diff --git a/src/host_secrets/catalog.py b/src/host_secrets/catalog.py
index 4bbb4ad..4ab8f37 100644
--- a/src/host_secrets/catalog.py
+++ b/src/host_secrets/catalog.py
@@ -25,7 +25,11 @@ class Service(NamedTuple):
 
 
 CATALOG: dict[str, Service] = {
-    "anthropic": Service("ANTHROPIC_AUTH_TOKEN", (Upstream("api.anthropic.com"),)),
+    # Claude Code calls claude.ai connectors at mcp-proxy with the same bearer.
+    "anthropic": Service(
+        "ANTHROPIC_AUTH_TOKEN",
+        (Upstream("api.anthropic.com"), Upstream("mcp-proxy.anthropic.com")),
+    ),
     # git's smart HTTP refuses a bearer. It takes Basic with x-access-token as the user.
     "github": Service(
         "GH_TOKEN",
diff --git a/src/providers/docker_sbx/tests/test_api.py b/src/providers/docker_sbx/tests/test_api.py
index 06b43c9..36f96b0 100644
--- a/src/providers/docker_sbx/tests/test_api.py
+++ b/src/providers/docker_sbx/tests/test_api.py
@@ -133,9 +133,9 @@ async def fake_exec(*args, **kwargs):
 
 CUSTOM SECRETS
 SCOPE  TARGETS  ENV  PLACEHOLDER  SECRET
-sb-test  api.anthropic.com  ANTHROPIC_AUTH_TOKEN  drk.0123.anthropic.abc  cmd (on-demand)
+sb-test  api.anthropic.com, mcp-proxy.anthropic.com  ANTHROPIC_AUTH_TOKEN  drk.0123.anthropic.abc  cmd (on-demand)
 sb-test  api.acme.test, acme.example  ACME_TOKEN  drk.0123.acme.def  cmd (on-demand)
-"""
+"""  # noqa: E501
 
 
 @pytest.mark.asyncio
diff --git a/src/providers/docker_sbx/tests/test_secrets.py b/src/providers/docker_sbx/tests/test_secrets.py
index 27f77f0..198aadf 100644
--- a/src/providers/docker_sbx/tests/test_secrets.py
+++ b/src/providers/docker_sbx/tests/test_secrets.py
@@ -55,7 +55,7 @@ async def test_any_other_secret_is_a_custom_secret_on_its_host_from_a_file(tmp_p
     assert stat.S_IMODE(path.parent.stat().st_mode) == 0o700
     api.set_custom_secret.assert_awaited_once_with(
         sandbox="sb-one",
-        hosts=["api.anthropic.com"],
+        hosts=["api.anthropic.com", "mcp-proxy.anthropic.com"],
         env="ANTHROPIC_AUTH_TOKEN",
         placeholder=str(placeholder),
         command=f"cat {path}",
diff --git a/src/secrets_exchange/tests/test_app.py b/src/secrets_exchange/tests/test_app.py
index 8456cae..22d35cb 100644
--- a/src/secrets_exchange/tests/test_app.py
+++ b/src/secrets_exchange/tests/test_app.py
@@ -228,6 +228,7 @@ async def test_the_upstreams_are_the_hosts_with_a_registered_secret(edge) -> Non
         "api.anthropic.com",
         "api.github.com",
         "github.com",
+        "mcp-proxy.anthropic.com",
         "uploads.github.com",
     ]