Operate Claude Code in production

Operating Claude Code after rollout means watching four signals: spend (/usage and the OpenTelemetry cost metrics), session health (claude doctor and /context), the performance of the code Claude Code ships, and the security of that code. Each signal has an owner in the table below and a page, so nobody has to watch sessions.

This hub is for developers and tech leads who own Claude Code for a team after the first month: the token bill has doubled, one teammate’s sessions behave differently, and a security reviewer asks what the agent touched last week. Commands were checked against Claude Code v2.1.283 on the latest channel.

Which Claude Code operate page answers your question?

Your question	Page
A session ignores CLAUDE.md, a permission rule does not apply, or an MCP server is dead.	Troubleshoot a Claude Code session
Where does the money go, and how do I cap it?	Claude Code cost control for teams
How do I add logging, tracing and alerts to my application?	Observability setup with Claude Code
How do I find slow queries, heavy bundles and slow endpoints?	Application performance analysis with Claude Code
How do I cut tokens and latency without losing quality?	Claude Code performance optimization
How do I audit a codebase for vulnerabilities and prove the findings?	Security audits with Claude Code

Agent telemetry for every tool (traces, tool calls, audit retention) lives in observing the agents, cost per accepted change in the economics of agent-built software, and model prices on the models hub.

How do you set an operating baseline for Claude Code?

Do this once per team, before tuning.

1. Check the install and the release channel. In a terminal, run claude --version and claude doctor. /doctor in a session can also fix issues. Record the version: on 2026-09-26 the latest channel was v2.1.283 and the stable channel v2.1.274, and the Opus 5.5 default needs v2.1.280 or later.

2. Read your own spend. In a session, /usage shows session cost, plan limits and activity. /context shows how much of the context window each part of the session uses.

3. Turn on telemetry, and prove it arrives. Start with the console exporter to see a datapoint before wiring a collector:

   export CLAUDE_CODE_ENABLE_TELEMETRY=1
   export OTEL_METRICS_EXPORTER=console
   export OTEL_METRIC_EXPORT_INTERVAL=10000
   claude

   Within about 10 seconds of your first prompt, a claude_code.session.count datapoint prints. Then switch to OTEL_METRICS_EXPORTER=otlp with OTEL_EXPORTER_OTLP_ENDPOINT, and put the same variables in the env block of managed settings so every developer reports. Cost arrives as claude_code.cost.usage (USD) and tokens as claude_code.token.usage.

4. Cap every unattended run. Headless jobs take a budget: claude -p "…" --max-budget-usd 2.00. It works only with -p (--print); interactive sessions need plan limits instead.

5. Fix the model policy in managed settings. availableModels and maxEffortLevel cap model choice and effort, and autoUpdatesChannel keeps native installs on one release channel.

Copy-paste prompt: audit this repository's Claude Code setup for cost and risk

Do not edit any files. Audit how Claude Code is configured in this repository:
CLAUDE.md (and any nested CLAUDE.md or AGENTS.md), .claude/settings.json,
.claude/agents/, .claude/skills/, hooks, and .mcp.json.
Report a table with columns: file, finding, cost or risk, fix. Look for:
1. Instructions longer than 200 lines or duplicated across files (they load every session).
2. MCP servers that nothing in the repository or the last 20 commits refers to.
3. Permission rules that allow Bash without a command pattern, or writes outside the repo.
4. Hooks that call the network or read secrets.
End with the three changes that would save the most tokens and the one that removes the most risk.

Copy-paste prompt: turn last month's telemetry export into an operating review

Read ops/claude-code-usage.csv, exported from our OpenTelemetry backend
(claude_code.cost.usage and claude_code.token.usage per user, model and day).
First print the column names you found; if user, model, date or cost is missing, stop and say so.
Do not guess missing values. Report:
1. Cost per active developer per day, as median and 90th percentile.
2. The five users and the five days with the highest cost, and the model each used.
3. Any week where cost rose more than 30% while sessions stayed flat.
4. The share of cost by model.
Write the result to ops/claude-code-review.md with every number traceable to its rows,
and list the rows you could not parse.

How do you know Claude Code is operating well without watching sessions?

Read owned signals, not transcripts; open a session only when a signal points at it.

Signal	Where it comes from	What healthy looks like	Owner
Spend	claude_code.cost.usage per user; claude_code.session.count proves every developer reports	Stable cost per active developer week to week. Anthropic’s typical enterprise figure is “around $13 per developer per active day and $150-250 per developer per month” (Claude Code costs docs, checked 2026-09-26)	Tech lead
Session health	claude doctor after upgrades; /context in long sessions	No errors; one release channel across the team	Each developer
Performance of shipped code	Your application’s traces and error rate	No regression after a Claude Code change	On-call engineer
Security of shipped code	/security-review and your scanners on each pull request	Every high finding has an exploit test or a documented dismissal	Code owner

The stage before this one is review and ship with Claude Code.

What breaks when Claude Code runs every day?

Symptom	Cause	Recovery
Spend rises while output does not	Long sessions carry stale context; many MCP servers add tools to every session	Check /context, start a fresh session per task, remove unused servers; see performance optimization
A CI job costs far more than planned	A headless run has no budget	Add --max-budget-usd to every claude -p call and fail the job when it trips
The telemetry dashboard is empty	CLAUDE_CODE_ENABLE_TELEMETRY or an exporter is unset	Rerun with the console exporter; if nothing prints, run claude --debug-file /tmp/cc.log and search it for [3P telemetry]
One teammate gets a different default model	Different release channels: the Opus 5.5 default needs v2.1.280, which stable had not reached on 2026-09-26	Compare claude --version. autoUpdatesChannel in managed settings steers only auto-updating native installs; for Homebrew use the claude-code@latest cask (or claude-code for stable), for npm the matching dist-tag
A vulnerability ships in an agent-written change	Security review ran only when someone remembered	Make the audit a pull-request gate; see security audits with Claude Code

Where to go next with operating Claude Code

Control the bill

Claude Code cost control for teams

Observe the agents

Observing the agents

Set team policy

Claude Code for teams and enterprises

Across all tools

DevOps with AI

For other agents, see operate Codex and operate Cursor.