security-scan

To scan Claude Code configurations for security vulnerabilities, you use AgentShield to audit files like CLAUDE.md, settings.json, and mcp.json for hardcoded secrets, risky permissions, and prompt injection risks. Run the scan from your project root to generate a security report.

AgentShield is used to detect security misconfigurations and prompt injection vectors in Claude Code projects. It checks configuration files, MCP servers, hooks, and agent definitions to ensure your setup follows security hygiene best practices before deployment.

You do not need to install AgentShield globally to audit MCP configs; you can run it on demand using npx ecc-agentshield scan. Alternatively, installing it globally via npm install -g ecc-agentshield allows you to execute security scans directly from the project root.

Available report formats for Claude Code security scans include terminal, json, markdown, and html outputs. These formats allow you to integrate security audit results into your CI/CD pipeline or review them directly in your project repository.

You should perform a security hygiene check on your Claude Code setup during project onboarding, after modifying CLAUDE.md or settings.json, and periodically across repositories. This prevents vulnerabilities from persisting in your MCP servers, hooks, and agent definitions.