Claude Security plugin (Claude Code)

Anthropic’s beta Claude Code plugin that runs a multi-agent vulnerability scan of a codebase from the terminal, released 22 Jul 2026 (covered by MarkTechPost — detailed technical secondary coverage of a first-party release, T2). Installed from the official marketplace (/plugin install claude-security@claude-plugins-official), it adds one /claude-security command with three modes: scan a codebase, scan changes (branch/PR/commit diffs), or suggest patches. Needs a paid plan, Claude Code v2.1.154+, and dynamic workflows enabled.

It matters here not as a security tool but as a shipped, first-party reference architecture for agent-orchestration with a real verification gate — the concrete instance of patterns this wiki has mostly seen described.

The pipeline

A JavaScript dynamic workflow distributes work across subagents through six declared phases: Inventory → Threat model → Research → Sweep → Panel → Adversarial. Research covers four vulnerability classes — injection-and-input, auth-and-access, memory-and-unsafe, crypto-and-secrets — and a memory-safe codebase skips the memory-unsafe lens, a small example of scoping the fan-out to the target rather than running every agent everywhere.

The roles are model-tiered, which is the model-choice lever applied inside one tool: an Opus-class orchestrator, Sonnet-class repository cartographer and code explorer, and researchers/verifiers that inherit the session model. Cheap-and-wide for mapping, expensive for coordination.

The part worth stealing: the panel

This is the strongest answer yet to the verification thread’s core problem — don’t trust a single agent’s say-so. A candidate finding does not enter the report because a researcher found it; it enters only after surviving a Panel: three independent verifiers judge REACHABILITY, IMPACT, and DEFENSES on a 2-of-3 quorum. Unanimous → “high” confidence; 2/3 → capped at “medium.” And the decisive detail —

the tally is computed in Python by the report renderer, not asserted by the model.

That closes the loop agent-evals and verification-loops-skills leave open: a model grading its own work can hallucinate the grade, so here the aggregation is taken out of the model’s hands and made programmatic and auditable. It is the adversarial-verification pattern hardened into a quorum with a mechanical tally — the same instinct as Harness computing eval pass/fail outside the agent (harness-agent-dlc), pushed down to individual findings. Patch suggestions get the same treatment: built in an isolated scratch clone (never the working tree), and an independent verifier confirms the change addresses the one finding, adds no new vulnerability, and leaves behavior otherwise unchanged, before you git apply by hand.

Honest scope

Anthropic states the limits plainly: scans are nondeterministic and “do not replace traditional static analysis, dependency scanning, or code reviews.” And a real agent-guardrails caveat — the plugin adds no isolation of its own; it inherits session permissions and .claude/ settings, so Anthropic recommends running it under sandbox-runtime for untrusted codebases. It sits in a documented ladder of Anthropic security surfaces (in-session guidance → the single-pass /security-review → this deep plugin → PR-time Code Review → hosted Claude Security → CI SAST), i.e. the on-demand deep tier, not a replacement for the pipeline.

Why it’s here, and the boundary

Security is the domain; the multi-agent orchestration + programmatic verification is the substance — the same reason cybersecurity-skills files here on its skill-pack form, not its security content. It is also a bridge to osint-wiki (defensive security tooling) — cross-link, don’t duplicate: the recon/OSINT spoke owns the security subject, this spoke owns the agent machinery.

Related

agent-orchestration · agent-evals · verification-loops-skills · harness-agent-dlc · agent-guardrails · anthropic-skills · claude-code-model-effort-levels · cybersecurity-skills