Anthropic Ships Claude Code Skill & Plugin Security Scanning: The Supply Chain Defense Layer

The Supply Chain Problem Gets a Fix

On August 6, 2026, Anthropic shipped skill and plugin security scanning as a beta feature in Claude Code. The feature — announced in Anthropic's release notes as "Skill and plugin security scanning (beta)" — scans MCP servers, agent plugins, and custom skills for malicious patterns before allowing them to execute in agent contexts.

The timing is significant. The UK AISI had just published its 122-incident report on prompt injection attacks, and the 2026 agent supply chain breach wave (npm, PyPI, MCP servers) had made supply chain security the #1 concern for enterprise AI adoption.

What the Scanner Detects

Based on Anthropic's documentation and reverse engineering by the security community, the scanner checks for:

1. Tool description injection: Hidden instructions in MCP tool descriptions that attempt to override agent behavior
2. Data exfiltration patterns: Tool implementations that send data to unauthorized endpoints
3. Privilege escalation: Plugins requesting capabilities beyond their declared scope
4. Prompt extraction: Attempts to extract system prompts or conversation history
5. Malicious code execution: Shell commands, file system access, or network calls beyond expected boundaries

How It Works

The scanner operates as a pre-execution gate:

Plugin/MCP Discovery ──► Static Analysis ──► Sandboxed Dry Run ──► Allow/Deny
                              │                      │
                    Pattern Matching            Network Monitor
                    AST Analysis                File Access Audit

1. Static analysis: The scanner parses MCP server code and plugin manifests, looking for known malicious patterns in tool descriptions, function implementations, and configuration files.
2. Sandboxed dry run: Before allowing a plugin to execute in a real agent context, the scanner runs it in a sandboxed environment with synthetic inputs, monitoring for unexpected network calls, file access, or data exfiltration.
3. Pattern matching: The scanner maintains a database of known prompt injection patterns (updated weekly) and flags any tool description or system message that matches.

Industry Impact

The feature has three immediate effects:

1. Enterprise adoption: Enterprises that paused Claude Code deployment due to supply chain concerns can now enable a security baseline. Early adopters report that the scanner catches 94% of known malicious MCP servers.
2. MCP server quality: The existence of a scanner raises the bar for MCP server publishers. Servers with suspicious patterns are flagged, creating a natural quality filter for the MCP ecosystem.
3. Competitive pressure: The scanner sets a new baseline for coding agent security. Cursor, Codex, and GitHub Copilot are expected to ship similar features by Q4 2026.

What the Scanner Doesn't Catch

Anthropic is transparent about limitations:

• Novel attack patterns: The scanner catches known patterns but not zero-day injection techniques.
• Context-dependent attacks: Attacks that only trigger under specific conditions (e.g., when a certain date or user ID is present) may evade static analysis.
• Obfuscated code: Minified or obfuscated plugin code can bypass pattern matching.

For high-security deployments, Anthropic recommends combining the scanner with network monitoring, least-privilege plugin scoping, and the PydanticAI tool description sanitization pattern.

The Bigger Picture

Claude Code's security scanner is part of Anthropic's broader supply chain security strategy, which includes:

• MCP server allowlists (shipped in May 2026)
• Plugin capability declarations (shipped in June 2026)
• Tool description sanitization (shipped in August 2026)
• Runtime network monitoring (expected Q4 2026)

The trajectory is clear: agent supply chain security is becoming a first-class feature, not an afterthought.

By Deepak Bagada, CEO at SaaSNext & Principal AI Architect.

Last tested: August 2026 with Python 3.12, Node v22, and latest framework releases.