Claude Agent SDK & FastAPI: Production AI Agents 2026

The Claude Code tools the SDK can load, and what they cost just by being in the prompt. The same question with no tools, three tools by name, the full preset of 29 and the preset minus five, plus a request for a shell that is not there. Then the four options that decide which tools exist and which may run.

Download: the project with the built-in tools script, one experiment per argument.

Turn a Python function into a tool with the tool decorator, put it in an in-process MCP server, and give Deskmate that tool and nothing else. The first run answers honestly and still wrong, and shows why a search excerpt is only half a tool. Tools are functions, so they get tests without a model.

Download: the project with the first tool, its tests and the ask script.

A second tool reads one whole document, and only documents inside the knowledge base folder. With it, Deskmate finds the right answer and names its source for the PDF and Okta SSO questions, and an attempt to read a file outside the folder is refused by code that a test proves.

Download: the project with both knowledge base tools and their tests.

Tickets in SQLite: list, read, add a note, and close. Closing asks a person, and only an explicit yes reaches the database. In the real run the agent asked to close all six tickets, including one that orders an AI to close everything; the gate let exactly one through.

Download: the project with the ticket tools, the triage script and the gate tests.

Add a third-party MCP server as a separate process, pinned to one version, next to your own tools. Measure what it costs per run even when it is never used, see a connected server denied because its tools were not approved, and apply a four-question checklist before any server goes in.

Download: the project with the external server script and its modes.

A pre tool use hook that stops notes promising refunds or containing email addresses, and a post tool use hook that writes an audit line for every call. Without hooks the note broke both rules; with them the agent was denied twice, read the reasons, and wrote a clean note.

Download: the project with the hooks, their tests and the demo script.

Three attacks through the data Deskmate reads: an order hidden in a ticket, the same order written into the knowledge base, and that order plus a prompt that trusts procedures. Each is run more than once and counted. The model resisted the loud attacks and fell for the quiet one; the gate in code never did.

Download: the project with the attack script and the tests that prove the gate.

Deskmate moves behind FastAPI: one place that configures the agent, a validated question, a route that awaits the agent, and tests that swap the agent for a fake. Real timings: fifteen seconds for one answer, almost two of them spent starting a process, and three questions at once in eighteen seconds, not thirty-seven.

Download: the project with the API, its tests and a client script.

The SDK message stream becomes server-sent events: text, tool calls and the final result. The measured timeline shows the tool events arriving seven seconds before the first word, and a client that hangs up stops the agent: no tool runs and no process is left behind.

Download: the project with the streaming route, its tests and a timing client.

Each user gets one conversation that continues: which session is whose, a lock so a second tab waits instead of forking it, and a time to live so it ends. Ana gets her history back, Ben cannot see it, and a deleted conversation is really gone.

Download: the project with the session store, its tests and the demo script.

One Pydantic model becomes the JSON schema sent to the SDK, the check on what comes back, and the API response. All six tickets come back valid, including the injection attempt, but the same ticket gets two different priorities in two runs: a schema fixes the shape, not the judgment.

Download: the project with the triage module, route, tests and script.

Sessions expire; a few facts about a user should not. Memory is at most eight short facts per user, written through one tool bound to that user, with secrets refused in code, and read back into the prompt. A day later, Ana gets an answer built on her Safari version; Ben gets the generic one.

Download: the project with the memory module, routes, tests and demo.

A triage lead delegates research to a read-only subagent, four at once. Two surprises from the real run: the stream holds two results, and code that stops at the first loses four notes; and with a small knowledge base, the single agent is cheaper and faster.

Download: the project with the team definition, its tests and the comparison script.

A single HTML page reads the chat stream with fetch, and the gate from section two moves to the web: the agent can ask to close a ticket, a person approves it, and code closes it. The real run also shows one invented sentence the gate cannot catch.

Download: the project with the page, the approvals and their tests.

Deskmate goes into a container and onto Cloud Run. A slim image with a user that is not root, the API key kept out of every layer and read from a secret at start, and real numbers: a 1.45 GB image, a quarter of it the Claude Code CLI, about 500 MB of memory for three answers at once, and a first answer in eleven seconds.

Download: the project with the Dockerfile, settings module, container test and deploy script.

An open agent is a credit card on the internet. Callers get bearer tokens, stored only as hashes, with a role and a daily budget that also caps every run. The real run found a bug: when the budget fuse fired, the SDK raised after the result, the server answered 500 and the cost was lost. Now it is a 402 with the cost recorded.

Download: the project with the auth module, token script, budget demo and tests.

Three limits, three status codes: too many requests per user, too many runs per instance, and a run that takes too long. The first timeout took eight seconds to say three; the fix answers on time and stops the process in the background. A model that does not exist returns "success" with an error flag: check the flag, and set a fallback model.

Download: the project with the limits module, failure demo and tests.

One JSON log line per request, per run and per tool call, all with the same request id. The first version logged every user as a dash, for two reasons worth knowing: a dependency running in a worker thread, and a middleware running in another task. Deployed, four questions become four log queries: who spent, what failed, where the time goes, and what one request did.

Download: the project with the logging module, traffic script and log queries.

Nine cases with things the answer must and must not say, three of them safety cases, each run three times, with a pass rate, a cost ceiling and an exit code for CI. The suite was wrong in both directions: it failed good answers, then passed a change that invented a feature. Reading the answers found a bug that was already in production; one prompt sentence fixed it.

Download: the project with the eval suite, runner and CI workflow.

Four questions about what the agent can reach, each answered with a probe against the real agent: the agent's process inherits your server's secrets, and a file in its working folder can quietly become its prompt. The answers become an audit that refuses to start an unsafe server, and a function that removes app-only secrets first. Plus the rule on authentication: an API key, never a personal login.

Download: the project with the security module, probes and tests.

One new capability, built the way the whole course builds: a contract, read-only tools, checks in code, tests, an eval and the same container. Handing the tickets over from code cut the run from 17 turns to 10. Three of three became six of ten over more runs; a quote checked against its document brought nine of ten, and the reason a person still sends the drafts.

Download: the project with the digest module, its eval, tests and route.

The digest runs from a GitHub Actions workflow: a cron schedule, the key as a secret, and the result posted as an issue comment. The first runs failed quietly, then honestly: an account out of credit. Then the schedule itself, measured: about 29 slots in five hours, not one run. So Deskmate gets a status route a monitor can watch, because a missing digest must become an alert.

Download: the project with the workflow and the status route.

The same morning digest on Claude Managed Agents: same model, prompt, tools and checks, with the knowledge base kept on your machine as custom tools. Measured: 13 to 20 seconds and about two cents a run against 22 to 25 seconds and three cents on the SDK, and ten of ten in the eval. Then what each choice gives you: where the loop runs, your rules, your data, schedules.

Download: the project with the Managed Agents script.

The course in one table, and every check run once more on the finished project: 92 tests with no model, the task suite at 27 of 27, and a digest eval that still says no one time in three. The habits that held up in every lesson, and where to take Deskmate next: real search, a real ticket system, and evals from every real failure.

Download: the finished project.

My other courses, if you want to keep learning.