Tag: Developer Reference

  • AI Agents Are Learning to Check Instead of Guess: The GitHub Context Problem

    AI Agents Are Learning to Check Instead of Guess: The GitHub Context Problem

    Most AI assistants still answer from memory. Ask one a question and it reasons from patterns baked in during training — useful, but static. The moment a question depends on something that changed yesterday, or something that only exists inside your own systems, that static knowledge runs out.

    The more interesting shift happening in AI tooling right now isn’t bigger models — it’s agents that can actually go check. Dispatch-style AI systems, the kind that can spin off an isolated task, open a real shell, browse a real page, or read an actual file, are starting to close the gap between “the AI’s best guess” and “what’s actually true right now.” GitHub is a good test case for why that distinction matters.

    Search-and-cite isn’t the same as read-and-act

    A lot of what gets marketed as an AI “GitHub integration” is really a search layer: the assistant can look up an issue or a pull request and summarize it, with a citation back to the source. That’s genuinely useful for answering “what did that PR change” — but it’s a dead end the moment you need the assistant to actually do something, like open an issue, comment, or verify what a repository’s current state really is.

    The more capable version of this connects an agent directly to real developer tooling: an actual shell, a real git client, real file access. Instead of summarizing a cached snapshot of a repo, the agent can clone it, read the current commit log, open the actual config files, and answer questions against what’s genuinely there today — including the uncomfortable cases, like when the live state doesn’t match what anyone assumed it would.

    Why “just check” is harder than it sounds

    The obvious rebuttal is: shouldn’t a good assistant just check before it answers? In practice, most AI tools default to answering from what they already “know,” because checking is slower and requires actual tool access, not just a knowledge base. The systems that skip the check tend to produce confident, plausible-sounding answers that are quietly wrong the moment reality has drifted from training data — a stale API, a renamed config path, a repo that moved.

    The fix isn’t a smarter model. It’s an agent willing to spend the extra step: open the real file, run the real command, read the real log, before saying anything with confidence. That habit is unglamorous, but it’s the difference between an assistant that sounds right and one that actually is.

    The practical takeaway

    For any business layering AI into real workflows, the question worth asking about a tool isn’t just “how smart is the model” — it’s “what can this thing actually go look at, and will it bother to.” An assistant that can search and summarize is a research aid. One that can open a shell, read your actual repository, and ground its answer in what’s really there is a different category of tool entirely — and it’s the direction the whole space is quietly moving.

  • Logic Apps vs Cloud Workflows: No-Code Automation Across Two Clouds

    Logic Apps vs Cloud Workflows: No-Code Automation Across Two Clouds

    Every content operation runs on small invisible chains of “when this happens, do that.” Publish an article → notify a channel → write a row to the ledger. None of it is hard, but you don’t want to babysit a script for it — you want a managed orchestrator that fires on an event, calls a few services, and logs the result, for free. Azure and Google each have one, and they take opposite philosophies to the same job.

    We wire the same publish → notify → log automation on both Azure Logic Apps and Google Cloud Workflows, on the free tiers, and compare. Short answer: Logic Apps wins when the work is gluing SaaS services together — its connector library and visual designer are unmatched, with a free grant of 4,000 built-in actions/month. Cloud Workflows wins when the work is lightweight, code-first orchestration inside GCP — its 5,000 internal + 2,000 external steps/month free tier pairs cleanly with Eventarc and Pub/Sub. One is a no-code SaaS glue gun; the other is a YAML orchestration engine.

    This is the breakdown from the running lab on tygart.media — connector ecosystems, visual designer vs YAML, triggers, and free ceilings.

    The free-tier ceilings

    How we do it

    Azure Google Cloud Verdict
    Free grant/month 4,000 built-in actions 5,000 internal + 2,000 external steps Comparable, units differ
    Billing model Per-action (Consumption) Per-step (internal vs external) Different mental models
    What counts Each connector/built-in action Each workflow step executed Tie at our volume
    Fit for a glue chain Generous Generous Tie
    Our actual bill $0 $0 Tie where it counts

    Both free grants comfortably cover a real automation cadence. A publish → notify → log chain is three or four actions/steps per run; at a few publishes a day, neither 4,000 actions nor 7,000 steps comes close to binding. The units differ — Azure counts actions, Workflows splits internal vs external steps (external = calls out to other services, which are scarcer) — but for our workload both run free.

    Connectors vs code-first

    This is the real fork in the road, and it decides the choice.

    How we do it

    Azure Google Cloud Verdict
    Connector library Hundreds (SaaS + Microsoft + 3rd-party) HTTP + GCP services, no big SaaS catalog Logic Apps, decisively
    Authoring model Visual designer (drag-and-drop) YAML (code-first) Logic Apps for no-code
    SaaS glue (Slack, email, etc.) Native connectors, prebuilt auth Roll your own via HTTP Logic Apps
    GCP-native orchestration Possible via HTTP First-class Cloud Workflows
    Versioning / review in git Exportable, but designer-first YAML lives in git naturally Cloud Workflows

    Logic Apps’ superpower is its connector library — hundreds of prebuilt, pre-authenticated connectors for Slack, Office, Salesforce, Twitter/X, databases, and most SaaS you’d name. Wiring “post to Slack when an article publishes” is point-and-click, with the OAuth handled for you. Cloud Workflows takes the opposite stance: it’s code-first YAML with no big SaaS catalog — you orchestrate GCP services and arbitrary HTTP endpoints, building any integration you need by hand. That’s less convenient for SaaS glue but cleaner for engineers who want their orchestration in git, reviewed like code.

    Triggers and event sources

    How we do it

    Azure Google Cloud Verdict
    Native triggers Many (HTTP, schedule, connector events) HTTP + Eventarc/Pub/Sub Logic Apps on built-in variety
    Event-driven on cloud events Via Event Grid Via Eventarc (first-class) Cloud Workflows for GCP events
    Schedule / cron Built-in recurrence Cloud Scheduler Tie
    SaaS event triggers Connector-based, prebuilt Roll your own Logic Apps
    Pub/Sub-style fan-out Event Grid Pub/Sub (native pairing) Cloud Workflows in GCP

    Logic Apps can be triggered by connector events directly — “when a new email arrives,” “when a row is added” — which keeps SaaS-driven automations entirely no-code. Cloud Workflows leans on Eventarc and Pub/Sub for event sources, which is the idiomatic, powerful path if your events originate in GCP. Each is strongest for events native to its own cloud.

    What surprised us

    • Logic Apps’ connector library is the whole ballgame for SaaS glue. Pre-authenticated connectors turned a “write a small integration” task into a five-minute drag-and-drop. Nothing on the GCP side matches that catalog.
    • Cloud Workflows’ YAML-in-git is quietly the better engineering experience. When the orchestration lives in the repo and gets code-reviewed, it stops being a clickable black box. We liked that more than expected.
    • The free grants are both ample. We worried about per-action metering and never came near either ceiling at a realistic publishing cadence.
    • External steps are the scarce currency on GCP. Workflows’ 2,000 external steps (calls out to other services) is the limit to watch, not the 5,000 internal steps.

    The takeaway

    Pick Azure Logic Apps if your automation is mostly gluing SaaS services together — Slack, email, CRMs, Microsoft 365 — and you want a visual, no-code designer with hundreds of pre-authenticated connectors. It’s the fastest path from “I wish X notified Y” to a running flow.

    Pick Google Cloud Workflows if your automation is lightweight orchestration inside GCP — coordinating Cloud Run, Functions, Pub/Sub, and HTTP endpoints — and you want it defined as code-first YAML that lives in git and pairs with Eventarc. It’s the cleaner engineering primitive when the events and services are already on Google’s side.

    For our publish → notify → log chain, the deciding factor is where the notify lands: a Slack or email notification leans Logic Apps for the free connector; a fan-out into Cloud Run or Pub/Sub leans Workflows. Running the same chain on both made the connector-vs-code-first trade concrete.

    This is part of our “Two Clouds, One Site” series — we run the same media property on both Azure and Google Cloud on the free tiers, wiring the same automation on each to see which orchestrator fits which job. The lab lives on tygart.media; the findings publish here.

    Frequently asked questions

    What’s the free tier for Azure Logic Apps and Google Cloud Workflows?
    Azure Logic Apps (Consumption) includes a free grant of 4,000 built-in actions per month. Google Cloud Workflows includes 5,000 internal steps and 2,000 external steps per month free. Both comfortably cover a realistic automation cadence, so a small glue chain runs at $0 on either.

    Which is better for no-code automation, Logic Apps or Cloud Workflows?
    Logic Apps is the no-code choice — it has a visual drag-and-drop designer and hundreds of pre-authenticated connectors for SaaS services. Cloud Workflows is code-first YAML with no big SaaS catalog, so it suits engineers orchestrating GCP services rather than non-developers gluing apps together.

    Does Cloud Workflows have a connector library like Logic Apps?
    No. Cloud Workflows orchestrates GCP services and arbitrary HTTP endpoints, but it has no large prebuilt SaaS connector catalog the way Logic Apps does. To integrate a third-party SaaS in Workflows, you call its HTTP API and handle authentication yourself, whereas Logic Apps provides a ready-made connector.

    How do I trigger automation when an article is published?
    On Azure, a Logic App can be triggered by an HTTP request, a schedule, or a connector event, then call further connectors with no code. On Google Cloud, a Workflow is typically triggered via Eventarc or Pub/Sub for cloud-native events, or by HTTP. Each is strongest for events that originate inside its own cloud.

    Which is better for gluing SaaS and cloud events together?
    Logic Apps wins for SaaS glue thanks to its connector library and visual designer, making things like “notify Slack when X happens” nearly code-free. Cloud Workflows wins for lightweight, code-first orchestration of GCP services that lives in git and pairs with Eventarc and Pub/Sub. Pick by where your events and services already live.

  • Azure Static Web Apps vs Firebase Hosting: A Dashboard on Each

    Azure Static Web Apps vs Firebase Hosting: A Dashboard on Each

    A static front-end — an internal dashboard, a docs site, a landing page — is the most thankless thing to host badly and the most satisfying thing to host well. You want a global CDN, free SSL, a custom domain, and CI/CD that redeploys when you push, all without standing up a server or paying a cent. Both Azure and Google have a purpose-built free product for exactly this, and they’re both genuinely excellent.

    We host the same internal dashboard on both Azure Static Web Apps and Firebase Hosting, on the free tiers, and compare. Short answer: this is a toss-up — both are excellent, pick by ecosystem. Azure Static Web Apps free tier gives you 100 GB of bandwidth, 2 custom domains, 0.5 GB per app, free managed SSL, and built-in CI/CD straight from GitHub. Firebase Hosting’s free Spark plan gives you 10 GB of storage, 360 MB/day of transfer, free SSL, and custom domains. The right answer is whichever cloud your other services already live in.

    This is the breakdown from the running lab on tygart.media — bandwidth and limits, CI/CD, auth and functions integration, custom domains, and the CDN.

    The free-tier ceilings

    How we do it

    Azure Google Cloud Verdict
    Free bandwidth 100 GB total 360 MB/day (~10 GB/mo) transfer Azure on raw monthly headroom
    Free storage per app 0.5 GB 10 GB Firebase on storage
    Custom domains (free) 2 Multiple supported Firebase, slightly
    Free managed SSL Yes Yes Tie
    Built-in CI/CD Yes (GitHub Actions wired automatically) Yes (Firebase CLI / GitHub Action) Azure, slightly more turnkey

    The numbers favor different things. Azure leads on monthly bandwidth — 100 GB is a lot of dashboard traffic — while Firebase leads on storage, with 10 GB versus Azure’s 0.5 GB per app. For an internal dashboard, neither limit is close to binding: the assets are small and the audience is a handful of people. Firebase’s 360 MB/day transfer cap is the one to watch only if a dashboard goes unexpectedly viral, which an internal tool won’t.

    CI/CD, auth, and functions

    This is where “static hosting” stops being just a CDN and starts being a platform.

    How we do it

    Azure Google Cloud Verdict
    Deploy on git push Auto-wired GitHub Actions Firebase CLI or GitHub Action Azure on zero-config setup
    Built-in auth Yes (Entra, GitHub, social — built in) Via Firebase Authentication Azure for bundled, Firebase for depth
    Serverless functions Built-in Azure Functions integration Cloud Functions / pairs naturally Tie — both have a backend path
    Staging environments Free preview environments per PR Preview channels Tie
    Setup friction Connect repo, done CLI init, done Azure, slightly

    Azure Static Web Apps’ standout is how much it bundles by default: connect a GitHub repo and it writes the Actions workflow for you, provisions preview environments per pull request, and offers built-in authentication (Entra, GitHub, and social providers) without you wiring an auth service. Firebase matches the capability but composes it from named products — Firebase Authentication and Cloud Functions — which is more à la carte and, if you’re already deep in Firebase, more powerful and familiar.

    Custom domains and the CDN

    How we do it

    Azure Google Cloud Verdict
    Custom domain setup 2 free, managed cert Add domain, managed cert Tie
    Global CDN Yes, included Yes, included (Fastly-backed) Tie
    Cache control Configurable Configurable Tie
    TTFB at our scale Fast Fast Tie

    Both put your dashboard behind a real global CDN with automatic SSL on a custom domain, and at our scale the time-to-first-byte was indistinguishable. This part is genuinely a wash — both clouds have solved static delivery.

    What surprised us

    • Azure’s per-PR preview environments are a delight. Open a pull request and you get a live URL of that exact change, free, with no setup. For reviewing dashboard tweaks it’s better than we expected.
    • Firebase’s storage allowance is the bigger one. 10 GB versus 0.5 GB sounds dramatic, but for a static front-end neither limit matters — the assets are tiny.
    • Azure’s built-in auth saved real work. Adding GitHub login to an internal dashboard was nearly free of code on Azure; on Firebase it meant wiring Firebase Authentication, which is more capable but more steps.
    • The hosting itself is a non-event on both. Push, it’s live, it’s fast, it’s free. That’s the whole experience — exactly as it should be.

    The takeaway

    Pick Azure Static Web Apps if you want the most bundled experience — auto-wired GitHub CI/CD, free per-PR preview environments, and built-in authentication — and your stack already leans Microsoft. The 100 GB bandwidth is generous for any internal tool.

    Pick Firebase Hosting if you’re already in the Firebase/Google ecosystem and want its deeper, composable Authentication and Cloud Functions, or you value the larger 10 GB storage allowance. It pairs naturally with the rest of Firebase.

    Honestly, for a static dashboard you can’t go wrong. We run the dashboard on whichever cloud hosts the data and functions behind it — co-location beats cleverness. Both deliver the dashboard fast, on a custom domain, with free SSL, at $0.

    This is part of our “Two Clouds, One Site” series — we run the same media property on both Azure and Google Cloud on the free tiers, hosting the same dashboard on each to feel where the platforms differ. The lab lives on tygart.media; the findings publish here.

    Frequently asked questions

    What do the free tiers of Azure Static Web Apps and Firebase Hosting include?
    Azure Static Web Apps’ free tier includes 100 GB of bandwidth, 2 custom domains, 0.5 GB of storage per app, free managed SSL, and built-in GitHub CI/CD. Firebase Hosting’s free Spark plan includes 10 GB of storage, 360 MB/day of transfer, free SSL, and custom domains. Azure leads on bandwidth; Firebase leads on storage.

    Which is better for hosting a static site or dashboard for free?
    Both are excellent and the choice comes down to ecosystem. Azure Static Web Apps bundles more by default — auto-wired CI/CD, per-PR preview environments, and built-in authentication. Firebase Hosting pairs naturally with Firebase Authentication and Cloud Functions and offers more free storage. Pick the one matching the rest of your stack.

    Does Azure Static Web Apps include built-in authentication?
    Yes. Azure Static Web Apps offers built-in authentication with Entra ID, GitHub, and social providers without wiring a separate auth service, which makes adding login to an internal dashboard nearly code-free. Firebase achieves the same through Firebase Authentication, which is more capable but takes more setup.

    Do both Azure Static Web Apps and Firebase Hosting give free SSL and custom domains?
    Yes. Both provide free managed SSL certificates and support custom domains on the free tier — Azure includes 2 custom domains, and Firebase supports adding custom domains with managed certificates. Both also put your site behind a global CDN at no cost.

    Will I hit the free hosting limits with an internal dashboard?
    Almost certainly not. An internal dashboard serves small assets to a few people, so neither Azure’s 100 GB bandwidth nor Firebase’s 360 MB/day transfer comes close to binding. Firebase’s daily transfer cap would only matter if a public site went unexpectedly viral.

  • Cosmos DB vs Firestore: A Free-Tier Operations Ledger on Both Clouds

    Cosmos DB vs Firestore: A Free-Tier Operations Ledger on Both Clouds

    Every real content operation grows a small database it didn’t plan for: a ledger of what got published when, a metadata store tracking which article has an audio version, which has been translated, which is queued. It’s not big data — it’s a few thousand small records that need to be written cheaply, queried quickly, and never cost anything. The question is which cloud’s free NoSQL tier carries that load forever.

    We run the same small ops ledger and content-metadata store on both Azure Cosmos DB and Google Firestore, on the free tiers, and watch the quotas. Short answer: Cosmos DB’s always-free tier is unusually generous1,000 RU/s of provisioned throughput plus 25 GB of storage, free for the life of one account per subscription. Firestore’s free tier is simpler but tighter1 GiB of storage with 50,000 reads, 20,000 writes, and 20,000 deletes per day. For a metadata store that fits either, Cosmos gives you more room; Firestore gives you less to think about.

    This is the breakdown from the running lab on tygart.media — free-tier generosity, data model, query power, latency, and which one we’d trust with the ledger.

    The free-tier ceilings

    This is where the two diverge most, and the units don’t line up cleanly — which is itself the point.

    How we do it

    Azure Google Cloud Verdict
    Free throughput 1,000 RU/s provisioned 50K reads / 20K writes / 20K deletes per day Cosmos for steady throughput
    Free storage 25 GB 1 GiB Cosmos — 25× the storage
    Billing unit Request Units (RU/s) Per-operation daily quota Different mental models
    How many free tiers One per subscription Per project (Spark plan) Tie, structurally
    Fit for a metadata store Generous Comfortable for small stores Cosmos on headroom

    The mismatch in units is the real story. Cosmos meters everything in Request Units — a blended currency for reads, writes, and queries — and gives you a flat 1,000 RU/s continuously plus 25 GB. Firestore meters discrete daily operations — 50K reads, 20K writes, 20K deletes — and 1 GiB. For our ledger, Cosmos’s 25 GB is absurd headroom we’ll never approach, and 1,000 RU/s comfortably absorbs bursty publish events. Firestore’s daily caps are fine for a small store but you feel them: a chatty dashboard that re-reads the ledger on every page load can nibble through 50K reads faster than you’d expect.

    Data model and query power

    How we do it

    Azure Google Cloud Verdict
    Data model Multi-model (document, key-value, graph, column) Document (collections + docs) Cosmos on flexibility
    API surface NoSQL (SQL-like), MongoDB, Cassandra, Gremlin, Table Native Firestore SDK Cosmos on portability
    Query model Rich SQL-like queries, indexing tunable Indexed queries, real-time listeners Tie — different strengths
    Real-time sync Change feed First-class real-time listeners Firestore on live UI
    Schema Schema-agnostic Schema-agnostic Tie

    Cosmos is multi-model: the same data can be addressed through a SQL-like NoSQL API, MongoDB’s wire protocol, Cassandra, Gremlin (graph), or Table. If you ever want to query the ledger like a graph, or you’re migrating off MongoDB, that optionality is real and free. Firestore is single-purpose by design — document collections with excellent real-time listeners, which is the thing to reach for when a dashboard should update live as the ledger changes. For a metadata store feeding a UI, those listeners are genuinely pleasant.

    Latency and operational feel

    How we do it

    Azure Google Cloud Verdict
    Read latency Single-digit ms (tuned) Low, very consistent Tie at our scale
    Provisioning model Provisioned RU/s (or serverless) Fully managed, no capacity knobs Firestore on simplicity
    Capacity tuning You can over/under-provision Nothing to tune Firestore on hands-off
    Setup friction A few more knobs Near-zero Firestore

    At our volume, both are fast enough that latency never registered as a difference. The operational feel diverges: Cosmos hands you knobs (RU/s, consistency levels, indexing policy) — power if you want it, a thing to learn if you don’t. Firestore has almost no knobs, which is the right call when the database is a side character in your stack and you never want to think about capacity.

    What surprised us

    • Cosmos’s 25 GB always-free storage is wildly generous for a metadata store. We will not approach it. It reframed Cosmos from “enterprise database” to “perfectly viable free tier.”
    • Firestore’s daily read quota is the thing to watch. It’s not the storage that bites — it’s a chatty UI re-reading the ledger. Cache reads or you’ll surprise yourself.
    • The RU/s model has a learning curve. Cosmos’s Request Unit currency is unintuitive at first; once it clicks, capacity planning is straightforward, but day one is more conceptual than Firestore.
    • Firestore’s real-time listeners are a quiet joy. For a live dashboard, “the data just updates” without polling is worth a lot.

    The takeaway

    Pick Azure Cosmos DB if you want maximum free headroom — 1,000 RU/s and 25 GB is a lot of database for $0 — or you value multi-model flexibility and API portability (especially a MongoDB-compatible path). It’s our pick when the ledger might grow or change shape.

    Pick Firestore if you want the simplest possible managed document store with first-class real-time listeners and nothing to tune, and your store stays comfortably inside 1 GiB and the daily operation caps. It’s the right call when the database should disappear into the background.

    For our ops ledger, Cosmos’s always-free generosity is hard to argue with — but for the live dashboard that reads the ledger, Firestore’s real-time listeners are the nicer developer experience. Running the same store on both made the trade explicit instead of theoretical.

    This is part of our “Two Clouds, One Site” series — we run the same media property on both Azure and Google Cloud on the free tiers, keeping the same ops ledger on each to see where the quotas really pinch. The lab lives on tygart.media; the findings publish here.

    Frequently asked questions

    What does the free tier of Cosmos DB and Firestore actually include?
    Azure Cosmos DB’s always-free tier gives 1,000 RU/s of provisioned throughput plus 25 GB of storage, free for one account per subscription. Firestore’s free Spark tier gives 1 GiB of storage with 50,000 reads, 20,000 writes, and 20,000 deletes per day. Cosmos offers far more storage; Firestore meters by daily operations.

    Is Cosmos DB or Firestore more generous on the free tier?
    For storage and steady throughput, Cosmos DB is more generous — 25 GB and a continuous 1,000 RU/s versus Firestore’s 1 GiB and daily operation caps. Firestore is perfectly adequate for a small metadata store, but a chatty application can hit its daily read quota. Cosmos gives more headroom for growth.

    What’s the difference between Cosmos DB and Firestore’s data model?
    Cosmos DB is multi-model: the same data can be queried as documents, key-value pairs, graphs, or columns, and it speaks NoSQL, MongoDB, Cassandra, Gremlin, and Table APIs. Firestore is a focused document database — collections and documents — with excellent real-time listeners. Cosmos offers flexibility; Firestore offers simplicity.

    Which is better for a serverless content metadata store?
    Both work well. Choose Cosmos DB if you want generous free storage, multi-model flexibility, or a MongoDB-compatible path. Choose Firestore if you want a zero-tuning managed store with real-time listeners that update a dashboard live, and your data fits inside 1 GiB and the daily operation limits.

    Will I hit Firestore’s free quota with a small app?
    Storage usually isn’t the problem — 1 GiB holds a lot of small records. The daily read quota of 50,000 is what catches people: a dashboard that re-reads the same data on every page load can consume it quickly. Caching reads keeps a small app comfortably inside the free tier.

  • Azure Functions vs Cloud Run: We Ran the Same Worker on Both

    Pick a serverless platform and you’re picking a default for the next five years of your stack. Most comparisons of Azure Functions vs Google Cloud Run are written from the docs. This one isn’t — we deployed the same worker to both, in production, on the free tiers, and watched what happened.

    The worker is simple on purpose: it takes a webhook, does a little work, writes a record, returns JSON. The kind of glue every real system has dozens of. Boring is exactly what you want when you’re measuring the platform and not the app.

    The short answer

    If you just want the verdict: Cloud Run wins for anything containerized and anything where you care about not storing deploy keys. Azure Functions wins when your automation already lives in the Microsoft ecosystem and benefits from Logic Apps, Event Grid, and Entra sitting right next door. Both run our worker for $0/month. The tie-breakers are deploy security and what else is in the neighborhood.

    Now the detail.

    Deploying the same worker

    This is where the two platforms feel most different, and where Google Cloud quietly pulls ahead.

    How we do it

    Azure Functions Google Cloud Run Verdict
    Unit of deploy Function app (code + host) Container image Cloud Run if you’re already containerized
    Deploy auth Publish profile / service principal Workload Identity Federation — no stored keys Cloud Run, decisively
    Cold start Noticeable on Consumption plan Negligible at our scale Cloud Run
    Local dev parity Functions Core Tools (good) “It’s just a container” (great) Cloud Run

    The headline is the deploy auth. Our Cloud Run workers deploy from GitHub Actions using Workload Identity Federation — GitHub proves its identity to Google with a short-lived token, and no service-account key is ever stored in the repo. That’s not a convenience; it’s the single biggest reduction in credential risk you can make in a CI/CD pipeline. Azure Functions can get close with OIDC + a service principal, but the container-native, keyless Cloud Run path was simpler to lock down and is the model we standardized on.

    What the free tier actually gives you

    Both platforms have genuinely generous always-free serverless tiers. The numbers that matter for a glue worker:

    How we do it

    Metric Azure Functions Google Cloud Run Verdict
    Free requests/month 1,000,000 2,000,000 Google — 2× headroom
    Free compute 400,000 GB-s 360,000 GiB-s + 180,000 vCPU-s Roughly even
    Scale to zero Yes (Consumption) Yes Tie
    Max instances control Yes Yes (and per-service concurrency) Cloud Run, slightly
    Our actual bill $0 $0 Tie where it counts

    At our volume — thousands of invocations a month, not millions — both are free and stay free. The 2M-vs-1M request gap only matters if you’re genuinely high-traffic. For most glue workloads, you will never see a bill on either.

    The neighborhood effect

    A serverless function is rarely alone. It fires because something happened and it triggers something else afterward. That’s where the ecosystems diverge — and where Azure earns its keep.

    • Azure Functions sits next to Logic Apps (4,000 free built-in actions/month), Event Grid (100,000 free operations/month), and Entra ID for identity. If your automation is event-driven and Microsoft-centric, the glue around the function is already there and already free.
    • Cloud Run sits next to Eventarc, Cloud Workflows, Pub/Sub, and Cloud Scheduler — the same pattern on Google’s side, equally capable.

    Neither is “better” in the abstract. The right answer is whichever cloud your other services already live in. A function that triggers a Logic App next door beats a function that has to reach across clouds to do the same thing.

    What surprised us

    • Cloud Run cold starts basically disappeared. At our concurrency the container was warm often enough that we stopped thinking about it. Azure Functions on the Consumption plan had more noticeable cold starts for the same workload.
    • Azure’s free side-resources are real. Functions itself is free, but watch the storage account and Application Insights it provisions alongside — those can accrue tiny charges. Set a budget alert on day one.
    • Keyless deploy changed our security posture more than any single config. Once the repo holds zero secrets for deploys, an entire category of “leaked key” incidents just can’t happen.

    The takeaway

    For a containerized, security-conscious, GitHub-Actions-driven stack, Cloud Run is our default — the keyless deploy and the request headroom settle it. But “default” isn’t “only”: when a workload belongs in the Microsoft ecosystem — triggered by Microsoft events, feeding Microsoft services, governed by Entra — Azure Functions is the right tool, and it runs for the same $0.

    Run the same worker on both for a week. The platform stops being a religious debate and becomes a placement decision: put the work where its neighbors already are.

    This is part of our “Two Clouds, One Site” series — we run the same media property on both Azure and Google Cloud, on the free tiers, and write up what we learn. The lab lives on tygart.media; the findings publish here.

    Frequently asked questions

    Is Azure Functions or Cloud Run cheaper?
    For typical glue workloads, both are free and stay free. Cloud Run offers more free requests per month (2M vs 1M) and Azure offers 400,000 GB-seconds of free compute. At thousands of invocations a month you will not see a bill on either; the cost difference only appears at high traffic.

    Which is more secure to deploy?
    Cloud Run, because it supports keyless deploys via Workload Identity Federation — GitHub Actions authenticates with a short-lived token and no service-account key is stored in the repo. Azure Functions can approximate this with OIDC and a service principal, but the container-native keyless path is simpler to secure.

    Can I run the same code on both Azure Functions and Cloud Run?
    Yes. If you package the worker as a container, Cloud Run runs it directly and Azure Functions can run it via a custom handler or containerized function. We deploy the same worker logic to both; the differences are in deploy tooling and the surrounding event services, not the code.

    When should I choose Azure Functions over Cloud Run?
    Choose Azure Functions when your automation already lives in the Microsoft ecosystem — triggered by Event Grid, orchestrated by Logic Apps, or governed by Entra ID. Co-locating the function with the services it talks to beats reaching across clouds.

    Do serverless cold starts matter on either platform?
    At moderate concurrency, Cloud Run cold starts were negligible in our testing because the container stayed warm. Azure Functions on the Consumption plan showed more noticeable cold starts for the same workload. For latency-sensitive endpoints, test under your real traffic before deciding.

  • Claude Message Batches API: 50% Pricing, Limits and How It Works (2026)

    Claude Message Batches API: 50% Pricing, Limits and How It Works (2026)

    Last verified: June 13, 2026

    The Message Batches API lets you submit up to 100,000 Claude requests in a single call and receive results asynchronously — at exactly 50% of standard token prices. Most batches finish in under an hour. Results remain downloadable for 29 days. This page covers every verified limit, the per-tier rate limit tables, and how batch pricing stacks with prompt caching.

    Pricing: 50% off standard rates

    Every token processed through the Message Batches API is billed at half the standard input and output price. No quality difference from synchronous requests — only timing. The table below shows verified batch prices for active models.

    Model Batch input (per MTok) Batch output (per MTok) Standard input (per MTok) Standard output (per MTok)
    Claude Fable 5 $5.00 $25.00 $10.00 $50.00
    Claude Opus 4.8 $2.50 $12.50 $5.00 $25.00
    Claude Opus 4.7 $2.50 $12.50 $5.00 $25.00
    Claude Opus 4.6 $2.50 $12.50 $5.00 $25.00
    Claude Opus 4.5 $2.50 $12.50 $5.00 $25.00
    Claude Sonnet 4.6 $1.50 $7.50 $3.00 $15.00
    Claude Sonnet 4.5 $1.50 $7.50 $3.00 $15.00
    Claude Haiku 4.5 $0.50 $2.50 $1.00 $5.00

    Source: platform.claude.com/docs/en/build-with-claude/batch-processing

    Key limits at a glance

    Limit Value
    Maximum requests per batch 100,000
    Maximum batch payload size 256 MB
    Typical completion time Under 1 hour
    Hard expiration window 24 hours from creation
    Result retention period 29 days after creation
    Zero Data Retention eligible No
    Results format JSONL, streamed via results_url
    Supported models All active Claude models

    A batch expires if processing has not completed within 24 hours. Any individual request within that batch that did not finish is marked expired — you are not billed for expired or errored requests. Batch results (the JSONL file) are accessible for download for 29 days after the batch was created; after that the batch object itself is still visible but results can no longer be downloaded.

    Message Batches API rate limits by tier

    The Message Batches API has its own rate-limit pool, shared across all models, separate from the standard Messages API limits. The “processing queue” count refers to individual batch requests (not batches) that have been submitted but not yet completed by the model.

    Tier RPM (API calls) Max batch requests in processing queue Max batch requests per batch
    Tier 1 50 100,000 100,000
    Tier 2 1,000 200,000 100,000
    Tier 3 2,000 300,000 100,000
    Tier 4 4,000 500,000 100,000

    Source: platform.claude.com/docs/en/api/rate-limits

    RPM here limits how fast you can make HTTP requests to the Batches API endpoints (create, retrieve, list, cancel). It does not limit how many individual requests inside a batch are processed per minute — that is governed by the queue cap above. If high demand causes processing to slow, more individual requests within a batch may reach the 24-hour expiration limit.

    Stacking batch pricing with prompt caching

    The Batches API documentation explicitly states that the 50% batch discount and prompt caching discounts stack. Cache writes incur a one-time cost at 1.25x the base input rate (5-minute TTL) or 2x (1-hour TTL); subsequent cache reads cost 0.1x the base input rate. Because batches process asynchronously and may take longer than 5 minutes, Anthropic recommends using the 1-hour cache duration for batch requests that share large context.

    The following example uses Claude Opus 4.8 (standard input: $5.00/MTok) to show what each token type costs in a batch with a 1-hour cached system prompt.

    Token type Multiplier applied Effective price per MTok How calculated
    Uncached input (standard) 1x $5.00 Baseline
    Uncached input (batch) 0.5x $2.50 50% batch discount
    Cache write — 1h TTL (batch) 2x × 0.5x = 1x $5.00 2x write cost, then 50% batch
    Cache read (batch) 0.1x × 0.5x = 0.05x $0.25 10% read cost, then 50% batch
    Output (batch) 0.5x of $25.00 $12.50 50% batch discount on output

    In practice: if you cache a 50,000-token system prompt once and then read it across 1,000 batch requests, the cache write costs $0.25 (50K tokens at $5.00/MTok effective), while 1,000 cache reads cost $12.50 total (50M tokens at $0.25/MTok). The same 50 million tokens without caching would cost $125 in batch input (50 MTok at the $2.50/MTok batch rate). Cache hit rates on batches vary; Anthropic’s documentation notes typical rates of 30% to 98% depending on traffic patterns, since batch requests are processed concurrently rather than sequentially.

    How results come back

    When the batch finishes (or the 24-hour limit is reached), a results_url property is set on the batch object. Results are in JSONL format — one JSON object per line, in any order (not necessarily matching submission order). Each result carries the custom_id you assigned, plus a result object of type succeeded, errored, canceled, or expired. Streaming the results file rather than downloading it all at once is recommended for large batches. You are not billed for errored, canceled, or expired requests.

    Does the Batches API count against my standard Messages API rate limits?

    No. The Message Batches API has its own rate-limit pool that is tracked separately from the standard Messages API RPM, ITPM, and OTPM limits. You can use both simultaneously up to their respective limits.

    What happens if my batch does not finish within 24 hours?

    Any individual requests within the batch that did not complete are marked expired. You are not billed for those requests. The batch itself moves to ended status and whatever results did complete are available at the results_url.

    Can I use extended thinking, tool use, or vision in a batch?

    Yes. The Batches API supports vision, tool use (including server tools such as web search and code execution), system messages, multi-turn conversations, and extended thinking. The parameters not supported are stream: true, fast mode (speed), Threads parameters, and max_tokens: 0.

    How long are batch results available for download?

    Results are available for 29 days after the batch was created. After that window, the batch object remains visible in the Console and via the API, but the results file can no longer be downloaded.

    Is the Batches API eligible for Zero Data Retention?

    No. The Message Batches API is explicitly excluded from Zero Data Retention (ZDR). Data is retained under the feature’s standard retention policy regardless of your organization’s ZDR settings.

  • How Many Words Is a Million Claude Tokens? (2026) — and How the New Tokenizer Changed the Math

    How Many Words Is a Million Claude Tokens? (2026) — and How the New Tokenizer Changed the Math

    Last verified: June 13, 2026

    A million Claude tokens equals roughly 750,000 words on Claude Sonnet 4.6 — but only about 555,000 words on Claude Opus 4.7, Claude Opus 4.8, and Claude Fable 5. The gap comes from a new tokenizer that Anthropic introduced with Opus 4.7: it emits up to 35% more tokens from the same text. The only reliable way to measure your actual token count is the /v1/messages/count_tokens endpoint.

    Token-to-word conversion by model (1 million tokens)

    Anthropic publishes word equivalents directly in the context-window tooltips on the official models overview page. The figures below come from those tooltips.

    Model Tokenizer Context window ~Words per 1M tokens ~Pages per 1M tokens*
    Claude Fable 5 (claude-fable-5) New (Opus 4.7) 1M tokens ~555,000 ~2,200
    Claude Opus 4.8 (claude-opus-4-8) New (Opus 4.7) 1M tokens ~555,000 ~2,200
    Claude Opus 4.7 (claude-opus-4-7) New (Opus 4.7) 1M tokens ~555,000 ~2,200
    Claude Sonnet 4.6 (claude-sonnet-4-6) Older 1M tokens ~750,000 ~3,000
    Claude Haiku 4.5 (claude-haiku-4-5) Older 200k tokens ~150,000 (200K context) ~600 (200K context)
    Claude Opus 4.6 (claude-opus-4-6) Older 1M tokens ~750,000 ~3,000

    * Pages estimated at ~250 words per double-spaced page. These are approximations for typical English prose; actual counts vary by content type.

    What the new tokenizer changed — and why it matters

    Anthropic introduced a new tokenizer with Claude Opus 4.7. The official migration guide states that the new tokenizer “may use roughly 1x to 1.35x as many tokens when processing text compared to previous models (up to ~35% more, varying by content).” The most commonly cited figure across Anthropic’s documentation is roughly 30% more tokens for the same text.

    The practical effect: a document that costs 1,000,000 tokens on Opus 4.6 or Sonnet 4.6 costs approximately 1,300,000 tokens on Opus 4.7, Opus 4.8, or Fable 5. Budgets built for the old tokenizer need to be re-baselined against the new one.

    Tokenizer Models Approximate token increase vs. older tokenizer
    New (introduced Opus 4.7) Opus 4.7, Opus 4.8, Fable 5, Mythos 5 ~30% typical; up to ~35% depending on content
    Older Opus 4.6, Sonnet 4.6, Haiku 4.5, Opus 4.5, Sonnet 4.5 Baseline

    The token counting page also notes the comparison directly: “Claude Fable 5 and Claude Mythos 5 use the tokenizer introduced with Claude Opus 4.7, which produces roughly 30% more tokens than models before Claude Opus 4.7 for the same text.”

    Use count_tokens — not tiktoken or ratio math

    Anthropic’s migration guide explicitly flags the risk: “Any code path that estimates tokens client-side or assumes a fixed token-to-character ratio should be re-tested against Claude Opus 4.7.” OpenAI’s tiktoken library is trained on a different vocabulary and produces different counts. It will not give accurate results for any Claude model.

    The correct approach is the /v1/messages/count_tokens endpoint, passing the specific model you intend to use:

    curl https://api.anthropic.com/v1/messages/count_tokens \
      --header "x-api-key: $ANTHROPIC_API_KEY" \
      --header "content-type: application/json" \
      --header "anthropic-version: 2023-06-01" \
      --data '{
        "model": "claude-opus-4-8",
        "messages": [{"role": "user", "content": "Your text here"}]
      }'

    The endpoint returns a model-specific count. If you are migrating a workload from Sonnet 4.6 to Opus 4.8, count the same prompt with both model IDs and compare the two input_tokens values. The token counting endpoint is free to use (rate limits apply by usage tier). Anthropic notes that the returned count is an estimate; the actual count at inference time may differ by a small amount.

    Quick reference: common document sizes

    Document type Approx. words Tokens (older tokenizer) Tokens (new tokenizer)
    Novel (~400 pages) ~100,000 ~133,000 ~173,000
    Long research paper ~20,000 ~27,000 ~35,000
    Full context, Sonnet 4.6 (1M tokens) ~750,000 1,000,000 N/A (different model)
    Full context, Opus 4.8 (1M tokens) ~555,000 N/A (different model) 1,000,000

    These word estimates assume typical English prose. Code, structured data, and non-Latin scripts tokenize differently from natural language prose. Highly repetitive text and dense symbol-heavy content (like JSON or code) can fall well outside the ~0.75 words-per-token ratio.

    Does the new tokenizer change what fits in the context window?

    Yes, in one direction. The context window is still 1M tokens, but that window holds fewer words on the new tokenizer (~555k words) than on the old one (~750k words). A document that previously fit comfortably may now require trimming or chunking when moving to Opus 4.7, Opus 4.8, or Fable 5.

    Does Sonnet 4.6 use the new tokenizer?

    No. Claude Sonnet 4.6 uses the older tokenizer. Anthropic’s model overview page lists Sonnet 4.6’s 1M-token context window as equivalent to ~750k words, the same ratio as Opus 4.6 — confirming it has not adopted the Opus 4.7 tokenizer. Only Opus 4.7, Opus 4.8, Fable 5, and Mythos 5 use the new tokenizer.

    Can I use tiktoken or another open-source tokenizer for Claude?

    No. tiktoken is built for OpenAI models and uses a different vocabulary. It will not produce accurate token counts for any Claude model, and its error will be larger on the new Opus 4.7 tokenizer than on older Claude models. Use /v1/messages/count_tokens with the specific Claude model ID you plan to deploy.

    Does the new tokenizer affect pricing?

    Yes. Billing reflects token counts under the model’s tokenizer. If you migrate a workload from Opus 4.6 to Opus 4.8 and the new tokenizer produces 30% more tokens, your input token costs increase by roughly 30% before accounting for any per-token price difference between the models. Re-baseline cost estimates using the count_tokens endpoint rather than scaling from old measurements.

    How many pages is the full 1M-token context window?

    On models with the older tokenizer (Sonnet 4.6, Opus 4.6), 1 million tokens is approximately 3,000 double-spaced pages of typical English prose. On models with the new tokenizer (Opus 4.8, Fable 5), the same 1 million tokens holds approximately 2,200 pages. These are prose estimates — a 1M-token window filled with source code or dense structured data will span a very different page count.

  • Claude Enterprise Compliance: BAA, SOC 2, GDPR and Data Policy (2026)

    Claude Enterprise Compliance: BAA, SOC 2, GDPR and Data Policy (2026)

    Last verified: June 13, 2026

    Anthropic publishes a defined compliance posture for Claude: it holds SOC 2 Type I and Type II, ISO 27001:2022, and ISO/IEC 42001:2023 credentials; it will sign a Business Associate Agreement (BAA) covering HIPAA-ready services such as the first-party API and Enterprise plans; by default it does not train models on data sent under its commercial terms; and it offers a zero-data-retention (ZDR) arrangement on the Messages and Token Counting APIs. The hard part for buyers is the per-surface boundary — what the BAA covers, which features are blocked under ZDR or HIPAA, how long data is kept, and where it can be processed. Every figure below is drawn from Anthropic’s own trust, privacy, and developer documentation, with sources at the bottom. Eligibility, feature lists, and durations change; treat your signed contract and the live Trust Center as the controlling sources.

    Certifications and attestations

    Anthropic’s help center lists the following compliance credentials for its commercial products (Claude for Work and the Anthropic API). It directs customers to the Trust Portal at trust.anthropic.com to request copies of the underlying reports and certificates.

    Credential Status as described by Anthropic Scope
    SOC 2 Type I & Type II Listed as held Commercial products (Claude for Work, Anthropic API)
    ISO 27001:2022 Certified Information Security Management
    ISO/IEC 42001:2023 Certified (issued by Schellman Compliance, LLC, accredited by the ANSI National Accreditation Board) AI Management Systems
    HIPAA “HIPAA-ready configuration (BAA available)” See BAA section

    Anthropic describes itself as “one of the first frontier AI labs” to achieve ISO/IEC 42001:2023 certification, in an announcement dated January 13, 2025. The help-center certifications list does not mention ISO 27017, ISO 27018, FedRAMP, or CSA STAR; those are left out here rather than asserted. GDPR and CCPA are handled through Anthropic’s privacy program and customer agreements rather than as line-item “certifications” (see GDPR section).

    HIPAA and the BAA: covered by product surface

    Anthropic states it “provides a Business Associate Agreement (BAA) covering our HIPAA-ready services, such as use of our first-party API or Enterprise plans.” HIPAA readiness is enforced at the organization level: Anthropic provisions a dedicated HIPAA-enabled organization that automatically blocks non-eligible features. To process protected health information (PHI) on the API, an administrator must sign the BAA and contact sales to enable it; for Enterprise, an admin activates HIPAA compliance in the Claude Enterprise admin settings under “Data & Privacy” and signs the BAA there.

    Surface BAA / HIPAA-ready coverage
    First-party Claude API (Messages API) Covered as an Eligible Service (admin signs BAA, then contact sales)
    Claude Enterprise Covered once an admin activates HIPAA compliance and signs the BAA
    Workbench and Console Not covered
    Claude Free, Pro, Max, Team Not covered
    Cowork Not covered
    Claude Code Not covered under HIPAA readiness
    Amazon Bedrock / Vertex AI Not covered (cloud provider is the data processor; see those platforms)
    Claude Platform on AWS / Microsoft Foundry HIPAA readiness not available
    Beta features (e.g., Claude in Office, Claude Design) Generally not covered unless explicitly listed as eligible

    Within the API, only a subset of features is HIPAA-eligible. Anthropic enforces this in code: a HIPAA-enabled organization that sends a non-eligible feature gets a 400 invalid_request_error naming the blocked feature. Anthropic states your signed BAA is the official source of truth for what is covered.

    API feature HIPAA-eligible
    Messages API (/v1/messages) Yes
    Token counting Yes
    Web search Yes (dynamic filtering not eligible)
    Prompt caching, structured outputs, extended/adaptive thinking, citations, 1M context, PDF (inline), data residency, effort, fast mode, bash & text-editor tools, memory tool Yes
    Web fetch, computer use, advisor tool, context management (compaction / editing), tool search, cache diagnostics No
    Code execution, programmatic tool calling No
    Batch API, Files API, Agent Skills, MCP connector, Claude Managed Agents, MCP tunnels No

    PHI must appear only in message content, attached files, or related file names/metadata — never in JSON schema definitions (property names, enum/const values, or pattern regexes), because compiled schemas are cached separately and do not receive the same PHI protections. Anthropic notes workspace names, user contact details, billing data, and support tickets are not expected to contain PHI under the BAA.

    Data retention (commercial default)

    Under Anthropic’s commercial data retention policy, conversation content is not retained by default for the API, and API inputs and outputs are automatically deleted on the backend within 30 days of receipt or generation. For interface products such as Claude for Work, data persists until you delete it, after which it is removed from backend storage within 30 days. Two exceptions extend retention regardless of arrangement.

    Data type / event Retention
    API inputs and outputs (default) Auto-deleted within 30 days
    Deleted conversation content (Claude for Work) Removed from backend within 30 days
    Inputs/outputs for a chat flagged as a Usage Policy violation Up to 2 years
    Trust & safety classification scores (flagged chat) Up to 7 years
    Data tied to feedback you submit (thumbs up/down, bug report) 5 years

    Zero data retention (ZDR)

    With a ZDR arrangement, customer data is not stored at rest after the API response is returned, except where needed to comply with law or combat misuse. ZDR is requested through Anthropic sales and enabled per organization — it does not carry over automatically to new organizations under the same account. Even under ZDR, Anthropic retains User Safety classifier results, and may retain inputs and outputs for up to 2 years if a chat or session is flagged for a Usage Policy violation. CORS is not supported for ZDR organizations, so browser apps must call through a backend proxy.

    Surface ZDR coverage
    Claude Messages API & Token Counting API Eligible
    Claude Code (Commercial org API keys, or via Claude Enterprise with ZDR enabled) Eligible
    Console and Workbench Not eligible
    Claude Teams & Claude Enterprise interfaces Not eligible (except Claude Code via Enterprise with ZDR on)
    Claude Free, Pro, Max Not eligible
    Claude Managed Agents Not eligible (stateful; delete transcripts manually)
    Batch API, Files API, code execution, Agent Skills, MCP connector Not eligible
    Third-party integrations Not eligible

    A handful of ZDR-eligible features are marked “Yes (qualified)” — structured outputs and cache diagnostics — meaning Anthropic retains a narrow, documented set of technical data (for example, a cached JSON schema for up to 24 hours since last use) rather than your prompts or Claude’s outputs.

    Model-training policy and Covered Models

    Anthropic’s Privacy Policy states it does not apply to content processed on behalf of business customers; that data is governed by the customer agreement. For the API specifically, Anthropic states retained data is never used for model training without your express permission. Anthropic’s consumer-terms update confirms the data-use changes “do not apply to services under our Commercial Terms,” including Claude for Work, Claude for Government, Claude for Education, and API use (including via Amazon Bedrock and Google Cloud’s Vertex AI). Training on commercial data happens only if a customer explicitly opts in (for example, the Development Partner Program).

    One model-specific exception affects retention, not training: Claude Fable 5 and Claude Mythos 5 are designated Covered Models and require 30-day data retention. ZDR is not available for these two models; a request to either from an organization whose retention configuration doesn’t meet the requirement returns a 400 invalid_request_error. Organizations with ZDR can turn on 30-day retention for a single workspace (Console > Settings > Workspaces > Privacy controls) to use those models there while keeping ZDR elsewhere. On Bedrock, Vertex AI, and Microsoft Foundry, retention requirements for these models are set by each platform.

    GDPR, data residency, and international transfers

    For users in the EEA, UK, or Switzerland, the data controller is Anthropic Ireland, Limited; elsewhere it is Anthropic PBC. Where the EU or UK GDPR applies, Anthropic responds to verifiable data-subject requests within one calendar month. For transfers to countries without an adequacy decision, Anthropic relies on standard contractual clauses, and publishes its subprocessors at anthropic.com/subprocessors.

    On data residency, the Claude API exposes two independent controls. inference_geo sets where inference runs per request — values are "global" (default) or "us" — and is supported on Claude Opus 4.6, Sonnet 4.6, and later (older models return a 400). Workspace geo controls where data is stored at rest and where endpoint processing happens; it is set at workspace creation and cannot be changed afterward. Per Anthropic’s documentation, "us" is currently the only available workspace geo, and only "us" and "global" inference geos are available — so there is currently no EU-resident storage option at the workspace level. US-only inference is priced at 1.1x the standard rate on supported models. Data residency is available on the Claude API (first-party) and Claude Platform on AWS; on Bedrock and Vertex AI the region is set by the endpoint or inference profile.

    Does Anthropic train its models on my API or commercial data?

    No, not by default. Anthropic’s Privacy Policy excludes business-customer content (governed by your customer agreement), and for the API it states retained data is never used for training without your express permission. The consumer data-use changes explicitly do not apply to Commercial Terms services. Training on commercial data requires an explicit opt-in.

    Will Anthropic sign a BAA, and for what?

    Yes. Anthropic signs a BAA covering HIPAA-ready services such as the first-party API and Enterprise plans. The Messages API is covered as an Eligible Service. It does not cover Workbench/Console, Free/Pro/Max/Team, Cowork, Claude Code, or beta features unless explicitly listed. An admin must sign the BAA and enable HIPAA readiness; the organization then auto-blocks non-eligible features.

    What’s the difference between ZDR and HIPAA readiness?

    Per Anthropic, ZDR prevents customer data from being stored at rest after the API response. HIPAA readiness is a broader set of safeguards (encryption, access controls, audit logging) that protect PHI throughout its lifecycle and lets data be retained with safeguards rather than deleted immediately. Anthropic states you do not also need ZDR if you have HIPAA readiness.

    How long does Anthropic keep my data?

    By default, API inputs and outputs are auto-deleted within 30 days. If a chat is flagged as a Usage Policy violation, inputs/outputs may be retained up to 2 years and trust & safety classification scores up to 7 years. Data tied to feedback you submit is kept 5 years. ZDR removes the default at-rest storage but does not remove the law/misuse exceptions.

    Can I keep Claude inference and data in the EU?

    Not at rest currently. The API’s inference_geo can pin inference to "us" or run "global", but Anthropic’s documentation lists "us" as the only available workspace geo (storage region). EU/UK data-subject rights and standard contractual clauses apply regardless, but an EU storage-residency option is not currently offered at the workspace level per the docs verified here.


  • Claude Agent SDK Migration: Package Renames and Breaking Changes (2026)

    Claude Agent SDK Migration: Package Renames and Breaking Changes (2026)

    Last verified: June 13, 2026

    The Claude Code SDK has been renamed to the Claude Agent SDK. Migrating is three mechanical edits plus two behavioral changes you have to opt back into: rename the package, rename the imports, rename ClaudeCodeOptions to ClaudeAgentOptions, then decide whether you want the old Claude Code system prompt and filesystem settings back. The breaking changes landed in v0.1.0. Everything below is taken from Anthropic’s official Agent SDK migration guide and the live package registries, verified June 13, 2026.

    The renames at a glance

    Two packages and one Python type changed names. The documentation also moved out of the Claude Code docs into the API Guide’s Agent SDK section.

    Aspect Old New
    Package (TS/JS) @anthropic-ai/claude-code @anthropic-ai/claude-agent-sdk
    Package (Python) claude-code-sdk claude-agent-sdk
    Python import claude_code_sdk claude_agent_sdk
    Python options type ClaudeCodeOptions ClaudeAgentOptions
    Docs location Claude Code docs API Guide → Agent SDK

    Current published versions

    These are the latest versions on the public registries as fetched on June 13, 2026. The migration guide itself uses ^0.0.42 as the example old TypeScript version and ^0.2.0 as the example new one; pin to whatever is current when you install.

    Registry Package Latest version
    npm @anthropic-ai/claude-agent-sdk 0.3.177
    PyPI claude-agent-sdk 0.2.101

    TypeScript migration

    Swap the package, then update every import. The exported names (query, tool, createSdkMcpServer) are unchanged — only the module specifier moves.

    npm uninstall @anthropic-ai/claude-code
    npm install @anthropic-ai/claude-agent-sdk
    // Before
    import { query, tool, createSdkMcpServer } from "@anthropic-ai/claude-code";
    
    // After
    import { query, tool, createSdkMcpServer } from "@anthropic-ai/claude-agent-sdk";

    Update package.json as well, replacing the dependency key from @anthropic-ai/claude-code to @anthropic-ai/claude-agent-sdk.

    Python migration

    Swap the package, update the import path, and rename the options type. The import name changes from underscore-claude_code_sdk to underscore-claude_agent_sdk.

    pip uninstall claude-code-sdk
    pip install claude-agent-sdk
    # Before (claude-code-sdk)
    from claude_code_sdk import query, ClaudeCodeOptions
    
    options = ClaudeCodeOptions(model="claude-opus-4-7", permission_mode="acceptEdits")
    
    # After (claude-agent-sdk)
    from claude_agent_sdk import query, ClaudeAgentOptions
    
    options = ClaudeAgentOptions(model="claude-opus-4-7", permission_mode="acceptEdits")

    The rename is the only change to the type — its fields and constructor signature are otherwise the same. Per Anthropic, the new name matches the “Claude Agent SDK” branding.

    Breaking change: the system prompt is no longer default

    This is the change most likely to silently alter your agent’s behavior. In v0.0.x, the SDK used Claude Code’s system prompt by default. As of v0.1.0, query() uses a minimal system prompt instead. To get the old behavior, explicitly request the claude_code preset.

    Goal systemPrompt value
    Restore Claude Code’s prompt { type: "preset", preset: "claude_code" }
    Use your own instructions a plain string
    Minimal prompt (new default) omit the option
    // TypeScript — restore the old default
    const result = query({
      prompt: "Hello",
      options: {
        systemPrompt: { type: "preset", preset: "claude_code" }
      }
    });
    
    // Or a custom system prompt:
    const custom = query({
      prompt: "Hello",
      options: { systemPrompt: "You are a helpful coding assistant" }
    });
    # Python — restore the old default
    from claude_agent_sdk import query, ClaudeAgentOptions
    
    async for message in query(
        prompt="Hello",
        options=ClaudeAgentOptions(
            system_prompt={"type": "preset", "preset": "claude_code"}
        ),
    ):
        print(message)
    
    # Or a custom system prompt:
    async for message in query(
        prompt="Hello",
        options=ClaudeAgentOptions(system_prompt="You are a helpful coding assistant"),
    ):
        print(message)

    settingSources: changed, then reverted

    This one is widely mis-reported, so read it carefully. v0.1.0 briefly defaulted to loading no filesystem settings — and that default was reverted in subsequent releases. Anthropic’s current guidance is that no migration action is needed for setting sources.

    Current behavior: omitting settingSources on query() loads user, project, and local filesystem settings, matching the CLI — equivalent to ["user", "project", "local"]. That includes ~/.claude/settings.json, .claude/settings.json, .claude/settings.local.json, CLAUDE.md files, and custom commands. The accepted values are below.

    Source Loads from
    "user" ~/.claude/ — user CLAUDE.md, rules, skills, settings
    "project" <cwd>/.claude/ — project CLAUDE.md, rules, skills, hooks, settings.json
    "local" CLAUDE.local.md and .claude/settings.local.json

    To run isolated from filesystem settings, pass an empty array. This matters for CI/CD, deployed apps, test environments, and multi-tenant systems where local customizations should not leak in.

    // TypeScript — no filesystem settings
    const isolated = query({
      prompt: "Hello",
      options: { settingSources: [] }
    });
    
    // Only project settings
    const projectOnly = query({
      prompt: "Hello",
      options: { settingSources: ["project"] }
    });
    # Python — no filesystem settings
    from claude_agent_sdk import query, ClaudeAgentOptions
    
    async for message in query(
        prompt="Hello",
        options=ClaudeAgentOptions(setting_sources=[]),
    ):
        print(message)

    Two caveats Anthropic documents explicitly. First, Python SDK 0.1.59 and earlier treated an empty list the same as omitting the option — upgrade before relying on setting_sources=[]. Second, some inputs are read regardless of settingSources: managed policy settings, the global ~/.claude.json config, auto-memory, and claude.ai MCP connectors. For true multi-tenant isolation, the docs recommend running each tenant in its own filesystem and setting settingSources: [] plus CLAUDE_CODE_DISABLE_AUTO_MEMORY=1.

    The full checklist

    Work top to bottom; the first three are required, the last two are behavioral decisions.

    Step Action
    1 Uninstall old package, install @anthropic-ai/claude-agent-sdk / claude-agent-sdk
    2 Update all imports to the new module / package name
    3 Python only: rename ClaudeCodeOptions → ClaudeAgentOptions
    4 If you relied on Claude Code’s prompt, set systemPrompt to the claude_code preset
    5 Decide on settingSources: omit for CLI parity, or [] to isolate

    Do I have to change settingSources when I migrate?

    No. Anthropic states no migration action is needed for setting sources. The v0.1.0 change to “load nothing by default” was reverted; omitting settingSources again loads user, project, and local settings, matching the CLI.

    What is the new default system prompt?

    A minimal system prompt. Before v0.1.0 the SDK inherited Claude Code’s full system prompt by default. To restore it, pass systemPrompt as { type: "preset", preset: "claude_code" } (TypeScript) or system_prompt={"type": "preset", "preset": "claude_code"} (Python).

    Did the exported function names change in TypeScript?

    No. query, tool, and createSdkMcpServer are unchanged. Only the import path moves from @anthropic-ai/claude-code to @anthropic-ai/claude-agent-sdk.

    Which version introduced the breaking changes?

    Claude Agent SDK v0.1.0, introduced “to improve isolation and explicit configuration,” per the official guide. The latest published versions as of June 13, 2026 are 0.3.177 on npm and 0.2.101 on PyPI.

    Does settingSources: [] fully isolate my agent?

    Not by itself. Managed policy settings, the global ~/.claude.json config, auto-memory, and claude.ai MCP connectors are read regardless. For multi-tenant isolation, also run each tenant in its own filesystem and set CLAUDE_CODE_DISABLE_AUTO_MEMORY=1.


  • Claude vs GPT vs Gemini: Coding Benchmark Leaderboard (June 2026)

    Claude vs GPT vs Gemini: Coding Benchmark Leaderboard (June 2026)

    Last verified: June 13, 2026

    As of June 13, 2026, the four models most often compared for coding work are Claude Fable 5 and Claude Opus 4.8 from Anthropic, GPT-5.5 from OpenAI, and Gemini 3.1 Pro from Google. This page is a leaderboard built on one rule: every score below is taken from a vendor’s own page or the benchmark’s official model card that we fetched on the verification date, or it is marked as not published. Several vendors publish their benchmark tables as images rather than machine-readable text; where we could not read an official figure directly, we list the metric as not machine-verifiable and link to the source document instead of estimating. The result is a smaller table than most roundups, but every number in it is one you can click through and check.

    Models and pricing (verified specs)

    These columns are confirmed from each vendor’s official model documentation. Claude prices, context windows, and cutoffs come from Anthropic’s models overview and the AWS Bedrock model card; GPT-5.5 from OpenAI’s developer docs; Gemini 3.1 Pro from Google’s DeepMind model card and the Gemini API pricing page.

    Model API ID Input / Output (per Mtok) Context Max output Knowledge cutoff
    Claude Fable 5 claude-fable-5 $10 / $50 1M 128K Not stated on overview*
    Claude Opus 4.8 claude-opus-4-8 $5 / $25 1M 128K Jan 2026
    GPT-5.5 gpt-5.5 $5 / $30 1,050,000 128K Dec 1, 2025
    Gemini 3.1 Pro gemini-3.1-pro-preview $2 / $12 (≤200K)** 1M 64K Not stated on model card

    *Anthropic’s models overview lists Fable 5’s specs and price but does not publish a knowledge-cutoff date for it in the table we fetched. **Gemini 3.1 Pro uses tiered pricing: $2 / $12 per Mtok for prompts up to 200K tokens, rising to $4 / $18 for prompts above 200K tokens (Google AI pricing page). GPT-5.5 pricing rises to 2x input / 1.5x output above 272K input tokens (OpenAI developer docs). Claude Opus 4.8 offers an optional fast mode at $10 / $50 per Mtok (Anthropic).

    Coding benchmark scores (primary-source only)

    Each cell is either a figure we read directly from a primary source on June 13, 2026, or marked “not machine-verifiable” with the source you should consult. A blank-equivalent entry never means zero — it means the official figure was not available in readable form during verification. Note the harness and version differences called out in the footnotes: they make cross-vendor cells not strictly comparable.

    Benchmark Claude Fable 5 Claude Opus 4.8 GPT-5.5 Gemini 3.1 Pro
    SWE-bench Verified Not machine-verifiable (see system card) Not machine-verifiable (see system card) Not published in retrievable primary source 80.6%
    SWE-bench Pro (Public) Not machine-verifiable (see system card) Not machine-verifiable (see system card) Not published in retrievable primary source 54.2%
    Terminal-Bench Not machine-verifiable (see system card) Not machine-verifiable (see system card) 83.4% (v2.1, Codex CLI harness)† 68.5% (v2.0, Terminus-2 harness)
    LiveCodeBench Pro Not published in retrievable primary source Not published in retrievable primary source Not published in retrievable primary source 2887 Elo

    †GPT-5.5’s Terminal-Bench 2.1 figure of 83.4% is the score Anthropic attributes to GPT-5.5 “with the Codex CLI harness” in a footnote on its Claude Opus 4.8 announcement page. It is a competitor-reported comparison, not a number we read from OpenAI directly. Google reports Gemini 3.1 Pro on Terminal-Bench 2.0 under the Terminus-2 harness (68.5%); because the version and harness differ, the Gemini and GPT-5.5 Terminal-Bench cells are not directly comparable. Gemini’s SWE-bench Verified (80.6%), SWE-bench Pro Public (54.2%), and LiveCodeBench Pro (2887 Elo) are single-attempt figures from Google’s official Gemini 3.1 Pro model card.

    What we could not verify from a primary source

    Anthropic publishes its coding comparison tables for Claude Opus 4.8 and Claude Fable 5 as images inside its announcement pages, and the full Claude Opus 4.8 System Card PDF exceeded our fetch size limit, so we could not machine-read those percentages on the verification date. OpenAI’s GPT-5.5 announcement page returned an access error to our fetcher, and its developer-docs model page lists specs and pricing but no benchmark scores. We have therefore left Claude’s and GPT-5.5’s SWE-bench figures out of the table rather than reproduce numbers we could not confirm at the source. For those figures, consult the primary documents linked in our source list: the Claude Opus 4.8 System Card, the Claude Fable 5 and Mythos 5 announcement, and OpenAI’s GPT-5.5 page. If you are choosing a model today, the verified spec table above (price, context, output, cutoff) is the part you can rely on without caveat.

    How to read a coding leaderboard

    Three cautions apply to any 2026 coding comparison. First, harness matters: the same model scores differently on Terminal-Bench depending on whether it runs under Terminus-2, a Codex CLI scaffold, or a vendor’s internal agent, which is why we annotate every Terminal-Bench cell. Second, version matters: “Terminal-Bench 2.0” and “Terminal-Bench 2.1” are different test sets, and “SWE-bench Pro” public and full splits differ — a single percentage with no version is close to meaningless. Third, a headline score is one slice of behavior; long-horizon agentic coding, tool-call reliability, and context handling over a long session often decide real-world usefulness more than a single pass rate. Treat the verified cells here as a starting point, then test the shortlist on your own repository.

    Which model has the highest published coding benchmark score in June 2026?

    We cannot crown a single winner from primary sources alone, because Anthropic and OpenAI publish their coding scores in formats we could not machine-verify on June 13, 2026. From figures we could read directly, Google’s Gemini 3.1 Pro model card reports 80.6% on SWE-bench Verified and 54.2% on SWE-bench Pro (Public). Anthropic’s and OpenAI’s comparable figures are in their system cards and announcement pages, which we link in the sources; we did not reproduce them here because they were not readable at the source during verification.

    What does Claude Fable 5 cost, and how is it different from Opus 4.8?

    Claude Fable 5 (claude-fable-5) is priced at $10 per million input tokens and $50 per million output tokens, with a 1M-token context window and up to 128K output tokens (Anthropic models overview). Claude Opus 4.8 (claude-opus-4-8) is the Opus-tier flagship at $5 / $25 per Mtok, also 1M context and 128K output, with a January 2026 knowledge cutoff. Fable 5 is Anthropic’s most capable widely released model; Opus 4.8 is the lower-priced model most teams will use for everyday agentic coding.

    Why are some benchmark cells marked “not machine-verifiable” instead of showing a number?

    Because this page only prints scores we could confirm from a primary source on the verification date. Several vendors render their benchmark tables as images, and one large system-card PDF exceeded our fetch limit, so the underlying percentages were not readable to us. Rather than copy figures from third-party trackers, we mark the cell and point you to the official document. It keeps the leaderboard honest at the cost of being shorter.

    How do the context windows compare?

    Claude Fable 5, Claude Opus 4.8, and Gemini 3.1 Pro each offer a 1M-token context window; GPT-5.5 offers 1,050,000 tokens. Maximum output is 128K tokens for Claude Fable 5, Claude Opus 4.8, and GPT-5.5, and 64K tokens for Gemini 3.1 Pro. Note that Claude Opus 4.8’s context window is 200K on Microsoft Foundry specifically, per Anthropic’s documentation.

    Is Terminal-Bench comparable across these models?

    Not cell-for-cell. Google reports Gemini 3.1 Pro on Terminal-Bench 2.0 under the Terminus-2 harness (68.5%), while the GPT-5.5 figure we show (83.4%) is Terminal-Bench 2.1 under a Codex CLI harness, as attributed by Anthropic. Different versions and different harnesses mean the two numbers should not be read as a head-to-head result.