Claude Code

Security guidance plugin pattern-checks each file edit Claude makes; no linting as a human types.

Security guidance plugin reviews Claude's edits, end-of-turn diffs and commits, then re-prompts Claude to fix.

/code-review and /security-review run in the terminal; /claude-security local scan needs a paid plan.

Managed Code Review posts severity-tagged inline GitHub comments plus a check run; Team/Enterprise only.

Check run always completes neutral by design; gating requires parsing the JSON summary line in your own CI.

/claude-security plugin scans a whole codebase; verifier agents confirm findings before reporting.

Managed Claude Security continuously monitors repositories on a schedule; cron runs also possible via GitHub Actions.

Not offered in vendor documentation reviewed as of 2026-09-05.

Agentic security review statically finds injection, SSRF, auth bypass, IDOR and weak crypto in code.

Managed Claude Security "traces data flows across files" per vendor docs; beta, Enterprise plan only.

Not mentioned in Claude Security, security-guidance, /security-review, or Code Review vulnerability checklists.

Not mentioned anywhere; no capability to verify whether a found secret still works.

No native dependency scanning; Anthropic's plugin docs defer supply-chain checks to your existing scanners.

Not mentioned in any Claude Code security-scanning documentation checked.

Claude Security plugin explicitly delegates "supply-chain checks" to external dependency scanners.

Not documented in Claude Code's security scanning or legal-and-compliance docs.

Not documented in any Claude Code security-scanning page checked.

No Terraform, Kubernetes, or Dockerfile scanning mentioned in any Claude Code security docs.

Not documented in any Claude Code security-scanning page checked.

No live cloud-account configuration scanning mentioned in any Claude Code docs.

Docs state reviews read "source code in your checkout, not a running site or deployed service."

/code-review reports reuse, simplification and efficiency cleanups; managed PR review excludes formatting and style.

Code Review scopes explicitly to correctness bugs and cleanup suggestions only, per its docs.

Not documented as clone detection; /code-review "reuse" cleanups are adjacent but different.

Not mentioned in any Claude Code review-product documentation checked.

Code Review explicitly does not flag missing test coverage by default; no coverage measurement documented.

Code Review docs explicitly exclude "missing test coverage" from its default checks.

No module-boundary or dependency-direction enforcement mentioned in any Claude Code docs.

No remediation-effort or cost quantification feature mentioned in any Claude Code docs.

No git-history hotspot, change-coupling, or bus-factor analytics product exists in the docs.

Parallel agents hunt correctness bugs; a verification step checks findings against actual code behavior.

Review body summary plus severity-sorted check-run Details; REVIEW.md can reshape its format.

REVIEW.md, hierarchical CLAUDE.md, and up to 50 custom regex patterns in security-patterns.yaml.

/code-review --fix edits the working tree; /claude-security drafts F<n>.patch files for manual git apply.

Opens fix PRs on request; the GitHub Action can commit fixes automatically.

Independent verifier agents reproduce findings before reporting, in Code Review, ultrareview and Claude Security.

Dedicated docs cover per-package CLAUDE.md, sparse worktrees, and per-directory skills for monorepos.

Entire product is agent-based: parallel reviewer agents on Anthropic infrastructure with independent verification.

Bring your own key via Console, Bedrock, Vertex, Foundry or LLM gateways; Claude models only.

Consumes MCP servers with first-use trust verification; no MCP server exposing review findings documented.

No AI-generated-code inventory; org analytics cover usage, per-repo cost and spend caps instead.

Web/desktop diff comments get responses; replying to GitHub Code Review comments does not prompt a reply.

Thumbs up/down reaction counts collected post-merge to tune the reviewer; no immediate re-review.

Zero Data Retention for qualified Enterprise accounts; no explicit training-exclusion statement in source.

Audit logging listed among cloud/web session execution safeguards for Anthropic-managed VMs.

Enterprise plans include SSO identity federation via OIDC.

Owner/Primary Owner roles gate setup; PR triggers require owner, member or collaborator access.

Not offered in vendor documentation reviewed as of 2026-09-05.