Claude SDK for Go 1.70.1

Last reviewed Sep 20, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. Go 1.27130 lines · 5.5K tokens
  2. Claude SDK for Go 1.70.1137 lines · 6.1K tokens
Total267 lines · 11.6K tokens

CWE Coverage

  • 15
  • 20
  • 22
  • 59
  • 78
  • 79
  • 89
  • 94
  • 117
  • 190
  • 201
  • 208
  • 209
  • 214
  • 250
  • 252
  • 257
  • 287
  • 294
  • 295
  • 307
  • 323
  • 327
  • 338
  • 347
  • 352
  • 362
  • 367
  • 378
  • 426
  • 444
  • 488
  • 494
  • 532
  • 636
  • 639
  • 732
  • 759
  • 770
  • 772
  • 807
  • 829
  • 862
  • 863
  • 915
  • 916
  • 918
  • 942
  • 1004
  • 1275
  • 1395
  • 1427
  • 1428

Prompt Preview

Apply the Go 1.27 baseline first. These rules cover github.com/anthropics/anthropic-sdk-go v1.70.1, which requires Go 1.24 or newer: client construction, credential resolution, request options, Messages, the beta tool runner, the local agent toolset, streaming, files and skills, webhooks, and error handling.

Client construction and credential resolution

  • Build anthropic.NewClient only in trusted server or worker code, because any process holding a reusable Claude credential is a disclosure boundary.
  • Use option.WithoutEnvironmentDefaults() with your chosen option.WithAPIKey, option.WithAuthToken, or federation provider when the application owns credential resolution; adding an explicit credential alone does not disable environment endpoint or profile settings.
  • Know the resolution order before depending on it: ANTHROPIC_API_KEY, then ANTHROPIC_AUTH_TOKEN, then the profile named by ANTHROPIC_PROFILE, then env-var federation, then the fallback profile from active_config or the literal default.
  • Treat ANTHROPIC_CUSTOM_HEADERS as trusted deployment input; its newline-separated headers are loaded only when the default credential chain reaches its end without selecting a source.
  • Protect ANTHROPIC_CONFIG_DIR, XDG_CONFIG_HOME, APPDATA, the active_config pointer, configs/<profile>.json, and the referenced credentials files from tenant-controlled writes; profiles can choose credentials, token files, workspace, and base URL.
  • Review a loaded profile's base_url and workspace_id even when explicit credentials shadow it: non-credential