Anthropic brings Claude Security scans to Claude Code beta

Anthropic has documented a Claude Security plugin for Claude Code that runs vulnerability scans from inside a paid Claude Code session. The beta plugin can scan a full repository, a scoped area, a branch diff, a pull request diff, or a single commit, then produce patch files that the developer reviews and applies manually.

This matters because security review is moving into the same agent loop that writes and edits code. The useful detail is not that Claude can "look for bugs"; it is that Anthropic is separating scan, verification, and patch application instead of letting one agent silently rewrite a codebase.

Claude Security adds a deep-scan command

The plugin adds one main command, /claude-security, with three jobs: scan codebase, scan changes, and suggest patches. Anthropic's documentation says the scan maps repository architecture, builds a threat model, hunts for vulnerabilities, and has independent agents review findings before a report is written.

The plugin is installed from Anthropic's official Claude plugin marketplace as claude-security@claude-plugins-official. If the marketplace is not already present, users add anthropics/claude-plugins-official first. The public GitHub repository is also useful for teams that want to inspect the marketplace source and plugin structure before approving it.

Access is not universal. The docs list Claude Code v2.1.154 or later, a paid plan, dynamic workflows, Python 3.9.6 or later, and Git for change scans and patch generation. Full scans can run outside version control, but diff and patch workflows need Git state.

Reports are tied to the scanned revision

Every scan writes a timestamped CLAUDE-SECURITY-<timestamp>/ directory into the repository. The report includes a Markdown summary, a JSONL findings file, and a revision stamp that records the commit, effort level, whether uncommitted changes were included, and how thoroughly the run was verified.

That revision stamp is the part teams should preserve. Security scans become much less useful when nobody can answer which code was actually reviewed. Anthropic's design makes the scanned commit and coverage explicit, while also noting that scans are nondeterministic and may surface different findings across runs.

The report directory includes its own .gitignore, so a routine git add should not accidentally commit scan artifacts. Teams that need an audit trail can remove that ignore file and commit the report deliberately.

Patch files stay outside the working tree until review

The patch workflow starts from a finding in the report. Claude Security drafts each patch in a scratch copy of the repository, then has an independent agent review whether the change fixes the finding, avoids introducing a new vulnerability, and preserves behavior outside the intended security fix.

If that review passes, the plugin writes a patch file under the report's patches/ folder. It does not apply the patch automatically. Developers still run git apply, review the diff, run their own tests, and ideally ship each security fix in a separate pull request.

Where it fits in a security stack

Anthropic now has several overlapping security surfaces in Claude Code. The security guidance plugin checks code as Claude writes it. /security-review provides a single-pass branch review. Code Review runs at pull-request time for eligible plans. Claude Security is the deeper on-demand scan for repositories or diffs.

That layering is useful, but it can also become expensive and noisy if teams turn everything on without a policy. The practical setup is to keep deterministic SAST, dependency scanning, and secret scanning in CI, then use Claude Security on high-risk areas: authentication, authorization, payment flows, admin surfaces, file upload paths, and agent/tool execution code.

Teams using LinkLoot's AI workflow guidance should treat this as another checkpoint in an agentic development flow, not as final approval. A good pattern is: generate or refactor with an agent, run local tests, run Claude Security on the changed scope, review the patch suggestions, then let CI and human review decide what lands. For broader agent tooling choices, see the LinkLoot guide to AI agent tools.

Source check

The primary source is Anthropic's Claude Code documentation for the Claude Security plugin. The official anthropics/claude-plugins-official repository corroborates the marketplace and plugin distribution surface, while MarkTechPost independently reported the beta release and summarized the command flow, verification model, and patch-review behavior.

The beta label matters. Teams should verify current Claude Code version requirements, plan access, token usage impact, and marketplace approval rules before adding the plugin to shared repositories or managed developer environments.