The launch gate for AI-built apps.

Point LyraShield at a repository, URL or API you are authorized to test. It reviews what your coding agents shipped and returns one verdict: ready, not ready or insufficient evidence.

Every finding shows its evidence
Fixes are proposals you approve
A fresh retest checks each fix.

Start free trial See a sample Lite result

7 days · 60 agent-minutes · 3 targets · no card

Set up LyraShield in your coding agent →

Open beta · Security review for AI-built apps. Evidence is limited to the authorized scope and the checks that ran. No security guarantee.

Sample verdict card

Verdict · Insufficient evidence

Detected Server credential referenced by client build
Detected Missing rate limit on login route Example EX-014 · followed in the evidence journey

Target scope: Authorized example route
Evidence coverage: Partial · retest pending

7 controls need your evidence

Evidence: bounded to the checks that ran

A verdict that shows its work.

Four things stay visible so you can defend the decision to ship.

Three evidence states, never blended

Detected, retest-confirmed and inconclusive stay separate on every finding.

Read the definitions

Missing evidence stays visible

If a check did not run or cannot prove a fix, the verdict says insufficient evidence instead of rounding up to a pass.

You approve every fix

Fixes arrive as proposals. Nothing auto-merges. A connected coding agent acts only inside a grant you confirm in the browser.

A fresh server-run retest checks the change

The retest runs server-side from a clean baseline, so the conversation that wrote the patch never grades its own work. It confirms a fix only for a finding a deterministic scanner raised; one the model engine alone raised ends inconclusive.

Works alongside the scanners you already run. LyraShield adds evidence states, fix proposals and retests.

Review your AI-built app Start with the free Lite Check, then run your first review from a free trial.Review client releases Walk through the evidence and handoff workflow with the founder.

Passive and read-only

Understand your Lite Check result.

The free Lite Check above reviews exposed secrets, browser protections, frontend data-layer signals and HTTPS at the public URL you authorize. Here is how to read its results.

For checks that never leave your browser, use the WebMCP Security Checker or other browser-local tools.

What it covers / what it cannot prove

What a result looks likeSample values · your result depends on your app

Security headers3 missingNo Content-Security-Policy, no HSTS, no X-Content-Type-Options.
Frontend data-layer signals1 to reviewA client bundle references a key-shaped string. Worth a look before launch.
HTTPS and redirectsCleanValid certificate, HTTP redirects to HTTPS.
CORS policyNot applicableNo cross-origin API surface was reachable from the public page.

A passive check reads what your app already exposes publicly. It can show you what is missing; it cannot prove that nothing is wrong. The deeper questions — auth flows, logic and whether a fix actually held — need the full loop. What the Lite Check covers and what it cannot prove

From target to verdict.

One finding, followed through the loop.

Skip to the product preview

One reviewable record of what you checked, fixed and retested before you ship.

AI builds fast. LyraShield keeps what you checked, how you checked it and what changed after in one reviewable record instead of scattered chats and manual checks.

Example EX-014 · Authorized scope is stated

Start with the surface you need to ship.

Review a repository, public URL or API. Use a passive Lite Check for a quick public-surface read or create an account for the full evidence loop.

Repository, URL and API targets
GitHub and coding-agent workflows
Approval-gated fixes and fresh retests

Choose what you are actually shipping.

Name your repo, live URL or API before anything runs. Nothing is tested outside the boundary you explicitly approve.

Example EX-014 · Target identity stays on record

Run checks that do not blur together.

Deterministic checks find known signals. AI-assisted review examines logic, auth flows and data handling. Separate coverage layers show what kind of evidence you actually have.

Example EX-014 · The checks that ran are recorded

Coverage stays explicit, including what needs human evidence.

The control ledger separates 43 code or URL review controls from 7 evidence-required controls. Unmatched or unsupported checks remain inconclusive, never silently passed.

43 review controls · 7 evidence-required

Keep "we saw it" separate from "we proved it".

Detected, retest-confirmed and inconclusive remain distinct. Missing proof stays visible; it never becomes a silent pass.

Detected
Retest-confirmed
Inconclusive

Example EX-014 · Detected is distinct from proven

Every conclusion carries its basis and its limit.

See which check produced the signal, whether independent proof exists and whether a fresh retest confirmed the change. Shared records omit repository coordinates and raw secrets.

Finding and evidence state
Control-level coverage receipt
Retest outcome and stated limitations

Get a fix proposal you review. Nothing auto-merges.

Review a plain-English explanation and staged patch proposal. PR execution stays blocked until a server-generated patch is bound to your exact approval.

Example EX-014 · A proposal still needs approval

Bring the review loop into your coding agent.

Use the hosted MCP server and supported agent integrations to inspect results and prepare approval-gated remediation without copying findings between tools.

OAuth-first agent connections
GitHub-aware review context
No automatic merge or silent write

Confirm with a fresh check, not the same conversation.

A fresh, server-owned scan checks the fix. Complete deterministic coverage can confirm it; engine-only absence stays inconclusive.

Example EX-014 · Missing coverage stays inconclusive

Ship one report that shows its limits too.

Scope, coverage, findings, fixes, retest outcomes and limits become one checksum-bound launch report: a private snapshot written once per scan and report type, bound to a recorded sha256 manifest checksum. Shared versions exclude repository coordinates and raw secrets.

Example EX-014 · Scope and limitations travel with the report

Turn the next release into evidence your team can review.

Create a workspace, add the target you are shipping and choose the depth of review. LyraShield keeps the resulting scope, evidence and retest outcome together.

Start free trial Read the definitions

Explore the current evidence console.

From the next decision to the recorded review. Choose a view to see how the workflow fits together.

LyraShield dashboard showing one next action, authorized target scope, partial coverage and an insufficient evidence state. Private review identity is redacted. — Know what needs your attention.
Start with one next action. Keep assessed scope, incomplete coverage and the current evidence state in view.

A current finding detail panel with Critical severity, Open status, Inconclusive evidence and actions to review evidence or create a fix proposal. The private finding title is redacted. — Review the evidence before proposing a fix.
Severity, status and evidence state stay separate. The next step leads to retained evidence and an approval-gated fix proposal.

A completed, sealed scan record showing its duration, retained findings, a zero-count reserved verification column, coverage state and Create an assurance report action. The target name is redacted. — Turn a recorded review into an assurance report.
Keep scan completion, findings and coverage distinct when packaging the recorded scope for your team.

Current Launch Readiness view showing insufficient current evidence, a review-findings action and a triage score explicitly labeled as separate from readiness. — Keep missing evidence visible at release time.
Readiness explains the evidence limits. Triage helps prioritize open findings without becoming a launch verdict.

Current Coding Agents view with search, setup methods and Devin, GitHub Copilot and Cline installation cards, each with Set up, Docs and expandable setup details. — Connect the coding agent you already use.
Find your client, choose its setup method and open the installation guidance. Technical setup details stay available when you need them.

Actual dashboard captures from the demo workspace, supplied on October 9, 2026. Private identities and finding details are redacted. Counts and evidence states describe the captured example.

Use it where you already work.

The console keeps scope, coverage, findings and their evidence states, fix proposals and fresh retest outcomes together, so the release decision is reviewable rather than reconstructed.

Start a local workspace session from the command line.

npx --yes lyrashield@0.2.14 login --oauth

The installer pins the client version, so the command above is the one this site is built against.

50 launch controls, 7 of which need proof only you can give.

43 are reviewed from code or a URL. The other 7 describe how you operate: audit coverage, monitoring, restore proof, deployment egress, test independence, multi-agent trust and accountable review. Those live in the Operational Evidence Vault.

Coverage version vibe-security-50/1.2.0. A clean result does not prove an application has no vulnerabilities.

LyraShield covers

Repository, URL and API reviews, agent-tool surfaces and an operational evidence record.

Scanners you already run

Dependency and secrets scanning in depth. LyraShield adds evidence states, fix proposals and retests rather than replacing them.

No tool can prove

That an application has no vulnerabilities.

Vibe Security 50 Evidence Vault

Cloud plans

Choose by review depth and capacity

Start with a free trial: 7 days · 60 agent-minutes · 3 targets · no card. Paid plans bill monthly or annually; regional prices and full limits are on pricing.

Starter

$29.00/mo

$295.00/yr210 agent-minutes/month ⓘup to 5 targets

For solo builders reviewing up to five targets with standard scans.

Safe, Quick and Standard scans.

Choose Starter

Pro

$99.00/mo

$950.00/yr850 agent-minutes/month ⓘup to 15 targets

For solo builders who need Deep and Custom scans across up to 15 targets.

Deep and Custom scans included.

Choose Pro

Agency

$499.00/mo

$4,188.00/yr4,500 agent-minutes/month ⓘup to 50 targets

For a team of up to five sharing one minute pool across up to 50 targets.

Deep and Custom scans included.

Choose Agency

Enterprise is contact-led from $1,500.00/month. Talk to us about custom limits and a contact-led rollout.

Questions

What happens after I create an account?

Create a workspace, add an authorized repository, public URL or API target, then choose the review depth. LyraShield keeps the resulting scope, findings, evidence states, fix proposals and fresh retest outcomes in one launch report.

What does a LyraShield result actually prove?

Only what the retained evidence supports. We keep detected findings, retest-confirmed fixes, inconclusive retests and checks that were limited or not applicable distinct. Missing proof stays visible.

Does LyraShield automatically fix my code?

No. LyraShield records fix proposals and can stage a server-generated patch. Fix PRs open only after a human approves, with a server-generated patch. A connected OAuth agent may run only the operations authorized by its browser-confirmed grant, with checks at execution. Nothing auto-merges.

Is this a replacement for my other security scanners?

No. LyraShield complements specialist scanners rather than replacing them: SCA, secrets scanning, dependency checks and repo review are coverage layers inside a wider launch-gate workflow that adds evidence states, fix proposals and retests. Specialist tools may still provide deeper coverage in their own category.

What is the Operational Evidence Vault?

It is a private workspace where you collect, review and version proof for the seven Vibe Security 50 controls that cannot be established by a repository or URL scan: audit trails, monitoring, backup tests, sandboxing, test independence, multi-agent trust and accountable review. Accepted evidence is frozen into a checksum-bound private assurance report; public shared reports do not include it.

What is live today and what is on the roadmap?

Live today: the free Lite Check, 7 browser-local tools, the full launch-gate platform in open beta, the Operational Evidence Vault, MCP and GitHub integrations, a published CLI and a GitHub Action with a diff-aware gate and SARIF output. Registration is open; product pages describe current coverage and limits. Cloud prices and full limits are listed on /pricing.

Do you store my codebase?

Scans run in hardened, short-lived environments. The full platform retains scope, receipts, findings and evidence states, not a copy of your source. Shared reports exclude repository coordinates, file paths and raw secrets.

How is the Lite Check different from the full review?

The Lite Check passively reads an authorized public URL for a bounded set of surface signals. The full platform can review repositories, URLs and APIs, retain control-level evidence, stage fix proposals, run fresh retests and produce a shareable launch report.

Target → review → evidence → retest

Get a verdict on your first app.

Create a workspace, add a target and choose the review depth. Nothing auto-merges and missing evidence stays visible.

Create workspace
→
Add target
→
Choose review

Start free trial

Book a demo with the founder for a walkthrough.

Prefer to work from your coding agent? View agent setup