Introduction

Lighthouse gives AI coding agents the security rules of your repository before they write code, then checks the code they produce. It works with Claude Code and Codex, on repositories hosted on GitHub.

How it worksCopy Anchor Link

Lighthouse does three things, in this order:

1. Learns your repository. An ingestion reads a branch and writes down its security rules as security cards. For example: "Every handler under app/routes/admin/ must call require_admin first."
2. Briefs your agent. When you start a request with /lighthouse-enhance, Lighthouse adds the cards that apply to that request. This is prompt enhancement.
3. Checks the result. A pre-commit scan reviews your staged changes on every commit. A pull request scan reviews every pull request on GitHub. Problems are reported as findings, and your team decides which ones block a commit or a merge.

repository  ──  ingestion  ──→  security cards
request     ──  enhance    ──→  request + relevant cards  ──→  agent
change      ──  scan       ──→  findings  ──→  allowed or blocked

Every run is recorded in the dashboard at lighthouse.rewarelabs.com, so you can see what was scanned, what was found, and what guidance each agent received.

Start hereCopy Anchor Link

Setup has two parts. An admin sets up the team once. Then each developer sets up their own machine.

RequirementsCopy Anchor Link