By ZeroPathAI
ZeroPath for Claude Code: scan code you write or modify against ZeroPath's AI appsec engine (SAST, secrets, SCA, IaC), and triage findings from your ZeroPath organization directly from the chat.
Explains why a ZeroPath finding matters in this codebase, with real code references.
Triggers ZeroPath's cloud AI to investigate whether a finding is exploitable; polls, summarizes.
Independent security review of a diff or files. Returns a BLOCK/FLAG/PASS verdict.
Authors a custom ZeroPath rule from a description; dry-runs before creating.
Runs the zeropath CLI on session edits, parses SARIF, drives a fix-and-rescan loop.
Apply, decline, or remove the ZeroPath usage block in the project CLAUDE.md. Idempotent; records consent so SessionStart stops nudging.
Explain why a ZeroPath finding matters in this codebase.
List open ZeroPath issues in this repo (or org). Read-only.
Fix a single ZeroPath finding end-to-end; verifies with a re-scan.
Trigger ZeroPath's cloud AI to investigate whether a finding is exploitable.
Executes bash commands
Hook triggers when Bash tool is used
Modifies files
Hook triggers on file write and edit operations
External network access
Own this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimOwn this plugin?
Verify ownership to unlock analytics, metadata editing, and a verified badge. GitHub access is read-only (username + org membership).
Sign in to claimBased on adoption, maintenance, documentation, and repository signals. Not a security audit or endorsement.
This plugin requires configuration values that are prompted when the plugin is enabled. Sensitive values are stored in your system keychain.
org_idYour default ZeroPath org ID. If left blank, the MCP server will resolve from your auth session.
${user_config.org_id}base_urlHosted ZeroPath users: leave as https://zeropath.com. Single-tenant or self-hosted users: change to your tenant URL, e.g. https://acme.zeropath.com. The MCP server and CLI both read this; the wrong value silently routes you to the wrong cluster.
${user_config.base_url}token_idAPI token ID. Generate one at Settings -> API Keys in the ZeroPath app (https://zeropath.com/app/settings/api).
${user_config.token_id}token_secretAPI token secret. Stored in your system keychain. Never logged, never echoed.
${user_config.token_secret}Connects to servers outside your machine
Connects to servers outside your machine
Requires secrets
Needs API keys or credentials to function
Requires secrets
Needs API keys or credentials to function
Uses power tools
Uses Bash, Write, or Edit tools
Uses power tools
Uses Bash, Write, or Edit tools
A security context layer for Claude. Your ZeroPath organization becomes a read/write surface Claude can reason over — findings, cross-repo code search, your team's triage history, custom rules — alongside the file in front of you.
This plugin bundles two pieces of existing ZeroPath tooling for use inside Claude Code:
zeropath-mcp-server
for read/write access to your org's findings, rules, and code.zeropath-cli
for local-diff scanning (SAST + secrets + SCA + IaC).Both are wired in automatically — you only fill in a Token ID and Token Secret at install time.
Vanilla Claude can only read what you have open. With this plugin, Claude can also:
You don't have to remember new commands. Claude routes to the right capability when your intent matches.
> is this pattern flagged anywhere in our org?
> why was this finding marked false-positive last quarter?
> what does our team think about this class of bug?
ZeroPath is where your appsec team has already codified what's risky in your codebase - custom rules they wrote after real incidents, suppressions for noisy patterns that don't matter in your stack, severity overrides based on actual exploitability, investigations completed by senior reviewers, the patched/FP/archived history.
Without this plugin, Claude operates without any of that. It can
spot a generic eval( but has no idea your team decided three
months ago that the one in templates/admin.ts is fine because
the input is signed upstream.
With the plugin, every answer Claude gives starts from that institutional knowledge instead of trying to rediscover it.
> have we used this dangerous regex anywhere else?
> show me callers of this function across the org
Claude can search and read code across every repo your ZeroPath
org has onboarded — not just what you have cloned locally. Returns
file:line citations from repos you've never opened. When you ask
about a finding in another repo, it pulls the source from there to
ground the explanation in actual code.
> is this safe to ship?
/zeropath:scan runs ZeroPath's checks against your local diff in
seconds, using your team's existing rule config and suppressions —
not a one-off scan. If you try to git push or open a PR with
unscanned edits, the plugin gives a soft warning (never blocks).
> fix issue_abc123
/zeropath:fix explains the finding against your real call graph,
proposes a unified diff, applies it on your consent, then re-scans
to verify the issue is actually gone. Optionally opens a PR for
you.
> investigate the criticals
/zeropath:investigate asks ZeroPath whether a finding is actually
exploitable in your codebase — not just theoretically reachable.
> flag any direct eval() usage in our checkout service
/zeropath:rule drafts a rule, shows you how many existing files
it would flag before you commit, then creates it org-wide on your
say-so.
From inside Claude Code:
/plugin marketplace add ZeroPathAI/zeropath-agent-plugin
/plugin install zeropath@ZeroPathAI
npx claudepluginhub zeropathai/zeropath-agent-plugin --plugin zeropathHarness-native ECC operator layer - 67 agents, 271 skills, 92 legacy command shims, reusable hooks, rules, selective install profiles, and production-ready workflows for Claude Code, Codex, OpenCode, Cursor, and related agent harnesses
Complete collection of battle-tested Claude Code configs from an Anthropic hackathon winner - agents, skills, hooks, and rules evolved over 10+ months of intensive daily use
Efficient skill management system with progressive discovery — 410+ production-ready skills across 33+ domains