# Defending Code Reference Harness

> Anthropic's reference for finding and fixing vulnerabilities with Claude. Claude Code skills (/threat-model, /vuln-scan, /triage, /patch) only read and write files. The autonomous pipeline targets C/C++ memory bugs with Docker and ASAN, runs target code only in a gVisor sandbox, and must be ported to other languages. Apache-2.0. Not maintained or accepting contributions; Anthropic points to its paid Claude Security for a managed option. Needs Claude access.

- Repository: https://github.com/anthropics/defending-code-reference-harness
- Official docs: https://github.com/anthropics/defending-code-reference-harness#readme
- Checked: 2026-10-26

## What it replaces
- Snyk: Find vulnerabilities in your own source code (SAST) (partial). Claude-driven threat modelling, source scanning, triage and patch drafts; reference code you adapt yourself, unmaintained, with no dependency, IaC or container scanning.
  - Use it instead of paying for Snyk? Personal use: Partly (Needs something paid: Claude (Claude Code or API)). Business: Partly.

## Facts, with sources

| Question | Status | Answer | Source | Checked |
|---|---|---|---|---|
| Runs on my machine? | Confirmed | Yes, Claude Code skills in a local clone; the autonomous pipeline runs in local Docker containers | https://github.com/anthropics/defending-code-reference-harness#getting-started | 2026-10-23 |
| Code licence | Confirmed | Apache-2.0 (GitHub shows no SPDX id, but the LICENSE file is the Apache License 2.0) | https://github.com/anthropics/defending-code-reference-harness/blob/main/LICENSE | 2026-10-23 |
| Model weights licence | Confirmed | No bundled weights; uses Claude | https://github.com/anthropics/defending-code-reference-harness#readme | 2026-10-23 |
| Commercial use | Confirmed | Yes, Apache-2.0 | https://github.com/anthropics/defending-code-reference-harness/blob/main/LICENSE | 2026-10-23 |
| Paid services needed? | No | Needs access to Claude through Claude Code or the Claude API (direct, Bedrock, Vertex or Azure) | https://github.com/anthropics/defending-code-reference-harness#readme | 2026-10-23 |
| Hardware | Partial | No GPU needed, Claude runs via the API; the skills have no hardware needs of their own; pipeline agent containers get a 4 GB Docker memory cap by default (memory\_limit in the target config); no host CPU, RAM or disk minimum documented | https://github.com/anthropics/defending-code-reference-harness/blob/main/targets/README.md | 2026-10-26 |
| Operating systems | Partial | Interactive skills run wherever Claude Code runs; the sandboxed pipeline needs Docker with the gVisor runtime, set up with sudo and /etc/docker/daemon.json (Linux) | https://github.com/anthropics/defending-code-reference-harness/blob/main/docs/agent-sandbox.md | 2026-10-23 |
| Setup effort | Confirmed | Easy for the skills (clone, open in Claude Code, run /quickstart); medium for the pipeline, which needs Docker, a one-time gVisor sandbox setup and porting to your language | https://github.com/anthropics/defending-code-reference-harness#getting-started | 2026-10-23 |

GitHub: 7695 stars, 635 forks, last push 2026-08-06, archived: no.

## Alternatives to Defending Code Reference Harness
- [Trail of Bits Skills](https://repoquarry.dev/projects/trailofbits-skills.md): Trail of Bits' marketplace of 40+ security plugins for Claude Code and Codex, from CodeQL and Semgrep scans to C, Rust and supply-chain audits.
- [Cloudflare Security Audit Skill](https://repoquarry.dev/projects/security-audit-skill.md): Cloudflare's coding-agent skill that runs a six-phase security audit of a codebase, with every finding re-checked by a separate agent.
- [Superpowers](https://repoquarry.dev/projects/superpowers.md): Skill library for coding agents that walks them through brainstorming, planning, test-driven development, subagent work and code review.
- [Skills For Real Engineers (Matt Pocock)](https://repoquarry.dev/projects/mattpocock-skills.md): Matt Pocock's small, composable agent skills for engineering work, such as grilling sessions, TDD, bug diagnosis, specs and code review.
- [ECC](https://repoquarry.dev/projects/ecc.md): Large plugin of agents, skills, hooks, rules and memory for Claude Code, with native Codex and Qoder plugins and partial adapters for other agents.
- [Ponytail](https://repoquarry.dev/projects/ponytail.md): A skill (one prompt) for AI coding agents that makes them reuse what exists and write less code, plus /ponytail-review and /ponytail-audit commands.
---
Source: RepoQuarry (https://repoquarry.dev/projects/defending-code-reference-harness). Data licence: CC BY 4.0. Quotes are from project documentation and belong to their authors.