Anthropic has released its internal security tool for free, integrating the utility directly into its developer tool to enhance Claude Code security protocols.
The tool identifies software vulnerabilities during the active writing phase. Developers can access this utility immediately to scan their repositories for potential risks. This release aims to make secure coding practices more accessible to individual developers and enterprise teams alike.
Three Levels of Automated Review
The system operates across three distinct stages of the development cycle to ensure thorough code analysis. First, during every file edit, the tool flags risky code patterns and misused libraries. Second, after a developer completes a chunk of work, the system reviews the full diff to identify issues that span multiple changes.
Finally, during commits, it analyzes the surrounding code to verify if a vulnerability is real, which reduces false alarms. This multi-layered approach helps developers catch errors early in the workflow using artificial intelligence capabilities.
Custom Rules with Guidance Files
Organizations can customize the tool to align with their specific internal standards. By adding a `claude-security-guidance.md` file to their repository, teams can enforce custom security rules alongside the default configurations.
This flexibility allows businesses to maintain compliance with their unique development policies. Consequently, teams do not have to rely solely on generic rules and can tailor the tool to their specific software architecture within their apps and services.
Internal Testing and Performance Metrics
Anthropic previously used this tool internally to monitor its own codebase before making it publicly available. The company stated that security-related comments on pull requests decreased by 30% to 40% during internal testing.
Previously, human reviewers flagged approximately 100 security issues per code review, but that number dropped to between 60 and 70 issues as the plugin resolved the remaining vulnerabilities. This reduction demonstrates the tool’s capacity to filter out minor issues before human intervention.
Future Outlook for Claude Code security
The integration of this tool represents a shift toward automated code analysis to improve Claude Code security within development environments. By catching vulnerabilities before human review, the tool reduces the manual workload for security teams.
Developers can install the plugin directly from the plugins directory inside the command-line interface. As automated tools become more common, developers can expect further updates to address emerging security threats.
Source: X (@vaibhavsisinty)
