Claude Code's security plugin scans your diff before you merge

AI coding agents write fast. Security review did not get faster by default. SQL injection, hardcoded secrets, and unsafe DOM calls still slip through when velocity is the KPI.

Anthropic's answer in July 2026 is a stack, not one checkbox:

1. Security guidance plugin catches risky patterns as Claude edits files (zero model cost)
2. /security-review runs a single pass on your branch
3. Claude Security plugin runs a deep multi-agent scan you trigger with /claude-security
4. Code Review on pull requests (Team and Enterprise)
5. Hosted Claude Security for connected repos on Enterprise

The digest headline was the terminal plugin. The docs make the layering explicit. Speed and safety are both table stakes now, baked into the harness.

Layer 1: security guidance (automatic, no model call)

The security-guidance plugin hooks Write, Edit, and MultiEdit before changes land.

It pattern-matches dangerous APIs without calling a model:

Warnings are session-scoped so you do not get spammed on every line. Install from the official marketplace the same way as other Claude Code plugins.

This is the "scan as you type" layer from the newsletter: no extra commands, no token burn, catches the obvious footguns before they become a diff.

Layer 2: Claude Security plugin (on-demand deep scan)

The Claude Security plugin is the deep layer. Install:

/plugin install claude-security@claude-plugins-official
/reload-plugins

Prerequisites: paid plan, Claude Code v2.1.154+, python3 3.9.6+, git for change scans.

Run /claude-security and pick:

The scan orchestrates multiple agents: map architecture, build a threat model, hunt vulnerabilities, verify each finding independently, then write the report. Nothing applies automatically.

Results land in a timestamped CLAUDE-SECURITY-<timestamp>/ directory:

• CLAUDE-SECURITY-RESULTS.md for humans
• CLAUDE-SECURITY-RESULTS.jsonl for automation
• patches/F1.patch only after an independent review agent vouches the fix

Apply patches yourself:

git apply CLAUDE-SECURITY-<timestamp>/patches/F1.patch

Anthropic recommends auto mode for scans so agents do not stall on permission prompts every step.

Layer 3: everything else in the stack

Stage	Tool	Role
In session	Security guidance plugin	Stop bad patterns at write time
On demand	/security-review	One pass on current branch
On demand	Claude Security plugin	Multi-agent repo or diff scan
On PR	Code Review	Multi-agent review with repo context
Managed	Claude Security	Hosted monitoring for connected GitHub repos
CI	Your SAST and dependency scanners	Deterministic rules and supply chain

The plugin complements static analysis. It reasons about data flow and cross-file logic like a human researcher, which rule matchers miss.

What changes for teams shipping with agents

Three implications for applied AI work:

1. Security becomes a harness feature. You do not schedule a quarterly pen test and hope agent-written code waited. Guidance runs on every edit. Deep scans run before merge.

2. Human approval stays mandatory. Patches are suggestions. That is the right default when models confidently rewrite working code. Same philosophy as Claude Code auto mode: automate the tedious gate, keep humans on consequential decisions.

3. Attackers get the same tools. Anthropic's own defender narrative is explicit: models that find novel bugs for you can find them for someone else. Scan cadence matters. Stale reports are worse than no scan.

Practical rollout I would use this week

For a client repo on Claude Code:

1. Install security-guidance for every developer session (baseline, free pattern layer).
2. Add /claude-security scan my branch to the pre-merge checklist for agent-heavy branches.
3. Keep CI SAST running. Do not replace Semgrep or dependency bots with a plugin.
4. On Enterprise, evaluate hosted Claude Security for repos you cannot scan from a laptop (air-gapped or non-GitHub hosts).

Watch token spend on full-repo scans. Scope large monorepos to API or auth packages first. Reports include file counts and relative cost before you confirm.

Fable 5 users may see classifier downgrades mid-scan. Anthropic documents that as expected when cybersecurity classifiers fire.

What this does not solve

Plugins do not replace threat modeling in design reviews. They do not scan running services or deployed infrastructure. They do not fix secrets in .env files agents read from disk.

They close the gap between "agent wrote it" and "human security reviewer has time to read it."

If you are shipping agent-written code to production and want help layering guidance, scan hooks, and vault boundaries, book a free discovery call. Most of my client work sits exactly at this intersection of speed and auditability.