Claude Code
ChatAnthropic
Product overview
Name of Agent: Claude Code
Advertised use: coding agent
Monetisation/Usage price: 20,
100, higher rate limits
200,
Who is using it?: end user and enterprise customers for coding and prototyping
Website: (https://claude.com/product/claude-code, archived)
Category: Chat
Company & accountability
Developer: Anthropic
Place of legal incorporation: Delaware, USA
For profit company?: Yes (PBC)
Parent company?: Not applicable
Technical capabilities & system architecture
Documention: (https://code.claude.com/docs, archived)
Observation space: File system, bash commands, MCP
Action space: File system, bash commands, MCP
User interface and interaction design: Chatbot in terminal
User roles: Operator (issues queries, which the agent to responds to); Executor (user may take actions/make decisions based on outputs); Examiner (user can use thumbs up/down buttons to give feedback)
Component accessibility: Closed source
Autonomy & control
Autonomy level and planning depth: L1-L4: in plan mode it is most like a simple chat bot. but with auto approve mode on, Claude Code can plan actions and take multiple steps (using different tolls) without user approval. it will ask for clarification as needed.
User approval requirements for different decision types: Yes, permission for running bash commands, editing files, or reading files outside of its initial directory source
Execution monitoring, traces, and transparency: Visible (albeit summarized) CoT with a list of to-dos being worked on
Emergency stop and shut down mechanisms and user control: User can pause/stop the agent at any time
Usage monitoring and statistics and patterns: User can see how much context is used
Ecosystem interaction
Identify to humans?: Anthropic’s stance on watermarking (link, archived): "While watermarking is most commonly applied to image outputs, which we do not currently provide, we continue to work across industry and academia to explore and stay abreast of technological developments in this area."
Anthropic’s Usage Policy prohibits using Claude to impersonate a human (i.e., to convince someone they’re communicating with a natural person when they are not), implying Claude deployments must not hide AI identity in human interactions (link, archived)
Identifies technically?: Anthropic officially documents that Claude-related web activity is identifiable via specific User-Agent tokens: ClaudeBot, Claude-User, and Claude-SearchBot (link, archived)
Anthropic states it does not currently publish fixed IP ranges for these bots/agents (they use service-provider public IPs), so IP-range identification is not available as an official signature mechanism (link, archived)
Interoperability standards and integrations: Anthropic defines Model Context Protocol (MCP) as an open standard that “standardizes how applications provide context to LLMs,” likened to a “USB-C port for AI applications.” [link]. Claude Code offers MCP support and works with open source plugins and skills.
Web conduct: - ClaudeBot, Claude-User, and Claude-SearchBot “respect ‘do not crawl’ signals by honoring industry standard directives in robots.txt” and “respect anti-circumvention technologies,” stating they do not attempt to bypass CAPTCHAs (link, archived)
- Independent reporting and site-operator accounts, however, have documented periods of very heavy crawling and, at least in some cases, behavior that appeared to ignore site preferences until new robots.txt rules propagated. ((link, archived), (link, archived))
Safety, evaluation & impact
Technical guardrails and safety measures: "Model training: We use reinforcement learning to train Claude to recognize and refuse malicious instructions—even when they appear authoritative or urgent.
Content classifiers: We scan all untrusted content entering Claude's context and flag potential injections before they can affect behavior.
Granular permissions to give you control over what Claude can access and do.
Site blocklists preventing Claude's access to certain types of high-risk websites.
Action confirmations for certain high-risk actions such as purchasing." (link
, archived)Claude Code uses a permission-based architecture and is read-only by default; higher-impact actions (e.g., editing files, executing commands) require explicit user approval (link, archived)
Sandboxing and containment approaches: filesystem, network, OS-level enforcement
Sandboxed bash tool: Sandbox bash commands with filesystem and network isolation, reducing permission prompts while maintaining security. Enable with /sandbox to define boundaries where Claude Code can work autonomously
Write access restriction: Claude Code can only write to the folder where it was started and its subfolders (source, archived)