Claude Security
Anthropic · Claude Security: Anthropic's AI Agent That Continuously Scans Repositories, Validates Vulnerabilities, and Tracks Fixes
Claude Security is Anthropic's hosted vulnerability-scanning agent in Claude.ai. It writes a threat model of your code, runs a deep baseline scan of connected repositories, re-scans as new commits land, and tracks each finding until a fix ships, with suggested patches that people review and apply. It is in public beta for Claude Enterprise organizations and suits security and engineering teams that want validated, prioritized findings across their own repositories instead of a rule-based scanner list.
Best for
Security and engineering teams at Claude Enterprise organizations that want continuously updated, validated findings across their own repositories, with severity tuned to their threat model and fixes handled in Claude Code
Not ideal for
Teams not on Claude Enterprise, organizations that require Zero Data Retention, teams that need deterministic, repeatable scanner output as compliance evidence, anyone wanting to scan open-source or third-party code, and teams with Git servers that cannot be reached from Anthropic's IP ranges
Who it's for
Product security and AppSec teams, and engineering teams that own code, at organizations on Claude Enterprise, especially those already using Claude Code
Capabilities
- Projects that group up to eight repositories from GitHub.com, GitHub Enterprise Server, or other Git providers via an auth token, each with an optional branch, folder scope, excluded folders, and an in-scope or context-only setting
- A threat model written from your code that your team can read and edit, plus a Knowledge tab for deployment notes, accepted risks, security policies, and architecture documents that guide what gets flagged and how it is rated
- A deep baseline scan, then continuous scanning of new commits based on their risk and complexity, with no fixed schedule to configure
- Multi-stage verification in which Claude critically reviews its own findings before they are surfaced
- Findings with severity (Critical, High, Medium, Low) judged against the threat model, a CWE category where one applies, cited files and lines across repositories, the scanned branch and commit, an exploit path explanation, fix guidance, and a full change history
- Coverage of categories including injection, path traversal and SSRF, authentication and access-control flaws, memory safety, cryptography, deserialization, and protocol and encoding issues
- A Fix button that opens Claude Code in the cloud on a specific finding, or gives a prompt to run in your own Claude Code
- Fix tracking that marks findings fixed when the change lands, wherever it was made, and reopens them automatically if the issue reappears
- Triage with dismissal reasons (false positive, accepted risk, duplicate, other) and triage notes. Dismissed findings do not reappear in later scans, and Claude uses the notes for the project
- Claude Security API for listing and reading projects and findings, resolving or reopening findings, and creating and managing projects and repositories, authenticated with personal access tokens
- Webhooks for new findings, and an MCP connector that lets Claude and Claude Code list, read, resolve, or reopen findings in the same session as the fix
- Role-based access control: admins decide which roles can create projects or view, triage, or manage all projects, and projects are shared with Full, Triage, or View roles
- A separate spend limit for Claude Security and per-project cost views by month to date and by day
Limitations
- Available only to organizations on Claude Enterprise, and still in public beta. Each user needs a seat that includes Claude Code, and usage credits must be enabled for consumption billing
- Zero Data Retention is not supported. Anthropic points ZDR customers to the separate Claude Security plugin for Claude Code instead
- Anthropic's scope-of-use terms allow scanning only code your company owns and has the rights to scan, not third-party or open-source repositories outside your own codebase
- Scans are stochastic, so two scans of the same code can return different findings
- A project holds at most eight repositories, counting context-only repositories. Large monorepos need folder scopes
- Baseline scans can take hours, and costs scale with repository size and how often code changes. No per-scan price is published, only direct token cost
- Fixes go through Claude Code. Without Claude Code in the cloud, users copy a prompt into their own Claude Code session
- Repositories on GitHub Enterprise Server or other self-hosted Git servers must be reachable from Anthropic's IP ranges, and a GitHub Enterprise Server instance must already be connected to Claude Code in the cloud. No self-hosted deployment of the managed service is documented
- Projects from the earlier version must be migrated to get the new features, and migration does not copy members, webhooks, excluded directories, scan history, or scheduled scans. GitHub Enterprise projects cannot be migrated
Use cases
- Connecting a company's most critical services to a project and running a deep baseline scan before an audit or pen test
- Keeping findings current on fast-moving repositories without scheduling scans
- Putting a backend and its client app in one project to catch trust-boundary bugs between them
- Encoding a team's risk policy and accepted risks in the threat model so severity matches how the team prioritizes
- Sending new findings to Slack or Jira through webhooks and syncing status with a vulnerability-management tool through the API
- Letting engineers pull up a finding through the MCP connector, fix it in Claude Code, and resolve it in one session
Our take
Claude Security's strongest idea is treating vulnerabilities as a living list rather than a scan report. Continuous scans, automatic fix tracking that reopens regressions, and a threat model the team can correct address the usual failure of security scanners, which is a growing backlog of stale or misrated findings. The API, webhooks, and MCP connector make it practical to route findings into existing ticketing and to close them from Claude Code. The constraints are just as clear. It is an Enterprise-only public beta, there is no Zero Data Retention option, cost depends on token usage that grows with repository size and change rate, and results vary between scans, so it does not replace deterministic SAST or dependency scanning. Teams already on Claude Enterprise should start with one well-scoped project, invest in the threat model, and watch the per-project usage view before rolling it out widely.
Who should use it
Product security and AppSec teams at Claude Enterprise organizations who want continuous, validated coverage of their most important repositories, and engineering teams already using Claude Code who want findings that flow straight into a fix session and close themselves when the fix ships.
Who should skip it
Organizations not on Claude Enterprise or that require Zero Data Retention (the Claude Code plugin may fit better), teams that need repeatable, rule-based scanner output for compliance, anyone looking to scan open-source or third-party code, and teams that cannot expose their Git servers to Anthropic's IP ranges.
Strengths
- Continuous scanning and automatic fix tracking keep findings close to the current code without anyone scheduling scans
- An editable threat model and knowledge base let teams tune what gets flagged and how severe it is
- Findings are verified before they surface and explain how an attacker would reach the code
- Cross-repository projects can catch issues between services
- API, webhooks, and an MCP connector fit findings into existing tools and Claude Code workflows
- Billed at direct token cost with no platform fee, with separate spend limits and per-project cost tracking
Weaknesses
- Requires Claude Enterprise and is still a public beta
- No Zero Data Retention support for the managed service
- Results can vary between scans of the same code
- No published per-scan price, and costs grow with repository size and change rate
- Limited to code your company owns, eight repositories per project
Claude Security pricing
Claude Security on Claude Enterprise (public beta)
Direct token cost
- No additional platform fee
- Requires Claude Enterprise, seats that include Claude Code, and usage credits enabled
- Covers scans, threat models, project chat, and fix checks
- Separate spend limit and per-project cost tracking
Launch offer (ends December 31, 2026)
Up to $25,000/month in credits
- For eligible Claude Enterprise organizations, including via AWS Marketplace
- Two consecutive months, applied automatically to new-experience projects
- Unused credits do not carry over
- Organizations joining after November 1, 2026 do not get two full months
Claude Security plugin for Claude Code (beta)
Claude Code usage
- Separate local plugin based on the same technology
- Needs a paid plan, Anthropic API access, or a third-party provider
- Uses your Claude Code models, and each scan counts toward your usage
Note: Anthropic publishes no per-scan price. Claude Security usage is charged at direct token cost, and costs scale with the size of your repositories and how often they change. Launch-offer credits apply before committed spend or other usage credits and stop at the end of December 31, 2026 (UTC), even if two months have not passed.
Technical specs
Available models
Where Claude Security excels
Continuous coverage of critical services
After one baseline scan, Claude Security scans new commits on its own and keeps findings close to the current code, so a security team does not have to schedule or re-run scans as code changes.
Closing the loop between findings and fixes
Engineers open a finding in Claude Code with one click or through the MCP connector, fix it, and Claude Security marks it fixed once the change lands, reopening it automatically if the issue returns.
Feeding an existing vulnerability-management process
Webhooks push new-finding events into tools such as Slack or Jira, the API lets teams resolve or reopen findings from their own systems, and RBAC limits who can create projects or triage.
Claude Security vs. competitors
Claude Security vs. Codex Security
Codex Security is OpenAI's application security agent. It runs as a Codex plugin, an Apache-2.0 CLI and SDK for local and CI scans, a GitHub pull-request reviewer, and Codex Security Cloud, a research preview that scans connected GitHub repositories once or continuously. Claude Security has no local scanner of its own (that is the separate Claude Code plugin); it is a hosted Claude Enterprise service built around projects of up to eight repositories from GitHub or other Git providers, with automatic fix tracking and fixes handled in Claude Code.
Claude Security vs. CodeMender
CodeMender is Google Cloud's find, verify, and fix agent, in limited public preview for Google Cloud customers. It runs through a local `cm` CLI that verifies findings and tests patches on your machine without uploading full repositories. Claude Security reads connected repositories from Anthropic's hosted service, scans them continuously, and suits organizations on Claude Enterprise rather than Google Cloud.
Claude Security vs. Strix
Strix is an Apache-2.0 AI pentesting tool that actively tests running applications and codebases in a sandbox, with a paid cloud platform for continuous testing and autofix pull requests. Claude Security reasons over source code across connected repositories rather than attacking a running target, and is available only on Claude Enterprise.
Frequently asked questions
What is Claude Security?
Claude Security is a capability built into Claude.ai that watches your codebases for security vulnerabilities. It writes a threat model, runs a deep baseline scan of connected repositories, scans new commits continuously, verifies findings before showing them, suggests targeted patches for human review, and tracks each finding until the fix ships.
Who can use Claude Security?
The managed product is in public beta for organizations on Claude Enterprise. An owner enables it in Organization settings, each user needs a seat that includes Claude Code, and usage credits must be enabled for consumption billing. Admins control who can create, view, triage, or manage projects through custom roles.
How much does Claude Security cost?
Anthropic charges Claude Security at direct token cost with no additional platform fee. Usage covers scans, threat-model writing, the project chat, and fix checks. You can set a separate spend limit and see each project's cost by month and day. As a launch offer, eligible Enterprise organizations get up to $25,000 a month in promotional credits for two months, ending December 31, 2026 (UTC).
Does Claude Security work with GitLab or Bitbucket?
Yes. GitHub.com and GitHub Enterprise Server repositories connect through the Claude GitHub App. Repositories on other Git providers, such as GitLab and Bitbucket, or on publicly accessible self-hosted Git servers, connect with the repository address and an auth token. Self-hosted servers must allow traffic from Anthropic's IP ranges.
Does Claude Security fix vulnerabilities automatically?
No. Each finding includes a recommended patch, and clicking Fix opens Claude Code on that finding, but Anthropic says every patch requires human review and approval. Claude Security then marks the finding fixed once the change lands, and reopens it if the issue comes back.
How is Claude Security different from /security-review and the Claude Security plugin in Claude Code?
/security-review is a single security pass over your current branch in Claude Code. The Claude Security plugin for Claude Code, in beta, runs a multi-agent scan of a repository or diff inside your own session, using the models in your Claude Code account, and writes patches you apply yourself; it suits teams that need ZDR, a third-party model provider, or code kept in their environment. Claude Security itself is the hosted Enterprise service that monitors connected repositories continuously, runs on Claude Mythos models, and tracks fixes.
How is Claude Security different from OSS Scanner?
Both come from Anthropic. Claude Security is the commercial product for companies to scan code they own, and its terms exclude scanning open-source projects outside your company's codebase. OSS Scanner is a free, opt-in service in which Anthropic scans enrolled, security-critical open-source projects and emails reports to their maintainers.
Claude Security vs Codex Security: what is the difference?
Both are AI agents that threat-model code, validate vulnerabilities, and propose fixes for human review. Claude Security is a single hosted Claude Enterprise service built around projects of up to eight repositories from GitHub or other Git providers, with automatic fix tracking that reopens regressions. Codex Security is OpenAI's counterpart, delivered as a Codex plugin, an open-source CLI and SDK for local and CI scans, GitHub pull-request reviews, and Codex Security Cloud, a research preview that scans connected GitHub repositories once or continuously.
Integrations & fit
Alternatives to consider
OpenAI
Security and engineering teams that already use Codex or the OpenAI API and want an agent that validates findings and prepares reviewable fixes, from a one-off repository audit to per-PR checks in CI
Paid
Security and platform teams already on Google Cloud who want an agent that verifies vulnerabilities and proposes tested patches, and who can join a preview program
PaidAbout Claude Security
Claude Security runs inside Claude.ai at claude.ai/security. Work is organized into projects: you name a project, connect up to eight repositories from GitHub.com, GitHub Enterprise Server, or another Git provider such as GitLab or Bitbucket (with an auth token), and optionally set a branch, a folder scope, and excluded folders for each. A repository can be in scope, so Claude reports findings in it, or added for context only, so Claude reads it without reporting on it. Grouping a backend and its client in one project lets Claude trace issues that cross service boundaries. Claude then reads the code, writes a threat model, and runs a deep baseline scan that can take minutes or hours. After that there is no schedule to manage: Claude checks for new commits and scans changes based on their risk and complexity. Each finding passes multi-stage verification before it is shown, and arrives with a severity judged against the project's threat model, a CWE category where one applies, cited files and lines, the branch and commit scanned, an explanation of how an attacker would reach the code (sometimes with an attack-path diagram), and fix guidance. Teams shape results by editing the threat model and adding notes or architecture documents in the project's Knowledge tab, and by dismissing findings with a reason and a triage note. Dismissed findings do not reappear in later scans, and Claude uses the notes for the project. Fixing happens in Claude Code: clicking Fix opens a Claude Code session in the cloud for that finding, or gives you a prompt to paste into your own Claude Code. Anthropic says every patch requires human review and approval. Claude Security then checks open findings against changed code, marks them fixed when the fix lands even if the fix was made elsewhere, and reopens them if the issue returns. An October 2026 update added an API (personal access tokens that carry the user's own permissions), new-finding webhooks, an MCP connector for Claude and Claude Code, and role-based access with Full, Triage, and View project roles. Scans run on Claude Mythos models without Cyber Verification Program access, and usage is billed at direct token cost with no platform fee. The main tradeoffs: it requires Claude Enterprise, does not support Zero Data Retention, may be used only on code your company owns, and produces results that can differ between scans. For local, ZDR, or third-party-provider setups, Anthropic offers a separate Claude Security plugin for Claude Code that runs scans inside a Claude Code session.
Updates from Claude Security
On October 21, 2026, Anthropic released a new version of Claude Security in public beta for Claude Enterprise. Projects now scan new commits continuously after a baseline scan, mark findings fixed when the fix lands and reopen them if the issue returns, and use an editable threat model and knowledge base to decide what to flag. The release added an API, new-finding webhooks, an MCP connector for Claude and Claude Code, and role-based access controls, plus a launch offer of up to $25,000 a month in usage credits for two months, ending December 31, 2026. Anthropic says thousands of organizations have used Claude Security to find over a million vulnerabilities since its public beta began in April.
Are you the founder? Claim this listing →