Claude Security

Claude Security Plugin for Claude Code

Put a team of agents to work as security researchers on your codebase: map the architecture, build a threat model, hunt across every component, and independently verify every finding before it reaches the report. Then, if you want, turn the confirmed findings into suggested fixes delivered as targeted patch files you review and apply when you choose.

This is the in-your-session version of Claude Security, Anthropic’s hosted product for vulnerability detection and patching. It runs entirely inside your Claude Code session — no separate process, no daemon.

Recommended models

We recommend Claude Opus 5.5 or Fable 5.1 for best performance. Pick a model using Claude Code's /model command.

In Opus 5.5 or Fable 5.1, portions of a scan may occasionally be downgraded to Opus 4.8. The rest of the scan will complete on your chosen model. Please share feedback with /feedback so we can keep improving our cybersecurity safeguards.

Where it runs

A scan and a fix both run in your Claude Code session, under your permissions. The plugin reads the repository you have open the same way you would, and adds no isolation of its own: the directory's .git/config, its .claude/ settings and hooks, and its CLAUDE.md all apply exactly as they would in any other session.

That makes it a natural fit for code you control — your own repositories, where the question is which bugs are in the code rather than whether the code is trying something. If you are scanning a repository that you do not trust, such as a third-party dependency or an unfamiliar repository, we suggest running the whole session inside sandbox-runtime.

Installation

Install from the official Anthropic marketplace, then reload plugins in the same session:

/plugin install claude-security@claude-plugins-official
/reload-plugins

If Claude Code reports that the marketplace is not found, run /plugin marketplace add anthropics/claude-plugins-official first, then retry.

Getting started

Run /claude-security for the menu. It offers the three jobs the plugin does:

Job	What it scans
Scan codebase	The whole repository, or a scoped part of it
Scan changes	This branch's diff, a pull request's diff (with its branch checked out), or one commit
Suggest patches	A report's findings, turned into patch files