reware-lighthouse

reware-lighthouse connects your Git repository to Lighthouse, so your coding agent gets security guidance for your codebase and every commit is scanned before it lands.

It works with Claude Code and Codex on macOS, Linux, and Windows, and needs Python 3.11 or newer. On Windows, the pre-commit hook runs through Git for Windows.

Quickstart

$ uv tool install reware-lighthouse    # or: pipx install reware-lighthouse
$ reware-lighthouse login              # paste the API key from your dashboard
$ cd your-repo
$ reware-lighthouse init
$ reware-lighthouse status

Restart your coding agent afterward so it picks up the new skill and MCP server.

What just happened?

1. login verified your API key and saved it to ~/.config/lighthouse/config.env.
2. init linked the repository to its Lighthouse project, installed a pre-commit hook, and added the agent skill.
3. status checked that your account, project link, and tooling all work.

You'll need an API key first. Create one on the Lighthouse dashboard. It's shown once, so copy it right away.

Enhance a coding request

Enhancement adds your repository's security rules to a request before your agent starts coding. It only runs when you ask for it, so ordinary requests are never changed.

In Claude Code:

/lighthouse-enhance add a password reset endpoint

In Codex, invoke the lighthouse-enhance skill with the same request.

Your agent tells you which branch's rules it used, plus any warnings, such as a branch that has no repository-specific rules yet. If enhancement fails, the agent stops and asks before continuing without it. Every enhancement appears in your dashboard history.

To pick a branch, start the request with --branch:

/lighthouse-enhance --branch release add a password reset endpoint

Without the flag, Lighthouse uses the branch attached to your checkout, then the project's default branch.

Scan commits

The pre-commit hook runs reware-lighthouse scan on your staged changes. Whether a finding blocks the commit depends on the blocking policy saved for your project.

If the API is unreachable or the scan times out, the commit goes through. To change the timeout, set LIGHTHOUSE_SCAN_TIMEOUT to a number of seconds.

What init creates

Use --agent, --no-hook, or --no-mcp to set up less. If a step can't finish, init reports which items were created, which were already in place, and which need you. Rerunning it is safe.

Note that init never edits shared hook setups. If Git uses a shared or global hooks directory (core.hooksPath pointing outside the repository), or you use the pre-commit framework, add reware-lighthouse scan to that hook yourself. Edits you make to files init created are preserved.

Commands

Run any command with --help for an example.

Environment variables

What leaves your machine

• Enhancement sends the request you give the skill, plus the repository and branch. Lighthouse stores the original and enhanced prompts and shows them in your dashboard history.
• Pre-commit scans send your staged diff.

Scanning has known gaps in coverage and reporting that we're still working on. Treat it as one safeguard, not the only one.

Update

$ uv tool upgrade reware-lighthouse    # or: pipx upgrade reware-lighthouse

If the API needs a newer version, commands tell you to upgrade and show the commands above.

Uninstall

Clean up before you remove the tool. Once it's gone, nothing is left to run deinit or logout.

$ reware-lighthouse deinit             # in each repository you set up
$ reware-lighthouse logout
$ uv tool uninstall reware-lighthouse  # or: pipx uninstall reware-lighthouse

logout only removes the key from your machine. To revoke it, ask an admin to rotate or delete it on the dashboard.

License

Proprietary. See LICENSE.