// sixthwall for Claude Code

Claude Code security check: scan what Claude writes, as it writes it

SixthWall runs inside Claude Code as an MCP server, so Claude checks its own work after every change. It complements the built-in /security-review command with fixed rules that fire the same way every time, a score you can track, and fixes Claude can apply directly.

Three steps

  1. 01

    Run init in your project

    This writes a .mcp.json that registers the SixthWall server, adds a short section to your CLAUDE.md so Claude scans after writing code, installs a pre-commit hook, and runs your first scan.

    npx @sixthwall/cli init
  2. 02

    Restart Claude Code and approve the server

    Claude Code asks once whether to trust the project's MCP servers. Say yes. From then on Claude has scan_code, explain_finding and security_score tools available.

  3. 03

    Ask Claude to scan, or just keep working

    Try: "scan my code for security issues". Because of the CLAUDE.md section, Claude will also scan on its own after it writes new code and offer to fix what it finds.

What it looks for

The same rules run for every project, whatever tool wrote the code. These are the most serious ones. See all rules.

Questions

Do I still need Claude Code's /security-review?

Keep using it. It is a great first pass and it can reason about things no rule can. SixthWall adds deterministic checks that catch the same mistake every time, plus a score that persists between sessions.

Is there a Claude Code security review command I can run by hand?

Two. Inside Claude Code, type /security-review for Anthropic's own model-based review. For SixthWall's rule-based check, ask Claude to "scan my code for security issues" (it calls the scan_code tool), or run npx @sixthwall/cli scan in the terminal for the current diff and npx @sixthwall/cli scan --full for the whole project.

How do I secure the code Claude Code produces, not just review it?

Make the check part of the loop rather than a step you remember. After init, the CLAUDE.md section tells Claude to scan after it writes code, the pre-commit hook blocks commits with critical findings, and the GitHub App checks every pull request. Each finding carries a prompt you can paste straight back to Claude to apply the fix.

Does my code leave my machine?

No. The scanner runs locally, makes no network calls during a scan and needs no account. The only download is the scanner itself.

Is it free?

Yes. The editor scanner, the Claude Code integration, the pre-commit hook and the GitHub Action are free with no limits.