Browse documentation
What is Linmas?
Linmas is a defensive security toolkit built specifically for AI-assisted software development. When developers and teams use AI coding agents to write features, refactor code, or deploy infrastructure, Linmas provides structured security review guidance to help identify vulnerabilities, improper access controls, and cloud misconfigurations before changes reach production.
Who is Linmas for?
- Vibe coders & solo developers: Ship ambitious projects with confidence without needing years of AppSec experience.
- Engineering teams: Integrate consistent security checklists and evidence into code review workflows.
- Security practitioners: Scale defensive guidance across AI coding agents with deterministic policy rules.
System Requirements
- Runtime: Node.js 24+ (required for the CLI and local MCP server).
- Git: Required for source checkouts and Codex marketplace installation.
- AI Agent Host: Supported hosts include Codex (primary/native), Claude Code (verified compatible), and any coding agent supporting portable Markdown instructions.
Supported Hosts
| Host | Support Level | Capabilities |
|---|---|---|
| Codex | Primary / Native | Marketplace plugin, 11 skills, 7 MCP tools, provider-backed review engine |
| Claude Code | Verified Compatible | Managed skills directory, CLI integration, Claude API review path |
| Other AI Agents | Portable | Manual import of canonical skills/*/SKILL.md instructions |
Your First Review Path
The fastest way to test Linmas locally without calling external models or configuring API keys is the offline judge demo:
git clone https://github.com/TanKimGwan/linmas.git
cd linmas
npm ci
npm run demo:judgeThe demo evaluates a synthetic code diff, passes it through the baseline-appsec policy, and produces an in-memory Review Capsule demonstrating the exact output format.