Defending Code Reference Harness
Anthropic's reference Claude Code skills and autonomous pipeline for threat modelling, vulnerability scanning, triage and patching. Not maintained.
Anthropic's reference for finding and fixing vulnerabilities with Claude. Claude Code skills (/threat-model, /vuln-scan, /triage, /patch) only read and write files. The autonomous pipeline targets C/C++ memory bugs with Docker and ASAN, runs target code only in a gVisor sandbox, and must be ported to other languages. Apache-2.0. Not maintained or accepting contributions; Anthropic points to its paid Claude Security for a managed option. Needs Claude access.
The facts
| Question | Answer | Source | Checked |
|---|---|---|---|
| Runs on my machine? | Yes. Yes, Claude Code skills in a local clone; the autonomous pipeline runs in local Docker containers | github.com | Checked 11 days ago |
| Code licence | Open source. Apache-2.0 (GitHub shows no SPDX id, but the LICENSE file is the Apache License 2.0) | github.com | Checked 11 days ago |
| Commercial use | Yes. Yes, Apache-2.0 | github.com | Checked 11 days ago |
| Paid services needed? | Required. Needs access to Claude through Claude Code or the Claude API (direct, Bedrock, Vertex or Azure) | github.com | Checked 11 days ago |
| Hardware | No GPU needed, Claude runs via the API; the skills have no hardware needs of their own; pipeline agent containers get a 4 GB Docker memory cap by default (memory_limit in the target config); no host CPU, RAM or disk minimum documented | github.com | Checked 8 days ago |
| Operating systems | Interactive skills run wherever Claude Code runs; the sandboxed pipeline needs Docker with the gVisor runtime, set up with sudo and /etc/docker/daemon.json (Linux) | github.com | Checked 11 days ago |
| Setup effort | Easy for the skills (clone, open in Claude Code, run /quickstart); medium for the pipeline, which needs Docker, a one-time gVisor sandbox setup and porting to your language | github.com | Checked 11 days ago |
Each fact has its own date. Unknown means nobody has published it. We read their documentation; we didn’t install it. Running it yourself costs your hardware, electricity and setup time. Report a correction.
No licence changes since we started watching. Licence changes: follow Defending Code Reference Harness and we email you if its terms change.
What it replaces, job by job
| Paid tool | Jobs | How far it goes |
|---|---|---|
| Snyk $25/month |
| 1 of 3 jobs. Claude-driven threat modelling, source scanning, triage and patch drafts; reference code you adapt yourself, unmaintained, with no dependency, IaC or container scanning. |
Stars over time
Building history +42 this week; not enough baseline history. Stars show attention, not quality. Where these numbers come from.
- Defending Code Reference Harness
Tracked daily since 24 Oct 2026. Dashed history is estimated (how).