How to scan your whole repo for vulnerabilities with Claude Code's Claude Security plugin

Claude Code's Claude Security plugin sends a team of agents through your repository: they map the architecture, build a threat model, then hunt for vulnerabilities. Every candidate goes to separate verifier agents that try to disprove it, and only the survivors make the report. Unlike the security-guidance plugin, which reviews code as Claude writes it, this is an on-demand deep scan. A post that passed 500 likes on X on October 16 recommends the same steps.

1. Pick the model first. The agents that hunt and verify run on your session's model, and the plugin README recommends Opus 5.5 or Fable 5.1.

/model

1. Install from the official marketplace and reload plugins.

/plugin install claude-security@claude-plugins-official
/reload-plugins

If you see Marketplace "claude-plugins-official" not found, run /plugin marketplace add anthropics/claude-plugins-official first. If you see Plugin "claude-security" not found, refresh the catalog with /plugin marketplace update claude-plugins-official and retry.

1. Run /claude-security for a menu with Scan codebase, Scan changes and Suggest patches. You can also skip the menu and state the scope and effort directly.

/claude-security scan the whole repo at high

It asks once to confirm the time and token cost before it starts. Keep Claude Code open until it finishes, and follow progress in /workflows. On a large repository, scan one area at a time, such as your API layer or auth code.

1. Results land in a CLAUDE-SECURITY-<timestamp>/ directory in your repo. CLAUDE-SECURITY-RESULTS.md lists each finding with its severity (CRITICAL, HIGH, MEDIUM or LOW) and exploit scenario, and the same findings come as JSONL and SARIF. The directory carries its own .gitignore, so it won't be committed by accident.

2. Run /claude-security again, pick Suggest patches and choose findings, and you get one patch file per finding, such as patches/F1.patch. Patches are never applied automatically. Apply each from your shell, one pull request per patch.

git apply CLAUDE-SECURITY-<timestamp>/patches/F1.patch

You need a paid plan, Anthropic API access or a third-party provider. Scans run on dynamic workflows, so on Pro turn on the Dynamic workflows row in /config. You need python3 3.9 or later on your PATH, and git for change scans and patches. Scans count toward your usage, and two scans of the same code can find different things.