Unidentified plugin activity

Last updated Oct 17, 2026 Preview Policies Access & Sharing

AI summary

Detect Claude plugin activity that Anthropic cannot name, closing a blind spot in your visibility. When activity appears, ask affected users which plugins they ran and implement a plugin allowlist to prevent it from recurring.

Severity: Medium Security Recommended Preview

What it detects

Detects activity in the combined third-party bucket, where plugins run that the Claude Console analytics cannot name, on the Enterprise plan.

Why it matters

Anthropic collects plugin activity for which the reporting client provided no plugin name in one combined third-party bucket, and redacts the identity of third-party Claude Code plugins at the source. Activity in that bucket means plugins are running in the organization that Anthropic cannot name for us: the usage is real, the plugin behind it is not identifiable from the API. Treat it as the blind spot it is - the people in the affected rows can say which plugins they run, and a plugin allowlist keeps the bucket empty.

The rule

Every Claude Plugin Usage where Unidentified Activity is true

In Rencore Governance

Details

Applies to	Claude plugin usage
Connector	Claude Enterprise
Severity	Medium
Category	Security
Recommended	Yes
Recommended automation	None
License type	Standard

Other policies that check Claude plugin usage objects:

Plugin from outside the official directory (Medium)

Frequently asked questions

What does the unidentified plugin activity policy detect?

The Unidentified plugin activity policy detects activity in the combined third-party bucket, where plugins run that the Claude Console analytics cannot name, on the Enterprise plan.

Which objects does the unidentified plugin activity policy check?

The Unidentified plugin activity policy checks Claude plugin usage objects from the Claude Enterprise inventory and reports each one that matches its rule as a violation.

How severe is a violation of the unidentified plugin activity policy?

Violations of the Unidentified plugin activity policy have Medium severity. The policy is in the Security category.

Which module includes the unidentified plugin activity policy?

The Unidentified plugin activity policy comes with the Claude Enterprise connector (in preview) in the AI & Agents module of Rencore Governance, an add-on module on the Premium and Enterprise Plans.

Was this page helpful?