Kjell Tore Guttormsen
83db634a72
D2b, order 20260821T041145Z-8516817669-from-.claude. Measured by .claude against the org: llms.txt was missing in 23 of 23 org repos (probe verified both ways in the same call chain: README.md -> 200, a nonexistent path -> 404). The operator decision of 21.08 creates it in 6 repos -- the catalog plus the 5 artifacts with their own run path -- and deliberately not in the 12 plugin repos, whose entry surface is already uniform. The reader is an AI agent already standing in this repository that needs one deterministic place to find what this artifact is and how it is started. Not crawlers: measurements show the major agent crawlers skip /llms.txt and read the HTML directly, so that would not be a reason that holds. Follows the llmstxt.org convention: H1, one blockquote summary, then H2 sections holding lists of markdown links, with "Optional" naming the links an agent may skip. Deliberately minimal -- llms.txt is a convention, not a ratified standard, and a W3C proposal from June 2026 diverges from the Answer.AI spec, so a format change should stay cheap. The install block is quoted byte-identical from README.md's first code block (verified with diff against README.md:67-68), not rewritten. A rewritten variant would be a second source of truth, not an entry point. Docs only; the Iron Law does not fire. Full suite unchanged vs HEAD: 2253 tests / 2247 pass / fail 0, exit 1 from the known jetbrains-parser after()-hook assertion, measured identically on a stashed HEAD tree. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Y7TAHJfxBoCm9YwhMWm6y5
31 lines
1.7 KiB
Text
31 lines
1.7 KiB
Text
# LLM Security Plugin for Claude Code
|
|
|
|
> A Claude Code plugin that scans, audits and threat-models agentic AI projects. It layers runtime hooks that block, deterministic Node.js scanners that compute, and advisory `/security` slash-commands that judge, mapped to OWASP LLM Top 10, OWASP Agentic AI Top 10, OWASP Skills Top 10, MCP Top 10, and the DeepMind AI Agent Traps taxonomy.
|
|
|
|
This file exists for an AI agent already standing in this repository that needs
|
|
one deterministic place to find what this artifact is and how it is started.
|
|
It cites `README.md`; it does not replace it.
|
|
|
|
Install — verbatim from the first code block in `README.md`:
|
|
|
|
```bash
|
|
claude plugin marketplace add https://git.fromaitochitta.com/open/ktg-plugin-marketplace.git
|
|
claude plugin install llm-security@ktg-plugin-marketplace
|
|
```
|
|
|
|
Then run `/security` in Claude Code for the command router, or `/security posture`
|
|
for a first scorecard.
|
|
|
|
## Docs
|
|
|
|
- [README.md](README.md): what the plugin is, install, every command, known limitations, non-goals
|
|
- [CLAUDE.md](CLAUDE.md): the plugin's own operating instructions — commands, hooks, agents, security boundaries
|
|
- [SECURITY.md](SECURITY.md): supported versions, deprecation notice period, how to report a vulnerability
|
|
- [CHANGELOG.md](CHANGELOG.md): every release, newest first
|
|
- [CONTRIBUTING.md](CONTRIBUTING.md): the fork-and-own model — issues are signals, pull requests are not accepted
|
|
|
|
## Optional
|
|
|
|
- [docs/scanner-reference.md](docs/scanner-reference.md): scanner internals, CLI surface, CI/CD templates, knowledge files
|
|
- [docs/defense-philosophy.md](docs/defense-philosophy.md): why the three layers are independent, and what none of them catch
|
|
- [docs/version-history.md](docs/version-history.md): release notes from v7.0.0 onward
|