Claude SDK for Go 1.68.0

Apply the Go 1.27 baseline first. These rules cover github.com/anthropics/anthropic-sdk-go v1.68.0, whose minimum Go version is 1.24. Apply the optional tool, session, MCP, and cloud integration rules when those features are enabled.

Clients and credentials

• Construct anthropic.NewClient in trusted server code. Select credentials deliberately: defaults try API-key and auth-token environment variables, an explicit profile, environment federation, then the fallback profile. Use option.WithoutEnvironmentDefaults() with explicit credentials and a configured HTTP client when the application owns credential selection.
• Protect ANTHROPIC_BASE_URL, profile/config directories, federation token files, and all client or per-request options as deployment configuration. Keep option.WithBaseURL, WithHeader, WithMiddleware, and raw client.Execute/Get/Post paths out of user control; absolute URLs can retain the client's authentication and retry settings.
• Supply a trusted HTTPS endpoint and an option.WithHTTPClient whose CheckRedirect rejects unexpected redirects before credentials leave the approved origin; do not assume Go strips the SDK's X-Api-Key header on redirects.
• Bind credentials, anthropic-workspace-id, UserProfileID, and provider resource IDs to the authenticated application tenant. Keep organization administration, federation, vault, and deployment operations behind separate privileged authorization; exposing client.Beta.Organization is not a tenant access-control layer.
• Scope federation with option.FederationOptions.WorkspaceID at