Claude Security puts a team of agents to work inside your Claude Code session: map the architecture, build a threat model, hunt across components, and independently verify every finding before it reaches the report. Optionally it turns confirmed findings into patch files that you review and apply. It is the in-session version of Anthropic's hosted Claude Security product.
Was es kann
Wo Claude Security läuft und was es ergänzt, laut Dokumentation
Scan codebase: whole repository or a scoped part at a chosen effort tier
Scan changes: a branch diff, a PR diff, or one commit
Suggest patches: turns a report's findings into F.patch files, never applied automatically
Writes CLAUDE-SECURITY-RESULTS.md, .jsonl and .sarif (SARIF 2.1.0) plus a revision stamp
Verifiers try to disprove each finding; false positives are discarded
Wann Sie es einsetzen sollten
Gut geeignet
Scanning your own repositories for vulnerabilities before release
Reviewing a feature branch or PR diff for security flaws
Producing SARIF for GitHub code scanning or IDE viewers
Nicht geeignet für
Untrusted third-party repositories, unless the whole session runs inside sandbox-runtime
Replacing SAST, dependency scanning or code review (README says it complements them)
So installieren Sie Claude Security
Sie benötigen: Claude Code; Python 3.9 or newer on PATH; A git checkout for scanning changes and suggesting patches (whole-repo scan works without one); README recommends Claude Opus 5.5 or Fable 5.1
If marketplace not found: /plugin marketplace add anthropics/claude-plugins-official, then retry
Run /claude-security for the menu, or e.g. /claude-security scan my branch at high
Berechtigungen und Sicherheit
Worauf es zugreifen kann
Runs in your Claude Code session under your permissions, reads the open repository, adds no isolation of its own
Writes a CLAUDE-SECURITY-/ directory with a .gitignore into the repository
Patches are developed in a scratch copy; nothing is applied, committed or pushed for you
Sicherheitshinweise der Maintainer
Repository's .git/config, .claude/ settings and hooks, and CLAUDE.md apply as in any session; use sandbox-runtime for untrusted code
Credential values are redacted by an agent on a best-effort basis; review files before sharing
Usage-count telemetry via Claude Code; disable with DISABLE_TELEMETRY=1, DO_NOT_TRACK=1 or CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC=1
Repository text is treated as data, but this is not a defense against a hostile repository
Prüfen Sie den Quellcode, bevor Sie einem Agenten Zugriff auf Zugangsdaten oder Produktivsysteme geben. Wir dokumentieren die Angaben der Maintainer; Code prüfen wir nicht.
Einschränkungen
Scans are nondeterministic; two scans of the same code can surface different findings
A patch is written only when review vouches for it; otherwise you get a note
Das agentische Coding-Tool von Anthropic, das Ihre Codebasis liest, Dateien bearbeitet und Befehle ausführt, im Terminal, in IDEs, in der Desktop-App oder im Browser.
Kostenlos bis: Kein kostenloser Tarif: Claude Code ist in den bezahlten Claude-Abonnements (Pro, Max, Team, Enterprise) enth…
