NEW: Claude Code Security — research preview

Architecture

Internal mechanics - runtime components and 9-step pipeline

Read time: 20 min

title: "Architecture" description: "Internal mechanics - runtime components and 9-step pipeline" section: "Core" readTime: "20 min"

Architecture: Internal Mechanics

How Claude Code works under the hood.

Runtime Components

1. Tool System

Manages execution of file, bash, git, and API tools.

2. Memory System

Maintains conversation history, compaction, checkpoints.

3. Permission Engine

Evaluates actions against rules and hooks before execution.

4. Task Manager

Coordinates parallel agents and subagent spawning.

5. Multi-Agent Coordinator

Routes tasks, manages session fork/resume.

The 9-Step Pipeline

1. Input Processing
   ↓
2. Context Loading (CLAUDE.md, Skills, Hooks)
   ↓
3. Permission Check (hooks: PreToolUse)
   ↓
4. Planning/Approval
   ↓
5. Tool Execution
   ↓
6. Result Processing (hooks: PostToolExecution)
   ↓
7. Memory Compaction
   ↓
8. Artifact Generation (diffs, commits)
   ↓
9. Session State Update

Context System

Claude Code maintains 5 context layers:

{
  "files": ["src/main.ts", "package.json"],
  "history": ["Previous 50 messages"],
  "tools": ["Available bash, git, file tools"],
  "rules": ["CLAUDE.md + Rules layer + Hooks"],
  "memory": ["Session checkpoints"]
}

Use claude /context to inspect.

AGENTS.md — Cross-Tool Universal File

All agent platforms read this file:

  • Claude Code (CLI)
  • Cursor IDE
  • Codex
  • OpenCode
  • Gemini
  • CodeBuddy

When you create .claude/AGENTS.md, every connected agent reads it first.

# AGENTS.md
 
## Agent Identity
name: "My Team's AI"
role: "Full-stack developer"
style: "direct, no fluff"
 
## Shared Rules
- Always write tests
- Use TypeScript strict mode
- API keys never in code
 
## Tool Constraints
- No dangerous bash (rm -rf, sudo)
- File operations limited to /src
- API rate: 100 req/min

SOUL.md — Philosophical Layer

Define agent's values and decision-making style:

# SOUL.md
 
## Identity
We are a team of senior engineers who value:
- Code clarity over cleverness
- User safety over speed
- Documentation over assumptions
 
## Ethics
- Never suggest insecure patterns
- Always mention tradeoffs
- Admit when uncertain
 
## Communication
- Question assumptions
- Explain reasoning
- Respect user autonomy

Rules Layer: ~/.claude/rules/

Always-active constraint files, separate from skills.

~/.claude/rules/
├── common/
│   ├── no-dangerous-bash.md
│   ├── api-safety.md
│   └── git-hygiene.md
├── typescript/
│   ├── strict-mode.md
│   └── testing-required.md
├── python/
│   ├── type-hints.md
│   └── pep8-strict.md
└── golang/
    └── error-handling.md

Each file contains Claude Code hook rules that auto-activate.

MCP Token Warning: Each MCP tool description consumes tokens (averaging 500-1000 tokens per tool). The permission engine parses all descriptions on each run.

Cap at 10 MCPs + 80 active tools per project. Use deferred loading for optional MCPs.

Permission Modes Internals

Default Mode

For each action:
  1. Load hook rules
  2. Check against CLAUDE.md
  3. Ask user: "Can I proceed?"
  4. Log decision

Auto Mode

For each action:
  1. Load hook rules
  2. ML classifier evaluates action type
  3. High confidence → proceed
  4. Medium confidence → ask
  5. Low confidence → block

Uses deployment parameter: --enable-auto-mode (Team/Enterprise only)

Compaction Algorithm

When memory hits 70% token threshold:

1. Identify tool results (500-2000 tokens)
2. Compress to 1-line summary
3. Keep file edits (full content)
4. Compress intermediate steps
5. Preserve key decisions
6. Keep most recent 30 lines intact

At 90%: Automatic /clear if enabled, else new session.

CLAUDE_CODE_SUBAGENT_MODEL

Set the model for subagent delegation:

{
  "env": {
    "CLAUDE_CODE_SUBAGENT_MODEL": "haiku"
  }
}

Default: sonnet. Haiku = 80% cost reduction for delegation tasks.

Token Budget Best Practices

MAX_THINKING_TOKENS: 10000    # Not 31999 (70% savings)
CLAUDE_AUTOCOMPACT_PCT_OVERRIDE: 50  # Compact earlier
CLAUDE_CODE_SUBAGENT_MODEL: haiku    # Cheap delegation

Real-world impact: ~$6/dev/day vs $20/dev/day without optimization.


Next Steps