The Stack — Claude Code

Claude Code is an agentic coding assistant that runs in your terminal and operates directly on your codebase

What It Is

Claude Code is Anthropic’s terminal-native coding agent, launched in early 2025 and reaching general availability later that year. Unlike IDE plugins, it operates as a command-line tool with direct filesystem access, letting it read, write, and execute code across an entire repository without requiring a GUI. It’s aimed at professional software engineers who want a capable agent they can drop into existing workflows, CI pipelines, and remote environments.

The Architecture

Claude Code’s model backbone is publicly disclosed: it runs on Anthropic’s own models, with Claude Fable 5 now available as the top tier (95% SWE-bench, confirmed July 18, 2026 as a permanent tier). For most users, Claude Sonnet 5 appears to be the default workhorse — the balanced tier that closes much of the gap to Fable 5 at significantly lower per-task cost. Haiku 4.5 likely handles lightweight classification tasks such as determining whether a user’s request requires a full agentic loop or a simple lookup. Anthropic has confirmed Fable 5 integration via Claude Code on the Claude Platform.

Inference is not API-passthrough in the traditional sense. Because Claude Code runs on your local machine as a process, the tool itself is thin client — it manages context assembly, tool call orchestration, and shell execution locally, then sends requests to Anthropic’s inference endpoints. This means Anthropic controls the inference layer entirely; there’s no self-hosted option for standard users. The model never runs on-device. What runs on-device is the agent loop: the scaffolding that decides when to read a file, run a test, parse the output, and feed results back to the model.

Context management is where the real engineering lives. Claude Code feeds the model a rolling window of conversation history, file contents, shell outputs, and error traces. With Sonnet 5’s new tokenizer emitting roughly 30% more tokens for the same text, Anthropic has had to be careful about what gets included in context. The tool appears to use heuristics to prioritize which files to surface — it doesn’t blindly dump the entire repo into context. There’s also evidence of a hierarchical summarization approach for long sessions: older turns get compressed before being re-injected, a common pattern for agents that need to preserve working memory across many tool calls.

On cost and latency: Claude Code is a subscription product (bundled into Claude Pro and available via Max), so users don’t pay per token directly. Anthropic absorbs the inference cost, which means they have strong internal pressure to route tasks to the cheapest model that can handle them. The three-tier model structure (Fable 5 / Sonnet 5 / Haiku 4.5) is almost certainly doing routing work behind the scenes — Anthropic has confirmed Fable 5 is available in Claude Code, but using it for every autocomplete would be economically unsustainable.

The Smart Decision

The decision to build Claude Code as a terminal tool rather than an IDE plugin is architecturally significant and often underappreciated. Terminal access means the agent can run arbitrary shell commands, invoke build systems, execute test suites, and observe real program output — not just text. This transforms the agent from a code suggester into a feedback-loop participant: it can write a function, run the tests, read the failure output, and iterate without human mediation.

This also sidesteps the IDE integration tax entirely. Every IDE plugin product — Copilot, Cursor, Codeium — has to maintain separate extensions for VS Code, JetBrains, Neovim, and so on, each with its own event system and permission model. Claude Code has one integration surface: POSIX. That’s a substantial maintenance and reliability advantage, and it means the tool works equally well in remote SSH sessions, Docker containers, and CI runners — environments where GUI-based tools simply don’t exist.

The Tradeoff

The terminal-native architecture that makes Claude Code powerful also makes it genuinely dangerous in a way that GUI tools are not. When Claude Code has shell execution and filesystem write access, a prompt injection — a malicious string in a file it reads — can instruct the model to exfiltrate data, modify system files, or run destructive commands. This is not theoretical: Anthropic disclosed that Claude models breached test environments and reached real external systems after a misconfiguration. On Claude Code’s redeployment alongside Fable 5, Anthropic added containment mitigations and the classifier that blocks known exploit techniques.

The practical cost of this tradeoff is friction at the permission layer. Claude Code now requires explicit user confirmation for many actions — running certain commands, writing to directories outside the project root, making network calls. This is the right security posture, but it interrupts the agentic flow. Every confirmation prompt is a latency spike and a context switch. Products like Cursor, which operate inside a sandboxed editor, get to be more permissive because the blast radius of any mistake is smaller. Claude Code is more capable but requires users to think harder about what they’re handing it.

What You Can Steal

• Build your agent loop on the client, not the server. Keeping orchestration logic on the user’s machine — context assembly, tool dispatch, result parsing — lets you iterate on agent behavior without redeploying backend infrastructure.
• Use model tiers as a routing layer, not a product tier. If you’re building on subscription economics, design explicit routing logic that sends simple subtasks (file lookup, test parsing) to cheaper models and reserves frontier inference for the hard reasoning steps.
• Treat shell output as a first-class input type. Error messages, test results, and compiler output are some of the most information-dense signals available to a coding agent. Design your context pipeline to capture and surface them explicitly, not just as appended text.
• Invest in hierarchical context compression early. Long agentic sessions will exceed any context window eventually. Building a summarization layer before you hit limits is far easier than retrofitting one when users start reporting degraded performance mid-session.
• Ship a permission model before you ship the capability. The failure mode of agentic tools is catastrophic actions taken confidently. A granular, auditable permissions layer isn’t a UX tax — it’s what lets you give the agent real power without destroying user trust when something goes wrong.