security-guidance for Claude Code: review, how it works and whether it is worth it (2026)

What you get in one minute#

security-guidance is a free Anthropic plugin that checks the code Claude writes for security mistakes, in three layers, and it is worth having for web or server code if you can spare the extra model usage.

Logo: the official Claude Code logo from Anthropic's press kit (anthropic.com/press-kit)

The marketplace page shows 241,800 installs (October 2026). It never blocks anything: it hands findings back to Claude.

What it does#

You do nothing: once installed, it runs by itself while Claude works. There is no command to type.

• Layer 1, each edit: 25 text rules (for example eval(, innerHTML, pickle, yaml.load, GitHub Actions files) warn Claude at once. No model, no cost.
• Layer 2, each finished turn: the changes of that turn go to an Opus review in the background. Findings come back to Claude to fix.
• Layer 3, each git commit or git push Claude runs: an agent reads related files to trace data flow, for bugs a single file hides.
• Your own rules: add claude-security-guidance.md (text for the reviewer) or security-patterns.yaml (extra regex rules).
• Added to Claude Code: 5 hook events, 0 skills, 0 slash commands, 0 agents, 0 MCP servers. The marketplace page still describes an older "pre-tool hook".

How it works in the background#

Python hooks watch three moments, and each layer feeds its findings back into Claude's context. The picture follows one change.

• Background reviews use asyncRewake: a hook that exits with code 2 wakes Claude with the findings (hooks docs).
• Caps: 30 files per turn, 3 fix rounds in a row, 20 commit reviews per hour.

Under the hood: dissection#

security-guidance is about 12,000 lines of Python and Bash hooks, with no skills or prompts to load: it is real code that runs on every prompt, edit, stop and commit.

The file tree#

security-guidance/
├── .claude-plugin/plugin.json     name, version 2.0.17
├── LICENSE                        Apache 2.0
├── README.md                      settings, privacy, cost
├── hooks/
│   ├── hooks.json                 5 hook events, all run through sg-python.sh
│   ├── sg-python.sh               Bash: finds a working Python 3
│   ├── ensure_agent_sdk.py        builds the venv, installs claude-agent-sdk
│   ├── security_reminder_hook.py  the main hook: every event ends here
│   ├── patterns.py                the 25 regex rules and their warnings
│   ├── llm.py                     the model calls and the reviewer prompts
│   ├── review_api.py              API request helper
│   ├── gitutil.py, diffstate.py   git snapshot, diff, caps, state
│   ├── reporesolve.py             finds the repo to review
│   ├── extensibility.py           loads your rule files
│   ├── session_state.py, _base.py state, logging, output format
└── tests/                         45 test files

What each file is#

Key excerpts#

hooks/hooks.json, the commit review:

{ "type": "command",
  "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/sg-python.sh\" \"${CLAUDE_PLUGIN_ROOT}/hooks/security_reminder_hook.py\"",
  "if": "Bash(git*commit*)", "asyncRewake": true }

hooks/patterns.py, one of 25 rules:

"ruleName": "eval_injection",
"regex": r"(?<![a-zA-Z0-9_\.])eval\(",   # skips model.eval(), redis.eval()

Disk and network#

• Writes: ~/.claude/security/ (state, a log that rotates at 1 MB, the venv), temporary git index copies, and your optional rule files are read.
• Network: pip install claude-agent-sdk once (unpinned), then model calls. By default your diff hunks, paths and file contents go to api.anthropic.com, or to your gateway or cloud provider.
• Needs: Bash, Python 3.10+ for the agent review, git, and a Claude sign-in or API key.

Chart: line counts from the plugin folder at commit 41f619d, 27 October 2026.

What users say#

27 reports read: 2 praise, 4 mixed, 21 complaints, but that split is skewed. GitHub issues attract complaints. Most name versions 2.0.6 to 2.0.13, not 2.0.17, and we did not test the fixes. Hacker News had no thread; Reddit was not read.

Chart: our count of the 27 reports, October 2026. Not a satisfaction rate.

Chart: themes of the 21 complaints, labelled by DIY Lab Hub, October 2026.

Pros: why it is useful#

It adds a second pair of eyes on Claude's code at almost no effort, and it is built by Anthropic.

• Free first layer: the regex rules cost nothing and add context only when a rule matches.
• Separate reviewer: layers 2 and 3 start from the diff in a fresh context (docs), so Claude does not grade itself.
• Cross-file bugs: the commit reviewer reads callers and sanitizers, which one-file checks cannot.
• Tunable: a cheaper model, any layer off, and your own rules.

Cons: why it is not useful#

It costs usage, sends code to a model, and has been buggy.

• Cost: Opus reviews each turn and commit; no in-session cost view.
• Privacy: diffs and file contents leave your machine.
• Quality: false positives and a few invented findings were reported.
• Gaps: commits you run yourself are not reviewed; no dependency or CI scanning.
• Overlap with /security-review and the Claude Security plugin.

Should you consider it? When it is useful#

Consider it for web, API and server code, and tune it first; skip it for throwaway scripts or if code cannot leave your machine.

Install and check it#

One command inside Claude Code installs it from Anthropic's official marketplace. You need Python 3.10+ and git.

Linux#

/plugin install security-guidance@claude-plugins-official

Or from your shell: claude plugin install security-guidance@claude-plugins-official.

Windows (PowerShell)#

Install Git for Windows first (the hooks run through Bash), then:

claude plugin install security-guidance@claude-plugins-official

Mac (Terminal)#

claude plugin install security-guidance@claude-plugins-official

Check it worked#

claude plugin list

Then ask Claude to write a file containing eval(userInput): a "Security Warning: eval() executes arbitrary code" note should appear. The log is ~/.claude/security/log.txt ($HOME\.claude\security\log.txt on Windows). If /plugin is "not available in this environment", use the shell command above.

Things to keep in mind#

• Security: it runs your Python on every prompt and edit, and installs the latest claude-agent-sdk from PyPI at session start. Read hooks/hooks.json first.
• Privacy: your claude-security-guidance.md is added to every review prompt: no secrets in it.
• Update channel: the marketplace; versions move fast (2.0.6 to 2.0.17 in about four months of the issue reports).
• Conflicts: none known; it overlaps with /security-review.
• Organisations can switch it on with enabledPlugins, or block marketplaces.
• Off switches: SECURITY_GUIDANCE_DISABLE=1, or /plugin disable security-guidance@claude-plugins-official.

Troubleshooting#

FAQ#

Is it made by Anthropic? Yes. It is in Anthropic's own marketplace, listed as "Anthropic verified".

Does it block bad code? No. Findings go to Claude as instructions; nothing stops a write or a commit.

How do I make it cheaper? Set SECURITY_REVIEW_MODEL and SG_AGENTIC_MODEL to a smaller model, or turn the model layers off.

Does it replace /security-review or CI scanning? No. The docs call it one layer next to /security-review, Code Review and your own scanners.

Sources#

• security-guidance in anthropics/claude-plugins-official: README, hooks/, plugin.json and the marketplace entry at commit 41f619d (27 October 2026).
• Catch security issues as Claude writes code, Hooks reference and the marketplace listing: official pages (October 2026).
• User reports, GitHub issues in claude-plugins-official: 5067, 6609, 6355, 5331, 5330, 5558, 6854, 5934, 5066, 6097, 2697, 2011; in claude-code: 96860, 99840, 98731, 92146, 96148, 96276, 90010, 102567, 101548, 85421 (May to October 2026).
• Articles: Help Net Security (May 2026), mer.vin (May 2026), Inventive HQ (June 2026), VibeDoctor (September 2026), apito.ai (2026).

Not run by DIY Lab Hub: we read the code and docs but did not install the plugin on a test machine.

Checked against the official docs on 2026-10-27