Claude Security Plugin (Multi-Agent Vulnerability Scanning in Claude Code)

Source: ai-research/claude-code-docs-claude-security-plugin-2026-07-24.md — official Claude Code documentation, code.claude.com/docs/en/claude-security, fetched 2026-07-24 · raw/x-bookmarks-recent-digest-2026-07-24.md (the first-party @claudeai launch announcement) · raw/reddit-1v48e9x.md (community reaction, corroborating the launch window)

The Claude Security plugin is Anthropic’s official on-demand deep-scan layer for Claude Code, announced in beta on 2026-07-22: a team of agents maps your architecture, builds a threat model, hunts vulnerabilities, and independently verifies every finding before it reaches the report. It then turns the findings you pick into patch files reviewed by a different agent than the one that wrote them — and never applies them for you. This is the local, in-session sibling of the managed Claude Security product Anthropic demoed at both 2026 keynotes^[inferred]; the plugin reaches code the hosted service can’t (GitLab, Bitbucket, networks with no inbound access).

Key Takeaways

• Launched in beta on 2026-07-22. Announced by @claudeai: “The Claude Security plugin for Claude Code is now available in beta. Scan your changes for vulnerabilities before you commit, or run a full scan across your codebase, all from your terminal on the Claude inference you already run.” (permalink). Beta is a status the documentation page never states — factor it into how much you lean on a clean report. See the release-date note below for how the date was established.
• One command, three jobs. /claude-security opens a menu: Scan codebase, scan a set of changes, and Suggest patches. You can skip the menu — pass arguments (/claude-security scan my branch) or plain language (“scan commit abc1234”).
• It is a dynamic workflow under the hood, which is why the version floor is high: Claude Code v2.1.154+ on a paid plan. On Pro, dynamic workflows must be switched on from the Dynamic workflows row in /config. Also needs Python 3.9.6+ on PATH as python3 (standard library only — nothing gets installed) and works on Linux, macOS, and Windows.
• Install: /plugin install claude-security@claude-plugins-official, then /reload-plugins to activate without restarting. If the marketplace isn’t found, run /plugin marketplace add anthropics/claude-plugins-official first. Uninstall via the /plugin menu or claude plugin uninstall claude-security.
• Findings are gated on independent verification. They “only appear in the report after independent verifier agents analyze them, which keeps reports short and worth reading.” The docs are equally explicit about the cost of that design: scans are nondeterministic — two scans of the same code can surface different findings — so run them regularly rather than treating one clean report as proof.
• Every report is stamped to the code it describes. CLAUDE-SECURITY-REVISION-<commit>.json records the commit scanned, the effort level, whether uncommitted changes were in the tree, and how thoroughly the run was verified. Outside version control it stamps UNVERSIONED.
• Patches are never applied automatically. They land as patches/F<n>.patch with a note; you run git apply yourself, one patch per pull request. Each patch is drafted in a scratch copy of the repo, so your source files stay untouched until you choose.
• The patch reviewer has a three-part contract. A patch is written only when an agent independent of the author can vouch that the change (1) addresses the one finding, (2) introduces no new vulnerability, and (3) leaves behavior otherwise unchanged. When it can’t vouch for all three you get a short note explaining why instead of a patch. When the patched code has no tests, the note says so.
• Local, and it costs you. The plugin runs in your session and each scan counts against your plan’s usage limits — a scan “may take a while, may use a significant number of tokens, and needs Claude Code left open.” Nothing runs until you confirm.
• Works best in auto mode, so the scan’s agents proceed without a permission prompt at each step; the plugin reminds you how to enable it when a job starts.

Scan scoping — full, diff, or focused area

Scope	What it reads	Requires git?
Whole repository	The working tree	No — works in any directory
Focused area (e.g. API layer, auth code)	One subtree; the run sizes itself to your pick	No
Branch diff	Commits your branch has that its base doesn’t	Yes
Pull request diff	One of your open PRs	Yes, plus gh signed in and already permitted
Single commit	e.g. “scan commit abc1234”	Yes

Two constraints worth internalizing:

• Change scans read only committed code. Commit or stash in-progress edits first, or run a full scan — the full scan is the one that reads the working tree.
• Exactly one step touches the network: finding your open pull requests, and only when the session already has permission to run the GitHub CLI. Everything else is local.

On a large repository the docs’ guidance is to scan one area at a time rather than the whole tree; the report’s coverage section states what was and wasn’t examined, so partial coverage is legible rather than silent.

What a scan writes to your repo

A scan’s only change to your checkout is one timestamped CLAUDE-SECURITY-<timestamp>/ directory containing:

• CLAUDE-SECURITY-RESULTS.md — the report. Each finding gets an ID (F1, F2, …) plus impact, exploit scenario, severity, confidence, and recommendation.
• CLAUDE-SECURITY-RESULTS.jsonl — the same findings machine-readable, one JSON object per line.
• CLAUDE-SECURITY-REVISION-<commit>.json — the revision stamp described above.

The directory ships its own .gitignore, so a stray git add can’t sweep a report into a commit. To keep a report for an audit trail, delete that one .gitignore and commit the directory normally.

Fixing findings

Pick Suggest patches from the menu, or say “fix finding F3”. Two guard rails matter:

• Stale reports are refused, not patched around. Patches are built against committed code and the report must still describe the code you have. Findings whose code has changed since the scan are skipped with a note, and the plugin offers a fresh scan rather than patching from a stale report.
• The reviewer runs your tests against the change when the code has them, and reads the diff on its own terms for anything new the patch might introduce.

git apply CLAUDE-SECURITY-<timestamp>/patches/F1.patch

Where it sits in the security stack

The docs’ own six-layer table — this expands the four-stage model documented in the security-guidance plugin article, adding the deep-scan and managed rows:

Stage	Tool	What it covers
In session	Security-guidance plugin	Common vulnerabilities in code Claude writes, fixed in the same session
On demand, single pass	/security-review	One-time security pass on the current branch
On demand, deep scan	Claude Security plugin	Multi-agent scan of a repository or diff, with independently reviewed findings and patches
On pull request	Code Review (Team and Enterprise plans)	Multi-agent correctness and security review with full codebase context
Managed	Claude Security product (Enterprise plan)	Hosted scanning that monitors connected repositories
In CI	Your existing static analysis and dependency scanners	Language-specific rules, supply-chain checks, policy enforcement

Anthropic is explicit that the plugin does not replace existing source-code security tooling: “it reasons about your code the way a human security researcher would, which complements the deterministic checks those tools provide.”

The Fable 5 classifier caveat — an escape hatch that is itself gated

The docs’ troubleshooting section states plainly: “You may see ‘Fable 5’s safeguards flagged this message’ when using Fable 5.” Certain model activities are blocked by Fable 5’s cybersecurity safety classifiers and automatically downgraded to Opus. “This is expected, and the scan should still complete successfully.”

This sharpens the existing wiki claim (from Boris Cherny, 2026-06-10, recorded in security-guidance-plugin and Fable 5) that routing legitimate security work through /security-review or Claude Security is the way around cyber-classifier false positives. The route is not outside the gate — the gate still fires inside a Claude Security scan. The difference is that it degrades to Opus and continues rather than refusing, which is what makes it a workable path.

Troubleshooting

• Python warning on menu open. The plugin needs python3 3.9.6+ on PATH. If no python3 exists, the menu warns the plugin won’t work; if the first python3 on PATH is older, the warning names the version it found. Install or reorder PATH, then start a new session.

Try It

1. Check the floor first: claude --version (need v2.1.154+) and python3 --version (need 3.9.6+). On Pro, open /config and enable the Dynamic workflows row — the scan cannot orchestrate its agents without it.
2. Install and activate: /plugin install claude-security@claude-plugins-official, then /reload-plugins.
3. Start with a diff, not the tree. Run /claude-security on a feature branch you’re about to merge — bounded scope, bounded token spend, and it tells you whether the findings are worth the cost of a full scan.
4. Turn on auto mode before a long scan, or you’ll be answering permission prompts for the duration.
5. Patch one finding end-to-end. Pick Suggest patches, choose a single finding, read the note beside the .patch file (especially whether the review ran with or without a test pass), then git apply it in its own PR.
6. Decide your report-retention policy up front. Default is gitignored-and-ephemeral. If you want an audit trail, delete the directory’s .gitignore and commit it — do this deliberately, since scan reports enumerate live exploit scenarios for your code.
7. Don’t retire your scanners. Keep SAST and dependency scanning in CI; slot this in as the on-demand deep pass between in-session guidance and PR review.

Related

• Claude Code Security-Guidance Plugin — the in-session layer above this one in the stack; free, hook-driven, pattern-check-plus-model-review.
• Dynamic Workflows — the orchestration primitive the scan is built on, and the reason for the v2.1.154 floor and paid-plan requirement.
• Auto Mode — the permission mode the plugin recommends for uninterrupted scans.
• Claude Code Plugins & Marketplaces — how /plugin marketplace add and /plugin install work.
• Code with Claude London 2026 — Opening Keynote — where Claude Security was demoed as overnight whole-codebase scanning with severity ranking.
• SkillSpector and DeepSec — third-party scanners covering the skill-supply-chain and vulnerability layers respectively.
• How We Contain Claude — Anthropic’s defense-in-depth framing that this stack operationalizes.
• Verifier-First Loops — the independent-verifier discipline this plugin applies twice (finding verification, then patch review).
• The Verification Frontier — why “an agent that checks another agent’s work” is the load-bearing pattern here.

Open Questions

• No published precision/recall or benchmark numbers. The security-guidance plugin shipped with a 30–40% PR-comment-reduction figure; this page publishes no equivalent effectiveness measure, and the acknowledged nondeterminism makes one harder to state.
• What “effort” levels exist. The revision stamp records “at what effort” a scan ran and “how thoroughly the run was verified,” but the page never enumerates the effort or verification levels or how to select one.
• Token cost has no published shape. “May use a significant number of tokens” is the only guidance; no per-KLOC or per-file estimate, and the cost of a full scan versus a focused scope is stated only as “relative cost” inside the menu.
• Relationship to the managed product’s fix flow is unstated. The keynotes described the managed Claude Security as able to spawn Claude Code sessions to fix findings; the plugin instead emits patch files you apply. Whether these converge is not addressed.
• Plugin release date not given. Resolved 2026-07-24 — launched in beta 2026-07-22. The docs page still carries no launch date (the v2.1.154 floor only bounds it from below), but three independent signals converge:
  1. First-party announcement. @claudeai posted the beta launch (raw/x-bookmarks-recent-digest-2026-07-24.md). Its status ID 2079990597973057691 decodes to 2026-07-22T18:02:57 UTC via the standard X snowflake epoch. The decoding method was validated against a post in the same corpus with an independently stated date — @NousResearch/2079285221418053758, which decodes to 2026-07-20T19:20 and whose own raw file records “Posted: ~2026-07-20”.^[the timestamp is derived from the status ID, not stated in the source; the method was cross-checked but the exact minute is a derivation]
  2. Community reaction the next morning. raw/reddit-1v48e9x.md — “Claude Code just added native codebase security scanning” (r/ClaudeAI, 345 score) — posted 2026-07-23T09:01:26Z, ~15 hours after the announcement. Image-only post, so it corroborates the timing rather than adding detail.
  3. Absent from the CLI changelog, as expected. Releases v2.1.216–218 (2026-07-20 to 07-22) mention nothing about security scanning, consistent with the plugin shipping through the claude-plugins-official marketplace rather than the CLI binary.
• How long does beta last, and what changes at GA? The beta label comes only from the launch tweet; the documentation does not mention it, so there is no stated scope, duration, or exit criteria.