Superpower Daily
C3.ai Cuts Costs and Repairs Margins, but Revenue Still Falls 2...GPT-6 Astra Hits 99.9% on ARC-AGI-3, but Scores 62.7% in a Shar...Anthropic Nears $15 Billion Credit Facility Before Its Public I...Crusoe Signs Reported $13 Billion, Five-Year AI Cloud Deal With...Tesla Says 45 Cybercabs Are Registered for Texas Robotaxi Netwo...Microsoft Releases MAI-Transcribe-2 at 10 Cents an HourC3.ai Cuts Costs and Repairs Margins, but Revenue Still Falls 2...GPT-6 Astra Hits 99.9% on ARC-AGI-3, but Scores 62.7% in a Shar...Anthropic Nears $15 Billion Credit Facility Before Its Public I...Crusoe Signs Reported $13 Billion, Five-Year AI Cloud Deal With...Tesla Says 45 Cybercabs Are Registered for Texas Robotaxi Netwo...Microsoft Releases MAI-Transcribe-2 at 10 Cents an Hour
Toolspublished

claude-api-guard Scans AI SDK Changes in CI, but Misses Raw HTTP Calls

The GitHub Action can block known, high-severity SDK compatibility problems before a merge and fix some mechanical changes. Its coverage remains tied to recognizable official SDK patterns and a limited set of languages.

By 2 min read
claude-api-guard Scans AI SDK Changes in CI, but Misses Raw HTTP Calls
claude-api-guard Scans AI SDK Changes in CI, but Misses Raw HTTP Calls

Listen to this story

The audio brief

About 1:42
0:001:42
Read transcript
Claude API Guard can now stop a pull request when it spots certain high-severity Anthropic or OpenAI SDK compatibility problems—and it can automatically fix some mechanical changes. But its biggest limitation is also clear: it does not scan all AI traffic. The GitHub Action looks for recognizable official SDK call patterns, so raw HTTP requests, heavily indirect calls, and unsupported languages can pass unnoticed.\n\nThe scanner runs in CI on pull requests or pushes. HIGH findings fail the build by default, while MEDIUM and LOW findings can be reported without blocking a merge. It needs no API key and makes no runtime model calls; its rules are packaged with the project. Under the hood, it uses an abstract syntax tree, or AST, to understand code structure instead of matching text across files. The project says that adding import and asynchronous-context checks reduced false matches in tests involving six public repositories, including a LiteLLM test.\n\nCoverage is uneven. Anthropic support includes 10 hand-extracted rules plus automatically extracted additions, with first-pass support for Python, JavaScript, and TypeScript. OpenAI support has four manually seeded, Python-only rules. A scheduled process uses an Anthropic API call to propose updates from release notes, but every change still requires a human-reviewed pull request.\n\nThe key constraint is simple: a clean result covers supported code shapes, not every integration. Teams using custom request layers, Go, or other unsupported languages still need another validation method. The project’s Business Source License permits commercial use and self-hosting, while restricting competing paid hosted services until September 1st, 2030, when it converts to MIT.

Story brief

3 key points

claude-api-guard offers CI checks for selected Anthropic and OpenAI SDK patterns, with default blocking only for HIGH-severity findings. Its AST-based rules can auto-fix some changes and require no API key or runtime model calls, but they do not cover raw HTTP requests, heavily indirect paths, or unsupported languages. Anthropic rules are partly synchronized through human-reviewed pull requests; OpenAI has four...

  1. 01

    Anthropic coverage combines 10 hand-extracted rules with automatically extracted additions; OpenAI coverage remains four hand-seeded Python rules.

  2. 02

    HIGH findings fail CI by default; MEDIUM and LOW findings can be reported without blocking merges.

  3. 03

    A maintenance job uses an Anthropic API call to propose rules, but human-reviewed pull requests gate every update.

claude-api-guard is built to catch known Anthropic and OpenAI API changes before they become production failures. But the GitHub Action examines selected official SDK call patterns rather than all AI API traffic, leaving raw HTTP integrations and some indirect code paths beyond its current view.

The tool runs on pull requests or pushes and fails CI on HIGH-severity findings by default; MEDIUM and LOW findings can be reported without blocking a merge. It needs no API key for scanning and makes no runtime LLM calls because its rules ship with the project. It can also auto-fix some mechanical updates.

A scheduled maintenance process reads provider release notes and uses an Anthropic API call to propose rules. Those proposals do not go live automatically: each one must clear a human-reviewed pull request. The current Anthropic set combines 10 hand-extracted rules with automatically extracted additions. OpenAI support consists of four hand-seeded, Python-only rules and is not part of that synchronization process.

The scanner uses an abstract syntax tree, a structured representation of program code, rather than matching text across whole files. The project says adding import and asynchronous-context checks cut false matches from unrelated code in its LiteLLM test.

Current coverage boundaries

  • Detection covers Python use of Anthropic and OpenAI SDKs, plus first-pass JavaScript and TypeScript support for Anthropic’s SDK.
  • Raw HTTP requests that bypass official SDK call shapes are not currently detected.
  • Heavily indirect calls can be missed, and Go and other non-Python or non-JavaScript languages are unsupported.

That makes a clean result a compatibility signal for the supported code shapes, not a complete inventory of a team’s exposure to provider changes. Teams with custom request layers must validate those integrations by another route.

The project uses the Business Source License 1.1. Commercial use and self-hosting are allowed, but operating a competing paid hosted service is restricted until September 1, 2030, when the license converts to MIT.

Sources

  1. github.comGitHub - MarkMoneyMan/Claude-api-goat: nice

Related coverage

Continue reading