[FEATURE] Route AnthropicModel through the Amazon Bedrock Mantle endpoint

[moritalous]

SDK Language

Python

Problem Statement

Amazon Bedrock serves Claude models through the Anthropic Messages API on the bedrock-mantle endpoint (https://bedrock-mantle.{region}.api.aws/anthropic), billing through the caller's AWS account rather than an Anthropic API key. AnthropicModel has no configuration for it.

You can get partway there today by hand-building the endpoint in client_args:

AnthropicModel(
    model_id="anthropic.claude-sonnet-5",
    max_tokens=1028,
    client_args={
        "api_key": "<BEDROCK_API_KEY>",
        "base_url": "https://bedrock-mantle.us-east-1.api.aws/anthropic",
    },
)

That reaches the endpoint, but it authenticates only with a static API key string. Bedrock signs requests with SigV4 from the standard AWS credential chain, which is what makes instance roles, SSO sessions, and assumed roles usable. There is no way to select that path through AnthropicModel: client_args is forwarded to anthropic.AsyncAnthropic, and the SigV4-capable client is a different class (anthropic.AsyncAnthropicBedrockMantle, added in anthropic 0.91.0). The provider does not accept a pre-built client either, so the class cannot be swapped from outside.

OpenAIModel and OpenAIResponsesModel already expose bedrock_mantle_config for the OpenAI-compatible side of the same endpoint. The Anthropic-compatible side has no equivalent.

Proposed Solution

Add a bedrock_mantle_config option to AnthropicModel, matching the name and shape the OpenAI providers already use:

AnthropicModel(
    model_id="anthropic.claude-sonnet-5",
    max_tokens=1028,
    bedrock_mantle_config={"region": "us-east-1"},
)

When set, the provider builds anthropic.AsyncAnthropicBedrockMantle instead of the direct client. That client derives the base URL from the region, sends the required anthropic-version header, and signs every request with SigV4, so the SDK never has to mint or refresh a bearer token. The config accepts region, profile, and api_key; supplying none of them falls back to the standard AWS credential chain.

Since the region is interpolated into the endpoint URL, it should go through the same validate_region() guard the OpenAI path already uses.

Use Case

• Running Claude models against an AWS account's existing Bedrock spend and quotas instead of a separate Anthropic API key.
• Agents on EC2/ECS/Lambda authenticating with the instance or task role, with no long-lived credential to distribute or rotate.
• Local development against an SSO profile.
• Deployments that need in-region inference for data residency.

Alternatives Solutions

• Document the client_args base URL workaround instead of adding config. No code change, but it stays static-API-key-only and asks every user to assemble the endpoint URL by hand.
• Accept a pre-built client on AnthropicModel. More general, but a larger API change than this needs, and it pushes the region, base URL, and version-header details onto every caller.

Additional Context

Endpoint reference: https://docs.aws.amazon.com/bedrock/latest/userguide/inference-messages-api.html

The Mantle catalog uses anthropic.-prefixed model IDs that differ from the direct API (anthropic.claude-sonnet-5, anthropic.claude-opus-4-8, anthropic.claude-haiku-4-5, and others), and the available set varies by region.

TypeScript needs the same option, tracked separately as a port.