By ByteBot
Anthropic shipped the Claude Security plugin for Claude Code on July 22, and it is not another linter dressed up in AI clothing. The plugin runs a coordinated team of subagents — an Opus orchestrator, Sonnet mappers, and per-session researchers — directly in your terminal to find injection flaws, authentication bypasses, and business logic errors that tools like Semgrep were never designed to catch. Here is what it actually does, how to get it running in under five minutes, and where it belongs in your stack next to the scanners you already use.
A Six-Phase Pipeline, Not a Smarter grep
The core distinction worth understanding before you install anything: Claude Security runs a dynamic workflow of subagents across six phases. First, an inventory agent partitions your repository into components — every top-level directory must be scanned or explicitly skipped with a documented reason. Then, threat modelers spin up per component and produce entry points, sinks, trust boundaries, and a list of files that need full reads. Research agents fan out across those files hunting for vulnerabilities. A sweep phase catches what the focused research missed. Finally, every finding goes to a three-voter adversarial panel (REACHABILITY, IMPACT, DEFENSES) that requires a 2-of-3 quorum to pass. If the panel is split, confidence is capped at medium — the plugin will not overstate certainty to save you time.
That last part matters more than it sounds. Most AI-assisted security tools serve you whatever they find and let you sort it out. The adversarial panel is a meaningful architectural decision: a second agent, independent of the one that found the issue, drafts a patch in a scratch copy and runs your tests before vouching for the change. Patches never apply automatically. You get .patch files to review, not surprise commits.
Requirements and Setup (Five Minutes)
Before you run the install command: Claude Code v2.1.154 or later, Python 3.9.6+ available as python3 on your PATH, Git installed, and Dynamic Workflows enabled in /config. If you are on a paid plan and have been using Claude Code recently, you almost certainly meet all of these already.
Individual install:
/plugin install claude-security@claude-plugins-officialFor organizations, admins enable the plugin for the whole team from the admin console at claude.ai/admin-settings/claude-code. Once enabled, every Claude Code user in the org gets the /claude-security command without individual installs.
Three Commands and the One You Will Actually Use Daily
The plugin adds a single entrypoint, /claude-security, with three jobs:
# Scan the full repository or a scoped subset
/claude-security scan codebase
# Scan a branch diff, PR diff, or a single commit
/claude-security scan changes
# Turn findings into .patch files to review
/claude-security suggest patchesThe command you will reach for every day is scan changes. Run it against your PR diff before you push and you get a semantic review of exactly what changed, not a full-repo scan that burns through token limits. On a medium-sized codebase, scan changes typically completes in a few minutes and surfaces issues that only make sense in the context of the diff — an authorization check that your new endpoint forgot, a data flow you opened up by refactoring a helper function.
What It Catches That Snyk and Semgrep Miss
Both tools are worth keeping. Snyk‘s dependency CVE database and reachability analysis are industry-leading for open-source package vulnerabilities — Claude Security does not touch SCA at all. Semgrep’s pattern engine runs in seconds, is CI-native, and lets your security team write policy-as-code in YAML. Neither tool reasons across files to catch a logic flaw that spans an authentication middleware and a downstream handler.
That is the gap Claude Security fills. The 2026 data is uncomfortable: AI-assisted developers produce commits 4x faster than their peers but introduce security findings at 10x the rate, and 45% of AI-generated code samples carry OWASP Top 10 vulnerabilities. Pattern matchers were built for human-written code at human velocity. They were not built for a codebase where a vibe-coded session added 1,200 lines in an afternoon. The multi-agent semantic scan is.
| Tool | Best For | Gap |
|---|---|---|
| Claude Security | Business logic, multi-file data flows, novel injection patterns | No SCA, no SIEM output, nondeterministic |
| Snyk | Dependency CVEs, container scanning, OSS reachability | Cannot reason about logic flaws |
| Semgrep | Fast CI gates, policy-as-code, custom org patterns | Only catches patterns it was taught |
The Honest Limitations
Claude Security is in beta, and Anthropic is not hiding the rough edges. Scans are nondeterministic — two runs on the same codebase can produce different findings. Large repositories hit session crashes and token limits. There is no SARIF or JSON output yet, which means no feeding findings into your SIEM or making them a hard CI gate. The plugin runs under your session permissions with no additional isolation, so treat unfamiliar repositories with sandbox-runtime. And if your compliance environment requires code to never leave the perimeter, this is not a fit in its current form.
Worth Installing Today
If you are on a paid Claude Code plan, install the plugin. The scan changes command alone justifies the five-minute setup — it catches the category of AI-generated vulnerability that pattern tools consistently miss, and it does it inside the workflow where you already spend your day. The adversarial voter panel is not theater. For a beta, the architecture shows Anthropic is taking false positive rates seriously, which is the problem that killed developer trust in earlier generations of security tooling. Use it alongside Snyk and Semgrep, not instead of them, and your coverage across the full vulnerability surface is genuinely strong.
