What it does

OSS Scanner scans open-source repositories for security vulnerabilities. Core maintainers enroll a project by opening a pull request that adds projects/<project>/project.yaml to github.com/anthropics/oss-scanner. The config names the repository, a primary contact email and a Dockerfile. The Dockerfile installs all dependencies and builds the project so the scanning agent can work without internet access. Maintainers can validate the config with tools/validate.py before opening the pull request. After a project is accepted, Anthropic scans it. The scanning pipeline includes agents that double-check bugs, propose patches and perform root cause analysis. Maintainers receive a bundle of bug reports by email. After the first scan, OSS Scanner regularly scans enrolled projects to identify potential new vulnerabilities introduced since the last scan, and vulnerabilities that may have been missed in prior scans.

Capabilities

Enrolled projects receive reports as soon as they are scanned, without human review of the reports first.
An optional threat model file lets maintainers describe what code to test, which inputs are adversarial, and how to rate severity.
Maintainers can add a GPG public key so report emails are encrypted. A project that adds a GPG key cannot add CC addresses.
The auto_ccs field adds extra email addresses that are copied on every report.
A project can pause reports by setting disabled: true, or opt out by deleting its projects/<project>/ directory in a pull request.

When to use it

Use it when your project's core maintainers already keep up with verified high and critical vulnerability reports and want to further secure the code.
Use it when you want vulnerability reports sooner than the human-reviewed coordinated vulnerability disclosure process delivers them.
Use it when your project is an established open-source project with a critical impact on infrastructure and user security.