Anthropic’s Claude Code holds your API keys and runs shell commands on your machine. The leaked source shows it does so with exactly two automated test files. Both cover a peripheral web server, not the part that reads your files and runs your commands.

The Claude Code source leak began on March 31, 2026, when a security researcher noticed that version 2.1.88 of @anthropic-ai/claude-code shipped a ~60 MB JavaScript sourcemap that someone forgot to add to .npmignore. That .map file pointed straight at the full, unobfuscated TypeScript source on Anthropic’s own R2 bucket, downloadable as a zip. Within hours it was mirrored across GitHub, and a clean-room copy reportedly cleared 50,000 stars in two hours.

So we did the obvious thing. We pointed StackGrit at the leaked source: every tool, every command, every line of the LLM engine. The leak is usually described as ~512,000 lines; StackGrit measured 552,720 across the full tree in 2,147 files, analyzed in 47 minutes for $8.64 in tokens. There’s a particular recursion here worth saying out loud: StackGrit runs on Claude. This is Claude reading the source of Claude Code.

Want to dig into the report yourself? Open the full Claude Code analysis →

First, the fine print: the grade isn’t fair without it

This is a frozen snapshot of one leaked version. Anthropic has almost certainly patched much of what follows in the months since; nothing here describes the Claude Code you update to today. Two scores in particular are artifacts of the leak and should be read with that in mind:

The Team score is meaningless. The public repo’s git history only records the two people who published the leak in March and April 2026, not the Anthropic engineers who actually wrote the code. Any “team health” signal describes the publishers.
Dependency staleness is partly the freeze. The codebase stopped receiving updates the moment it leaked, so “87% of dependencies are behind latest” is measured against a moving target two months on. The known CVEs that shipped in the release, however, were real on day one.

Even so, the findings about the code itself are exactly what we’d flag in any codebase, leak or not.

The scorecard: D+, 55 out of 100

Data Model lands at a B (80) and Architecture at a C+ (72). Then it slides: Code Quality D+ (58), Security D (52), Technologies D- (45), and Test Coverage bottoms out at an F (20), dragging the overall grade down to a D+.

For context, when we ran the same analysis on React, maintained by Meta, it scored a C+. The same patterns show up again and again in large, fast-moving codebases, whether the team builds a JavaScript framework or the AI tool everyone uses to build everything else.

552,000 lines of code. Two test files.

This is the headline finding, and it’s not close. The entire codebase ships with two test files, both covering a single peripheral web-server module. They’re well-written. They’re also the only tests that exist.

The shell-command permission engine. The file-edit logic. The OAuth flow. The MCP connection manager. All 42 agent tools. The entire LLM tool-call loop. Zero automated tests. The project doesn’t even declare a test script in package.json, so the two tests that exist can’t be discovered or run without knowing where they live.

Think about what that means for a tool that runs shell commands and holds your credentials. Its single most security-critical function, the 2,622-line engine that decides whether a command Claude wants to run is safe, has no regression net at all. Change one branch and the only way to know you didn’t open a hole is to test it by hand. That gap is the F on the card.

One function. 3,630 lines.

The run() function in main.tsx is roughly 3,630 lines long, one of the largest single functions we have ever measured in a production TypeScript codebase. It lives inside a 4,684-line file and contains the entire CLI command tree, interactive startup, headless path, MCP config, worktree logic, and every feature-flagged branch, all in one block.

It has company. The MCP client is 3,349 lines, the MCP auth module 2,466, and the bash-permission engine 2,622. These four files concentrate most of the logic that matters, and they resist safe modification precisely because they’re too big to review or test in isolation. Add a feature, and it gets appended to a file that’s already unreviewable.

To be clear, this isn’t sloppy code: the naming is disciplined, error handling is broadly present, and Zod validates every external boundary. These files are simply doing too much: the signature of a codebase that grew faster than anyone could refactor it.

Security: strong core, leaky edges

The security picture splits cleanly into two halves.

The core is mature. The BashTool, the component that decides which LLM-requested shell commands to run, implements one of the most thorough command-injection defenses we’ve seen in any TypeScript project: 23 distinct security checks, tree-sitter AST analysis, and an escalate-to-the-user model instead of silent blocking. The OAuth flow uses PKCE correctly. For the attack surface that matters most in an agentic CLI, the engineering investment is real.

The satellite web server is where it gets uncomfortable. Claude Code ships a companion web terminal, and that’s where the findings cluster:

The terminal server defaults to unauthenticated admin access: with no AUTH_TOKEN set (the zero-config default), every caller is treated as isAdmin: true, on a server bound to all interfaces.
A stored XSS in the admin dashboard renders user-controlled OAuth profile fields straight into innerHTML.
A real Anthropic production logging credential is hardcoded in the source: a live secret now compromised by the leak (we’re not reprinting the value).
The companion Next.js frontend shipped on 14.2.0, which carries the critical CVE-2025-29927 middleware authorization-bypass plus eight more high-severity CVEs.

Zoom out and the report logged 48 findings in total (4 critical and 14 high) on top of 72 known vulnerabilities in the dependency tree, with one critical and 27 high-severity CVEs concentrated in next, axios, and the MCP SDK. None of this means Claude Code is insecure. It means the hardened, obvious surface got the attention while a secondary deployment target quietly defaulted to open. Security debt almost always hides there, in the part nobody thinks of as the product.

We asked the report to explain itself

A static report answers the questions it was built to answer. StackGrit’s chatbot answers the ones you actually have, and it reads the live source, not just the summary. So we asked it one thing: “Trace what happens when Claude wants to run a shell command on my machine.”

In technical mode, it traced the whole path, from the LLM emitting a tool_use block, through the five permission layers, down to the process spawn. Along the way it cited exact files and line numbers (it pointed straight at the 904-line decision function in bashPermissions.ts) and generated this sequence diagram from the code it had just read:

Asked the exact same question in non-technical mode, it dropped the code entirely and explained the same flow as a plain numbered walkthrough, then framed, in business terms, both what’s mature about the shell-command “door” and what’s risky about the untested 2,600-line file behind it:

Same source, same question, two audiences: one answer for the engineer who’ll fix it, one for the executive who has to fund the fix.

What the codebase does well

A D+ doesn’t mean fragile. The architecture earned its C+ honestly: it’s a clean modular monolith where all 42 tools are fully self-contained with zero inter-tool dependencies, which is real coupling discipline at this scale. Feature flags strip entire subsystems out of the binary at build time. The data model scored a B: with no database at all, the conversation state is modeled as precise TypeScript discriminated unions, and eleven config-migration files show deliberate schema evolution.

That architecture diagram, by the way, wasn’t drawn by hand. StackGrit generated it from the actual module dependency graph.

If Claude Code looks like this, so does your codebase

This is bigger than a leaked-code curiosity. Claude Code is the tool a generation of developers now reaches for to write and review their code, built at one of the best AI labs in the world by people who think about this for a living. And under the hood it carries the exact debt that every fast-moving codebase accumulates: near-zero tests, a handful of god files, and security gaps in the surfaces nobody was watching.

None of that is a knock on Anthropic. It’s the natural state of software shipped fast, and a near-perfect mirror of what AI-assisted development produces at scale. Velocity goes to features. Tests, decomposition, and the boring hardening of secondary surfaces are the friction that always loses the sprint. The difference between a healthy codebase and a risky one isn’t whether this debt exists, but whether anyone can see it before it becomes someone else’s incident.

That’s what StackGrit does: it read 552,000 lines of unfamiliar code in 47 minutes and produced the scorecard, the per-module test map, the complexity hotspots, the security findings, and a prioritized list of what to fix first. It’s the kind of map you’d otherwise need a senior engineer and a free week to draw by hand.

See the complete Claude Code analysis →

Curious what your own codebase scores? First report is free, no credit card.

Get your free code health report →