{"version":"v1","licence":"CC-BY-4.0","id":"defending-code-reference-harness","name":"Defending Code Reference Harness","repo":"anthropics/defending-code-reference-harness","repository_url":"https://github.com/anthropics/defending-code-reference-harness","docs_url":"https://github.com/anthropics/defending-code-reference-harness#readme","description":"Anthropic's reference Claude Code skills and autonomous pipeline for threat modelling, vulnerability scanning, triage and patching. Not maintained.","summary":"Anthropic's reference for finding and fixing vulnerabilities with Claude. Claude Code skills (/threat-model, /vuln-scan, /triage, /patch) only read and write files. The autonomous pipeline targets C/C++ memory bugs with Docker and ASAN, runs target code only in a gVisor sandbox, and must be ported to other languages. Apache-2.0. Not maintained or accepting contributions; Anthropic points to its paid Claude Security for a managed option. Needs Claude access.","capabilities":["agent-skills","code-scan"],"tags":["Agent skills","Security"],"alternatives":[{"product":"snyk","jobs":["code-scan"],"coverage":"partial","note":"Claude-driven threat modelling, source scanning, triage and patch drafts; reference code you adapt yourself, unmaintained, with no dependency, IaC or container scanning."}],"facts":{"runs_locally":{"status":"yes","value":"Yes, Claude Code skills in a local clone; the autonomous pipeline runs in local Docker containers","source_url":"https://github.com/anthropics/defending-code-reference-harness#getting-started","checked_at":"2026-10-23","confidence":"high","validation":"documentation_review","modes":["local"],"untrusted_source_quote":"Open this repo in Claude Code and run `/quickstart` to get oriented."},"code_license":{"status":"yes","value":"Apache-2.0 (GitHub shows no SPDX id, but the LICENSE file is the Apache License 2.0)","source_url":"https://github.com/anthropics/defending-code-reference-harness/blob/main/LICENSE","checked_at":"2026-10-23","confidence":"high","validation":"documentation_review","spdx":"Apache-2.0","untrusted_source_quote":"Licensed under the Apache License, Version 2.0"},"model_license":{"status":"yes","value":"No bundled weights; uses Claude","source_url":"https://github.com/anthropics/defending-code-reference-harness#readme","checked_at":"2026-10-23","confidence":"high","validation":"documentation_review","spdx":null,"applies":false},"commercial_use":{"status":"yes","value":"Yes, Apache-2.0","source_url":"https://github.com/anthropics/defending-code-reference-harness/blob/main/LICENSE","checked_at":"2026-10-23","confidence":"high","validation":"documentation_review"},"paid_services":{"status":"no","value":"Needs access to Claude through Claude Code or the Claude API (direct, Bedrock, Vertex or Azure)","source_url":"https://github.com/anthropics/defending-code-reference-harness#readme","checked_at":"2026-10-23","confidence":"high","validation":"documentation_review","required":["Claude (Claude Code or API)"],"optional":[],"untrusted_source_quote":"it can be used with whatever access you have to Claude APIs (including Bedrock, Vertex, or Azure)"},"hardware":{"status":"partial","value":"No GPU needed, Claude runs via the API; the skills have no hardware needs of their own; pipeline agent containers get a 4 GB Docker memory cap by default (memory_limit in the target config); no host CPU, RAM or disk minimum documented","source_url":"https://github.com/anthropics/defending-code-reference-harness/blob/main/targets/README.md","checked_at":"2026-10-26","confidence":"medium","validation":"documentation_review","cpu_ok":true,"min_vram_gb":null,"min_ram_gb":null,"untrusted_source_quote":"docker --memory for agent containers (default 4g)"},"platforms":{"status":"partial","value":"Interactive skills run wherever Claude Code runs; the sandboxed pipeline needs Docker with the gVisor runtime, set up with sudo and /etc/docker/daemon.json (Linux)","source_url":"https://github.com/anthropics/defending-code-reference-harness/blob/main/docs/agent-sandbox.md","checked_at":"2026-10-23","confidence":"medium","validation":"documentation_review","windows":"unknown","macos":"unknown","linux":"yes","untrusted_source_quote":"It needs `sudo` (to install a new Docker runtime and edit `/etc/docker/daemon.json`)"},"setup":{"status":"yes","value":"Easy for the skills (clone, open in Claude Code, run /quickstart); medium for the pipeline, which needs Docker, a one-time gVisor sandbox setup and porting to your language","source_url":"https://github.com/anthropics/defending-code-reference-harness#getting-started","checked_at":"2026-10-23","confidence":"high","validation":"documentation_review","level":"medium","untrusted_source_quote":"To get set up, run `scripts/setup_sandbox.sh` once, then invoke the pipeline via `bin/vp-sandboxed`."}},"metrics":{"stars":7695,"forks":635,"contributors":4,"archived":false,"last_push_at":"2026-08-06T21:42:09Z","latest_release":null,"fetched_at":"2026-11-03T01:20:55.050Z"},"url":"https://repoquarry.dev/projects/defending-code-reference-harness","note":"Installation guidance: follow docs_url. This service never installs or runs code."}