Claude Code

Claude Code documents no whole-agent export or matching import. /export writes only the current conversation as plain text. Agent state is spread across ~/.claude, ~/.claude.json and project .claude/ files, and no procedure is documented for moving it to another machine.

• Sessions: export and locate session data
• Commands reference (/export)
• Explore the .claude directory

The only export is conversation text. Several classes of state are held by the provider on claude.ai and are not in any export: claude.ai connectors, synced skills and plugins, and cloud sessions/routines. Anthropic-hosted connectors (e.g. Gmail, Google Calendar, Microsoft 365) can only be linked through the redirect URL registered by claude.ai.

• Sessions: export
• MCP: use MCP servers from claude.ai
• Skills synced from claude.ai

The runtime is a closed binary. Its right to use comes from Anthropic's Consumer Terms, under which Anthropic 'may suspend or terminate your access to the Services ... at any time without notice' and may revise the terms at its discretion. No perpetual or irrevocable right to run is granted. Anthropic also 'doesn't support routing Claude Code to non-Claude models through any gateway'.

• Anthropic Consumer Terms (sections 9, 10, 12)
• Legal and compliance
• claude-code repository LICENSE.md (commit 732e167)
• Other LLM gateways

ANTHROPIC_BASE_URL, gateway model discovery and CLAUDE_CODE_MAX_CONTEXT_TOKENS are documented and let an Anthropic-format endpoint serve other model IDs. However, Anthropic states it doesn't support routing Claude Code to non-Claude models, so local open-weight models work only through an unofficial workaround. Features tied to Anthropic API betas degrade on non-first-party hosts, e.g. MCP tool search is disabled by default.

• Other LLM gateways
• Environment variables
• Model configuration

In the default local CLI, configuration, CLAUDE.md, auto memory, skills and transcripts are plain files on the owner's machine, so they stay available after account termination. Skills synced from claude.ai stay on disk once downloaded. Provider-held classes and 30-day transcript pruning are graded in P2 and A1.

• Explore the .claude directory: application data
• Skills synced from claude.ai
• Anthropic Consumer Terms: termination

State is stored as plaintext JSONL, JSON and Markdown with no encryption. However, the docs say the transcript entry format 'is internal to Claude Code and changes between versions', and the provider-supplied base prompt and built-in logic ship inside a closed binary rather than as documented readable files.

• Sessions: export and locate session data
• Explore the .claude directory: plaintext storage

/context breaks down the context by category, and OTEL_LOG_RAW_API_BODIES can log the full request JSON (including the system prompt) to an owner-run collector. /status and /model show the model in use. One shortfall: behaviour is also shaped by GrowthBook feature flags fetched from Anthropic (they can change the starting permission mode and turn features or 'server configuration' experiments on), and the owner has no documented way to see which flag values are in effect.

• Debug your config (/context)
• Monitoring usage (OTEL_LOG_RAW_API_BODIES)
• Env vars: features that need feature-flag fetching
• Permission modes: which mode a session starts in

For consumer plans, Anthropic keeps sessions for 30 days, or up to 5 years if training is allowed. Flagged sessions are kept for up to 2 years, and trust-and-safety classification scores for up to 7 years. De-identified data may be kept 'longer' for research, and data may also be kept 'as necessary to combat violations'. Classification scores are derived data that the owner cannot see, and some retention periods are open-ended.

• Privacy Center: How long do you store my data?
• Anthropic Privacy Policy section 6
• Data usage

The provider-preferred defaults found are disclosed and can be switched off: the auto-added 'claude.ai Claude Docs' connector (deniedMcpServers), claude.ai-synced Anthropic skills (syncClaudeAiSkills), official marketplace auto-install (env var) and Claude Code commit/PR attribution lines (attribution setting). Because the runtime is closed, the absence of other self-preferencing rests on no binding commitment.

• MCP: use MCP servers from claude.ai
• How Claude Code works: context Claude Code adds
• Data usage: default behaviors

Session transcripts record every tool call with its arguments and results, but two shortfalls apply. (1) Transcripts are deleted after cleanupPeriodDays, which defaults to 30 days. (2) Hook commands are an entry path whose own actions are not written to the transcript: stdout and stderr go only to the debug log. The transcript is also written asynchronously, and no alert on recording failure is documented.

• Explore the .claude directory: cleaned up automatically
• Hooks reference

No integrity data (hash chaining, signatures or checkpoints) is documented for transcripts or logs. They are plain JSONL files that can be changed without trace.

• Explore the .claude directory: plaintext storage
• Sessions

In the default auto mode, the model-based classifier blocks writes to session transcripts (v2.1.205+). That is a classifier policy, not a structural guarantee. The OS-level sandbox protects 'most of' ~/.claude, but it is off by default, covers only Bash, and bypassPermissions skips the protected-path checks.

• Permission modes: auto mode blocks
• Sandboxing: protected paths
• Permissions

The runtime is closed: the public anthropics/claude-code repository's LICENSE.md says '© Anthropic PBC. All rights reserved', and the repository holds plugins, examples and the changelog, not the runtime source. A GPG-signed manifest verifies that binaries came from Anthropic, not that they match any source.

• claude-code repository LICENSE.md (commit 732e167)
• Setup: verify binary integrity

The agent has no identity of its own that the owner roots. It acts through the owner's claude.ai OAuth login, which Anthropic can revoke, and through the owner's own tool credentials. Its only default outward marker is a provider-branded 'Co-Authored-By: Claude' attribution.

• Authentication
• How Claude Code works: context Claude Code adds

Checkpointing (Esc Esc / rewind) restores the conversation and Claude's file edits. It does not track Bash-made or external changes, or changes to settings, permissions, model or runtime version. The provider-side sync of claude.ai skills and connectors has no change history. Memory edits appear only as tool calls in transcripts, which are pruned.

• Checkpointing: limitations
• Explore the .claude directory

The owner can replace the whole system prompt with --system-prompt or --system-prompt-file, add output styles, CLAUDE.md, rules and skills, and turn off git instructions and attribution. However, the system-prompt replacement is a per-launch flag rather than a persistent setting, and the docs do not show that every injected system reminder can be removed. Local edits to claude.ai-synced skills 'can be overwritten or removed' by a later sync.

• CLI reference: system prompt flags
• Output styles
• Skills synced from claude.ai
• How Claude Code works

Persistent memory is CLAUDE.md/AGENTS.md files, .claude/rules, and auto memory saved as Markdown files in ~/.claude/projects/<project>/memory/. All of them can be listed, edited and deleted as ordinary files or through /memory, and auto memory can be turned off.

• Memory

The owner can add any tool, with no provider review, through MCP servers (claude mcp add), plugins, skills and hooks. Built-in tools can be removed with --tools, --disallowedTools or permission deny rules, and claude.ai connectors can be disabled.

• MCP
• CLI reference
• Permissions

Every documented protection can be switched off by the owner: sandboxing (sandbox settings), the auto-mode classifier (permission mode choice), protected-path checks (bypassPermissions), the WebFetch domain blocklist (skipWebFetchPreflight), telemetry, and the auto-updater. The actions no mode auto-approves (e.g. rm on critical paths) still ask the owner rather than refuse outright.

• Permission modes
• Sandboxing
• Data usage: WebFetch domain safety check

By default, native installs auto-update on the 'latest' channel, and features and the starting permission mode can change through server-fetched GrowthBook flags. Anthropic can also 'temporarily turn off' auto mode server-side. The owner can pin a version (DISABLE_AUTOUPDATER, DISABLE_UPDATES, or installing a specific version), disable flag fetching (DISABLE_GROWTHBOOK), and pin a full model ID. However, hosted models retire with at least 60 days' notice, which cannot be declined, and v2.1.257 rewrote a saved 'claude-fable-5' model setting to the 'fable' alias.

• Setup: auto-updates, release channel, disable auto-updates
• Env vars: DISABLE_GROWTHBOOK and feature-flag fetching
• Model configuration: aliases and pinning
• Model deprecations
• Permission modes

Limits can be set per tool, path, command prefix and domain through permission rules, and the OS sandbox adds file and network isolation. Channel plugins keep a per-sender allowlist, and the agent is blocked from editing its own settings files (protected paths). Spend is treated as met under G11 because there is no payment capability. One shortfall: sandbox limits cover only Bash commands, so MCP server and hook processes run outside them, and the docs call Bash rules 'not a security boundary'.

• Permissions
• Sandboxing
• Channels

The owner can put ask rules on any tool or pattern, and ask rules are honoured in every mode, including bypassPermissions. However, the docs say Bash ask and deny rules match only the command text as written and are 'not a security boundary around the program'. As a result, a gate on an action class performed through the shell (e.g. a given program) can be bypassed by another invocation form.

• Permissions: Bash rule limits
• Permission modes: actions no mode auto-approves

Esc or Ctrl+C stops the foreground turn. Background subagents need a separate Ctrl+X Ctrl+K. Background sessions in agent view keep running after Ctrl+C or exit and need /stop or Ctrl+X per session. Cloud routines and desktop scheduled tasks are stopped separately.

• Interactive mode: keyboard shortcuts
• Agent view

On the default Pro/Max sign-in, Anthropic trains on sessions when the consumer 'help improve Claude' setting is on. Anthropic's own pages do not say what the setting defaults to at signup. Third-party reporting (TechCrunch, labelled) says the consent pop-up toggle was preset to 'On', with a smaller switch than the Accept button. Under G12 the opt-in is not shown. Other flows: metrics telemetry, error reports (third-party service) and the WebFetch hostname check are on by default but can be turned off. Consumer Terms changes take effect when the owner keeps using the service ('continue to access'). Flagged content is used to train trust-and-safety classifiers.

• Data usage
• Anthropic: Updates to Consumer Terms and Privacy Policy
• Anthropic Privacy Policy
• Anthropic Consumer Terms
• Third-party: TechCrunch, 28 Aug 2025

Local credentials are listed and revoked one at a time: /logout revokes the login, and each MCP server has 'Clear authentication' or claude mcp logout. Connector credentials for claude.ai connectors are held by Anthropic and managed at claude.ai/customize/connectors. No public statement says provider-side copies are deleted on revocation, so under G12 the pass is withheld.

• Authentication: credential management
• MCP: authentication
• Data usage: cloud execution credentials

claude project purge deletes local state one project at a time, and account deletion is a separate step on claude.ai. Provider-side copies survive: flagged sessions (up to 2 years), classification scores (up to 7 years), de-identified training data, and data kept 'as required by law ... or as necessary to combat violations'.

• CLI reference: claude project purge
• Privacy Center: How long do you store my data?