claude-api-guard Scans AI SDK Changes in CI, but Misses Raw HTTP Calls

claude-api-guard is built to catch known Anthropic and OpenAI API changes before they become production failures. But the GitHub Action examines selected official SDK call patterns rather than all AI API traffic, leaving raw HTTP integrations and some indirect code paths beyond its current view.

The tool runs on pull requests or pushes and fails CI on HIGH-severity findings by default; MEDIUM and LOW findings can be reported without blocking a merge. It needs no API key for scanning and makes no runtime LLM calls because its rules ship with the project. It can also auto-fix some mechanical updates.

A scheduled maintenance process reads provider release notes and uses an Anthropic API call to propose rules. Those proposals do not go live automatically: each one must clear a human-reviewed pull request. The current Anthropic set combines 10 hand-extracted rules with automatically extracted additions. OpenAI support consists of four hand-seeded, Python-only rules and is not part of that synchronization process.

The scanner uses an abstract syntax tree, a structured representation of program code, rather than matching text across whole files. The project says adding import and asynchronous-context checks cut false matches from unrelated code in its LiteLLM test.

Current coverage boundaries

• Detection covers Python use of Anthropic and OpenAI SDKs, plus first-pass JavaScript and TypeScript support for Anthropic’s SDK.
• Raw HTTP requests that bypass official SDK call shapes are not currently detected.
• Heavily indirect calls can be missed, and Go and other non-Python or non-JavaScript languages are unsupported.

That makes a clean result a compatibility signal for the supported code shapes, not a complete inventory of a team’s exposure to provider changes. Teams with custom request layers must validate those integrations by another route.

The project uses the Business Source License 1.1. Commercial use and self-hosting are allowed, but operating a competing paid hosted service is restricted until September 1, 2030, when the license converts to MIT.