Code quality: silent exception swallowing in SDK core + unbounded LRU caches

[artvepa80]

Summary

We ran HefestoAI (deterministic static analysis, no AI/LLM) against anthropic-sdk-python and found patterns that may warrant review. None are critical vulnerabilities — they are code quality and reliability observations.

Findings

1. Silent exception swallowing (7 instances)

except Exception: pass or except Exception: return in SDK core code.

Most notable — src/anthropic/_models.py:532:

try:
    return validate_type(type_=cast("type[object]", original_type or type_), value=value)
except Exception:
    pass

This silently swallows validation errors during union type construction. A malformed API response could produce an incorrect model object instead of raising.

src/anthropic/_base_client.py:910,1548 — __del__ finalizers catching Exception. These are defensible (finalizers should not raise), but noted for completeness.

src/anthropic/_utils/_httpx.py:19,27 — IP address validation catches Exception where ValueError would suffice:

try:
    ipaddress.IPv4Address(hostname.split("/")[0])
except Exception:
    return False

src/anthropic/lib/tools/_beta_builtin_memory_tool.py:389,676 — Directory iteration in memory tool silently returns on any error. except OSError would be more precise.

2. Unbounded LRU caches (2 instances)

src/anthropic/_base_client.py:2198:

@lru_cache(maxsize=None)
def platform_headers(version: str, *, platform: Platform | None) -> Dict[str, str]:

src/anthropic/lib/bedrock/_stream_decoder.py:13:

@lru_cache(maxsize=None)
def get_response_stream_shape()

Both are low risk in practice (bounded input space), but maxsize=None on a public SDK means any downstream long-running process inherits unbounded caches. maxsize=128 would be equivalent in practice and bounded by design.

False positives we found (transparency)

HefestoAI flagged 9 HARDCODED_SECRET findings in lib/bedrock/ — these are false positives. Parameter names like aws_secret_key: str and references to AWSEventStreamDecoder triggered the regex. We are improving this detection pattern.

Reproduction

pip install hefesto-ai
git clone --depth 1 https://github.com/anthropics/anthropic-sdk-python.git
hefesto analyze anthropic-sdk-python/ --severity LOW

About

HefestoAI is an open-source (MIT) deterministic code quality and security analyzer. All findings are from static, offline, reproducible rules — no AI/LLM was used for the analysis.

Happy to discuss any of these findings. The full report with line-by-line assessment is available on request.

[artvepa80]

Closing this issue. After further review, some findings need additional verification before being reported externally. We will re-evaluate and re-open with verified findings only if warranted. Apologies for the noise.