Defending Code Reference Harness

Use it when

• You want Claude to autonomously find, execution-verify, deduplicate, and report memory-safety bugs in a C or C++ codebase using ASAN in a gVisor sandbox
• Your static scanning floods the team with unverified findings and you need a threat-model-scoped scan plus triage that ranks and dedupes across runs and drafts candidate patches

What it solves

Not the fit when

• offensive exploitation or unauthorized targets
• a maintained turnkey product (repo is an unmaintained reference; managed option is Claude Security)
• secret-exposure-risk
• agent-tool-overreach
• no-regression-signal

Install

git clone https://github.com/anthropics/defending-code-reference-harness && cd defending-code-reference-harness && python3 -m venv .venv && .venv/bin/pip install -e . && ./scripts/setup_sandbox.sh (needs Docker + gVisor); export ANTHROPIC_API_KEY=sk-ant-...

Invoke

Interactive: open the repo in claude and run /quickstart, then /threat-model, /vuln-scan <target>, /triage, /patch (read/write only). Autonomous: bin/vp-sandboxed run <target> --model <model-id> --runs 3 --parallel --stream --auto-focus, then bin/vp-sandboxed patch results/<target>/<timestamp>/

Alternatives

No reviewed alternatives recorded yet.