Free AI vulnerability scans for open-source projects

Anthropic has launched OSS Scanner, a free service that scans open-source projects for security issues and produces vulnerability reports. The launch gives maintainers and other users of open-source software a way to request an AI-assisted review without paying for the scans. Anthropic says the service is designed to examine codebases and identify potential vulnerabilities, then provide findings in a report.

OSS Scanner is aimed at open-source projects: users submit a project for scanning, and Anthropic’s systems analyze it. The service is not presented as a replacement for existing security practices, but as an additional way to surface possible problems. Its reports can help readers understand what the scanner found and decide whether further investigation is needed.

By making the scans free, Anthropic is offering security analysis to projects that may not have access to dedicated security teams or paid review tools. The launch also reflects a broader effort to apply AI models to software security work. Details about how the scanner works, what its reports include, and who can use the service are covered in the following sections.

How OSS Scanner uses Anthropic models

OSS Scanner uses Anthropic’s strongest models to scan open-source projects for vulnerabilities, including Mythos. The service applies these models to the code in a project and produces a security report, helping maintainers examine potential risks in their software.

Using Anthropic models is central to how the scanner assesses a project. Rather than offering only a general overview, OSS Scanner looks for vulnerabilities in the project’s code and presents findings for review. Its scans are available free for open-source projects, making this model-powered analysis accessible to maintainers working on publicly available software.

Mythos is included among the strongest Anthropic models used by the service. OSS Scanner’s reports can help teams understand what the scan found and decide what to investigate next. The service is intended to support security work, not replace maintainers’ judgment: developers can review the reported issues in the context of their project and determine appropriate next steps.

What the vulnerability reports provide

OSS Scanner’s reports are the output of its analysis of open-source projects for vulnerabilities. The service is designed to help developers and project maintainers understand potential security issues in the software they use or maintain.

Rather than presenting a scan as a substitute for review, the reports give users information to consider as part of their security work. They can help teams identify areas that may need attention and decide what to investigate further. Because the analysis focuses on open-source projects, the reports can also support a clearer view of potential vulnerabilities in project dependencies.

These results are intended to be useful to people working with open-source software, whether they are evaluating a project or maintaining one. OSS Scanner uses Anthropic models as part of its analysis, and the resulting reports communicate what that analysis identifies. Users can use the findings to inform their next steps, while applying their own judgment and context when assessing the issues.

Who the service is for

OSS Scanner is designed for open-source projects, with scans offered free of charge. Its focus is on helping open-source maintainers identify potential vulnerabilities in their code without paying for a scan. The service uses AI to examine projects and produce vulnerability reports, giving teams information they can use to assess security issues.

This makes OSS Scanner relevant to people maintaining or contributing to open-source software who want to check their projects for vulnerabilities. It is not described as a general-purpose scanning service for every kind of software: the stated audience is open-source projects. The scans are free, so there is no scan fee for eligible open-source projects.

Whether a project is maintained by one person or a wider community, the central point is the same: OSS Scanner offers open-source projects a way to request AI vulnerability scans at no cost. Maintainers can use the resulting reports as a starting point for reviewing potential problems in their code and deciding what to investigate further.