Claude Code Security Plugin: Three-Layer Scanning, Free

The Claude Code security plugin story is really two stories, and most of this week’s coverage merges them into one. The free three-layer reviewer — the one that pattern-checks every edit, security-reviews each turn’s diff, and re-reviews on commit — is called security-guidance, and it launched on May 27, 2026. What Anthropic actually shipped this week, in beta, is a separate plugin called claude-security: an on-demand, multi-agent deep scan you invoke deliberately when you want a full vulnerability sweep.

The distinction matters because the two tools answer different questions. The three-layer plugin asks, continuously and for free, “did Claude just write something dangerous?” The new deep-scan plugin asks, on demand and at real token cost, “what is lurking in this codebase right now — and can you prove it?” Together they turn security review from a separate audit step into a toolchain default, arriving at a moment when the volume of AI-generated code entering production has made that shift overdue — and when the first fully agentic breach has shown what’s at stake.

This guide separates the two plugins cleanly, walks through the three-layer architecture and the new deep-scan pipeline, combines Anthropic’s seven security rungs into one reference table, and closes with an honest read on limits. One sourcing note up front: neither plugin received a dedicated anthropic.com news post — the facts below come from Anthropic’s own plugin documentation and the July 22–23 press coverage that corroborates it.

On July 22, 2026, Anthropic released the claude-security plugin for Claude Code in beta, with coverage from MarkTechPost, Cyber Security News, and GBHackers all landing on July 23. It adds a single command, /claude-security, which opens a menu of three jobs: scan the whole codebase (or a scoped subset), scan a set of changes — a branch’s diff, a PR’s diff, or a single commit — or turn selected findings into patch files.

What did not ship this week is the three-layer scanning system the title of this post describes. That plugin, security-guidance, arrived eight weeks earlier on May 27, 2026 — and if you missed the May launch, it’s arguably the bigger deal of the two, because it’s free, automatic, and requires nothing beyond a one-line install. Anthropic’s own documentation positions the pair as different rungs of a single defense-in-depth stack: the three-layer plugin is the always-on companion; the deep scan is the escalation you reach for before a release or after inheriting a codebase.

The security-guidance plugin is built on Claude Code’s hooks system — its source is public in the official plugin marketplace repo as a worked example for anyone building their own hook-based reviewers. Once installed, three review layers run without any manual invocation, each triggering at a different point in the write-ship loop.

Two design details are worth pausing on. First, reviewer independence: the plugin never asks the Claude instance that wrote the code to grade its own work. The model-backed reviews run as separate calls with fresh context and a security-focused prompt — per the docs, instructed only to find problems. Both model-backed layers default to Claude Opus 4.7, configurable via the SECURITY_REVIEW_MODEL and SG_AGENTIC_MODEL environment variables.

Second, teams can teach it their own threat model. A .claude/claude-security-guidance.md file feeds plain-language guidance to the model-backed reviews (capped at 8 KB combined across scopes), and a .claude/security-patterns.yaml file adds up to 50 custom deterministic rules with glob-scoped paths. When the plugin launched in May, Anthropic said its internal rollout and benchmarks showed a 30–40% decrease in security-related comments on PRs opened using the plugin — a vendor-stated figure reported via Help Net Security’s launch coverage, not an independently audited benchmark, so treat it as directional rather than proven.

Where the three-layer plugin reviews what changed, claude-security interrogates what exists. A full scan runs as a dynamic workflow — a JavaScript orchestration script that fans work out across subagents — moving through six phases, per MarkTechPost’s technical breakdown of the public plugin source:

• Inventory. The repo is partitioned into components; every top-level directory is either scanned or explicitly skipped with a stated reason.
• Threat model. One modeler per component produces entry points, sinks, and trust boundaries.
• Research. Researchers work a component-by-category matrix across four fixed lenses — injection and input, auth and access, memory and unsafe code, crypto and secrets — with the memory lens dropped for components written only in memory-safe languages.
• Sweep. Gap-fill passes catch what the matrix missed.
• Panel. Three-lens adversarial verification of every candidate finding (more on this below).
• Adversarial. At max effort only, marginal keeps are re-paneled and every survivor is red-teamed.

Effort tiers scale the scope: low and medium cap the scan at 12 components, high and max raise that to 24, and the number of gap-fill sweeps steps from zero at low effort up to two at high and max. Model assignments are tiered too — the orchestrator runs on Opus, the repository cartographer and read-only code explorer run on Sonnet, and researchers and verifiers inherit the session’s model. Every scan agent is restricted to read-only tools.

The deep scan’s most interesting design choice is its distrust of its own researchers. A candidate finding doesn’t reach the report because an agent found it — it gets there only after surviving a panel of three independent verifiers, one per lens: reachability (can an attacker actually get there?), impact (does it matter?), and defenses (does something already stop it?). If fewer than three voters return, the candidate can’t be kept at all.

Better still, the verification tally is computed in Python by the report renderer rather than asserted by the model. The revision stamp’s verification status reads “verified” only when the vote record proves the panel actually ran for every finding — otherwise it’s marked unverified with a stated reason. That’s Anthropic building an auditable check on the AI’s own rigor claims into the artifact itself, and it’s the kind of detail most of this week’s coverage skipped.

Output lands in a timestamped CLAUDE-SECURITY-* directory that is auto-gitignored so a stray git add can’t sweep a vulnerability report into your history: a human-readable Markdown report with findings tagged F1, F2, and so on — each with impact, exploit scenario, severity, confidence, and recommendation — plus a machine-readable JSONL file and a revision stamp recording exactly which commit was scanned at what effort level.

Patches follow the same trust model. Each one is drafted in a scratch copy of the repo and reviewed by an agent independent of the one that wrote it — running project tests when present — and is only produced when that review can vouch the change fixes the one finding, introduces no new vulnerability, and leaves behavior otherwise unchanged. Otherwise you get a note instead of a patch. Findings whose underlying code has changed since the report was generated are skipped with a note. Nothing is ever applied automatically: you run git apply yourself, one patch per PR.

Anthropic documents its review tooling across two separate docs pages, each with its own partial table. The reference below combines all seven rungs — the three free in-session layers plus the four on-demand, PR-time, and managed rungs — into one practitioner view. The consistent pattern: cost and depth rise together, and nothing on this list replaces your existing CI static analysis or dependency scanners, by Anthropic’s own explicit framing.

One practical note on the top of the stack: the managed Claude Security product monitors connected repositories continuously on the Enterprise plan, but the plugin version reaches code the managed product can’t — repositories hosted on GitLab or Bitbucket, or codebases on networks that allow no inbound connections. For teams in that position, the beta plugin is the only way to get the deep-scan pipeline at all.

Both plugins install from the official marketplace and apply without a restart. The three-layer plugin needs Claude Code v2.1.144 or later and Python 3.7+ on PATH (3.10+ for the agentic commit review and for model-backed reviews on third-party providers like Amazon Bedrock); on first run it creates a virtualenv under ~/.claude/security/ and installs the Claude Agent SDK. The diff-based layers need a git repository and skip silently outside one — the layer-1 pattern check works anywhere.

For teams, the rollout paths matter more than the install commands. Admins can enable the three-layer plugin fleet-wide via enabledPlugins in managed settings, or check it into a repo’s .claude/settings.json so every clone gets it — which is also the only way it carries into Claude Code on the web, since user-scoped plugins don’t follow you into cloud sessions run on Anthropic infrastructure. The new deep-scan plugin gets its org enablement switch in the admin console. We’ve run this exact two-plugin setup on our own client builds — it’s the kind of default we now bake into every web development engagement rather than treating security review as a separate line item.

Anthropic’s own documentation is unusually direct about limits, and the honest read starts there. None of the three in-session layers block writes or commits — findings reach the writing Claude as instructions, Claude addresses them in conversation, and the review model can still miss issues. Deep scans are explicitly nondeterministic: two scans of the same code can surface different findings, which is why the docs tell you to scan regularly and use revision stamps to attribute each report to exact code and settings. And a quirk worth knowing before your first scan: the docs note you may see “Fable 5’s safeguards flagged this message” during security work — the model’s cybersecurity safety classifiers can block certain activities and auto-downgrade to Opus, which is expected behavior, not a bug.

The trade press adds a fair counterweight on the new plugin’s transparency. Reported integrations — Slack and Jira via webhooks, CSV export, dismissals that carry forward across triage — appear in only one outlet’s coverage and aren’t corroborated by Anthropic’s docs as we fetched them, so treat those as unconfirmed color for now.

That critique is fair, and the sensible operating posture follows from it: validate the deep scan’s output against your existing SAST, DAST, and pen-testing practice, keep a human on every suggested patch, and treat both plugins the way Anthropic itself frames them — as one layer of defense in depth, not a replacement for a security program.

Zoom out and the week’s real signal is strategic. The same week Anthropic shipped a free three-layer reviewer to every Claude Code user and put a multi-agent deep scanner in open beta, Google gated its own security-specialized Gemini model behind restricted access for governments and trusted partners. Two labs, two opposite postures on the same question: is AI security capability something you democratize into every developer’s terminal, or something you control? Anthropic is betting that defense wins when it’s ambient — the same expansion instinct behind Record a Skill, its other toolchain addition this month.

Our projection: this becomes table stakes fast. Once one agentic coding tool reviews its own output by default, “my AI wrote it and nothing checked it” stops being a defensible engineering posture — for vendors and for teams. Expect competing CLIs to ship equivalent hooks within quarters, expect security review to show up in AI-coding procurement checklists, and expect the interesting differentiation to move to exactly what claude-security is pioneering: not finding candidate issues, which models are already decent at, but proving which findings are real. Here’s the practical version of that bet, by team situation:

For organizations working out where AI-assisted development fits their security posture — which rungs to mandate, how to budget deep-scan usage, how to wire review defaults into every repo — this is exactly the kind of toolchain decision our AI transformation engagements are built to settle in days rather than quarters.