Defending Code Reference Harness

What it is

The GitHub landing/README for Anthropic's defending-code-reference-harness — an open-source, unmaintained, non-contribution reference implementation of a Claude-driven vuln-finding loop. The summary already covers the skills and pipeline; what the page adds is the operational safety model, a concrete Day-1 workflow with exact commands, and the fact that a hosted alternative (Claude Security) exists if you don't want to run this yourself. It works with any Claude API access, including Bedrock, Vertex, or Azure.

The sandbox boundary (the part that matters)

The page draws a sharp line between skills that only touch files and pipelines that execute untrusted target code — this decides whether you need gVisor.

flowchart TD
  A["/quickstart, /threat-model, /vuln-scan, /triage"] -->|read/write only| S["Safe unsandboxed if you approve each tool use"]
  B["/patch on static findings<br/>TRIAGE.json / VULN-FINDINGS.json"] -->|read/write only| S
  C["/customize"] -->|edits harness + runs validation| S
  D["vuln-pipeline, dnr-pipeline,<br/>/patch on pipeline results"] -->|executes target code| G["Refuses to run outside gVisor<br/>unless explicitly overridden"]
  E["/dnr-hunt, /dnr-respond"] -->|also binds demo app on 127.0.0.1| G

What to do

Setup for the autonomous pipelines (execute code):

scripts/setup_sandbox.sh   # run once
bin/vp-sandboxed            # invoke the pipeline

Day-1 interactive loop (no sandbox needed if you approve each tool use). Pin subagents to a chosen model first:

export CLAUDE_CODE_SUBAGENT_MODEL=<model-id>
claude
> /quickstart
> /threat-model bootstrap targets/canary
> /vuln-scan targets/canary
> /triage targets/canary/VULN-FINDINGS.json
> /patch ./TRIAGE.json --repo targets/canary

Outputs: THREAT_MODEL.md, VULN-FINDINGS.{json,md}, TRIAGE.{json,md}, PATCHES/. The /threat-model step exists specifically to scope the scan and cut false positives.

Quick start on the bundled canary target:

git clone https://github.com/anthropics/defending-code-reference-harness
cd defending-code-reference-harness
claude
> /quickstart

Caveats

• Reference, not a product. The harness is configured only for C/C++ memory bugs via Docker + ASAN and "will not work on every codebase out of the box" — run /customize to port it to another language, detector, or vuln class.
• Static-scan candidates come from source review with nothing built or run, so expect more false positives on non-canary targets; execution-verified findings come later in the loop.
• On the canary, /triage may dismiss findings as false positives because entry.c announces itself as deliberately vulnerable demo code.
• The repo is not maintained and not accepting contributions.