[ Removed by moderator ]

I've been researching how Anthropic distinguishes between official Claude Code clients and third-party tools after the April crackdown. There's a lot of speculation online about headers, TLS fingerprints, and account-level bans — but very little actual evidence. So I ran controlled experiments.

## Methodology

I isolated three variables and tested each independently, changing only one factor at a time while keeping everything else constant. All tests used the same valid Max subscription account.

## Finding 1: HTTP headers are NOT the detection mechanism

Many people assume Anthropic checks `User-Agent`, `X-Stainless-*`, or other client-specific headers. I tested this by sending a known-good request body with mismatched headers.

**Result:** Request succeeded. Headers alone don't determine whether you're flagged as third-party.

## Finding 2: TLS fingerprinting (JA3/JA4) is NOT the mechanism

Different HTTP clients (Bun, Node.js, curl) produce unique TLS handshake fingerprints. I routed requests through a Node.js proxy to completely change the TLS signature.

**Result:** Same blocking error. TLS fingerprint is not a factor.

## Finding 3: System prompt content IS the mechanism

This was the key discovery. The server analyzes the content of the `system` field in the API request body. When the system prompt matches Claude Code's known pattern — request goes through. When it contains custom instructions from a third-party tool — blocked.

**Important details:**

- It's **per-request**, not per-account — the same token works or fails depending on prompt content

- It's not keyword-based — no single phrase triggers the block. It appears to be pattern/embedding-based analysis of the overall prompt structure

- Only the **static instruction portion** is checked. Runtime-injected content (environment variables, directory listings, project-specific instructions) passes through regardless of content

## What this tells us

Anthropic's detection is more sophisticated than simple header checks, but also more fragile than people assume. It's content-based classification running server-side on the system prompt.

This raises interesting architectural questions:

- Why analyze prompt content rather than using separate OAuth client_ids for official vs third-party clients?

- How does this interact with legitimate Claude Code extensions and customizations?

- Is embedding-based prompt classification the right approach for access control?

## Full writeup

Detailed methodology with all experiments documented: [GitHub Gist](https://gist.github.com/mrcattusdev/53b046e56b5a0149bdb3c0f34b5f217a)

*Disclaimer: This is security research documenting detection mechanisms. I'm not advocating for bypassing any platform restrictions. Understanding how these systems work benefits both users and platform developers.*

---

Has anyone else done similar testing? I'm curious whether these findings hold across different third-party tools or if Anthropic uses different detection methods for different clients.