A marketplace of Trail of Bits agent skills and plugins for AI-assisted security auditing, testing, and secure development in Claude Code and Codex.
8.1K+146 this week683PythonCC-BY-SA-4.0Well maintainedUpdated yesterday
anthropics/defending-code-reference-harness
Reference implementation of an autonomous vulnerability discovery and patching pipeline for Claude, with interactive security skills for threat modeling, scanning, triage, and patching.
- Stars
- 7,714
- Forks
- 637
- Open issues
- 21
- Last commit
- 3 months ago
What is it?
This repository is a reference harness for using Claude to find and fix security vulnerabilities in source code. It provides Claude Code skills for interactive work: building a threat model, running static scans scoped by that model, triaging and deduplicating findings, and drafting patches. These skills only read and write files, so they can be run without a sandbox while you approve each tool use.
The autonomous harness runs a pipeline of recon, find, verify, dedupe, report, and patch stages. Find agents run in parallel, each in an isolated container, and a separate grader reproduces crashes before they are reported. The default configuration targets C/C++ memory bugs using Docker and AddressSanitizer, and includes a `/customize` skill for porting it to other languages or vulnerability classes. A detection and response track is also included for hunting an attacker's activity in logs.
Autonomous pipelines execute target code, so they are designed to run inside a gVisor sandbox with restricted network egress.
Key features
- 01Claude Code skills for threat modeling, static scanning, triage, and patch generation
- 02Autonomous pipeline that finds, verifies, and reports crashes in parallel containers
- 03Default C/C++ configuration using Docker and AddressSanitizer
- 04/customize skill for adapting the pipeline to other languages or vulnerability classes
- 05Detection and response mode for hunting attacker activity in logs
Use cases
- Security teams auditing C or C++ codebases for memory-safety bugs
- Developers building a threat model and scoping a static scan before review
- Teams porting an automated vulnerability-finding pipeline to their own language stack
- Responders searching application logs for an active attack campaign
Quick start
- 1
Clone the repository
git clone https://github.com/anthropics/defending-code-reference-harness - 2
Enter the repo and start Claude Code
cd defending-code-reference-harness && claude - 3
In Claude Code, run the guided intro skill
/quickstart
Things to know
- The autonomous pipeline executes target code and requires Docker and a gVisor sandbox.
- The harness is a reference for C/C++ memory bugs and needs customization for other languages.
- The repository is not maintained and is not accepting contributions.
In collections
Topics
FAQ
- What is defending-code-reference-harness?
- Reference implementation of an autonomous vulnerability discovery and patching pipeline for Claude, with interactive security skills for threat modeling, scanning, triage, and patching. This repository is a reference harness for using Claude to find and fix security vulnerabilities in source code. It provides Claude Code skills for interactive work: building a threat model, running static scans scoped by that model, triaging and deduplicating findings, and drafting patches. These skills only read and write files, so they can be run without a sandbox while you approve each tool use.
- Is defending-code-reference-harness free to use? What license does it have?
- defending-code-reference-harness is open source under the Other license. Check the license terms before using it in commercial products.
- Is defending-code-reference-harness still maintained?
- Updated within 6 months. The last commit to defending-code-reference-harness was on Aug 6, 2026.
- What can I use defending-code-reference-harness for?
- Security teams auditing C or C++ codebases for memory-safety bugs Developers building a threat model and scoping a static scan before review Teams porting an automated vulnerability-finding pipeline to their own language stack Responders searching application logs for an active attack campaign
- How do I install defending-code-reference-harness?
- Clone the repository: git clone https://github.com/anthropics/defending-code-reference-harness Enter the repo and start Claude Code: cd defending-code-reference-harness && claude In Claude Code, run the guided intro skill: /quickstart
- Where can I get defending-code-reference-harness?
- The source code and installation instructions are on GitHub: https://github.com/anthropics/defending-code-reference-harness
Summary generated by AI from the project's README. GitHub stats refresh daily.
Related projects
A coding-agent skill that runs multi-phase security audits with isolated agents, independent verification, and machine-readable findings.
65.4K+10.3K this week4.2KJavaScriptMITUpdated 2 months ago
AI-powered threat modeling tool that uses LLMs to generate STRIDE threat models, attack trees and mitigations for an application.
1.2K+3 this week337PythonMITWell maintainedUpdated 11 hours ago
Open source AI code review that runs a separate reviewer over your agent's changes before you push, for Claude Code, Codex, Cursor and Cline.
1.1K79TypeScriptApache-2.0Updated 12 hours ago
A local code knowledge graph that gives AI coding tools precise review context over MCP and a CLI.
32.6K+110 this week3KPythonMITUpdated yesterday
Google's continuous fuzzing service for open source projects, running libFuzzer, AFL++ and Honggfuzz with sanitizers to find security bugs.
12.9K+94 this week3KShellApache-2.0Updated yesterday