Claude Security Continuous Scanning: API, Pricing and Enterprise Access

Anthropic updated Claude Security on October 21 with continuous repository scanning, automatic fix tracking, and API and MCP integrations. The public beta is available to Claude Enterprise customers. For engineering teams, the useful change is that a security finding can now stay connected to the code after the initial scan.

The announcement describes a move from manually initiated checks toward an ongoing workflow. Claude establishes a baseline, examines subsequent changes, and reopens an issue if it finds the vulnerability again after a fix.

How continuous scanning works

The unit of work is a project containing related repositories. According to the setup guide, a project supports up to eight repositories, with optional branch and folder scoping. GitHub connections use the Claude GitHub App; other Git providers can use repository addresses and authentication tokens.

Claude first reads the code, creates a threat model, and performs a baseline scan. That initial pass can take minutes or hours. The service then checks for new commits. Continuous does not mean an instantaneous verdict on every edit: the help documentation says scanning has no fixed schedule and depends on changes’ risk and complexity.

Grouping related services matters. Imagine a backend that assumes an upstream application has already checked a user’s access. Reviewing either repository alone may leave that assumption untested. Putting the relationship in scope gives the scanner a better chance of tracing the complete path. It still leaves the team responsible for checking whether the reported path is real.

Pricing and the launch credits

The setup guide says Claude Security charges direct token costs, without an additional platform fee. Costs depend on repository size and change frequency, and administrators can set a separate feature spend limit. Users need Enterprise seats that include Claude Code; cloud execution of suggested fixes is optional.

The Help Center’s offer terms provide up to $25,000 monthly credits for two consecutive months. Existing Enterprise organizations start on October 21, whether they use the feature or not. Unused monthly credits expire. The offer stops December 31, 2026 UTC, so organizations joining after November 1 do not receive two full months. Only the new experience qualifies, including migrated projects.

That makes the trial useful for measuring actual operating cost. A reasonable evaluation would separate the first deep scan from the recurring work, then compare spending against findings that engineers validate and resolve. A large promotional balance does not establish a predictable monthly price.

API and MCP connect findings to engineering work

The new API can read and manage projects, repositories and findings, including resolving or reopening issues. Personal access tokens inherit the user’s permissions. Webhooks report new findings, while the MCP connector makes findings accessible inside Claude and Claude Code.

These integrations address a practical problem: a scanner and an engineering tracker can disagree about whether something is finished. Automatic rechecking can reduce that gap, particularly when the fix happens outside Claude. Role-based controls also separate viewing and triage from project administration.

The useful integration is therefore more than another notification. A team could attach the finding to its existing remediation workflow, retain the evidence, and check the code state before treating the work as complete. The announcement does not establish that every organization’s existing tracker supports this automatically.

Limits to check before rollout

The Help Center says the hosted service does not support Zero Data Retention, and scans are stochastic. Repeating a scan can produce different results. It also limits use to code the organization owns and has the necessary rights to scan, rather than arbitrary third-party repositories.

Migration needs attention too: members, webhooks, excluded directories and scan history do not transfer, and GitHub Enterprise projects cannot be migrated. Existing projects otherwise continue running.

Those constraints make a controlled rollout more sensible than connecting every repository at once. Keep human review of proposed patches, test them through the normal release process, and verify that the project’s deployment assumptions remain accurate.

The lasting question is whether continuous scanning reduces the time between a meaningful code change and a verified repair. Counting findings alone will not answer it.

I’m Paras. I work at the intersection of AI, engineering and distribution.

I help technical founders turn complex product updates into clear stories that developers can understand and share.

Book a 30-minute call.