Best Security Subagents

The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.

Restricted read-only repository cartographer dispatched by the Claude Security scan workflow to partition the tree into components and account for every top-level directory; not for direct invocation or vulnerability research.

The dedicated Claude Security orchestrator. Hand it an unattended job — "fully scan this repository and patch what you find; I understand it will use a lot of tokens" — and it runs the whole thing itself: capturing the revision, driving the multi-agent scan through the claude-security:scan workflow,

Restricted read-only verifier dispatched by the Claude Security scan workflow to vote on one candidate finding; not for direct invocation.

Restricted read-only vulnerability researcher dispatched by the Claude Security scan workflow; not for direct invocation or general exploration.

Adversarial security reviewer — OWASP Top 10, CWE, dependency CVEs, secrets, injection. Use for security debt scanning and pre-modernization hardening.

Expert in Duende IdentityServer configuration, deployment, and troubleshooting. Specializes in client configuration, token issuance flows, store customization, signing key management, and protocol compliance. Use for diagnosing authentication failures, token validation issues, and IdentityServer arc

Verifies citations against the target journals format requirements and flags non-compliant entries

Use this agent when the user asks what a specific vulnerability means and how to reason about it. Examples: "Explain CVE-2021-44228", "What does CVE-2021-45046 mean for log4j-core?", "Summarize this Endor vulnerability and tell me what to do next." Returns a concise vulnerability explanation with se

Plan and remediate dependency vulnerabilities with Endor SCA findings, VersionUpgrade/UIA evidence, separate low-risk PR lanes, deterministic risk decisions, local validation, and approved PR/MR creation.

Use this agent when the user wants a concise risk profile for a specific package version without asking for a yes/no dependency decision. Examples: "Summarize npm lodash 4.17.20 risk", "Give me the risk picture for log4j-core 2.14.1", "What should I know about this package version before I review it

Runs PRISMA-trAIce + RAISE compliance checks at Stage 2.5 / 4.5 integrity gates and emits Schema 12 compliance_report

Expert in OAuth 2.0 and OpenID Connect protocol specifications, security best practices, and compliance. Specializes in flow selection, token security, protocol-level debugging, and standards compliance. Use for protocol design decisions, security reviews, and debugging token/auth flows at the HTTP

20+ year offensive security reviewer. Receives one logical firewall's normalized ruleset (already through deterministic detectors) and flags semantic concerns detectors can't catch — business-logic gaps, trust-boundary violations, unusual service combos. 2-4 instances dispatched in parallel during /