lagune0.16.0
🪼 Your security copilot as you build, your Blue Team when you audit, whether you're a developer or not.
Untested on omp
This is a pi package. No one has reported whether it works on omp yet. If you try it, add your result below.
Reports 0
No reports yet.
Readme
🪼 Lagune AI
Lagune helps your AI agent make a project more secure. You point it at your code, and the agent figures out what your system actually does, then guides you through the security work that matters for it.
- Lagune works with projects in any programming language ✨
- Lagune adapts to your environment, whether it is a new project or an existing project.
[!NOTE]
Love Lagune? Give us a ⭐ on GitHub! It helps more people discover the project.
Get Started
Install and Update
Pick your agent:
| Install | Update |
|---|---|
 |
|
|
|
|
|
|
|
 |
|
|
|
[!NOTE]
- See the Install section for detailed instructions.
- Migrate from previous Lagune manifest-based setup.
Skills
Once installed, your AI agent unlocks a set of commands, all governed by the charter: secure new work as you build it, or run the full audit over a project.
[!TIP]
See real-world Prompt Samples 🪼
› Build
Harden the work as you write it, with no flow to follow:
| Skill | What it does for you |
|---|---|
| /lagune-charter | Sets your project's security rules, the foundation /lagune builds against |
| /lagune (Universal) | Builds what you ask and hardens it as it is written, guided by the charter |
› Audit: the Blue Team flow
These five run in order. Each builds on the previous, so following the list top to bottom is all it takes:
| # | Skill | What it does for you |
|---|---|---|
| 1 | /lagune-charter | Sets your project's security rules, proposed for you or shaped by what you say |
| 2 | /lagune-detect | Reads your code and maps what your system does and where the risks are |
| 3 | /lagune-plan | Turns what detect found into a defense plan, with a fix for each finding |
| 4 | /lagune-harden | Applies the plan's fixes to your code, safely and one at a time |
| 5 | /lagune-verify | Proves each applied fix holds and closes out the ones that do |
› Special skills
| Skill | What it does |
|---|---|
| /lagune-specialize | Teaches Lagune a new security specialization from articles, exploits, or topics |
| /lagune-prove | Turns each detected finding into a runnable, defense-only proof for responsible disclosure |
[!TIP]
Security is not a cost, it is an investment: what you put in upfront, you save many times over in the incidents you never have 🙋🏻♂️
[!NOTE]
Some agents take the commands under the plugin's name, such as
/lagune:lagune-charter. Your agent's install page shows how to type them.
[!IMPORTANT]
See the full documentation for usage examples and more.
Dashboard
For an interactive live view of .lagune/, run:
npx lagune
It serves a dashboard and opens it on a random port:
- Live Reload
- Private and Local
- Follow the findings, fixes, and verdicts, and manage the categories, directly from your browser
- No
node_modulesorpackage.jsonis needed 📦
Overview
[!TIP]
- 🚪 Use
--portto specify a custom port.- ⏏️ Press
Ctrl+Cto stop.
Requirements
You will need Node.js (LTS) installed on your system.
Security
To report a vulnerability and see the supported versions, check the Security Policy.
Contributing
See the Contributing Guide and please follow our Code of Conduct 🚀
Acknowledgements
Partners
Partners get an exclusive logo across the repositories and landing pages, plus a spot on a dedicated partners page.
Help my work grow by becoming a partner 🖖
Supporters
Really thanks to everyone who has supported and keeps supporting my work.
Support my work by becoming a sponsor too ✨
License
Lagune is under the Apache License 2.0.
Copyright © 2026-present Weslley Araújo and contributors.
All product names, trademarks, and registered trademarks mentioned are the property of their respective owners and are used for identification purposes only.