Security scanning for Claude Code projects
SixthWall runs inside Claude Code as an MCP server, so Claude checks its own work after every change. It complements Claude Code's built-in security review with fixed rules that fire the same way every time, a score you can track, and fixes Claude can apply directly.
Three steps
- 01
Run init in your project
This writes a .mcp.json that registers the SixthWall server, adds a short section to your CLAUDE.md so Claude scans after writing code, installs a pre-commit hook, and runs your first scan.
npx @sixthwall/cli init - 02
Restart Claude Code and approve the server
Claude Code asks once whether to trust the project's MCP servers. Say yes. From then on Claude has scan_code, explain_finding and security_score tools available.
- 03
Ask Claude to scan, or just keep working
Try: "scan my code for security issues". Because of the CLAUDE.md section, Claude will also scan on its own after it writes new code and offer to fix what it finds.
What it looks for
The same rules run for every project, whatever tool wrote the code. These are the most serious ones. See all rules.
Questions
Do I still need Claude Code's /security-review?
Keep using it. It is a great first pass and it can reason about things no rule can. SixthWall adds deterministic checks that catch the same mistake every time, plus a score that persists between sessions.
Does my code leave my machine?
No. The scanner runs locally, makes no network calls during a scan and needs no account. The only download is the scanner itself.
Is it free?
Yes. The editor scanner, the Claude Code integration, the pre-commit hook and the GitHub Action are free with no limits.