Plugin Claude Code
AppSec Foundry plugins for application security work in Claude Code.
16 today A
tokens not measured
Plugin Claude Code
Code-derived threat modeling plugin: the architecture model is derived from the repository, not maintained by hand. Provides AppSec-focused agents and skills for threat modeling, STRIDE analysis, dependency scanning, QA review, and security context resolution.
16 today A
tokens not measured
e2e-full
03Command Claude Code
Manual full-run E2E check — runs the threat-model pipeline against the bundled synthetic-repo fixture and validates 25 structural assertions. Costs 30–50% of a Pro 5h-window; never auto-triggered.
16 today A 46 tokens
Command Claude Code
Triage a failed make release-check — read the captured log, identify the failing gate stage, and recommend the producer-side fix. Analysis only; applies nothing unless asked.
16 today A 36 tokens
PreToolUse
05Hook Claude Code
Runs before the agent uses a tool for Write, Edit, MultiEdit, NotebookEdit, Bash, PowerShell, mcp__.*, Edit, Write, MultiEdit, NotebookEdit and Bash tool calls, running python3 (2 commands). From appsec-foundry/appsec-advisor.
16 today A
tokens not measured
Settings file Claude Code
Agent settings declaring 1 hook event (PreToolUse).
16 today A
tokens not measured
Instructions file CodexOpenCode
AGENTS.md instructions for appsec-foundry/appsec-advisor, covering agents.md, project at a glance, contract hierarchy, rules that always apply and branch flow.
16 today A 1,834 tokens
Instructions file
Claude Code instructions for appsec-foundry/appsec-advisor, a project described as: Claude Code plugin for code-anchored threat modeling and security architecture review.
16 today A 11 tokens
Agent
INTERNAL — verifies one receipted abuse-case candidate end-to-end against bounded candidate metadata and targeted code evidence.
16 today B 31 tokens
Agent
INTERNAL — controller-dispatched actor discovery after config/IaC scanning and before architecture modeling; writes .actors-discovered.json and is skipped in quick mode.
16 today A 40 tokens
Agent
INTERNAL — Stage 4 of the create-threat-model skill. Rewrites the prose of an assembled threat model for clarity and consistency, and changes nothing else. Reads the bounded projection at .dispatch-context/editorial/blocks.json and writes one plan to .dispatch-context/editorial/plan.json; applyeditorialplan.py…
16
changed today A 90 tokens
Agent
INTERNAL context-v2 role that converts validated recon and topology evidence into the bounded architecture-stage artifacts for Phases 3 through 6.
16 today A 36 tokens
Agent
Standalone AuthN/AuthZ analyzer. Consumes deterministic scanner output (sourceauthscanner, authzconfirm, routeinventory) and optional requirements violations to produce a cross-component authentication and authorization threat report. Runs as part of the authnz-review skill or as a post-Phase-9 deepener.
16 today B 67 tokens
Agent
INTERNAL — controller-dispatched configuration and IaC analysis after recon and before STRIDE fan-out; emits contracted findings from supported deployment and package surfaces.
16 today B 36 tokens
Agent
INTERNAL — controller-dispatched context resolver for approved external context, business context, and bounded repository documents; writes .threat-modeling-context.md.
16 today B 36 tokens
Agent
INTERNAL context-v2 role that evaluates validated architecture and control evidence and writes only Phase-8 controls and bounded STRIDE semantic context.
16 today A 34 tokens
Agent
Semantic-quality judge for a threat-model run, used by the eval-threat-model dev/test skill (NOT in the create-threat-model phase map). Two modes: JUDGE surfaces candidate quality defects for one rubric dimension from a pre-digested brief; VERIFY adversarially refutes another judge's candidates (refute-by-default)…
16 today A 104 tokens
Agent
INTERNAL context-v2 role that judges the controller-selected evidence sample from bounded receipted source windows.
16 today A 28 tokens
Agent
INTERNAL — lightweight repair executor for the create-threat-model re-render loop; rewrites only planned fragments and reruns deterministic composition without analysis stages.
16 today A 36 tokens
Agent
INTERNAL specialist for Stage-2 Management Summary fragments. Authors only management-summary inputs; the controller owns composition and shared stage state.
16 today A 32 tokens
Agent
INTERNAL context-v2 role for the bounded qualitative mitigation splits, additions, and cross-finding tier root-cause synthesis that deterministic post-STRIDE scripts cannot derive.
16 today A 44 tokens
Agent
INTERNAL — exceptional Stage-3 semantic triage after the deterministic QA gate. Consumes a compact repair plan; never repeats the full mechanical detector battery.
16 today A 38 tokens
Agent
INTERNAL — controller-dispatched repository reconnaissance for structure, technology, and security-relevant code signals; writes $OUTPUTDIR/.recon-summary.md.
16 today D 37 tokens
Agent
Security reviewer for a single code change. Reads the diff, works out which security expectations it implicates, and grades the post-change code PASS/PARTIAL/FAIL/UNVERIFIABLE/NOTAPPLICABLE with file:line evidence and a code-aware fix → .requirements-verification.json. Grades against the active standard: the company…
16 today A 137 tokens