Top AI Repos — open-source AI, indexed and scored
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
Top AI Repos tracks AI repositories on GitHub and answers two different questions about each one: is it moving right now, and would you bet a product on it.
An AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities.
| Date | Stars |
|---|---|
| 2026-07-31 | 5708 |
| 2026-08-02 | 5708 |
| 2026-08-03 | 5740 |
| 2026-08-06 | 5740 |
Today
— stars today
This week
— stars this week
This month
— stars this month
Momentum
0.0
growth rate 0.00%/day
# Claude Code Security Reviewer
An AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities. This action provides intelligent, context-aware security analysis for pull requests using Anthropic's Claude Code tool for deep semantic security analysis. See our blog post [here](https://www.anthropic.com/news/automate-security-reviews-with-claude-code) for more details.
## Features
- **AI-Powered Analysis**: Uses Claude's advanced reasoning to detect security vulnerabilities with deep semantic understanding
- **Diff-Aware Scanning**: For PRs, only analyzes changed files
- **PR Comments**: Automatically comments on PRs with security findings
- **Contextual Understanding**: Goes beyond pattern matching to understand code semantics
- **Language Agnostic**: Works with any programming language
- **False Positive Filtering**: Advanced filtering to reduce noise and focus on real vulnerabilities
## Quick Start
Add this to your repository's `.github/workflows/security.yml`:
```yaml
name: Security Review
permissions:
pull-requests: write # Needed for leaving PR comments
contents: read
on:
pull_request:
jobs:
security:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
ref: ${{ github.event.pull_request.head.sha || github.sha }}
fetch-depth: 2
- uses: anthropics/claude-code-security-review@main
with:
comment-pr: true
claude-api-key: ${{ secrets.CLAUDE_API_KEY }}
```
## Security Considerations
This action is not hardened against prompt injection attacks and should only be used to review trusted PRs. We recommend [configuring your repository](https://docs.github.com/en/repositories/managing-your-repositorys-settings-and-features/enabling-features-for-your-repository/managing-github-actions-settings-for-a-repository#controlling-changes-from-forks-to-workflows-in-public-repositories) to use the "Require approval for all external contributors" option to ensure workflows only run after a maintainer has reviewed the PR.
## Configuration Options
### Action Inputs
| Input | Description | Default | Required |
|-------|-------------|---------|----------|
| `claude-api-key` | Anthropic Claude API key for security analysis. <br>*Note*: This API key needs to be enabled for both the Claude API and Claude Code usage. | None | Yes |
| `comment-pr` | Whether to comment on PRs with findings | `true` | No |
| `upload-results` | Whether to upload results as artifacts | `true` | No |
| `exclude-directories` | Comma-separated list of directories to exclude from scanning | None | No |
| `claude-model` | Claude [model name](https://docs.anthropic.com/en/docs/about-claude/models/overview#model-names) to use. Defaults to Opus 4.1. | `claude-opus-4-1-20250805` | No |
| `claudecode-timeout` | Timeout for ClaudeCode analysis in minutes | `20` | No |
| `run-every-commit` | Run ClaudeCode on every commit (skips cache check). Warning: May increase false positives on PRs with many commits. | `false` | No |
| `false-positive-filtering-instructions` | Path to custom false positive filtering instructions text file | None | No |
| `custom-security-scan-instructions` | Path to custom security scan instructions text file to append to audit prompt | None | No |
### Action Outputs
| Output | Description |
|--------|-------------|
| `findings-count` | Total number of security findings |
| `results-file` | Path to the results JSON file |
## How It Works
### Architecture
```
claudecode/
├── github_action_audit.py # Main audit script for GitHub Actions
├── prompts.py # Security audit prompt templates
├── findings_filter.py # False positive filtering logic
├── claude_api_client.py # Claude API client for false positive filtering
├── json_parser.py # Robust JSON parsing utilities
├── requirements.txt # Python dependencies
├── test_*.py # Test suites
└── evals/ Excerpt of 8,552 characters
Read on GitHub
David Dworken · Anthropic · United States
28
Graham Campbell · Graham Campbell Technology Ltd · United Kingdom
1
1
Would you bet a product on this? Bounded 0–100 and slow moving.
matched fp:afa8ab3f468d7e24, llm:Description: 'An AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities.' Language: Python. Uses AI model to review code for security issues in CI/CD action.
matched fp:afa8ab3f468d7e24, llm:Description: 'An AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities.' Language: Python. Uses AI model to review code for security issues in CI/CD action.
matched fp:afa8ab3f468d7e24, llm:Description: 'An AI-powered security review GitHub Action using Claude to analyze code changes for security vulnerabilities.' Language: Python. Uses AI model to review code for security issues in CI/CD action.