Claude Developer Security Report Generator

A small reusable live Anthropic Claude integration extracted from AutoPentest Studio.

It takes deterministic security-assessment data and converts it into a developer-readable report containing:

• executive summary
• developer context
• key risks
• remediation progress
• ordered developer actions
• verification notes

The component deliberately keeps finding detection, severity, risk scoring, approval state, commit state, and runtime verification outside the AI model.

Why this gig exists

Security scanners often produce technically correct evidence that is difficult for software teams to act on quickly. This component translates already-established security facts into implementation-focused language without allowing the model to redefine those facts.

Safety / grounding behavior

The system prompt tells Claude not to:

• invent vulnerabilities or exploit success
• change supplied severities or scores
• change correlation verdicts
• claim deployment or runtime verification that did not occur
• claim external exploitability unless supplied evidence proves it

The client also:

• discovers a Claude model available to the current API key
• supports an explicit ANTHROPIC_MODEL
• rejects truncated responses
• rejects malformed JSON
• keeps output structured
• does not require the Anthropic Python SDK

Requirements

• Python 3.10+
• requests
• Anthropic API key

Install:

pip install -r requirements.txt

Set the API key.

Windows CMD:

set ANTHROPIC_API_KEY=your_key_here

PowerShell:

$env:ANTHROPIC_API_KEY="your_key_here"

Optional explicit model:

set ANTHROPIC_MODEL=your_available_model_id

Input

Pass a normal JSON object containing deterministic security data. Example:

{
  "scope": {
    "incident": "Demo assessment",
    "website": "https://example.test",
    "repository": "https://github.com/example/app",
    "branch": "main"
  },
  "deterministic_summary": {
    "aggregate_risk": "Critical",
    "total_findings": 6,
    "severity_counts": {
      "Critical": 2,
      "High": 1,
      "Medium": 3
    }
  },
  "priority_findings": [
    {
      "title": "SQL injection",
      "severity": "Critical",
      "risk_score": 16,
      "location": "app.py:94",
      "risk_rationale": "Untrusted values are interpolated into SQL.",
      "remediation": "Use parameterized queries."
    }
  ],
  "correlations": [],
  "remediation": [],
  "before_after": []
}

Do not include raw passwords, API keys, access tokens, or secret values in the assessment payload.

Usage

CLI:

python claude_developer_security_report.py assessment.json

Python:

from claude_developer_security_report import generate_developer_security_report
report = generate_developer_security_report(assessment)
print(report["executive_summary"])
print(report["_meta"]["model"])

Output shape

{
  "executive_summary": "...",
  "developer_context": "...",
  "key_risks": [],
  "remediation_progress": "...",
  "priority_actions": [],
  "verification_notes": "...",
  "_meta": {
    "provider": "Anthropic Claude",
    "model": "...",
    "request_id": "...",
    "input_tokens": 0,
    "output_tokens": 0
  }
}

Origin

Built during the hackathon as the Software Developer Report capability in AutoPentest Studio, then extracted as a standalone reusable code gig.

Dependencies / disclosure

• Live AI provider: Anthropic Claude API
• HTTP client: requests
• No pretrained model is bundled in this repository.
• No AutoPentest Studio database, authentication, scanner, or UI code is included.

License

Recommended marketplace/repository license: MIT.