Claude Security
Deep vulnerability scanning of your own code, run entirely inside your Claude Code session at a chosen effort tier, with every finding challenged before it is reported and the verification tally computed in code. Turns surviving findings into targeted patches, each verified by a panel of agents, that you apply when you choose. See the plugin README for the tiers, the report format, and the trust model.
The vulnerability detection and patching capabilities behind Claude Security, packaged for Claude Code. Scans run inside your session on your machine, against any repository you can clone.
Scan Codebase maps your repository's architecture, threat-models every component, fans research agents across the code, and verifies what they find. Each finding comes back with a severity, a CWE category, potential impact, reproduction steps, and a suggested path to remediation.
How it works: Install the plugin, run /claude-security, and choose an option.
- Scan Codebase covers the whole repository, including code you didn't write
- Scan Changes points the same analysis at a pull request, a single commit, or the changes on a branch. Research agents still read the whole repository for context rather than the diff alone. Run it in CI, or locally before you commit
- Suggest Patches turns confirmed findings into patches, with an adversarial panel reviewing each one. Output is a .patch file that Claude can apply and open a pull request with
In beta. Scans use the Claude access you already have. Learn more here.