Claude Agent SDK

​

Supported surface

​

Install

pip install egisai claude-agent-sdk

​

Use

import asyncio
import egisai
from claude_agent_sdk import ClaudeSDKClient, ClaudeAgentOptions

egisai.init(app="research-agent", env="production")

async def main():
    options = ClaudeAgentOptions(
        system_prompt="You are a helpful research assistant.",
        allowed_tools=["Read", "WebSearch"],
    )
    async with ClaudeSDKClient(options=options) as client:
        await client.query("Summarize today's headlines.")
        async for message in client.receive_response():
            print(message)

asyncio.run(main())

​

What gets enforced

1. Input phase — the prompt text is evaluated against your request-phase policies (PII detection, regex denylist, model allow-list, size cap, intent judge). A block refuses the turn before the subprocess starts.
2. PreToolUse — for each tool the model wants to call, the SDK runs output-side policies that target tool dispatches (deny_tool_call, deny_mcp_call, deny_bash_command, deny_db_query, deny_financial_action, semantic_guard with targets: ["tool_calls"]). A block returns permissionDecision: deny to the CLI; the tool never runs.
3. PostToolUse — for each tool that ran, the SDK evaluates output-side policies against the tool’s response text (pii_scan, deny_output_regex, semantic_guard). A sanitize verdict masks the result in place via the SDK’s updatedToolOutput / updatedMCPToolOutput substitution contract; a block replaces the result with a refusal payload — in both cases the model never sees the raw bytes.
4. End-of-turn — the aggregated assistant response (text + structured tool calls) is evaluated one more time.

• MCP-shaped responses — {"content": [{"type": "text", "text": "..."}]}. PII in text parts is masked or replaced; non-text parts (images, audio) pass through untouched.
• Raw-string responses — typical of Bash, Read, Write, … Replaced via updatedToolOutput.
• Opaque-dict responses — JSON-serialized for scanning, then replaced via updatedToolOutput.

​

Audit fidelity

​

Access inventory

• mcp_servers — one MCP-server entry per configured server (name + transport label only — never the command, URL, or credentials). In-process SDK servers built with create_sdk_mcp_server additionally contribute full tool metadata (name, PII-sanitized description, parameter names, schema hash).
• allowed_tools — built-in tool names and fully-qualified mcp__… names granted to the session. Permission specifiers such as Bash(git:*) and server-level grants (mcp__<server>) are understood.
• The CLI’s init system message — the toolset the subprocess actually loaded, filtered through allowed_tools.

​

Backwards compatibility

​

When a call is blocked

egisai.init(..., on_block="stub")

​

What’s next