Building GRC Agents with the Anthropic Agent SDK

import { query } from "@anthropic-ai/claude-agent-sdk";

for await (const message of query({
  prompt: "Find all evidence files related to access control",
  options: {
    model: "sonnet",
    allowedTools: ["Glob", "Read", "Grep"],
    maxTurns: 50
  }
})) {
  switch (message.type) {
    case "system":
      if (message.subtype === "init") {
        console.log("Session ID:", message.session_id);
        console.log("Available tools:", message.tools);
      }
      break;

    case "assistant":
      for (const block of message.message.content) {
        if ("text" in block) {
          console.log("Claude:", block.text);
        } else if ("name" in block) {
          console.log("Tool call:", block.name);
        }
      }
      break;

    case "result":
      console.log("Status:", message.subtype);
      console.log("Cost:", message.total_cost_usd);
      break;
  }
}

import { query } from "@anthropic-ai/claude-agent-sdk";

const evidenceReviewSchema = {
  type: "object",
  properties: {
    findings: {
      type: "array",
      items: {
        type: "object",
        properties: {
          severity: {
            type: "string",
            enum: ["low", "medium", "high", "critical"]
          },
          category: {
            type: "string",
            enum: ["missing", "incomplete", "outdated", "mismatch"]
          },
          controlId: { type: "string" },
          file: { type: "string" },
          description: { type: "string" },
          recommendation: { type: "string" }
        },
        required: ["severity", "category", "controlId", "description"]
      }
    },
    summary: { type: "string" },
    controlsCovered: { type: "number" },
    gapsIdentified: { type: "number" }
  },
  required: ["findings", "summary", "controlsCovered", "gapsIdentified"]
};

async function reviewEvidence(evidenceDir: string, controlFamily: string) {
  for await (const message of query({
    prompt: `Review the evidence files in ${evidenceDir} against ${controlFamily}
control requirements. Identify gaps, outdated artifacts, and mismatches between
evidence and stated control implementations.`,
    options: {
      model: "opus",
      allowedTools: ["Read", "Glob", "Grep"],
      permissionMode: "bypassPermissions",
      maxTurns: 50,
      outputFormat: {
        type: "json_schema",
        schema: evidenceReviewSchema
      }
    }
  })) {
    if (message.type === "result" && message.subtype === "success") {
      const review = message.structured_output;

      console.log(`\nEvidence Review: ${controlFamily}\n`);
      console.log(`Controls Covered: ${review.controlsCovered}`);
      console.log(`Gaps Identified: ${review.gapsIdentified}`);
      console.log(`Summary: ${review.summary}\n`);

      for (const finding of review.findings) {
        const icon = finding.severity === "critical" ? "🔴" :
                     finding.severity === "high" ? "🟠" :
                     finding.severity === "medium" ? "🟡" : "🟢";
        console.log(`${icon} [${finding.category.toUpperCase()}] ${finding.controlId}`);
        console.log(`   ${finding.description}`);
        if (finding.recommendation) {
          console.log(`   → ${finding.recommendation}`);
        }
        console.log();
      }
    }
  }
}

reviewEvidence("./evidence/access-control/", "AC");

import { query, AgentDefinition } from "@anthropic-ai/claude-agent-sdk";

async function comprehensiveEvidenceReview(evidenceDir: string) {
  for await (const message of query({
    prompt: `Perform a comprehensive evidence review of ${evidenceDir}.
Use the policy-reviewer for policy documents and procedure-analyzer for
technical implementation evidence.`,
    options: {
      model: "opus",
      allowedTools: ["Read", "Glob", "Grep", "Task"],
      permissionMode: "bypassPermissions",
      maxTurns: 50,
      agents: {
        "policy-reviewer": {
          description: "Policy document specialist",
          prompt: `You are a GRC policy analyst. Focus on:
- Policy completeness and coverage
- Version dates and review cycles
- Alignment with framework requirements
- Missing required sections`,
          tools: ["Read", "Grep", "Glob"],
          model: "sonnet"
        } as AgentDefinition,

        "procedure-analyzer": {
          description: "Technical evidence and procedure reviewer",
          prompt: `You are a technical evidence analyst. Examine:
- Screenshots and configuration exports
- Log samples and audit trails
- Technical procedure documentation
- Evidence freshness and relevance`,
          tools: ["Read", "Grep", "Glob"],
          model: "haiku"
        } as AgentDefinition
      }
    }
  })) {
    if (message.type === "assistant") {
      for (const block of message.message.content) {
        if ("text" in block) {
          console.log(block.text);
        } else if ("name" in block && block.name === "Task") {
          console.log(`\nDelegating to: ${(block.input as any).subagent_type}`);
        }
      }
    }
  }
}

comprehensiveEvidenceReview("./evidence/");

options: {
  // Standard mode - prompts for each tool use
  permissionMode: "default",

  // Auto-approve edits (useful for generating reports)
  permissionMode: "acceptEdits",

  // No prompts - for automated pipelines
  permissionMode: "bypassPermissions"
}

options: {
  canUseTool: async (toolName, input) => {
    // Allow all read operations
    if (["Read", "Glob", "Grep"].includes(toolName)) {
      return { behavior: "allow", updatedInput: input };
    }

    // Block access to sensitive directories
    if (input.path?.includes("/secrets/") || input.path?.includes("/.env")) {
      return { behavior: "deny", message: "Cannot access sensitive files" };
    }

    return { behavior: "allow", updatedInput: input };
  }
}