Claude for
your entire
organization.

Deploy Claude Cowork, Claude CLI, and the Claude CLI to every employee in under 10 minutes — with enterprise security, real-time cost controls, and full observability. No engineering weeks. No data leaving your infrastructure.

Deploy in 10 Minutes

Runs in Your AWS Account

Terminal — ccwkwb

# Install the Workmates CLI

$ uv tool install git+https://github.com/Workmates-Development-Team/cowork-3p-with-bedrock.git#subdirectory=source

Resolving dependencies...

✓ ccwkwb installed successfully

$ ccwkwb init

AWS Region: ap-south-1

Organization: Acme Corp

✓ Config saved to ~/.ccwkwb/config.yml

$ ccwkwb deploy

▶ Creating CloudFormation stack...

Cognito User Pool CREATED

IAM OIDC Provider CREATED

EC2 OTel Collector CREATED

CloudWatch Dashboard CREATED

Secrets Manager CREATED

$ ccwkwb package --version 1.0.0

Bundling Claude Cowork + configs...

✓ dist/cowork-3p-v1.0.0.zip ready

✓ Share with employees → easy installer → done!

🚀 Infrastructure deployed in 8m 42s

Avg. Deploy Time

~10 min

Zero API Keys

for employees

How it works

From zero to deployed
in three commands.

Employees need no AWS knowledge, no credentials, and no IT ticket. Just a ZIP file.

For Admins

ccwkwb init

Configure

Set your AWS region, org name, and email. Credentials auto-resolved from your existing AWS profile.

ccwkwb deploy

Deploy

Provisions Cognito, IAM, EC2, CloudWatch, and Secrets Manager via CloudFormation in under 10 minutes.

ccwkwb package

Distribute

Generates a versioned ZIP with all configs baked in. Email it, push via MDM, or host on your intranet.

For Employees

Extract ZIP

Unzip cowork-3p-v1.0.0.zip anywhere on your machine.

Easy Installer

Double-click. No prompts, no config, no AWS credentials. Everything is pre-baked.

Open Claude Cowork

Launch from the Start Menu. Log in with your company email. That's it — you're live.

Capabilities

Everything your org needs.
Nothing you don't.

Three Clients, One Backend

Claude Cowork for daily chat, Claude CLI for engineering, and the CLI for automation — all sharing the same quota pool, auth, and observability.

Claude Cowork

• Full chat UI with artifacts
• File uploads (PDF, image, xlsx)
• Offline mode w/ queue
• Prompt caching (saves $$)

Claude CLI

• Terminal + file tree
• Git integration / auto-PR
• Run tests & deploy
• Security scan on PR

CLI (ccwkwb)

• Works over SSH / CI/CD
• Batch mode (1000s of files)
• Headless automation
• Same Cognito auth

Quota & Cost Control

Per-user token limits, team quota pools, warn/block enforcement. Redis-backed atomic counters and 5-min IAM sync ensure real-time accuracy.

Engineering Team 38M / 50M tokens

Marketing Team 21M / 25M tokens

Skills & Plugin System

Bundle custom skills, MCP servers, and slash commands into distributable plugins. Ship internal tools like Jira, Confluence, and SQL query access org-wide.

ccwkwb install acme-corp/jira-assistant
✓ skill installed for all 147 employees

MCP Server Registry

Pre-configured integrations for AWS, GitHub, GitLab, Linear, Sentry, PostgreSQL, Redis, and your internal APIs.

AWS Bedrock GitHub Linear Sentry PostgreSQL Redis + more

All in One Observability

One place to find all the key metrics — input/output tokens, latency, TTFT, cache hits, throttles, and errors across every user and model.

Tokens

In / Out

Latency

P50 / P99

TTFT

Avg / Max

Cache

Read / Write

Throttles

Count

Errors

Client / Server

Enterprise Security

Your data never
leaves your AWS account.

All inference happens in your own Bedrock deployment. Conversations are never shared with Anthropic or any third party. Every API call is logged to CloudWatch.

AWS Cognito SSO + STS Tokens

Employees authenticate via OIDC. 1-hour STS sessions auto-rotate via credential_helper.py. Zero long-lived credentials.

Principle of Least Privilege

IAM role grants only bedrock:InvokeModel*. Model restrictions and deny policies applied per role. Configs locked via registry hardening.

Encrypted Everything

API keys in Secrets Manager, OIDC tokens in Windows Credential Manager, S3 with SSE-KMS. No sensitive data in plaintext anywhere.

Observability

See exactly how your
org uses Claude.

Real-time metrics, per-user breakdowns, cache analytics, and latency percentiles — all in a built-in React admin panel.

Interactive Self-Built Dashboard

Token usage for both Claude Co-Work Desktop and Claude CLI

Top Users by Token Usage

Model-wise usage insights for every user

Full End-to-End Observability

Input/output tokens, avg latency, cache read/write tokens, throttles, client errors, avg TTFT

Quota Enforcement

Limitations at individual, team, and organization levels

OIDC User Management

Directly manage OIDC users through admin dashboard

Model Management & Selection

Enable/disable and select models through admin dashboard

MCP Server Integrations

Web search via MCP server and other MCP server integrations

Organization MCP Servers & Skills

Ready to use straight away — covers Authentication, Governance & Observability

Use Cases

Built for every team.

Engineering

Code review with security feedback
Root cause from log files
Auto-generate API docs
Bulk refactor 1000s of files via CLI

Data & Analytics

Natural language to SQL
CSV analysis → exec summaries
Chart code generation
Anomaly detection in time-series

Customer Support

Auto-triage by urgency
Search 10k+ KB articles instantly
Draft replies from past tickets
Flag VIP / legal escalations

Legal & Compliance

Highlight non-standard clauses
Draft GDPR/CCPA docs
Summarize audit evidence
Auto-redact PII from files

Capability	Workmates This solution	Claude.ai Consumer	DIY Bedrock
Data in your AWS account	✓	✗	✓
Deploy in < 10 minutes	✓	✓	✗
Per-user quota enforcement	✓	✗	✗
Real-time observability dashboard	✓	✗	✗
Custom skills & plugin system	✓	✗	✗
Zero AWS knowledge for employees	✓	✓	✗

Ready to deploy?
It takes 10 minutes.

Install the CLI, run three commands, and your entire org is live on Claude with enterprise-grade security and observability.

Quick Start

# Install the CLI