security-scan

To scan Claude Code configuration files for security vulnerabilities, audit the .claude directory to analyze CLAUDE.md, settings.json, and MCP server configs. This process detects hardcoded secrets, prompt injection patterns, and overly permissive access controls, assigning a severity grade from A to F with remediation guidance.

A prompt injection risk in Claude Code agent definitions occurs when malicious instructions manipulate agent behavior. Configuration auditing detects these injection patterns alongside hardcoded secrets and misconfigurations in agent files, preventing unauthorized system access and potential data breaches in your development environment.

Yes, you can audit MCP server configs and hooks for overly permissive access controls. The security scan analyzes these configuration files to identify unrestricted Bash access rules and misconfigurations, providing actionable severity grading to secure your Claude Code development environment.

You should run a security audit on your Claude Code development environment during pre-commit configuration reviews, new project onboarding, and periodic security hygiene checks. This catches hardcoded API keys and unrestricted access rules before pushing configurations to a shared repository.

No, the Claude Code config audit requires no external dependencies or components. It leverages AgentShield internally to analyze configuration directories and evaluate security risks, making it straightforward to run without additional environment setup.