|

Anthropic Releases Claude Security Plugin for Claude Code in Beta: A Multi-Agent Vulnerability Scanner That Runs in Your Terminal

ByRicardo

Anthropic has launched the Claude Security plugin for Claude Code in beta. The plugin runs a multi-agent vulnerability scan of a repository from inside an present Claude Code session, then turns the findings you choose into patch recordsdata that you simply overview and apply your self. Anthropic emphasised the software’s versatility upon announcement, highlighting its functionality to both run a complete scan throughout the complete codebase or examine adjustments from the terminal proper earlier than a commit.

What plugin provides

The plugin provides a single command, /claude-security, which opens a menu of three jobs, per the official documentation:

  • Scan codebase — the entire repository or a scoped subset of it
  • Scan adjustments — a department’s diff, a pull request’s diff, or a single commit
  • Suggest patches — flip a report’s findings into .patch recordsdata

Installation is 2 instructions from the official Anthropic marketplace:

Copy Code
/plugin set up claude-security@claude-plugins-official
/reload-plugins

If {the marketplace} is just not discovered, run /plugin market add anthropics/claude-plugins-official first. The plugin supply is public in the claude-plugins-official repository, presently at model 0.10.0.

How the scan pipeline is structured

The scan is applied as a dynamic workflow — a JavaScript orchestration script that followers work out throughout subagents. The script declares six phases:

  1. Inventory: partition the repository into parts. Every top-level listing have to be both scanned or explicitly skipped with a cause.
  2. Threat mannequin: one modeler per part, producing entry factors, sinks, belief boundaries, and recordsdata a researcher should learn in full.
  3. Research: one researcher per part × class cell.
  4. Sweep: gap-fill over what the matrix didn’t cowl.
  5. Panel: three-lens adversarial verification, one voter per lens.
  6. Adversarial: max effort solely: re-panel marginal retains, then red-team each survivor.

Research runs in opposition to 4 mounted classes: injection-and-input, auth-and-access, memory-and-unsafe, and crypto-and-secrets. The memory-and-unsafe lens is dropped for parts written completely in memory-safe languages, so a pure Python or TypeScript part will get three lenses as a substitute of 4.

The operational scale of a run is dictated by 4 distinct effort tiers: low, medium, excessive, and max. Depending on the chosen tier, particular thresholds are enforced: the utmost variety of parts is capped at 12 for low and medium tiers, increasing to 24 for excessive and max tiers; matrix cells are assigned 1 researcher, which will increase to 2 on the excessive and max ranges; and the variety of gap-fill sweeps scales from 0 at low, to 1 at medium, as much as 2 for excessive and max. When coping with a restricted scope or a small diff, the method condenses right into a single-researcher configuration as a substitute of deploying all the matrix. This ensures the analysis stays strictly proportionate to the goal whereas sustaining the an identical verification customary.

The system employs model-tiered brokers: the orchestrator runs on Opus, whereas the repository cartographer and read-only code explorer run on Sonnet. Furthermore, the session mannequin is inherited by researchers and verifiers, and scan brokers are restricted completely to read-only instruments.

How a discovering earns its place in the report

This is the half price understanding intently. A candidate discovering doesn’t go into the report as a result of a researcher discovered it. It goes in solely after surviving a panel.

Each candidate is handed to a few unbiased verifiers, one per lens: REACHABILITY, IMPACT, and DEFENSES. Each returns a structured verdict of TRUE_POSITIVE or FALSE_POSITIVE with one or two strains naming the decisive file:line. The preserve quorum is 2 of three. If fewer than three voters return, the candidate is just not keepable in any respect.

The panel end result additionally caps the discovering’s said confidence. A unanimous 3/3 panel permits a confidence ceiling of excessive; a 2/3 quorum caps it at medium. A discovering can’t declare extra confidence than its verification earned.

Critically, the tally is computed in Python by the report renderer, not asserted by the mannequin that produced the findings. The revision stamp’s verification.standing is ready to verified solely when the vote document proves the panel ran for each discovering in the report; in any other case it’s unverified with a said cause. That makes the report’s personal account of its rigor one thing you may test slightly than one thing you tackle belief.