Claude Code Security Review: 3 Free AI Agents (2026)

New to Claude Code? Start hereWhat you need before installing anything

Get your code onto your computer. These tools read code in a folder. Built in Lovable? Connect your project to GitHub, then clone it so you have a local copy.
Install Claude Code and open it inside that folder. Two of the three tools only exist inside Claude Code.
Put the project on GitHub. /security-review compares your changes against the main branch on GitHub, and the Security Guidance plugin needs a git repository for its deeper checks.
Have Python and Node.js installed. The plugin runs on Python. The Cloudflare skill installs with npx, which comes with Node.js. Not sure? Ask Claude Code to check for you.
Only scan apps you own. These are for protecting your own work.

The 3 agents, from quickest to deepest

/security-review

A built-in Claude Code command that checks the changes on your current branch for security problems, like injection, login and permission issues, and data leaks. It looks at what changed compared with your main branch on GitHub.

code.claude.com/docs/en/commands

Install it

Note

Nothing to install. Open Claude Code in your project folder and type:
/security-review

Try it
Paste in Claude Code
```
/security-review
```
Claude reads your changes and lists each security risk it finds, explained in plain words.

Heads up It only reviews changes, not your whole app, so run it on a branch with new work before you merge it into main. More

If it stops with an ambiguous argument error, your project is missing a link to its main branch on GitHub. Run this, swapping main for your main branch name if it's different, then try again:

git remote set-head origin main

think of it as the airport bag scanner. Quick, built in, and it only checks what you just packed.

Security Guidance

Anthropic's free plugin that watches Claude while it writes your code. It checks at three points: a quick scan on every file edit for about 25 known risky patterns, a separate Claude review of everything that changed at the end of each turn, and a deeper review that reads related files whenever Claude makes a git commit. When it finds something serious, Claude gets the finding and fixes it in the same chat.

github.com/anthropics/claude-plugins-official/tree/main/plugins/security-guidance

Install it
Paste in Claude Code
```
/plugin install security-guidance@claude-plugins-official
```
Type that inside Claude Code. When it asks for a scope, pick user scope so it runs in every project. If it says the marketplace isn't found, run this first and try again:
Paste in Claude Code
```
/plugin marketplace add anthropics/claude-plugins-official
```
If the install summary says Run /reload-plugins to apply., type /reload-plugins.
Try it
There is nothing to run. Just keep building, for example:
You, to Claude
```
Add a search box to my app that shows the user what they searched for.
```
If the plugin spots a risk, you'll see the finding and Claude's fix right in the chat. No message means it didn't flag anything.

Heads up The per-edit scan costs nothing, but the end-of-turn and commit reviews use your Claude usage like any other request. More

It only checks code Claude writes or changes, not code that was already there, and it does not review commits you make yourself outside Claude.

this one sits in the passenger seat and grabs the wheel before you hit the curb.

Cloudflare security-audit skill

An open-source skill from Cloudflare (more than 25,000 stars on GitHub) that turns your coding agent into a full security team. It runs six phases: map your app, send separate hunter agents after holes, give every possible problem to a fresh agent that tries to prove it wrong, save the results, have more fresh agents double-check them, then write the report. You get REPORT.md, plus FINDINGS-DETAIL.md and NEEDS-VALIDATION.md, saved by default in ~/security-audit-skill/<repo-name>/run-<N>, outside your project.

github.com/cloudflare/security-audit-skill

Install it

Paste in Terminal

npx skills add https://github.com/cloudflare/security-audit-skill \
  --skill security-audit

Paste it into your terminal, or ask Claude Code to run it for you. To install it for every project on your computer, add --global:

Paste in Terminal

npx skills add https://github.com/cloudflare/security-audit-skill \
  --skill security-audit \
  --global

Try it
You, to Claude
```
security audit this codebase
```
The skill switches on by itself, works through the phases, and ends with a report of confirmed problems, the exact place in your code, and the smallest fix for each.

Heads up It launches a lot of agents, so it uses a lot of your Claude usage. More

Run it before launch, not every day. For a lighter first pass, ask for its quick profile, or give it a budget (a maximum number of agents) and it will stay under it. Some findings land in NEEDS-VALIDATION.md because the skill won't run your app's code without a proper sandbox. One run won't catch everything: in Cloudflare's own tests, a single run found roughly half of what repeated runs found.

When to run which

When	Use	Why
While you build	Security Guidance	Runs by itself and fixes risky code as Claude writes it
After every change	/security-review	One command, checks just what changed
Before you launch	Cloudflare security-audit skill	Deep audit of the whole codebase with a written report

Questions people ask

Do I need to know how to code to use these?

No. You type one command or one plain-English request, and Claude explains what it found in plain words. You do need your app's code in a folder on your computer and Claude Code to open it.

Are these really free?

The tools are free. /security-review is built into Claude Code, Security Guidance is a free Anthropic plugin available on all plans, and Cloudflare's skill is open source under the MIT license. The reviews still use your normal Claude usage, and the Cloudflare audit uses a lot of it.

I build with Cursor or Lovable. Can I still use these?

/security-review and Security Guidance only work inside Claude Code. Cloudflare's skill installs with the Skills CLI, which lists Cursor as a supported agent. Lovable users can sync the project to GitHub, clone it to their computer, and open that folder in Claude Code.

Will these attack my live website?

No. They read the code on your computer, not your running site. Cloudflare's skill is written as a defensive audit and tells its agents not to probe deployed services. Only run them on apps you own.

Where Ned does his homework

The tools are free. Knowing what to ask them for is the real skill. Professor Glitch teaches it from zero, in order, inside the community: 8 courses and 200+ lessons. These two are where Ned started.