Anthropic SDK for PHP 0.47.0

Last reviewed Sep 24, 2026

Export as PDF

Prompt Details

Prompt Composition

2prompts
  1. PHP 8.5145 lines · 5.4K tokens
  2. Anthropic SDK for PHP 0.47.0154 lines · 6.9K tokens
Total299 lines · 12.3K tokens

CWE Coverage

  • 20
  • 22
  • 59
  • 78
  • 79
  • 88
  • 89
  • 95
  • 98
  • 117
  • 187
  • 201
  • 208
  • 209
  • 214
  • 250
  • 256
  • 295
  • 323
  • 338
  • 340
  • 347
  • 352
  • 354
  • 367
  • 384
  • 390
  • 404
  • 409
  • 434
  • 470
  • 488
  • 502
  • 522
  • 532
  • 552
  • 601
  • 611
  • 613
  • 614
  • 639
  • 674
  • 675
  • 732
  • 770
  • 776
  • 798
  • 799
  • 807
  • 829
  • 862
  • 915
  • 916
  • 918
  • 940
  • 1004
  • 1050
  • 1275
  • 1333
  • 1395
  • 1426
  • 1427

Prompt Preview

Apply the PHP 8.5 baseline first. These rules cover anthropic-ai/sdk 0.47.0 on PHP 8.5: credentials and workspaces, Messages, tools and MCP, streaming, files and skills, batches, webhooks, Managed Agents, cloud backends, retries, middleware, and errors. Composer accepts PHP ^8.1; that compatibility floor does not mean PHP 8.1 still receives security fixes.

Client identity, credentials, and workspaces

  • Construct Anthropic\Client only in trusted server or worker code; never ship a reusable API key, bearer token, refresh token, or webhook secret to a browser or other untrusted client.
  • Choose one credential mode: an explicit credentials provider, apiKey, or authToken. Without a provider, the base client accepts both non-empty static values and sends both X-Api-Key and Authorization; remove competing environment credentials rather than assuming a constructor argument disables the other mode.
  • Prefer Workload Identity Federation for production workloads and an identity-backed service-account key when federation is unavailable; keep personal and organization-administration credentials out of shared services.
  • Resolve the intended identity before accepting work. An explicit credentials argument takes precedence; otherwise explicit or environment static credentials precede profiles and direct federation variables. Missing or malformed profile data can fall through to another source; automatic profile/federation discovery runs only for the base Client, not its subclasses.
  • Treat ANTHROPIC_PROFILE, ANTHROPIC_CONFIG_DIR, active_config, and the