Anthropic adds code execution, MCP connector, Files API, and caching

Announcement record

Anthropic announced four API capabilities for agents: a code-execution tool, an MCP connector, a Files API, and extended prompt caching. The release described hosted computation, remote-tool connections, persistent files, and longer context, each with its own access, data-lifecycle, availability, billing, adoption, and developer implementation considerations.

Why it matters

These primitives reduce implementation work but concentrate powerful permissions. Assess sandbox limits, connector identity, file lifecycle, data retention, and cache invalidation before use.

What the announcement established

Anthropic's May 22, 2025 announcement grouped four agent-building capabilities: code execution, an MCP connector, a Files API, and extended prompt caching. Each shifts a different operational burden. Hosted execution runs computation outside the application process; MCP can connect a model to remote tools; files create persistent content handles; caching changes cost and latency behavior for repeated context. The release did not turn those components into one universal security boundary. This historical note keeps the announcement scope separate from current account entitlements, connector trust, pricing, retention, regional support, and any claim that a composed agent is safe by default.

Separate capability planes

A useful design names four planes instead of hiding them behind one agent: the reasoning plane, sandbox plane, connector plane, and evidence plane. Code execution needs filesystem and network limits. MCP needs server identity, scoped tool manifests, input validation, and revocation. Files need ownership, classification, lifecycle, and deletion receipts. Caching needs a key design that prevents one tenant's context from being reused for another. A single model session may coordinate those planes, but its text output should not be the authority deciding their permissions. Hypler can express each step as a typed capability grant that expires and is auditable.

Composition makes failures compound

An agent can fail safely in isolation but become unsafe when files, code, and connectors share ambient access. A file name can carry hostile instructions; a code runtime can export a connector response; a stale cache can return prior context after permissions changed. Treat file ingestion as untrusted input, block unapproved network paths from code execution, and prevent connector calls from reading arbitrary sandbox outputs. When any component is unavailable, return a specific failed state rather than silently substituting a broader privilege. The operator needs to see whether an answer came from cached context, an uploaded file, a tool response, or a failed fallback.

Hypothetical data-repair run

Hypothetical: an engineer asks an agent to identify malformed records and propose repairs. The Files API equivalent receives a bounded export with a classification label. A sandbox computes candidate fixes without network access. The model may summarize patterns, but the only connector exposed can create a review ticket, not update the source system. The ticket includes file version, ruleset version, sampled failures, and a patch preview. A reviewer approves a separate, service-owned apply job. If the file classification is missing, the workflow stops before retrieval or caching. If the connector returns an error, the report states that no ticket was created instead of implying completion.

Acceptance checks before adoption

Test expired grants, revoked connector credentials, mislabeled files, cross-tenant cache keys, oversized uploads, malicious filenames, sandbox egress attempts, connector schema changes, and deletion after a partial failure. Assert that a model cannot discover or invoke a tool absent from its task grant. Confirm that cache entries include authorization and content-version dimensions. Verify a reviewer can trace every output to file versions, tool invocations, and policy decisions. Include a red-team fixture where a document tries to persuade the agent to call an unrelated MCP tool. Passing tests should prove containment and honest failure reporting, not merely that the happy path returns text.

Hypler connection

Hypler evaluates agent components through separate grants for files, computation, connectors, and evidence. Each capability is scoped, observed, and reviewed as part of the workflow, which makes it possible to assess a useful integration without assigning broad standing authority to a model or connector.

Capability inventory

Keep a machine-readable inventory of every sandbox image, connector, file store, cache namespace, and model-facing grant. For each item, name the owner, data classes, authentication method, egress policy, expiry, logging location, and test evidence. A capability added for one pilot should not become an invisible global primitive through reuse. Review the inventory when a tool changes version or a new integration is proposed. The most useful operator screen answers simple questions quickly: what can this run touch, what did it touch, what was denied, and how can access be revoked? That discipline applies regardless of whether the underlying vendor groups the features under one agent platform.

Related capabilities

• Custom software and product engineering