What Is the Claude Security Plugin — and How Does It Work?

Claude Security is an official plugin for Claude Code, Anthropic’s command-line coding tool, that runs a multi-agent scan of a codebase to find security vulnerabilities and turn them into fixable patches. Instead of matching code against a fixed list of unsafe patterns, it sends a team of separate AI agents through the repository: one maps the architecture, another builds a threat model, others hunt for concrete vulnerabilities, and independent reviewer agents check every finding before it ever reaches the report.

What it is

Claude Security is a plugin you install explicitly — it isn’t switched on by default. That matters because Anthropic ships several tools with overlapping names. A separate “security guidance” plugin reviews code line by line as Claude writes it, catching problems before they ever reach a pull request. Claude Security is different: it’s an on-demand, deeper scan you point at an entire repository, a branch’s diff, a pull request, or a single commit. There’s also a separate hosted “Claude Security” product built for enterprises that want continuous monitoring of connected repositories — the plugin covered here is the version any individual developer can run locally, and it can reach code the hosted product can’t, such as repositories on GitLab or Bitbucket.

How it works

Running /claude-security inside a Claude Code session opens a menu: scan the whole codebase, scan just a set of changes, or turn existing findings into patches. A full scan proceeds in stages — mapping how the code is structured, building a threat model of what an attacker could target, then hunting for concrete vulnerabilities such as injection flaws, authentication bypasses, insecure direct object references, and weak cryptography. Every candidate finding is then handed to a separate reviewer agent, which has to independently confirm it’s real before it’s written up. That verification step exists because scans are nondeterministic — two runs over identical code can surface different results — so only findings that survive review make it into the final report.

Results land in a timestamped folder inside the repository: a Markdown report, a machine-readable version of the same findings, and a stamp recording exactly which commit was scanned. Asking the plugin to suggest patches then drafts a fix for each finding you pick, working in a scratch copy of the repository so the actual working files stay untouched. A second, independent agent reviews each patch — running the project’s tests against it when there are any — before it’s written to disk. Nothing is applied automatically: every patch still has to be applied by hand, typically with git apply, in its own pull request.

Why it matters

Traditional static-analysis tools match code against known-bad patterns, which is fast but blind to bugs that only turn dangerous in context — a database query that looks safe in isolation but becomes exploitable once combined with how another file calls it, for example. Because Claude Security reasons about the whole codebase rather than one file at a time, it can catch that kind of context-dependent bug much the way a human security researcher tracing data flows across files would. It isn’t a replacement for other layers of AI-powered code security auditing — Anthropic positions it as one layer in a defense-in-depth stack that still needs pull-request review, CI scanners, and dependency checks — but it gives any team, even one without a dedicated security engineer, a way to run that kind of deep, cross-file review whenever they want.

Running a scan costs nothing beyond ordinary Claude usage, but it does require at least a paid plan: as of July 2026, per Claude’s pricing page, Claude Pro starts at $20 a month billed monthly (or $17 a month billed annually), and each scan or patch run counts against that plan’s usage limits like any other request. The plugin itself installs for free from Anthropic’s official marketplace inside a Claude Code session — see the installation guide for the exact commands, which also lists the version and Python requirements a scan needs to run. Anthropic’s broader push into security tooling reflects how central Claude has become to how code actually gets written.

In the news

Anthropic rolled the plugin out in beta alongside a wider Claude Code update — see our brief on the launch.