# Spectrum card: Claude Code on the web > GAMMA-Ray v0.0.26 (beta, for review; every rating is experimental). The GAMMA-Ray Spectrum beta card of Claude Code on the web: A0 · R2 · C0 · O2, Exploring; 47 provisions lit across 8 instruments. > Page: https://gamma-ray.sgit.ai/spectrum/cards/claude-code-web/ · Source: data/scans/claude-code-web.json Spectrum 0.1 beta · Public tier · read 2026-11-10 · not reviewed by its vendor yet The same coding agent in a cloud session: a managed container with one repository attached and a proxy above it. Claude Code on the web a product, as documented SPECTRUM 0.1 BETA · Public tier · 2026-11-10 A · Autonomy not yet evidenced R2 Reach Integrated C · Control not yet evidenced O2 Openness Documented Stage: Exploring (4 of 16) Standout. Reach 2 (Integrated): the repository, the shell and the code host Next unlock. Autonomy 3 (Acts): public evidence that it is in production: a public source names a customer or gives usage figures for what it does on its own would get there. Standards constellation. 47 provisions lit across 8 of 8 instruments. Salesforce EAAMM OWASP MCP AAGMM Microsoft NIST AI Act Evidence: 9 sources, captured and hashed · the card's page has the vault's read key · Not reviewed by its vendor yet · correct or claim this card *Figure. The walk from the card down to each indicator, its public source and the instruments it touches; the sections below list the same in text.* This card rates a product as its vendor documents it, not anyone's deployment of it. A feature the operator has to turn on counts, and is marked as available. Levels are computed from the evidence below by [published rules](../../evidence-map/index.md). A dimension with no evidence reads "not yet evidenced". ## Autonomy: not yet evidenced *What does the agent do on its own?* Nothing public was found that meets a rule in this dimension. That is not a no. **Next unlock: level 3, Acts.** Public evidence that it is in production: a public source names a customer or gives usage figures for what it does on its own. ## Reach: level 2, Integrated *How connected is it?* Documented connectors to common tools. - `I10` It works across several domains or systems. The repository, the shell and the code host. [Source](https://code.claude.com/docs/en/claude-code-on-the-web) (read, documented, captured 2026-11-10T06:11Z, sha256 `d04a844155a8f560`) - `I11` It connects to external tools or services across a trust boundary. Sessions reach package registries and other allowlisted domains. [Source](https://code.claude.com/docs/en/cloud-environments) (read, documented, captured 2026-11-10T06:11Z, sha256 `a68b3899c0bcdfc2`) This evidence touches 8 provisions: Salesforce, Microsoft, OWASP, NIST AI RMF. **Next unlock: level 3, Open protocol.** Public evidence that there is a published protocol or communication layer between agents. ## Control: not yet evidenced *Can people stay in command?* Nothing public was found that meets a rule in this dimension. That is not a no. **Next unlock: level 1, Stated.** Public evidence that a limit on it is a rule in prose. ## Openness: level 2, Documented *Does it show its work?* Public documents on how it works, its data, its models and its limits. - `I58` The data it uses is described. A page describes what data is sent, kept and used. [Source](https://code.claude.com/docs/en/data-usage) (read, documented, captured 2026-11-10T06:11Z, sha256 `0f5fa5f2a836052b`) - `I61` The models and third-party components it uses are listed. The model configuration page lists the models Claude Code uses by alias and the version each resolves to per provider; cloud sessions take the same /model command. "Uses the latest Opus model for complex reasoning tasks" [Source](https://code.claude.com/docs/en/model-config) (read, documented, captured 2026-11-10T06:11Z, sha256 `1d0950edada35be5`) This evidence touches 6 provisions: AAGMM, EAAMM, Salesforce, OWASP, NIST AI RMF. Also evidenced: the rule for level 4. It will count when the level before it is. **Next unlock: level 3, Measured.** Public evidence that test or evaluation results are published. ## The standards constellation One piece of public evidence can speak to several frameworks at once. "Touched" never means "complies". The share is of the provisions that can be read from outside. | Instrument | Provisions touched | Of those publicly readable | |---|---|---| | Salesforce | 10 | 24 | | EAAMM | 2 | 8 | | OWASP | 7 | 17 | | MCP authorization | 6 | 8 | | AAGMM | 5 | 6 | | Microsoft | 8 | 23 | | NIST AI RMF | 7 | 20 | | EU AI Act | 2 | 6 | ## Upper layers The public card is the front door. The same evidence, read with the governance rules, is this agent's [GAMMA-Ray rating](../../../scans/claude-code-web/index.md): freedom, governance, the level held, the grant and a work order. That layer is written for an operator. ## The vault Every source behind this card was captured and hashed into a public sgit vault (`kq47p50t`): `captures.json` lists each URL with the SHA-256 of what was fetched and when. Read key: `sgit_public_read_8996af6ecc712b76dfb7a34f4b820d2e89d066ade22bf910e02b7a5ea39d9fdc:kq47p50t` With [sgit](https://sgit.ai/): `sgit clone sgit_public_read_8996af6ecc712b76dfb7a34f4b820d2e89d066ade22bf910e02b7a5ea39d9fdc:kq47p50t`.