Claude Code as Security Scanner (Research Preview)
Beyond securing Claude Code itself, Anthropic offers a dedicated vulnerability scanning feature: Claude Code Security.
⚠️ Research preview: Access via waitlist only. Not yet in GA. Details: claude.com/solutions/claude-code-security
What it does
- Scans your entire codebase for vulnerabilities using contextual reasoning (traces data flows cross-files)
- Adversarial validation: findings are challenged internally before surfacing to reduce false positives
- Generates patch suggestions that preserve code structure and style
- Requires human review and approval before any fix is applied
How it differs from the Security Auditor Agent
| Security Auditor Agent (today) | Claude Code Security (preview) | |
|---|---|---|
| Access | Available now, any plan | Waitlist only |
| Scope | OWASP Top 10, rule-based | Whole codebase, semantic analysis |
| Patches | No (reports only) | Yes (with human approval) |
| Model | Configurable | Anthropic's most capable models |
When to use which
- Now → Use the Security Auditor Agent + Security Patcher Agent for full detect-then-patch coverage
- Now → Use the Security Gate Hook to block vulnerable patterns at write time
- Waitlist → Join the preview for deeper semantic analysis once your team needs it