claude-security Beta: Cost, Output, Accuracy — 189 Agents, 2 Hours, Measured

> **What this article covers**: A measured run of Anthropic's official security-scanning plugin `claude-security` (beta). What the tool does, how long it takes, what output it returns, and how far you can trust it — backed by the raw data from the run's own artifacts.

You may know the official plugin exists and still not have tried it, for reasons like these:

• **The cost is unreadable.** It warns you at startup that it "may take a while and use a significant number of tokens," but never says how much
• **The output quality is unknown.** How is this different from existing static analysis, and does an LLM that only reads code produce findings you can act on?
• **It's unclear what to do afterward.** If dozens of findings come back, where do you start?

On 2026-07-25 I installed v0.10.0 and scanned my entire `~/.claude` configuration set (hooks, skills, agents, permission settings). **189 subagents ran for two hours and returned 20 findings.** This article is that measurement.

> This plugin is in beta as of 2026-07 (the version number is 0.10.0). Every number and behavior below is measured on v0.10.0 and may change.

Prerequisites

| Item | Requirement |

|---|---|

| Claude Code | Measured on 2.1.220 |

| Plugin | `claude-security` v0.10.0 (by Anthropic, marketplace `claude-plugins-official`) |

| Python | python3 3.9+ (used by the report-generation scripts) |

| git | Change scans require a git checkout. Whole-repository scans work without git |

| Permission mode | auto mode recommended (the plugin says so itself) |

This plugin is the "runs inside your session" version of the hosted [Claude Security](https://claude.com/product/claude-security) product. It starts no separate process and no daemon; it runs entirely inside your Claude Code session.

What the tool is, and what happens when you run it

From install to launch

# Run these inside a Claude Code session
/plugin install claude-security@claude-plugins-official
/reload-plugins

If it reports that the marketplace was not found, run `/plugin marketplace add anthropics/claude-plugins-official` first and retry.

After installing, `/claude-security` opens a menu offering three jobs.

| Job | Target | Duration |

|---|---|---|

| **Scan codebase** | The whole repository, or a scoped part of it | Depends on size (2 hours 1 minute in my run) |

| **Scan changes** | A branch diff, a pull request diff, or a single commit | Minutes for a small diff |

| **Suggest patches** | Turns an existing report's findings into patch files | Depends on the finding count |

You can also skip the menu and name the job in the arguments.

/claude-security scan my branch's changes
/claude-security --base main
/claude-security 3cb30d2          # a hex string of 7+ chars is read as a commit SHA

Get the confirmation prompt out of the way

Choosing a whole-repository scan always triggers this confirmation.

> This scan may take a while and may use a significant number of tokens. You will nee