Anthropic SDK for Java 2.59.0

Apply the Java 25 baseline first. The SDK supports Java 8 and later; use these rules for Java 25 applications using Anthropic SDK for Java 2.59.0. Apply the optional tool, Managed Agents, and webhook rules when those surfaces are enabled.

Clients and credentials

• Construct AnthropicOkHttpClient or AnthropicOkHttpClientAsync in trusted server code with service credentials scoped to the intended workspace; never put API keys or bearer tokens in Messages, tool arguments, or distributed client applications.
• Treat fromEnv() as credential discovery, not just an API-key lookup: control anthropic.apiKey, anthropic.authToken, and anthropic.baseUrl system properties as well as their ANTHROPIC_* environment counterparts; system properties win. Protect ANTHROPIC_PROFILE, ANTHROPIC_CONFIG_DIR, profile/cache files, and federation token sources because discovery can select credentials from disk or workload identity.
• Fix baseUrl, backend, proxy, and custom transport configuration in deployment policy; allow only approved HTTPS origins, including any changes through withOptions(). Do not let request data or model output choose credential destinations or weaken sslSocketFactory, trustManager, or hostnameVerifier verification.
• Enforce the same destination policy on every redirect through a transport that disables redirects or validates each hop before sending credentials, backed by egress restrictions. The SDK retains OkHttp's redirect defaults; do not assume its handling of Authorization protects x-api-key or other custom secret headers.