The System Prompt

Before rappelling into the depths of application code, it is beneficial to provide Claude Code with contextual information for the target application and guidance on what we want to see in a response. This will result in fewer false positives and more useful responses compared to just telling Claude to “Find vulns in this app plz”. A system prompt is the perfect place to supply this. When working with an LLM, the client application maintains a rolling, limited “memory” of your conversation, called a context window, which is used during subsequent inference (i. e.

, generating a response). In practice, the model doesn’t have its own memory. The entirety of this context window is transparently sent with each subsequent prompt to the model. The size of the context window varies by model, so it is important to understand that the LLM will not know any of the dropped information purged from the context window. Fortunately, the context windows used and available capacity are sometimes surfaced to us users in GUI and CLI tools.

Companies are also starting to leverage long-term memories that persist outside of the context window to improve continuity, which you will see an example of below. The system prompt is typically present in every prompt as a guiding prefix in the model’s context window. I like to provide pertinent application and code base information to the model via the system prompt, such as: The persona (i. e. , role) that the model is to operate as Response content, structure, and formatting expectations A description of the application that includes the name, type of application, purpose, data storage in use, and a definition of its authorization model Application URL, language, frameworks A link to or attachment of the API spec The full folder paths for different app components (e.

g. , frontend, router, controllers, views, daemons) Below is the system prompt that I use.