Anthropic Python SDK v1.10.0 Released: Enterprise Features and Plugin Marketplace Arrive

Anthropic's official Python SDK has landed its v1.10.0 update. This release goes well beyond routine bug fixes — it marks a significant step toward enterprise-grade scenarios and a broader developer ecosystem, with Claude Enterprise analytics, Plugin Marketplaces, RBAC permission management, and more all shipping together. The Organization API has also officially reached GA (generally available) status.

For teams actively integrating Claude into production environments, the changes in this version are worth a close look.

Enterprise Management Capabilities Significantly Expanded

The most substantial changes in this update are concentrated in the Admin API. Anthropic has added Claude Enterprise analytics, spend limits, and Role-Based Access Control (RBAC) grouping and role capabilities to the management interface. This gives enterprise administrators far more granular control over their team's usage and costs.

Paired with the new per-user usage and cost reporting, administrators can clearly see each member's API consumption — providing a solid data foundation for budget allocation and usage governance. These kinds of capabilities previously required teams to build their own tracking systems; now they're integrated directly at the SDK level.

In addition, the Organization API endpoints have officially transitioned to GA status, signaling that org-level management is no longer an experimental feature but a stable interface ready for production. For large organizations that need to manage multiple teams and members, this is an important milestone.

What is RBAC? RBAC (Role-Based Access Control) is the dominant model for managing permissions in enterprise software. Its core idea is to assign "permissions" to "roles" rather than directly to "users," then assign "roles" to users — enabling bulk permission management and unified changes. Typical role divisions include: administrators (who can modify org configuration), developers (who can call APIs and create applications), and read-only auditors (who can only view usage reports). In the context of the Claude SDK, the introduction of RBAC means large organizations can assign differentiated API access permissions to different business lines or functional teams, preventing unauthorized access while making it easier to pinpoint responsibility when anomalies occur. Compared to manually maintaining API key whitelists, RBAC makes permission changes less costly and integrates more naturally with an enterprise's existing IdP (Identity Provider) infrastructure.

Plugins and Plugin Marketplace Make Their Debut

This version introduces the concepts of Plugins and Plugin Marketplaces, bringing them under the Admin API. Developers and administrators can manage plugin installation and distribution at the organizational level, including the ability to remove org-wide installation settings for a given plugin.

On the type definition side, the SDK has also changed admin plugin preference and marketplace-related fields to enumerated types, making API calls more consistent and reducing room for error. The addition of a plugin marketplace signals that the Claude ecosystem is moving beyond simple API calls toward a composable, extensible platform.

A broader perspective on Plugin Marketplaces: While the Plugin Marketplace model isn't new, native integration at the LLM SDK level is still relatively early territory. The core value lies in "composability": each plugin encapsulates an independent piece of tool logic or data source access capability. Administrators can centrally approve, distribute, or revoke plugins at the org level, without requiring every developer to maintain their own integration code. This follows the same governance philosophy as mature platforms like Salesforce AppExchange and the Slack App Directory — the platform handles review and distribution, enterprise admins handle access decisions, and end users simply consume the result, with three layers of responsibility cleanly separated. For industries with strict compliance requirements (such as finance and healthcare), this kind of centralized control can significantly reduce "shadow IT" risk, ensuring that all external tools connecting to Claude remain within an auditable scope.

Managed Agents and MCP Tunnel Updates

The Managed Agents feature, aimed at automation scenarios, also received several improvements. The new version adds a refusal stop reason and stop_details field to session idle events, giving developers a more precise way to determine why an agent stopped. Additionally, repository error types have been added to Managed Agents session errors, making error handling more granular.

On the tool execution side, a notable fix is that the session tool runner now stops after any end-turn idle (#969), preventing potential resource leakage.

The MCP (Model Context Protocol) tunnel beta has also been updated — the Tunnel object now includes a read-only transport property, and the create response returns a one-time relay token. These changes provide more complete transport information for MCP-based context connections.

What is MCP? MCP (Model Context Protocol) is an open protocol championed by Anthropic to provide large language models with a standardized way to access external context. Its core idea is to decouple the "model" from "data/tool sources": an MCP Server exposes resources (files, databases, APIs, etc.), and an MCP Client (typically an agent framework or IDE plugin) fetches them on demand — with both sides communicating via a unified JSON-RPC-style protocol. An MCP Tunnel is a relay layer Anthropic provides in managed environments, allowing MCP Servers in local or private networks to be securely exposed to Claude through a cloud tunnel without opening public ports. The newly added transport property and one-time relay token further standardize the tunnel connection setup process, improving both security and auditability.

Security and Stability Fixes

Beyond new features, v1.10.0 also tightens up some security details. On the credentials side, the SDK now rejects configuration files that are writable by "group" or "other" users. This is a classic least-privilege security practice, preventing sensitive configurations from being tampered with by unauthorized users.

Pagination logic has also been fixed: auto-pagination will now continue iterating as long as next_page exists, even when it encounters an empty page — avoiding premature termination caused by intermediate empty pages. The description, metadata, and archived_at fields for memory store entries have also been corrected to required fields, making the data structure more consistent.

What This Means for Developers

Taken together, v1.10.0 is not a simple version bump — it's a concentrated push by Anthropic along two tracks: enterprise readiness and ecosystem expansion. Enterprise analytics, cost controls, RBAC permissions, and a plugin marketplace are capabilities that previously lived in the admin dashboards of mature SaaS platforms; now they're integrated into the official SDK, lowering the bar for teams governing their AI usage.

For individual developers, the pagination fix, credential security hardening, and improved Managed Agents error handling deliver a more robust day-to-day experience. Teams using the Claude Python SDK in production — especially those dealing with multi-member collaboration and cost management — are encouraged to evaluate upgrading.

For the full list of changes, refer to the official Changelog from v1.9.0 to v1.10.0.