Claude Code plugin
Your lockfile says what you have. The plugin says whether it matters.
A Match means you have a vulnerable version installed, but most Matches don’t affect your app: the vulnerable function is never called, or the feature is off. The plugin reads your code and tells you which is which, with the file and line.
-
Runs on your machine
It’s a Claude Code plugin. It runs in your own terminal, with your own Claude login.
-
Your code never leaves it
Nothing is uploaded to agentprime. The plugin reads your code locally and fetches only public Advisory data.
-
A Verdict for each Match
For every Advisory your lockfile matches, it says Not affected, Reachable – unproven or Inconclusive, with file:line evidence you can check.
No converter the app builds registers the Table extension, so the vulnerable parser never runs, even on user Markdown.
- app/Http/Controllers/DocsController.php:18 Converts user Markdown with a CommonMarkConverter whose environment has the core extension only; no Table extension
- app/Http/Controllers/PreviewController.php:23 Adds CommonMarkCoreExtension and AttributesExtension only; TableStartParser is never registered
Install
Get the plugin.
In Claude Code, add the agentprime marketplace and install the plugin:
/plugin marketplace add TheCraigHewitt/agentprime-plugin
/plugin install agentprime@agentprimeThen, from the repository you want to check, ask in plain words (“does CVE-2025-46734 affect us?”) or run /agentprime:does-this-affect-me GHSA-xxxx-xxxx-xxxx. The source is on GitHub, MIT licensed.
You’ll need Claude Code and Node 20 or later. Read the docs for what the plugin and its CLI do.