agentic-security — Claude Code plugin: what it does, how to install
A Claude plugin that hunts for vulnerabilities, tests whether each finding is actually exploitable, and repairs it through a verification gate. Useful when a model wrote the code and you need to know what is unsafe.
/plugin marketplace add anthropics/claude-plugins-community
/plugin install agentic-security@claude-communityWhat agentic-security does
Mechanical analyzers do the scanning, and agents do the reasoning: some look for weaknesses, others try to knock each finding down. A claim only stands when tooling backs it, not when a model says so. The model cannot set severity, confirm an exploit or mark a fix verified.
Repairs go through a gate. Before anything lands in your files, the patch is scanned again and run past the linter and the test suite. The report lists which checks ran and which did not. Start with npx @clear-capabilities/agentic-security-scanner ci examples/demo-app --assurance strict — --assurance belongs to ci only, there is no scan --assurance. In strict mode the build fails when the analysis itself did not finish cleanly, not just when vulnerabilities turn up.
A scan that stopped early is never reported as clean. A missing analyzer, a skipped validation step, a partial run: none of these count as proof that code is safe. Accuracy on outside code was measured once and came out low — precision 6/19, recall 6/278, F1 0.040. Keep that in mind before you lean on a report.
What it helps with
- find vulnerabilities in model-generated code
- cut scanner false positives by trying to disprove each finding
- show what a flaw can reach in the codebase
- fix a vulnerability and confirm the patch did not break anything
- avoid mistaking an unfinished scan for a clean one
Example prompts for the agent
- Scan the demo app:
npx @clear-capabilities/agentic-security-scanner ci examples/demo-app --assurance strict - Check this repo for vulnerabilities and show me which ones are actually exploitable
- Find the issue, propose a patch, and run the checks before writing it
How to install agentic-security
Plugin marketplace
/plugin marketplace add anthropics/claude-plugins-community/plugin install agentic-security@claude-communityStep by step, with commands for each platform: Claude Code plugins: marketplaces, installing, and building your own
Questions about agentic-security
How do I install agentic-security in Claude Code?
From the marketplace: run /plugin marketplace add anthropics/claude-plugins-community, then /plugin install agentic-security@claude-community.
What does agentic-security do?
It looks for weaknesses, challenges its own findings, and proves exploitability where a reproducer exists. Patches are written only after a rescan, lint and tests.
Can I trust its security report?
It will not call an unfinished scan clean. Accuracy on code the engine was not built from was measured once and is low: precision 6/19, recall 6/278, F1 0.040.
