com/mql/providers/claude"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Invite status","desc":"One of pending, accepted, expired, or deleted.","provider":"go.mondoo.com/mql/providers/claude"}},"title":"Claude organization invite","desc":"Pending invitation to the Claude organization. The `status` field is one of pending, accepted, expired, or deleted.","min_provider_version":"13.0.0","defaults":"id email role status","provider":"go.mondoo.com/mql/providers/claude"},"claude.organization.member":{"id":"claude.organization.member","name":"claude.organization.member","fields":{"addedAt":{"name":"addedAt","type":"\t","is_mandatory":true,"title":"Timestamp when the user was added to the organization","provider":"go.mondoo.com/mql/providers/claude"},"email":{"name":"email","type":"\u0007","is_mandatory":true,"title":"User email address","provider":"go.mondoo.com/mql/providers/claude"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"User identifier","provider":"go.mondoo.com/mql/providers/claude"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"User display name","provider":"go.mondoo.com/mql/providers/claude"},"role":{"name":"role","type":"\u0007","is_mandatory":true,"title":"Organization role","desc":"One of user, developer, billing, admin, or claude_code_user.","provider":"go.mondoo.com/mql/providers/claude"}},"title":"Claude organization member","desc":"Member of the Claude organization, including their role assignment. The `role` field is one of user, developer, billing, admin, or claude_code_user.","min_provider_version":"13.0.0","defaults":"id name email role","provider":"go.mondoo.com/mql/providers/claude"},"claude.organization.rateLimit":{"id":"claude.organization.rateLimit","name":"claude.organization.rateLimit","fields":{"groupType":{"name":"groupType","type":"\u0007","is_mandatory":true,"title":"Rate limit group type","desc":"One of model_group, batch, token_count, files, skills, or web_search.","provider":"go.mondoo.com/mql/providers/claude"},"inputTokensPerMinute":{"name":"inputTokensPerMinute","type":"\u0005","is_mandatory":true,"title":"Maximum input tokens per minute (cache-aware)","provider":"go.mondoo.com/mql/providers/claude"},"models":{"name":"models","type":"\u0019\u0007","is_mandatory":true,"title":"Models covered by this rate limit group","provider":"go.mondoo.com/mql/providers/claude"},"outputTokensPerMinute":{"name":"outputTokensPerMinute","type":"\u0005","is_mandatory":true,"title":"Maximum output tokens per minute","provider":"go.mondoo.com/mql/providers/claude"},"requestsPerMinute":{"name":"requestsPerMinute","type":"\u0005","is_mandatory":true,"title":"Maximum requests per minute","provider":"go.mondoo.com/mql/providers/claude"}},"title":"Claude organization rate limit group","desc":"Organization-level or workspace-level rate limit group. Each group covers a category of API usage such as model_group, batch, web_search, or files, and lists the models it applies to along with per-minute request and token limits.","min_provider_version":"13.0.0","defaults":"groupType","provider":"go.mondoo.com/mql/providers/claude"},"claude.organization.serviceAccount":{"id":"claude.organization.serviceAccount","name":"claude.organization.serviceAccount","fields":{"archivedAt":{"name":"archivedAt","type":"\t","is_mandatory":true,"title":"Timestamp when the service account was archived","desc":"Null while the account is active. An archived account keeps its record but can no longer be used.","provider":"go.mondoo.com/mql/providers/claude"},"archivedByActorId":{"name":"archivedByActorId","type":"\u0007","is_mandatory":true,"title":"Tagged identifier of the actor that archived the account","desc":"Prefixed user_ or svac_. Null while the account is active.","provider":"go.mondoo.com/mql/providers/claude"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Timestamp when the service account was created","provider":"go.mondoo.com/mql/providers/claude"},"createdByActorId":{"name":"createdByActorId","type":"\u0007","is_mandatory":true,"title":"Tagged identifier of the actor that created the account","desc":"Prefixed user_ for an organization member or svac_ for another service account, so an account created by another account is visible as such.","provider":"go.mondoo.com/mql/providers/claude"},"description":{"name":"description","type":"\u0007","is_mandatory":true,"title":"Description recorded on the service account","provider":"go.mondoo.com/mql/providers/claude"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Service account identifier","provider":"go.mondoo.com/mql/providers/claude"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Service account display name","provider":"go.mondoo.com/mql/providers/claude"},"organizationRole":{"name":"organizationRole","type":"\u0007","is_mandatory":true,"title":"Role the service account holds in the organization","desc":"One of admin or developer. An admin service account can administer the organization without a person being involved.","provider":"go.mondoo.com/mql/providers/claude"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Timestamp when the service account was last updated","provider":"go.mondoo.com/mql/providers/claude"},"updatedByActorId":{"name":"updatedByActorId","type":"\u0007","is_mandatory":true,"title":"Tagged identifier of the actor that last updated the account","desc":"Prefixed user_ or svac_. Null when the account has not been updated since it was created.","provider":"go.mondoo.com/mql/providers/claude"}},"title":"Claude organization service account","desc":"Non-human principal in the Claude organization, holding its own API keys and its own organization role. A service account is standing, unattended access: it does not expire with a person leaving, so its role and its archive state are worth auditing directly. Read `organizationRole` to see how much the account can reach and `archivedAt` to tell a retired account from a live one, and reach its keys through claude.organization.apiKey where principalServiceAccount names this account.","min_provider_version":"13.1.3","defaults":"id name organizationRole","provider":"go.mondoo.com/mql/providers/claude"},"claude.organization.usageEntry":{"id":"claude.organization.usageEntry","name":"claude.organization.usageEntry","fields":{"cacheReadInputTokens":{"name":"cacheReadInputTokens","type":"\u0005","is_mandatory":true,"title":"Input tokens read from cache","provider":"go.mondoo.com/mql/providers/claude"},"endingAt":{"name":"endingAt","type":"\t","is_mandatory":true,"title":"Bucket end timestamp","provider":"go.mondoo.com/mql/providers/claude"},"model":{"name":"model","type":"\u0007","is_mandatory":true,"title":"Model identifier","provider":"go.mondoo.com/mql/providers/claude"},"outputTokens":{"name":"outputTokens","type":"\u0005","is_mandatory":true,"title":"Output tokens produced","provider":"go.mondoo.com/mql/providers/claude"},"serviceTier":{"name":"serviceTier","type":"\u0007","is_mandatory":true,"title":"API service tier","desc":"One of standard, batch, priority, flex, or priority_on_demand.","provider":"go.mondoo.com/mql/providers/claude"},"startingAt":{"name":"startingAt","type":"\t","is_mandatory":true,"title":"Bucket start timestamp","provider":"go.mondoo.com/mql/providers/claude"},"uncachedInputTokens":{"name":"uncachedInputTokens","type":"\u0005","is_mandatory":true,"title":"Uncached input tokens consumed","provider":"go.mondoo.com/mql/providers/claude"},"workspace":{"name":"workspace","type":"\u001bclaude.organization.workspace","title":"Workspace the consumption is attributed to","desc":"Null for buckets that are not scoped to a single workspace.","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/providers/claude"}},"title":"Claude organization usage report bucket","desc":"Daily usage bucket from the Admin API usage report. Each bucket covers a time window and contains per-model, per-workspace token consumption breakdowns for the last seven days.","min_provider_version":"13.0.0","defaults":"startingAt","provider":"go.mondoo.com/mql/providers/claude"},"claude.organization.workspace":{"id":"claude.organization.workspace","name":"claude.organization.workspace","fields":{"allowedInferenceGeos":{"name":"allowedInferenceGeos","type":"\u0019\u0007","is_mandatory":true,"title":"Allowed inference geographic regions","provider":"go.mondoo.com/mql/providers/claude"},"archivedAt":{"name":"archivedAt","type":"\t","is_mandatory":true,"title":"Timestamp when the workspace was archived, if applicable","provider":"go.mondoo.com/mql/providers/claude"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Workspace creation timestamp","provider":"go.mondoo.com/mql/providers/claude"},"defaultInferenceGeo":{"name":"defaultInferenceGeo","type":"\u0007","is_mandatory":true,"title":"Default inference geographic region","provider":"go.mondoo.com/mql/providers/claude"},"displayColor":{"name":"displayColor","type":"\u0007","is_mandatory":true,"title":"Hex display color for the console UI","provider":"go.mondoo.com/mql/providers/claude"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Workspace identifier","provider":"go.mondoo.com/mql/providers/claude"},"member":{"name":"member","type":"\u001bclaude.organization.workspace.member","title":"Claude organization workspace member","desc":"Member's access to a specific workspace. The `workspaceRole` field is one of workspace_user, workspace_developer, workspace_restricted_developer, workspace_admin, or workspace_billing.","provider":"go.mondoo.com/mql/providers/claude","is_implicit_resource":true},"members":{"name":"members","type":"\u0019\u001bclaude.organization.workspace.member","title":"Members with access to this workspace","provider":"go.mondoo.com/mql/providers/claude"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Workspace name","provider":"go.mondoo.com/mql/providers/claude"},"rateLimits":{"name":"rateLimits","type":"\u0019\u001bclaude.organization.rateLimit","title":"Workspace-level rate limit overrides","provider":"go.mondoo.com/mql/providers/claude"},"workspaceGeo":{"name":"workspaceGeo","type":"\u0007","is_mandatory":true,"title":"Workspace geographic region","provider":"go.mondoo.com/mql/providers/claude"}},"title":"Claude organization workspace","desc":"Workspace within the Claude organization, including its name, display color, creation date, archive status, data residency configuration, and workspace-level members and rate limits.","min_provider_version":"13.0.0","defaults":"id name","provider":"go.mondoo.com/mql/providers/claude"},"claude.organization.workspace.member":{"id":"claude.organization.workspace.member","name":"claude.organization.workspace.member","fields":{"user":{"name":"user","type":"\u001bclaude.organization.member","title":"Organization member holding this workspace access","desc":"Carries the member's name, email, and organization-level role, so workspace access can be reviewed against who the person is and what they can already do across the organization.","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/providers/claude"},"workspace":{"name":"workspace","type":"\u001bclaude.organization.workspace","title":"Workspace this access grant applies to","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/providers/claude"},"workspaceRole":{"name":"workspaceRole","type":"\u0007","is_mandatory":true,"title":"Workspace-level role","desc":"One of workspace_user, workspace_developer, workspace_restricted_developer, workspace_admin, or workspace_billing.","provider":"go.mondoo.com/mql/providers/claude"}},"title":"Claude organization workspace member","desc":"Member's access to a specific workspace. The `workspaceRole` field is one of workspace_user, workspace_developer, workspace_restricted_developer, workspace_admin, or workspace_billing.","min_provider_version":"13.0.0","defaults":"workspaceRole","provider":"go.mondoo.com/mql/providers/claude"},"claude.session":{"id":"claude.session","name":"claude.session","fields":{"archivedAt":{"name":"archivedAt","type":"\t","is_mandatory":true,"title":"Archive timestamp, if applicable","provider":"go.mondoo.com/mql/providers/claude"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Session creation timestamp","provider":"go.mondoo.com/mql/providers/claude"},"environment":{"name":"environment","type":"\u001bclaude.environment","title":"Execution environment this session runs in","desc":"The environment supplies the compute context and visibility scope for the session, so reading it alongside the session shows where the agent work actually executes.","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/providers/claude"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Session identifier","provider":"go.mondoo.com/mql/providers/claude"},"status":{"name":"status","type":"\u0007","is_mandatory":true,"title":"Session status","desc":"One of rescheduling, running, idle, or terminated.","provider":"go.mondoo.com/mql/providers/claude"},"title":{"name":"title","type":"\u0007","is_mandatory":true,"title":"Session title","provider":"go.mondoo.com/mql/providers/claude"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Object type","provider":"go.mondoo.com/mql/providers/claude"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/claude"}},"title":"Claude agent session","desc":"Agent session in the Claude platform, including its execution status, the environment it runs in, and its lifecycle timestamps. Auditing sessions shows which agent work is active or idle and which environment each session is bound to. The `status` field is one of rescheduling, running, idle, or terminated.","min_provider_version":"13.0.0","defaults":"id title status","provider":"go.mondoo.com/mql/providers/claude"},"claude.skill":{"id":"claude.skill","name":"claude.skill","fields":{"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/claude"},"displayTitle":{"name":"displayTitle","type":"\u0007","is_mandatory":true,"title":"Skill display title","provider":"go.mondoo.com/mql/providers/claude"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Skill identifier","provider":"go.mondoo.com/mql/providers/claude"},"latestVersion":{"name":"latestVersion","type":"\u0007","is_mandatory":true,"title":"Latest version identifier","provider":"go.mondoo.com/mql/providers/claude"},"source":{"name":"source","type":"\u0007","is_mandatory":true,"title":"Skill source","desc":"One of custom (authored in the workspace), anthropic (published by Anthropic and read-only), anthropic_example (an Anthropic-published sample), or plugin (resolved from an installed plugin).","provider":"go.mondoo.com/mql/providers/claude"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Object type","provider":"go.mondoo.com/mql/providers/claude"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/claude"}},"title":"Claude registered skill","desc":"Skill registered in the Claude platform, packaging reusable instructions that extend agent capabilities. Skills can be Anthropic-provided or custom, letting you audit which extensions are available to agents and where they originate. The `source` field is one of custom or anthropic.","min_provider_version":"13.0.0","defaults":"id displayTitle","provider":"go.mondoo.com/mql/providers/claude"},"claude.userProfile":{"id":"claude.userProfile","name":"claude.userProfile","fields":{"accessType":{"name":"accessType","type":"\u0007","is_mandatory":true,"title":"How the platform uses the API on behalf of this entity","desc":"`application` means the platform sells a product that calls the API behind the scenes and the profile is an individual end user of that product. `passthrough` means the platform resells raw inference and the profile identifies the company it is resold to. Null when the profile does not report an access type.","min_provider_version":"13.1.3","provider":"go.mondoo.com/mql/providers/claude"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Profile creation timestamp","provider":"go.mondoo.com/mql/providers/claude"},"externalId":{"name":"externalId","type":"\u0007","is_mandatory":true,"title":"Platform-provided external identifier","provider":"go.mondoo.com/mql/providers/claude"},"externalUserOnboardedAt":{"name":"externalUserOnboardedAt","type":"\t","is_mandatory":true,"title":"Timestamp the platform onboarded the end user behind this profile","desc":"Null when the platform has not reported an onboarding time.","min_provider_version":"13.1.3","provider":"go.mondoo.com/mql/providers/claude"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Profile identifier","provider":"go.mondoo.com/mql/providers/claude"},"name":{"name":"name","type":"\u0007","is_mandatory":true,"title":"Profile display name","provider":"go.mondoo.com/mql/providers/claude"},"relationship":{"name":"relationship","type":"\u0007","is_mandatory":true,"title":"Relationship to the platform","desc":"Deprecated in favor of accessType. The API no longer reports a relationship, so this field is always null.","provider":"go.mondoo.com/mql/providers/claude","maturity":"deprecated","replaced_by":"claude.userProfile.accessType"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Object type","provider":"go.mondoo.com/mql/providers/claude"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/claude"}},"title":"Claude user profile","desc":"User profile representing an entity that interacts with the Claude platform. The `accessType` field describes how the platform uses the API on behalf of the entity, and `externalUserOnboardedAt` records when the platform onboarded the end user behind the profile.","min_provider_version":"13.0.0","defaults":"id name accessType","provider":"go.mondoo.com/mql/providers/claude"},"claude.vault":{"id":"claude.vault","name":"claude.vault","fields":{"archivedAt":{"name":"archivedAt","type":"\t","is_mandatory":true,"title":"Archive timestamp, if applicable","provider":"go.mondoo.com/mql/providers/claude"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Vault creation timestamp","provider":"go.mondoo.com/mql/providers/claude"},"credential":{"name":"credential","type":"\u001bclaude.vault.credential","title":"Claude vault credential","desc":"Credential stored in a Claude vault. Credentials provide authentication details that agents can use during sessions without exposing secrets in prompts or tool calls.","provider":"go.mondoo.com/mql/providers/claude","is_implicit_resource":true},"credentials":{"name":"credentials","type":"\u0019\u001bclaude.vault.credential","title":"Credentials stored in this vault","provider":"go.mondoo.com/mql/providers/claude"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Vault display name","provider":"go.mondoo.com/mql/providers/claude"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Vault identifier","provider":"go.mondoo.com/mql/providers/claude"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Object type","provider":"go.mondoo.com/mql/providers/claude"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/claude"}},"title":"Claude secret vault","desc":"Secret vault used to store credentials for agent sessions. Vaults hold credentials that agents can access at runtime without exposing secrets in prompts.","min_provider_version":"13.0.0","defaults":"id displayName","provider":"go.mondoo.com/mql/providers/claude"},"claude.vault.credential":{"id":"claude.vault.credential","name":"claude.vault.credential","fields":{"archivedAt":{"name":"archivedAt","type":"\t","is_mandatory":true,"title":"Archive timestamp, if applicable","provider":"go.mondoo.com/mql/providers/claude"},"createdAt":{"name":"createdAt","type":"\t","is_mandatory":true,"title":"Creation timestamp","provider":"go.mondoo.com/mql/providers/claude"},"displayName":{"name":"displayName","type":"\u0007","is_mandatory":true,"title":"Credential display name","provider":"go.mondoo.com/mql/providers/claude"},"id":{"name":"id","type":"\u0007","is_mandatory":true,"title":"Credential identifier","provider":"go.mondoo.com/mql/providers/claude"},"type":{"name":"type","type":"\u0007","is_mandatory":true,"title":"Object type","provider":"go.mondoo.com/mql/providers/claude"},"updatedAt":{"name":"updatedAt","type":"\t","is_mandatory":true,"title":"Last update timestamp","provider":"go.mondoo.com/mql/providers/claude"},"vault":{"name":"vault","type":"\u001bclaude.vault","title":"Vault that holds this credential","min_provider_version":"13.0.13","provider":"go.mondoo.com/mql/providers/claude"}},"title":"Claude vault credential","desc":"Credential stored in a Claude vault. Credentials provide authentication details that agents can use during sessions without exposing secrets in prompts or tool calls.","min_provider_version":"13.0.0","defaults":"id displayName","provider":"go.mondoo.com/mql/providers/claude"}},"dependencies":{"core":{"id":"go.mondoo.com/mql/providers/core","name":"core"}},"provider_roots":{"go.mondoo.com/mql/providers/claude":"claude"}}