Learn Claude Code is a course, not a product. It shows how tools like Claude Code work by having you build a small version in Python. Lesson one is a single loop and one bash tool: send a message to the model, run what it asks for, send back the result, repeat. Each of the 17 lessons then adds one mechanism, such as permissions, hooks, subagents, skills, context compaction, memory, task systems, agent teams and MCP plugins.
Its argument is that the intelligence comes from the model, and your job as an engineer is the harness around it: tools, knowledge, context and permissions. Every lesson is a Python file you can read and run, with text in English, Chinese and Japanese. There is also a free website, learn.shareai.run, with the lessons, source and simulators, so you can read along without installing anything.
It is by shareAI Lab, an independent group, and is not from Anthropic. It is MIT-licensed with about 80,000 stars and 62 contributors. The README closes by pointing to the group's own Kode tools as next steps, which you do not need for the course.
- Repository: github.com/shareAI-lab/learn-claude-code
- Licence: MIT (MIT License)
- Language: Python. Stars: 80K. Forks: 12.8K. Last push: Oct 27, 2026.
- Scan: safe, Nov 7, 2026, commit 7226f55
Who it is for
Developers who use coding agents and want to know what happens inside them, engineers about to build an agent of their own, and curious learners with some Python who are comfortable in a terminal. To just read along, no setup is needed.
Getting started
1. Download the course and install its three Python packages
git clone https://github.com/shareAI-lab/learn-claude-code && cd learn-claude-code && pip install -r requirements.txt2. Copy the settings file, then add your API key and model name to .env
cp .env.example .env3. Run lesson one, ideally on a test folder
python s01_agent_loop/code.pyYou need an API key from the Anthropic Console, which bills per use and is separate from any Claude subscription, or a key from a compatible provider listed in .env.example such as MiniMax, GLM, Kimi or DeepSeek. The examples run real shell commands the model chooses, so use a throwaway folder or container.
Safety scan
We cloned shareAI-lab/learn-claude-code at commit 7226f55 on Nov 7, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secret hits and no pattern hits in 417 files and about 61,000 lines, mostly Python and Markdown. No binaries committed and no install hooks.
- web/package-lock.json has 235 packages and 52 advisories: four critical, 22 high, 21 moderate, five low. All four criticals are remote code execution bugs in Next.js 16.1.6, and most of the highs are in Next.js too. That lockfile belongs only to the optional course website. The Python lessons do not use it, and the site builds to static pages (output: export), turns off image optimization and uses no use cache functions or server actions.
- If you run the site locally with npm run dev, you are running that old Next.js as a live server, so do not expose it to a network or leave it running on shared Wi-Fi. The hosted site at learn.shareai.run needs no install.
- The examples are teaching code, not a sandbox. Lesson one runs whatever shell command the model picks, in your current folder, and blocks only five strings such as sudo and rm -rf /. A differently written destructive command would get through, so run it in a throwaway folder or container.
- The examples read ANTHROPIC_API_KEY and MODEL_ID from your .env file. They do not read Claude Code's login, a keychain or any credentials file, and they remove ANTHROPIC_AUTH_TOKEN from the environment when you set a custom base URL. Network hosts in the code are only github.com and api.anthropic.com, and nothing reports usage.
- Two workflows, six action uses, all first-party and pinned to commits, with no pull_request_target. A licence and contributing guide are present; no Dependabot or security policy. The Python requirements have no lockfile, so the advisory check could not cover them.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | None: nothing runs at install beyond the package manager itself. |
| Committed binaries | None. |
| CI workflows | 2 workflows. None use pull_request_target. No third-party actions. |
| Network hosts | 2 distinct hosts referenced from source; most often github.com, api.anthropic.com. No URLs to bare IP addresses. |
| Known vulnerabilities | 52 advisories across 235 pinned packages: 4 critical, 22 high, 21 moderate, 5 low. web/package-lock.json: 235 packages, 52 advisories. |
| Project hygiene | Has licence file, contributing guide. Missing security policy, automated dependency updates, CodeQL. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
Worst known vulnerabilities (24 of 52)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-2464-fhr4-w9xw | critical | next@16.1.6 | Next.js: Unauthenticated Remote Code Execution in Image Optimization API when SVG files are used |
| GHSA-2xp9-vwfh-vxw4 | critical | next@16.1.6 | Next.js: Unauthenticated Remote Code Execution in Image Optimization API when AVIF files are used |
| GHSA-673q-mjm6-r5xr | critical | next@16.1.6 | Next.js: Unauthenticated Remote Code Execution in `use cache` functions returning typed arrays |
| GHSA-p293-qw3h-jr36 | critical | next@16.1.6 | Next.js: Unauthenticated Remote Code Execution on windows-hosted servers |
| GHSA-267c-6grr-h53f | high | next@16.1.6 | Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes |
| GHSA-26hh-7cqf-hhc6 | high | next@16.1.6 | Next.js has a Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-U… |
| GHSA-36qx-fr4f-26g5 | high | next@16.1.6 | Next.js has a Middleware / Proxy bypass in Pages Router applications using i18n |
| GHSA-492v-c6pp-mqqv | high | next@16.1.6 | Next.js has a Middleware / Proxy bypass through dynamic route parameter injection |
| GHSA-6gpp-xcg3-4w24 | high | next@16.1.6 | Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale |
| GHSA-89xv-2m56-2m9x | high | next@16.1.6 | Next.js: Server-Side Request Forgery in Server Actions on custom servers |
| GHSA-8h8q-6873-q5fj | high | next@16.1.6 | Next.js Vulnerable to Denial of Service with Server Components |
| GHSA-c4j6-fc7j-m34r | high | next@16.1.6 | Next.js vulnerable to server-side request forgery in applications using WebSocket upgrades |
| GHSA-cjq9-62q9-8jv4 | high | next@16.1.6 | Next.js has Server-Side Request Forgery in Image Optimization |
| GHSA-m99w-x7hq-7vfj | high | next@16.1.6 | Next.js: Denial of Service in App Router using Server Actions |
| GHSA-mg66-mrh9-m8jx | high | next@16.1.6 | Next.js vulnerable to Denial of Service via connection exhaustion in applications using Cache Components |
| GHSA-p3m5-59mp-jv5r | high | next@16.1.6 | Next.js: Denial of Service in App Router using Server Actions |
| GHSA-p9j2-gv94-2wf4 | high | next@16.1.6 | Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname |
| GHSA-q4gf-8mx6-v5v3 | high | next@16.1.6 | Next.js has a Denial of Service with Server Components |
| GHSA-6g55-p6wh-862q | high | postcss@8.4.31 | PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments |
| GHSA-r28c-9q8g-f849 | high | postcss@8.4.31 | PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure |
| GHSA-6g55-p6wh-862q | high | postcss@8.5.6 | PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments |
| GHSA-r28c-9q8g-f849 | high | postcss@8.5.6 | PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure |
| GHSA-f88m-g3jw-g9cj | high | sharp@0.34.5 | sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591 |
| GHSA-rgj7-g3m4-5g8c | high | sharp@0.34.5 | sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545 |
By the numbers
| Stars | 80K |
|---|---|
| Forks | 12.8K |
| Contributors | 62 |
| Commits | 248 |
| Open issues | 37 |
| Open pull requests | 22 |
| Releases | 0 |
| Latest release | none tagged |
| Licence | MIT |
| Main language | Python |
| Project age | 1 year |
| Last push | Oct 27, 2026 |
| Tracked files | 417 |
| Lines of code | 60.6K |
| Checkout size | 4 MB |
Lines by language: Python 25.2K, Markdown 17.4K, TypeScript 11K, JSON 6,321, CSS 582, YAML 85.
Questions
Is Learn Claude Code free?
Yes, the course is MIT-licensed and free, including the website. Running the examples costs whatever your model provider charges for the API calls they make.
Can I use my Claude subscription?
No. The examples need an API key from the Anthropic Console or a compatible provider. They do not use a Claude Code login, and API usage is billed separately from a subscription.
Is this Anthropic's official course?
No. It is an independent project by shareAI Lab that studies how Claude Code is structured and rebuilds the ideas in simple Python.
Will this teach me how to use Claude Code?
Not directly. It teaches how an agent like Claude Code is built. You will come away understanding loops, tools, permissions and subagents, which helps you use any coding agent better, but it is not a guide to Claude Code's commands.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.