Anthropic’s Claude Code team posted on X that it has shipped a “security-guidance plugin” for Claude Code, a tool the company describes as helping identify and fix vulnerabilities while code is being written. The plugin is available to all Claude Code users through the plugin marketplace, according to the post.
In the company’s description, the plugin runs through hooks and checks code at three stages: on file edits, after model turns, and on commits. Anthropic states that the first pass looks for “risky patterns” such as commonly misused dangerous libraries, while later checks review the full diff and surrounding code for harder-to-spot issues.
The company also claims it has used the plugin internally and that, across its rollout and benchmarks, it saw a “30-40% decrease in security-related comments on PRs” when the plugin was involved. That figure should be treated cautiously, but it suggests the tool is being positioned as an early filter before a fuller code review.
Anthropic added that org-specific policy can be stored in a claude-security-guidance.md file, either in a repository or distributed via MDM. The plugin then enforces those rules alongside built-in checks.
Source: ClaudeDevs on X
