security plugins

by Affaan Mustafa

Harness-native ECC workflows for Codex: shared skills, production-ready MCP configs, and selective-install-aligned conventions for TDD, security scanning, code review, and autonomous development.

by Affaan Mustafa

Harness-native ECC workflows for Codex: shared skills, production-ready MCP configs, and selective-install-aligned conventions for TDD, security scanning, code review, and autonomous development.

by Anthropic

Deep vulnerability scanning of your own code, run entirely inside your Claude Code session at a chosen effort tier, with every finding challenged before it is reported and the verification tally computed in code. Turns surviving findings into targeted patches, each verified by a panel of agents, that you apply when you choose. See the plugin README for the tiers, the report format, and the trust model.

by claude-code-templates

Denies Bash commands that match destructive patterns (recursive rm on roots, force push, hard reset, destructive SQL, disk formatting) before they run. A tool.call hook with a Bash matcher that returns { deny } without calling next.

by claude-code-templates

Screens every prompt going into the conversation and every reply coming out of it with TypeSafe's Jev, a System One decision model, the way TypeSafe's guardrails cookbook does: one request per message asks a battery of hazard questions (jailbreak, harm or a crime, a diagnosis or a dosage, self-harm) and scores how much harm complying would do. The thresholds live here, in a named policy (strict or permissive), and turn the probabilities into pass, review (the user is asked), block (the prompt is dropped, or the reply withheld) or support. Falls back to the engine's built-in classifier when no key is set.

by claude-code-templates

Asks the user, in the engine's AskUserQuestion dialog ($.ui.ask), before Claude edits or overwrites a file larger than a configurable line count; denies by default when nobody can answer (headless runs). A tool.call hook on Edit and Write using $.fs.read.

by claude-code-templates

Denies Edit, Write and NotebookEdit calls on sensitive paths (.env files, lockfiles, CI workflows, git internals, private keys) with a glob allowlist override. A tool.call hook with an array matcher.

by claude-code-templates

Redacts API keys, tokens, JWTs, private keys and connection strings from every tool result before the model reads them, notes the redaction through context, and refuses to echo a redacted placeholder back into a Bash command. A tool.call hook in the after placement.

by Alireza Rezvani

388 production-ready skills across 20 domains — engineering, marketing, product, compliance, C-level advisory, research, business operations, and more. 727 Python tools, 842 reference guides, 118 agents (cs-* + personas), 150 slash commands, 99 marketplace plugins. The largest open-source skills library for AI coding agents.

by Paweł Płatek

Comprehensive C/C++ security code review, with coverage verified against a parse of the source

by Andrea Cappa (Aptos Labs) & Paweł Płatek (Trail of Bits)

Comprehensive Rust security code review with specialized bug-finding agents covering the safe/unsafe boundary, memory safety in unsafe blocks, concurrency, panic-induced DoS, recursion-induced stack overflow, FFI, and async runtime hazards

by Eric Quintero

Audit a project's npm, PyPI, and Go dependencies for supply-chain risk: version-matched advisories for direct dependencies and the full lockfile tree, abandoned upstreams, npm publisher concentration, and install scripts

by OpenAI

Codex Security workflows for security scans, analysis, and investigation.

by Jeremy Longshore

Build authentication systems with JWT, OAuth2, and API keys

by Jeremy Longshore

Scan APIs for security vulnerabilities and OWASP API Top 10

by Claude Code Plugins

Check infrastructure compliance (SOC2, HIPAA, PCI-DSS)

by Claude Code Plugins

Scan containers for vulnerabilities using Trivy, Snyk, and other security tools

by Intent Solutions IO

Monitor cross-chain bridge activity, track transfers, analyze security, and detect bridge exploits

by Claude Code Plugins

Database plugin for database-security-scanner

by Jeremy Longshore

Terraform infrastructure as code for ADK and Vertex AI Agent Engine deployments

by Jeremy Longshore

GitHub Actions CI/CD workflows for Google Cloud and Vertex AI deployments

by Jeremy Longshore

Production readiness validator for Vertex AI deployments and configurations

by Claude Code Plugins

Manage Kubernetes network policies and firewall rules

by tonone-ai

Security Operations Team — 10 agents: Red, Blue, Hunt, Patch, Chain, Sast, Siem, Resp, Zero, Phish