Connect Claude Desktop

Sentinel can route the Claude Desktop app through the same local proxy as the terminal CLI, so desktop Chat and Code inference share your pooled accounts, usage tracking, and alerts.

The desktop app doesn’t read ~/.claude/settings.json or environment variables. Instead it reads a per-user gateway config that Sentinel writes for you — no MDM or admin setup required:

• macOS ~/Library/Application Support/Claude-3p/configLibrary/
• Windows %LOCALAPPDATA%\Claude-3p\configLibrary\
• Linux ~/.config/Claude-3p/configLibrary/

1. Install and open the Claude Desktop app. Sentinel detects it automatically and shows a Claude Desktop card.

2. Click Enable on that card. Sentinel writes a gateway config pointing the desktop app at the proxy on http://127.0.0.1:47284. Your real account token is injected per-request by the proxy, so the desktop app inherits account pooling and rotation. Once routing is active the card disappears — there’s nothing left to confirm. The on/off control then lives in Settings → General.

3. Fully quit and reopen Claude Desktop (⌘Q / tray → Quit — a reopen from the dock won’t reload the config). On Windows, closing the window is not enough: check Task Manager for lingering claude.exe processes and end them before relaunching. On next launch it no longer needs a separate login; it routes through Sentinel.

4. Confirm traffic is flowing:

   tail -f ~/.sentinel/daemon.log

What routes through Sentinel

Enabling covers the desktop app’s Chat and Code inference. Cowork runs tasks in a separate VM whose network egress may not use the host gateway, so Cowork coverage isn’t guaranteed. macOS and Windows are verified end-to-end; Linux uses the same mechanism.

Credential health lives in Sentinel

The gateway config holds a placeholder key — the proxy injects a real account token into every request. That means when the desktop app reports “The provider rejected your credentials” or its Setup shows a 401 from /v1/models, the problem is never solved inside the desktop app: the pooled account’s token has expired or the account was removed. Fix it in Sentinel (Re-authenticate the account, or add one), and the desktop app recovers on its own — don’t re-enter credentials in the desktop app’s Setup.

If the model picker stays stuck on “Models are still loading” after Sentinel is healthy again, fully restart the desktop app — see Troubleshooting.

Sentinel’s MCP server in the desktop app

Enabling routing also installs Sentinel’s local MCP server — the compression retrieve tool and the code-mode bridge — into the desktop app’s claude_desktop_config.json, so desktop Code sessions get the same token-optimization tooling the CLI has. The desktop app only spawns command-based (stdio) MCP servers and silently drops the HTTP entry the CLI uses, so Sentinel’s entry runs the daemon binary in a small stdio bridge mode that relays to the same local endpoint.

Fully restart the desktop app after enabling routing to pick the server up — sentinel then appears in the app’s local MCP list. Disabling routing removes the entry; any other MCP servers you configured there are preserved.

Drift and re-apply

If the desktop app’s applied config is later pointed at a different gateway (a manual change, or an in-app reset), the card switches to Claude Desktop routed elsewhere with a one-click Re-apply to restore Sentinel routing.

Disabling

Open Settings → General and turn off Route Claude Desktop through Sentinel. Sentinel removes only its own gateway entry (any other third-party inference configs you created are preserved) and the desktop app returns to its first-party login the next time it starts.

Card not showing?

The card only appears when the desktop app is detected and routing isn’t active yet. If you just installed the app, give Sentinel a few seconds to poll, or reopen the tray window. If routing is already on, the card is gone by design — manage it from Settings → General. See Troubleshooting.