Important
To install Lagune, follow the website instructions.
Lagune helps your AI agent make a project more secure. You point it at your code, and the agent figures out what your system actually does, then guides you through the security work that matters for it.
- Lagune works with projects in any programming language ✨
Love Lagune? Give us a ⭐ on GitHub!
Lagune adapts to your environment, whether it is a new project or an existing one.
Tip
See real-world Prompt Samples 🪼
Install Lagune's commands into your agent with the skills.sh:
npx skills add wellwelwel/laguneOr paste this prompt into your agent:
Run `npx --yes skills add wellwelwel/lagune` and follow the generated skill instructions now. Read its complete output, redirecting it to a temporary file first if necessary. Resolve relative paths from the supporting-files directory it provides.- 🃏 Lagune runs on Node.js under the hood, you use whatever language you want.
npx skills updateTip
Your charter, the phase artifacts, the tracking, and your own specializations live in .lagune/ and stay untouched.
/lagune.charter records the categories your project needs. Change them anytime:
npx lagune add --categories javascript
npx lagune remove --categories javascriptNote
A project set up by the Lagune CLI (npx lagune init) keeps working as it is. To move it, see Migrate.
Once Lagune's commands are installed, your AI agent unlocks a set of slash commands:
Harden the work as you build it, guided by the charter, with no flow to follow:
| Command | What it does for you |
|---|---|
| /lagune | Enforces security along with your development, on any prompt, at any time |
- Pull in the on-demand specializations in real time while your agent works.
- Combine it with the /lagune.charter command to shape every build around your project's own security rules.
These five run in order. Each builds on the previous, so following the list top to bottom is all it takes:
| # | Command | What it does for you |
|---|---|---|
| 1 | /lagune.charter | Sets your project's security rules, proposed for you or shaped by what you say |
| 2 | /lagune.detect | Reads your code and maps what your system does and where the risks are |
| 3 | /lagune.plan | Turns what detect found into a defense plan, with a fix for each finding |
| 4 | /lagune.harden | Applies the plan's fixes to your code, safely and one at a time |
| 5 | /lagune.verify | Proves each applied fix holds and closes out the ones that do |
| Command | What it does |
|---|---|
| /lagune.specialize | Teaches Lagune a new security specialization from articles, exploits, or topics |
| /lagune.prove | Turns each detected finding into a runnable proof for responsible disclosure |
Tip
Security is not a cost, it is an investment: what you put in upfront, you save many times over in the incidents you never have 🙋🏻♂️
Important
See the full documentation for usage examples and more.
For an interactive live view and follow-up, run:
npx laguneIt serves a dashboard and opens it in a random port:
- Live Reload
- Private and Local
- Follow the findings, fixes, and verdicts, and manage the specialization categories, directly from your browser
- No
node_modulesorpackage.jsonis needed 📦
Overview
Tip
- 🚪 Use
--portto specify a custom port. ⏏️ PressCtrl+Cto stop.
You will need Node.js (LTS) installed on your system.
To details, report a vulnerability, and see the supported versions, see the Security Policy.
See the Contributing Guide and please follow our Code of Conduct 🚀
Partners get an exclusive logo across the repositories and landing pages, plus a spot on a dedicated partners page.
Help my work grow by becoming a partner 🖖
Really thanks to everyone who has supported and keeps supporting my work.
Support my work by becoming a sponsor too ✨
Lagune is under the Apache License 2.0.
Copyright © 2026-present Weslley Araújo and contributors.