claude-security

Deep vulnerability scanning of your own code, run entirely inside your Claude Code session at a chosen effort tier, with every finding challenged before it is reported and the verification tally computed in code. Turns surviving findings into targeted patches, each verified by a panel of agents, that you apply when you choose.

Install

If the official marketplace isn’t added yet, run

Category: Security
Author: Anthropic
GitHub: anthropics/claude-plugins-official

Good for

Scan a whole repository or a scoped part of it for vulnerabilities
Security-review a branch diff, a pull request diff or a single commit
Turn confirmed findings into patch files that you apply when you choose

Getting started

Run /plugin install claude-security@claude-plugins-official, then /reload-plugins
Run /claude-security for the menu, or type a job like /claude-security scan my branch at high
Confirm the time and token cost; results go into a CLAUDE-SECURITY- directory in the repository

Before you install

Scans run in your Claude Code session under your permissions with no extra isolation; for untrusted repositories, run the session inside sandbox-runtime. Claude Opus 5.5 or Fable 5.1 is recommended.

Summarized by AI from the project docs; check the official docs before relying on it.

Similar tools

security-guidanceOfficial plugin · Security
Security review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.
42crunch-api-security-testingOfficial plugin · Security
Automate API security directly in Claude Code with 42Crunch - automatically audit OpenAPI specs, detect vulnerabilities aligned with OWASP API Security risks (including BOLA/BFLA), and apply AI-powered fixes. Designed for AI-assisted development workflows, it provides continuous guardrails through an audit->scan->remediate->validate loop, ensuring APIs meet enterprise security standards before deployment.
auth0Official plugin · Security
Enterprise-grade auth, easy to implement. Add login, SSO, MFA, and access control to any app with framework-aware guidance.
crowdsecOfficial plugin · Security
Operational skill for installing, configuring, operating, and debugging CrowdSec (cscli, LAPI/CAPI, hub, bouncers, WAF/AppSec) across bare-metal, Docker, and Kubernetes.
crowdstrike-falcon-foundryOfficial plugin · Security
CrowdStrike Falcon Foundry development skills for building cybersecurity applications on the Falcon platform. Includes UI development, collections, functions, workflows, API integration, security patterns, and debugging workflows.