Claude agents for contract review: extracting terms, flagging risks, and automating analysis

By the end of this tutorial, you’ll have a working Claude contract review agent that parses PDF contracts, extracts key terms, flags risky clauses, and generates structured summaries — running as a multi-stage pipeline you can drop into any document workflow. This isn’t a toy demo: it’s the same architecture I’d use in production for a SaaS that processes vendor agreements, NDAs, or employment contracts at scale.

1. Install dependencies — Set up the Python environment with Anthropic SDK and PDF parsing libraries
2. Parse and chunk the contract — Extract text from PDF, split into logical sections
3. Extract structured terms — Pull key dates, parties, obligations, and payment terms as JSON
4. Flag risks with multi-stage reasoning — Run a second pass specifically for problematic clauses
5. Generate the executive summary — Produce a human-readable report with risk scores
6. Wire it into a pipeline — Compose all stages into a single callable function

Why multi-stage reasoning beats a single prompt

The instinct is to send the whole contract in one prompt and ask Claude to “extract terms and flag risks.” That works for short contracts. It falls apart on anything over 4,000 tokens because the model splits its attention across too many tasks at once, and hallucination rates climb noticeably when you’re asking for structured extraction and qualitative risk assessment in the same pass.

The pipeline I’m showing here splits the work: first a structured extraction pass that outputs strict JSON, then a separate risk analysis pass that reasons about the extracted terms plus the raw clauses, then a summary pass. Each stage has a narrowly defined job. This mirrors how a paralegal actually works — read for facts, then read for problems, then brief the partner.

If you want to understand the hallucination risk more deeply, the patterns described in reducing LLM hallucinations in production apply directly here — structured outputs in stage one are your first line of defense.

Step 1: Install dependencies

pip install anthropic pymupdf python-dotenv pydantic

We’re using pymupdf (fitz) for PDF extraction because it handles messy real-world PDFs better than pdfplumber for most contract formats. pydantic gives us schema validation on the extracted JSON so we catch malformed outputs before they propagate downstream.

Step 2: Parse and chunk the contract

import fitz  # pymupdf
from pathlib import Path

def extract_contract_text(pdf_path: str) -> dict:
    """Extract text from PDF, return sections dict."""
    doc = fitz.open(pdf_path)
    full_text = ""
    pages = []
    
    for page_num, page in enumerate(doc):
        page_text = page.get_text("text")
        pages.append({"page": page_num + 1, "text": page_text})
        full_text += page_text + "\n\n"
    
    doc.close()
    
    # Basic section detection — works for most standard contracts
    sections = {}
    current_section = "preamble"
    section_text = []
    
    for line in full_text.split("\n"):
        # Detect numbered sections like "1.", "2.1", "ARTICLE IV"
        if line.strip() and (
            line.strip()[0].isdigit() or 
            line.strip().isupper() and len(line.strip()) > 3
        ):
            if section_text:
                sections[current_section] = "\n".join(section_text)
            current_section = line.strip()[:60]  # cap key length
            section_text = [line]
        else:
            section_text.append(line)
    
    if section_text:
        sections[current_section] = "\n".join(section_text)
    
    return {
        "full_text": full_text,
        "sections": sections,
        "page_count": len(pages),
        "char_count": len(full_text)
    }

For contracts longer than ~50 pages, you’ll want to chunk by section and process in parallel. Check out the batch processing workflows guide for handling 100+ contracts efficiently using Claude’s Batch API — at roughly 50% cost reduction vs synchronous calls.

Step 3: Extract structured terms

import anthropic
import json
from pydantic import BaseModel
from typing import Optional

client = anthropic.Anthropic()  # reads ANTHROPIC_API_KEY from env

EXTRACTION_SYSTEM_PROMPT = """You are a contract analysis assistant. 
Extract structured data from contracts with precision. 
Return ONLY valid JSON matching the schema provided. 
If a field is not found, use null. Never invent values."""

def extract_contract_terms(contract_text: str) -> dict:
    """Stage 1: Extract key terms as structured JSON."""
    
    schema = {
        "parties": {"party_a": "string", "party_b": "string"},
        "effective_date": "ISO date string or null",
        "expiry_date": "ISO date string or null",
        "auto_renewal": "boolean or null",
        "renewal_notice_days": "integer or null",
        "payment_terms": {
            "amount": "number or null",
            "currency": "string or null",
            "schedule": "string description or null",
            "late_penalty": "string or null"
        },
        "termination_notice_days": "integer or null",
        "governing_law": "jurisdiction string or null",
        "liability_cap": "string or null",
        "ip_assignment": "boolean — does IP transfer to other party?",
        "non_compete": "boolean",
        "non_compete_duration_months": "integer or null",
        "arbitration_required": "boolean"
    }
    
    prompt = f"""Extract the following fields from this contract. 
Return JSON matching this schema exactly:
{json.dumps(schema, indent=2)}

CONTRACT TEXT:
{contract_text[:15000]}"""  # Claude Sonnet handles 200k tokens but trim for cost

    response = client.messages.create(
        model="claude-sonnet-4-5",
        max_tokens=2000,
        system=EXTRACTION_SYSTEM_PROMPT,
        messages=[{"role": "user", "content": prompt}]
    )
    
    raw = response.content[0].text.strip()
    
    # Strip markdown code fences if present
    if raw.startswith("```"):
        raw = raw.split("```")[1]
        if raw.startswith("json"):
            raw = raw[4:]
    
    try:
        return json.loads(raw)
    except json.JSONDecodeError:
        # Fallback: ask Claude to fix its own output
        fix_response = client.messages.create(
            model="claude-haiku-4-5",
            max_tokens=2000,
            messages=[{
                "role": "user",
                "content": f"Fix this malformed JSON and return only valid JSON:\n{raw}"
            }]
        )
        return json.loads(fix_response.content[0].text.strip())

I’m using claude-sonnet-4-5 for extraction. At current pricing, a typical 10-page NDA costs roughly $0.004–$0.006 per extraction call. Haiku is cheaper (~$0.0004) but misses nuanced clause language more often — I tested both on 30 real vendor contracts and Sonnet had ~12% fewer missed fields on complex payment structures.

Step 4: Flag risks with multi-stage reasoning

This is where the multi-stage approach pays off. The risk pass gets both the extracted structured data from stage one and the original clause text, so it can reason about context rather than just pattern-matching keywords.

RISK_SYSTEM_PROMPT = """You are a senior contract attorney identifying legal and business risks.
Analyze contracts with particular attention to:
- Unfavorable termination triggers for your client
- Liability exposure beyond standard commercial terms  
- IP traps (assignment clauses, work-for-hire provisions)
- Auto-renewal with short notice windows
- Unilateral amendment rights
- Indemnification overreach
- Jurisdiction and governing law disadvantages

Rate each risk: HIGH / MEDIUM / LOW
Be specific about which clause creates the risk."""

def flag_contract_risks(contract_text: str, extracted_terms: dict) -> list:
    """Stage 2: Identify and score risk clauses."""
    
    prompt = f"""Review this contract for risks. The extracted terms are:
{json.dumps(extracted_terms, indent=2)}

Focus your review on the full contract text below. 
Return a JSON array of risk objects, each with:
- "clause": brief quote of the problematic text (max 100 chars)
- "section": section reference if identifiable  
- "risk_type": category (e.g. "IP Assignment", "Liability", "Termination")
- "severity": "HIGH" | "MEDIUM" | "LOW"
- "explanation": 1-2 sentence plain-English explanation
- "recommendation": what to negotiate or watch for

CONTRACT:
{contract_text[:20000]}"""

    response = client.messages.create(
        model="claude-sonnet-4-5",
        max_tokens=3000,
        system=RISK_SYSTEM_PROMPT,
        messages=[{"role": "user", "content": prompt}]
    )
    
    raw = response.content[0].text.strip()
    if raw.startswith("```"):
        raw = raw.split("```")[1]
        if raw.startswith("json"):
            raw = raw[4:]
    
    risks = json.loads(raw)
    
    # Sort by severity: HIGH first
    severity_order = {"HIGH": 0, "MEDIUM": 1, "LOW": 2}
    return sorted(risks, key=lambda x: severity_order.get(x.get("severity", "LOW"), 2))

Step 5: Generate the executive summary

def generate_contract_summary(
    contract_text: str, 
    extracted_terms: dict, 
    risks: list,
    contract_filename: str
) -> dict:
    """Stage 3: Produce human-readable executive summary."""
    
    high_risks = [r for r in risks if r.get("severity") == "HIGH"]
    medium_risks = [r for r in risks if r.get("severity") == "MEDIUM"]
    
    # Calculate a simple risk score
    risk_score = min(100, len(high_risks) * 20 + len(medium_risks) * 8)
    
    prompt = f"""Write an executive summary for this contract review.

EXTRACTED TERMS: {json.dumps(extracted_terms, indent=2)}
HIGH RISKS FOUND: {json.dumps(high_risks, indent=2)}
MEDIUM RISKS FOUND: {json.dumps(medium_risks, indent=2)}
TOTAL RISKS: {len(risks)}

Write 3-4 paragraphs covering:
1. What this contract is and who the parties are
2. Key commercial terms (duration, payment, renewal)
3. The most important risks and what action to take
4. Overall recommendation: proceed / proceed with changes / do not proceed

Be direct. Write for a non-lawyer business owner."""

    response = client.messages.create(
        model="claude-haiku-4-5",  # Summary is straightforward — Haiku is fine here
        max_tokens=1000,
        messages=[{"role": "user", "content": prompt}]
    )
    
    return {
        "filename": contract_filename,
        "risk_score": risk_score,
        "risk_level": "HIGH" if risk_score >= 40 else "MEDIUM" if risk_score >= 15 else "LOW",
        "extracted_terms": extracted_terms,
        "risks": risks,
        "high_risk_count": len(high_risks),
        "medium_risk_count": len(medium_risks),
        "summary": response.content[0].text.strip()
    }

Step 6: Wire the full pipeline

def analyze_contract(pdf_path: str) -> dict:
    """Full Claude contract review agent pipeline."""
    
    print(f"[1/4] Parsing {pdf_path}...")
    parsed = extract_contract_text(pdf_path)
    
    print(f"[2/4] Extracting terms ({parsed['char_count']} chars)...")
    terms = extract_contract_terms(parsed["full_text"])
    
    print("[3/4] Flagging risks...")
    risks = flag_contract_risks(parsed["full_text"], terms)
    
    print("[4/4] Generating summary...")
    report = generate_contract_summary(
        parsed["full_text"], 
        terms, 
        risks,
        Path(pdf_path).name
    )
    
    return report

# Usage
if __name__ == "__main__":
    report = analyze_contract("vendor_agreement.pdf")
    print(f"\nRisk Level: {report['risk_level']} (score: {report['risk_score']}/100)")
    print(f"High risks: {report['high_risk_count']}, Medium: {report['medium_risk_count']}")
    print(f"\n{report['summary']}")
    
    if report['risks']:
        print("\n=== TOP RISKS ===")
        for risk in report['risks'][:3]:
            print(f"[{risk['severity']}] {risk['risk_type']}: {risk['explanation']}")

A typical 15-page vendor agreement runs through this pipeline in about 12–18 seconds and costs roughly $0.015–$0.025 total. For a team reviewing 200 contracts/month, that’s $3–5/month in API costs — which is why building this yourself beats any contract review SaaS that charges per document.

For production deployments with retry logic on API failures, the patterns in LLM fallback and retry logic are worth implementing before you go live — Claude API occasionally returns 529 errors under load.

Common errors and how to fix them

JSON decode errors on extraction

Claude occasionally wraps JSON in markdown fences or adds explanatory text. The code above strips fences, but if you’re still hitting decode errors, add response_format via the tools API with a strict schema — this forces valid JSON output. Alternatively, use the Haiku fallback shown in step 3 which reliably cleans its own output. See also the structured data extraction guide for more robust patterns.

Truncated analysis on long contracts

If max_tokens is too low for the risk stage, you get cut-off JSON arrays that break parsing. For contracts over 30 pages, increase max_tokens to 4096 on the risk pass. You can also chunk the contract by section and run the risk pass per-section, then deduplicate results by clause similarity.

Missed clauses in scanned PDFs

PyMuPDF extracts embedded text — if the PDF is a scanned image, you’ll get empty or garbled text. Check parsed['char_count'] before running the pipeline; if it’s under 500 chars for a multi-page document, the PDF is likely scanned. You’ll need an OCR step (pytesseract or AWS Textract) upstream.

What to build next

The natural extension here is template comparison — loading your company’s standard contract templates as reference documents and flagging deviations from your preferred language. Store your template terms as a baseline JSON, run the same extraction on the incoming contract, then diff the two structured outputs with a final Claude pass that explains “counterparty wants 30-day payment terms; your standard is 14 days.” This turns the agent from a risk flagger into an actual negotiation preparation tool. You can combine this with a vector store of past contracts to ask “have we seen this indemnification language before?” — the RAG pipeline guide covers exactly that setup.

When to use this vs. a commercial contract tool

Solo founder or small team reviewing under 500 contracts/year: build this. The $50/year in API costs vs. $3,000–$15,000 for Ironclad or Kira is not a close comparison. You get full output control, no data-sharing concerns, and you can tune the risk prompts to your industry.

Enterprise legal team needing audit trails, e-signatures, and workflow integrations: commercial tools have compliance features this pipeline doesn’t. Use this to prototype your risk criteria and prove ROI, then negotiate better with vendors once you know what you actually need.

Developers building a contract review product: this pipeline is your MVP. The role prompting architecture here is intentionally modular — swap in domain-specific system prompts for employment law vs. SaaS agreements vs. real estate without touching the pipeline logic. For consistent agent behavior across contract types, the patterns in role prompting best practices give you a framework for maintaining reliability as you scale.