security-scan

To scan Claude Code configurations for security issues, run npx ecc-agentshield scan from your project root. This audits CLAUDE.md, settings.json, and mcp.json to identify hardcoded secrets, risky permissions, and prompt-injection patterns.

Security risks in Claude Code agents and MCP settings include prompt-injection patterns in CLAUDE.md, hardcoded secrets, and risky permissions or exposure in settings.json, mcp.json, hooks, and agent definitions. AgentShield detects these misconfigurations during audits.

You can integrate Claude Code security audits into CI/CD pipelines by configuring AgentShield scan outputs. The tool supports terminal, JSON, Markdown, and HTML report formats, enabling automated pre-commit checks and continuous configuration enforcement.

AgentShield requires Node.js to audit Claude Code projects. You must install the tooling via npx ecc-agentshield or npm install -g ecc-agentshield before scanning project configurations for misconfigurations and security vulnerabilities.

AgentShield offers an optional auto-fix feature to remediate security misconfigurations in Claude Code settings. Alongside generating JSON, Markdown, or HTML audit reports, it can automatically correct risky permissions and exposure found during the scan.

You should run a security audit on your Claude Code project during initial project setup, as part of ongoing maintenance, and during pre-commit checks. This ensures continuous enforcement of secure configurations and early detection of prompt risks.