Reverse engineering Claude Code(kirshatrov.com)
kirshatrov.com
Reverse engineering Claude Code
https://kirshatrov.com/posts/claude-code-internals
24 comments
I see this behavior all the time. When it can’t read a file using its read tool - it escalates up to try with bash. Often it tries to search the entire file system “find / …”
I always tell agents to use ripgrep instead of find.
Cursor has basically run into this exact thing. It figured out it can read .env files by running other tools despite the file being "blocked": https://github.com/getcursor/cursor/issues/2546
Quite concerning to see the issue still marked as open (since jan!), hopefully it got fixed and it's just that no one marked as closed
I ran into this issue, I built my own bash and SSH MCP server. In my first iteration I did not quite trust Claude yet so I limited the commands it was allowed to run in Bash. But I gave it access to Python, so any time it ran into a limitation it ended up using python to work around it. It's exceedingly good at problem solving.
I Eventually learned to trust Claude, and just gave it access to everything. It's crazy how useful having AI do tasks for you like setting up servers, configuring them etc (one exapmple, I asked claude to create a webhook for my deployment pipeline, and it wrote the shell script, and did the server side configuration in 1-shot. I did't have a github tool so I did that manually in the UI)
I Eventually learned to trust Claude, and just gave it access to everything. It's crazy how useful having AI do tasks for you like setting up servers, configuring them etc (one exapmple, I asked claude to create a webhook for my deployment pipeline, and it wrote the shell script, and did the server side configuration in 1-shot. I did't have a github tool so I did that manually in the UI)
XKCD 416: Zealous Autoconfig
https://xkcd.com/416/
It's missing one last panel where he is under his bed googling for lawyers specialized on kidnapping and CFAA charges
The source code for a pre-release version got leaked a while ago (they forgot to remove the embedded source map) and if you can find it, it’s definitely worth looking into.
An interesting thing about the “agent” (it’s called Task inside Claude Code) is it starts a completely new Claude chat, with its own context etc. I’ve seen a Task go write its own code in multiple files and then your “main” chat ends up confused about what happened.
It also responds to the Task summary like you typed the message sometimes, like “That’s a fascinating analysis!” so kind of quirky.
It also responds to the Task summary like you typed the message sometimes, like “That’s a fascinating analysis!” so kind of quirky.
Claude Code seems a lot more stable than Cursor Agent. I've had it run for 15-20 minutes on a single prompt, debugging, testing and fixing bugs. Also haven't seen network timeout or file edit failures.
11 cents to describe the project in the current directory is ridiculous.
ridiculously low?
I think it depends on the project. I think most of us could eye ball a blog directory pretty quickly and get more or less the same idea. However, give it a gnarly bit of legacy code in a language you haven't used for a while, and indeed, 11c is pretty cheap.
Claude code wastes way too many tokens compared to other agents doing the same task
The other agent is often a human.
A human getting paid 1 cent per second ($36.00 per hour) is 75k/yr (cost to business is ~2x that).
So if Claude manages to save 11 seconds of human time for 11 cents, that would be a good deal.
Tax section 174 makes the employee costs amortised, so spending on Claude as an expense to save employee costs is more valuable than first appearances.
A human getting paid 1 cent per second ($36.00 per hour) is 75k/yr (cost to business is ~2x that).
So if Claude manages to save 11 seconds of human time for 11 cents, that would be a good deal.
Tax section 174 makes the employee costs amortised, so spending on Claude as an expense to save employee costs is more valuable than first appearances.
Probably that's why it's so good.
Claude Code has support for AWS Bedrock. You can use Sonnet models available in AWS Bedrock to run Claude Code locally. This means you can also leverage Bedrock logs to inspect the API calls and the prompts sent.
I was amazed and excited by how good Claude Code is compared to Windsurf/Cursor and wanted to inspect the working. I inspected the logs and got an understanding on its system prompt as well the tools used. It is a great combination of prompt engineering, tool calls, tools orchestration.
I was amazed and excited by how good Claude Code is compared to Windsurf/Cursor and wanted to inspect the working. I inspected the logs and got an understanding on its system prompt as well the tools used. It is a great combination of prompt engineering, tool calls, tools orchestration.
You don't need to overcomplicate things
Just set the base url to a local ngrok and it will log the request
This gives the full prompt with all tool calls
With a proxy you can have it forward requests to Anthropic if you want to see it actually working too and not just the initial request (since it will fail without forwarding them)
Just set the base url to a local ngrok and it will log the request
This gives the full prompt with all tool calls
With a proxy you can have it forward requests to Anthropic if you want to see it actually working too and not just the initial request (since it will fail without forwarding them)
That's a great trick. I do not have a Claude subscription and my current setup is to use with Bedrock backend. Initially I tried with mitmproxy but I think AWS had pinned the TLS certificates causing the requests to fail.
[deleted]
It isn't hard to think of a simple example in which Claude.md can be written to by the LLM to allow accessing endpoints not whitelisted by the user by smuggling a base64 encoded payload that then gets decoded by a subroutine it wrote to a file without you noticing. Or realizing it can't use the WebFetchTool but it can write a script to do manual DNS resolution and then use bash TCP sockets instead of curl in case it is hardened to not be able to use curl.