Claude Security Continuous Scanning: Fix Tracking, API and MCP

Last updated: October 23, 2026

Claude Security no longer waits for someone to start a scan. Since the October 21, 2026 update, a project runs one deep baseline scan, then keeps rescanning as commits land. It marks a finding fixed when the fix ships and reopens it if the issue comes back. Findings can now leave the tool through a new API, an MCP connector for Claude and Claude Code, and webhooks. It is a public beta for Claude Enterprise, billed at direct token cost. The launch offer gives up to $25,000 in usage credits a month for two months.

If you are not on Enterprise, or you need Zero Data Retention, the same technology also ships as a Claude Code plugin that you run in your own session. This guide covers both. For reviews at pull-request time, which is a different layer, see Claude Code Review levels.

What shipped#

From Anthropic's announcement and the Help Center article:

• Continuous scanning. A project connects up to eight repositories. Claude reads the code, writes a threat model and runs a deep baseline scan. After that it checks for new commits and scans changes "based on their risk and complexity". There is no fixed schedule.
• Fix tracking. Claude re-checks open findings against the code that changed and marks them fixed when the fix lands, whether the fix came from Claude Code or anywhere else. If a later scan finds the issue again, the finding reopens automatically.
• Your context shapes the scan. Each project has a Knowledge tab with an editable threat model plus documents such as architecture docs. Claude uses them to decide what to flag and how to rate it, and to skip risks your environment already handles.
• Severity and exploit paths. Each finding is rated Critical, High, Medium or Low against the project's threat model, explains how an attacker would reach the code, and can include an attack-path diagram.
• Integrations. There is an API with personal access tokens, an MCP connector in Claude.ai and Claude Code, webhooks for new findings, and RBAC with Full, Triage and View project roles.
• Models. Scans run on Claude Mythos, with no Cyber Verification Program access required. Users get findings without direct model access. Background on that model is in our Claude Mythos explainer.

%% title: The Claude Security project lifecycle after the October 2026 update
flowchart TD
  A["Create project, connect up to 8 repos"] --> B["Claude writes a threat model"]
  B --> C["Deep baseline scan"]
  C --> D["Findings: severity, exploit path, fix guidance"]
  D --> E["New commits land"]
  E --> F["Scan changes by risk and complexity"]
  F --> D
  D --> G{"Fix merged?"}
  G -->|"Yes"| H["Marked fixed"]
  H -->|"Issue found again"| D
  D --> I["API, MCP connector, webhooks"]

Set it up#

Requirements: an active Claude Enterprise plan, a premium seat for each user, and usage credits enabled for consumption billing. An owner turns it on in Organization settings > Claude Security and sets who has access.

1. Connect repositories. For GitHub.com and GitHub Enterprise Server, an owner installs the Claude GitHub App and grants it the repositories to scan. For GitLab, Bitbucket and other Git servers, you supply the repository address and an auth token. A GitHub Enterprise Server or self-hosted instance must allow inbound traffic from Anthropic's IP ranges.
2. Create a project. Choose the branch and scope for each repository. A repository can be in scope, meaning scanned with findings reported, or context only, meaning read during scans with no findings reported. Both count toward the eight-repository limit. That is how a project catches issues that live between services, such as a backend that trusts input a client was supposed to validate.
3. Scope monorepos. Set a folder scope and exclude folders you don't need covered. Claude can still pull context from the rest of the codebase.
4. Fill in the Knowledge tab. Describe how the code is deployed, who can reach it and which risks you have accepted. If a finding describes an attack your environment makes impossible, tell Claude why in the project chat and ask it to update the threat model.
5. Wait for the baseline. Depending on repository size it can take several minutes or hours. You can leave the page while it runs.

Triage, fix and route findings#

Every finding carries a title, severity, category with a CWE ID where one applies, file and line locations (it can span several repositories), status, assignee, what Claude found, how to fix it, evidence tied to the scanned branch and commit, how the attack works, why Claude believes it, and a full history.

• Fix: click Fix on a finding to open Claude Code on that vulnerability. Without Claude Code in the cloud, you copy a prompt into your own Claude Code.
• Dismiss: choose false positive, accepted risk, duplicate or another reason, and optionally add a triage note. Dismissed findings do not reappear in future scans.
• API: create a personal access token under Claude Security settings. The token acts as you and can see and change only what you can. You can list and read projects and findings, resolve and reopen findings, and create and manage projects and their repositories.
• MCP connector: in Claude and Claude Code, it can list and read your projects and findings, and resolve or reopen a finding when you ask. An engineer can pull up a finding, ask about it, start the fix and mark it resolved in one session.
• Webhooks: create one under Claude Security settings to push new-finding events into systems such as Slack or Jira.

If you build your own security tooling on Claude, Claude Inference Hooks are the policy layer for your own model traffic, which is a different job from scanning code.

Cost#

There is no platform fee. Usage is charged at direct token cost and covers scans, threat-model writing, project chat and fix checks. You can set a separate spend limit for Claude Security, and each project's settings show month-to-date and per-day cost.

The launch offer terms:

• Up to $25,000 in promotional credits in each of two consecutive months, for Claude Enterprise organizations, including Enterprise bought through AWS Marketplace.
• Existing Enterprise organizations start on October 21, 2026. New ones start on their signup date. The two months run whether or not you use Claude Security, and unused credits do not carry over.
• The offer ends December 31, 2026 (UTC) even if your two months haven't finished, so organizations that sign up after November 1 won't get two full months.
• Credits are used before committed spend or usage credits, and apply only to projects in the new experience.

The Claude Code plugin: same idea, your session#

The Claude Security plugin is for teams that want the scanner without Anthropic's hosted agent infrastructure, have ZDR requirements, or reach models through a third-party provider such as Amazon Bedrock, Google Cloud's Agent Platform or Microsoft Foundry. It needs a paid plan, Anthropic API access or a third-party provider for the dynamic workflows it orchestrates, plus Python 3.9 or later on PATH as python3 and Git for change scans.

/plugin install claude-security@claude-plugins-official

If Claude Code reports Marketplace "claude-plugins-official" not found, run /plugin marketplace add anthropics/claude-plugins-official and retry. Then run /claude-security and pick Scan codebase, scan only your branch's diff, or ask directly, for example "scan commit abc1234". Each scan writes a CLAUDE-SECURITY-<timestamp>/ directory with:

• CLAUDE-SECURITY-RESULTS.md, the report
• CLAUDE-SECURITY-RESULTS.jsonl, the findings as JSON lines
• CLAUDE-SECURITY-RESULTS.sarif, for GitHub code scanning
• a revision stamp tying the report to the scanned commit

Suggest patches writes reviewed F<n>.patch files that are never applied automatically:

git apply CLAUDE-SECURITY-<timestamp>/patches/F1.patch

The plugin runs on your session's model, not Mythos, and the scan counts toward your normal Claude Code usage.

Gotchas and limits#

Scans are stochastic. Two scans of the same code can return different findings, by design. Treat Claude Security as a layer next to your static analysis and dependency scanners, not a replacement. The Claude Code docs say the same about the plugin.

No Zero Data Retention. The hosted product does not support ZDR. Use the plugin if that is a requirement.

Migration drops settings. Existing projects keep running in the old experience, and the launch credits do not apply to them. Migrating a project you own copies its findings and archives the original, but members, webhooks, excluded directories, scan history and scheduled scans are not copied. GitHub Enterprise projects can't be migrated.

The GitHub check is per user. If claude.ai/security keeps redirecting to "Install GitHub App", the cause is your own connected account. It may not be connected, may not be in the GitHub org, may need SSO authorization, or may be blocked by an IP allow list. In the last case, add 160.79.104.0/21 as an org-level allow list entry.

Scope of use. You may only scan code you or your company owns and holds the rights to scan. For open source projects, Anthropic runs a separate free program, covered in how to enroll in the OSS Scanner.

The closest alternative#

OpenAI's Codex Security is the direct comparison. It is an agent that reads your repository, hypothesizes attack paths and writes up findings, with the same split: a cloud version that scans connected GitHub repositories and can monitor new commits, plus a local plugin. Claude Security's edge after this update is the managed loop around the scanner. Automatic fix tracking and reopening, cross-repository projects and an API plus MCP connector make it something a security team can run as a system, not a report it reads once. If you already live in ChatGPT Enterprise or Codex, compare the two on your own repositories before committing to either.

What people are actually saying#

• The update is two days old. Beyond Anthropic's own announcement and customer quotes, we found no Hacker News or Reddit thread with independent practitioner results yet.
• The claim to test yourself is noise. Anthropic says every finding goes through multi-stage verification before it surfaces. Run one project with an honest Knowledge tab for a few weeks and count dismissed findings against fixed ones before you widen access.

FAQ#

What changed in Claude Security on October 21, 2026?#

It moved from one-off scans to continuous monitoring with fix tracking, a per-project threat model and knowledge base, an API, an MCP connector, webhooks and role-based access.

Who can use Claude Security?#

Claude Enterprise organizations, in public beta, with a premium seat per user and usage credits enabled. It does not support Zero Data Retention.

How much does Claude Security cost?#

Direct token cost with no platform fee, plus a launch offer of up to $25,000 in credits per month for two months through December 31, 2026.

What is the difference between Claude Security and the Claude Code plugin?#

The hosted service monitors connected repositories and runs on Claude Mythos. The plugin runs on demand in your own Claude Code session, on your session's model, and writes Markdown, JSONL and SARIF reports.

Can Claude Security scan GitLab or Bitbucket repositories?#

Yes, with the repository address and an auth token. GitHub.com and GitHub Enterprise Server connect through the Claude GitHub App.

Continue Reading#

• Claude Code Review Levels: Quick, Standard and Deep Explained - the pull-request layer of the same stack
• Codex Security Preview: AppSec Agent for Real Repos - OpenAI's take on the same job
• Anthropic OSS Scanner: How to Enroll - the free route for open source maintainers

Sources#

• Anthropic: Claude Security now scans continuously and tracks fixes (October 21, 2026)
• Claude Help Center: Use Claude Security
• Claude Code docs: Scan your codebase for vulnerabilities (Claude Security plugin)
• Claude Academy: Getting started with Claude Security