ツール

Anthropic's terminal coding agent: understands your codebase, edits code, runs commands and handles git workflows, with plugins, MCP and a headless mode (claude -p). Sign in with a Claude account or set an API key.

Reviews pull requests with several parallel subagents, scores each finding by confidence to filter out false positives, and can post the results as PR comments. Official Anthropic plugin; requires a logged-in GitHub CLI.

Orchestrates subagents in-session to map the architecture, build a threat model and hunt for vulnerabilities. Every finding is independently verified before it goes in the report, which also comes as SARIF, and optional patch files are left for you to apply. Official Anthropic plugin.

A seven-phase feature development workflow: clarify requirements, explore the codebase with parallel subagents, design the architecture, implement, then run a quality review. Start it with /feature-dev. Official Anthropic plugin.

Six specialized review subagents that check comment accuracy, test coverage, silent failures, type design, code style and simplification opportunities. Run them individually or all at once. Official Anthropic plugin.

Simplifies and tidies recently changed code without changing behavior: reduces nesting and redundancy, improves naming and follows the project conventions in CLAUDE.md. Official Anthropic plugin.

Three layers of security checks on agent-written code: rule-based warnings on about 25 risky patterns during edits, a model review of the diff at turn end, and an agent tracing cross-file bugs like IDOR and SSRF at commit. Official Anthropic plugin; needs Python 3.8+ and model API access.

Everyday software engineering plugin: standup summaries, code review, structured debugging, architecture decision records, incident response and pre-deploy checks. Official from Anthropic, built mainly for Cowork but also usable in Claude Code.

Anthropic's reference implementation for finding and fixing vulnerabilities: Claude Code skills for threat modeling, static scanning, triage and patching, plus an autonomous recon-to-patch pipeline (C/C++ memory bugs by default; needs Docker and gVisor). No longer maintained.