# claude-security

Scans a repository or its changes, then can turn verified findings into targeted patch files. It runs only as the main agent of a session.

- subagent · `type=agent` · Claude Code · ★ 44635
- Author: Anthropic · official Anthropic repository
- License: LicenseRef-Proprietary · policy=link-only · description only; the file stays with the author
- Source: https://github.com/anthropics/claude-plugins-official/tree/HEAD/plugins/claude-security/agents/claude-security.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/agents/claude-security

## What it does

\`claude-security` scans an entire repository, a scoped part of it, a branch or pull request diff, or a single commit. It can then create targeted patch files for findings that pass verification. The changes are not committed, pushed, or opened as a pull request.

The orchestrator runs the `claude-security:scan` workflow with research and verification agents. For remediation, it uses a patch generator, a verifier, and a fresh researcher for each finding. A scan asks for confirmation of its time or token cost unless the user has already accepted that cost. If Workflow is unavailable, the scan stops. Run it as the main session agent with `claude --agent claude-security:claude-security`; do not dispatch it as a subagent.

## Install

### Claude Code (native platform)

1. **Plugin marketplace**
In the agent chat (not a shell):
```text
/plugin install claude-security@claude-plugins-official
```

2. **Manually: put the files in place**
- File: `.claude/agents/claude-security.md` — For all projects use ~/.claude/agents/. Claude delegates by the description field or an @-mention

### Codex

**Manually: put the files in place**
- File: `.codex/agents/claude-security.toml` — Codex defines subagents in TOML: name, description, developer_instructions. Move the Markdown text into developer_instructions by hand. For all projects use ~/.codex/agents/

### Cursor

**Manually: put the files in place**
- File: `.cursor/agents/claude-security.md` — Cursor also reads .claude/agents/

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/anthropics/claude-plugins-official/tree/HEAD/plugins/claude-security/agents/claude-security.md

## When to use it
- scan a repository for security findings
- review changes in a branch or pull request
- inspect a single commit for vulnerabilities
- generate patches for verified findings
- validate proposed fixes with separate agents

## Example prompts
- Run `claude-security` as the main agent with `claude --agent claude-security:claude-security` and scan the whole repository.
- Start `claude-security` with `claude --agent claude-security:claude-security`, review this branch’s changes, and prepare patches for findings that pass verification.

## Similar
- [code-reviewer](https://affpapa.org/en/nevibecode/agents/voltagent-community-code-reviewer.md) — subagent · 31050 installs
- [security-auditor](https://affpapa.org/en/nevibecode/agents/voltagent-community-security-auditor.md) — subagent · 10718 installs
- [devops-engineer](https://affpapa.org/en/nevibecode/agents/devops-engineer.md) — subagent · 7392 installs

From the same set: [anthropics/claude-plugins-official](https://affpapa.org/en/nevibecode/by/anthropics/claude-plugins-official.md) — 128 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md