Skip to main content
bex.co
419

GLM security scan

Run a GLM security scan on your codebase.

Route GLM through Claude Code while Bex Security keeps scan scope, workflow policy, evidence validation, and final artifacts under one consistent contract.

Install and run a scanExplore Bex Security

Open source · Apache 2.0 · Report-only by default

GLM security scan
npm install --global @bex-co/bex-security
export ZAI_API_KEY="<your-zai-api-key>"
bex-security scan . --agent claude --provider zai --model glm-5.3
Claude CodeGLM 5.3Bex Security

GLM 5.3

Selected model

Claude Code

Agent runtime

Bex Security

Security orchestration

More than a prompt

What a GLM security scan actually does.

The model helps execute the work. Bex Security owns the repeatable process that turns exploration into reviewable security evidence.

  1. 01

    Scope the repository

    Define source boundaries and permissions before investigation begins.

  2. 02

    Discover attack paths

    Use GLM through Claude Code to investigate likely vulnerability paths.

  3. 03

    Validate evidence

    Challenge candidate findings and reject claims that lack support.

  4. 04

    Seal scan artifacts

    Preserve reviewable findings, evidence, and coverage as local artifacts.

The Bex layer

Use GLM without rebuilding your security process.

Provider and model choice should not force a different definition of a complete, validated scan.

Open agent boundary

Claude Code runs behind the ACP adapter while Bex remains the workflow host.

Stable scan contract

Scope, permissions, schemas, workbench tools, and artifact rules stay consistent.

Scoped credentials

Z.AI configuration applies only to the Claude ACP subprocess; Bex does not store the API key.

Quick setup

How to run a GLM security scan.

Install Bex Security from npm, install Claude Code, provide a Z.AI API key, and select the Z.AI provider explicitly.

1

Install Bex Security and Claude Code

Install @bex-co/bex-security from npm and make sure the Claude Code binary is available on PATH.

2

Provide a scoped Z.AI key

Export ZAI_API_KEY in the current shell. Bex forwards it only to the Claude ACP subprocess and does not store it.

3

Choose the GLM model

Pass --model glm-5.3 for explicit selection, then point the scan at the repository you want to inspect.

Alpha integration. The Claude Code ACP path is available for early use and is still being hardened with full-scan fixtures and interruption tests.

Frequently asked questions

Does a GLM security scan run through Claude Code?

Yes. Bex starts Claude Code through its ACP adapter and applies the Z.AI provider configuration only to that subprocess while Bex owns scan scope and validation.

Which GLM model does Bex Security use?

The Z.AI provider currently defaults to glm-5.3[1m]. Pass --model glm-5.3 when you want the explicit standard GLM 5.3 selection shown in this guide.

Does Bex Security store my Z.AI API key?

No. ZAI_API_KEY is passed to the current Claude ACP subprocess and is not written into Claude Code settings or Bex credential storage.

Explore other AI security scans

Make GLM security scanning easier to trust.

Star Bex Security if you want portable security workflows that can follow the agent and model best suited to each repository.

Star Bex Security

One workflow · Open agent layer · Validated evidence