ArchestackBest of Vibe Coding: List on GitHub ↗1 star (opens in a new tab)

#77th of 7 in Code review and testing

defending-code-reference-harness

Reference pipeline and Claude Code skills for finding and patching vulnerabilities

Documentation ↗ (opens in a new tab)Website ↗ (opens in a new tab)Repository on GitHub ↗ (opens in a new tab)
Stars
7.6k
License
custom license
Last commit
Aug 2026
Language
Python

Missed the latest GitHub check; these facts may be older.

Anthropic is hiring: 647 open roles

Overview

Anthropic's reference implementation of a recon, find, verify, report and patch loop driven by Claude. The harness targets C/C++ memory bugs using Docker and ASAN, with gVisor sandboxing for agents. It also ships Claude Code skills (/threat-model, /vuln-scan, /triage, /patch, /customize) and a detection-and-response track. The README states it is a reference, not a product, and is unmaintained.

Who it is for: Security engineers building Claude-based vulnerability finding pipelines

Strengths

  • Findings are execution-verified: a separate grader agent reproduces each ASAN crash in a fresh container
  • Interactive skills only read and write files, so they run without a sandbox
  • Patch stage checks build, original PoC, test suite and a fresh find agent
  • Works with Claude API, Bedrock, Vertex or Azure access

Weaknesses

  • README states the repo is not maintained and accepts no contributions
  • Out-of-the-box pipeline only covers C/C++ memory bugs; other stacks need /customize porting
  • Autonomous pipelines refuse to run outside a gVisor sandbox, which requires Docker setup
  • License is not identified (NOASSERTION); README gives no license terms

What it needs

  • no GPU
  • Needs Docker, gVisor, Claude Code, Anthropic API key (or Bedrock/Vertex/Azure), Python 3
  • Models: Claude (Anthropic API, Bedrock, Vertex, Azure)

Also in Code review and testing

See all 7
Also in Code review and testing
RankProjectScore
1open-code-reviewCLI that reviews Git diffs with an LLM agent and line-level comments47.2k starsApache-2.078 out of 100
2no-mistakesLocal git proxy that runs AI review, tests and lint before opening a PR8.8k starsMIT72 out of 100
3pr-agentLLM pull request reviewer that comments via /review, /describe and /improve13.4k starsMIT67 out of 100
#4front-end-checklistFront-end rules checklist with an MCP server for agent code review74.5k starsMIT64 out of 100
#5e2eAI-driven end-to-end testing framework for web and mobile apps8.4k starsApache-2.062 out of 100