type: user

role: user

content: Fetch the README for https://github.com/anthropics/defending-code-reference-harness via WebFetch at https://raw.githubusercontent.com/anthropics/defending-code-reference-harness/main/README.md. Return the full README content. Research only — do not write any files.

userType: external

entrypoint: sdk-ts

gitBranch: HEAD

slug: mellow-wobbling-swan


type: attachment


type: message

role: assistant

type: text

text: I'll fetch the README for you using the WebFetch tool.

service_tier: standard

attributionAgent: Explore

type: assistant


ToolSearch

query: select:WebFetch

type: direct

speed: standard


tool_name: WebFetch


text: Now I'll fetch the README from the raw GitHub URL.


WebFetch

prompt: Return the full content of this README file


content:
# Defending Code Reference Harness - Full README

## Overview

This repository contains a reference implementation for autonomous vulnerability discovery and remediation using Claude. It's based on learnings from security partnerships and includes both interactive skills and an autonomous pipeline.

## Key Features

**Interactive Skills** (read/write files only):
- `/quickstart` - 30-second introduction and guided walkthrough
- `/threat-model` - Build security threat models for code
- `/vuln-scan` - Run static vulnerability scans scoped by threat models
- `/triage` - Verify, deduplicate, and rank findings
- `/patch` - Generate candidate fixes for verified vulnerabilities
- `/customize` - Adapt the pipeline to different languages and vulnerability classes

**Autonomous Pipeline**:
The reference harness performs seven stages: Build → Recon → Find → Verify → Dedupe → Report → Patch. It executes inside gVisor sandbox containers with restricted egress for security.

## Quick Start

```bash
git clone https://github.com/anthropics/defending-code-reference-harness
cd defending-code-reference-harness
claude
> /quickstart
```

## Recommended Ramp-Up Timeline

**Day 1**: Build threat model and run static scan with triage on your code
**Day 2**: Execute reference pipeline on known-vulnerable C/C++ library
**Days 3-5**: Customize pipeline for your target stack
**Week 2**: Deploy autonomous scanning, triage across runs, and patching

## Important Notes

⚠ **Sandboxing**: The autonomous pipeline executes target code and requires gVisor sandbox isolation. Run `scripts/setup_sandbox.sh` once, then use `bin/vp-sandboxed` to invoke the pipeline.

🔒 **Managed Alternative**: Anthropic offers Claude Security, a hosted product providing vulnerability scanning with multi-stage verification pipelines.

## Customization

The pipeline's architecture is language-agnostic. Porting requires defining:
- Signal indicating a finding (e.g., crash signature, exception)
- Proof-of-concept format (crashing input, HTTP sequence)
- Build and execution method (containerized)

## Further Resources

Comprehensive documentation covers pipeline mechanics, security considerations, customization procedures, and troubleshooting guidance. A companion blog post discusses best practices from security partnerships.


text:
Here's the full README content for the defending-code-reference-harness repository:

## Defending Code Reference Harness - Full README

### Overview
This repository contains a reference implementation for autonomous vulnerability discovery and remediation using Claude. It's based on learnings from security partnerships and includes both interactive skills and an autonomous pipeline.

### Key Features

**Interactive Skills** (read/write files only):
- `/quickstart` - 30-second introduction and guided walkthrough
- `/threat-model` - Build security threat models for code
- `/vuln-scan` - Run static vulnerability scans scoped by threat models
- `/triage` - Verify, deduplicate, and rank findings
- `/patch` - Generate candidate fixes for verified vulnerabilities
- `/customize` - Adapt the pipeline to different languages and vulnerability classes

**Autonomous Pipeline**:
The reference harness performs seven stages: Build → Recon → Find → Verify → Dedupe → Report → Patch. It executes inside gVisor sandbox containers with restricted egress for security.

### Quick Start

```bash
git clone https://github.com/anthropics/defending-code-reference-harness
cd defending-code-reference-harness
claude
> /quickstart
```

### Recommended Ramp-Up Timeline

**Day 1**: Build threat model and run static scan with triage on your code
**Day 2**: Execute reference pipeline on known-vulnerable C/C++ library
**Days 3-5**: Customize pipeline for your target stack
**Week 2**: Deploy autonomous scanning, triage across runs, and patching

### Important Notes

⚠ **Sandboxing**: The autonomous pipeline executes target code and requires gVisor sandbox isolation. Run `scripts/setup_sandbox.sh` once, then use `bin/vp-sandboxed` to invoke the pipeline.

🔒 **Managed Alternative**: Anthropic offers Claude Security, a hosted product providing vulnerability scanning with multi-stage verification pipelines.

### Customization

The pipeline's architecture is language-agnostic. Porting requires defining:
- Signal indicating a finding (e.g., crash signature, exception)
- Proof-of-concept format (crashing input, HTTP sequence)
- Build and execution method (containerized)

### Further Resources

Comprehensive documentation covers pipeline mechanics, security considerations, customization procedures, and troubleshooting guidance. A companion blog post discusses best practices from security partnerships.