Lagune is an open-source, defense-only security workflow that helps your AI agent harden any codebase. It detects what your system actually does, then guides the security fixes that matter for that context.

Can Lagune secure code as I build it?

Yes. The /lagune command takes any prompt, builds what you asked, and hardens it with safe defaults as it is written, guided by your charter. The five-phase Blue Team flow then audits what already exists.

Can Lagune audit an existing project?

Yes. The five-phase Blue Team flow audits what already exists: charter sets your security rules, detect maps what the system does and where the risks are, plan scores each finding and pairs it with a fix, harden applies the fixes, and verify proves they hold and closes them.

How do I install Lagune?

Run npx -y lagune@latest init in your project. It works in both new and existing projects and needs no API key.

How many AI agents does Lagune work with?

Lagune works with 72 AI coding agents, including Claude Code, Codex, Cursor, Gemini CLI, and GitHub Copilot.

Lagune is your security copilot as you build, your Blue Team when you audit, whether you're a developer or not.

Harden as you build

One command, /lagune, brings security while the code is written, not after.

Mark it on any prompt and the agent builds what you asked for as always, now with security knowledge on-demand.

Inspired by Spec-Driven

A five-phase, Blue Team-based flow, ready to run.

It detects what your system actually does, maps the matching attack vectors, then applies the security work that fits.

Knowledge on demand

Focused security modules load only for what your project is.

It pulls in the module that fits the context it finds, drawing from a catalog that keeps adapting as new risks emerge.

Progress in your browser

A local, private dashboard follows your findings, fixes, and proofs live.

Live view of your project's security, as the agent works. It runs on your machine and nothing leaves it.

Docs