lagune

🪼 Your security copilot as you build, your Blue Team when you audit, whether you're a developer or not.

Packages

Package details

extensionskill

Install lagune from npm and Pi will load the resources declared by the package manifest.

npm repo home report

$ pi install npm:lagune

Package: lagune
Version: 0.17.0
Published: Nov 4, 2026
Downloads: 823/mo · 359/wk
Author: weslley.io
License: Apache-2.0
Types: extension, skill
Size: 1.6 MB
Dependencies: 0 dependencies · 0 peers

Pi manifest JSON

{
  "skills": [
    "./skills"
  ],
  "extensions": [
    "./lib/plugins/pi.js"
  ]
}

Security note

Pi packages can execute code and influence agent behavior. Review the source before installing third-party packages.

README

🪼 Lagune AI

Instead of running a generic checklist, what if security existed before, during, and after development?

Give us a ⭐ on GitHub It helps more people discover the project.

📘 Documentation

Get Started

Install and Update

Pick your agent:

claude plugin install lagune --marketplace wellwelwel/lagune

claude plugin marketplace update lagune
claude plugin update lagune@lagune

Type /plugin and select Manage plugins.
Add wellwelwel/lagune on the Marketplaces tab.
Install lagune on the Plugins tab.

Type /plugin and select Manage plugins.
Open the Marketplaces tab.
Select the refresh icon on lagune.

codex plugin marketplace add wellwelwel/lagune
codex plugin add lagune@lagune

codex plugin marketplace upgrade lagune

[!NOTE]

See the Install section for detailed instructions.

Migrate from previous Lagune manifest-based setup.

Skills

Once installed, your AI agent unlocks a set of commands, all governed by the charter: secure new work as you build it, or run the full audit over a project.

[!TIP]

See real-world Prompt Samples 🪼

› Build

Harden the work as you write it, with no flow to follow:

Skill	What it does for you
/lagune-charter	Sets your project's security rules, the foundation `/lagune` builds against
/lagune (Universal)	Builds what you ask and hardens it as it is written, guided by the charter

› Audit: the Blue Team flow

These five run in order. Each builds on the previous, so following the list top to bottom is all it takes:

#	Skill	What it does for you
1	/lagune-charter	Sets your project's security rules, proposed for you or shaped by what you say
2	/lagune-detect	Reads your code and maps what your system does and where the risks are
3	/lagune-plan	Turns what detect found into a defense plan, with a fix for each finding
4	/lagune-harden	Applies the plan's fixes to your code, safely and one at a time
5	/lagune-verify	Proves each applied fix holds and closes out the ones that do

› Special skills

Skill	What it does
/lagune-specialize	Teaches Lagune a new security specialization from articles, exploits, or topics
/lagune-prove	Turns each detected finding into a runnable, defense-only proof for responsible disclosure

[!TIP]

Security is not a cost, it is an investment: what you put in upfront, you save many times over in the incidents you never have 🙋🏻‍♂️

[!NOTE]

Some agents take the commands under the plugin's name, such as /lagune:lagune-charter. Your agent's install page shows how to type them.

[!IMPORTANT]

See the full documentation for usage examples and more.

Dashboard

For an interactive live view of .lagune/, run:

npx lagune

It serves a dashboard and opens it on a random port:

Live Reload
Private and Local
Follow the findings, fixes, and verdicts, and manage the categories, directly from your browser
No node_modules or package.json is needed 📦

[!TIP]

🚪 Use --port to specify a custom port.

⏏️ Press Ctrl+C to stop.

Requirements

You will need Node.js (LTS) installed on your system.

Security

To report a vulnerability and see the supported versions, check the Security Policy.

Contributing

See the Contributing Guide and please follow our Code of Conduct 🚀

Acknowledgements

Partners

Partners get an exclusive logo across the repositories and landing pages, plus a spot on a dedicated partners page.

Help my work grow by becoming a partner 🖖

Supporters

Really thanks to everyone who has supported and keeps supporting my work.

Support my work by becoming a sponsor too ✨

License

All product names, trademarks, and registered trademarks mentioned are the property of their respective owners and are used for identification purposes only.