Claude Code Security Review
https://github.com/anthropics/claude-code-security-review- Category
- Cybersecurity
- Rank
- No. 617Tools index
- Pricing
- Open Source
- Type
- TOOL
- Builder
- anthropics
- GitHub
- 6.2k stars
- Date
About
Anthropic's GitHub Action that uses Claude to analyze diffs for security vulnerabilities — flags issues with explanation and fix suggestions on every PR.
What it does
It acts as an automated security gate for code changes. Claude studies repository context and modified code, returns structured findings with severity and confidence, filters low-signal results, then can publish line-specific comments and upload JSON output.
Why it's ranked here
The design targets a real weakness in conventional pattern scanners: understanding intent and tracing risky behavior across context. Its strict confidence threshold, explicit exclusions, configurable prompts, structured output, and second filtering stage make it practical for pull-request triage. The prompt-injection warning, however, sharply limits where teams can run it safely.
What's good
The audit prompt demands exploit scenarios, remediation guidance, confidence scores, and focus on newly introduced risks. Hard rules remove recurring noise such as generic rate-limit advice and documentation findings. Teams can add organization-specific vulnerability categories and replace filtering criteria without discarding the default scan categories.
Tradeoffs
It requires an API key enabled for both Claude API and Claude Code usage. The authors explicitly say it is not hardened against prompt injection and recommend reviewing only trusted contributions. Default filtering intentionally omits denial of service, resource exhaustion, rate limiting, open redirects, and several other lower-signal classes, so coverage is selective.
How to use it well
Use it for trusted pull requests where maintainers want focused, actionable security comments before merging. Start with default filtering, then version organization-specific assumptions beside the code and have security staff approve them. Keep conventional dependency, secret, compliance, and broad static scanning tools, because this deliberately excludes important categories and is not a complete security program.
Technical notes+
The Python package builds its audit prompt in claudecode/prompts.py, including pull-request metadata, optional unified diff content, custom categories, a structured JSON schema, severity guidance, and confidence thresholds. claudecode/findings_filter.py applies regex-based hard exclusions before optional Claude API filtering, while claudecode/json_parser.py parses direct JSON or extracts objects from surrounding text and code fences. Defaults such as model, token limit, retry count, exit codes, and subprocess timeout live in claudecode/constants.py. Prompt, parser, filtering integration, and evaluation behavior have pytest coverage in claudecode/test_prompts.py, claudecode/test_json_parser.py, claudecode/test_integration.py, and claudecode/test_eval_engine.py.
Observed
- License
- MIT License
- Primary implementation language
- Python
- Install surface
- GitHub Action configured in a repository workflow
- Interfaces
- GitHub Action and Claude Code slash command
- Platform example
- The documented workflow runs on Ubuntu
- Test structure
- Pytest modules are colocated under the claudecode package
Read from README.md, __init__.py, docs/custom-filtering-instructions.md, docs/custom-security-scan-instructions.md, claudecode/audit.py, claudecode/logger.py, claudecode/prompts.py, claudecode/__init__.py, claudecode/constants.py, claudecode/json_parser.py, claudecode/test_prompts.py, claudecode/findings_filter.py, claudecode/test_eval_engine.py, claudecode/test_integration.py, claudecode/test_json_parser.py.
What it can do
Analyze code diffs for security vulnerabilities
Git diff from pull request → List of identified security issues
Flag security issues in pull requests
Pull request code changes → Security vulnerability alerts with flagged code sections
Generate explanations for security vulnerabilities
Identified security issue in code → Detailed explanation of the vulnerability
Suggest fixes for security vulnerabilities
Security vulnerability in code → Recommended code changes to fix the issue
Automatically review every pull request
New pull request submission → Security review report with findings
Tags
Tech Stack
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.