Docs

SafeWeave for Claude Code

Two ways to use SafeWeave in Claude Code: add it as an MCP server, or install the plugin for slash commands and a pre-push hook. Both run SafeWeave's 8 scanners; the free tier needs no license key.

Option A — MCP server (one command)

claude mcp add safeweave -- npx -y safeweave-mcp

Then ask Claude to "scan this project with SafeWeave." Findings come back with severity, file:line, and CWE; ask Claude to fix one and it opens the file and applies the change.

Option B — Plugin (commands + hook)

/plugin marketplace add nickfluxk/safeweave
/plugin install safeweave

The plugin adds:

• /safeweave:scan — full project scan with a coverage-aware summary.
• /safeweave:fix <finding_id> — pull fix context, apply it, and re-scan to verify.
• secure-before-push skill — Claude scans before commits, pushes, and PRs.
• pre-push hook — a hard gate: a git commit/git push with a high or critical finding is blocked. Override once with SAFEWEAVE_ALLOW=1.

Pro scanners

Set SAFEWEAVE_LICENSE_KEY in your environment to unlock all 8 scanners. Without it, SAST, secrets, and dependency scanning run free.