Claude Security Plugin Review 2026: What Anthropic's Multi-Agent Scanner Finds, What It Costs, and When /security-review Is Enough

By AICoderScope Team · 13 min read
claude-codeclaude-securitysecuritypluginreviewai-code-review

TL;DR: The Claude Security plugin turns a Claude Code session into a multi-agent vulnerability scanner: agents map your architecture, build a threat model, hunt for flaws, and independently verify every finding before it reaches the report. It costs nothing extra — scans burn your existing plan usage — but a deep scan eats tokens fast, and it needs dynamic workflows, which Pro users must enable manually. For a quick pre-merge check, the built-in /security-review command is enough.

Claude Security plugin/security-review (built in)Claude Security (managed)
Best forOn-demand deep scan of a repo or diffOne-pass check of your current branchScheduled org-wide repo monitoring
Plan requiredAny paid plan or API access + dynamic workflowsAny planEnterprise only (public beta)
Price$0 extra; counts toward plan usage$0 extra; counts toward plan usageContact sales; no public pricing
The catchToken-hungry; no cloud-session support; nondeterministic runsSingle pass, current branch only, no patch pipelineRuns on Anthropic’s infra, not yours; GitHub repos only

Honest take: Install the free security-guidance plugin everywhere, run /security-review before every merge, and save the Claude Security plugin for the moments that justify its token bill — inherited codebases, pre-release audits, and post-incident sweeps. Paying for the Enterprise managed product only makes sense once you want scheduled scans and Jira/Slack routing, not before.

Anthropic shipped the Claude Security plugin in beta on July 22, 2026, and the official plugin page showed 8,580 installs when we checked on October 18, 2026. It’s the fourth security layer Anthropic has attached to Claude Code in under a year, and the naming is now genuinely confusing: there’s a security-guidance plugin, a /security-review command, a PR-time Code Review service, a managed Claude Security product for Enterprise — and this plugin, which shares a name with the managed product but is a different thing. This review covers what the plugin actually does, what it writes to disk, what it costs on each Claude plan as of October 18, 2026, and which of the five layers you actually need. Everything below was verified against Anthropic’s official docs and pricing pages today.

What does the Claude Security plugin actually do?

It runs a staged, multi-agent vulnerability scan inside your Claude Code session. Per the official docs: “A team of Claude agents maps your architecture, builds a threat model, hunts for vulnerabilities, and independently reviews every finding before writing the report.” The independent-verification stage is the design decision that matters — findings only appear in the report after separate verifier agents try to tear them down, which is Anthropic’s answer to the false-positive flood that makes most static-analysis output unreadable.

The plugin adds exactly one command, /claude-security, with three jobs:

  1. Scan codebase — full-repository scan. Works in any directory, versioned or not.
  2. Scan changes — scans only a diff: a branch against its base, one of your open pull requests, or a single commit (“scan commit abc1234”). Needs git, and only committed changes count.
  3. Suggest patches — turns findings you pick into .patch files, each reviewed by an agent independent of the one that wrote it. When the surrounding code has tests, the reviewer runs them against the patch.

This approach is the opposite of pattern-matching scanners. Anthropic’s February 20, 2026 announcement of the underlying research program claimed the same reasoning-based technique (then running on Opus 4.6) found over 500 previously undetected vulnerabilities in production open-source codebases — targeting business-logic flaws and broken access control, the classes regex-based tools can’t see. The plugin doesn’t replace deterministic scanners, and the docs say so plainly: run it alongside static analysis and dependency scanning, not instead of them. We made the same argument from the other direction in our local static analysis tools guide.

How do you install it and run a first scan?

One command inside a Claude Code session, from the official Anthropic marketplace:

/plugin install claude-security@claude-plugins-official

If Claude Code reports Marketplace "claude-plugins-official" not found, add it first with /plugin marketplace add anthropics/claude-plugins-official and retry.

Prerequisites, from the docs, verified October 18:

  • A paid Claude plan, Anthropic API access, or a third-party provider (Bedrock, Google Cloud’s Agent Platform, Microsoft Foundry)
  • Dynamic workflows enabled — the scan orchestrates its agents through them. On Pro, they’re off by default: run /config and turn on the Dynamic workflows row, or the scan won’t start. Our dynamic workflows guide covers what they are.
  • Python 3.9+ on your PATH as python3 (standard library only — nothing gets pip-installed)
  • Git for change scans and patches; full scans work without it

Then run /claude-security, pick Scan codebase, and the plugin reads your repository and offers scoped options — whole repo or a focused area like your auth code — with each option’s file count and relative cost stated up front. Nothing runs until you confirm, which matters because the docs warn a scan “may take a while, may use a significant number of tokens, and needs Claude Code left open while it completes.”

Results land in a timestamped directory in your repo:

CLAUDE-SECURITY-2026-10-18T.../
├── CLAUDE-SECURITY-RESULTS.md       # human-readable report
├── CLAUDE-SECURITY-RESULTS.jsonl    # one JSON object per finding
├── CLAUDE-SECURITY-RESULTS.sarif    # SARIF 2.1.0 for GitHub code scanning
├── CLAUDE-SECURITY-REVISION-<commit>.json  # what was scanned, at what effort
└── patches/                         # F1.patch, F2.patch after "Suggest patches"

The directory ships with its own .gitignore so a stray git add . never commits a vulnerability report. Each finding carries an ID, severity, confidence rating, impact, exploit scenario, reproduction steps, and a recommendation, classified under CWE categories. The SARIF output is the sleeper feature for teams: it drops straight into GitHub code scanning alongside your existing CodeQL or Semgrep results.

Patches are never applied automatically. You apply each one yourself:

git apply CLAUDE-SECURITY-<timestamp>/patches/F1.patch

The docs tell you to put each patch in its own pull request, and the patch pipeline refuses to work from stale reports — if the code a finding describes has changed since the scan, the finding is skipped with a note and you’re offered a fresh scan.

What does a scan cost on each Claude plan?

Nothing beyond your existing subscription — and potentially a lot of it. The plugin makes no model calls of its own and has no separate price; every scan counts toward your plan’s usage pool, the same pool your regular Claude Code sessions draw from. Plan prices, verified at claude.com/pricing on October 18, 2026:

PlanPriceCan run the plugin?Practical scan headroom
Free$0No — no Claude Code access—
Pro$20/mo ($17/mo annual)Yes, after enabling dynamic workflows in /configOne scoped scan can eat deep into a 5-hour usage window
Maxfrom $100/mo (5x or 20x Pro)YesFull-repo scans viable
Team$20–$25 standard seat; $100–$125 premium seatYesPremium seats get 5x standard usage
Enterprise$20/seat/mo annual + usage at API ratesYes; also unlocks the managed productMetered — you pay per token
Anthropic APIper-tokenYesPay-as-you-scan

Anthropic publishes no per-scan token estimate, and we won’t invent one — scan size scales with repository size and the scope you pick. The honest guidance: the confirmation step states each scope’s relative cost before anything runs, and on Pro you should pick a focused scope (the docs recommend scanning one area at a time on large repos) rather than pointing it at a monorepo. The hunting, verification, and patching agents run on your session’s model — switch with /model before scanning — while repository mapping uses the cheaper sonnet alias regardless.

One cost lever worth knowing: because the heavy agents follow your session model, running the scan with a cheaper model selected cuts the usage burn, at some unquantified cost to finding quality. The same routing logic applies as in our subagent model routing cost guide.

How does it compare to Claude Code’s four other security layers?

This is the question the naming mess obscures, so here’s the full stack, from the official docs, with plan gates:

LayerWhat it isWhen it runsPlanExtra cost
security-guidance pluginReviews code as Claude writes it: per-edit pattern match, end-of-turn diff review, commit-time agentic review (Opus 4.7 default)Automatic, in sessionAll plansUsage for model-backed reviews; pattern check free
/security-reviewSingle security pass over your current branchOn demandAll plansSession usage
Claude Security pluginMulti-agent deep scan of a repo or diff, verified findings, reviewed patchesOn demandAny paid plan + dynamic workflowsSession usage, significant
Code ReviewPR-time multi-agent review (correctness + security) on Anthropic infrastructureOn pull requestTeam, EnterpriseMetered, org spend limit
Claude Security (managed)Hosted scanning that monitors connected GitHub repos, runs on Claude Mythos 5.1, Slack/Jira webhooks, scheduled scansContinuous/scheduledEnterprise (public beta)Contact sales

Two distinctions that decide real purchases:

Plugin vs. /security-review: the command is one pass over one branch’s changes with no patch pipeline and no independent verification stage. The plugin reads the whole repository for context even on change scans, verifies findings adversarially, and produces SARIF plus reviewable patches. If /security-review is a smoke detector, the plugin is the inspection you order before buying the house.

Plugin vs. managed product: the managed product runs on Anthropic’s infrastructure against connected GitHub repositories and uses Claude Mythos 5.1 — the unrestricted-tier sibling of Fable 5 that individual developers can’t access directly (we covered that split in the Fable 5 / Mythos 5 piece). The plugin runs locally, on whatever models your account has, and can reach what the managed service can’t: GitLab and Bitbucket repos, and code on networks that refuse inbound connections. For FOSS-stack alternatives to both — Semgrep, Bandit, and friends — see aifoss.dev.

Where does the plugin break?

Four limits surfaced in our testing and in the docs’ own fine print.

It doesn’t work in cloud sessions. We tried installing it from a Claude Code cloud session (version 2.1.302) on October 18 and the CLI install was refused by session policy. That matches the documented limitation: cloud sessions don’t load plugins from user settings or from a repository’s .claude/settings.json — only from organization-managed settings. Treat this as a local, desktop, and VS Code workflow; your CI box and cloud sandboxes are out unless your org distributes the plugin through managed settings.

Scans are nondeterministic. The docs say it directly: “two scans of the same code can surface different findings.” That’s inherent to reasoning-based scanning and it’s why every scan writes a revision stamp recording the commit, effort level, and verification thoroughness. For compliance work, keep the stamps; a clean scan is evidence of a pass, not proof of absence.

Only committed changes get diff-scanned. In-progress edits are invisible to change scans — commit or stash first, or run a full scan, which reads the working tree. The one network-touching step (finding your open PRs) only appears if gh is installed and signed in.

Fable models trip their own safeguards mid-scan. The documented behavior: Fable’s cybersecurity safety classifiers can flag the scan’s own requests (vulnerability hunting looks like attack planning from the inside), and Claude Code re-runs the flagged request on an Opus model via automatic model fallback. The docs call the “safeguards flagged this message” notice expected, and the scan completes. It’s cosmetically alarming the first time and harmless after — but on Bedrock, Agent Platform, or Foundry, a flagged request can end in a refusal instead, depending on deployment settings.

A fifth, structural limit: the plugin scans source in your checkout, not running services. Dependency CVEs, infrastructure misconfig, and supply-chain checks stay with your existing scanners. Given this year’s parade of agent-tooling attacks — agentjacking, GhostApproval, and the rest of our security series — AI-generated code needs scanning and the agents writing it need guardrails; this plugin only covers the first half.

Verdict: who should install it?

Install it now if you’re on Max, Team, or Enterprise and you own code you didn’t write — an inherited codebase, a vendor handoff, an acquisition target, or an open-source dependency you’re about to trust with auth. The scoped-scan flow plus SARIF output plus reviewed patches is a genuinely better workflow than pasting files into a chat window, and at $0 marginal subscription cost it beats commissioning a point-in-time review for a first pass.

Hold off if you’re on Pro and your usage window is already tight — the free security-guidance plugin plus /security-review before merges covers the daily-driver case, and both run on any paid plan. Add the deep scanner when a specific audit moment justifies the token spend, and run it with a scoped target.

Skip the Enterprise managed product for now unless you specifically need scheduled, continuous monitoring with Slack/Jira routing and want scans on Mythos 5.1. It’s in public beta with no published pricing, and the plugin reaches more code hosts than the managed service does.

FAQ

Is the Claude Security plugin free?

There’s no separate charge — it’s an official Anthropic plugin, and scans consume your existing plan or API usage. The real cost is tokens: Anthropic’s own docs warn a scan “may use a significant number of tokens,” so on Pro, scope scans narrowly.

Does it work with Cursor, Cline, or other AI coding tools?

No. It’s a Claude Code plugin and runs only inside Claude Code sessions (terminal, desktop app, or VS Code extension — not cloud sessions). Cursor and Cline users wanting similar coverage need separate tooling; our static analysis roundup covers free options that work across editors.

Can it scan a pull request before I merge?

Yes — Scan changes handles a branch diff, one of your open PRs, or a single commit, and research agents still read the whole repository for context. Only committed changes are scanned, and PR discovery requires a signed-in gh CLI.

Does it apply fixes automatically?

Never. Patches are written to a patches/ folder as .patch files, each reviewed by an independent agent (which runs your tests when they exist), and you apply them yourself with git apply — the docs recommend one PR per patch.

Sources

Last verified October 18, 2026. Plugin status (beta), plan prices, and feature gates all checked against official Anthropic pages on that date; this space is moving fast — re-verify before building a security program on it.

Was this article helpful?

Know which coding tool is worth paying for

Hands-on comparisons of AI coding assistants and what each one costs to run — including the local-model path. Sent only when something changes. Unsubscribe anytime.