@ai-sdk/anthropic 3.0.125 → 3.0.127

package/docs/05-anthropic.mdx

@@ -399,6 +399,57 @@ const servedByFallback = iterations?.some(
 console.log('Served by fallback:', servedByFallback);
 ```
 
+### Dangerous Tool Use Safeguard
+
+The `safeguards` option asks the API to run additional server-side checks as part of the request. The `dangerous_tool_use` safeguard classifies every `tool_use` block in the response for dangerous actions, such as destructive shell commands or data exfiltration, and returns a verdict per tool call. This is the check that Claude Code's auto mode relies on. The `dangerous-tool-use-2026-09-03` beta header is added for you.
+
+```ts highlight="9-16"
+import { anthropic, AnthropicLanguageModelOptions } from '@ai-sdk/anthropic';
+import { generateText, tool } from 'ai';
+import { z } from 'zod';
+
+const result = await generateText({
+  model: anthropic('claude-sonnet-4-5'),
+  prompt: 'Use the bash tool to run: echo hello',
+  tools: { bash: tool({ inputSchema: z.object({ command: z.string() }) }) },
+  providerOptions: {
+    anthropic: {
+      safeguards: [
+        {
+          type: 'dangerous_tool_use',
+          classifierContext: { v: 1, permission_mode: 'auto' },
+        },
+      ],
+    } satisfies AnthropicLanguageModelOptions,
+  },
+});
+
+console.log(result.providerMetadata?.anthropic?.safeguardResults);
+```
+
+The verdicts are available on `providerMetadata.anthropic.safeguardResults`, one entry per requested safeguard, in the API's wire shape:
+
+```json
+[
+  {
+    "type": "dangerous_tool_use",
+    "status": {
+      "type": "available",
+      "tool_uses": {
+        "toolu_01Ti4QpUfhLV6QqCTFVY8C7w": {
+          "type": "evaluated",
+          "outcome": "not_flagged"
+        }
+      }
+    }
+  }
+]
+```
+
+`status.type` is `available` when the classifier ran; `unsupported` means the API key is not enabled for the beta. Inside `status.tool_uses`, each tool call id maps to `evaluated` (with an `outcome` of `not_flagged` or `flagged`, the latter with an `explanation` such as `[Data Exfiltration]`), `skipped`, or `unavailable` (a transient classifier failure). When streaming, the verdicts arrive on the final `message_delta` event and are exposed on the `finish` part's provider metadata.
+
+Anthropic's platform reference does not document the beta yet; the feature is described from the client side in the Claude Code [auto mode classifier](https://code.claude.com/docs/en/auto-mode-classifier-billing) and [gateway compatibility](https://code.claude.com/docs/en/llm-gateway-protocol#feature-pass-through) guides.
+
 ### Reasoning
 
 Anthropic models support extended thinking, where Claude shows its reasoning process before providing a final answer.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-sdk/anthropic",
-  "version": "3.0.125",
+  "version": "3.0.127",
   "license": "Apache-2.0",
   "sideEffects": false,
   "main": "./dist/index.js",
@@ -37,7 +37,7 @@
   },
   "dependencies": {
     "@ai-sdk/provider": "3.0.18",
-    "@ai-sdk/provider-utils": "4.0.56"
+    "@ai-sdk/provider-utils": "4.0.57"
   },
   "devDependencies": {
     "@types/node": "20.17.24",

package/src/anthropic-message-metadata.ts

@@ -1,4 +1,5 @@
 import type { JSONObject } from '@ai-sdk/provider';
+import type { AnthropicSafeguardResult } from './anthropic-messages-api';
 
 /**
  * Represents a single iteration in the usage breakdown.
@@ -65,6 +66,19 @@ export interface AnthropicMessageMetadata {
     reason: string;
   }>;
 
+  /**
+   * Verdicts of the server-side safeguards requested with
+   * `providerOptions.anthropic.safeguards`, one entry per requested safeguard.
+   * For `dangerous_tool_use`, `status.type` is `'available'` when the
+   * classifier ran and `status.tool_uses` maps each tool call id to its
+   * verdict (`type: 'evaluated'` with an `outcome` of `'not_flagged'` or
+   * `'flagged'` plus an `explanation`, `'skipped'`, or `'unavailable'`).
+   *
+   * Kept in the API's wire shape (snake_case), since consumers such as Claude
+   * Code read the verdicts verbatim.
+   */
+  safeguardResults?: AnthropicSafeguardResult[];
+
   /**
    * Details about why the request stopped. Present only when the API returns
    * a `refusal` stop reason together with a `stop_details` object (a

package/src/anthropic-messages-api.ts

@@ -649,6 +649,27 @@ const anthropicStopDetailsSchema = z.object({
 
 export type AnthropicStopDetails = z.infer<typeof anthropicStopDetailsSchema>;
 
+const anthropicSafeguardResultSchema = z.object({
+  type: z.string(),
+  status: z.object({
+    type: z.string(),
+    tool_uses: z
+      .record(
+        z.string(),
+        z.object({
+          type: z.string(),
+          outcome: z.string().nullish(),
+          explanation: z.string().nullish(),
+        }),
+      )
+      .nullish(),
+  }),
+});
+
+export type AnthropicSafeguardResult = z.infer<
+  typeof anthropicSafeguardResultSchema
+>;
+
 const anthropicToolCallCallerSchema = z.union([
   z.object({
     type: z.literal('code_execution_20250825'),
@@ -963,6 +984,7 @@ export const anthropicMessagesResponseSchema = lazySchema(() =>
       input_transformations: z
         .array(anthropicInputTransformationSchema)
         .nullish(),
+      safeguard_results: z.array(anthropicSafeguardResultSchema).nullish(),
       usage: z.looseObject({
         input_tokens: z.number(),
         output_tokens: z.number(),
@@ -1397,6 +1419,7 @@ export const anthropicMessagesChunkSchema = lazySchema(() =>
           stop_reason: z.string().nullish(),
           stop_sequence: z.string().nullish(),
           stop_details: anthropicStopDetailsSchema.nullish(),
+          safeguard_results: z.array(anthropicSafeguardResultSchema).nullish(),
           container: z
             .object({
               expires_at: z.string(),

package/src/anthropic-messages-language-model.ts

@@ -702,6 +702,16 @@ export class AnthropicMessagesLanguageModel implements LanguageModelV3 {
       system: messagesPrompt.system,
       messages: messagesPrompt.messages,
 
+      ...(anthropicOptions?.safeguards &&
+        anthropicOptions.safeguards.length > 0 && {
+          safeguards: anthropicOptions.safeguards.map(safeguard => ({
+            type: safeguard.type,
+            ...(safeguard.classifierContext !== undefined && {
+              classifier_context: safeguard.classifierContext,
+            }),
+          })),
+        }),
+
       ...(contextManagement && {
         context_management: {
           edits: contextManagement.edits
@@ -841,6 +851,13 @@ export class AnthropicMessagesLanguageModel implements LanguageModelV3 {
       betas.add('mcp-client-2025-04-04');
     }
 
+    if (
+      anthropicOptions?.safeguards &&
+      anthropicOptions.safeguards.length > 0
+    ) {
+      betas.add('dangerous-tool-use-2026-09-03');
+    }
+
     if (contextManagement) {
       betas.add('context-management-2025-06-27');
 
@@ -1588,6 +1605,9 @@ export class AnthropicMessagesLanguageModel implements LanguageModelV3 {
           ...(response.input_transformations != null
             ? { inputTransformations: response.input_transformations }
             : {}),
+          ...(response.safeguard_results != null
+            ? { safeguardResults: response.safeguard_results }
+            : {}),
 
           iterations: response.usage.iterations
             ? response.usage.iterations.map(
@@ -1732,6 +1752,7 @@ export class AnthropicMessagesLanguageModel implements LanguageModelV3 {
     let stopSequence: string | null = null;
     let stopDetails: AnthropicMessageMetadata['stopDetails'] = undefined;
     let inputTransformations: AnthropicMessageMetadata['inputTransformations'];
+    let safeguardResults: AnthropicMessageMetadata['safeguardResults'];
     let container: AnthropicMessageMetadata['container'] | null = null;
     let isJsonResponseFromTool = false;
     let isMessageOpen = false;
@@ -2802,6 +2823,12 @@ export class AnthropicMessagesLanguageModel implements LanguageModelV3 {
                 inputTransformations = value.input_transformations;
               }
 
+              // Earlier deltas may carry null while the classifier is still
+              // running; the last non-null value is the final verdict.
+              if (value.delta.safeguard_results != null) {
+                safeguardResults = value.delta.safeguard_results;
+              }
+
               rawUsage = {
                 ...rawUsage,
                 ...(value.usage as JSONObject),
@@ -2822,6 +2849,7 @@ export class AnthropicMessagesLanguageModel implements LanguageModelV3 {
                 ...(inputTransformations != null
                   ? { inputTransformations }
                   : {}),
+                ...(safeguardResults != null ? { safeguardResults } : {}),
                 iterations: usage.iterations
                   ? usage.iterations.map(
                       iter =>

package/src/anthropic-messages-options.ts

@@ -364,6 +364,25 @@ export const anthropicLanguageModelOptions = z.object({
    */
   anthropicBeta: z.array(z.string()).optional(),
 
+  /**
+   * Server-side safeguards to run as part of the request.
+   *
+   * `dangerous_tool_use` asks the API to classify every `tool_use` block in
+   * the response for dangerous actions (the check Claude Code's auto mode
+   * relies on). The per-call verdicts are returned in
+   * `providerMetadata.anthropic.safeguardResults`, keyed by tool call id.
+   * `classifierContext` is passed through to the API as `classifier_context`.
+   * The `dangerous-tool-use-2026-09-03` beta is added automatically.
+   */
+  safeguards: z
+    .array(
+      z.object({
+        type: z.literal('dangerous_tool_use'),
+        classifierContext: z.record(z.string(), z.unknown()).optional(),
+      }),
+    )
+    .optional(),
+
   contextManagement: z
     .object({
       edits: z.array(