OSS Scanner

by Anthropic

A free security audit for open source.

822 stars GitHub Apache-2.0 FreeSecurity

View on GitHub →

What it does

Claude models scan your repository regularly
Vulnerabilities, root-cause analysis and suggested patches
For critical projects: sign up with a pull request

! Reports are sent without human review.

Install it

Requirements: For core maintainers of critical open-source projects only. You need a Dockerfile that builds the project offline.

The sign-up repository

https://github.com/anthropics/oss-scanner

Check your config before the PR

python tools/validate.py

The prompt for your agent

Paste it into your coding agent: it checks the requirements and installs it for you.

Claude CodeCodexCursorGemini CLIopencode

Prompt

Help me enroll my open-source project in Anthropic's OSS Scanner.
1. Read the docs at https://red.anthropic.com/oss-scanner/ and the templates/project.yaml template in https://github.com/anthropics/oss-scanner.
2. Prepare projects/<my-project>/project.yaml with repo, primary_contact and the Dockerfile path.
3. Check that the Dockerfile builds the project and that tests pass without internet access.
4. Run tools/validate.py, then prepare the pull request, but don't open it until I approve.

Always review what your agent is about to run, especially install commands.