Claude Code + Prisma AIRS

The base flow shows how every prompt moves through 8 phases: from user input through local hooks, context assembly, AIRS outbound/inbound scanning, the Claude API, model processing, tool execution, and final output. All block/error paths exit left; the tool loop returns on the right.

The extended flow highlights three additions that change the base flow: Skills inject workflow rules during context assembly (Phase 2), an API Gateway (Portkey, LiteLLM, Bedrock) proxies traffic between AIRS and the Claude API (Phase 4), and MCP Servers add external tool execution via JSON-RPC over stdio/SSE alongside local tools (Phase 7).

AIRS inspects traffic in both directions. Outbound (prompt → API) catches prompt injection, data leakage, policy violations, and budget overruns before the prompt reaches the model. Inbound (API → user) catches malicious code, data exfiltration, toxic content, and license violations in the model's response.

AIRS works in three deployment patterns depending on how your organization routes LLM traffic:

• Direct API — simplest setup; AIRS sits as an inline proxy between Claude Code and api.anthropic.com
• Gateway-Proxied — enterprise pattern; route Claude Code through the Prisma AIRS AI Gateway (Step 3.9 of that guide) with the AI Runtime guardrail configured on the gateway (Step 5.2 there), so no hooks or client-side scanning are needed. Third-party gateways such as LiteLLM add AIRS as a guardrail instead.
• Cloud Provider — uses AWS Bedrock or Azure OpenAI as the model endpoint; AIRS scans before cloud ingress

Admins configure AIRS policies in the SCM portal across three areas: Security Profiles (which detection categories to enable and severity thresholds), AI Access Policies (which apps/users and what action to take), and DLP Data Profiles (PII patterns, secrets regex, custom rules). At runtime, the AIRS policy engine evaluates each request and takes one of three actions:

• BLOCK — request/response rejected, error returned to Claude Code
• ALERT — content allowed but alert logged and admin notified
• ALLOW — content passes through, audit logged

The hooks method inserts five security scripts at three hook points in the Claude Code lifecycle. Each script calls the AIRS Scan API and blocks the action if a threat is detected.

Each hook script sends content to the AIRS Scan API as one of three content types:

All three integration methods require an active Prisma AIRS API Intercept subscription with a generated API key and security profile.

All three methods require Claude Code CLI. The MCP and Skill methods additionally require specific Claude Code features.

The hooks and skill methods require jq and curl for JSON processing and API calls. The skill method additionally requires Python 3.9+.

1. Install jq and curl:

   # macOS
   brew install jq
   
   # Debian/Ubuntu
   sudo apt-get install jq curl
   
   # RHEL/CentOS
   sudo yum install jq curl

   Copy
2. For the Skill method, confirm Python is available:

   python3 --version

   Copy

All three methods require the same core environment variables. Add these to the shell profile.

1. Open the shell profile:

   # zsh (macOS default)
   open ~/.zshrc
   
   # bash
   open ~/.bashrc

   Copy
2. Add the AIRS credentials:

   export PRISMA_AIRS_API_KEY="YOUR_API_KEY_HERE"
   export PRISMA_AIRS_PROFILE_NAME="YOUR_PROFILE_NAME_HERE"

   Copy
3. For non-US regions, add the regional endpoint:

   # EU (Germany)
   export PRISMA_AIRS_URL="https://service-de.api.aisecurity.paloaltonetworks.com"
   
   # India
   export PRISMA_AIRS_URL="https://service-in.api.aisecurity.paloaltonetworks.com"
   
   # Singapore
   export PRISMA_AIRS_URL="https://service-sg.api.aisecurity.paloaltonetworks.com"

   Copy
4. Reload the shell profile:

   source ~/.zshrc

   Copy

*One of PRISMA_AIRS_PROFILE_NAME or PRISMA_AIRS_PROFILE_ID is required.

AIRS session tracking correlates all scans from a single Claude Code session for audit and investigation. The hooks method sends the Claude Code session_id as the AIRS transaction_id automatically.

In production, ensure missing or invalid AIRS configuration blocks actions rather than silently allowing them.

1. For the Hooks method, verify fail-closed behavior is active:

   # Temporarily unset the API key
   unset PRISMA_AIRS_API_KEY
   
   # Test a prompt - should be blocked
   echo '{"prompt": "Hello"}' | bash ~/.claude/hooks/scan-user-input.sh
   echo $?
   # Expected: 2 (blocked)
   
   # Restore the API key
   export PRISMA_AIRS_API_KEY="YOUR_API_KEY_HERE"

   Copy
2. For the MCP method, verify that Claude reports an error when credentials are missing.
3. For the Skill method, verify that scan.py exits with code 1 when credentials are missing.

Route the AIRS security log to a centralized logging system for alerting and audit.

1. Set a persistent log path in the shell profile:

   export SECURITY_LOG_PATH="$HOME/.claude/hooks/prisma-airs.log"

   Copy
2. Example log entries (Hooks method):

   [Mon Mar 16 14:30:02 CDT 2026] BLOCKED USER INPUT: malicious - detected: [agent,injection] (scan_id: ac9a12ec...)
   [Mon Mar 16 14:31:16 CDT 2026] BLOCKED URL in mcp__github__get_file_contents response: http://evil.com (malware) [scan:def456]
   [Mon Mar 16 14:32:44 CDT 2026] BLOCKED mcp__github__get_file_contents response content: malicious_code [scan:f23fd2bf...]

   Copy
3. Forward the log to a SIEM or centralized logging platform using a file shipper (Filebeat, Fluentd, etc.) or symlink the log to a monitored directory.

Establish a key rotation schedule to limit exposure from compromised credentials.

1. Log in to Strata Cloud Manager.
2. Navigate to AI Runtime Security > API Intercept.
3. Generate a new API key.
4. Update the PRISMA_AIRS_API_KEY environment variable on all developer machines.
5. Revoke the old key after confirming the new key is operational.

Hooks block all prompts, including benign ones.

Claude Code processes prompts without triggering AIRS scans.

The /mcp command does not list prisma-airs.

Claude reports authentication failures when invoking AIRS MCP tools.

The skill script fails with Python errors or API errors.

AIRS API requests time out or return network errors.