security-scan

To scan Claude Code configurations for security vulnerabilities, use AgentShield to audit the .claude directory. It checks CLAUDE.md, settings.json, mcp.json, and hooks to identify secrets exposure, prompt injection vectors, and unsafe automations.

Security risks in CLAUDE.md changes include secrets exposure, prompt injection vectors, and insecure agent definitions. Running a configuration audit flags these issues with severity grading and provides remediation guidance to establish a secure baseline.

Yes, you need AgentShield installed to audit Claude Code settings. You can install it globally via npm install -g ecc-agentshield or run it directly using npx ecc-agentshield scan to produce a structured risk report.

You can automatically fix insecure Claude Code agent definitions and high-risk servers when safe, automated fixes are available. AgentShield supports auto-fix readiness to remediate flagged vulnerabilities during your configuration audit.

Run a security audit when applying new Claude Code projects, making changes to CLAUDE.md or settings.json, and during periodic repository hygiene checks across teams. This ensures a secure baseline before committing configuration changes.

A Claude Code configuration risk report includes severity grading for identified vulnerabilities, targeted risk assessment for high-risk servers, and remediation guidance. It checks mcp.json, hooks, and settings for misconfigurations and injection risks.