Live lens while you code
Each dog stays on all session and flags risky code the moment it's written: the line, the exploit, the smallest fix.
v0.2.3 · 14 dogs, one install →Security review,
Security review,
running while you build.
A pack of security dogs inside Claude Code. They flag real vulnerabilities as you write code and audit the whole repo with one command.
users.tsstorage.tftools.py
12users.get("/:id", async (req, res) => {
13 const sql = "SELECT * FROM users WHERE id = " + req.params.id; const row = await db.query("SELECT * FROM users WHERE id = $1", [req.params.id]);
14 const row = await db.raw(sql);
15 res.json(row);
16});
SQL injection
ExploitGET /users/1 OR 1=1 dumps every user
FixSmallest change suggested
Malinois is watching$ /watchdog-go-vapt code0 found · 0 fixed
Always-on security lens
14 dogs, one per surface
Built into Claude Code
Works with the scanners you already use
- semgrep
- gitleaks
- trivy
- checkov
- osv-scanner
- bandit
- slither
- mobsf
Why Watchdog
From late, costly reviews to a pack on duty.
Security review usually comes late, costs a lot, or never happens.
Watchdog moves it into the moment you write the code. Find vulnerabilities as your product changes, not months later, then go straight from the finding to the fix.
How teams use Watchdog
Run it while you build, or send the whole pack.
Use a single dog for one surface, a bundle for your product type, or every dog at once.
Whole-repo audit
One command reviews the entire repo and returns a ranked report, Critical to Low, with file:line for every finding.
Bundles per product
Pick what you're building and one command sends the right dogs. No guessing which checks apply.
Client-ready report
/watchdog-go-vapt report turns the session's findings into one report you can hand over.
Compliance mapping
Pyrenees maps findings to SOC 2, ISO 27001, PCI DSS and OWASP ASVS before the auditor asks.
The report
Every finding, ranked in one place.
Severity, the exact line, how it gets abused and the smallest fix. Every report ends with what was not checked.
Findings
20
- Critical2
- High5
- Medium9
- Low4
Top findings
- SQL injection in GET /users/:id
src/routes/users.ts:12 - IDOR: any user can read any invoice
src/routes/invoices.ts:31
- JWT accepted with alg=none
src/auth/jwt.ts:18
- S3 bucket is public-read
infra/storage.tf:7
- Agent tool can run shell without approval
agent/tools.py:44
Fix · users.ts:12
- const sql = "SELECT … id = " + id; + db.query("… id = $1", [id]);
Not checked
- Runtime config on prod
- Third-party SaaS settings
- Business rules outside the repo
Secrets
2 found, reported by location and type only. Values are never printed.
The pack
Fourteen dogs. Each guards one surface.
Start with the dog you need, then add more.
VAPT
Malinois
Vulnerability assessment for source code, web apps, APKs and IPAs, then the report. Active tests stay in scope.
/watchdog-go-vaptAPIs
Bloodhound
Reads your OpenAPI or GraphQL spec and handlers together for BOLA, mass assignment, SSRF and shadow routes.
/watchdog-go-apiAuth
Doberman
Guards the front door: login, OAuth/OIDC, sessions, password reset, MFA, JWTs and SSO.
/watchdog-go-authCloud
Husky
Misconfigurations in Terraform, Kubernetes, Dockerfiles and CI pipelines.
/watchdog-go-cloudAI
Collie
Prompt injection, over-powered agent tools, unsafe model output, RAG leaks and risky MCP config.
/watchdog-go-ai
Privacy
Beagle
Follows personal data into logs, analytics and SDKs. Maps findings to GDPR and India's DPDP Act.
/watchdog-go-privacy
Supply chain
Rottweiler
Lockfiles, typosquats, install scripts, pinning, SBOMs, signed releases and licences.
/watchdog-go-supply-chain
Mobile
Shepherd
Android, iOS, Flutter and React Native: storage, pinning, deep links, WebViews and bridges.
/watchdog-go-mobile-app
Database
Dachshund
Digs into migrations, row-level security, DB roles and Firebase/Supabase rules.
/watchdog-go-database
Secrets
Akita
Finds secrets in code and git history, helps rotate them and blocks them at commit.
/watchdog-go-secrets
Frontend
Pointer
XSS sinks, CSP, postMessage, token storage and third-party scripts.
/watchdog-go-frontend
Web3
Shiba
Solidity and Rust contracts: reentrancy, access control, oracles and upgrades.
/watchdog-go-web3
Incident
Saint Bernard
After a breach: reads the logs, builds the timeline, sizes the blast radius, lists containment steps.
/watchdog-go-incident
Compliance
Pyrenees
Maps the pack's findings to SOC 2, ISO 27001, PCI DSS and OWASP ASVS.
/watchdog-go-complianceCommands
One command for what you're building.
One command
Sends 7 dogs
- MalinoisVAPT
- BloodhoundAPIs
- DobermanAuth
- PointerFrontend
- DachshundDatabase
- AkitaSecrets
- RottweilerSupply chain
Why Watchdog
Close the gaps between your scanners and your pen test.
CoverageTraditional approachThe gapWatchdog
CodeSAST and dependency scannersExploitability and business logicDogs read the code scanners can't understand
While buildingReview happens after the PRBugs ship before anyone looksLive lens flags risk as the line is written
Pen testingDeep, point-in-time, expensiveNothing between engagementsRun a full audit any time, for free
ReportingLong PDF, security jargonDevs don't know what to fix firstRanked, plain English, smallest fix
What you get
Findings your team can act on.
Catches bugs while you code
Each dog's lens stays on all session. When you or Claude write a login handler, a SQL query or an agent tool, the dog flags the risk on the spot: the line, why it's exploitable, and the smallest fix.
A full audit in one command
Run one bundle for what you're building, or /watchdog-go-all for everything. You get one ranked report, Critical to Low, each finding with file:line, a concrete exploit and a fix.
Plain English
Every finding says what it is, how someone would abuse it, how to fix it, and what happens if you don't. Useful to a junior dev or a client, not only to a security expert.
Honest about its limits
Every report ends with Not checked, so you know what still needs a human.
Never leaks what it finds
Secrets are reported by location and type only. The value is never printed.
Uses the tools you have
Dogs run installed scanners (semgrep, gitleaks, trivy, checkov, osv-scanner) and read the code those scanners can't understand.
14security dogs
40commands and lenses
0accounts or telemetry
MITfree and open source
Install
Up and running in a minute.
- 1Add the marketplace
In Claude Code, run /plugin marketplace add watchdoglab/watchdog.
- 2Install the pack
Run /plugin install watchdog@watchdog. One plugin brings all 14 dogs and every command.
- 3Send the dogs out
Work as usual and the dogs flag risks as you go. Run /watchdog-go-web (or the bundle for your product) for a full audit.
FAQ
Questions, answered.
What is Watchdog?
Watchdog is a free, open-source plugin for Claude Code. It adds 14 security "dogs", each an expert on one surface: VAPT, APIs, auth, cloud, AI, privacy, supply chain, mobile, databases, secrets, frontend, Web3, incident response and compliance. They review your code as you build and audit the whole repo on demand.
How do I install it?
In Claude Code run /plugin marketplace add watchdoglab/watchdog, then /plugin install watchdog@watchdog. That single plugin includes every dog and every command.
Which command should I run?
Run the bundle for what you're building: /watchdog-go-web, /watchdog-go-mobile, /watchdog-go-ai-app, /watchdog-go-infra, /watchdog-go-marketplace or /watchdog-go-defi. /watchdog-go-all runs every dog. Each dog also has its own command, like /watchdog-go-api or /watchdog-go-secrets.
Is Watchdog free?
Yes. It's MIT licensed, with no accounts, subscriptions or telemetry. It runs inside your own Claude Code session.
Does it attack live systems?
No, not by default. Every dog does static review. Only Malinois can run active tests, and only against targets you list in its authorized scope. Anything out of scope is refused.
Does it send my code anywhere?
Watchdog adds no servers of its own. It works through Claude Code, so your code is handled the same way as in any other Claude Code session. Secrets it finds are never printed, only their location and type.
Does it replace a professional pen test?
No. It catches a lot early and cheaply, and every report ends with a Not checked list. For a client audit, run /watchdog-go-compliance to map findings to SOC 2, ISO 27001, PCI DSS or ASVS, then bring in a human for what's left.
Which languages and stacks does it support?
Any. The dogs read code, specs, infrastructure files, mobile binaries and smart contracts. They also use scanners you already have installed, such as semgrep, gitleaks, trivy, checkov and osv-scanner.