Defending Code Reference Harness is a reference implementation for autonomous vulnerability discovery and remediation in source code using Claude.
The tool addresses the problem of finding and fixing security vulnerabilities at scale by automating a multi-stage pipeline: reconnaissance, vulnerability discovery, verification, reporting, and patching. It works by orchestrating Claude API calls to analyze code, identify potential vulnerabilities, triage findings to reduce false positives, and generate fixes. The harness includes threat modeling and scanning skills accessible through Claude Code, along with a customizable autonomous pipeline configured for detecting C/C++ memory vulnerabilities using Docker and ASAN sanitizers.
The project suits teams building their own vulnerability detection workflows who want to understand how to structure such a pipeline and customize it for their specific languages, vulnerability classes, or detection tools. It provides interactive skills for scoping, scanning, and patching alongside a reference harness that demonstrates the general shape and prompting patterns needed for autonomous vulnerability work. The tool also includes a separate detection and response track for hunting vulnerabilities in already-compromised codebases and proposing containment responses. Anthropic offers Claude Security as a managed alternative for teams preferring a hosted product with built-in verification pipelines and lifecycle management.
The repository is explicitly not maintained and does not accept contributions. The harness is presented as a reference implementation rather than production-ready software, meaning the general approach and prompts are reusable but the implementation will require customization to work reliably on most codebases. The accompanying blog post and companion cookbook document the learnings from security partnerships and provide guidance on best practices for this class of work.
