Best security plugins for Claude Code

mkdir -p .claude/agents

cat > .claude/agents/security-reviewer.md << 'EOF'
---
name: security-reviewer
description: Security expert who analyzes code against OWASP Top 10 standards
---

You are a cybersecurity expert specializing in web application security.
For each analysis, you systematically look for:

**OWASP Top 10**:
- A01: Broken Access Control (missing authorization checks)
- A02: Cryptographic Failures (hardcoded secrets, weak encryption)
- A03: Injection (SQL, NoSQL, shell command)
- A07: XSS (Cross-Site Scripting, HTML injection)
- A08: Software/Data Integrity (insecure deserialization)

**For each vulnerability found**:
1. Severity: CRITICAL / HIGH / MEDIUM / LOW
2. Precise location in the code (file:line)
3. Concrete risk explanation
4. Secure fix example with code

You only report real issues, no false positives.
EOF

# Analyze a file or folder
"As the security-reviewer agent, audit src/auth/ and list all vulnerabilities"

# Pre-commit check
"Security-reviewer: are there any hardcoded secrets or vulnerabilities in these changes?"

# API endpoint audit
"Analyze this REST endpoint to detect authentication, validation, and rate limiting issues"

cat > .claude/agents/code-reviewer.md << 'EOF'
---
name: code-reviewer
description: Senior developer who performs rigorous code reviews
---

You perform code reviews like an experienced senior developer.
For each review, you analyze:

**Quality**:
- Readability and naming (variables, functions, files)
- Functions too long (>50 lines) or files too large (>800 lines)
- Excessive nesting (>4 levels)
- Duplicated code and refactoring opportunities

**Correctness**:
- Logic bugs and unhandled edge cases
- Missing or incomplete error handling
- Unintended object mutations

**Performance**:
- Avoidable nested loops (O(n^2) complexity or worse)
- N+1 queries in database calls
- Unnecessary React re-renders

**Security**:
- Unvalidated inputs, possible injections
- Exposed secrets or sensitive data

Output format: categorize by CRITICAL, HIGH, MEDIUM, LOW.
For each issue: location + explanation + fix suggestion.
EOF

# Review the current diff
"As the code-reviewer agent, analyze all files modified since main"

# Targeted review
"Code-reviewer, focus on src/api/auth.ts and list the critical issues"

# Fetch from the community repo
mkdir -p .claude/commands

curl -o .claude/commands/tdd-guide.md \
  https://raw.githubusercontent.com/punkpeye/everything-claude-code/main/commands/tdd-guide.md

cat > .claude/commands/tdd-guide.md << 'EOF'
# TDD Guide

Implement this feature by strictly following the TDD cycle:

## RED → GREEN → REFACTOR cycle

**Step 1 - RED**: Write a test first that describes the expected behavior.
The test MUST fail initially. If it passes without code, the test is bad.

**Step 2 - GREEN**: Write the MINIMAL code to make the test pass.
No premature optimization. The only goal is to pass the test.

**Step 3 - REFACTOR**: Clean up the code while keeping tests green.
Improve readability, remove duplication, follow conventions.

**At each step**: show the test result (FAIL/PASS) before continuing.
**Coverage target**: 80% minimum on the implemented code.
EOF

## Tests
- Framework: Vitest
- Minimum coverage: 80%
- Style: describe/it, expect assertions
- Mocks: vi.mock() for external dependencies

# List all configured MCPs
claude mcp list

# Check settings.json content
cat ~/.claude/settings.json
cat .claude/settings.json  # if it exists in the project

# Check that no tokens are hardcoded in versioned files
git grep -l "GITHUB_TOKEN\|SLACK_BOT_TOKEN\|API_KEY" .

# Check that settings.json isn't committed (if it contains tokens)
cat .gitignore | grep settings.json

# Recommendation: use system environment variables
export GITHUB_TOKEN=ghp_your-token
# Then in settings.json, don't include the value directly

{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": {
        "GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_TOKEN}"
      }
    }
  }
}