Hello everyone. I’ve been working with the Anthropic Agent SDK for a few weeks now, primarily exploring the concurrency model of the agent runtime and how tool executions are scheduled. As part of that, I wanted to get a complete picture of the data flow, so I built a local HTTP proxy that sits between the SDK and Anthropic's API endpoints.

My primary goal was to understand the exact security boundary: what information leaves my local environment, when, and in what shape. I was particularly curious about the state of the agent (its memory, pending tool calls, conversation history) at the moment of an API call. The SDK's asynchronous nature makes it somewhat opaque, and I wanted to see the raw traffic to identify any potential race conditions or state leakage between independent agent instances sharing a client.

Here is the core of the proxy setup, a simple Python script using `mitmproxy`:

```python
from mitmproxy import http

def request(flow: http.HTTPFlow) -> None:
if "api.anthropic.com" in flow.request.pretty_host:
# Log the full request body, focusing on messages and tool definitions
with open("sdk_traffic.log", "a") as f:
f.write(f"n--- Request to {flow.request.path} ---n")
if flow.request.content:
# I'm filtering for specific fields to avoid logging tokens
import json
try:
req_data = json.loads(flow.request.content)
# Extract just the structure of tool calls and message slices
filtered = {
"messages_preview": [msg.get("role") for msg in req_data.get("messages", [])],
"tool_count": len(req_data.get("tools", [])),
"has_system": "system" in req_data
}
f.write(json.dumps(filtered, indent=2) + "n")
except:
f.write(flow.request.text + "n")
```

From initial logging, I've observed a few interesting things. The entire conversation history, including tool execution results, is sent on each turn. This seems necessary for the model context but raises questions about long-running sessions and privacy. More importantly, I noticed that tool schemas, including their full descriptions and parameter definitions, are transmitted with every request, not just on initialization. I presume this is for statelessness on Anthropic's side, but it's a constant leakage of potentially sensitive implementation details.

My main question to the group, especially those familiar with the SDK internals, revolves around agent state and concurrency. If I have two agent instances running concurrently using the same client (and thus the same proxy connection), how are the HTTP requests interleaved? Could a tool execution result from Agent A be incorrectly routed to Agent B's context if there's a race condition in the SDK's request/response mapping? The logs show unique HTTP connections, but I'm unsure if the SDK uses connection pooling or multiplexing under the hood.

Furthermore, I'm trying to understand what is truly local. The tool execution itself is local, but the *specification* of the tool is in every API call. Does this mean the hosted components have a full, turn-by-turn picture of my tooling architecture? I'd be grateful for any insights or similar experiences dissecting the SDK's network behavior.