Claude Security for Claude Code: review, how it works and whether it is worth it (2026)

What you get in one minute#

Claude Security is Anthropic's own plugin that scans your code for vulnerabilities with a team of agents that try to disprove every finding; it is worth it for a deep check of code you own before a release, but it is expensive in usage and not for everyday use.

Logo: the official Claude Code logo from Anthropic's press kit (anthropic.com/press-kit)

The marketplace page shows 8,580 installs (October 2026). The plugin is in beta.

What it does#

You run /claude-security, pick a job, and a scan writes a report folder into your repository.

Effort tiers are low (one researcher, then the panel), medium (the default) and high (more passes). Added by the plugin: 1 skill, 9 agents, 1 workflow, 4 hook events, 0 MCP servers, one command.

How it works in the background#

One skill runs the conversation, one JavaScript workflow fans the work out to agents, and Python scripts do the counting so the model cannot inflate its own results.

• Steps 5 to 7 run as the claude-security:scan workflow, shown live in /workflows.
• The panel has three voters with different lenses (reachability, impact, defenses) and a 2-of-3 rule. Their instruction starts with "Default to FALSE_POSITIVE."

Under the hood: dissection#

About half the plugin is Python (208 KB) that does bookkeeping and reporting, and half is Markdown prompts (194 KB) that tell the agents how to behave. We read all 46 files at commit ca08d5e.

The file tree#

claude-security/
├── .claude-plugin/plugin.json       name, version 0.12.0, author Anthropic
├── hooks/
│   ├── hooks.json                   4 hook events
│   ├── hooks.sh                     picks a Python 3.9+ and runs hooks.py
│   └── hooks.py                     banner, usage counts, scan tip, 60 s timeout
├── skills/claude-security/
│   ├── SKILL.md                     the front-desk menu
│   ├── role.md                      the "Security Lead" rules
│   ├── jobs/ scan-codebase.md, scan-changes.md, suggest-patches.md
│   └── specs/ report-spec.md, patch-spec.md
├── agents/                          9 agents (below)
├── workflows/scan.js                the scan pipeline, minified, 60 KB
├── scripts/
│   ├── write_scan_meta.py, save_result.py, render_report.py, patch_artifacts.py
│   ├── keep-waiting.sh
│   └── lib/                         14 helpers (SARIF, CWE, findings, strict JSON)
├── README.md, SECURITY.md, NOTICE.md, LICENSE

What each file is#

Two key excerpts#

hooks/hooks.json (shortened) runs a tip after a push or a new pull request:

"PostToolUse": [{ "matcher": "Bash", "hooks": [
  { "command": "sh \"${CLAUDE_PLUGIN_ROOT}/hooks/hooks.sh\" tip push || true",
    "if": "Bash(git push *)", "timeout": 5 } ] }]

agents/scan-verifier.md: tells each voter to "try to disprove it".

Models, disk and network#

• Models: most agents use your session model; inventory, loader, redactor and explore use Sonnet.
• Writes: one CLAUDE-SECURITY-<time>/ folder and scratch clones for patches.
• Network: none in the scripts; the optional pull-request list uses gh if allowed.
• Needs: python3 3.9+, git for change scans and patches, dynamic workflows.

Chart: file sizes in plugins/claude-security at commit ca08d5e, read in October 2026.

What users say#

18 reports read: 2 praise, 5 mixed or neutral, 11 complaints, and the split is skewed. Reddit was not read; one Medium post was blocked (403), so only its title counts.

Chart: our count of the 18 reports, July to October 2026. Not a satisfaction rate.

Chart: themes of the 11 complaints, labelled by DIY Lab Hub.

Pros: why it is useful#

It looks for real attack paths and shows its work, which is what you want from a security review.

• Short reports: a finding must survive three verifiers and a 2-of-3 vote, so you read fewer false alarms (Anthropic's claim; no independent false-positive rate exists).
• Honest numbers: Python computes the tally, and the report lists what was not examined.
• Safe by design: it never applies, commits or pushes; patches are built in a scratch clone and reviewed.
• Free to install, runs on your own checkout, also on Bedrock, Vertex and Foundry.

Cons: why it is not useful#

It is a heavy, beta tool that can eat a day's usage, and it is not a sandbox.

• Cost is unpredictable: verifiers scale with candidates and there is no time limit (a maintainer says this is intended).
• Setup friction: Workflow tool problems blocked several first runs.
• Nondeterministic: two scans can differ.
• No isolation: a hostile repository's .claude/ hooks apply as usual (its SECURITY.md says so).
• Overlaps with /security-review and security-guidance; no SAST replacement.

Should you consider it? When it is useful#

Consider it for a scoped deep scan of your own code before a release or a big merge, and skip it as a daily tool. Start with one area or one branch diff.

Install and check it#

You install it from Anthropic's official marketplace with one command.

Linux#

Inside Claude Code:

/plugin install claude-security@claude-plugins-official
/reload-plugins

Check python3 --version shows 3.9 or newer first.

Windows (PowerShell)#

Make sure python3 runs, then start claude and enter the same two lines. Hooks start with sh, so install Git for Windows if the menu warns (our reading, not tested).

python3 --version
claude

Mac (Terminal)#

python3 --version
claude

Then enter the install lines from the Linux section at the prompt.

Check it worked#

Run /claude-security: a banner and a three-option menu appear. Run /model first (the README recommends Opus 5.5 or Fable 5.1). A cheap first test: /claude-security scan my branch at low.

Things to keep in mind#

• Security. It runs under your permissions with no isolation. Sandbox untrusted code (sandbox-runtime).
• Secrets. A model masks credentials in the report on a best-effort basis; read it before sharing.
• Privacy. Usage counts go through Claude Code telemetry; DISABLE_TELEMETRY=1 stops them, CLAUDE_SECURITY_SCAN_TIP=off stops the push tip.
• Licence. Proprietary: internal use with Anthropic products only.
• Updates. No version pin, so it auto-updates; behaviour changed between 0.10 and 0.12.

Troubleshooting#

FAQ#

Is this the hosted Claude Security product? No. That one is for Enterprise and can use Claude Mythos; the plugin uses your Claude Code models.

Does it change my code? No. It writes a report folder and, if you ask, patch files you apply yourself.

How is it different from security-guidance? That plugin warns while Claude writes code; this one does an on-demand deep scan.

Does my code leave my machine? The model in your session reads it, as in any Claude Code work; the scripts open no connections.

Sources#

• plugins/claude-security: 46 files and marketplace entry, commit ca08d5e (October 2026).
• Marketplace page (install count) and product page (October 2026).
• Official docs: Claude Security, workflows, plugin security (October 2026).
• User reports, GitHub: 4415, 4428, 6606, 81018, 80281, 88151, 92317, 102096, 104581, 104448 (July to October 2026).
• User reports, web: Classmethod, AI Disruption, Build Fast with AI, Valletta Software, Pasquale Pillitteri, Cyber Security News, Medium post (title only), Hacker News thread (July to September 2026).

Not run by DIY Lab Hub: we read the files and docs but did not install the plugin or run a scan.

Checked against the official docs on 2026-10-27