security-scan

To scan Claude Code configurations for security vulnerabilities, apply this tool to the .claude directory to inspect CLAUDE.md, settings.json, mcp.json, hooks, and agent files for hardcoded secrets, unsafe allow lists, and prompt injection patterns. It generates graded vulnerability reports with remediation suggestions.

Yes, you can integrate a Claude Code security scan into CI pipelines or pre-commit checks by outputting vulnerability reports in JSON, Markdown, HTML, or terminal formats. These graded outputs allow automated security gates to block unsafe configurations before they reach production.

An MCP server configuration audit detects hardcoded secrets, risky MCP servers, unsafe allow lists, and prompt injection patterns within Claude Code settings. It inspects settings.json, mcp.json, hooks, and agent definitions to identify injection surfaces and risky defaults before runtime execution.

Yes, the security scan supports optional auto-fixes for Claude Code settings and agent files via the ecc-agentshield integration. After detecting vulnerabilities and misconfigurations, it highlights auto-fixable changes and applies remediations to secure your project configuration.

Adversarial multi-agent analysis for prompt injection detection is an optional red-team pipeline using attacker, defender, and auditor agents to deeply analyze Claude Code configurations. When API keys are provided, it simulates attacks to uncover complex injection surfaces that standard scanning might miss.

A limitation when scanning Claude Code hooks and agent files is that the optional adversarial multi-agent red-team analysis requires providing API keys to function. Standard scanning covers configuration files, but deeper prompt injection detection depends on external API access.