Initial Claude Agent Setup and Tool Definition

Set up a basic Claude agent using the Claude Agents SDK. Define two simple tools: `get_instance_metadata(instance_id: str)` returning instance tags and `threat_intel_lookup(hash: str)` returning known threats. Configure the agent to use Claude Opus 4.1. Write a test case where the agent receives a high CPU alert and needs to use these tools to gather context.

```python
# agent_main.py
from anthropic import Anthropic
from anthropic_agents import Agent, tool

anthropic_client = Anthropic()

@tool
def get_instance_metadata(instance_id: str) -> str:
    """Gets metadata like tags for a given cloud instance ID."""
    # Simulate API call
    if instance_id == "i-abcdefg123":
        return "tags: prod, web-server"
    return "No metadata found."

@tool
def threat_intel_lookup(hash: str) -> str:
    """Looks up a file hash in threat intelligence databases."""
    # Simulate API call
    if hash == "malicious_process.sh_hash":
        return "Known cryptocurrency miner identified."
    return "No threat found for this hash."

agent = Agent(
    client=anthropic_client,
    model="claude-3-opus-20240229", # Or newer model if available
    tools=[get_instance_metadata, threat_intel_lookup],
    system_prompt="You are a cloud security analyst. Analyze alerts, use tools, and provide classification and remediation."
)

async def run_triage(alert: str):
    response = await agent.run(alert)
    print(response.content)

# Example usage:
# asyncio.run(run_triage("High CPU alert on instance i-abcdefg123. Suspicious process 'malicious_process.sh' detected."))
```