Claude Security
Deep vulnerability scanning of your own code, run entirely inside your Claude Code session at a chosen effort tier, with every finding challenged before it is reported and the verification tally computed in code. Turns surviving findings into targeted patches, each verified by a panel of agents, that you apply when you choose.
Skills (1)
Claude uses these on its own when your request matches.
Agents (9)
Specialized helpers Claude can hand work to.
- claude-securityThe Claude Security orchestrator, for use only as the main agent of a session (claude --agent claude-security:claude-security), where it runs a scan end to end and can turn its findings into targeted patch files, each verified by a panel of agents. Never dispatch it as a…
- exploreRead-only code explorer that the plugin's other agents dispatch to map a codebase — locate files, trace how a flow is wired, find every caller of a symbol, answer "where does X happen".
- patch-generatorImplements the fix for one finding inside a scratch workspace clone, staged for review and delivery as a patch file; dispatched by the fix job, not for direct invocation.
- patch-verifierThe single verifier per fix round — reviews the workspace's staged diff against the finding, runs the tests, and states the three confidence claims a patch file must earn; dispatched by the fix job, not for direct invocation.
- scan-inventoryRestricted read-only repository cartographer dispatched by the Claude Security scan workflow to partition the tree into components and account for every top-level directory; not for direct invocation or vulnerability research.
- scan-loaderRestricted read-only loader dispatched by the Claude Security scan workflow to return one JSON file from the run directory; not for direct invocation.
- scan-redactorRestricted agent dispatched by the Claude Security scan jobs to replace the credential values in a finished scan's report files with [REDACTED]; not for direct invocation.
- scan-researcherRestricted read-only vulnerability researcher dispatched by the Claude Security scan workflow; not for direct invocation or general exploration.
- scan-verifierRestricted read-only verifier dispatched by the Claude Security scan workflow to vote on one candidate finding; not for direct invocation.
Also adds hooks that run automatically at set points in a session.
Install
Run in your terminal
claude plugin install claude-security@claude-plugins-officialClaude Code already includes the claude-plugins-official marketplace, so this installs directly. Start a new Claude Code session to use it.
Already in a Claude Code session?
Install
/plugin install claude-security@claude-plugins-officialPublished in Anthropic's claude-plugins-official marketplace (anthropics/claude-plugins-official).
Related plugins
- 1SSecurity GuidanceSecurity review for Claude-generated code. Pattern-based warnings on edits, LLM-powered diff review on Stop, and an agentic commit reviewer that catches injection, XSS, SSRF, hardcoded secrets, and 25+ other vulnerability classes.242kmarketplace installs
- 2
SemgrepSemgrep catches security vulnerabilities in real-time and guides Claude to write secure code from the start.20kmarketplace installs
- 3
Sonatype GuideSonatype Guide MCP server for software supply chain intelligence and dependency security. Analyze dependencies for vulnerabilities, get secure version recommendations, and check component quality metrics.7.5kmarketplace installs
- 4
Aikido SecurityAikido Security scanning for Claude Code — SAST, secrets, and IaC vulnerability detection powered by the Aikido MCP server.7.3kmarketplace installs
- 5
SonarqubeAutomatically enforce SonarQube code quality and security in the agent coding loop — 7,000+ rules, secrets scanning, agentic analysis, and quality gates across 40+ languages. PostToolUse hooks run analysis after every file edit. Pre-tool secrets scanning prevents 450+ patterns from reaching the LLM. Slash commands give on-demand access to quality gate status, coverage, duplication, and dependency risks. Includes SonarQube CLI, MCP Server, skills, hooks, and slash commands.6.4kmarketplace installs
- 6
Auth0Enterprise-grade auth, easy to implement. Add login, SSO, MFA, and access control to any app with framework-aware guidance.4.7kmarketplace installs