claude-security — Claude Code plugin: vulnerability scanning
Scans your code for vulnerabilities inside the Claude session, challenges every finding, and turns confirmed ones into patches.
/plugin install claude-security@claude-plugins-official
/plugin marketplace add anthropics/claude-plugins-officialWhat claude-security does
The plugin puts a crew of agents on your repository as security researchers. They map the architecture, build a threat model, hunt through the components, and verify each finding independently before it lands in the report. Everything runs in your Claude session, with no daemon behind it. For the best results the author recommends Claude or Fable 5.1, picked with /model.
Start with /claude-security to get the menu of three jobs: scan the codebase (whole repo or a scoped part), scan changes (a branch diff, a pull request diff, or a single commit), or suggest patches from a report. You can skip the menu and type the job after the command, or just ask in plain words. Before work begins the plugin reads the repository, offers concrete scope and effort options with their cost, and states what it settled on. A scan asks once to confirm time and token spend.
Output goes to a timestamped CLAUDE-SECURITY-<timestamp>/ directory: a readable CLAUDE-SECURITY-RESULTS.md with severity on the CVSS v4.0 qualitative scale, a machine-readable CLAUDE-SECURITY-RESULTS.jsonl, a CLAUDE-SECURITY-RESULTS.sarif log for GitHub code scanning, and a revision stamp naming the commit, effort and severity counts. An agent swaps credential values in the outputs for [REDACTED], though that is a model's best effort rather than a guarantee — read the files before sharing them.
What it helps with
- find vulnerabilities in your own repo before release
- review a branch or pull request diff for flaws
- get a report with severity and an exploit scenario
- export findings as SARIF for GitHub code scanning
- turn confirmed findings into patch files
Example prompts for the agent
- Scan my branch diff at high effort
- Suggest patches from the latest report
How to install claude-security
Plugin marketplace
/plugin install claude-security@claude-plugins-official/plugin marketplace add anthropics/claude-plugins-officialStep by step, with commands for each platform: Claude Code plugins: marketplaces, installing, and building your own
Questions about claude-security
How do I install claude-security in Claude Code?
Add the marketplace first: /plugin marketplace add anthropics/claude-plugins-official. Then install the plugin: /plugin install claude-security@claude-plugins-official.
What does claude-security do?
It runs a team of agents over your code: threat model, vulnerability hunt, and independent verification of every finding. Confirmed findings can be turned into patch files you apply yourself.
Can I scan a repository I don't trust?
A scan runs in your session under your permissions, and the plugin adds no isolation. For unfamiliar code the author suggests running the session inside sandbox-runtime.
