anthropics/defending-code-reference-harness

Health v2 · maintenance only

Flags: no_releases young no_license

Adoption not part of the score

7368 stars · 594 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

A reference implementation from Anthropic for autonomous vulnerability discovery and remediation using Claude, including Claude Code skills for threat modeling, scanning, triage, and patching, plus an autonomous scanning harness configured for C/C++ memory vulnerabilities. It also includes detection-and-response skills for hunting attackers already present in logs.

Use cases

• find memory safety vulnerabilities in C/C++ codebases with an LLM agent
• build a threat model for my repository before scanning
• triage and verify LLM-discovered vulnerability findings to reduce false positives
• automatically generate patches for confirmed vulnerabilities
• customize an autonomous vulnerability scanning pipeline for my language or vuln class
• hunt for signs of an attacker already in my logs and propose a response

When to choose

• you want an open-source, customizable reference pipeline for LLM-driven vulnerability discovery and remediation
• you use Claude APIs (including Bedrock, Vertex, or Azure) and want to build your own security scanning workflow
• you need skills for interactive threat modeling, scanning, triage, and patching in Claude Code
• you want to learn Anthropic's best practices for securing source code with LLMs

When to avoid

• you need a maintained, production-ready product with support - the repo explicitly is not maintained and accepts no contributions
• you want a turnkey scanner that works on every codebase out of the box - the harness is a reference, not a product
• you prefer a managed hosted solution - consider Anthropic's Claude Security product instead
• you need a permissive license - the license is non-standard (NOASSERTION)

Facets

framework · maturity maintenance

security vulnerability-scanning agent-framework penetration-testing developer-tools security developer-tools artificial-intelligence python cli cross-platform vulnerability-discovery threat-modeling triage patching claude-code-skills llm-security memory-safety asan detection-and-response reference-implementation ai-agents docker

Member repositories

For agents

markdown · JSON · MCP: product_card(name="anthropics/defending-code-reference-harness")