# Claude Code plugin: Your lockfile says what you have. The plugin says whether it matters.

A Match means you have a vulnerable version installed, but most Matches don’t affect your app: the vulnerable function is never called, or the feature is off. The plugin reads your code and tells you which is which, with the file and line.

- ## Runs on your machine

  It’s a Claude Code plugin. It runs in your own terminal, with your own Claude login.

- ## Your code never leaves it

  Nothing is uploaded to agentprime. The plugin reads your code locally and fetches only public Advisory data.

- ## A Verdict for each Match

  For every Advisory your lockfile matches, it says Not affected, Reachable – unproven or Inconclusive, with file:line evidence you can check.

GHSA-3q6v-r5mr-hxv8 · league/commonmark 2.5.3 Not affected

No converter the app builds registers the Table extension, so the vulnerable parser never runs, even on user Markdown.

- app/Http/Controllers/DocsController.php:18 Converts user Markdown with a CommonMarkConverter whose environment has the core extension only; no Table extension
- app/Http/Controllers/PreviewController.php:23 Adds CommonMarkCoreExtension and AttributesExtension only; TableStartParser is never registered

Example Verdict from the test app in our labelled set.

## Install: Get the plugin.

In Claude Code, add the agentprime marketplace and install the plugin:

```
/plugin marketplace add TheCraigHewitt/agentprime-plugin
/plugin install agentprime@agentprime
```

Then, from the repository you want to check, ask in plain words (“does CVE-2025-46734 affect us?”) or run `/agentprime:does-this-affect-me GHSA-xxxx-xxxx-xxxx`. The source is on [GitHub](https://github.com/TheCraigHewitt/agentprime-plugin), MIT licensed.

You’ll need Claude Code and Node 20 or later. [Read the docs](https://agentprime.io/docs/) for what the plugin and its CLI do.

---

The web page: <https://agentprime.io/plugin/>. Everything for agents: <https://agentprime.io/llms.txt>.