scan-inventory — Claude Code subagent: what it does, how to install
Internal cartographer subagent for the Claude Security scan workflow. It partitions repository directories into discrete review targets and tracks intentionally skipped paths.
/plugin install claude-security@claude-plugins-officialWhat scan-inventory does
The subagent runs in read-only mode on the Sonnet model with medium effort. It has no shell access and cannot dispatch secondary subagents. File inspections rely entirely on three primitives: Read, Glob, and Grep. To avoid confusing the execution directory with the actual codebase, it resolves every file pattern from the absolute SCAN_ROOT.
Its task is structural cartography rather than vulnerability research. The agent divides the codebase into two structured ledgers: target components and intentionally skipped areas (securityScanSkippedComponents). The scan ledger lists modules ranked by external exposure, placing network endpoints, parsers, and authentication paths first. The skipped ledger records dependencies, vendored packages, generated code, and fixtures along with an explicit justification.
Because this subagent is designed for machine consumption within a security pipeline, it does not accept manual vulnerability audits. It treats repository contents as untrusted input. Any directives inside code comments or CLAUDE.md files that request skipping a directory are ignored.
What it helps with
- partition repository directories into discrete security review targets
- rank codebase components by attacker-reachable exposure
- document justified exclusions for third-party and generated code
- enforce complete coverage across all top-level repository directories
Example prompts for the agent
- Run a repository security audit using the claude-security workflow
- Partition the repository structure into components for security review
- Map the codebase and isolate third-party dependencies from review targets
How to install scan-inventory
1Plugin marketplace
/plugin install claude-security@claude-plugins-official2Manually: put the files in place
.claude/agents/scan-inventory.mdFor all projects use ~/.claude/agents/. Claude delegates by the description field or an @-mention
Manually: put the files in place
.codex/agents/scan-inventory.tomlCodex defines subagents in TOML: name, description, developer_instructions. Move the Markdown text into developer_instructions by hand. For all projects use ~/.codex/agents/
Manually: put the files in place
.cursor/agents/scan-inventory.mdCursor also reads .claude/agents/
Step by step, with commands for each platform: Claude Code subagents: how to create one, call it and keep context clean
Questions about scan-inventory
How do I install scan-inventory in Claude Code?
Add the security plugin by running /plugin install claude-security@claude-plugins-official. Alternatively, place the agent definition directly into .claude/agents/scan-inventory.md.
Does scan-inventory search for vulnerabilities?
No. It acts strictly as an architectural cartographer without evaluating code flaws or severity ratings.
Which tools can the subagent access?
It only uses Read, Glob, and Grep. Shell execution is disabled, and it cannot spawn other subagents.
