LimaCharlie AI Integrations
This repository contains AI integrations for LimaCharlie, including Claude Code plugins, agents, and skills for security operations.
Claude Code Plugin Marketplace
The plugins/ directory contains Claude Code plugins that can be installed to enhance Claude Code with LimaCharlie capabilities.
Available Plugins
lc-essentials
The lc-essentials plugin provides comprehensive LimaCharlie integration for Claude Code, including:
- API Operations: Full access to LimaCharlie APIs through structured skills
- Detection Engineering: Build, test, and deploy D&R rules with AI assistance
- Investigation Creation: Automated SOC investigation workflows
- Threat Report Evaluation: Parse threat reports and hunt for IOCs
- Sensor Tasking: Query and command EDR agents
- Multi-tenant Reporting: Generate reports across multiple organizations
- Adapter Management: Configure and troubleshoot log adapters
Getting Started
Before using the lc-essentials plugin, you need access to Claude Code through one of these options:
Option A: Local Installation
Install Claude Code on your local machine:
curl -fsSL https://claude.ai/install.sh | bash
For detailed setup instructions, see the Claude Code Quickstart Guide.
Then continue to the Plugin Installation section below.
Option B: Web-Based (No Installation)
Use Claude Code directly through the LimaCharlie web interface at app.limacharlie.io. The lc-essentials plugin is already pre-configured - you're ready to go with no additional setup required.
Plugin Installation
Only required for Option A (local installation)
Option 1: Add as a Marketplace (Recommended)
Installing the AgenticSecOps Workspace
From within a project directory:
# Add the marketplace
/plugin marketplace add https://github.com/refractionPOINT/lc-ai
# Install the plugin
/plugin install lc-essentials@lc-marketplace
Option 2: Local Installation
Clone this repository and add it as a local marketplace:
git clone https://github.com/refractionPOINT/lc-ai.git
cd your-project
/plugin marketplace add /path/to/lc-ai
/plugin install lc-essentials@lc-marketplace
Option 3: Docker Container
Use the pre-configured Docker container with everything ready to go:
cd docker && docker compose run --rm lc-claude
See the Docker section below for more details.
Authentication
After installing the plugin:
- Restart the
claude tool
- Run
/mcp and select the LimaCharlie MCP server
- Authenticate using OAuth when prompted
Configuration
For advanced configuration options, see the LimaCharlie MCP documentation.
Usage
Once installed, initialize any project with LimaCharlie guidelines:
/init-lc
Then use natural language to interact with LimaCharlie:
- "List all sensors in my organization"
- "Create a detection rule for encoded PowerShell"
- "Investigate this detection and create an investigation record"
- "Get a health report for all my organizations"
See marketplace/plugins/lc-essentials/SKILLS_SUMMARY.md for a complete list of available skills.
LimaCharlie Agents (ai-agents)
The ai-agents/ directory contains autonomous AI agents that run inside LimaCharlie organizations. These are not Claude Code sub-agents — they are standalone AI agents deployed as LimaCharlie IaC.
Available Agents
| Agent | Description |
|---|
| l1-bot | Automated L1 SOC analyst that investigates new cases and documents findings for L2 review |
Installing Agents
With the lc-essentials plugin (recommended): Ask Claude Code to "install the l1-bot agent in my org" — the lc-deployer skill handles everything automatically.
Manually: See each agent's README for step-by-step instructions.
Repository Structure
refractionPOINT