Merge pull request #43662 from BerriAI/litellm_backport_safeguards_stable_1_103_x

fix(anthropic): backport #42152 and #42288 to stable/1.103.x

litellm/anthropic_beta_headers_config.json

@@ -11,6 +11,7 @@
     "computer-use-2025-11-24": "computer-use-2025-11-24",
     "context-1m-2025-08-07": "context-1m-2025-08-07",
     "context-management-2025-06-27": "context-management-2025-06-27",
+    "dangerous-tool-use-2026-09-03": "dangerous-tool-use-2026-09-03",
     "effort-2025-11-24": "effort-2025-11-24",
     "fast-mode-2026-02-01": "fast-mode-2026-02-01",
     "files-api-2025-04-14": "files-api-2025-04-14",
@@ -44,6 +45,7 @@
     "computer-use-2025-11-24": "computer-use-2025-11-24",
     "context-1m-2025-08-07": "context-1m-2025-08-07",
     "context-management-2025-06-27": "context-management-2025-06-27",
+    "dangerous-tool-use-2026-09-03": "dangerous-tool-use-2026-09-03",
     "effort-2025-11-24": "effort-2025-11-24",
     "fast-mode-2026-02-01": null,
     "files-api-2025-04-14": "files-api-2025-04-14",
@@ -76,6 +78,7 @@
     "computer-use-2025-11-24": "computer-use-2025-11-24",
     "context-1m-2025-08-07": "context-1m-2025-08-07",
     "context-management-2025-06-27": null,
+    "dangerous-tool-use-2026-09-03": null,
     "effort-2025-11-24": "effort-2025-11-24",
     "fast-mode-2026-02-01": null,
     "files-api-2025-04-14": null,
@@ -109,6 +112,7 @@
     "computer-use-2025-11-24": "computer-use-2025-11-24",
     "context-1m-2025-08-07": "context-1m-2025-08-07",
     "context-management-2025-06-27": "context-management-2025-06-27",
+    "dangerous-tool-use-2026-09-03": "dangerous-tool-use-2026-09-03",
     "effort-2025-11-24": "effort-2025-11-24",
     "fast-mode-2026-02-01": null,
     "files-api-2025-04-14": null,
@@ -142,6 +146,7 @@
     "computer-use-2025-11-24": "computer-use-2025-11-24",
     "context-1m-2025-08-07": "context-1m-2025-08-07",
     "context-management-2025-06-27": "context-management-2025-06-27",
+    "dangerous-tool-use-2026-09-03": "dangerous-tool-use-2026-09-03",
     "effort-2025-11-24": null,
     "fast-mode-2026-02-01": null,
     "files-api-2025-04-14": null,
@@ -175,6 +180,7 @@
     "computer-use-2025-11-24": "computer-use-2025-11-24",
     "context-1m-2025-08-07": "context-1m-2025-08-07",
     "context-management-2025-06-27": "context-management-2025-06-27",
+    "dangerous-tool-use-2026-09-03": null,
     "effort-2025-11-24": "effort-2025-11-24",
     "fast-mode-2026-02-01": "fast-mode-2026-02-01",
     "files-api-2025-04-14": "files-api-2025-04-14",

litellm/llms/anthropic/experimental_pass_through/adapters/handler.py

@@ -35,7 +35,7 @@ if TYPE_CHECKING:
     from litellm.router import Router
 
 # Anthropic-only keys already mapped by the translator; strip on extra_kwargs re-merge.
-ANTHROPIC_ONLY_REQUEST_KEYS: Final[frozenset[str]] = frozenset({"output_config"})
+ANTHROPIC_ONLY_REQUEST_KEYS: Final[frozenset[str]] = frozenset({"output_config", "safeguards"})
 
 _AnthropicMessages: TypeAlias = "list[dict[str, object]]"
 _AnthropicSystem: TypeAlias = "str | list[dict[str, object]] | None"

litellm/llms/anthropic/experimental_pass_through/messages/transformation.py

@@ -79,10 +79,14 @@ class AnthropicMessagesConfig(BaseAnthropicMessagesConfig):
             "speed",
             "output_config",
             "reasoning_effort",
+            "safeguards",
             # TODO: Add Anthropic `metadata` support
             # "metadata",
         ]
 
+    def should_filter_anthropic_beta_headers(self) -> bool:
+        return self._resolved_provider != "anthropic"
+
     def _remove_scope_from_cache_control(self, anthropic_messages_request: dict) -> None:
         """
         Remove `scope` field from cache_control blocks.

litellm/llms/azure_ai/anthropic/messages_transformation.py

@@ -2,14 +2,18 @@
 Azure Anthropic messages transformation config - extends AnthropicMessagesConfig with Azure authentication
 """
 
+from collections.abc import Mapping
 from typing import Any, Final
 
 from litellm.llms.anthropic.experimental_pass_through.messages.transformation import (
     AnthropicMessagesConfig,
 )
 from litellm.llms.azure.common_utils import BaseAzureLLM
+from litellm.types.llms.anthropic import ANTHROPIC_BETA_HEADER_VALUES
 from litellm.types.router import GenericLiteLLMParams
 
+DANGEROUS_TOOL_USE_BETA: Final = ANTHROPIC_BETA_HEADER_VALUES.DANGEROUS_TOOL_USE_2026_09_03.value
+
 
 class AzureAnthropicMessagesConfig(AnthropicMessagesConfig):
     """
@@ -71,7 +75,7 @@ class AzureAnthropicMessagesConfig(AnthropicMessagesConfig):
             messages=messages,
         )
 
-        return headers, api_base
+        return _with_dangerous_tool_use_beta_for_safeguards(headers, optional_params), api_base
 
     def get_complete_url(
         self,
@@ -164,3 +168,14 @@ class AzureAnthropicMessagesConfig(AnthropicMessagesConfig):
         self._normalize_system_role_messages(anthropic_messages_request, model=model)
         self._remove_scope_from_cache_control(anthropic_messages_request)
         return anthropic_messages_request
+
+
+def _with_dangerous_tool_use_beta_for_safeguards(
+    headers: Mapping[str, str], optional_params: Mapping[str, object]
+) -> dict[str, str]:
+    if optional_params.get("safeguards") is None:
+        return dict(headers)
+    existing: Final = ",".join(value for key, value in headers.items() if key.lower() == "anthropic-beta")
+    betas: Final = {piece.strip() for piece in existing.split(",") if piece.strip()}
+    others: Final = {key: value for key, value in headers.items() if key.lower() != "anthropic-beta"}
+    return {**others, "anthropic-beta": ",".join(sorted(betas | {DANGEROUS_TOOL_USE_BETA}))}

litellm/llms/bedrock/messages/invoke_transformations/anthropic_claude3_transformation.py

@@ -530,6 +530,9 @@ class AmazonAnthropicClaudeMessagesConfig(
         if anthropic_model_info.is_eager_input_streaming_used(tools):
             beta_set.add(ANTHROPIC_FINE_GRAINED_TOOL_STREAMING_BETA_HEADER)
 
+        if anthropic_messages_optional_request_params.get("safeguards") is not None:
+            beta_set.add(ANTHROPIC_BETA_HEADER_VALUES.DANGEROUS_TOOL_USE_2026_09_03.value)
+
         self._filter_context_management_for_bedrock_invoke(
             anthropic_messages_request=anthropic_messages_request,
             beta_set=beta_set,

litellm/llms/vertex_ai/vertex_ai_partner_models/anthropic/experimental_pass_through/transformation.py

@@ -108,6 +108,9 @@ class VertexAIPartnerModelsAnthropicMessagesConfig(AnthropicMessagesConfig, Vert
         if anthropic_model_info.is_tool_search_used(tools):
             beta_values.add(get_tool_search_beta_header("vertex_ai"))
 
+        if optional_params.get("safeguards") is not None:
+            beta_values.add(ANTHROPIC_BETA_HEADER_VALUES.DANGEROUS_TOOL_USE_2026_09_03.value)
+
         if beta_values:
             headers["anthropic-beta"] = ",".join(beta_values)
 

litellm/types/llms/anthropic.py

@@ -411,6 +411,7 @@ class AnthropicMessagesRequestOptionalParams(TypedDict, total=False):
     output_config: AnthropicOutputConfig | None  # Configuration for Claude's output behavior
     cache_control: dict[str, Any] | None  # Automatic prompt caching
     reasoning_effort: str | None
+    safeguards: ReadOnly[list[dict[str, object]] | None]
 
 
 class AnthropicMessagesRequest(AnthropicMessagesRequestOptionalParams, total=False):
@@ -530,6 +531,7 @@ class AnthropicStopDetails(TypedDict, total=False):
 class MessageDelta(TypedDict, total=False):
     stop_reason: str | None
     stop_details: ReadOnly[AnthropicStopDetails]
+    safeguard_results: ReadOnly[list[dict[str, object]]]
 
 
 class ServerToolUsage(TypedDict, total=False):
@@ -600,6 +602,7 @@ class MessageChunk(TypedDict, total=False):
     stop_reason: str | None
     stop_sequence: str | None
     usage: UsageDelta
+    safeguard_results: ReadOnly[list[dict[str, object]]]
 
 
 class MessageStartBlock(TypedDict):
@@ -748,6 +751,7 @@ class ANTHROPIC_BETA_HEADER_VALUES(str, Enum):
     FAST_MODE_2026_02_01 = "fast-mode-2026-02-01"
     ADVISOR_TOOL_2026_03_01 = "advisor-tool-2026-03-01"
     PER_TURN_CONTROL_2026_07_01 = "per-turn-control-2026-07-01"
+    DANGEROUS_TOOL_USE_2026_09_03 = "dangerous-tool-use-2026-09-03"
 
 
 # Tool search beta header constant (for Anthropic direct API and Microsoft Foundry)

litellm/types/llms/anthropic_messages/anthropic_response.py

@@ -97,3 +97,4 @@ class AnthropicMessagesResponse(TypedDict, total=False):
     type: Literal["message"] | None
     usage: AnthropicUsage | None
     context_management: NotRequired[ContextManagementResponse]
+    safeguard_results: NotRequired[ReadOnly[list[dict[str, object]]]]

litellm/types/llms/bedrock.py

@@ -1236,6 +1236,7 @@ class BedrockInvokeAnthropicMessagesRequest(TypedDict, total=False):
     thinking: dict
     metadata: dict
     output_config: dict
+    safeguards: list
 
     # `context_management` is allowed for Bedrock InvokeModel only when it
     # carries `compact_20260112` edits paired with the `compact-2026-01-12`

tests/test_litellm/llms/anthropic/experimental_pass_through/adapters/test_handler_output_config_passthrough.py

@@ -110,6 +110,19 @@ class TestOutputConfigStrippedFromCompletionKwargs:
             "reject it with 400 'Extra inputs are not permitted'"
         )
 
+    def test_safeguards_is_stripped_for_non_anthropic_target(self):
+        extra_kwargs = {
+            "custom_llm_provider": "azure",
+            "safeguards": [{"type": "dangerous_tool_use", "classifier_context": {"v": 1}}],
+        }
+
+        result = _call_prepare(extra_kwargs=extra_kwargs)
+
+        completion_kwargs = result[0] if isinstance(result, tuple) else result
+        assert "safeguards" not in completion_kwargs, (
+            "safeguards is an Anthropic-only field; OpenAI-format backends reject it with 400"
+        )
+
     def test_output_config_format_translated_to_response_format(self):
         """When ``output_config`` carries structured-output ``format``, the
         translator now maps it to OpenAI's ``response_format`` so non-Anthropic

tests/test_litellm/llms/anthropic/experimental_pass_through/messages/test_anthropic_experimental_pass_through_messages_handler.py

@@ -2,7 +2,7 @@ import asyncio
 import json
 import os
 import uuid
-from typing import Any, Dict, List
+from typing import Any, Dict, Final, List
 
 import httpx
 import pytest
@@ -1438,3 +1438,263 @@ async def test_anthropic_messages_leaves_non_provider_failures_unmapped():
         )
 
     assert "Traceback" not in str(excinfo.value)
+
+
+@pytest.mark.asyncio
+async def test_anthropic_messages_forwards_safeguards_and_unknown_beta_to_anthropic():
+    """Shapes are what Claude Code 2.1.278 sends and api.anthropic.com returns, captured 2026-09-21."""
+    from litellm.llms.anthropic.experimental_pass_through.messages import handler
+
+    safeguards = [{"type": "dangerous_tool_use", "classifier_context": {"v": 1, "permission_mode": "auto"}}]
+    client_betas = "dangerous-tool-use-2026-09-03,interleaved-thinking-2025-05-14"
+    safeguard_results = [{"type": "dangerous_tool_use", "status": {"type": "available", "tool_uses": {}}}]
+    captured: dict[str, object] = {}
+
+    def upstream_records_the_request(request: httpx.Request) -> httpx.Response:
+        captured["body"] = json.loads(request.content)
+        captured["anthropic-beta"] = request.headers.get("anthropic-beta")
+        return httpx.Response(
+            200,
+            json={
+                "id": "msg_1",
+                "type": "message",
+                "role": "assistant",
+                "model": "claude-haiku-4-5",
+                "content": [{"type": "text", "text": "ok"}],
+                "stop_reason": "end_turn",
+                "stop_sequence": None,
+                "usage": {"input_tokens": 1, "output_tokens": 1},
+                "safeguard_results": safeguard_results,
+            },
+            request=request,
+        )
+
+    upstream = AsyncHTTPHandler()
+    upstream.client = httpx.AsyncClient(transport=httpx.MockTransport(upstream_records_the_request))
+
+    response = await handler.anthropic_messages(
+        max_tokens=16,
+        messages=[{"role": "user", "content": "hi"}],
+        model="anthropic/claude-haiku-4-5",
+        custom_llm_provider="anthropic",
+        api_key="sk-test",
+        client=upstream,
+        safeguards=safeguards,
+        extra_headers={"anthropic-beta": client_betas},
+    )
+
+    assert captured["body"]["safeguards"] == safeguards
+    assert set(captured["anthropic-beta"].split(",")) == set(client_betas.split(","))
+    assert response["safeguard_results"] == safeguard_results
+
+
+@pytest.mark.asyncio
+async def test_anthropic_messages_streaming_forwards_safeguards_and_keeps_safeguard_results():
+    """Shapes are what Claude Code 2.1.278 sends and api.anthropic.com returns, captured 2026-09-21."""
+    from litellm.llms.anthropic.experimental_pass_through.messages import handler
+
+    safeguards = [{"type": "dangerous_tool_use", "classifier_context": {"v": 1, "permission_mode": "auto"}}]
+    tool_verdicts = {"toolu_01": {"type": "evaluated", "outcome": "not_flagged"}}
+    safeguard_results = [{"type": "dangerous_tool_use", "status": {"type": "available", "tool_uses": tool_verdicts}}]
+    captured: dict[str, object] = {}
+    message_start = {
+        "type": "message_start",
+        "message": {
+            "id": "msg_1",
+            "type": "message",
+            "role": "assistant",
+            "model": "claude-haiku-4-5",
+            "content": [],
+            "stop_reason": None,
+            "stop_sequence": None,
+            "usage": {"input_tokens": 1, "output_tokens": 0},
+            "safeguard_results": safeguard_results,
+        },
+    }
+    message_delta = {
+        "type": "message_delta",
+        "delta": {"stop_reason": "end_turn", "stop_sequence": None, "safeguard_results": safeguard_results},
+        "usage": {"output_tokens": 1},
+    }
+    sse = "".join(
+        f"event: {event['type']}\ndata: {json.dumps(event)}\n\n"
+        for event in (message_start, message_delta, {"type": "message_stop"})
+    )
+
+    def upstream_streams_safeguard_results(request: httpx.Request) -> httpx.Response:
+        captured["body"] = json.loads(request.content)
+        return httpx.Response(200, headers={"content-type": "text/event-stream"}, content=sse.encode(), request=request)
+
+    upstream = AsyncHTTPHandler()
+    upstream.client = httpx.AsyncClient(transport=httpx.MockTransport(upstream_streams_safeguard_results))
+
+    stream = await handler.anthropic_messages(
+        max_tokens=16,
+        messages=[{"role": "user", "content": "hi"}],
+        model="anthropic/claude-haiku-4-5",
+        custom_llm_provider="anthropic",
+        api_key="sk-test",
+        client=upstream,
+        stream=True,
+        safeguards=safeguards,
+    )
+    raw = b"".join([chunk async for chunk in stream]).decode()
+    events = [json.loads(line[len("data: ") :]) for line in raw.splitlines() if line.startswith("data: ")]
+
+    assert captured["body"]["safeguards"] == safeguards
+    assert events[0]["message"]["safeguard_results"] == safeguard_results
+    assert [e for e in events if e["type"] == "message_delta"][0]["delta"]["safeguard_results"] == safeguard_results
+
+
+def _claude_code_auto_mode_request() -> tuple[list[dict[str, object]], list[dict[str, object]]]:
+    """Shapes are what Claude Code 2.1.278 sends and Bedrock Invoke / Vertex rawPredict return, captured 2026-09-21."""
+    safeguards = [{"type": "dangerous_tool_use", "classifier_context": {"v": 1, "permission_mode": "auto"}}]
+    tool_verdicts = {"toolu_01": {"type": "evaluated", "outcome": "not_flagged"}}
+    safeguard_results = [{"type": "dangerous_tool_use", "status": {"type": "available", "tool_uses": tool_verdicts}}]
+    return safeguards, safeguard_results
+
+
+def _upstream_answering_with(safeguard_results: list[dict[str, object]], captured: dict[str, object]) -> AsyncHTTPHandler:
+    def upstream_records_the_request(request: httpx.Request) -> httpx.Response:
+        captured["body"] = json.loads(request.content)
+        captured["anthropic-beta"] = request.headers.get("anthropic-beta")
+        return httpx.Response(
+            200,
+            json={
+                "id": "msg_1",
+                "type": "message",
+                "role": "assistant",
+                "model": "claude-sonnet-5",
+                "content": [{"type": "text", "text": "ok"}],
+                "stop_reason": "end_turn",
+                "stop_sequence": None,
+                "usage": {"input_tokens": 1, "output_tokens": 1},
+                "safeguard_results": safeguard_results,
+            },
+            request=request,
+        )
+
+    upstream = AsyncHTTPHandler()
+    upstream.client = httpx.AsyncClient(transport=httpx.MockTransport(upstream_records_the_request))
+    return upstream
+
+
+_CLIENT_BETA_HEADERS: Final = (
+    pytest.param({"anthropic-beta": "dangerous-tool-use-2026-09-03,interleaved-thinking-2025-05-14"}, id="client_sends_beta"),
+    pytest.param({"anthropic-beta": "interleaved-thinking-2025-05-14"}, id="client_omits_beta"),
+    pytest.param({}, id="client_sends_no_beta_header"),
+)
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("client_headers", _CLIENT_BETA_HEADERS)
+async def test_anthropic_messages_forwards_safeguards_and_dangerous_tool_use_beta_to_bedrock_invoke(
+    local_beta_headers_config, client_headers
+):
+    """Bedrock Invoke takes betas in the body's `anthropic_beta` and 400s on `safeguards` without the beta, so the beta rides along with the field."""
+    from litellm.llms.anthropic.experimental_pass_through.messages import handler
+
+    safeguards, safeguard_results = _claude_code_auto_mode_request()
+    captured: dict[str, object] = {}
+
+    response = await handler.anthropic_messages(
+        max_tokens=16,
+        messages=[{"role": "user", "content": "hi"}],
+        model="bedrock/us.anthropic.claude-sonnet-5",
+        custom_llm_provider="bedrock",
+        aws_access_key_id="test-access-key",
+        aws_secret_access_key="test-secret-key",
+        aws_region_name="us-east-1",
+        client=_upstream_answering_with(safeguard_results, captured),
+        safeguards=safeguards,
+        extra_headers=client_headers,
+    )
+
+    assert captured["body"]["safeguards"] == safeguards
+    assert captured["body"]["anthropic_beta"] == ["dangerous-tool-use-2026-09-03"]
+    assert response["safeguard_results"] == safeguard_results
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("client_headers", _CLIENT_BETA_HEADERS)
+async def test_anthropic_messages_forwards_safeguards_and_dangerous_tool_use_beta_to_vertex(
+    local_beta_headers_config, client_headers
+):
+    """Vertex rawPredict takes the beta as the `anthropic-beta` header and 400s on `safeguards` without it, so the beta rides along with the field."""
+    from litellm.llms.anthropic.experimental_pass_through.messages import handler
+    from litellm.llms.vertex_ai.vertex_llm_base import VertexBase
+
+    safeguards, safeguard_results = _claude_code_auto_mode_request()
+    captured: dict[str, object] = {}
+
+    with patch.object(  # test-quality-ok: the GCP token exchange runs before the faked HTTP boundary
+        VertexBase, "_ensure_access_token", return_value=("test-token", "test-project")
+    ):
+        response = await handler.anthropic_messages(
+            max_tokens=16,
+            messages=[{"role": "user", "content": "hi"}],
+            model="vertex_ai/claude-sonnet-5",
+            custom_llm_provider="vertex_ai",
+            vertex_project="test-project",
+            vertex_location="global",
+            vertex_credentials="{}",
+            client=_upstream_answering_with(safeguard_results, captured),
+            safeguards=safeguards,
+            extra_headers=client_headers,
+        )
+
+    assert captured["body"]["safeguards"] == safeguards
+    assert "anthropic_beta" not in captured["body"]
+    assert captured["anthropic-beta"].split(",").count("dangerous-tool-use-2026-09-03") == 1
+    assert response["safeguard_results"] == safeguard_results
+
+
+@pytest.mark.asyncio
+@pytest.mark.parametrize("client_headers", _CLIENT_BETA_HEADERS)
+async def test_anthropic_messages_forwards_safeguards_and_dangerous_tool_use_beta_to_azure_ai_foundry(
+    local_beta_headers_config, client_headers
+):
+    """Foundry 400s on `safeguards` without the beta, and the proxy never forwards client betas to azure_ai, so the beta rides along with the field."""
+    from litellm.llms.anthropic.experimental_pass_through.messages import handler
+
+    safeguards, safeguard_results = _claude_code_auto_mode_request()
+    captured: dict[str, object] = {}
+
+    response = await handler.anthropic_messages(
+        max_tokens=16,
+        messages=[{"role": "user", "content": "hi"}],
+        model="azure_ai/claude-sonnet-5",
+        custom_llm_provider="azure_ai",
+        api_key="test-key",
+        api_base="https://test.services.ai.azure.com/anthropic",
+        client=_upstream_answering_with(safeguard_results, captured),
+        safeguards=safeguards,
+        extra_headers=client_headers,
+    )
+
+    assert captured["body"]["safeguards"] == safeguards
+    assert captured["anthropic-beta"].split(",").count("dangerous-tool-use-2026-09-03") == 1
+    assert response["safeguard_results"] == safeguard_results
+
+
+@pytest.mark.asyncio
+async def test_anthropic_messages_adds_no_dangerous_tool_use_beta_to_azure_ai_foundry_without_safeguards(
+    local_beta_headers_config,
+):
+    from litellm.llms.anthropic.experimental_pass_through.messages import handler
+
+    captured: dict[str, object] = {}
+
+    await handler.anthropic_messages(
+        max_tokens=16,
+        messages=[{"role": "user", "content": "hi"}],
+        model="azure_ai/claude-sonnet-5",
+        custom_llm_provider="azure_ai",
+        api_key="test-key",
+        api_base="https://test.services.ai.azure.com/anthropic",
+        client=_upstream_answering_with([], captured),
+        extra_headers={"anthropic-beta": "interleaved-thinking-2025-05-14"},
+    )
+
+    assert "safeguards" not in captured["body"]
+    assert "dangerous-tool-use-2026-09-03" not in (captured["anthropic-beta"] or "").split(",")

tests/test_litellm/llms/bedrock/messages/invoke_transformations/test_anthropic_claude3_transformation.py

@@ -1656,6 +1656,92 @@ def test_bedrock_messages_allowlist_filters_anthropic_only_fields():
     assert set(result).issubset(cfg.BEDROCK_INVOKE_ALLOWED_TOP_LEVEL_FIELDS)
 
 
+@pytest.mark.parametrize(
+    "client_beta_header",
+    ["dangerous-tool-use-2026-09-03,interleaved-thinking-2025-05-14", "interleaved-thinking-2025-05-14"],
+    ids=["client_sends_beta", "client_omits_beta"],
+)
+def test_bedrock_messages_forwards_safeguards_with_dangerous_tool_use_beta(local_beta_headers_config, client_beta_header):
+    """
+    Claude Code's server-side auto-mode classifier sends `safeguards` alongside the
+    dangerous-tool-use-2026-09-03 beta. Bedrock Invoke accepts the pair, answers
+    "safeguards: Extra inputs are not permitted" for the field alone, and returns
+    `safeguard_results: []` for the beta alone, so the field reaches it unchanged
+    and the beta rides along whether or not the client sent it, as every other
+    body-driven beta does here.
+    """
+    from litellm.types.router import GenericLiteLLMParams
+
+    cfg = AmazonAnthropicClaudeMessagesConfig()
+    safeguards = [{"type": "dangerous_tool_use", "classifier_context": {"v": 1, "permission_mode": "auto"}}]
+
+    result = cfg.transform_anthropic_messages_request(
+        model="us.anthropic.claude-sonnet-5",
+        messages=[{"role": "user", "content": [{"type": "text", "text": "Hello"}]}],
+        anthropic_messages_optional_request_params={"max_tokens": 64, "safeguards": safeguards},
+        litellm_params=GenericLiteLLMParams(),
+        headers={"anthropic-beta": client_beta_header},
+    )
+
+    assert result["safeguards"] == safeguards
+    assert result["anthropic_beta"].count("dangerous-tool-use-2026-09-03") == 1
+
+
+def test_bedrock_messages_does_not_add_dangerous_tool_use_beta_without_safeguards(local_beta_headers_config):
+    from litellm.types.router import GenericLiteLLMParams
+
+    cfg = AmazonAnthropicClaudeMessagesConfig()
+
+    result = cfg.transform_anthropic_messages_request(
+        model="us.anthropic.claude-sonnet-5",
+        messages=[{"role": "user", "content": [{"type": "text", "text": "Hello"}]}],
+        anthropic_messages_optional_request_params={"max_tokens": 64},
+        litellm_params=GenericLiteLLMParams(),
+        headers={},
+    )
+
+    assert "safeguards" not in result
+    assert "dangerous-tool-use-2026-09-03" not in result.get("anthropic_beta", [])
+
+
+def test_bedrock_messages_stream_decoder_keeps_safeguard_results():
+    """Bedrock streams the classifier verdicts on message_start and on the final message_delta, exactly as api.anthropic.com does."""
+    decoder = AmazonAnthropicClaudeMessagesStreamDecoder(model="us.anthropic.claude-sonnet-5")
+    tool_verdicts = {"toolu_01": {"type": "evaluated", "outcome": "not_flagged"}}
+    safeguard_results = [{"type": "dangerous_tool_use", "status": {"type": "available", "tool_uses": tool_verdicts}}]
+
+    message_start = decoder._chunk_parser(
+        {
+            "type": "message_start",
+            "message": {
+                "id": "msg_01",
+                "type": "message",
+                "role": "assistant",
+                "model": "claude-sonnet-5",
+                "content": [],
+                "stop_reason": None,
+                "usage": {"input_tokens": 3, "output_tokens": 0},
+                "safeguard_results": safeguard_results,
+            },
+        }
+    )
+
+    assert isinstance(message_start, dict)
+    assert message_start["message"]["safeguard_results"] == safeguard_results
+
+    message_delta = decoder._chunk_parser(
+        {
+            "type": "message_delta",
+            "delta": {"stop_reason": "end_turn", "stop_sequence": None, "safeguard_results": safeguard_results},
+            "usage": {"output_tokens": 1},
+            "amazon-bedrock-invocationMetrics": {"inputTokenCount": 3, "outputTokenCount": 1},
+        }
+    )
+
+    assert isinstance(message_delta, dict)
+    assert message_delta["delta"]["safeguard_results"] == safeguard_results
+
+
 def test_bedrock_messages_filters_user_provided_unsupported_beta_header():
     """
     In proxy deployments the client (e.g. Claude Code) doesn't know the backend

tests/test_litellm/llms/vertex_ai/vertex_ai_partner_models/anthropic/test_vertex_ai_partner_models_anthropic_messages_config.py

@@ -3,6 +3,8 @@ import json
 import os
 from unittest.mock import MagicMock, patch
 
+import pytest
+
 from litellm.llms.vertex_ai.vertex_ai_partner_models.anthropic.experimental_pass_through.transformation import (
     VertexAIPartnerModelsAnthropicMessagesConfig,
 )
@@ -67,6 +69,63 @@ def test_web_search_header_added_for_messages_endpoint():
         )
 
 
+@pytest.mark.parametrize(
+    "client_headers",
+    [{"anthropic-beta": "dangerous-tool-use-2026-09-03"}, {}],
+    ids=["client_sends_beta", "client_omits_beta"],
+)
+def test_safeguards_add_dangerous_tool_use_beta_header(client_headers):
+    """Vertex rejects `safeguards` without the dangerous-tool-use beta, so the beta rides along with the field the way the web search and context management betas do."""
+    config = VertexAIPartnerModelsAnthropicMessagesConfig()
+    litellm_params = {
+        "vertex_ai_project": "test-project",
+        "vertex_ai_location": "global",
+        "vertex_credentials": "{}",
+    }
+    optional_params = {
+        "safeguards": [{"type": "dangerous_tool_use", "classifier_context": {"v": 1, "permission_mode": "auto"}}]
+    }
+
+    with (
+        patch.object(config, "_ensure_access_token", return_value=("token", "test-project")),
+        patch.object(config, "get_complete_vertex_url", return_value="https://mock-url"),
+    ):
+        updated_headers, _ = config.validate_anthropic_messages_environment(
+            headers=client_headers,
+            model="claude-sonnet-5",
+            messages=[],
+            optional_params=optional_params,
+            litellm_params=litellm_params,
+            api_base=None,
+        )
+
+    assert updated_headers["anthropic-beta"].split(",").count("dangerous-tool-use-2026-09-03") == 1
+
+
+def test_no_safeguards_leaves_dangerous_tool_use_beta_header_out():
+    config = VertexAIPartnerModelsAnthropicMessagesConfig()
+    litellm_params = {
+        "vertex_ai_project": "test-project",
+        "vertex_ai_location": "global",
+        "vertex_credentials": "{}",
+    }
+
+    with (
+        patch.object(config, "_ensure_access_token", return_value=("token", "test-project")),
+        patch.object(config, "get_complete_vertex_url", return_value="https://mock-url"),
+    ):
+        updated_headers, _ = config.validate_anthropic_messages_environment(
+            headers={},
+            model="claude-sonnet-5",
+            messages=[],
+            optional_params={"max_tokens": 64},
+            litellm_params=litellm_params,
+            api_base=None,
+        )
+
+    assert "dangerous-tool-use-2026-09-03" not in updated_headers.get("anthropic-beta", "")
+
+
 def test_web_search_header_not_added_without_tool():
     """Test that beta header is NOT added when web search tool is not present"""
     config = VertexAIPartnerModelsAnthropicMessagesConfig()

tests/test_litellm/test_anthropic_beta_headers_filtering.py

@@ -442,6 +442,20 @@ class TestAnthropicBetaHeadersFiltering:
 
         assert filtered == ["thinking-binding-controls-2026-08-01"]
 
+    @pytest.mark.parametrize("provider", ["anthropic", "azure_ai", "bedrock", "vertex_ai"])
+    def test_dangerous_tool_use_forwarded(self, provider):
+        """Claude Code's server-side auto-mode classifier sends `safeguards` together with
+        dangerous-tool-use-2026-09-03. Bedrock Invoke, Bedrock Mantle, and Vertex rawPredict
+        all answer "safeguards: Extra inputs are not permitted" when the body field arrives
+        without the beta (probed 2026-09-21), so dropping the header turned every auto-mode
+        turn into a 400 on Vertex and silently disabled the classifier on Bedrock."""
+        filtered = filter_and_transform_beta_headers(
+            beta_headers=["dangerous-tool-use-2026-09-03"],
+            provider=provider,
+        )
+
+        assert filtered == ["dangerous-tool-use-2026-09-03"]
+
     def test_null_value_headers_filtered(self):
         """Test that headers with null values are always filtered out."""
         for provider in [