Claude Code (Opus 5) System Prompt

This capture presents the leaked system prompt for Claude Code, Anthropic’s CLI coding agent, running on Opus 5 (1M context, claude-opus-5[1m]). It is the primary-source, real harness prompt — the authoritative counterpart to the synthesized [[claude-code-system-prompt]] page built from secondary articles. Where that page summarizes the tool, this page documents the actual live prompt text.

The source is confidence: low because it is a leaked-prompt artifact from a public mirror, not an authenticated vendor publication. It is useful for comparative pattern analysis and as real evidence of Anthropic’s CLI prompt design, not certified proof of a current production configuration.

System Surface (confidence: high for structure)

The prompt opens with behavior and harness directives: GitHub-flavored-markdown output in a terminal, permission-mode acknowledgement (“a denied call means the user declined it — adjust, don’t retry verbatim”), parallel independent tool calls, mid-conversation system turns, and hooks treated as user feedback. It emphasizes faithful outcome reporting and confirmation for actions that are hard to reverse or outward-facing. Security posture is explicit up front: authorized red-teaming/CTF/defensive/educational work is supported, while destructive DoS, mass targeting, supply-chain compromise, and detection evasion for malicious ends are refused.

Implications

The harness encodes operating experience as rules: permission-denial is treated as instruction to adjust (not a failure to retry), and hook output is user feedback, not noise. A mature agent prompt frames tool-denial and hook interception as control signals rather than errors.

Persistent Memory Filesystem (confidence: high for structure)

Claude Code maintains a per-project, file-based memory directory (~/.claude/projects/<project-slug>/memory/) that is distinct from CLAUDE.md. Each memory is one file holding one fact, with frontmatter (name, description, and metadata.type where type is user | feedback | project | reference). After writing, add a one-line pointer in MEMORY.md — the index loaded into context each session, with one line per memory and no frontmatter. Related memories link to one another by their name slug (double-bracket wikilink syntax); a dangling link to a not-yet-created memory marks something worth writing later rather than an error. Before saving, de-duplicate against existing files and update rather than duplicate; do not save what the repo or git already records; verify a recalled file/function still exists before recommending it.

Implications

This is a second, structured long-term memory layer with its own typed taxonomy and index, distinct from the CLAUDE.md/auto-memory covered in [[claude-code-memory]] and the codebase-derived layer in [[codebase-memory]]. For a prompt author, “which file gets which fact” is governed here by the user|feedback|project|reference taxonomy plus explicit de-duplication rules.

Tool Surface (confidence: high)

Roughly 37 tools beyond the core Read / Edit / Write / Bash / WebFetch / WebSearch / Agent: scheduling and task orchestration (TaskCreate/Get/List/Output/Stop/Update, CronCreate/Delete/List, ScheduleWakeup), worktree isolation (EnterWorktree/ExitWorktree), planning gates (EnterPlanMode/ExitPlanMode), long-running/monitoring (Monitor), remote and flow control (RemoteTrigger, ReportFindings), plus Design, NotebookEdit, PushNotification, SendMessage, Artifact, Skill, and EndConversation (with a dedicated self-harm or harm-to-others exit path).

Implications

The modern agent surface is scheduling + monitoring + sandbox operations, not just file editing. A full agent design needs cron/task primitives, plan gates, worktree isolation, and monitoring — not only callable edits.

Skill Loading and Model Facts

Skills are loaded at runtime in a # Skills section (invoked only for user-invocable skills, /<skill-name>). The environment block declares model facts: Opus 5 = claude-opus-5[1m], /fast keeps Opus 5 (faster output, no downgrade to a smaller model), a dedicated scratchpad directory replaces /tmp, and knowledge cutoff May 2026. Security terms are reiterated: authorized context (pentest, CTF, research, defensive) is acceptable; destructive, DoS, and detection-evasion requests are refused; confirm before dual-use tool use.

Implications

Model ID and fast-mode semantics are prompt-level facts, not inferable from behavior. “Fast mode does not downgrade the model” is a meaningful operational claim for a user choosing /fast. Scratchpad isolation tells the agent where temporary files belong.

Open Questions

• How do the per-project memory/ filesystem entries interact with the CLAUDE.md / auto-memory layer — do the two long-term stores ever merge or conflict?
• Is context compaction aware of the MEMORY.md index, or is the memory index always reloaded verbatim?
• The captured fixture includes the original user’s private details (path, email, git identity); these are evidence of the capture environment and must not be generalized into product claims.

Relationships

• “sibling-of” claude-code-system-prompt — synthesized summary page of the same CLI; this page is the primary-source prompt
• “sibling-of” claude-opus-5-system-prompt — same Opus 5 model; consumer chat surface vs CLI coding agent
• “uses” claude-code-memory — CLAUDE.md / auto-memory concepts the filesystem relates to
• “uses” codebase-memory — codebase-derived memory concepts
• “implements” plan-before-implement-gate — plan modes as explicit gates
• “implements” action-safety-tiering — security refusal / authorized-context tiers

Sources

• raw/prompts/leaked/claude-code-opus-5.md