Security Scanning
PluginSecurity plugin from the wshobson/agents marketplace: commands for SAST, dependency vulnerability scanning and hardening, security auditor and threat modeling subagents, and threat analysis skills such as STRIDE and attack trees.
README is not available right now
This repository does not provide a README. See the GitHub repository instead.
Related resources
Claude Security
PluginOrchestrates subagents in-session to map the architecture, build a threat model and hunt for vulnerabilities. Every finding is independently verified before it goes in the report, which also comes as SARIF, and optional patch files are left for you to apply. Official Anthropic plugin.
anthropics/claude-plugins-official40k
SonarQube
PluginSonar's official plugin bringing SonarQube checks into the agent coding loop: secrets-scanning hook, issue fixing, quality gates, coverage and dependency risk; with Vortex analysis on, every edit is checked. Needs SonarQube (free Community Build works), the sonar CLI and Docker.
SonarSource/sonarqube-agent-plugins112
Semgrep
CLISemantic multi-language static analysis: find vulnerabilities and bugs with rules that look like source code, across 30+ languages with custom rules. Scans locally by default without uploading code; cross-file analysis and Pro rules require sign-in.
semgrep/semgrep17.1kSemgrep MCP
MCPSemgrep's official MCP server, now part of the main semgrep repo and started with semgrep mcp: lets agents run static security scans, find issues with custom rules and inspect syntax trees. Requires the Semgrep CLI; connecting to the AppSec platform needs SEMGREP_APP_TOKEN.
semgrep/semgrep17.1k
ECC
PluginA complete harness for coding agents: dozens of subagents, nearly 300 skills, hooks, rules, memory and continuous learning, plus the AgentShield security scanner. Built mainly for Claude Code, with Codex support.
affaan-m/ECC281k
Codex Security
PluginSecurity scans for a whole repo or for changes like PRs and commits, with threat modeling, vulnerability triage, fixes and re-verification; reports export to JSON, SARIF and more. OpenAI's official Codex plugin; requires Codex Security access.
openai/plugins7.5k