Anthropic OSS Scanner
Anthropic OSS Scanner provides free, opt-in vulnerability scans for accepted open source projects. Reports include reproduction details and proposed patches where available. This is security support rather than direct maintainer funding.
Eligibility and enrollment. The program targets established projects important to infrastructure and user security. New projects and forks generally do not qualify unless they independently meet the criteria. Core maintainers apply through a pull request to the enrollment repository, providing project configuration, a Dockerfile, and a security contact. A threat model is optional.
Tradeoffs. Findings are model-generated without human review and may be incorrect. Maintainers need capacity to validate and fix reports. Scans recur, but the documentation promises no fixed schedule. Projects can pause or withdraw through the enrollment repository.
See the official FAQ for current eligibility and operating terms and the launch announcement for background. OSS Scanner is separate from Claude for Open Source’s subscription program.
You are viewing: Anthropic OSS Scanner
Goal: Project support. Model: Infrastructure. Status: Live.
Should you use this?
- Best for
- Projects whose main blocker is hosting, CI, storage, AI tooling, or operational overhead.
- Not ideal for
- Projects that need direct maintainer income rather than cost reduction.
- Why choose it
- Free recurring security scans for established, security-critical OSS projects with capacity to triage findings. Reports arrive without human review; acceptance is case by case.
- Watch out for
- Credits and tooling reduce burden but usually do not fund maintainer time directly.
- Setup effort
- Medium
- Fees
- Anthropic covers scanning costs for accepted projects. Maintainers provide a build environment and handle validation and remediation of findings.
- Last verified
- 2026-10-26