Claude Security Plugin: Where It Fits in Your Stack

Anthropic shipped the Claude Security Plugin for Claude Code in public beta on July 22, a multi-agent vulnerability scanner that runs in the terminal and finds bugs that rule-based tools like Semgrep and Bandit miss, but a single max-effort scan can consume over 754,000 tokens. The plugin orchestrates six phases, including threat modeling and an adversarial panel, and generates patches for review, but its cost and nondeterminism make it unsuitable for CI gates, so it complements existing tools like Semgrep, Bandit, and Snyk.

Anthropic shipped the Claude Security Plugin for Claude Code in public beta on July 22. It is a multi-agent vulnerability scanner that runs entirely inside your terminal session, finds the class of bug that Semgrep and Bandit structurally cannot find, and generates patches you review and apply yourself. It also burned one developer 754,000 tokens in a single run. Both of those things are true, and you need to know both before you install it. What It Actually Does Most “AI-powered security” tools are pattern matchers with a language model bolted on. The Claude Security Plugin is not. It deploys a coordinated team of specialized agents that reason about your code the way a human security researcher would — tracking data across files, modeling trust boundaries, and following business logic. That is why it surfaces vulnerabilities that rule-based scanners structurally miss: - Injection flaws that span multiple files and call chains - Authentication bypasses tied to application-specific logic - Cryptographic weaknesses in implementation, not just algorithm choices - Complex logic errors that no regex rule can codify This is not a cheaper Semgrep. It finds different bugs. The right move is to run both. The Six-Phase Pipeline When you trigger a scan, the plugin orchestrates six distinct phases: Inventory — partitions the repository into logical components Threat modeling — identifies entry points, sinks, and trust boundaries per component Research — investigates four categories: injection, authentication bypass, memory safety, and cryptography Sweep — fills any coverage gaps from the research phase Panel — three independent agents assess each candidate finding through REACHABILITY, IMPACT, and DEFENSES lenses; a 2-of-3 quorum is required to pass Adversarial — maximum-effort red-teaming for borderline cases Findings only appear in your report after surviving the adversarial panel. The verification tally is computed programmatically, not asserted by a model, which keeps false positives low and makes each finding worth investigating. The Token Cost Reality Here is the thing most launch coverage glossed over. A max-effort full-repository scan can spawn up to 50 agents simultaneously and consume over 754,000 tokens in a single session https://medium.com/@joe.njenga/i-tried-anthropic-new-claude-code-security-plugin-one-scan-cost-me-754k-tokens-223ffdc454aa , exhausting the session before completion on large codebases. The plugin warns you before each scan, but the warning assumes you know what “significant token usage” means at scale. The four effort tiers give you control: | Effort | Scope | Approx. Tokens | Best Use | |---|---|---|---| | Low | Single commit | ~500–2K | Quick pre-merge check | | Medium | Branch diff | ~2K–8K | Feature branch review | | High | Focused area API, auth layer | ~8K–20K | Component deep-dive | | Max | Full repository | 20K–754K+ | Periodic baseline audit | Start with High effort scoped to your authentication or API layer. Save Max for baseline audits on known-critical codebases. The plugin reads your repository first and presents scope options with file counts and token estimates before you confirm the run. Where It Lives in Your Security Stack The plugin is not a CI gate. It does not run automatically. For most teams, that is a feature rather than a limitation — the cost and nondeterminism make it a poor fit for pipeline enforcement. Your existing Semgrep https://semgrep.dev/ , Bandit, and Snyk integrations stay exactly as-is. | Stage | Tool | What It Covers | |---|---|---| | In-session | Security guidance plugin | Issues in code Claude writes right now | | On-demand, fast | /security-review | One-pass review of current branch | | On-demand, deep | Claude Security plugin | Multi-agent scan, verified findings, patches | | On PR | Code Review Team/Enterprise | Full-context PR security review | | CI | Semgrep / Snyk / Bandit | Deterministic rules, supply-chain CVEs | The plugin occupies the “on-demand, deep” slot — the thorough periodic audit you run before a major release, on a security-critical component, or when you suspect something subtle slipped through your CI gates. Setup Requirements: Claude Code v2.1.154 or later on a paid plan, Python 3.9.6+ available as python3 , Git, and dynamic workflows enabled toggle in /config on Pro plans . Installation is two commands in a Claude Code session: /plugin install claude-security@claude-plugins-official /reload-plugins Run /claude-security and select Scan codebase . The plugin reads your repository, offers scope options with file counts and token estimates, and waits for your confirmation. Results land in a timestamped CLAUDE-SECURITY-<timestamp / directory containing a markdown report, a machine-readable JSONL file, and a revision JSON linking findings to the exact commit scanned. To apply a suggested patch: git apply CLAUDE-SECURITY-<timestamp /patches/F1.patch Nothing auto-applies. Every fix is your decision. Two Caveats Worth Knowing It is nondeterministic. Two scans of the same code can surface different findings — an inherent property of reasoning models. Run scans regularly and use the revision stamps to attribute each report to the exact code and settings it covered. A single clean scan is not a clean bill of health. Fable 5 users may hit safety classifier blocks. The plugin automatically downgrades to Claude Opus for affected steps and the scan completes. The official documentation https://code.claude.com/docs/en/claude-security flags this as expected behavior, not a failure. The Verdict This is a real tool with genuine capability that most existing security tooling lacks. If you use Claude Code and work on a security-critical codebase, install it and run a High-effort scan on your authentication layer this week. The findings will likely surprise you. Just do not run max effort on your entire monorepo and expect your session to survive. Scope it, read the token estimates, and treat it as a periodic audit tool rather than a continuous scanner. That is what it is built to be — and at that job, it is genuinely good. The plugin is available now in the official Anthropic marketplace https://claude.com/plugins/claude-security for all paid Claude Code plans. Full setup documentation is at code.claude.com/docs/en/claude-security https://code.claude.com/docs/en/claude-security .