Tend to agree that for the strongest use cases, AI companies will prefer to sell the technique as a service rather than its raw output (e.g., their enterprise security services). For use cases where the output is less valuable, tokens are sold. If AI tokens were so magical in creating new value in developing software applications generally, they wouldn't be selling tokens directly. They'd hoard the tokens are use them to dominate SaaS software in any industry they want.
The same way as someone selling an expensive course in the stock market is signaling that they have more to gain by selling the course rather than taking their knowledge and making money in the stock market directly.
anthropics/defending-code-reference-harness
Interestingly, it states:
"This repo is not maintained and is not accepting contributions.
Want a managed option? Anthropic offers Claude Security, a hosted product that finds and fixes vulnerabilities in your source code across multiple projects. Claude Security scans your repository for vulnerabilities, applies a multi-stage verification pipeline to reduce false positives, and lets you manage findings through their lifecycle: triage, fix validation, and rapid fix generation.
This repository is an open-source reference implementation based on general best practices for finding vulnerabilities using Claude. You can use it to build your own vulnerability finding pipeline, customize the logic, and it can be used with whatever access you have to Claude APIs (including Bedrock, Vertex, or Azure)."
Mentions
功能也跑全了：JSON/Markdown/SARIF 输出、baseline 抑制误报、--recursive、CI 的 fail-on-findings、MCP registry 对比，还能当 MCP server。远程 Git URL 被它的 SSRF 防护拦，改本地 clone。推荐，但 LLM 要选型、分数需复核。 NVIDIA/SkillSpector 推广帖 x.com @CDGalpha
Tend to agree that for the strongest use cases, AI companies will prefer to sell the technique as a service rather than its raw output (e.g., their enterprise security services). For use cases where the output is less valuable, tokens are sold. If AI tokens were so magical in creating new value in developing software applications generally, they wouldn't be selling tokens directly. They'd hoard the tokens are use them to dominate SaaS software in any industry they want. The same way as someone selling an expensive course in the stock market is signaling that they have more to gain by selling the course rather than taking their knowledge and making money in the stock market directly. anthropics/defending-code-reference-harness Interestingly, it states: "This repo is not maintained and is not accepting contributions. Want a managed option? Anthropic offers Claude Security, a hosted product that finds and fixes vulnerabilities in your source code across multiple projects. Claude Security scans your repository for vulnerabilities, applies a multi-stage verification pipeline to reduce false positives, and lets you manage findings through their lifecycle: triage, fix validation, and rapid fix generation. This repository is an open-source reference implementation based on general best practices for finding vulnerabilities using Claude. You can use it to build your own vulnerability finding pipeline, customize the logic, and it can be used with whatever access you have to Claude APIs (including Bedrock, Vertex, or Azure)."