appsec plugins

by Anthropic

Deep vulnerability scanning of your own code, run entirely inside your Claude Code session at a chosen effort tier, with every finding challenged before it is reported and the verification tally computed in code. Turns surviving findings into targeted patches, each verified by a panel of agents, that you apply when you choose. See the plugin README for the tiers, the report format, and the trust model.

by OpenAI

Codex Security workflows for security scans, analysis, and investigation.

by Project CodeGuard

Security code review skill based on Project CodeGuard's comprehensive security rules. Helps AI coding agents write secure code and prevent common vulnerabilities.

by Ross Young

Agentic-Security: SAST + SCA + secrets + IaC + LLM-sec scanner with deterministic fix toolchain. Exposes a Model Context Protocol (MCP) server with 17 tools that Codex CLI can call directly.

by Application Security Team

Code-derived threat modeling plugin: the architecture model is derived from the repository, not maintained by hand. Provides AppSec-focused agents and skills for threat modeling, STRIDE analysis, dependency scanning, QA review, and security context resolution.

by Matt Corbett

Security-engineering (AppSec) team — agents (appsec-engineer, threat-modeler, supply-chain-security-engineer, cloud-security-engineer) for building security INTO software: threat modeling (STRIDE, data-flow diagrams, trust boundaries), application security testing (SAST/DAST/IAST/SCA in CI, OWASP Top 10 web), secrets management (detection, rotation, vaulting, no plaintext), software supply-chain integrity (SBOM consumption, dependency CVEs, SLSA verification, pinning), and cloud security posture (CSPM, IAM least-privilege, network exposure). skills, a decision-tree knowledge bank (vuln-triage + secrets-handling trees + a dated 2026 tooling map), best-practices, templates, commands, an advisory hook. **Proposes controls; every ship/no-ship security VERDICT escalates to ravenclaude-core/security-reviewer.** Seams: API OWASP -> api-engineering, identity -> auth-identity, data privacy -> data-governance-privacy. Requires ravenclaude-core@>=0.7.0.

by Dtwo

Manage Dtwo gateways, policies, and Rego with the Dtwo MCP server.

by OpenAI

Codex Security workflows for security scans, analysis, and investigation.

by daviduartedev

Agent Skills for AppSec in spec-driven development (OWASP ASVS 5.0.0 by relevance) and a human smoke checklist after implement

by Endor Labs

Endor Labs security workflow skills, agents, and MCP server for GitHub Copilot. Requires only the endorctl binary: no Node, Python, or Unix tools.