Skip to content

Commit cde6f92

Browse files
joocursoragent
joo
and
cursoragent
committed
docs(landing): add blog post on Claude Code third-party fingerprinting
Explain Anthropic's content-based detection (not a string blacklist), dispel the brand-name-scrub myth, and position clovapi as a legal config layer rather than a billing-evasion proxy. Bilingual (en/zh-CN). Co-authored-by: Cursor <cursoragent@cursor.com>
1 parent db96750 commit cde6f92

3 files changed

Lines changed: 127 additions & 0 deletions

File tree

‎landing/content/blog/claude-code-third-party-fingerprint.en.md‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
---
2+
title: How Claude Code fingerprints third-party agents (it's not a string blacklist)
3+
description: A technical breakdown of Anthropic's third-party detection — why renaming "OpenClaw" or "Hermes" doesn't help, what actually trips the classifier, and how clovapi stays on the legal config-layer side.
4+
date: 2026-05-29
5+
---
6+
7+
If you run a Claude subscription through anything other than the official client, you have probably seen this 400:
8+
9+
```
10+
Third-party apps now draw from your extra usage, not your plan limits.
11+
We've added a $XXX credit to get you started. Claim it at claude.ai/settings/usage.
12+
```
13+
14+
Since April 2026, Anthropic splits subscription usage into two pools: **plan limits** for the first-party Claude Code client, and a separate prepaid **extra usage** pool for third-party agents (OpenClaw, OpenCode, Hermes, Aider, …). When you are classified as third-party and that pool is empty, requests are rejected. It is not a rate limit — waiting does not fix it.
15+
16+
The interesting question is: *how does the server know it isn't Claude Code?*
17+
18+
## Myth: it greps for brand names
19+
20+
The intuitive guess is a string blacklist — that `openclaw` or `hermes` somewhere in the request is the trigger. Several people reverse-engineered this and **disproved it**:
21+
22+
- One investigator replaced every case-insensitive `openclaw` with `claude` in a 44KB system prompt. Same request otherwise. **Still blocked.** ([byoky: bisecting the fingerprint](https://byoky.com/blog/anthropic-claude-code-fingerprint))
23+
- Another confirmed `systemPrompt.replaceAll("OpenCode", "Claude Code")` does **not** pass; only removing the whole static prompt does. ([opencode-claude-auth #145](https://github.com/griffinmartin/opencode-claude-auth/issues/145))
24+
25+
> "So it's not literal string matching. The classifier is looking at content patterns, not specific tokens. Probably ML. Definitely not regex."
26+
27+
So a brand-name scrub buys you privacy, not a bypass.
28+
29+
## What actually trips the classifier
30+
31+
The consistent finding across independent write-ups is that detection is **content-based and server-side** — not headers, TLS, or IP. Three signals stack, and any one can flag you:
32+
33+
1. **Headers** — necessary but not sufficient. A `claude-cli/*` user-agent and the `claude-code-*` beta flag are the entry ticket; without them you fail immediately.
34+
2. **Tool names** — Claude Code's canonical PascalCase vocabulary (`Read`, `Bash`, `Edit`). Lowercase / snake_case names (`read_file`, `terminal`) read as third-party.
35+
3. **System prompt shape** — the `system` field is inspected by what looks like a content classifier. Long agent-framework prompts (persona, memory rules, heartbeat protocols) are flagged **even after brand markers are stripped**.
36+
37+
A telling detail: the classifier only inspects the **static** portion of the system prompt. Runtime-injected sections (`<env>`, directory listings, your `AGENTS.md`) pass through with arbitrary content — otherwise legitimate Claude Code users couldn't add project instructions.
38+
39+
## The irony
40+
41+
The classifier is aggressive enough to misfire. Anthropic's own Claude Code **VS Code extension** has been wrongly blocked with the same error ([claude-code #45016](https://github.com/anthropics/claude-code/issues/45016)), and at least one user tripped it just by pasting a structured CRM ticket into a stock terminal session.
42+
43+
## Where clovapi sits
44+
45+
clovapi is a **configuration layer**, not an evasion proxy. It does not forge a first-party identity to dodge billing. What it does:
46+
47+
- Organize **credentials you already obtained legally** (official OAuth flows, API keys, gateways) into profiles.
48+
- Apply them per CLI with `switch`, and transcode API formats through a local proxy.
49+
50+
If you want Claude on a subscription, the supported path is still the official Claude Code client. If you want third-party agents, the durable answer is **API-key billing**, not OAuth spoofing:
51+
52+
```bash
53+
clovapi switch --cli claude-code --vendor "Custom API" --model <model-id>
54+
clovapi switch --cli opencode --vendor "Custom API" --model <model-id>
55+
```
56+
57+
The takeaway from the reverse-engineering threads is not "find the magic string." It is that identity detection is now a moving, content-level classifier — so the stable strategy is to bill correctly, not to out-run a model that keeps learning.
58+
59+
## Read more
60+
61+
- [After Anthropic blocked third-party OAuth, how should agent users wire APIs?](/blog/anthropic-oauth-ban-agent-workflow)
62+
- [Claude Code tier routing on a budget](/blog/claude-code-tier-routing-on-a-budget)
63+
- [Claude Code third-party API](/guides/claude-code-third-party-api)

‎landing/content/blog/claude-code-third-party-fingerprint.zh-CN.md‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
---
2+
title: Claude Code 是怎么识别第三方 Agent 的（不是字符串黑名单）
3+
description: 拆解 Anthropic 的第三方检测机制：为什么把 OpenClaw、Hermes 改个名没用、到底是什么触发了分类器，以及 clovapi 为何始终站在「合法配置层」这一侧。
4+
date: 2026-05-29
5+
---
6+
7+
只要你用非官方客户端跑 Claude 订阅，大概率见过这个 400：
8+
9+
```
10+
Third-party apps now draw from your extra usage, not your plan limits.
11+
We've added a $XXX credit to get you started. Claim it at claude.ai/settings/usage.
12+
```
13+
14+
2026 年 4 月起，Anthropic 把订阅用量拆成两个池子：**plan limits** 给官方 Claude Code 客户端，另设一个预付的 **extra usage** 池给第三方 Agent（OpenClaw、OpenCode、Hermes、Aider…）。当你被判为第三方、且该池余额为 0 时，请求直接被拒。这不是限流——等不会好。
15+
16+
有意思的问题是：**服务端到底怎么知道你不是 Claude Code？**
17+
18+
## 误解：它在 grep 品牌名
19+
20+
直觉答案是「字符串黑名单」——以为请求里出现 `openclaw`、`hermes` 就被命中。几个人逆向后**证伪了这个假设**：
21+
22+
- 有人把一份 44KB system prompt 里所有不区分大小写的 `openclaw` 全替换成 `claude`，其余不变，**照样被 block**。([byoky：逆向指纹](https://byoky.com/blog/anthropic-claude-code-fingerprint))
23+
- 另有人确认 `systemPrompt.replaceAll("OpenCode", "Claude Code")` **过不了**，只有删掉整段静态 prompt 才行。([opencode-claude-auth #145](https://github.com/griffinmartin/opencode-claude-auth/issues/145))
24+
25+
> "So it's not literal string matching. The classifier is looking at content patterns, not specific tokens. Probably ML. Definitely not regex."
26+
27+
所以「抹掉品牌名」换来的是隐私，不是绕过。
28+
29+
## 真正触发分类器的是什么
30+
31+
各方独立记录的一致结论是：检测**基于内容、在服务端完成**——和 headers / TLS / IP 无关。三个信号叠加，任一即可命中：
32+
33+
1. **Headers**——必要但不充分。`claude-cli/*` 的 user-agent 加 `claude-code-*` beta flag 是入场券；缺了直接挂。
34+
2. **工具名**——Claude Code 的规范 PascalCase 词表（`Read`、`Bash`、`Edit`）。小写 / snake_case（`read_file`、`terminal`）一眼第三方。
35+
3. **System prompt 形态**——`system` 字段会被一个类似内容分类器的东西审查。长 agent 框架提示词（人设、记忆规则、心跳协议）**即使抹掉品牌名也会被判**。
36+
37+
一个关键细节：分类器只查 system prompt 的**静态部分**。运行时注入的段落（`<env>`、目录清单、你的 `AGENTS.md`）内容再花也放行——否则正常 Claude Code 用户没法加项目指令。
38+
39+
## 反讽之处
40+
41+
这个分类器激进到会误伤。Anthropic 自家的 Claude Code **VS Code 插件**就被同样的报错错误拦截过（[claude-code #45016](https://github.com/anthropics/claude-code/issues/45016)），还有用户只是在原生终端里粘了一段结构化的 CRM 工单文本就被判第三方。
42+
43+
## clovapi 站在哪一侧
44+
45+
clovapi 是**配置层**，不是绕过代理。它不会伪造 first-party 身份来逃避计费。它做的是：
46+
47+
- 把**你已合法获得的凭据**（官方 OAuth 写入、API Key、第三方网关）整理成 profile。
48+
- 按 CLI `switch` 应用，并通过本地代理做 API 形态转码。
49+
50+
想用订阅，受支持的路径仍是官方 Claude Code 客户端；想用第三方 Agent，可长期执行的答案是 **API Key 计费**，而不是 OAuth 伪装：
51+
52+
```bash
53+
clovapi switch --cli claude-code --vendor "Custom API" --model <model-id>
54+
clovapi switch --cli opencode --vendor "Custom API" --model <model-id>
55+
```
56+
57+
逆向讨论的真正启示，不是「找到那个魔法字符串」，而是：身份检测已经变成一个会持续学习、在内容层运作的分类器——所以稳定策略是把账单付对，而不是去追一个一直在进化的模型。
58+
59+
## 延伸阅读
60+
61+
- [Anthropic 封禁第三方 OAuth 之后，Agent 用户该怎么配 API？](/blog/anthropic-oauth-ban-agent-workflow)
62+
- [预算有限时的 Claude Code 分级路由](/blog/claude-code-tier-routing-on-a-budget)
63+
- [Claude Code 第三方 API](/guides/claude-code-third-party-api)

‎landing/src/lib/blog-data.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ export const BLOG_POSTS: BlogPostDef[] = [
1111
{ slug: "desktop-app-vs-cli-workflow", priority: 0.78 },
1212
{ slug: "switch-opencode-upstream-with-clovapi", priority: 0.76 },
1313
{ slug: "anthropic-oauth-ban-agent-workflow", priority: 0.75 },
14+
{ slug: "claude-code-third-party-fingerprint", priority: 0.745 },
1415
{ slug: "stop-diy-proxy-sprawl-for-agent-cli", priority: 0.74 },
1516
{ slug: "claude-code-tier-routing-on-a-budget", priority: 0.73 },
1617
{ slug: "switch-between-claude-codex-opencode", priority: 0.72 },

0 commit comments

Comments
 (0)