AWS Continuum Wraps Claude Code and Codex

By Lazar Milicevic · Published August 17, 2026 · 9 min read

You're shipping code faster than ever with Claude Code or Codex, and somewhere between the third refactor and the auto-generated migration script, a small voice asks: what's actually reviewing this for security before it hits main? If you're a solo dev or a 5-person team without a dedicated AppSec engineer, the honest answer has usually been "nothing, really." That changed at Black Hat USA 2026 when AWS announced Continuum would integrate directly into Anthropic's Claude Code and OpenAI's Codex.

This is a bigger deal than it looks, and not for the reason most vendors will tell you. Let's break down what it means if you're building with agentic coding tools right now.

What AWS Continuum actually does inside Claude Code and Codex

Continuum is AWS's code vulnerability scanning platform, and the new integration means it runs as an in-loop reviewer on code generated by Claude Code and Codex — before that code is committed, not after. The pitch is simple: agentic coding tools produce a lot of code, humans review less of it, and static scanners that run post-merge catch problems too late.

Concretely, the integration exposes Continuum as a review step the coding agent calls during generation. When Claude Code proposes a diff, Continuum inspects it for known vulnerability classes — SQL injection, hardcoded secrets, insecure deserialization, IAM overreach, unvalidated redirects — and returns findings the agent can act on in the same turn. Same pattern for Codex.

The interesting move here is architectural. AWS is not competing with Anthropic or OpenAI on the frontier model. It's positioning itself as the security substrate underneath both. If you believe agentic coding is where developer workflows are going, owning the security layer is a durable position regardless of which model wins.

Why the security layer matters more than the model right now

For solo developers and small teams, this integration solves a specific problem: the review bottleneck. When one person is shipping features with an agentic tool, they're the developer, the reviewer, and the security engineer. That doesn't scale, and it doesn't work.

Here's the honest tradeoff most builders are making today:

The "in-loop scanner" row is what Continuum is going after. It's not novel as a concept — Snyk, Semgrep, GitHub Advanced Security, and others have been pushing this direction. What's different is that Continuum is being wired directly into the agent runtime, not bolted on as a pre-commit hook you have to remember to configure.

For solopreneurs specifically, the value isn't "better security scanning." It's removing one more thing you have to think about. That's a real unlock.

What the integration actually looks like in practice

Based on the announcement, here's roughly how the flow works when Continuum is enabled in Claude Code:

# Example config sketch — verify exact schema on the AWS docs when it ships
claude_code:
  reviewers:
    - name: aws-continuum
      trigger: pre_commit
      policy: block_on_high
      scan_scope:
        - staged_diff
        - imported_dependencies
      auth:
        provider: aws-sso
        role: arn:aws:iam::123456789012:role/ContinuumScanner

When you ask Claude Code to add an endpoint, the agent writes the code, Continuum scans the diff, and if it finds a high-severity issue (say, a raw SQL query built from a query string), Claude Code sees the finding in the same turn and rewrites. You see the corrected version, not the vulnerable draft.

The important detail: this shifts the failure mode. Instead of "AI shipped insecure code and you didn't notice," you get "AI attempted to ship insecure code, scanner caught it, AI rewrote it." Same speed, better floor.

The tradeoff is latency and cost. Every generation now involves a scanner round-trip. For heavy refactors touching hundreds of files, that adds up. Expect somewhere in the range of a few extra seconds per meaningful diff. AWS hasn't published pricing at time of writing — check the current pricing page when it lands.

Where this leaves Snyk, Semgrep, and GitHub Advanced Security

This is a real competitive shot. Snyk and Semgrep have been the default recommendations for AI-generated code scanning, and GitHub Advanced Security has the GitHub-native advantage. AWS Continuum's wedge is that it's the same tool your infrastructure already trusts if you're on AWS — same IAM, same audit logs, same compliance reports.

Fair assessment of where each still wins:

• Semgrep remains the best option if you want custom rules written in a query language you fully control. Their community rule library is deep. Continuum's rule extensibility is unproven.
• Snyk has stronger dependency-graph analysis and license compliance features than Continuum is likely to match in v1.
• GitHub Advanced Security is the path of least resistance if your entire workflow lives in GitHub and you're not on AWS.
• AWS Continuum wins if you're already deep in AWS, want IAM-aware findings (it can flag "this Lambda code assumes a role with * on S3"), and want the in-agent integration without configuration.

None of these are wrong choices. If you're a two-person team on AWS already using Claude Code, Continuum has the shortest path to "just works." If you're on Vercel and GitHub, GitHub Advanced Security is probably still your answer.

The MCP question: how does this fit with Model Context Protocol?

Anthropic's Model Context Protocol (MCP) is the standard way Claude Code talks to external tools. The Continuum integration almost certainly runs over MCP — that's how Claude Code integrates with everything else, from filesystems to databases to third-party APIs.

That's good news for portability. If Continuum is an MCP server (which the pattern strongly suggests), then in principle any MCP-compatible agent — not just Claude Code — can call it. It also means you can run it alongside other MCP tools in the same agent session:

{
  "mcpServers": {
    "aws-continuum": {
      "command": "npx",
      "args": ["-y", "@aws/continuum-mcp"],
      "env": {
        "AWS_PROFILE": "default",
        "CONTINUUM_POLICY": "strict"
      }
    },
    "postgres": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-postgres"]
    }
  }
}

You can read more about MCP on the official Model Context Protocol site. If you're already running Claude Code with a handful of MCP servers, adding Continuum is a config change, not a rearchitecture.

The Codex integration is a different story. OpenAI has its own tool-calling conventions, and while there's growing convergence, don't assume drop-in portability of your Continuum config between the two.

Practical setup: adding an in-loop scanner to your agentic workflow today

If you don't want to wait for the Continuum GA, or you're not on AWS, you can build the same pattern right now with existing tools. Here's a minimal working setup using Semgrep as the scanner and Claude Code as the agent:

# Install Semgrep
brew install semgrep

# Run a scan on the staged diff before every commit
cat > .git/hooks/pre-commit <<'EOF'
#!/bin/bash
set -e
CHANGED=$(git diff --cached --name-only --diff-filter=ACM | grep -E '\.(py|js|ts|go)
#39; || true)
if [ -n "$CHANGED" ]; then
  semgrep --config=auto --error $CHANGED
fi
EOF
chmod +x .git/hooks/pre-commit

This gets you 70% of the value: any code Claude Code writes has to pass Semgrep before it can be committed. The remaining 30% — the part Continuum is pitching — is having the scanner findings flow back into the agent's context so the agent fixes them itself, instead of you copy-pasting errors back into the chat.

You can approximate that today with a subagent pattern:

# Rough sketch of an in-loop review subagent
def review_and_fix(diff: str, main_agent) -> str:
    findings = run_semgrep(diff)
    if not findings:
        return diff
    
    fix_prompt = f"""
    Semgrep found these issues in your diff:
    {findings}
    
    Rewrite the diff to address every high-severity finding.
    Keep the original functionality identical.
    """
    return main_agent.regenerate(fix_prompt)

Wire that into a Claude Code hook or a subagent and you have most of what Continuum is promising, without the AWS lock-in. The tradeoff: you're maintaining it.

What to actually do about this if you're a small team

Concrete recommendations, ordered by leverage:

1. Turn on some kind of in-loop scanner this week. Whether it's Semgrep in a pre-commit hook, GitHub Advanced Security, or waiting for Continuum, the "no scanner at all on AI-generated code" position is not defensible past a small side project.
2. Don't rip out what works. If you have Snyk running and it's catching things, don't switch to Continuum just because it's new. Switching security tooling has a real cost and a real risk window.
3. Watch the MCP integration story carefully. If Continuum ships as an MCP server, it's low-commitment to try. If it requires deep AWS-specific plumbing, the switching cost goes up fast.
4. Assume your agent will write vulnerable code. Not because the models are bad — they're getting genuinely good — but because agentic coding produces volume, and volume produces edge cases. Design your review process on that assumption.
5. Log what your agent does. Whatever scanner you pick, make sure the findings and the agent's responses to them are logged somewhere you can audit. This is the single biggest ask from any compliance conversation you'll have.

The pattern here isn't unique to AWS. Cloudflare, Google, and Microsoft are all making similar moves: wrap the agentic coding stack in your existing security and infrastructure primitives, and let the model vendors compete on model quality. Expect more of these announcements through the rest of the year.

The honest limitations nobody in the announcement talks about

A few things worth being clear about:

• Scanners have false positives. In-loop scanning means false positives now interrupt your agent's flow, not just your CI log. Tuning matters more than before.
• Scanners miss things. Any SAST tool, Continuum included, will miss logic bugs, business-logic authorization flaws, and novel vulnerability classes. This is a floor, not a ceiling.
• Prompt injection is still your problem. If your agent is reading untrusted input — issue descriptions, user-submitted PRs, external docs via MCP — a code scanner doesn't help. That's a different threat model.
• Dependency risk isn't fully solved. A scanner can flag a known-vulnerable dependency version. It can't tell you that the maintainer of a package your agent just imported got compromised last week.

If you take one thing from the Continuum announcement, take this: the AI security tooling market is now competing on integration depth, not scanner accuracy. The winner will be whoever makes the safety layer invisible to the developer.

How BizFlowAI approaches this

We ship Claude Code and MCP integrations into production for solopreneurs and small teams, and the security-in-the-loop pattern is exactly the shape of workflow we build. Concretely, that means agents that call scanners, log every decision, respect IAM boundaries, and refuse to run destructive actions without explicit human approval — the same principles Continuum is now productizing at platform scale.

If you're evaluating whether an agentic coding or automation workflow can run safely against your actual codebase or ops stack — not a demo repo — a discovery call is the fastest way to get a straight answer. We'll tell you where an agent fits, where it doesn't, and what the review loop needs to look like before it touches anything real.

Work with BizFlowAI

If you'd rather have this built for you, that's what we do: production AI automation for solo founders and small teams — agents, integrations, and document pipelines that actually ship.

Book a free discovery call — 30 minutes, we map the highest-ROI automation in your workflow. No pitch deck, just engineering.

More guides like this on the BizFlowAI blog.