Claude Code MCP Agent Rules Security Setup

Fastest path: run npx lyrashield init, which detects Claude Code and writes the config. For a one-step install, use the Agent Plugin (agent-plugins.org v1.0.0), the preferred route for launch clients. The manual config below is what the CLI writes, kept for reference.

Claude Code users can secure AI built apps by adding LyraShield MCP via stdio using npx -y @lyrashield/mcp or remote endpoint with a Bearer lsk_ key, registering it in .mcp.json with project scope, verifying the connection in Claude Code, then running inline security checks and a GitHub diff gate for team review.

Claude Code generates hundreds of lines per prompt, magnifying OWASP Top 10 risks like injection and broken access control. Adding LyraShield brings verification, aligned with vibe coding security guide. LyraShield is agent native AppSec at LyraShield site, built as Target to Scan to Evidence State to Fix Proposal to Retest to Assurance Report. Setup in Claude Code integration guide and checklist Claude Code security workflow. Transport uses Model Context Protocol and GitHub Actions plus NIST SSDF. Findings retain their recorded evidence states; independent verification requires a separate receipt. Current LyraShield tools record fix proposals and queue retests but do not edit code, create branches, or open pull requests.

1. Prerequisites and api key setup

Create LyraShield API key starting with lsk_ and store as LYRASHIELD_API_KEY. Never commit key to source control or chat logs. For local work, export it in shell profile. For teams, keep it in secret manager and add to GitHub repository secrets for CI parity. Naming consistency between shell, IDE config and CI reduces misconfig.

You need Node 18 plus so npx resolves pinned package, claude-code updated to build supporting MCP, and testable target such as http://localhost:3000 or repo root. LyraShield MCP supports stdio via npx -y @lyrashield/mcp and remote HTTP at remote MCP endpoint using Bearer lsk_ key. Stdio keeps traffic local, remote enables central policy.

Review CWE Top 25 and OWASP Top 10 to map checks to weaknesses your team tracks, and NIST SSDF for secure build. LyraShield v1 is designed to cover agentic pentest plus SCA and secrets with SARIF output. Fix proposals record intended remediation for human review, not hands off merges, after Sprints 0 to 2 shipped MCP contract. See Claude Code integration guide.

2. Configure MCP server in claude-code config file

claude-code reads MCP from .mcp.json. Top level key is mcpServers. Include stdio and remote to switch without code edits. Use pinned npx -y @lyrashield/mcp for stdio.

{
  "mcpServers": {
    "lyrashield": {
      "command": "npx",
      "args": ["-y", "@lyrashield/mcp"],
      "env": {
        "LYRASHIELD_API_KEY": "${LYRASHIELD_API_KEY}"
      }
    },
    "lyrashield-remote": {
      "url": "https://app.lyrashieldai.com/api/mcp",
      "headers": {
        "Authorization": "Bearer ${LYRASHIELD_API_KEY}"
      }
    }
  }
}

claude mcp add lyrashield -- npx -y @lyrashield/mcp
claude mcp add lyrashield-remote --transport http --url https://app.lyrashieldai.com/api/mcp

Placeholder ${LYRASHIELD_API_KEY} is resolved securely without writing secret to disk. Remote validates Bearer lsk_ at remote MCP endpoint. Do not commit real values, commit placeholder only and document setup in Claude Code integration guide onboarding. For multiple projects, keep personal keys in global config and team policy in project file. See Model Context Protocol and GitHub Actions for parity.

3. Verify the connection inside claude-code

Restart claude-code after saving config and open MCP servers view to confirm lyrashield shows connected with tools. In chat ask to list MCP tools to see scan tool. This confirms handshake completed.

If disconnected, open log panel. For 401 from remote MCP endpoint reissue key. For npx not found or EACCES fix Node PATH or install via nvm user space. Run npx -y @lyrashield/mcp manually in terminal with LYRASHIELD_API_KEY set to confirm handshake JSON prints. This isolates IDE versus Node issues.

Verification prevents silent failure where agent assumes scan succeeded but server was unreachable. That leaves OWASP Top 10 risks undetected and breaks verification loop. Allow egress to remote MCP endpoint if org blocks external.

4. Run a security check inline while you code

With MCP connected, prompt agent to scan current target before committing. Example prompt is scan target http://localhost:3000 for injection and secrets using LyraShield and return findings with recorded evidence states only with file paths and CWE.

Agent calls MCP tool and returns file, line, evidence snippet or reproduction notes, and remediation pointers that reference OWASP Top 10. For injection it shows untrusted input flowing into query without validation. For secrets it shows detected key pattern in source. For supply chain it maps lock entries against OSV database.

Use lyrashield_record_fix_proposal to record the intended remediation. After a developer applies the change, call lyrashield_verify_fix to queue a retest, then poll lyrashield_get_scan_status. A clean deterministic retest may be retest-confirmed; independent verification still requires a separate verification receipt.

Check type	What to scan	How to fix
Injection	API routes concatenating user input into queries	Parameterize queries, validate with schema, enforce allow lists at boundary
Secrets	Env example containing real keys, tokens in source	Remove secret, rotate credential, add precommit scan, use secret manager
Auth	Missing role check on sensitive routes, permissive CORS	Add auth middleware, test unauthenticated request, set secure cookie flags
Supply chain	Vulnerable npm packages with CVE in lockfile	Update lockfile, pin safe version, check OSV database advisory, limit scripts

Use table as prompt template for consistent scans. Reference Claude Code security workflow for deeper checklist.

5. Wire the GitHub Action diff aware gate

Local checks improve speed, but team assurance needs CI gate scanning changed files on pull requests and publishing SARIF for triage. LyraShield provides GitHub Action that runs diff aware scan and uploads SARIF. Uses GitHub Actions and aligns with OWASP Top 10 pipeline guidance.

name: LyraShield Security Gate
on:
  pull_request:
    branches: [main]
jobs:
  security:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
      pull-requests: write
    steps:
      - name: Run LyraShield diff scan
        uses: ecryptoguru/lyrashield-ai@v2
        with:
          fail_on_severity: HIGH

The runner-local Action needs no LyraShield API key. It emits and uploads SARIF, but it does not edit code, record a fix proposal, or create a branch.

6. Add agent rules for continuous guardrails

claude-code supports project rules that agent reads each task, baking security into definition of done without relying on memory. Add rule forcing LyraShield scan before marking feature complete, covering user input, auth, file upload, secrets or external fetch, and include retest.

Location varies. Cursor uses .cursor/rules/security.mdc with globs, Claude Code uses CLAUDE.md, Windsurf uses .windsurf/rules/security.md, VS Code uses .github/copilot-instructions.md, JetBrains uses .jetbrains/ai-assistant/rules/security.md. Choose location traveling with repo so new clones get same expectation.

# Security guardrail

For any task involving user input, auth, file upload or secrets:

1. Call LyraShield MCP scan on target .
2. List findings with their recorded evidence states, file and CWE
3. Propose remediation with code edit
4. Ensure .env.example has placeholders only
5. Retest via LyraShield after fix

Test rule by scaffolding endpoint accepting query param and confirming scan triggers without reminder. If agent skips, make rule more directive and place file where agent reads on startup. Keep rule short and committed. Pair with Claude Code security workflow and CWE Top 25 for taxonomy.

Why pair claude-code with LyraShield

Claude-Code speeds AI development but can repeat patterns OWASP Top 10 warns about such as trusting generated SQL or leaving debug endpoints enabled. LyraShield adds verification without changing UX, exposing scan and findings as native tools agent knows how to call.

The current product ships MCP, bounded scans, findings and evidence, approval-gated fix proposals, retests, reports, SCA, secrets, and the runner-local SARIF gate. The local Action is advisory and does not create hosted evidence states; use a recorded scan and retest when assurance evidence is required. Advisory dependency matches use OSV data and still require resolved-version review.

Local feedback plus CI gate creates defense in depth matching how AI apps evolve. For policy framing revisit vibe coding security guide and NIST SSDF.

Close loop by tracking findings as tasks, rerunning scans after fixes to confirm resolution, and ensuring SARIF appears in GitHub code scanning with file and line mapping. Run AI app security checklist before launch to cover injection, auth, secrets, headers and supply chain in one pass.

When ready to centralize results across claude-code sessions and pull requests with dashboards and retention, create an account at LyraShield AI for early access to team policies. LyraShield is designed to grow with your claude-code workflow, bringing findings with recorded evidence states, proposals requiring review, and retest evidence into existing loop without claiming hands off merges.