claude-security finds, validates, and fixes security vulnerabilities in your code — using an agentic methodology (threat model → discovery → validation → attack-path analysis → report) rather than a static ruleset. It runs on the Claude Code harness and reuses your existing Claude subscription, so a scan doesn't cost you a separate API bill.

It is a fork of openai/codex-security. The security methodology (the hard-won validation discipline that keeps false positives down) is reused under Apache-2.0; the OpenAI Codex harness is replaced with a thin driver around the claude CLI. See What's different and NOTICE.

Most "LLM security scanners" drown you in plausible-but-wrong findings. The value in codex-security is not detection rules — there are none — it's the validation phase: every finding must survive a per-instance proof (attacker-controlled source + broken control + dangerous sink + real impact), confidence is calibrated from evidence actually obtained (a reproduced PoC, not the scariness of the bug class), and a suppression must name the exact control that makes the code safe. That methodology is model-agnostic. This fork runs it on Claude Code.

Requires Node.js 18+, Python 3.10+, and Claude Code signed in.

# 1. Install and sign in to Claude Code (once)
npm i -g @anthropic-ai/claude-code
claude          # then run /login and sign in with your Claude Pro/Max account

# 2. Install claude-security
npm install -g @presmihaylov/claude-security

# 3. Scan
claude-security scan .

The scan streams progress to your terminal and writes a bundle to a temp directory (report.md, findings.json, coverage.json, and SARIF). The final line printed is REPORT: <path>.

This is the headline feature. The scan agent runs through the claude CLI, which authenticates with whatever login Claude Code already has:

• --auth subscription (default): the harness unsets ANTHROPIC_API_KEY / ANTHROPIC_AUTH_TOKEN in the child process, so claude falls back to your logged-in Claude Pro / Max OAuth session. The scan runs against your subscription — no per-token API charges.
• --auth api-key: the environment is left untouched, so claude uses ANTHROPIC_API_KEY if it's set. Use this in CI, where there's no interactive login.

claude-security scan .                 # uses your Claude subscription
claude-security scan . --auth api-key  # uses ANTHROPIC_API_KEY (e.g. in CI)

Verify what will be used without running a scan:

claude-security scan . --dry-run
# prints the resolved `claude` command, the scan dir, and whether ANTHROPIC_API_KEY
# is visible to the child process.

Subscription auth is intended for interactive / local use. Anthropic's Consumer Terms govern subscription usage; for automated/CI scanning at scale use --auth api-key.

claude-security scan [path]     Scan a whole repository or scoped path (default: .)
claude-security diff [path]     Scan a Git change set for security regressions
claude-security login           Sign in to Claude Code (delegates to `claude`)

Common options:

Examples:

claude-security scan ./services/api --scope 'src/**'
claude-security diff . --base main --head HEAD
claude-security scan . --model claude-opus-4-8 --max-turns 60

claude-security scan .
        │
        ├─ resolves target repo + a scan dir under $TMPDIR
        ├─ builds an orchestrator system prompt (src/prompt.mjs)
        └─ spawns:  claude -p "<kickoff>"
                      --append-system-prompt "<orchestrator>"
                      --plugin-dir ./agent            # the ported methodology, as a Claude Code plugin
                      --add-dir <scan-dir> --add-dir ./agent
                      --allowedTools Read Grep Glob Bash Write Edit Task TodoWrite
                      --dangerously-skip-permissions  # headless; writes constrained to scan dir by prompt

Inside that session the agent runs the phased pipeline defined by the plugin skills:

1. Threat model (agent/skills/threat-model) — repository-scoped assets, trust boundaries, attacker-controlled inputs, invariants.
2. Discovery (agent/skills/finding-discovery) — review in-scope files, emit raw candidates, normalize them into one deterministic ledger via scripts/normalize_candidates.py.
3. Validation (agent/skills/validation) — per-candidate proof tuples, evidence-calibrated confidence, exact-control suppression. This is the anti-false-positive core.
4. Attack-path analysis (agent/skills/attack-path-analysis) — reachability, severity, final policy decision, grounded in the threat model.
5. Finalize — author scan-manifest.json / findings.json / coverage.json, then scripts/finalize_scan_contract.py deterministically projects report.md + SARIF.

The agent/ directory is a self-contained Claude Code plugin — you can also load it directly in an interactive session:

claude --plugin-dir /path/to/claude-security/agent
# then: "Run a Claude Security scan of this repo."

claude-security/
├── bin/claude-security.mjs    # CLI entrypoint
├── src/                       # the harness (arg parsing, prompt builder, claude spawner)
│   ├── cli.mjs  harness.mjs  prompt.mjs  paths.mjs
└── agent/                     # the ported methodology — a Claude Code plugin
    ├── .claude-plugin/plugin.json
    ├── skills/                # threat-model, finding-discovery, validation, attack-path-analysis,
    │                          # security-scan, security-diff-scan, fix-finding, define-security-policy, …
    ├── references/            # the detailed methodology (validation-guidance.md, shared-hard-rules.md, …)
    ├── schemas/               # JSON Schemas for the canonical scan bundle
    └── scripts/               # deterministic Python backbone (normalize, finalize, resolve SECURITY.md)

The security methodology is intentionally preserved — that's the valuable part. The skill text still mentions Codex-only MCP tools in places; the harness injects an orchestrator prompt that tells the agent those tools don't exist here and to use the deterministic script fallbacks plus Claude Code's own tools. The two entry-point skills (security-scan, security-diff-scan) have been rewritten to be Claude-native.

The Codex deep multi-pass scan (repeated-discovery variance reduction) and the SQLite workbench used for cross-scan finding tracking / triage were tightly coupled to the Codex MCP server and are not wired up in this fork yet. The single-pass repository scan and the diff scan are the supported paths. The track-findings, triage-finding, propose-security-hardening, and vulnerability-writeup skills are carried over and usable, but their MCP-backed persistence is not.

• The target repository is treated as read-only; artifacts are written only to the scan dir.
• Your code is sent to Anthropic's API through Claude Code, subject to the terms of whichever credential you use. Don't scan code you're not permitted to send to a third-party model.
• Headless runs use --dangerously-skip-permissions so the scan doesn't stall on prompts. The orchestrator prompt constrains writes to the scan dir, but review the flags if you run this on untrusted code.

Apache-2.0. A fork/derivative of openai/codex-security (Apache-2.0). See LICENSE and NOTICE.