ZharfAI Team
AI Development
Claude Code is Anthropic’s coding agent for terminal-centered development. It can inspect a repository, edit files, run tools, and work with external systems when those capabilities are configured and permitted. That makes it more useful than a chat window for many engineering tasks—and makes scope, permissions, review, and verification part of the tutorial rather than optional cleanup.
This guide was checked against Anthropic's current documentation index and weekly release notes on August 6, 2026. Product behavior changes quickly, so commands and settings should be confirmed in the linked reference for the installed version. Feature availability varies by plan, platform, provider, organization policy, and rollout. Statements labeled “recommended practice” below are engineering guidance from this article, not a claim that Claude Code enforces them automatically.
Start with Anthropic’s Claude Code setup guide. It lists supported environments, installation options, authentication paths, update behavior, and diagnostic steps. Use the method documented for your operating system and organization rather than copying an old package command from a third-party post.
After installation, open a terminal in a small repository and start an interactive session:
cd path/to/your-project
claude
Confirm the directory before granting file or command access. Do not begin in a home directory, monorepo root, or folder containing unrelated secrets. Anthropic documents authentication through supported Anthropic and enterprise-platform routes; which route is appropriate depends on account, billing, data, and organizational policy.
Recommended practice: check the installed version, review release notes before broad team rollout, and use a test repository to validate permissions, proxies, certificates, and update controls. Treat installation success as connectivity proof, not authorization to expose every repository.
Anthropic’s CLI reference documents interactive invocation, an initial prompt, print mode, continuation and resume options, model selection, tool allow and deny flags, permission modes, input and output formats, and turn limits. The reference is the source of truth for currently supported flags.
Interactive mode is useful for exploration and iterative implementation because the user can inspect prompts and tool requests. Print mode is useful for scripts because it can produce structured output and exit. Those are product capabilities. They do not make an unattended script safe by themselves.
Recommended practice: give each invocation one bounded outcome, explicit files or tests, and a maximum work envelope. Parse machine-readable output rather than scraping prose. Capture the command, version, repository revision, exit status, and generated diff. A zero exit code means the process completed; it does not mean the code is correct.
Claude Code can discover repository files, but it cannot infer every local convention from code. Anthropic’s memory and project-instruction documentation explains the supported instruction files and scope behavior. Follow that documentation for the current filename, hierarchy, imports, and precedence.
A useful project contract explains:
Keep instructions short enough to remain usable and version them with the code where team policy is shared. Do not place secrets in an instruction file. Recommended practice: write verifiable rules such as “run the named targeted test after editing this package,” not vague requests such as “be careful.”
For broader patterns, AI software-engineering agents should be designed around repository contracts, bounded tasks, and evidence, not an assumption that more context always improves performance.
Claude Code asks for or applies tool permissions according to its configuration and mode. Anthropic’s security and permissions documentation describes the current permission model and security considerations. Review it before enabling command execution or expanding directories.
Prefer the smallest permission that completes the task. Read access, file editing, local tests, network access, package installation, cloud tools, and deployment are distinct capabilities. A trusted repository can still contain untrusted issue text, test fixtures, web content, or generated instructions.
The CLI reference documents an option that bypasses permission prompts and labels it dangerous. Do not make bypassed prompts the normal development workflow. Recommended practice: reserve any non-interactive elevated mode for an isolated environment with an explicit allowlist, no ambient credentials, narrow filesystem scope, network controls, and disposable state.
The deeper design problem is covered in tool permission security for AI: approval should be bound to a specific action and target, not treated as blanket trust in the model.
A strong implementation request states the observed problem, expected behavior, scope, relevant files, non-goals, compatibility constraints, and required verification. Ask the agent to inspect before editing when the cause is uncertain.
For example:
Diagnose why the checkout total differs after coupon removal.
Limit changes to packages/cart and its tests.
Preserve the public API and existing tax rounding.
Explain the cause, implement the smallest fix, run the targeted tests,
and summarize residual risk. Do not change dependencies.
This format is recommended practice, not special syntax. It separates diagnosis from implementation and reduces the chance that a plausible rewrite hides the actual cause.
Review the plan when the task affects authentication, authorization, money, personal data, migrations, infrastructure, or destructive operations. Ask for assumptions and evidence, but do not ask the model for hidden chain-of-thought. The useful artifacts are inspected files, diffs, commands, tests, and concise reasoning.
Claude Code can edit multiple files quickly. Speed increases the need for disciplined review. Start with the changed-file list and diff. Check that every change supports the requested outcome and that no unrelated formatting, generated artifact, lockfile, or credential was added.
Review trust boundaries, error paths, concurrency, data validation, authorization, migrations, localization, accessibility, and observability. Verify new tests can fail for the old behavior and are not merely snapshots of the generated implementation.
Recommended practice: use a clean branch or worktree, make one coherent change, and keep user edits distinct. Never “fix” a dirty tree by discarding unknown changes. Run git diff --check, targeted tests, and the project’s required validation before committing.
Claude Code may summarize its work, but the repository and command output are the evidence. Independent review remains necessary for consequential code.
Anthropic’s Claude Code hooks guide documents lifecycle events, configuration, matchers, hook inputs and outputs, and supported command or prompt hook behavior. Use the current reference because event names and schemas can evolve.
Hooks are appropriate when a policy must run deterministically: format a changed file, block access to a protected path, record a tool event, or require a check at a lifecycle boundary. They are not a reason to execute arbitrary repository text with full user privileges.
Recommended practice:
A hook that invokes a shell inherits the risk of that shell and environment. Treat user prompts, filenames, model output, and MCP responses as untrusted input. Prefer a small deterministic validator over a second open-ended model when enforcing a hard rule.
Anthropic’s Claude Code MCP documentation explains supported transports, configuration scopes, authentication, resources, prompts, and management commands. MCP can connect Claude Code to issue trackers, observability, databases, design systems, and other tools.
An MCP server expands the authority and data available to the session. Verify who operates it, what tools it exposes, how authentication is stored, where data travel, what logs remain, and whether returned content can contain prompt injection. Anthropic’s documentation warns that third-party servers are not automatically verified and that untrusted content requires caution.
Recommended practice: begin read-only, choose project scope only for configurations safe to share, keep credentials outside committed configuration, and split read and write capabilities. Use a development tenant and test data before production. Review the exact tool invocation and external target before approval.
For architecture and trust boundaries, see MCP integration architecture.
Claude Code is now a family of connected surfaces:
Use --cloud and --teleport only after checking the web and cloud boundary. Cloud work may have different network access, credentials, setup, retention, and repository revision.
Chrome and Computer Use can inherit logged-in state or see private information. Reading or testing does not authorize submitting a form, sending a message, uploading a file, changing permissions, publishing, purchasing, or approving an account action. Prefer test accounts and a separate browser profile.
Claude Code offers several levels of parallel work:
Pick the smallest useful level. Use --worktree or documented worktree controls for parallel writers and appoint one integration owner. A tightly coupled change should usually keep one writer. Agent messages are coordination, not evidence; verify files, commands, diffs, and test output. Nested agents also multiply time, context, and cost.
Official references: parallel-agent comparison, custom subagents, agent teams, dynamic workflows, and worktrees.
For supported languages, code intelligence improves definition, reference, symbol, and diagnostic awareness beyond text search. Confirm that language tooling loaded; a missing server should reduce confidence, not silently become a guess.
The advisor tool can let the main model consult a stronger advisor at difficult decision points. Use it for architecture tradeoffs, ambiguous failures, or high-impact review—not every trivial edit. The main session still integrates and verifies the advice.
For complex work, remain in plan mode until reproduction, contracts, tests, and rollout risk are clear. A persistent goal needs a measurable completion condition; “keep working” does not define success.
Checkpointing tracks file and conversation state so /rewind can return to an earlier point. Sessions can be named, resumed, branched, continued from a pull request, or transferred across supported surfaces. Git remains the durable code history and review boundary.
Before resuming, confirm the project, branch, worktree, revision, current diff, and permissions. After /compact, /clear, or a long pause, restate critical constraints and inspect the actual repository instead of assuming a summary retained every detail.
Auto memory and CLAUDE.md have different scopes. Auto memory captures learnings; CLAUDE.md is explicit, reviewable project instruction. Keep secrets and protected content out of both, place team policy in version control, and periodically remove stale memory.
Claude Code's extension surfaces have distinct roles:
Review third-party packages and constrain dependency versions. A marketplace is discovery, not a security endorsement. Hooks and channels are executable or networked components: scope credentials, authenticate senders, validate payloads, and prevent notification content from authorizing tool use.
The .claude directory may contain rules, settings, hooks, skills, commands, subagents, workflows, and auto memory. Use /context, /doctor, /hooks, and /mcp to inspect what actually loaded.
Artifacts can publish a session result as an interactive page on claude.ai with privacy and sharing choices. Publishing is an external side effect: inspect content, connected live data, secrets, access level, and final URL first.
Recurring work spans Desktop scheduled tasks, in-session /loop and scheduling tools, and cloud Routines triggered by schedules, API calls, or GitHub events. Automate only a workflow that already succeeds interactively. Add time/cost bounds, no-data behavior, idempotency, observability, and approval before merge, deploy, publish, message, or production mutation.
The Claude Agent SDK exposes the agent loop from Python or TypeScript with sessions, structured output, custom tools, subagents, hooks, MCP, permissions, checkpointing, storage, cost tracking, and observability. Use it instead of scraping terminal prose for product integrations.
GitHub Actions and GitLab CI/CD can turn issues or mentions into code work. Automated Code Review, /code-review, ultrareview, Claude Security, and the security-guidance plugin add specialized analysis. They produce evidence; they do not grant merge authority or security certification. Reproduce high-severity findings and independently verify patches.
Auto mode can reduce prompts using classifiers and managed allow/block rules. Use it only with a reviewed effective configuration and appropriate sandbox. A permission classifier is defense in depth, not host or network isolation.
Do not paste credentials into a prompt, source file, instruction file, or issue. Use the organization’s credential manager and inject the minimum secret only into the process that needs it. Scope tokens by environment and capability; prefer short-lived credentials and rotate after suspected exposure.
Repositories contain untrusted content: dependency scripts, markdown copied from the web, test samples, generated files, and contributor-controlled branch names. An instruction inside a file is data unless the user deliberately adopts it. Tool output from browsers and MCP servers is also data.
Recommended practice: isolate package installation and builds, disable unnecessary network access, inspect lifecycle scripts, and prevent the agent from reading credential directories. Secret scanning and code review remain required. If a secret appears in a transcript or diff, revoke it; deleting the text is not sufficient.
The CLI supports non-interactive usage and structured output as documented in the CLI reference. A team can use that capability for issue triage, documentation checks, test analysis, or narrowly scoped maintenance. Production automation needs more controls than a developer session.
Pin the environment and record the Claude Code version, model selection, repository revision, prompt template, allowed tools, and output schema. Use a clean checkout, minimal token permissions, no production credentials, network egress rules, time and cost limits, and artifact retention. Require review before merge or deployment.
Recommended practice: stage the workflow in four levels—read-only report, proposed patch, patch plus validation, then an approved external action. Each level needs measured reliability and rollback. A pipeline should fail closed when output is malformed, tests are missing, or the diff exceeds scope.
AI-assisted DevSecOps and code review is strongest when automation supplements scanners, tests, owners, and deployment controls rather than becoming a universal approval.
Do not measure Claude Code by lines generated or tasks started. Build a representative evaluation set with bug fixes, tests, refactors, documentation, and repository-specific constraints. Preserve hidden expected behavior where feasible.
Track task completion, accepted diff, reviewer correction, regressions, test quality, security findings, scope violations, latency, cost, tool prompts, and rollback. Separate first-pass success from success after human guidance. Break results down by repository, language, task type, and risk.
Monitor production outcomes after merged changes. An agent may pass unit tests while increasing support load or operational failure. Feed verified incidents and review findings back into repository instructions and evaluations rather than simply lengthening prompts.
For most development work, use this sequence:
Claude Code is most effective when it can act and easiest to trust when action is bounded by evidence. The product supplies repository tools, permissions, hooks, MCP integration, and interactive or scripted modes. Teams must still supply the engineering contract: who may authorize what, which tests establish confidence, and which decisions remain human.
If third-party model choice is the requirement, use an explicitly provider-flexible harness and see our Qwen3.8, GLM-5.2, and DeepSeek-V4 guide. An Anthropic-compatible endpoint does not by itself make another model an officially supported Claude Code model.
Official Anthropic documentation was reviewed on August 6, 2026:
Master GitHub Copilot CLI from installation and permissions to plan and autopilot modes, fleet agents, skills, MCP, plugins, IDE and remote work, review, hooks, and automation.
Read More
Master Google Antigravity CLI from installation and workspace trust to artifacts, subagents, models, permissions, sandboxing, skills, plugins, MCP, hooks, and headless automation.
Read More
Master OpenCode from installation to providers, AGENTS.md, plan and build agents, permissions, skills, MCP, plugins, IDE, desktop, server, and GitHub workflows.
Read MoreIf this note maps to a real system in your organization, start with the services page or a shipped case study.