A blueprint, not a scanner subscription
Anthropic's Defending Code Reference Harness is two things. First, it is a set of Claude Code skills for threat modeling, static review, triage, customization, and patch drafting. Second, it is a Python pipeline that lets autonomous Claude agents inspect and execute a target, prove crashes, remove duplicates, assess exploitability, and propose fixes. A separate detection-and-response example hunts a planted campaign in application logs.
The repository says plainly that it is a reference, not a product, and that it is not maintained or accepting contributions. That changes the buying decision. You are not selecting a supported security tool; you are studying a worked architecture that your team must own. Anthropic points users wanting managed lifecycle features toward Claude Security.
The ready-made pipeline has a deliberately narrow target: memory vulnerabilities in C and C++ programs that can be compiled with AddressSanitizer. It includes sample targets and a canary with known defects. The same sequence can be adapted to other languages or vulnerability classes, but the detector, proof format, build process, runtime, and verification rules all become your engineering problem.
Verification is the best idea here
Many model-based security demos stop when an agent writes a plausible report. This one asks for evidence. A find agent reads code, constructs malformed input, and keeps working until an ASAN crash reproduces three times. A separate grading agent receives the proof-of-concept bytes, not the first agent's reasoning, and reproduces the crash in a fresh container. A judge then compares verified crashes against prior findings before a report agent assesses reachability and severity.
Patching repeats that skeptical pattern. One agent writes a candidate diff. Another checks that the target builds, the original proof no longer crashes it, the existing tests pass, and a new finder cannot quickly bypass the repair. None of this proves correctness, but it is a much higher bar than accepting a confident explanation from the same model that proposed the bug.
The interactive path is useful even if you never run autonomy. /threat-model scopes relevant assets and boundaries. /vuln-scan performs a read-only static pass. /triage verifies, groups, and ranks the resulting files, while /patch drafts changes. Captured canary outputs let teams inspect the artifact shapes without spending tokens on a fresh demonstration.
False positives remain part of the deal. The README warns that static findings on real targets will be noisier than the curated example, and even notes that triage may correctly dismiss deliberately vulnerable fixture code. Severity and priority depend on deployment context. The project calls autonomous triage and patching open problems rather than pretending its voting and grading stages settle them.
The sandbox is not optional ceremony
Autonomous finders execute adversarial target code and can choose shell commands. Anthropic therefore puts each agent and target in a gVisor container rather than relying on ordinary Docker's shared host kernel. An internal Docker network has no normal internet route, while an allowlist proxy permits only model API traffic. The orchestrator runs outside because it manages containers but does not execute target code itself.
This design is the repository's most reusable lesson: enforce limits in infrastructure, not prompts. The launcher refuses agent-spawning commands if gVisor or the proxy is missing, unless the operator passes a flag whose name explicitly says it is dangerous. The documentation warns against privileged containers, host networking, credential-bearing mounts, and external tools that can modify production systems.
Prompt injection is still possible through target-derived traces, paths, logs, or build output. Patch prompts wrap such content as untrusted data with a random identifier, but the security guide correctly describes that as mitigation. A malicious repository can influence an agent that is being asked to edit code. Generated diffs need human review, and model credentials must be restricted to the narrowest useful capability.
Setup is a small infrastructure project
Trying the skills requires the repository and Claude Code. Running the full pipeline needs Python 3.11, a virtual environment, Docker, model access, and the sandbox setup script. That script downloads a pinned gVisor runtime, changes Docker configuration with sudo, creates the isolated network and proxy, builds target and agent images, and verifies the boundaries.
The recommended isolation works only on Linux x86-64 or Arm64. macOS and Windows users need a Linux VM. Rootless or nested Docker may lose enforced memory limits even when the other isolation layers remain. Bedrock adds region, credential, model ID, and endpoint rules; Vertex requires a manual egress allowlist and is documented as untested, while Azure is not wired.
Two open issues point out that prerequisites and the full setup order remain spread across the README and pipeline documentation. The material itself is excellent, but onboarding requires careful reading. Parallel runs can also consume substantial model tokens, so the pipeline guide advises beginning with a small batch and watching streamed reports before scaling.
Current code, intentionally no community roadmap
The last push was August 6, 2026, and recent merged changes hardened Bedrock preflight checks, stopped dead containers from wasting an hour in retries, clarified authorization context, and added captured examples. That is meaningful recent activity. It does not override the README's explicit statement that the repository is not maintained and will not accept contributions. Think of the updates as stewardship of a published reference, not a promise of ongoing support.
The open count combines issues and pull requests. Issue 15 contains 39 model-generated potential audit findings, with an explicit false-positive warning, and several proposed hardening pull requests remain open. There are no GitHub releases, so users must pin a commit themselves. The code is Apache 2.0 licensed despite GitHub failing to identify the plain LICENSE file automatically.
Security teams building agentic research infrastructure should read and run the canaries. Most developers should choose a maintained static analyzer, fuzzing service, or managed scanner. The lasting value here is not one magic prompt; it is the disciplined chain of isolation, independent reproduction, deduplication, contextual judgment, and adversarial patch checking.