Glossary

Plain-English definitions of the terms used in this repository, in alphabetical order, each linked to the page that explains it in depth. Product and API terms reflect Claude as of 2026-10-24; check the official docs for changes.

A · B · C · D · E · F · G · H · I · J · K · L · M · N · O · P · Q · R · S · T · U · V · W · Z

A

• Acceptable-use policy (AI): An organisation's rules for which AI tools staff may use, with which data and under what review. See 12 · AI governance.
• acceptEdits mode: A Claude Code permission mode that automatically accepts file edits in the working directory. See 09 · Permissions and settings.
• Adaptive thinking: thinking={"type": "adaptive"}; Claude decides when and how much to reason before answering. See 03 · Reasoning and thinking.
• Agent: A system in which the model chooses its next step and tools in a loop until a goal is met. See 10 · Workflows vs agents.
• Agent loop: The repeating cycle of model call, tool execution and result return that drives an agent. See 10 · The agent loop.
• Agent SDK (Claude Agent SDK): Claude Code's harness packaged as a library, with built-in file, shell and web tools, for building your own agents. See 09 · Headless, CI and the Agent SDK.
• Agent Skills: Folders with a SKILL.md file and optional scripts that give Claude packaged know-how, loaded on demand. See 04 · Progressive disclosure and Skills.
• Architecture decision record (ADR): A short document recording a design decision, the options and the reasoning. See 13 · Architecture decision records.
• Artifact: Standalone content (document, code, diagram, small app) shown in its own panel in the Claude apps. See 05 · Artifacts and output formats.
• Assistant prefill: Ending a request with a partial assistant message to steer output; not supported on current Claude models. See 03 · Structured output.
• Audit log: A tamper-evident record of prompts, tool calls, approvals and outcomes used for investigation and compliance. See 12 · Logging and auditability.
• Auto mode: A Claude Code permission mode in which a classifier reviews actions instead of prompting the user. See 09 · Permissions and settings.

B

• Batch processing (Message Batches): Asynchronous processing of many requests at 50% of standard prices, completing within 24 hours. See 06 · Batch processing.
• Bias (model): Systematic unfairness in outputs across groups or perspectives. See 14 · Safety and red-team evals.
• BM25: A classic keyword-ranking algorithm often combined with vector search in hybrid retrieval. See 11 · Retrieval strategies.
• bypassPermissions mode: A Claude Code mode that skips permission prompts; only for isolated, disposable environments. See 09 · Permissions and settings.

C

• Cache breakpoint: A cache_control marker that ends a cacheable prefix; up to four per request. See 04 · Prompt caching.
• Capability bloat: Giving an agent more tools or broader tools than it needs, which hurts accuracy and security. See 07 · Tool design best practices.
• Chain-of-thought: Having a model reason step by step before answering; on current Claude models usually achieved with adaptive thinking. See 03 · Reasoning and thinking.
• Chunking: Splitting documents into retrievable pieces for RAG. See 11 · Chunking strategies.
• Citations: A feature that links answer text to exact passages in supplied documents. See 06 · Vision, documents and citations.
• Claude apps: Claude on the web, desktop and mobile for chat, Projects, artifacts and research. See 05 · Product ecosystem.
• Claude Code: Anthropic's agentic coding tool for the terminal, IDEs, desktop and web. See 09 · What is Claude Code.
• Claude Partner Network: Anthropic's partner programme; organisations in it are currently eligible for the Claude certification exams. See 16 · Certification tracks.
• CLAUDE.md: A Markdown file of persistent project or user instructions that Claude Code loads into context. See 09 · CLAUDE.md and memory.
• Cloud platforms: Access to Claude through Amazon Bedrock, Google Vertex AI or Microsoft Foundry, with platform-specific auth and feature availability. See 06 · Cloud platforms.
• Compaction: Summarising earlier conversation to free context space, manually or server-side. See 04 · Compaction and context editing.
• Confused deputy: A component with broad privileges tricked into acting for a party that lacks them. See 12 · Agent identity and permissions.
• Connector: An integration that lets Claude read from or act in another service, often via MCP. See 05 · Connectors and integrations.
• Constitutional AI: Anthropic's training approach using written principles to guide self-critique and revision. See 02 · Anthropic's safety approach.
• Context editing: Clearing specific old content, such as stale tool results, from the conversation. See 04 · Compaction and context editing.
• Context engineering: Deciding what information occupies the context window at each step. See 04 · What is context engineering.
• Context window: The maximum tokens a model considers in one request, input and output together. See 01 · Context windows.
• Cost per completed task: Total spend to finish a unit of work, including retries and extra turns; the right basis for comparing models. See 15 · Cost optimisation.
• count_tokens: The API endpoint that counts input tokens before sending a request. See 06 · Token counting and cost.
• custom_id: The identifier you attach to each batch request; results must be matched by it. See 06 · Batch processing.

D

• Data exfiltration: Unauthorised transfer of data out of a system, for example via injected instructions and an outbound channel. See 12 · Data exfiltration and disclosure.
• Data minimisation: Sending only the data a task needs into prompts and tools. See 13 · Data governance and compliance.
• Data poisoning: Corrupting training or knowledge-base content to manipulate outputs. See 12 · Supply chain risks.
• Data residency: Requirements on where data is stored or processed geographically. See 13 · Data governance and compliance.
• Decomposition: Breaking a complex task into smaller, separately solvable steps. See 03 · Task decomposition and chaining.
• Deny rule: A Claude Code permission rule that blocks a tool or pattern; evaluated before ask and allow rules. See 09 · Permissions and settings.
• Direct prompt injection: Malicious instructions typed by the user to override intended behaviour. See 12 · Prompt injection.

E

• Effort: The output_config.effort setting (low to max) that tunes how thorough Claude is and how many tokens it spends. See 03 · Reasoning and thinking.
• Elicitation: An MCP client feature letting a server ask the user for more information. See 08 · Architecture.
• Embedding: A numeric vector representing meaning, used for semantic search. See 11 · Embeddings and indexing.
• Evaluation (eval): A repeatable test of model or system behaviour against defined criteria and data. See 14 · Why evaluate.
• Evaluation dataset: The curated inputs, expected outputs and edge cases an eval runs on. See 14 · Building eval datasets.
• Evaluator–optimiser: A workflow where one call generates and another critiques until criteria are met. See 10 · Workflow patterns.
• Excessive agency: More tools, permissions or autonomy than a task needs (OWASP LLM06). See 12 · Tool misuse and excessive agency.

F

• Fallback (refusal fallback): An API option that retries a refused request on a designated model on supported models and platforms. See 06 · Messages API.
• Few-shot prompting: Including a few examples of desired input and output in the prompt. See 03 · Examples and few-shot.
• Files API: Upload a file once and reference it by file_id in later requests. See 06 · Vision, documents and citations.
• Fine-tuning: Further training a model on task data; most Claude solutions use prompting, retrieval and tools instead. See 01 · Large language models.

G

• Generative AI: AI that produces new content such as text, code or images. See 01 · Generative AI.
• Grounding: Tying answers to supplied, verifiable sources. See 11 · Grounding and citations.
• Guardrails: Controls inside and around a model that constrain inputs, outputs and actions. See 12 · Enterprise deployment controls.

H

• Hallucination: Confident output that is false or unsupported by sources. See 01 · Hallucinations.
• Harness: The loop and context management around a model that turns it into an agent. See 10 · Managed agents and the Agent SDK.
• Headless mode: Running Claude Code non-interactively with claude -p, for scripts and CI. See 09 · Headless, CI and the Agent SDK.
• Hook: A command or handler Claude Code runs at a lifecycle event such as PreToolUse. See 09 · Hooks.
• Host (MCP): The AI application that connects to MCP servers through clients. See 08 · Architecture.
• Human-in-the-loop (HITL): A design where people review or approve model outputs or actions at defined points. See 10 · Human in the loop.
• Hybrid search: Combining keyword and vector retrieval. See 11 · Retrieval strategies.

I

• Idempotency: Designing an operation so repeating it has no extra effect; essential when retrying tool calls. See 15 · Reliability engineering.
• Incident response: The process for containing, investigating and recovering from failures or attacks. See 15 · Incident response.
• Indirect prompt injection: Instructions hidden in content the model processes, such as documents, web pages or tool results. See 12 · Indirect prompt injection.
• Insecure (improper) output handling: Passing model output unvalidated into HTML, SQL, shells or APIs (OWASP LLM05). See 12 · Insecure output handling.

J

• JSON Schema: A standard for describing JSON structure, used in tool definitions and structured outputs. See 07 · Defining tools.
• JSON-RPC 2.0: The message format MCP uses for requests, responses and notifications. See 08 · Architecture.

K

• Knowledge base: The curated content a RAG system or Project draws on. See 05 · Projects and knowledge.

L

• Large language model (LLM): A neural network trained on large text corpora to predict tokens and generate language. See 01 · Large language models.
• Latency: Time to respond; often measured as time to first token and total time. See 15 · Latency optimisation.
• Least privilege: Granting only the permissions a component needs. See 12 · Agent identity and permissions.
• LLM-as-judge: Using a model with a rubric to grade outputs. See 14 · Grading methods.
• Long context: Placing large documents directly in the context window rather than retrieving fragments. See 11 · RAG vs long context.

M

• Managed Agents: An Anthropic-hosted agent surface that runs the loop and a per-session sandbox for you. See 10 · Managed agents and the Agent SDK.
• Managed settings: Organisation-enforced Claude Code settings with the highest precedence. See 09 · Team rollout.
• max_tokens: The required cap on output tokens per response; hitting it truncates output. See 06 · Messages API.
• MCP (Model Context Protocol): An open protocol for connecting AI applications to external tools and data. See 08 · What is MCP.
• MCP server: A program exposing tools, resources and prompts over MCP. See 08 · Building an MCP server.
• Memory (agent): Information persisted across sessions, such as files or stores the agent reads and writes. See 04 · Memory and persistence.
• Messages API: The POST /v1/messages endpoint through which all Claude generation flows. See 06 · Messages API.
• Misinformation (OWASP LLM09): False or misleading output that users rely on. See 12 · OWASP LLM mapping.
• Mock mode: This repository's offline lab mode, using a fake client with canned responses. See 19 · Hands-on labs.
• Model selection: Choosing a model by capability, latency, cost and constraints, measured on evals. See 05 · Model selection.
• Multi-agent system: Several agents, often an orchestrator and workers, cooperating on a task. See 10 · Multi-agent architecture.

N

• NIST AI RMF: The NIST AI Risk Management Framework, organised as Govern, Map, Measure and Manage. See 12 · AI governance.

O

• OAuth 2.1: The authorization framework MCP uses for HTTP servers. See 08 · MCP security.
• Observability: Logs, metrics and traces that explain what a system did and why. See 15 · Observability.
• Orchestrator–workers: A pattern where a lead model delegates subtasks to workers and synthesises results. See 10 · Workflow patterns.
• output_config: The request object holding effort, structured output format and task budgets. See 06 · Messages API.
• OWASP Top 10 for LLM Applications: A ranked list of LLM application risks (2025 edition). See 12 · OWASP LLM mapping.

P

• Parallel tool use: Claude requesting several tool calls in one response; return all results in one message. See 07 · The tool-use loop.
• Parallelisation (workflow): Running independent model calls concurrently, by sectioning or voting. See 10 · Workflow patterns.
• pause_turn: A stop reason indicating a long server-tool turn paused and should be continued. See 07 · Server tools.
• Permission mode: The Claude Code setting (default, acceptEdits, plan, auto, dontAsk, bypassPermissions) that governs prompts. See 09 · Permissions and settings.
• PII (personal data): Information identifying a person, subject to privacy law and policy. See 12 · Data exfiltration and disclosure.
• Plan mode: A Claude Code mode where Claude explores read-only and proposes a plan before editing. See 09 · Permissions and settings.
• Plugin (Claude Code): A package bundling skills, commands, subagents, hooks and MCP servers. See 09 · Commands, skills and subagents.
• Production readiness: The checklist of reliability, security, cost and operational criteria before launch. See 15 · Production readiness.
• Progressive disclosure: Loading detailed context only when needed, as Skills do. See 04 · Progressive disclosure and Skills.
• Project (Claude apps): A workspace with custom instructions and knowledge files shared across chats. See 05 · Projects and knowledge.
• Prompt: The instructions and content sent to a model. See 02 · Prompt fundamentals.
• Prompt caching: Reusing a processed request prefix for lower cost and latency. See 04 · Prompt caching.
• Prompt chaining: Sequential calls where each output feeds the next. See 03 · Task decomposition and chaining.
• Prompt engineering: Designing prompts to get reliable, useful outputs. See 03 · Prompt engineering.
• Prompt injection: Input that manipulates a model into ignoring intended instructions (OWASP LLM01). See 12 · Prompt injection.
• Prompt template: A reusable prompt with variables filled per request, versioned like code. See 03 · System prompts and roles.
• Prompts (MCP primitive): User-controlled reusable templates exposed by an MCP server. See 08 · Architecture.

Q

• Query rewriting: Reformulating a user question into a better search query before retrieval. See 11 · Retrieval strategies.

R

• RAG (retrieval-augmented generation): Retrieving relevant content at query time and adding it to the prompt. See 11 · RAG fundamentals.
• Rate limit: A cap on requests or tokens per minute; exceeding it returns HTTP 429. See 15 · Rate limits and capacity.
• Recall@k: The share of queries whose correct source appears in the top k retrieved results. See 11 · RAG evaluation.
• Red teaming: Adversarial testing to find safety and security failures. See 14 · Safety and red-team evals.
• Refusal: A stop_reason indicating a safety classifier declined the request. See 06 · Messages API.
• Reranking: Re-scoring retrieved candidates with a more precise model. See 11 · Retrieval strategies.
• Resources (MCP primitive): Application-controlled data an MCP server exposes for reading into context. See 08 · Architecture.
• Responsible Scaling Policy (RSP): Anthropic's policy tying safety measures to model capability levels. See 02 · Anthropic's safety approach.
• Responsible use: Using AI in ways that are lawful, fair, transparent and appropriately supervised. See 02 · Responsible use.
• Retry with backoff: Retrying transient failures after increasing delays with jitter. See 06 · Errors, rate limits and retries.
• ROI (return on investment): Business value delivered relative to cost, used to justify AI projects. See 13 · Business value and ROI.
• Routing: A workflow that classifies input and sends it to a specialised prompt or model. See 10 · Workflow patterns.

S

• Sampling (MCP): A client feature allowing a server to request a completion from the host's model. See 08 · Architecture.
• Sandbox: An isolated environment for running code or tools with limited access. See 12 · Enterprise deployment controls.
• Secrets management: Storing and injecting credentials securely, never in prompts or code. See 12 · Secrets management.
• Semantic search: Finding content by meaning using embeddings. See 11 · Embeddings and indexing.
• Sensitive information disclosure: Revealing data the user should not see (OWASP LLM02). See 12 · Data exfiltration and disclosure.
• Server tools: Tools such as web search, web fetch and code execution that run on Anthropic's infrastructure. See 07 · Server tools.
• Settings precedence (Claude Code): Managed, then command line, then project local, then shared project, then user. See 09 · Permissions and settings.
• SLA / SLO: Service-level agreement or objective, the commitments on availability, latency and support. See 13 · Stakeholder communication.
• Slash command: A /command in Claude Code, built in or defined as a skill. See 09 · Commands, skills and subagents.
• stdio transport: The MCP transport that runs a server as a local subprocess over standard input and output. See 08 · Architecture.
• stop_reason: The response field that says why generation ended; check it before using content. See 06 · Messages API.
• Streamable HTTP: The MCP transport for remote servers using HTTP POST and optional SSE streams. See 08 · Architecture.
• Streaming: Receiving a response incrementally as server-sent events. See 06 · Streaming.
• Strict tool use: strict: true on a tool definition, guaranteeing arguments match the schema. See 07 · Defining tools.
• Structured outputs: Constraining a response to a JSON Schema via output_config.format. See 03 · Structured output.
• Subagent: A delegated agent with its own context window and tools, returning a summary. See 09 · Commands, skills and subagents.
• Supply chain risk (AI): Risk from third-party models, data, packages, plugins and MCP servers (OWASP LLM03). See 12 · Supply chain risks.
• System prompt: Operator instructions that set role, rules and context for a conversation. See 03 · System prompts and roles.
• System prompt leakage: Disclosure of system prompt contents (OWASP LLM07). See 12 · OWASP LLM mapping.

T

• Task budget: A beta token budget that lets Claude pace an agentic loop. See 10 · Agent reliability.
• Temperature: A sampling parameter in older models; current Claude models reject it. See 06 · Messages API.
• Threat model: A structured analysis of assets, threats and controls. See 12 · LLM threat modelling.
• Time to first token (TTFT): Latency until the first output token arrives. See 15 · Latency optimisation.
• Token: The unit of text a model processes and the basis for cost and limits. See 01 · Tokens and tokenisation.
• Token passthrough: Forwarding a client's token to downstream services; forbidden for MCP servers. See 08 · MCP security.
• Tool poisoning: Malicious instructions hidden in tool descriptions or metadata. See 12 · MCP server security.
• tool_choice: The request setting for tool selection; auto or none on Opus 5.5, Sonnet 5.5, Fable 5.1 and Mythos 5.1. See 07 · Defining tools.
• Tool Runner: An SDK helper that runs the tool-use loop for tools you define. See 07 · The tool-use loop.
• tool_result: The block returning a tool's output to Claude, matched to a tool_use id. See 07 · The tool-use loop.
• Tool use (function calling): Letting Claude request calls to functions you define. See 07 · Tool use fundamentals.
• tool_use: The content block (and stop reason) in which Claude requests a tool call. See 07 · Tool use fundamentals.
• Tools (MCP primitive): Model-controlled functions an MCP server exposes. See 08 · Architecture.
• Trust boundary: A line in a design where data or control passes between parties of different trust. See 12 · LLM threat modelling.

U

• Unbounded consumption: Uncontrolled resource or cost use from runaway requests or loops (OWASP LLM10). See 15 · Rate limits and capacity.
• Usage object: Token counts in each response, including cache creation and cache read tokens. See 06 · Token counting and cost.

V

• Vector and embedding weaknesses: Risks in RAG stores such as leakage across tenants or poisoning (OWASP LLM08). See 12 · OWASP LLM mapping.
• Vector database: A store optimised for similarity search over embeddings. See 11 · Embeddings and indexing.
• Vision: Claude's ability to read images and PDFs supplied as content blocks. See 06 · Vision, documents and citations.

W

• Web fetch tool: A server tool that retrieves the content of URLs already present in the conversation. See 07 · Server tools.
• Web search tool: A server tool that lets Claude search the web and cite results. See 07 · Server tools.
• Workflow: A system where code defines the steps and the model fills them in. See 10 · Workflow patterns.
• Workspace (Claude Console): A grouping of API keys, limits and settings inside an organisation. See 06 · Getting started with the API.

Z

• Zero data retention (ZDR): An arrangement under which request data is not retained after processing; some models require standard retention instead. See 13 · Data governance and compliance.
• Zero-shot prompting: Asking for a task without examples. See 03 · Examples and few-shot.