Claude Code MCP Agent Rules Security Setup

Current setup: follow the Claude Code integration guide with pinned @lyrashield/mcp@0.2.12 and authenticate local stdio separately using npx -y lyrashield@0.2.14 login --oauth. The Agent Plugin package 0.1.31 is published; its public listing and authenticated client runtime acceptance remain pending. Use pinned CLI commands for documented config or skill installs; marketplace plugins remain separately gated. Confirm client discovery, then make an authenticated read-only workspace call.

Claude Code users can secure AI built apps by adding LyraShield MCP via stdio using npx -y @lyrashield/mcp@0.2.12 or remote endpoint with hosted OAuth, registering it in .mcp.json with project scope, verifying the connection in Claude Code, then running inline security checks and a GitHub diff gate for team review.

Claude Code generates hundreds of lines per prompt, magnifying OWASP Top 10 risks like injection and broken access control. Adding LyraShield brings verification, aligned with vibe coding security guide. LyraShield is agent native AppSec at LyraShield site, built as Target to Scan to Evidence State to Fix Proposal to Retest to Assurance Report. Setup in Claude Code integration guide and checklist Claude Code security workflow. Transport uses Model Context Protocol and GitHub Actions plus NIST SSDF. Findings retain their recorded evidence states. Current LyraShield tools record fix proposals and queue retests but do not edit code, create branches or open pull requests.

1. Authenticate the current local adapter

Use Node.js 24 or newer and a current Claude Code release. Run npx -y lyrashield@0.2.14 login --oauth in the same OS account that starts Claude Code, select one accessible workspace and keep the credential store private. This browser login authenticates the local stdio adapter; it does not install a plugin or authenticate a separate hosted connection. Each teammate completes their own login. The shared project file contains connection values only, so a teammate does not inherit another person’s token when cloning the repository.

Use the Claude Code integration guide as the source of current installation instructions. The Agent Plugin package 0.1.31 is published, while its public listing and authenticated runtime acceptance remain pending. The marketplace default branch is preparation only. The earlier CLI 0.2.13 release printed legacy install instructions; do not treat them as a released plugin recipe. Use pinned CLI commands for documented config or skill installs; marketplace plugins remain separately gated. The coordinated direct MCP package pin is @lyrashield/mcp@0.2.12.

2. Merge the MCP configuration

Claude Code’s project .mcp.json uses mcpServers. Merge this entry into the existing file without replacing unrelated servers or settings. The local server uses the selected CLI workspace and does not need an API key in the config:

{
  "mcpServers": {
    "lyrashield": {
      "command": "npx",
      "args": ["-y", "@lyrashield/mcp@0.2.12"]
    }
  }
}

Alternatively, Claude’s own configuration command can register the pinned local server:

claude mcp add --scope project lyrashield -- npx -y @lyrashield/mcp@0.2.12

Inspect the resulting project entry and retain all existing client settings. A project configuration can be shared with the team, but consent and workspace access remain individual. For the optional remote HTTP route, follow the same canonical guide and complete hosted OAuth inside Claude Code. CLI OAuth authenticates only the local stdio route; a hosted API key cannot authorize scans, fix proposals or retests. Do not add a literal bearer to a committed file or paste credentials into an agent prompt.

3. Confirm discovery and an authenticated read

Restart Claude Code or reconnect the server, then inspect its MCP server view and available LyraShield tools. Discovery proves that the client loaded the connection, but it does not prove workspace access. Ask Claude to call lyrashield_list_workspaces and confirm the intended workspace, then list authorized targets. Keep the target selection explicit before requesting a recorded scan. An empty authorized target list should remain empty rather than being replaced with a guessed repository or URL.

If local authentication fails, repeat CLI OAuth login under the same OS account and restart the client. A configured server or successful npx -y lyrashield@0.2.14 doctor check is local setup evidence only. Do not start the stdio server as a standalone scanner or expect it to print handshake JSON without an MCP client. Inspect client logs for process or connection errors, distinguish missing Node from denied service access and retain the actual error when a check cannot complete. Reconnect remote OAuth separately if its consent expires. A successful workspace read establishes that read access at that moment; recorded scans, delegated writes, revocation, restart and upgrades need their own acceptance checks.

4. Run a security check inline while you code

With MCP connected, prompt agent to scan current target before committing. Example prompt is scan target http://localhost:3000 for injection and secrets using LyraShield and return findings with recorded evidence states only with file paths and CWE.

Agent calls MCP tool and returns file, line, evidence snippet or reproduction notes and remediation pointers that reference OWASP Top 10. For injection it shows untrusted input flowing into query without validation. For secrets it shows detected key pattern in source. For supply chain it maps lock entries against OSV database.

Use lyrashield_record_fix_proposal to record the intended remediation. After a developer applies the change, call lyrashield_verify_fix to queue a retest, then poll lyrashield_get_scan_status. A clean deterministic retest may be retest-confirmed.

Check type	What to scan	How to fix
Injection	API routes concatenating user input into queries	Parameterize queries, validate with schema, enforce allow lists at boundary
Secrets	Env example containing real keys, tokens in source	Remove secret, rotate credential, add precommit scan, use secret manager
Auth	Missing role check on sensitive routes, permissive CORS	Add auth middleware, test unauthenticated request, set secure cookie flags
Supply chain	Vulnerable npm packages with CVE in lockfile	Update lockfile, pin safe version, check OSV database advisory, limit scripts

Use table as prompt template for consistent scans. Reference Claude Code security workflow for deeper checklist.

5. Wire the GitHub Action diff aware gate

Local checks improve speed, but team assurance needs CI gate scanning changed files on pull requests and publishing SARIF for triage. LyraShield provides GitHub Action that runs diff aware scan and uploads SARIF. Uses GitHub Actions and aligns with OWASP Top 10 pipeline guidance.

name: LyraShield Security Gate
on:
  pull_request:
    branches: [main]
jobs:
  security:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
      pull-requests: write
    steps:
      - name: Run LyraShield diff scan
        uses: ecryptoguru/lyrashield-ai@v2
        with:
          fail_on_severity: HIGH

The runner-local Action needs no LyraShield API key. It emits and uploads SARIF, but it does not edit code, record a fix proposal or create a branch.

6. Add agent rules for continuous guardrails

claude-code supports project rules that agent reads each task, baking security into definition of done without relying on memory. Add rule forcing LyraShield scan before marking feature complete, covering user input, auth, file upload, secrets or external fetch and include retest.

Location varies. Cursor uses .cursor/rules/security.mdc with globs, Claude Code uses CLAUDE.md, Windsurf uses .windsurf/rules/security.md, VS Code uses .github/copilot-instructions.md, JetBrains uses .jetbrains/ai-assistant/rules/security.md. Choose location traveling with repo so new clones get same expectation.

# Security guardrail

For any task involving user input, auth, file upload or secrets:

1. Call LyraShield MCP scan on target .
2. List findings with their recorded evidence states, file and CWE
3. Propose remediation with code edit
4. Ensure .env.example has placeholders only
5. Retest via LyraShield after fix

Test rule by scaffolding endpoint accepting query param and confirming scan triggers without reminder. If agent skips, make rule more directive and place file where agent reads on startup. Keep rule short and committed. Pair with Claude Code security workflow and CWE Top 25 for taxonomy.

Why pair claude-code with LyraShield

Claude-Code speeds AI development but can repeat patterns OWASP Top 10 warns about such as trusting generated SQL or leaving debug endpoints enabled. LyraShield adds verification without changing UX, exposing scan and findings as native tools agent knows how to call.

The current product ships MCP, bounded scans, findings and evidence, approval-gated fix proposals, retests, reports, SCA, secrets and the runner-local SARIF gate. The local Action is advisory and does not create hosted evidence states; use a recorded scan and retest when assurance evidence is required. Advisory dependency matches use OSV data and still require resolved-version review.

Local feedback plus CI gate creates defense in depth matching how AI apps evolve. For policy framing revisit vibe coding security guide and NIST SSDF.

Close loop by tracking findings as tasks, rerunning scans after fixes to confirm resolution and ensuring SARIF appears in GitHub code scanning with file and line mapping. Run AI app security checklist before launch to cover injection, auth, secrets, headers and supply chain in one pass.

When ready to centralize results across claude-code sessions and pull requests with dashboards and retention, create an account at LyraShield AI to centralize findings with dashboards and retention. LyraShield is designed to grow with your claude-code workflow, bringing findings with recorded evidence states, proposals requiring review and retest evidence into existing loop without claiming hands off merges.