Lagune plugin
Lagune builds security into the agent workflow: a project charter, hardening as code is written, an audit chain to verification
- 215 ★ on the repository
- Last commit
- Apache-2.0
Extended access
Why this level
- The `/lagune-harden` skill edits project files from the defense plan, and the audit reads all source code
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add plugins/laguneDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- The `/lagune-harden` skill edits project files from the defense plan, and the audit reads all source code
This is third-party code. Review the repository files before installing.
What it does
Lagune is a plugin for Claude Code, Codex and about a dozen other agents that makes security part of development. The `/lagune-charter` skill sets the project security rules everything else builds on. The `/lagune` skill builds what you ask and hardens the code against the charter as it goes, for example for a profile photo upload or a form logic fix. An audit has five ordered steps called the Blue Team flow. `/lagune-detect` reads the code and maps what the system does and where the weak points are. `/lagune-plan` turns findings into a defense plan with a fix for each. `/lagune-harden` applies the fixes one at a time and `/lagune-verify` proves each one holds and closes the confirmed ones. The steps can go to sub-agents in a loop until every finding is closed. The `/lagune-specialize` skill teaches the plugin a new specialization from articles or topics. The author says no API key is needed.
Who it is for. Developers and small teams without a dedicated security specialist who want the agent to protect code as it works and run a stepwise audit.
Good fit when
- A new feature accepts files or user input and the code should be hardened as it is written
- A project heads to production with no written security rules, so start with `/lagune-charter`
- You want an audit: a system map, a defense plan, applied fixes and a check of each one
- You run several agents and want the same protection in all of them: Claude Code, Codex, Gemini CLI and others
Not a fit when
- You want a dependency scanner or a static analyzer with guaranteed coverage: Lagune works through the agent
- You need an opinion for certification or legal compliance: a person reviews the audit result
- You want offensive testing of other people's systems: the set is built for defense
Example request
Run /lagune-charter for this project, then audit it step by step through detect, plan, harden and verifyLimitations
- Audit quality depends on the model and project context: people verify findings and fixes, and `/lagune-verify` confirms fixes only within what the agent can do.
- `/lagune-harden` changes project files, so run it on a branch with a clean git state.
- Cursor, Gemini CLI, GitHub Copilot, OpenCode and other agents have separate install routes on the project site, and steps differ.
- An earlier manifest-based install must be moved with the migration command described in the docs.
How to disable. In Claude Code open `/plugin`, pick Manage plugins and remove `lagune`. In Codex remove the plugin with the plugin manager command. Project charter files are deleted by hand.
FAQ
How do I install Lagune in Claude Code?
Run `claude plugin install lagune --marketplace wellwelwel/lagune`. In the extension open `/plugin`, add `wellwelwel/lagune` on the Marketplaces tab and install `lagune`.
What is the charter?
A file of project security rules that `/lagune-charter` creates from the plugin proposal or from your words. Every other skill builds on it.
In what order does the audit run?
Five steps: `/lagune-charter`, `/lagune-detect`, `/lagune-plan`, `/lagune-harden`, `/lagune-verify`. Each builds on the previous one.
Is an API key needed?
No, per the project badge and statement no extra key is required: your agent model does the work.
Which agents are supported?
Claude Code, Codex, Cursor, Gemini CLI, GitHub Copilot, OpenCode, Hermes Agent, Antigravity CLI, Factory Droid, Kimi Code, Qwen Code and more. The site has a guide for each.
Discussion
No questions or reviews yet.
Related
PluginsA code security plugin: finds vulnerabilities, challenges its findings, proves exploitability and fixes with a verified patch
A marketplace of 22 hook plugins for Claude Code: safety, cost control, observability and automation
A local security gateway for Claude Code and Codex: checks tool calls against a policy, catches secrets and keeps an audit trail
Security hook for coding agents: scores each tool call with session context and flags injections in results and skills
A Claude Code plugin that classifies each tool call and the agent's reasoning, then blocks risky ones or asks you first.
A plugin and approval server for Claude Code and Codex: a risky tool call waits for your decision before it runs
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| Lagune (this card) | no | 215 | |
| security-audit | no | 71,520 | a one-off security audit, while this adds a charter, hardening during coding and a fix-and-verify chain |
| Vibe Security | no | 1,231 | a quick-build checklist, while this has a five-step audit and specializations |
README in short
The README shows installation for Claude Code, Codex and a dozen other agents, then lists skills by group: the first step with the charter, universal building with protection, the five Blue Team audit steps and special skills. Each comes with example prompts.