Claude Code Security: Add a Second Opinion That Saves Tokens

Why the Model That Wrote the Code Needs a Second Opinion

Asking Claude to review code Claude just wrote is useful, but it is the same kind of reviewer twice. Anthropic is open about the limits. Its documentation for the Claude Security plugin says: "Scans are nondeterministic: two scans of the same code can surface different findings." The same page warns that a scan may use a significant number of tokens, and recommends running the plugin alongside static analysis and dependency scanners, because model reasoning complements deterministic checks rather than replacing them.

The stakes are measurable. Veracode's 2026 GenAI Code Security Report tested more than 100 AI models over four years and found an average security pass rate of 56%, a figure that has not moved.

That is the gap a second opinion fills. A rule that looks for a hardcoded key, an eval() on user input or a route with no auth check gives the same answer on every run, at the start of a session or four hours in. Our comparison of Claude Code's own security tools covers what each one catches and what they leave to scanners.

What Claude Gets When You Connect VibeDoctor

VibeDoctor is a remote MCP (Model Context Protocol) server with six tools. Claude decides when to call them, the same way it decides to read a file or run a command.

The full scan of your repository runs on VibeDoctor's side: secret detection, known CVEs in your dependencies, a check that every imported package exists on npm or PyPI, security rules and language linters. Claude reads the results through vibedoctor_status. vibedoctor_check is the quick pass on files as they are written. Each reply says what it checked and names anything it skipped, such as cross-file auth or dependencies, so Claude does not mistake a quick check for a full scan.

How VibeDoctor Saves Claude Code Tokens

Usage limits are real budgets now. Anthropic added weekly limits to Claude Code for Pro and Max subscribers in August 2025, on top of the limits that reset every five hours. A good part of an agent's budget goes on finding things: listing folders, searching for names and reading whole files to work out where a problem is.

VibeDoctor answers those questions from the last scan, with a short reply instead:

The tool reply still goes into Claude's context, but it is a summary of work already done, not the files themselves. The scan ran on VibeDoctor's servers, not in your session. vibedoctor_check is the exception: Claude sends it the files to check, which costs about what writing them did. Use it for the second opinion, not to save tokens. For the same idea applied by hand, see how structural code maps cut tokens per prompt and what to do when you run out of tokens mid-bug.

Why You Can Trust VibeDoctor's Answers and Access

A second opinion is only worth having if you can trust both its answers and its access to your account. Here is what VibeDoctor does on each side.

The answers.

• Fixed rules. vibedoctor_check runs rules, not a model, so the same code gets the same findings on every run.
• Every finding points to a line. Claude, and you, can open the exact place and judge it.
• The check says what it skipped. A quick check names the areas only a full scan covers.
• A finding is a lead, not a verdict. When one is wrong, Claude can record why with vibedoctor_note. The note never dismisses the finding or changes the score; only you can dismiss it in the dashboard.

The access.

• Sign-in, not a pasted key. Claude connects with OAuth: you sign in to VibeDoctor with GitHub, Google or a 6-digit email code and choose Allow. There is no API key to copy into a config file.
• Each app gets its own access. It is stored hashed, and disconnecting ends it at once.
• VibeDoctor only sees what Claude sends. It receives the code sent for a check, the questions asked and the notes recorded. It never sees your conversation with Claude, files Claude does not send, or your Claude login. Code sent for a check is checked in a temporary folder that is deleted when the check ends.
• VibeDoctor cannot change your code. Five tools only read. The sixth writes a note and nothing else.
• VibeDoctor is in Claude's Connectors Directory. In October 2026 Anthropic approved it as a community connector, which means it was screened before listing. The directory labels explain what Community and Verified mean.

How to Add VibeDoctor to Claude Code

You need a VibeDoctor account and one project that has been scanned once, so there are findings to report. Signing in for the first time creates a free account. Add the project at app.vibedoctor.io.

1. Run this in your terminal:

   claude mcp add --transport http vibedoctor https://agent.vibedoctor.io/mcp

2. In Claude Code, type /mcp, choose vibedoctor and sign in.
3. Choose Allow. The tools are ready in the same session.

Claude Code stores the sign-in and refreshes it on its own. To revoke it, open /mcp, choose vibedoctor and pick Clear authentication.

To make the second opinion a habit rather than something you remember to ask for, add a short rule to your project's CLAUDE.md:

## Before saying a task is done
- Run vibedoctor_check on the files you changed.
- Fix every critical or high finding, or explain why it does not apply.

Making Claude Code check its own work goes further, with hooks that run on every edit.

How to Connect It in claude.ai and Claude Desktop

1. Open Settings, then Connectors, or go straight to VibeDoctor in the Claude directory.
2. Find VibeDoctor and choose Connect.
3. Sign in on the VibeDoctor page and choose Allow.

The same address works in ChatGPT and Codex too. The connector guide has the steps for each app, the full tool list and troubleshooting.

Prompts to Try First

• "What are the most serious issues in my project right now?"
• "Check the files I changed for security problems before I commit."
• "What would break if I change the login handler?"
• "Which parts of the code have no tests?"
• "This finding is a false positive because the file is a test fixture. Record why."

How to Judge Any Connector Before You Allow It

The same questions apply to every MCP server you add to Claude Code, not just this one:

Treat what any tool returns as information, not instructions. Anthropic's own advice is to connect only to developers you trust, review the permissions you grant and stay aware of prompt injection, whatever the label.

FAQ