Does it scan code outside a Claude Code session?

No. Scanning runs entirely inside your Claude Code session.

How are false positives handled?

Every finding is challenged before it is reported, and the verification tally is computed in code, so only findings that survive are reported.

Does it fix the vulnerabilities it finds?

Yes. Findings that survive verification are turned into targeted patches, each verified by a panel of agents.

Can I control how deep the scan goes?

Yes. You choose an effort tier for the scan.

claude-security

PackSecurity

claude-security is a security plugin that runs deep vulnerability scanning of your own code inside a Claude Code session. It scans at a chosen effort tier, challenges every finding before reporting it, and computes the verification tally in code. Findings that survive are turned into targeted patches, each verified by a panel of agents.

Unavailable. A Claude Code plugin. It installs in Claude Code, and ahel does not serve packs through its connector yet.

In Claude Code, run:

/plugin install claude-security@claude-plugins-official

It installs from Anthropic's official plugin marketplace.

What your AI can do with it

Deep vulnerability scanning of your own code inside a Claude Code session
Runs scans at a chosen effort tier
Challenges every finding before it is reported
Computes the verification tally in code
Turns surviving findings into targeted patches
Verifies each patch with a panel of agents

Getting started

Have a Claude Code session with the code you want scanned available.
Install the claude-security plugin.
Choose an effort tier for the scan.
Run the vulnerability scan and review the challenged findings and verification tally.
Apply the targeted patches produced for findings that survived verification.

Signals

GitHub stars: 37k
Forks: 4k
Last commit: Sep 2026

Questions

Does it scan code outside a Claude Code session?: No. Scanning runs entirely inside your Claude Code session.
How are false positives handled?: Every finding is challenged before it is reported, and the verification tally is computed in code, so only findings that survive are reported.
Does it fix the vulnerabilities it finds?: Yes. Findings that survive verification are turned into targeted patches, each verified by a panel of agents.
Can I control how deep the scan goes?: Yes. You choose an effort tier for the scan.

Advanced

Item type: plugin
Key: claude-security-anthropics
Source: github.com/anthropics/claude-plugins-official

github.com/anthropics/claude-plugins-official