This project provides a reference implementation for autonomous vulnerability discovery and remediation using Anthropic's Claude LLM. It targets security engineers and researchers seeking to build customizable, LLM-powered security analysis pipelines, offering a framework to automate threat modeling, scanning, triage, and patching.

How It Works

The project offers both interactive "Claude Code skills" and an autonomous reference pipeline (harness/). The pipeline orchestrates a multi-stage process: Build (compiling target code with ASAN), Recon (partitioning attack surface), Find (generating inputs causing crashes), Verify (reproducing crashes), Dedupe (identifying unique bugs), Report (analyzing exploitability), and Patch (generating and verifying fixes). This approach leverages LLMs for code understanding and generation, combined with sandboxed execution and verification steps to discover and remediate vulnerabilities.

Quick Start & Requirements

• Primary install: Clone the repository, cd into it, and run claude /quickstart for an interactive introduction.
• Prerequisites: Docker, gVisor (installed via scripts/setup_sandbox.sh), an Anthropic API key (ANTHROPIC_API_KEY or CLAUDE_CODE_OAUTH_TOKEN), and Python 3.x are required. The reference pipeline is configured for C/C++ memory vulnerabilities using AddressSanitizer (ASAN).
• Setup: The scripts/setup_sandbox.sh script installs necessary components like gVisor. The "Ramp Up" section suggests a phased approach over several days.
• Links:
  • Blog Post: blog-post.md
  • Security Docs: docs/security.md, docs/agent-sandbox.md
  • Pipeline Docs: docs/pipeline.md
  • Customization Docs: docs/customizing.md

Highlighted Details

• Interactive Skills: Includes commands like /threat-model, /vuln-scan, /triage, /patch, and /customize for guided, interactive security analysis.
• Autonomous Pipeline: The harness/ directory contains a reference pipeline (recon → find → verify → report → patch) designed for C/C++ memory vulnerabilities.
• Customization: The /customize skill enables porting the pipeline to different languages, vulnerability classes, or codebases by answering key questions about the target stack.
• Sandboxing: The autonomous pipeline executes target code within a gVisor sandbox with restricted egress for security, requiring explicit override to run unsandboxed.
• Phased Adoption: Recommends a "start small on Day 1" approach, progressing from interactive skills to autonomous pipeline runs and customization.

Maintenance & Community

This repository is explicitly marked as "not maintained and is not accepting contributions." Anthropic offers a managed product, "Claude Security," as an alternative. No community links (e.g., Discord, Slack) are provided.

Licensing & Compatibility

The license type is not specified in the provided README. Compatibility is noted for various Claude API access points (Bedrock, Vertex, Azure). While the reference pipeline targets C/C++ memory vulnerabilities, it is designed to be customizable for other languages and vulnerability classes.

Limitations & Caveats

The project is a reference implementation, not a product, and will not work on every codebase out-of-the-box, requiring customization. Autonomous triage and patching are noted as areas where the harness does not fully solve the problem, with severity and prioritization remaining user judgments. The repository is unmaintained and not accepting contributions.