Two-Stage, 50-Agent Security Scanner: Scale Claude Code for Large Codebase Reviews

TL;DR: Fan out 50 parallel Claude Code agents across your repositories using a two-stage pattern — fast rules scan first, then targeted agent review — to audit millions of lines in hours, not weeks.

Alberta's Ministry of Technology and Innovation scanned 466 million lines of code in 20 hours using this approach. The pattern is repeatable with standard Claude Code.

Stage 1 — Fast pattern scan (cheap)

Run semgrep, CodeQL, or a simple grep sweep against your repos. The goal is to flag candidate locations — not to reason about them yet. This phase is fast and inexpensive because it doesn't need code understanding, just signature matching.

semgrep --json --config=auto ./src > findings.json

Stage 2 — Agent review (targeted, deep)

For each flagged location, a Claude Code subagent receives the file + surrounding context (50–100 lines) and answers three questions:

1. Is this actually exploitable in context?
2. What's the minimal fix?
3. Does a test exist to verify the fix?

If no test exists, Claude writes one first, then patches. Run 20–50 subagents in parallel — one per finding batch — to fan out across repos simultaneously.

Optional: red/blue team agents

Add two specialized agents for comprehensive coverage:

• Red team: probes the application from the outside, mapping the attack surface and tracing how findings could chain into larger exploits
• Blue team: checks defenses against a controls checklist (OWASP Top 10, CIS, ISO 27001) and writes a remediation plan with exact file references

Alberta runs 95 security controls per application per pass with this setup. Applications originally built in the 1990s were rebuilt in modern, safer languages in 4–5 days (versus 5 months the first time).

Where to start

The Claude Code Review docs walk through setting up a review workflow. The Alberta case study (with published technical white papers) shows what this looks like at government scale — and what to expect as Claude writes tests, patches, and occasionally rebuilds whole modules.

Sources: Alberta government case study — Anthropic · Claude Code Review docs · Automate security reviews with Claude Code