claude security is now a claude code plugin — multi-agent vulnerability scanning from your terminal

Anthropic brought Claude Security into Claude Code as an installable plugin on July 21, 2026. the move widens access significantly: the same vulnerability-scanning and patch-generation workflow that was previously an Enterprise-only feature is now a /plugin install away for every Claude Code user.

what it does

the plugin runs a multi-agent scan against your repo from inside an existing Claude Code session. it maps architecture, traces data flows, and examines how components interact across files and modules — the kind of cross-file analysis that standard static analyzers miss. when it surfaces findings, you select which ones to act on; the plugin generates patch files you review and apply yourself.

two scan modes: scan your staged changes before a commit, or run a full scan across the entire codebase. both run locally in your terminal session without requiring a separate API integration or custom agent setup.

install

from inside a Claude Code session:

/plugin install claude-security@claude-plugins-official
/reload-plugins

the /reload-plugins activates it in the current session without restarting. it runs on Claude Opus 4.7 under the hood — same model as the Enterprise version.

background

Claude Security launched as an Enterprise public beta in May 2026. the origin story: in February 2026, Anthropic ran Claude Opus 4.6 across a set of production open-source codebases and found over 500 vulnerabilities — bugs that had survived decades of expert review, peer audits, and automated scanning. a single AI pass found them. that result was the product pitch for the Enterprise version; the plugin is its democratization.

honest take

the meaningful part of this release is access, not architecture. the underlying Claude Security capability has been running for Enterprise customers since May. making it a terminal plugin with no separate signup removes the friction that kept it out of individual developer workflows. if you're shipping code through Claude Code regularly, running a scan before merging costs about two minutes and doesn't require changing how you work.

the caveat: it's still a beta. the patch suggestions are starting points for review, not production-ready commits. treat it as a second pair of eyes that never gets tired, not as a fully automated security gate.