Anthropic SDK for Java 3.3

Last reviewed Oct 25, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. Java 25113 lines · 2.8K tokens
  2. Anthropic SDK for Java 3.341 lines · 2.1K tokens
Total154 lines · 4.9K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 78
  • 79
  • 88
  • 89
  • 94
  • 95
  • 117
  • 190
  • 201
  • 208
  • 209
  • 214
  • 294
  • 295
  • 297
  • 323
  • 327
  • 338
  • 347
  • 362
  • 367
  • 378
  • 427
  • 470
  • 471
  • 488
  • 494
  • 502
  • 532
  • 611
  • 639
  • 653
  • 681
  • 732
  • 770
  • 772
  • 776
  • 789
  • 807
  • 841
  • 862
  • 863
  • 915
  • 916
  • 918
  • 922
  • 942
  • 1333
  • 1426
  • 1427

Prompt Preview

Apply these rules to code using the Anthropic Java SDK, including its optional cloud backends, tool runner, MCP bridge, and webhook helpers. The included Java baseline is for Java 25 deployments; the SDK itself also supports older Java runtimes.

Credentials and tenant boundaries

  • Construct AnthropicOkHttpClient with one intended credential source. If using fromEnv(), control ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, ANTHROPIC_PROFILE, ANTHROPIC_CONFIG_DIR, corresponding anthropic.* system properties, and the profile/cache files for the process identity; do not let an untrusted request choose a profile or configuration directory. Prefer workload identity to long-lived keys when available, and keep credential files private.
  • Bind MessageCreateParams.workspaceId(...) and userProfileId(...) to the authenticated principal and authorized workspace. Do not let request JSON, model output, or a tool result choose either value or a credential-bearing client. Give administrative client.organization() calls a separate, narrowly authorized client and credential.
  • Treat putAdditionalHeader, additionalHeaders, putAdditionalQueryParam, and raw JSON setters as privileged escape hatches. Never let untrusted input set Authorization, X-Api-Key, workspace, beta, or routing headers; an existing authentication header suppresses the SDK's configured static credential. Review each use for tenant and authentication changes.
  • Keep AnthropicOkHttpClient.Builder.baseUrl, .proxy, and .backend under deployment control. For cloud backends, bind workspace,