Anthropic adds a security scanner to Claude Code's terminal
By Steven Van ·
The Claude Security plugin, in beta, checks diffs or a full codebase for vulnerabilities before you commit, using your own Claude inference.
Anthropic put a security reviewer inside the terminal. The Claude Security plugin for Claude Code is now in beta: scan your changes for vulnerabilities before you commit, or run a full scan across your codebase, all from your terminal, on the Claude inference you already run.
Security at the moment of commit
The smartest thing about this is where it lives: right before you commit. Security review usually happens too late, in a separate tool, after a PR, or worse, after a breach. Scanning your changes at commit time catches vulnerabilities while the code is still fresh in your head and cheap to fix, instead of weeks later in an audit. It shifts security left in the most literal way, into the exact keystroke where you'd otherwise ship the problem.
Two modes: diff and full
The plugin covers both the fast path and the thorough one. Scan just your changes for a quick check before committing, the low-friction habit you'd actually keep, or run a full scan across the whole codebase when you want a comprehensive pass. Having both in one terminal tool means security review stops being a special event and becomes part of the normal loop.
On your own inference
A quietly important detail: it runs on the Claude inference you already run. For teams sensitive about where their code goes, keeping the scan on your existing Claude setup rather than shipping code to a separate third-party security service is a real advantage, fewer vendors touching your source, and it fits the compliance posture teams already have with Claude.
Why it matters
As more code gets written (and generated) faster, the risk is that speed outruns review, AI can produce a lot of code, including a lot of subtly insecure code. A vulnerability scanner built into the same terminal loop where that code is written is a direct counterweight. For developers using Claude Code, it's a low-effort habit with outsized payoff: catch the issue before it's committed, not after it's exploited.
Try it
The Claude Security plugin is in beta for Claude Code now; details are at claude.com. Install it and run a scan on your current branch, the first full-codebase pass usually surfaces something worth knowing.
Sources: Claude on X, Claude Security.