ClaudeMap

Defending Code Reference Harness

Anthropic's official reference harness for agentic vulnerability discovery — threat modeling, scanning, triage, and patching skills.

Plugins & Agentssecurityagentsofficialvulnerability
Visit projectanthropics/defending-code-reference-harness

Anthropic's reference implementation of the agentic security workflow behind their own vulnerability-discovery writeups: skills for threat modeling, scanning, triage, and patching, plus a pipeline that lets agents hunt bugs autonomously. More complete than the lighter security-review plugins already in this library. Labeled a reference implementation ("not maintained, not accepting contributions") — treat it as a blueprint to fork, not a product to subscribe to.

What it does

  • Anthropic's reference implementation for autonomous vulnerability discovery and remediation with Claude
  • Claude Code skills: /quickstart, /threat-model, /vuln-scan, /triage, /patch, /customize
  • harness/ implements a recon → find → verify → report → patch pipeline, configured for C/C++ memory bugs with Docker + ASAN
  • Includes /dnr-hunt and /dnr-respond skills for detection & response

When to use it

For security engineers who want a proven blueprint for LLM-driven vuln hunting — copy the pipeline shape, prompts and sandboxing, then port to your language/vuln class with /customize.

Getting started

Clone the repo and open it in Claude Code; run /quickstart to get oriented. The harness/ pipeline needs Docker for the ASAN-based verification loop.

Things to know

Not maintained and not accepting contributions — it's a reference, not a product; it will not work on every codebase out of the box. Managed alternative: Claude Security.

Repository

anthropics/defending-code-reference-harness

Charted

Related on the map

  • clawd-conduit

    Plugin / Agent

    Wire all 15 Claude Code hook events into the Clawd on Desk desktop pet — and turn permission requests into a blocking desktop card.

    • hooks
    • desktop
    • notifications
    • claude-code
    View

  • CometixCode

    Plugin / Agent

    An unofficial Rust 1:1 reimplementation of the Claude Code terminal UI, ported file-for-file onto an iocraft TUI framework.

    • terminal-ui
    • rust
    • reimplementation
    • unofficial
    View

  • Abide

    Plugin / Agent

    Hook-level enforcement for the natural-language rules in AGENTS.md and CLAUDE.md — every edit is judged and violations are repaired in the same turn.

    • hooks
    • code-review
    • rules
    • agents-md
    View