Claude Code

Claude Code is Anthropic's official CLI agent. As a Jetty runtime, it runs your runbook inside a Daytona sandbox and uses Anthropic's models — directly, via Bedrock, or proxied through OpenRouter.

Use claude-code when:

• You're running an Anthropic-family model (Claude Sonnet, Haiku, Opus)
• You want full feature parity with the Anthropic API: prompt caching, thinking budgets, tool use, MCP servers
• The runbook needs Claude's strong tool-use and code-editing behavior

For non-Anthropic Bedrock models (DeepSeek, Zhipu, Qwen, etc.), use hermes instead — claude-code's API client validates against an Anthropic regex and rejects cross-family Bedrock IDs with a 400.

Provider support

Provider	Supported	How it routes
Anthropic	✅	Native Anthropic API via ANTHROPIC_API_KEY
AWS Bedrock	✅	CLAUDE_CODE_USE_BEDROCK=1 + AWS_BEARER_TOKEN_BEDROCK (Anthropic-shaped Bedrock client)
OpenRouter	✅	ANTHROPIC_BASE_URL=https://openrouter.ai/api/v1 (Anthropic-compatible proxy)
OpenAI	❌	Use codex
Google	❌	Use gemini-cli

Confirmed-working models

These configurations have been verified end-to-end on production runs. Model IDs vary by provider — Anthropic uses bare names (claude-sonnet-4-6), Bedrock uses cross-region inference profiles (us.anthropic.claude-*).

Provider	Model ID	Notes
Anthropic	claude-sonnet-4-6	Native API, default for the runtime
Anthropic	claude-opus-4-7	Largest Anthropic model
Anthropic	claude-haiku-4-5	Fast / cheap option
AWS Bedrock	us.anthropic.claude-sonnet-4-6	Cross-region inference profile
AWS Bedrock	us.anthropic.claude-haiku-4-5-20251001-v1:0	Versioned profile
AWS Bedrock	us.anthropic.claude-opus-4-7	Cross-region inference profile

Known-broken model IDs

Model ID	What happens	Use instead
zai.glm-5 (via Bedrock)	API 400 "Request metadata contains a value that violates the regular expression"	hermes runtime
nvidia.nemotron-nano-3-30b (via Bedrock)	Same 400 — Bedrock rejects non-Anthropic model IDs in claude-code's request shape	hermes runtime
gpt-5.5 / gemini-3-pro	claude-code does not speak OpenAI / Google APIs	codex / gemini-cli

Setup

Anthropic API

TOKEN="$(cat ~/.config/jetty/token)"
cat <<'BODY' | curl -s -X PATCH \
  -H "Authorization: Bearer $TOKEN" \
  -H "Content-Type: application/json" \
  "https://flows-api.jetty.io/api/v1/collections/{COLLECTION}/environment" \
  --data-binary @-
{
  "environment_variables": {
    "ANTHROPIC_API_KEY": "sk-ant-..."
  }
}
BODY

AWS Bedrock

Set AWS_BEARER_TOKEN_BEDROCK (and optionally AWS_REGION, defaults to us-east-1). The runner sets CLAUDE_CODE_USE_BEDROCK=1 for you when it detects an AWS provider.

{
  "environment_variables": {
    "AWS_BEARER_TOKEN_BEDROCK": "ABSK...",
    "AWS_REGION": "us-east-1"
  }
}

OpenRouter

{
  "environment_variables": {
    "OPENROUTER_API_KEY": "or-..."
  }
}

The runner reroutes claude-code's requests to https://openrouter.ai/api/v1 automatically. Set OPENROUTER_BASE_URL to point at a self-hosted OpenRouter proxy / corp gateway and the runner picks it up.

Use it in a runbook

---
agent: claude-code
model: us.anthropic.claude-sonnet-4-6
snapshot: python312-uv
---

# My Runbook

Do something interesting. Write the result to `{{results_dir}}/output.md`.

Or via the Chat Completions API:

{
  "model": "claude-sonnet-4-6",
  "jetty": {
    "runbook": true,
    "agent": "claude-code",
    "collection": "my-collection",
    "task": "my-task"
  }
}

MCP servers

Claude Code supports loading MCP servers inside the sandbox. Pass an mcp_servers map on the runbook step config:

{
  "step_configs": {
    "run": {
      "activity": "runbook",
      "agent": "claude-code",
      "mcp_servers": {
        "playwright": {
          "command": "npx",
          "args": ["-y", "@playwright/mcp@latest"]
        }
      }
    }
  }
}

The runner writes a .mcp.json in the sandbox and passes --mcp-config to the CLI. Allowed tools automatically include mcp__<server>__*.

Allowed tools

By default the runner allows: Bash, Edit, Write, Read, Glob, Grep, LS, WebFetch, NotebookEdit, NotebookRead, TodoRead, TodoWrite, Agent, plus any mcp__<server>__* for configured MCP servers.

How it streams

Claude Code emits structured JSON to stdout (--output-format stream-json). Jetty tails that file in real time, parsing tool calls and text into the trajectory's streamed log. Token usage is read from the final {"type":"result"} message.

The session log lands at /logs/agent/claude-code.txt inside the sandbox; Anthropic-style session metadata (resume state, message history) is written under /logs/agent/sessions/.

Limitations

• Anthropic-family models only. Bedrock cross-family models (zai, deepseek, nvidia, qwen, meta) fail with 400 — switch to hermes.
• Bedrock requires the bearer token form. Static IAM access keys do not work with the claude-code runner — use AWS_BEARER_TOKEN_BEDROCK instead.
• The pinned CLI version is 2.1.126. Older builds (before AWS_BEARER_TOKEN_BEDROCK support) silently fall back to the OAuth login path with apiKeySource: "none". The runner reinstalls if a different version is detected.