Rating certificate · AW/26-09/18626 Sept 2026
79of 100
The Register / Multi-agent frameworks / Claude Agent SDK
Register entry · Multi-agent frameworks · updated 26 Sept 2026
Claude Agent SDK
The Claude Agent SDK packages the agent harness behind Claude Code as a library for Python (claude-agent-sdk) and TypeScript (@anthropic-ai/claude-agent-sdk). It runs the Claude Code binary as a subprocess and exposes built-in file, shell and web tools, permission modes, hooks, subagents, MCP, skills and on-disk sessions. It works only with Claude models. Use is governed by Anthropic's Commercial Terms; a planned June 2026 change to how subscription usage is billed was paused.
What reviewers and users praise
- Gives custom agents most Claude Code capabilities (plan mode, subagents, todo lists) out of the box (HN)
- Practitioner review found subagents and session persistence solid enough to build on (Kyle Redelinghuys, Mar 2026)
- Defining agents and subagents needs little ceremony compared with AutoGen (r/AutoGenAI)
- Very frequent releases: 49 Python releases in 90 days
What they criticise
- Claude-only; runs a CLI subprocess rather than a pure library, adding deployment complexity (Kyle Redelinghuys review; r/ClaudeAI scaling thread)
- Subscription-billing policy for SDK use has been unstable and confusingly documented (HN, r/ClaudeCode)
- Inherits the bundled Claude Code CLI's long CVE list, plus a critical SDK argument-injection CVE in 2026
Experts vs the crowdneeds both scores
Experts—
Crowd58
| Price | Free |
|---|---|
| Use it via | API, CLI |
| Runs on | macos, linux, windows |
| Licence | proprietary |
| Updated | Evidence collected 26 Sept 2026 |
How the rating was worked out
Weights for Multi-agent frameworks: adoption 45%, experts 30%, crowd 25%. Pillars without enough evidence are left out and the others re-weighted. The method.
| Adoption & momentumweight 45% | 90 | GitHub stars 8.2k → 58 · npm weekly downloads 10M → 100 · PyPI monthly downloads 29M → 100 · 49 releases in 90 days → 100reach × 0.7 + momentum × 0.3 |
|---|---|---|
| Expertsindependent reviews · weight 30% | — | Only 1 independent review (3 needed) |
| Crowdcommunity sample · weight 25% | 58 | 14 dated posts from hackernews, reddit: 7 positive · 3 mixed · 4 negative (positive + ½ mixed) ÷ n, averaged toward 50 for small samples |
| Rating | 79 | Provisional: low confidence (2 of 3 pillars, 14 community posts). |
Editorial adjustment. Incident-history re-grade under methodology revision 2 (see the trust section).
Trust & safety
Seven dimensions graded A–D from documented facts. Overall: B.
B
Permission model
Documented permission modes (default, dontAsk, acceptEdits, bypassPermissions, plan, auto), allow/deny/ask rules, hooks and a canUseTool approval callback. Default mode sends calls that need approval to the callback. No sandbox on by default in the SDK. source
A
Data access scope
Scoped and documented: working directory plus additionalDirectories, path-scoped Read/Edit rules, tool allow/deny lists; acceptEdits applies only inside those directories. source
A
Data storage
Runs in the developer's process; sessions are written locally under ~/.claude/projects/<encoded-cwd>/*.jsonl, can be disabled (persistSession: false in TypeScript) or mirrored to the developer's own store. source
A
Data retention & training
With API keys (Commercial Terms): Anthropic says it will not use inputs/outputs from commercial products to train models by default, and deletes API inputs/outputs within 30 days; zero data retention available by agreement. source
C
Incident history (24 months)
Repeated serious issues: the SDK runs the Claude Code binary, which has 25+ published high/medium CVEs in 24 months (permission-prompt bypasses, sandbox escapes, trust-dialog bypasses), all with fixed versions; plus a critical SDK-specific argument-injection CVE fixed in claude-agent-sdk 0.2.121. Regraded from D: Revision 2: serious issues that were each fixed and publicly disclosed grade C; D is kept for unresolved issues or slow or undisclosed fixes. source
A
Compliance
Anthropic lists SOC 2 Type I & Type II, ISO 27001:2022 and ISO/IEC 42001:2023, plus HIPAA-ready configuration (BAA available). source
B
Transparency
Python wrapper repo is MIT, but the SDK runs the closed-source Claude Code binary and its use is governed by Anthropic's Commercial Terms; detailed public CHANGELOGs for both SDKs and extensive docs. source
The experts
1 named independent reviews found; dated reviews from the last 12 months are scored.
- positive
The subagent model and session persistence are solid enough to build on, and they solve the specific problems I was running into cleanly enough
Kyle Redelinghuys (ksred.com) · 2 Mar 2026 · ksred.com
The crowd
14 coded posts from hackernews, reddit.
7 positive3 mixed4 negative
- mixed
It's pretty unclear because they have two somewhat competing sets of documentation
news.ycombinator.com comment · 23 Sept 2026 · news.ycombinator.com - mixed
it has the drawbacks of being forced through the claude-sdk. You would still be using the claude system prompt etc.
news.ycombinator.com comment · 17 Sept 2026 · news.ycombinator.com - positive
if you use Claude agent sdk you still can have plan mode, questions, todo lists, sub agents, background tasks, workflows, nearly everything that Claude code has
news.ycombinator.com comment · 11 Sept 2026 · news.ycombinator.com - positive
I literally have voice agents via claude agent sdk + Pipecat
news.ycombinator.com comment · 30 Jul 2026 · news.ycombinator.com - positive
I built a UAT agent on top of claude-agent-sdk, it uses Playwright and can spin up a preview instance for PRs we open.
news.ycombinator.com comment · 2 Jul 2026 · news.ycombinator.com - positive
I built this a few months ago for our company slack using claude agent sdk
news.ycombinator.com comment · 24 Jun 2026 · news.ycombinator.com - negative
I’m about to give up building projects on top of the frameworks these companies provide, I thought I was doing everything right with using the Claude Agent SDK
news.ycombinator.com comment · 14 May 2026 · news.ycombinator.com - positive
This is sweet because I can prototype all sorts of agents with Claude Code embedded inside, at a predictable monthly cost.
news.ycombinator.com comment · 21 Apr 2026 · news.ycombinator.com
Pricing
As published, checked 26 Sept 2026.
| Plan | Price | Notes |
|---|---|---|
| SDK | Free | No charge for the library; Claude usage billed at Anthropic API token rates with an API key. |
| Claude subscription (own use) | Custom | Per Anthropic support (update June 15, 2026), SDK and claude -p usage still draw from the subscription's usage limits; third-party developers may not offer claude.ai login in their products unless approved. |
Recent changes
- 12 Sept 2026
Security advisory CVE-2026-96620 published for the Python SDK (fixed in 0.2.121, released 2026-07-17). source
- 15 Jun 2026
Anthropic paused the announced move of SDK / claude -p usage off subscription limits onto a separate monthly credit; usage still draws from plan limits. source
- 13 May 2026
Anthropic announced that from June 15, 2026 SDK and claude -p usage would stop counting toward plan limits and move to a monthly Agent SDK credit (later paused). source
Sources
Every figure above traces to one of these, observed up to 26 Sept 2026.