Anthropic’s Claude Security is not a single product with one deployment model. According to documentation reviewed by BlockTempo, the name covers two separate offerings: a plugin that runs locally inside Claude Code, and a managed version reserved for Claude Enterprise customers.
BlockTempo’s report laid out the installation steps, scan workflow, six-stage multi-agent pipeline, report structure, patch generation process and the usage limits listed by Anthropic.
Two products under the same Claude Security name
The plugin version is installed into Claude Code and runs in the user’s own session on local infrastructure. It is available to paid-plan users, and scans count toward plan usage. The managed product is operated by Anthropic, continuously watches connected GitHub repositories and is limited to Claude Enterprise customers through claude.ai/security.
BlockTempo described the difference in simple terms: the plugin is for users who want to run scans themselves, while the managed version lets Anthropic keep watch over a repository on an ongoing basis. The article added that the plugin can still be used if code is hosted on GitLab or Bitbucket, or if company network rules restrict outside connections, because execution stays on the user’s own machine. The managed version currently supports GitHub only, but in exchange it offers scheduling and continuous monitoring.
What users need before installing the plugin
The report listed several requirements from Anthropic’s official documentation.
- Claude Code must be version v2.1.154 or later, and the user must be on a paid plan.
- Scans rely on dynamic workflows. On the Pro plan, that setting needs to be turned on from the /config menu.
- Python 3.9.6 or later must be available on PATH under the command python3, which can be checked with python3 --version. The plugin uses only the standard library.
- Linux, macOS and Windows are supported.
- git is required for change-based scans and patch generation. Other version-control systems are not supported for those tasks, though full-repository scans can still run without that requirement.
BlockTempo said Python version issues and PATH configuration are the most common points of failure before setup.
Installation takes two commands
To install the plugin in Claude Code, users run:
/plugin install claude-security@claude-plugins-official
If the system cannot find the marketplace, Anthropic says users should first run:
/plugin marketplace add anthropics/claude-plugins-official
After installation, /reload-plugins activates the plugin in the current session without restarting. Removal can be done from the /plugin menu or with the terminal command claude plugin uninstall claude-security.
The standard scan flow has six steps
The plugin adds a single command, /claude-security, with three choices: scan the full codebase, scan a set of changes, or suggest patches.
BlockTempo summarized the usual scan process in six steps:
- Run /claude-security and choose Scan codebase.
- The plugin reads the repository and presents scope options, either the full repository or a focused area. Each option shows file count and relative cost. If the user is unsure, replying “I don’t know” lets the tool choose a default based on repository size.
- Confirm execution. The system warns that the scan may take time, may consume a large number of tokens and requires Claude Code to remain open.
- Progress is reported at the start of each stage, with more detail visible under /workflows.
- Read the report after the scan completes.
- Run /claude-security again and choose Suggest patches.
The article also said users can issue parameterized commands such as /claude-security scan my branch or natural-language prompts like “scan commit abc1234.” Anthropic recommends running in auto mode so the agent does not need permission prompts at every step.
Change-based scans, PR scans and large repositories
If the current branch contains commits that are not in the base branch, the menu can offer an option to scan only that diff. Users can also scan an open pull request or a single commit.
Change-based scans inspect committed content only. Work in progress must first be committed or stashed, or the user has to switch to a full repository scan that reads the working directory. The article noted that change scans require a git repository, while full-repo scans can still run in directories without version control.
Detecting an open pull request is the only networked step in the process. That option appears only when the current session already has GitHub CLI access and gh is logged in.
For large repositories, Anthropic recommends scanning one section at a time, such as the API layer or authentication code. The coverage section in the report shows what was checked and what was left out, making it possible to scan another section later.
How the six-stage multi-agent pipeline works
Anthropic says Claude Security uses a group of Claude agents to map architecture, build a threat model and then hunt for vulnerabilities. Every finding must then be reviewed by independent verifier agents before it enters the final report.
BlockTempo cited a breakdown from tech outlet MarkTechPost, which reconstructed the plugin configuration into six stages:
- Inventory: split the repository into components.
- Threat Model: identify entry points, sinks and trust boundaries for each component.
- Research: assign researcher agents to each component and run a four-category vulnerability matrix.
- Sweep: look for gaps not covered by the matrix.
- Panel: have three independent reviewers assess each candidate finding from the angles of reachability, impact and existing defenses.
- Adversarial: run another high-intensity review on edge cases.
The four vulnerability categories are injection and input handling, authentication and access, memory and unsafe operations, and cryptography and secrets. For memory-safe languages such as Python and TypeScript, the memory dimension is skipped.
A finding needs at least two votes from the three reviewers to make it into the report. It is marked high confidence only if all three reviewers approve it; with two votes, confidence tops out at medium. On effort settings, low through medium levels handle up to 12 components with one researcher per matrix cell, while high through maximum levels can cover up to 24 components with two researchers per cell. The article added that Opus acts as the coordinator and Sonnet handles mapping and code reconnaissance.
What appears in the CLAUDE-SECURITY results directory
Each scan writes its output to a timestamped directory in the repository named CLAUDE-SECURITY-<timestamp>/.
That directory contains three main file types:
- CLAUDE-SECURITY-RESULTS.md, a human-readable report listing each finding with an ID such as F1, along with impact, attack scenario, severity, confidence and recommendations.
- CLAUDE-SECURITY-RESULTS.jsonl, a machine-readable version with one JSON object per line.
- CLAUDE-SECURITY-REVISION-<commit>.json, a revision marker recording which commit was scanned, the effort level and whether uncommitted changes were present. In scans outside version control, it is labeled UNVERSIONED.
BlockTempo said this directory is the only change the scan makes to the checked-out repository. It also ships with its own .gitignore, so even an accidental git add will not include the report in a commit. Users who want an audit trail can remove that .gitignore and commit the files normally.
How patch suggestions are created and reviewed
To generate a patch, users can choose Suggest patches from /claude-security or issue a prompt such as “fix finding F3.”
Patches are built against committed code, so the report still needs to describe the current code in the user’s possession. If relevant code has changed since the report was produced, the plugin skips that finding, notes the reason and recommends a fresh scan instead of applying an outdated fix path.
Each patch is drafted inside a temporary copy of the repository. The original files remain untouched until the user decides to apply the result. Before delivery, another agent performs a review. If tests exist, it runs them, and it also inspects the diff for newly introduced issues.
Anthropic’s rule, as summarized by BlockTempo, is that a patch is produced only if the review can support all three of these points at once:
- the reported finding is fixed;
- no new vulnerability is introduced;
- all other behavior stays unchanged.
If any one of those points cannot be supported, the user receives a short note explaining why no patch will be issued.
Patches are stored under the patches/ folder, one file per finding, named F<n>.patch. The application command is:
git apply CLAUDE-SECURITY-<timestamp>/patches/F1.patch
The official rule is that patches are never applied automatically. Anthropic recommends opening one pull request per patch. If the codebase has no tests, the patch note explicitly states that no tests were run during review.
Enterprise activation requires more setup
The managed Enterprise version comes with a higher bar. BlockTempo listed the requirements as a Claude Enterprise account, Claude Code on the Web enabled, Extra Usage enabled with a spending cap, the Anthropic GitHub App installed and authorized for the target repository, and premium seats for the people running scans. Standard seats do not include Claude Code on the Web.
The activation process described in the article is sequential: verify that Extra Usage is enabled and spending limits are set appropriately; confirm the GitHub App is installed with the right repository permissions; confirm team members have premium seats; have an administrator enable the feature at claude.ai/admin-settings/claude-security; then go to claude.ai/security and choose a repository. For larger repositories, Anthropic suggests limiting the scope by directory or branch before starting the scan.
Findings in the managed interface show the vulnerability type, severity, file and line number. Clicking Open a remediation session opens a focused session around that issue. False positives can be dismissed with a written reason.
Anthropic’s own usage guidance, as cited by BlockTempo, includes creating one Project per team, running scans weekly, choosing Regular or Extended intensity, exporting findings in CSV or Markdown, setting webhooks for Slack and Jira, narrowing monorepo scans to selected subdirectories and using custom roles for RBAC.
Anthropic stresses context awareness but has not published accuracy metrics
On its product page, Anthropic says Claude Security can reason through code like a skilled security researcher. The company argues that the system can understand context, follow data flows across files and catch complex multi-component issues that rule-based matching tools may miss.
Anthropic also says every finding goes through adversarial verification, with the stated goal of surfacing more real issues while reducing false positives.
BlockTempo noted, however, that these are still vendor claims. Anthropic has not published false-positive rates, accuracy figures or benchmark scores to back them up, which the article said is worth keeping in mind when evaluating adoption.
The report said Anthropic particularly highlights high-severity classes such as memory corruption, injection flaws, authentication bypass and logic errors that require cross-file context to identify. On integrations, the article pointed to webhook delivery into Slack and Jira, CSV and Markdown exports, scheduled scanning, directory scoping and persistent records of dismissed findings.