Claude Code

Claude Code is an agentic software development product made by Anthropic. It uses models from the Claude family to inspect software projects, propose and apply changes, run development tools, and report results through a conversational interface. Anthropic introduced it as a limited research preview alongside Claude 3.7 Sonnet on February 24, 2025, and made it generally available with the Claude 4 release on May 22, 2025.^[1][2] By July 2026, Claude Code was available in a terminal, integrated development environments, Anthropic's desktop application, and hosted browser sessions.^[3]

Claude Code is one of a broader class of AI agents designed for software work. Its distinctive operating model is access to a developer's actual project and tools rather than generation of an isolated code snippet. Depending on the interface and permissions, it can read files, search a repository, edit source code, run tests and shell commands, use version-control workflows, and connect to external services. These capabilities can affect source code, credentials, networks, and build systems, so Anthropic's documentation treats user review, scoped permissions, and sandboxing as core parts of the product rather than optional precautions.^[3][4]

The official client repository is publicly viewable, but its license reserves all rights to Anthropic and subjects use to Anthropic's commercial terms. It is therefore inaccurate to describe Claude Code itself as open-source software.^[5]

Product model and workflow

Claude Code operates as a conversational agent around a working software project. A user can ask it to explain unfamiliar code, trace a defect, plan a change, edit files, run a test suite, investigate a build failure, or prepare version-control changes. The agent combines a language model with tools for file access, text search, editing, command execution, and task coordination. Tool availability differs by surface and by administrator or user configuration.^[3]

The normal workflow remains supervised. Claude Code can take multiple steps without a new prompt, but access to tools does not establish that its output is correct. Anthropic's security guidance directs users to review proposed code and commands, particularly when a task involves sensitive files, production systems, package installation, or untrusted repository content.^[4] This is important because plausible source code can still contain logic errors, insecure assumptions, fabricated APIs, or changes outside the intended scope.

Each interactive session has a finite context. Project instructions can be placed in CLAUDE.md files, while auto memory can retain concise notes that Claude Code derives from earlier work. The documented instruction scopes include organization-managed policy, user-level preferences, project instructions committed with a repository, and local project instructions that are not intended for version control.^[6] A CLAUDE.md file supplies model context. It is not an access-control mechanism, and deterministic restrictions should instead use permissions, managed settings, hooks, or an external sandbox.^[6][7]

Interfaces and execution environments

The terminal interface is the product's original surface. It runs in a developer's shell and works directly with the selected project directory. Anthropic also provides a native Visual Studio Code extension and an integration for JetBrains development environments. The Visual Studio Code extension adds an editor panel and can expose selections, diagnostics, and file context to the agent, while the terminal remains available for command-oriented workflows.^[3]

Claude Code is also available through Anthropic's desktop application and on the web. The web version, announced in beta on October 20, 2025, executes each task in an isolated cloud environment rather than in the user's local shell.^[8][9] A hosted task can clone a connected repository, make changes, run configured commands, and produce a branch or pull request for review. Isolation reduces direct access to the user's computer, but the task can still affect any repository, secret, or network destination made available to its environment. Organizations must therefore scope credentials and network access to the task.^[8][4]

The interfaces are related but not identical. Terminal and integrated development environment sessions can reach local tools permitted by the operating system and Claude Code configuration. Hosted sessions use an Anthropic-managed environment with its own repository and network configuration. Some features, authentication methods, and administrator controls vary by plan and surface.^[3][8]

Capabilities

Tools, sessions, and checkpoints

Claude Code's built-in tools support common software-development operations, including reading and editing files, searching a codebase, invoking shell commands, and coordinating tasks. It can use ordinary command-line programs already present in the environment, which lets it work with test runners, compilers, package managers, and version-control clients without a product-specific integration for each one.^[3]

File checkpointing provides a recovery mechanism for direct edits made by Claude Code during a session. A user can rewind the conversation, restore code, or do both. Checkpoints do not capture files changed by shell commands, changes made manually by the user, or changes made outside the session, and they are not a replacement for version control.^[10] This boundary matters for migrations, generated files, formatters, and scripts whose effects may extend beyond files edited through Claude Code's file tools.

Sessions can be resumed or continued across supported interfaces, but the available context still depends on the session and its stored state. Claude Code may compact an extended conversation to remain within the model's context window. Important project requirements should therefore live in durable project documentation and tests rather than only in a long chat transcript.^[3][6]

Project instructions, skills, and hooks

CLAUDE.md and files under .claude/rules/ let a project describe commands, architecture, coding conventions, review expectations, and directory-specific guidance. More specific instruction files can be loaded for relevant paths. Managed settings can impose organization-wide configuration that users cannot override.^[6]

Agent skills package reusable instructions and supporting resources in a SKILL.md file. Claude Code can discover skills and invoke them when their descriptions match a task. Earlier custom slash commands stored under .claude/commands/ remain supported, but Anthropic's documentation describes skills as the more general mechanism.^[11]

Hooks are user-defined commands, HTTP requests, model prompts, or agent checks that run at documented lifecycle events. They can validate a proposed command, run formatting after an edit, record an event, or block an operation under specified conditions.^[12] Because command hooks execute with the user's operating-system privileges, a project should review hook definitions before trusting them. A hook can make a rule deterministic, but a prompt-based hook still depends on model behavior.

External tools and the Model Context Protocol

Claude Code can connect to external tools and data through the Model Context Protocol. MCP servers can expose actions or resources such as issue trackers, databases, documentation systems, and browser automation. The client supports local and remote server configurations, authentication for compatible remote services, project-scoped configuration, and managed organization policy.^[13]

An MCP connection expands the agent's authority. A server may return untrusted content or permit consequential actions, and its credentials can provide access beyond the current repository. The server's permissions, transport security, provenance, and output must therefore be evaluated separately from Claude Code itself.^[13][4]

Subagents and multi-agent workflows

Claude Code can delegate a bounded task to a subagent with its own context, system instructions, tool access, and permission mode. The subagent returns its result to the calling session, helping separate research, testing, or review from the main context.^[14] Subagents are not independent security principals unless their tools and permissions are actually restricted.

Agent teams are a distinct experimental feature in which multiple Claude Code sessions coordinate through shared tasks and messages. Anthropic's documentation marks the feature as disabled by default and lists limitations involving session resumption, task coordination, and shutdown behavior.^[15] Dynamic workflows, introduced in May 2026, can expand a task into parallel subagents based on the work discovered at runtime. Anthropic warns that large fan-out can consume substantial tokens, so limits and monitoring are important.^[16]

Integrations and automation

Claude Code's GitHub Actions integration can respond to an @claude mention in an issue or pull request and perform work on a GitHub-hosted runner. The workflow uses the repository's configured permissions and secrets, and its result can include a commit or pull request. The current documentation describes version 1 of the action as generally available.^[17] The action does not eliminate the need for branch protection, least-privilege workflow permissions, and human review of generated changes.

The Claude Agent SDK exposes the same agent loop and core tools for custom applications. Anthropic provides TypeScript and Python SDKs. An application can add its own tools, permission callbacks, session handling, and deployment model.^[18] The SDK is related to Claude Code but is not the command-line client itself. Applications built with it have their own security, privacy, and licensing responsibilities.

Organizations can authenticate Claude Code directly with Anthropic or configure supported cloud platforms, including Amazon Bedrock, Google Cloud's Agent Platform, and Microsoft Foundry. Provider use changes authentication, model availability, billing, and some data-governance details, so administrators must consult both Anthropic's provider instructions and the selected platform's terms.^[19]

Permissions, sandboxing, and security

Claude Code's permission system classifies tool uses through allow, ask, and deny rules. Deny rules take precedence. Users and administrators can scope rules by tool and, for supported tools, by command or resource pattern.^[7] The initial workspace-trust prompt is a security boundary because a repository can contain project instructions, hooks, MCP configuration, and other material that influences an agent session.

The default interactive posture permits reading needed project content while seeking approval for edits and consequential commands that have not already been allowed. Users can grant narrower or broader permission rules, and managed policy can prohibit dangerous operations. Bypassing permission checks removes an important control and should be limited to an externally isolated environment designed for unattended execution.^[7][4]

Optional sandboxing adds operating-system enforcement around shell subprocesses. Anthropic documents Apple's Seatbelt on macOS and bubblewrap on Linux and Windows Subsystem for Linux 2. The sandbox controls filesystem and network access for supported commands, with broad read access and writes to the working directory under the default configuration. It does not sandbox every action performed by the host application, and privileged or incompatible tools can require exceptions.^[20] Sandboxing reduces risk but does not prove that a permitted command or network request is safe.

Prompt injection is a particular concern when an agent reads source code, issue text, web pages, logs, or tool output controlled by another party. Anthropic describes input filtering, permission prompts, workspace trust, and command analysis as mitigations, while still recommending review and limited access.^[4] No mitigation can guarantee that an autonomous coding session will ignore every malicious or misleading instruction.

Anthropic accepts vulnerability reports for Claude Code through HackerOne. Its published security policy asks researchers not to disclose vulnerabilities publicly before remediation and specifies the reporting channel for the repository.^[21]

Data handling

Data terms depend on how Claude Code is obtained. Anthropic states that commercial users of Team, Enterprise, the API, and supported third-party platforms are not included in model training by default unless their organization opts into a program. Consumer users on Free, Pro, or Max can choose whether their chats and coding sessions may be used to improve models.^[22][23] The applicable consumer or commercial terms, rather than the interface alone, determine the contractual treatment.

Locally run Claude Code stores session transcripts in plaintext under the user's Claude configuration directory. The documented default local retention period is 30 days and can be changed. Users must protect this directory because transcripts can contain source excerpts, command output, and other sensitive context.^[22] Feedback, bug-report, and shared-session submissions are separate voluntary transfers; Anthropic states that submitted transcripts may be retained for five years.^[22]

Hosted Claude Code tasks run in isolated virtual machines. Repository credentials and environment variables should be restricted to what the task needs, and organizations can control network access for compatible configurations.^[8][4] Anthropic states that usage metrics exclude code, prompts, and file paths. Error reports can contain internal error messages and stack traces, with known secret, path, email, and personal-information patterns redacted before transmission.^[22] Administrators should still evaluate the exact telemetry and logging configuration used in their environment.

Installation and authentication

Anthropic recommends its native installer. Supported package-manager routes include Homebrew on macOS and WinGet on Windows. Native installations update automatically by default. npm remains an alternative installation route; as of version 2.1.198, it requires Node.js 22 or later and installs the same platform-specific native binary used by the standalone installer.^[19]

As of July 28, 2026, the documented minimum platforms were macOS 13, Windows 10 version 1809, Ubuntu 20.04, Debian 10, and Alpine Linux 3.19, with at least 4 GB of memory and an x86-64 or ARM64 processor. Windows sessions can use a native installation or Windows Subsystem for Linux. Platform support and installation commands are operational details that can change, so the current installation page should be checked before deployment.^[19]

Direct Anthropic authentication supports paid Pro, Max, Team, and Enterprise access, or metered use through an Anthropic Console account. Claude Code is not included in Anthropic's free plan. Authentication through a supported cloud provider instead uses that provider's identity and billing configuration.^[19] Anthropic's legal guidance says that plan subscribers should use the interactive OAuth login intended for their plan, while applications and services built for other users should use API credentials rather than relaying a personal plan login.^[23]

Plans and pricing

Pricing is time-sensitive. On July 28, 2026, Anthropic listed the following United States prices before applicable tax and subject to usage limits:

Scroll sideways for more →

These prices and entitlements come from Anthropic's pricing and plan documentation, not from a permanent product guarantee.^[24][25] In particular, older descriptions that excluded Team Standard seats from Claude Code are no longer current. Usage allowances are shared across Claude surfaces for a subscriber, and limits vary with model, workload, context length, and plan.^[26] API and cloud-provider use is billed separately under the relevant account.

License and source availability

Anthropic maintains a public GitHub repository for Claude Code release records, issue reporting, and documentation pointers. Public visibility does not by itself grant an open-source license. The repository's license states that Anthropic retains all rights and that use is governed by its commercial terms.^[5] Users should not assume rights to redistribute, modify, or incorporate the client beyond those terms.

The Anthropic API, Claude Agent SDK, MCP servers, extensions, and third-party integrations are separate components. Each can have a different license and contractual boundary. An application built with the Agent SDK is not automatically part of Claude Code, and an open-source MCP server does not make the Claude Code client open source.^[13][18][23]

Release history

Claude Code changes frequently. The following milestones describe product availability and major interfaces rather than every point release:

Scroll sideways for more →

The statement about Opus 5 concerns the product's Opus selection, not a claim that every session or plan used that model by default. Model availability can depend on plan, provider, administrator policy, and release channel.

Associated services

Claude Code Review is a pull-request review service that Anthropic introduced in research preview for Team and Enterprise customers. It assigns multiple agents to examine a change from different perspectives and posts findings for human review. Anthropic states that it does not approve a pull request, leaving that decision to a person. The service uses additional tokens and was separately billed during the preview.^[29]

Claude Code Security is a separate research-preview service for vulnerability analysis and patch suggestions. At launch, Anthropic opened the limited preview to Team and Enterprise customers and invited open-source maintainers to apply for free, expedited access. Suggested findings and patches require human validation; the launch announcement did not establish that the system detects every vulnerability or that its suggestions are safe to apply automatically.^[28]

These services should not be conflated with the local client's ordinary code explanation, testing, and review capabilities. Their availability, billing, execution environment, and data handling can differ from an interactive Claude Code session.

Research and evaluation

Evidence about Claude Code's use and effects remains limited and should be separated from product marketing. Three 2026 studies provide useful but non-equivalent observations.

An Anthropic-authored analysis examined roughly 400,000 interactive Claude Code sessions from about 235,000 people between October 2025 and April 2026. Using privacy-preserving, model-based classifiers, the authors estimated that people made about 70 percent of planning decisions and about 20 percent of execution decisions in the sampled interactions.^[31] The report characterizes patterns in Anthropic's own product data. It is not an independent audit, a randomized comparison, or evidence that a particular division of decisions produces better software.

Santos and colleagues studied 328 CLAUDE.md configuration files drawn from the 100 most popular public projects in their sample. Their workshop paper found that architecture and system-design guidance was a common concern in these files and proposed a taxonomy of configuration practices.^[32] The sample covers prominent public repositories, not typical private projects, and the authors note that one researcher performed the initial classification before review by two others. The findings describe published configuration files during a fast-changing period rather than a universal best-practice standard.

Murphy-Hill and colleagues reported an observational analysis of command-line coding-agent adoption among tens of thousands of Microsoft engineers in early 2026. Across the evaluated tools, adopters produced about 24 percent more merged pull requests than an estimated no-adoption counterfactual. In a tool-specific within-person analysis, weeks with any Claude Code use were associated with an 11.4 percent increase in merged pull requests, with a reported 95 percent confidence interval from 9.4 to 13.6 percent.^[33] The 24 percent estimate must not be attributed to Claude Code alone. The paper is a preprint, merged pull requests are an incomplete proxy for productivity and quality, and observational deployment data cannot establish that the tool caused the entire measured difference.

No single benchmark captures Claude Code's practical reliability. Repository-level coding tasks such as SWE-bench test model and agent performance under controlled conditions, while deployed results also depend on project instructions, available tools, permissions, test quality, repository complexity, and human review. Performance claims should identify the model, client version, environment, task set, and evaluation method.

Limitations

Claude Code inherits limitations of large language models and adds risks associated with real tool access. It can misunderstand requirements, make unnecessary edits, select an incorrect dependency, write insecure code, misread tool output, or stop after a locally plausible result. Tests can reduce these risks only when they cover the relevant behavior and are themselves correct.

The agent's effectiveness depends strongly on the environment. Missing build tools, stale dependencies, unavailable services, weak project documentation, oversized repositories, or a limited context window can prevent a reliable result. Parallel agents can increase coverage but also increase cost, duplicate work, and create conflicting changes.^[14][16]

Permission prompts, deny rules, sandboxing, and isolated hosted environments reduce different kinds of risk but do not form an absolute security boundary. Allowed commands can still be destructive, network responses can still contain hostile instructions, and credentials can still authorize actions outside the repository. Checkpoints omit changes made through shell commands and external tools.^[10][7][20]

Finally, the product's interfaces, models, plan entitlements, pricing, and point releases change frequently. A factual account should attach dates to mutable details and prefer current official documentation for deployment decisions. Self-reported adoption, productivity, security, and quality claims require independent validation before they are treated as general evidence.

See also

• Artificial intelligence
• Large language model
• Software development
• Claude Agent SDK
• Claude Code subagents
• Claude Opus 5

References

1. ^Anthropic. "Claude 3.7 Sonnet and Claude Code." February 24, 2025. anthropic.com/...claude-3-7-sonnet
2. ^Anthropic. "Introducing Claude 4." May 22, 2025. anthropic.com/...claude-4
3. ^Anthropic. "Claude Code overview." Accessed July 28, 2026. code.claude.com/...overview
4. ^Anthropic. "Security." Accessed July 28, 2026. code.claude.com/...security
5. ^Anthropic. "Claude Code license." Accessed July 28, 2026. raw.githubusercontent.com/...LICENSE.md
6. ^Anthropic. "How Claude remembers your project." Accessed July 28, 2026. code.claude.com/...memory
7. ^Anthropic. "Configure permissions." Accessed July 28, 2026. code.claude.com/...permissions
8. ^Anthropic. "Claude Code on the web." Accessed July 28, 2026. code.claude.com/...claude-code-on-the-web
9. ^Anthropic. "Claude Code on the web." October 20, 2025. claude.com/...claude-code-on-the-web
10. ^Anthropic. "Checkpointing." Accessed July 28, 2026. code.claude.com/...checkpointing
11. ^Anthropic. "Extend Claude with skills." Accessed July 28, 2026. code.claude.com/...slash-commands
12. ^Anthropic. "Automate workflows with hooks." Accessed July 28, 2026. code.claude.com/...hooks
13. ^Anthropic. "Connect Claude Code to tools via MCP." Accessed July 28, 2026. code.claude.com/...mcp
14. ^Anthropic. "Create custom subagents." Accessed July 28, 2026. code.claude.com/...sub-agents
15. ^Anthropic. "Orchestrate teams of Claude Code sessions." Accessed July 28, 2026. code.claude.com/...agent-teams
16. ^Anthropic. "Introducing dynamic workflows in Claude Code." May 28, 2026. claude.com/...ing-dynamic-workflows-in-claude-code
17. ^Anthropic. "Claude Code GitHub Actions." Accessed July 28, 2026. code.claude.com/...github-actions
18. ^Anthropic. "Claude Agent SDK overview." Accessed July 28, 2026. code.claude.com/...overview
19. ^Anthropic. "Advanced setup." Accessed July 28, 2026. code.claude.com/...getting-started
20. ^Anthropic. "Configure the sandboxed Bash tool." Accessed July 28, 2026. code.claude.com/...sandboxing
21. ^Anthropic. "Security policy." Accessed July 28, 2026. raw.githubusercontent.com/...SECURITY.md
22. ^Anthropic. "Data usage." Accessed July 28, 2026. code.claude.com/...data-usage
23. ^Anthropic. "Legal and compliance." Accessed July 28, 2026. code.claude.com/...legal-and-compliance
24. ^Anthropic. "Plans and pricing." Accessed July 28, 2026. claude.com/pricing
25. ^Anthropic Help Center. "Use Claude Code with your Team or Enterprise plan." Accessed July 28, 2026. support.claude.com/...your-team-or-enterprise-plan
26. ^Anthropic Help Center. "How do usage and length limits work?" Accessed July 28, 2026. support.claude.com/...usage-and-length-limits-work
27. ^Anthropic. "Enabling Claude Code to work more autonomously." September 29, 2025. anthropic.com/...de-code-to-work-more-autonomously
28. ^Anthropic. "Making frontier cybersecurity capabilities available to defenders." February 20, 2026. anthropic.com/...claude-code-security
29. ^Anthropic. "Bringing Code Review to Claude Code." March 9, 2026. claude.com/...code-review
30. ^Anthropic. "Claude Code release feed." Accessed July 28, 2026. raw.githubusercontent.com/...feed.xml
31. ^Zoe Hitzig, Maxim Massenkoff, Eva Lyubich, Ryan Heller, and Peter McCrory. "Agentic coding and persistent returns to expertise." Anthropic, June 16, 2026. cdn.sanity.io/...0db1a52ebf0b8c6600f057b6908c5.pdf
32. ^Hélio Victor F. Santos, Vitor Costa, João Eduardo Montandon, and Marco Tulio Valente. "Decoding the Configuration of AI Coding Agents: Insights from Claude Code Projects." Accepted at the 1st International Workshop on Agentic Engineering, pages 63-67; arXiv:2511.09268, revised May 25, 2026. arxiv.org/...2511.09268
33. ^Emerson Murphy-Hill, Jenna Butler, and Alexandra Savelieva. "Adoption and Impact of Command-Line AI Coding Agents: A Study of Microsoft's Early 2026 Rollout of Claude Code and GitHub Copilot CLI." arXiv:2607.01418, July 1, 2026. arxiv.org/...2607.01418