How to Scan Claude Code Projects for Security Vulnerabilities

Why Claude Code Needs Security Scanning

Claude Code is one of the most capable AI coding tools available. It can scaffold entire applications, refactor complex codebases, and implement features from natural language descriptions. But like any developer (human or AI), it can introduce security issues:

• •Hardcoded secrets — API keys placed directly in source files instead of environment variables
• •SQL injection — string interpolation in database queries, especially when using raw SQL
• •Missing authentication — API routes without auth middleware, especially in rapid prototyping
• •Prompt injection — unsanitized user input in LLM prompts when building AI features

The risk is amplified when using --dangerously-skip-permissions, where Claude operates autonomously without asking for approval.

Step 1: Install ShipSafe

Install ShipSafe globally via npm:

npm install -g @shipsafe/cli

Step 2: Add ShipSafe as an MCP Server

The most powerful integration is adding ShipSafe as an MCP server. This gives Claude direct access to security scanning tools while it writes code.

Add to your project’s .mcp.json:

{
  "mcpServers": {
    "shipsafe": {
      "command": "shipsafe",
      "args": ["mcp-server"]
    }
  }
}

Now Claude can call shipsafe_scan to check for vulnerabilities, shipsafe_check_package before installing dependencies, and shipsafe_scan_environment to verify the development environment is safe.

You can also instruct Claude to scan automatically by adding to your CLAUDE.md:

# Security

When committing code, call the shipsafe_scan MCP tool first.
Do not skip this step.

Step 3: Install Git Hooks

Git hooks are your safety net. Even if Claude (or you) forgets to scan manually, the pre-commit hook catches vulnerabilities before they enter git history.

shipsafe hooks install

This is critical when using --dangerously-skip-permissions. Claude can write and commit code autonomously, but the hook blocks any commit containing hardcoded secrets or critical vulnerabilities.

Step 4: Scan the Environment

Before working in any cloned repository, scan the development environment for threats. This catches malicious MCP servers, poisoned CLAUDE.md files, and credential-stealing git hooks.

shipsafe scan-environment

Step 5: Set a Baseline

If you are adding ShipSafe to an existing project, set a baseline so future scans only show new findings:

shipsafe scan --baseline

The Three-Layer Defense

With these steps complete, you have three layers of security:

What ShipSafe Catches in Claude Code Projects

ShipSafe has 1,261 detection rules covering:

• ✓127 SQL injection rules — including Prisma and Drizzle awareness
• ✓143 XSS rules — React, Vue, Angular, and template engines
• ✓174 secret patterns — AWS, Stripe, GitHub, and 50+ services
• ✓7 prompt injection rules — critical for AI features
• ✓30 environment threats — malicious MCP servers and hooks