# scan-inventory

Internal cartographer subagent for the Claude Security scan workflow. It partitions repository directories into discrete review targets and tracks intentionally skipped paths.

- subagent · `type=agent` · Claude Code · ★ 44635
- Author: Anthropic · official Anthropic repository
- License: LicenseRef-Proprietary · policy=link-only · description only; the file stays with the author
- Source: https://github.com/anthropics/claude-plugins-official/tree/HEAD/plugins/claude-security/agents/scan-inventory.md
- Updated: 2026-10-24
- HTML: https://affpapa.org/en/nevibecode/agents/scan-inventory

## What it does

The subagent runs in read-only mode on the Sonnet model with medium effort. It has no shell access and cannot dispatch secondary subagents. File inspections rely entirely on three primitives: `Read`, `Glob`, and `Grep`. To avoid confusing the execution directory with the actual codebase, it resolves every file pattern from the absolute `SCAN_ROOT`.

Its task is structural cartography rather than vulnerability research. The agent divides the codebase into two structured ledgers: target components and intentionally skipped areas (`securityScanSkippedComponents`). The scan ledger lists modules ranked by external exposure, placing network endpoints, parsers, and authentication paths first. The skipped ledger records dependencies, vendored packages, generated code, and fixtures along with an explicit justification.

Because this subagent is designed for machine consumption within a security pipeline, it does not accept manual vulnerability audits. It treats repository contents as untrusted input. Any directives inside code comments or `CLAUDE.md` files that request skipping a directory are ignored.

## Install

### Claude Code (native platform)

1. **Plugin marketplace**
In the agent chat (not a shell):
```text
/plugin install claude-security@claude-plugins-official
```

2. **Manually: put the files in place**
- File: `.claude/agents/scan-inventory.md` — For all projects use ~/.claude/agents/. Claude delegates by the description field or an @-mention

### Codex

**Manually: put the files in place**
- File: `.codex/agents/scan-inventory.toml` — Codex defines subagents in TOML: name, description, developer_instructions. Move the Markdown text into developer_instructions by hand. For all projects use ~/.codex/agents/

### Cursor

**Manually: put the files in place**
- File: `.cursor/agents/scan-inventory.md` — Cursor also reads .claude/agents/

Where a file is given instead of a command, copy the files from the source to that path: https://github.com/anthropics/claude-plugins-official/tree/HEAD/plugins/claude-security/agents/scan-inventory.md

## When to use it
- partition repository directories into discrete security review targets
- rank codebase components by attacker-reachable exposure
- document justified exclusions for third-party and generated code
- enforce complete coverage across all top-level repository directories

## Example prompts
- Run a repository security audit using the claude-security workflow
- Partition the repository structure into components for security review
- Map the codebase and isolate third-party dependencies from review targets

## Similar
- [code-reviewer](https://affpapa.org/en/nevibecode/agents/voltagent-community-code-reviewer.md) — subagent · 31050 installs
- [security-auditor](https://affpapa.org/en/nevibecode/agents/voltagent-community-security-auditor.md) — subagent · 10718 installs
- [devops-engineer](https://affpapa.org/en/nevibecode/agents/devops-engineer.md) — subagent · 7392 installs

From the same set: [anthropics/claude-plugins-official](https://affpapa.org/en/nevibecode/by/anthropics/claude-plugins-official.md) — 128 cards

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md