Install the plugin
Installing is two steps that are easy to confuse, because they authenticate separately: adding the plugin, then signing in.
Before you start
- Claude Code, reasonably current. The governance hooks depend on hook behavior that older versions do not have.
- Access to the NobleCloak plugin marketplace. It is distributed to customers rather than published openly — if you do not have access, ask support@noblecloak.com before going further.
- A NobleCloak account in an organization with an entitled tool catalog. An organization with nothing entitled will install cleanly and then fail every call, which is a confusing place to start; see Troubleshooting.
1. Add the plugin
Add the NobleCloak marketplace we point you at, then install the plugin from
it, using Claude Code's /plugin command. Restart Claude Code afterwards so
the hooks and commands load.
You will know it worked when /bianoble-status exists as a command.
2. Sign in
/bianoble-login
This opens your browser, you authenticate, and the plugin stores a governance session locally. If the browser does not open, the command prints a URL to visit.
3. Connect the MCP server
Restart Claude Code, then check /mcp.
/bianoble-login authenticates the governance session — the token the
hooks use. The MCP server connection is owned by Claude Code's own native
OAuth, and holds a separate token.
Both are issued by the same authorization server, so the second one is usually a single click or silent. It is not a bug, and it is not something you can skip: they are genuinely two credentials with two different owners.
Verify
/bianoble-status
Read three lines in particular:
| Line | What good looks like |
|---|---|
Status | Connected. Not connected or Token expired → run /bianoble-login |
Organization (hooks token) | The organization you expect. If it is wrong, see Troubleshooting — re-running login alone will not fix it |
Catalog: N tools visible | N greater than zero. Catalog: 0 means every tool call will fail with not found in catalog — it is a precondition, not a warning |
/bianoble-status also prints whether governance is in audit-only or
ENFORCE mode. Audit-only is the default and blocks nothing.
Uninstalling
Run /bianoble-logout to clear the governance session, then remove the
plugin through /plugin. Logging out leaves the MCP server configuration
alone — disconnect that from /mcp separately, for the same
two-credentials reason as above.
Calls already made stay in the Execution Ledger. That is an audit record, and it is retained under our privacy policy.