Best security review agents for Claude
Agents focused on security review, vulnerability detection, and secure-coding enforcement for Claude.
Agents focused on security review, vulnerability detection, and secure-coding enforcement for Claude.
Compared at a glance
The top 5 picks side by side on trust, install, platform support, and disclosed notes — full rationale for each below.
| Field | MCP Server Threat Modeling Agent Source-backed agent that threat-models an MCP server before it is connected to Claude Code, covering trust verification, tool authority and side effects, prompt injection via tool output, network and credential exposure, and least-privilege mitigations, grounded in the official security docs. Open dossier | Sandbox Boundary Review Agent Source-backed agent that reviews Claude Code's sandboxed Bash configuration for safe boundaries, checking filesystem allow/deny paths, network allowlists, unsandboxed escape hatches, excluded commands, and credential read scope, grounded in the official Claude Code sandboxing docs. Open dossier | AI Code Review Security Agent - Agents AI-powered code review specialist focusing on security vulnerabilities, OWASP Top 10, static analysis, secrets detection, and automated security best practices enforcement Open dossier | MCP Authorization Boundary Review Agent Source-backed specialist agent for reviewing remote MCP authorization boundaries, protected resource metadata, resource indicators, token audience validation, token passthrough risk, and least-privilege scopes. Open dossier | Claude Plugin Marketplace Reviewer Agent A reusable agent prompt that vets a Claude Code plugin or marketplace before a team installs it. It walks source trust, the plugin's Will-install list and bundled components (skills, agents, hooks, MCP servers, commands), the context-window cost, version pinning, and the user/project/local/managed install scope. Open dossier |
|---|---|---|---|---|---|
| Trust | |||||
| Install risk | Review first | Review first | Review first | Review first | Review first |
| Notes | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ | Safety ✓ Privacy ✓ |
| Category | agents | agents | agents | agents | agents |
| Source | source-backed | source-backed | source-backed | source-backed | source-backed |
| Author | JPette1783 | JPette1783 | JSONbored | JSONbored | JPette1783 |
| Added | 2026-06-05 | 2026-06-05 | 2025-10-16 | 2026-06-05 | 2026-06-05 |
| Platforms | Claude Code | Claude Code | Claude Code | Claude Code | Claude Code |
| Source repo | — | — | — | — | — |
| Safety notes | ✓This agent assesses risk; it does not connect to or exercise the server. Connecting a new MCP server requires trust verification, which is disabled in non-interactive (-p) runs. Treat MCP tool output as untrusted content that can carry prompt-injection instructions; recommend not auto-acting on it and keeping result sizes bounded. Recommend least-privilege: explicit allow rules, confirmation for write tools, and disabling tools that are not needed. Anthropic does not security-audit MCP servers. | ✓This agent reviews sandbox configuration; it does not disable or weaken the sandbox itself. Flag broad allowWrite paths (PATH dirs, shell config), broad allowedDomains, and excludedCommands that undo isolation. Note that the default read policy can still read credential files like ~/.aws and ~/.ssh unless added to denyRead. | ✓Recommendations may include shell commands, package installs, or file edits; review and run any suggested changes yourself instead of applying them unverified. | ✓A remote MCP server can expose tools backed by user accounts, tenant data, third-party APIs, or write-capable integrations. Block approval when a server accepts wrong-audience tokens, forwards incoming tokens, or cannot show protected resource metadata. | ✓Plugins and marketplaces can execute arbitrary code with the user's privileges; recommend installing only from trusted sources and reviewing the Will-install list (commands, agents, skills, hooks, MCP/LSP servers) first. Anthropic does not control what plugins contain and cannot verify they work as intended; the official marketplace is curated but community/third-party sources are not security-audited. Recommend managed marketplace restrictions and managed scope for org-wide control, and version pinning so updates are intentional. |
| Privacy notes | ✓Tools send whatever inputs they are called with to the server; identify what data would leave the environment and to whom. Credentials for the server must be stored securely and never committed or logged; prefer a credential proxy so the agent never sees raw secrets. Confirm the server operator's data handling and retention before sending sensitive context to it. | ✓The sandbox proxy does not inspect TLS, so a broad domain allowlist can enable exfiltration; recommend narrow domains. Recommend denyRead for credential directories and consider scrubbing provider credentials from subprocess environments. allowing the docker socket or broad unix sockets can grant host access; flag such exceptions. | ✓Guides Claude to read your repository files plus any code, logs, configuration, or credentials you share in the session; nothing is transmitted beyond the model, but review what you expose before sharing. | ✓OAuth metadata, redirect URLs, scopes, tenant IDs, token claims, and tool results may contain private account structure. Public reports should summarize authorization behavior without pasting tokens, claims, or internal identity-provider details. | ✓Bundled MCP servers and hooks can access local files and external services; review what each component reaches before approving install. A plugin's context cost is added to every turn; factor it into the review and prefer tool-search-friendly MCP plugins. Do not approve plugins whose source or components you cannot inspect; treat install as a supply-chain decision. |
| Prerequisites |
|
| — none listed |
|
|
| Install | — | — | — | — | — |
| Config | — | — | — | — | — |
| Citations | |||||
| Claim | Unclaimed | Unclaimed | Unclaimed | Unclaimed | Unclaimed |
- 01Why it made the cut
MCP Server Threat Modeling Agent is included because it has safety notes present, privacy notes present, source-backed source posture.
Reach for insteadIf this will touch credentials, local files, or production systems, inspect the upstream source first.
- 02Why it made the cut
Sandbox Boundary Review Agent is included because it has safety notes present, privacy notes present, source-backed source posture.
Reach for insteadIf this will touch credentials, local files, or production systems, inspect the upstream source first.
- 03Why it made the cut
AI Code Review Security Agent - Agents is included because it has safety notes present, privacy notes present, source-backed source posture.
Reach for insteadIf this will touch credentials, local files, or production systems, inspect the upstream source first.
- 04Why it made the cut
MCP Authorization Boundary Review Agent is included because it has safety notes present, privacy notes present, source-backed source posture.
Reach for insteadIf this will touch credentials, local files, or production systems, inspect the upstream source first.
- 05Why it made the cut
Claude Plugin Marketplace Reviewer Agent is included because it has safety notes present, privacy notes present, source-backed source posture.
Reach for insteadIf this will touch credentials, local files, or production systems, inspect the upstream source first.
- 06Why it made the cut
NanoClaw Container Isolation Review Agent is included because it has safety notes present, privacy notes present, source-backed source posture.
Reach for insteadIf this will touch credentials, local files, or production systems, inspect the upstream source first.
- 07Why it made the cut
Claude Code Security Guidance Remediator Agent is included because it has safety notes present, privacy notes present, source-backed source posture.
Reach for insteadIf this will touch credentials, local files, or production systems, inspect the upstream source first.
- 08Why it made the cut
Code Reviewer Agent - Agents is included because it has safety notes present, privacy notes present, source-backed source posture.
Reach for insteadIf this will touch credentials, local files, or production systems, inspect the upstream source first.
- 09Why it made the cut
MCP Remote Server Security Auditor Agent is included because it has safety notes present, privacy notes present, source-backed source posture.
Reach for insteadIf this will touch credentials, local files, or production systems, inspect the upstream source first.
- 10Why it made the cut
Open Source PR Security Review Agent is included because it has safety notes present, privacy notes present, source-backed source posture.
Reach for insteadIf this will touch credentials, local files, or production systems, inspect the upstream source first.
- 11Why it made the cut
Agent SDK Production Architect Agent is included because it has safety notes present, privacy notes present, source-backed source posture.
Reach for insteadIf this will touch credentials, local files, or production systems, inspect the upstream source first.
- 12Why it made the cut
MCP Registry Metadata Reviewer Agent is included because it has safety notes present, privacy notes present, source-backed source posture.
Reach for insteadIf this will touch credentials, local files, or production systems, inspect the upstream source first.
Missing a pick? Propose an edit to this list — every change goes through the same review queue as new entries.
Suggest a pickGet the weekly brief
One calm read on Claude workflows. Sundays. No tracking pixels.
Unsubscribe any time. No tracking pixels. No partner blasts.