Is there any other way to do it though? Even if they implemented some form of auth logic, since it's all client side anyone could spoof it. The only real way to distinguish Claude Code from non-Claude Code is behavioral analysis (e.g. system prompt, set of tools, etc.). Or engage in a cat and mouse game of increasingly obfuscated challenge/auth.
Or call the tool "Read" and it works, according to an issue comment.
But actually the solution is checking out how the official client does it and then doing the same steps, though if people start doing this then Anthropic will probably start making it more difficult to monitor and reverse engineer.
It might not matter, as some people have a lot of expertice in this, but people might still get the message and move away to alternatives.
Then they'd start pinning certs and hiding keys inside the obfuscated binary to make traffic inspection harder?
And if an open source tool would start to use those keys, their CI could just detect this automatically and change the keys and the obfuscation method. Probably quite doable with LLMs..