Claude Code can now scan your repo for vulnerabilities and draft the patch
Anthropic shipped a plugin that runs a multi-agent security audit inside your own Claude Code session, then turns findings into patches you apply yourself. Here is what it needs, the exact commands, and where it fits next to the security tools you may already have running.
Anthropic released a plugin called Claude Security on July 22, 2026. If that name sounds familiar, it should — there is already a free "security guidance" plugin, a /security-review command, and a Code Review feature, all with overlapping names and overlapping jobs. Most people who hear about the new one will either skip it, assuming it duplicates something they already have, or never hear about it at all, because it shipped as a plugin update rather than a headline launch. Neither reaction is right. It does something the other three do not: a coordinated multi-agent scan of your actual codebase, with findings independently double-checked before they reach you, and a patch drafted for each one you choose to fix.
What it is, and what it is not
Claude Code now has five overlapping security layers, and the names alone will not tell you which one you are running:
| Layer | What it does | Where it runs |
|---|---|---|
| Security guidance plugin (free, since May 2026) | Flags common issues in code as Claude writes it, same session | In session |
/security-review | One-time pass over your current branch | On demand, single pass |
| Claude Security plugin (new) | Multi-agent scan of a repo or a diff, independently verified findings, drafted patches | On demand, deep scan |
| Code Review (Team/Enterprise) | Multi-agent correctness + security review on pull requests | On PR |
| Claude Security (managed product, Enterprise) | Hosted scanning that monitors connected repositories automatically | Continuous, managed |
The one this post is about is the third row: a plugin you install and run yourself, inside a normal Claude Code session, against a repo you already have open. It requires a paid Claude Code plan (Pro, Max, or Team all qualify — this is not gated to Enterprise, only the separate hosted product is), so if you are already paying for Claude Code, you already have access.
What a scan does
A scan runs a team of Claude agents in sequence: one maps your architecture, one builds a threat model against it, one hunts for vulnerabilities inside that model, and a separate agent independently reviews every candidate finding before it is written into the report. That last step is the part worth noticing — findings only surface after a second, independent agent has tried to knock them down, which is why the reports read as short lists of real issues instead of a wall of maybe-problems. The stated focus is injection flaws, authentication bypasses, memory corruption, and logic errors that cross file or module boundaries — the class of bug a single linter pass or a pattern-matching tool will not catch, because it depends on understanding what the code is trying to do.
Prerequisites
Before you install it, confirm these, since a missing one is the most common reason the plugin refuses to run:
- Claude Code v2.1.154 or later, on a paid plan. Check your version with
claude --version. The scan uses dynamic workflows to orchestrate its agents — on Pro, turn these on from the "Dynamic workflows" row in/configif they are not already enabled. - Python 3.9.6 or later on your
PATHaspython3. Check withpython3 --version. The plugin's own tooling only uses the Python standard library, so nothing extra gets installed. - Git, if you want to scan a diff, a branch, a pull request, or a single commit rather than the whole tree. A full scan of the working directory works without git too.
Install and run it
Inside a Claude Code session:
/plugin install claude-security@claude-plugins-official
If Claude Code says the marketplace is not found, run this first, then retry the install:
/plugin marketplace add anthropics/claude-plugins-official
Activate it in the current session without restarting:
/reload-plugins
Then run the scan:
/claude-security
This opens a menu: scan the whole codebase, scan only a set of changes (a branch diff, a PR, or a single commit), or suggest patches for findings you already have. On a large repository, pick a focused area — your auth code, your API layer — rather than the whole tree; the plugin states each option's file count and relative cost before you confirm, and answers "I don't know" with a sensible default sized to your repo. You can also skip the menu and just say what you want, either as arguments (/claude-security scan my branch) or in plain language ("scan commit abc1234"). The plugin works best in auto mode, which lets its agents proceed without a permission prompt at every step — it reminds you how to turn that on when a job starts.
Nothing runs until you confirm the scope, and a full scan can take a while and use a meaningful number of tokens, so leave Claude Code open and treat it like you would a real CI job, not a quick one-liner.
Reading and using the report
Every scan writes a timestamped CLAUDE-SECURITY-<timestamp>/ directory into your repository, with three files:
CLAUDE-SECURITY-RESULTS.md— the human-readable report, each finding numbered (F1,F2, ...) with its impact, exploit scenario, severity, confidence, and recommendation.CLAUDE-SECURITY-RESULTS.jsonl— the same findings, one JSON object per line, if you want to pipe them somewhere else.CLAUDE-SECURITY-REVISION-<commit>.json— a stamp recording exactly which commit was scanned and how thoroughly, so a report never gets separated from the code it describes.
That directory ships its own .gitignore, so a stray git add . will not sweep a scan report into a commit by accident. Scans are nondeterministic — running the same scan twice can surface different findings — so treat this as a recurring pass, not a one-time certificate.
To fix something, run /claude-security again and pick "Suggest patches," or just ask ("fix finding F3"). Each patch is built in a scratch copy of your repo by an agent that did not write the original finding, and it only produces a patch when it can vouch that the fix addresses that one issue, introduces nothing new, and passes your existing tests if you have them. Patches land in a patches/ folder next to the report — apply one yourself with git apply CLAUDE-SECURITY-<timestamp>/patches/F1.patch, in its own pull request. Nothing is ever applied automatically; you read every patch before it touches your source.
Where this fits if you already have a security pass
If you already run /security-review before merging, or lean on the free security guidance plugin while you code, keep both — this does not replace either. The guidance plugin catches the obvious stuff in the moment, cheaply, as code is written. /security-review gives you a single fast pass over a branch. This plugin is the slower, deeper layer: run it before a release, before you hand a repo to someone else, or on the codebase behind an AI-built app you are about to put in front of real users (the exact gap covered in what to check before you ship a vibecoded app and in catching AI-generated bugs before they ship). It also complements, rather than replaces, whatever static analysis or dependency scanner you already run in CI — those catch deterministic, rule-based issues; this reasons about your code the way a person auditing it would.
If you are the one reviewing AI-generated pull requests day to day, the 12-point PR review checklist is the manual version of the same instinct — this plugin is the automated first pass you run before that checklist, not instead of it.
Get the next post when it ships
One email on Sunday with the new post and a short list of what shipped that week — new guides, tool updates, and a couple of links worth reading.