@anthropic-ai/sdk

About

The official TypeScript library for the Anthropic API

What detecting @anthropic-ai/sdk tells you about a site

@anthropic-ai/sdk reveals an integration with Anthropic's Claude models. Like other model SDKs it is key-bearing and server-side by design, so a client-side appearance signals a leaked credential. Its presence tells you the product builds on Claude specifically — often for longer-context reasoning, tool use or agentic features.

Why the exact @anthropic-ai/sdk version matters

The SDK tracks Anthropic's API and model families (message streaming, tool use, the latest Claude versions); the exact version tells you which API capabilities the integration can use.

@anthropic-ai/sdk in a real-world stack

When you find @anthropic-ai/sdk in a bundle, it rarely travels alone. Frequently the Vercel ai SDK as a unifying layer, and a server runtime holding the API key.

Quick facts

Common pairings

Packages this one expects to find in the same project. Each is also a Sourcemap Explorer detection target.

What @anthropic-ai/sdk pulls in

@anthropic-ai/sdk declares 2 direct dependencies — each one also rides into any bundle that ships @anthropic-ai/sdk, so they are detection targets too. Reading them is a quick way to understand the package's real footprint .

How Sourcemap Explorer detects @anthropic-ai/sdk

@anthropic-ai/sdk ships as v0.115.0, published 2026-07-24 and carries 2 direct dependencies, 1 peer dependency (zod), 195 versions on the registry. Those exact numbers are the footprint Sourcemap Explorer matches when @anthropic-ai/sdk rides inside a deployed bundle — here is how the detection works.

We catch @anthropic-ai/sdk from two complementary signals: bundled source paths and the embedded package.json. Modern bundlers (webpack, Vite, esbuild, Rollup, Turbopack) preserve the original node_modules/@anthropic-ai/sdk/ paths inside the JavaScript sourcemap's sources[] array — that's the canonical signal. When the matching package.json is also captured in sourcesContent[], we read the exact version field — patch number included. No regex guessing, no version inference.

1. 1

   Confirm the site exposes sourcemaps

   In DevTools Network, check the response headers of any application script for `SourceMap` or `X-SourceMap`. Failing that, fetch the script's last 4 KB and look for a `//# sourceMappingURL=` comment — that map is where the `@anthropic-ai/sdk` paths live.

2. 2

   Find the package in the bundle

   Open DevTools → Network → reload. Click any application script and look at its sourcemap. Inside, search `sources[]` for entries matching `node_modules/@anthropic-ai/sdk/` — every match confirms the package is bundled. The matching `sourcesContent[i]` for `node_modules/@anthropic-ai/sdk/package.json` gives you the exact installed version.

3. 3

   Read the version directly from package.json

   Run `jq -r '. as $m | $m.sources | to_entries[] | select(.value | endswith("node_modules/@anthropic-ai/sdk/package.json")) | $m.sourcesContent[.key] | fromjson | .version' bundle.js.map`. Sourcemap Explorer automates the same query in the popup.

Recent security advisories for @anthropic-ai/sdk

The 2 most recent advisories affecting some versions of @anthropic-ai/sdk, aggregated from OSV.dev (GitHub Advisory + CVE data). A listing here doesn't mean the version a given site ships is affected — each advisory applies to a specific version range. Sourcemap Explorer reads the exact bundled version so you can check it against these ranges.

1. MODERATECVE-2026-41686· 2026-04-29

   Claude SDK for TypeScript has Insecure Default File Permissions in Local Filesystem Memory Tool

2. MODERATECVE-2026-34451· 2026-04-01

   Claude SDK for TypeScript: Memory Tool Path Validation Allows Sandbox Escape to Sibling Directories

Recent versions

@anthropic-ai/sdk README

Live mirror of the GitHub README, for reference. Updated whenever the repo's default branch changes.

npm install @anthropic-ai/sdk

import Anthropic from '@anthropic-ai/sdk';

const client = new Anthropic({
  apiKey: process.env['ANTHROPIC_API_KEY'], // This is the default and can be omitted
});

const message = await client.messages.create({
  max_tokens: 1024,
  messages: [{ role: 'user', content: 'Hello, Claude' }],
  model: 'claude-opus-4-6',
});

console.log(message.content);

FAQ