What security-guidance is
Three layers: regex warnings on Edit/Write for ~25 dangerous patterns, a fast-LLM diff review at turn end, and an SDK-driven reviewer on git commit.
What it does
Where security-guidance runs and what it adds, from its documentation- Warns on yaml.load, pickle.load, innerHTML, hardcoded secrets etc.
- Reviews diffs when Claude finishes a turn
- Agentic commit review traces cross-file data flow (IDOR, auth bypass, SSRF)
- Configured via environment variables
When to use it
Good fit
- Catching vulnerabilities in AI-generated code
Not for
- Replacing a full security audit
How to install security-guidance
You need: Claude Code CLI >= v2.1.144; Python 3.8+ on PATH; Working API path (subscription, API key or 3P provider)
- Marketplace ships enabled by default in Claude Code; or browse via /plugin > Discover
- Install: /plugin install security-guidance@claude-plugins-official
- Run the plugin's commands/agents as described in its README
- Trust check: Anthropic warns to trust a plugin before installing, as it cannot verify included MCP servers, files or software
Permissions and security
What it can access
- Runs inside Claude Code; commands, agents and hooks use Claude Code's tool permissions (see plugin README for specifics)
Security notes from the maintainers
- Marketplace README: make sure you trust a plugin before installing, updating, or using it
Review the source before granting an agent access to credentials or production systems. We document what the maintainers state; we do not audit code.
No user reviews yet
Anthropic's agentic coding tool that reads your codebase, edits files and runs commands from the terminal, IDEs, desktop app or browser.
Watch out: Not included in the Free Claude plan, and usage on subscriptions is capped by plan limits.
Listed Not yet reviewed
Verified
code.claude.com ↗ (opens Claude Code website in a new tab)
Frequently asked questions
How do I install the security-guidance plugin?
Run /plugin install security-guidance@claude-plugins-official in Claude Code. source
Is the security-guidance plugin made by Anthropic?
Yes, it is listed under /plugins (internal plugins developed by Anthropic) in the claude-plugins-official repo. source
What does the security-guidance plugin add to Claude Code?
Security review for Claude-written code: pattern warnings, LLM diff review on Stop, agentic commit review. source
Sources and gaps
Not stated by the maintainers: last_release (not read); limitations not stated in README; version 2.0.8 per plugin.json.
