lc-essentials

LimaCharlie AI Integrations

This repository contains AI integrations for LimaCharlie, including Claude Code plugins, agents, and skills for security operations.

Claude Code Plugin Marketplace

The plugins/ directory contains Claude Code plugins that can be installed to enhance Claude Code with LimaCharlie capabilities.

Available Plugins

lc-essentials

The lc-essentials plugin provides comprehensive LimaCharlie integration for Claude Code, including:

• API Operations: Full access to LimaCharlie APIs through structured skills
• Detection Engineering: Build, test, and deploy D&R rules with AI assistance
• Investigation Creation: Automated SOC investigation workflows
• Threat Report Evaluation: Parse threat reports and hunt for IOCs
• Sensor Tasking: Query and command EDR agents
• Multi-tenant Reporting: Generate reports across multiple organizations
• Adapter Management: Configure and troubleshoot log adapters

Getting Started

Before using the lc-essentials plugin, you need access to Claude Code through one of these options:

Option A: Local Installation

Install Claude Code on your local machine:

curl -fsSL https://claude.ai/install.sh | bash

For detailed setup instructions, see the Claude Code Quickstart Guide.

Then continue to the Plugin Installation section below.

Option B: Web-Based (No Installation)

Use Claude Code directly through the LimaCharlie web interface at app.limacharlie.io. The lc-essentials plugin is already pre-configured - you're ready to go with no additional setup required.

---

Plugin Installation

Only required for Option A (local installation)

Option 1: Add as a Marketplace (Recommended)

Installing the AgenticSecOps Workspace

From within a project directory:

# Add the marketplace
/plugin marketplace add https://github.com/refractionPOINT/lc-ai

# Install the plugin
/plugin install lc-essentials@lc-marketplace

Option 2: Local Installation

Clone this repository and add it as a local marketplace:

git clone https://github.com/refractionPOINT/lc-ai.git
cd your-project
/plugin marketplace add /path/to/lc-ai
/plugin install lc-essentials@lc-marketplace

Option 3: Docker Container

Use the pre-configured Docker container with everything ready to go:

cd docker && docker compose run --rm lc-claude

See the Docker section below for more details.

Authentication

After installing the plugin:

1. Restart the claude tool
2. Run /mcp and select the LimaCharlie MCP server
3. Authenticate using OAuth when prompted

Configuration

For advanced configuration options, see the LimaCharlie MCP documentation.

Usage

Once installed, initialize any project with LimaCharlie guidelines:

/init-lc

Then use natural language to interact with LimaCharlie:

• "List all sensors in my organization"
• "Create a detection rule for encoded PowerShell"
• "Investigate this detection and create an investigation record"
• "Get a health report for all my organizations"

See marketplace/plugins/lc-essentials/SKILLS_SUMMARY.md for a complete list of available skills.

LimaCharlie Agents (ai-agents)

The ai-agents/ directory contains autonomous AI agents that run inside LimaCharlie organizations. These are not Claude Code sub-agents — they are standalone AI agents deployed as LimaCharlie IaC.

Available Agents

Agent	Description
l1-bot	Automated L1 SOC analyst that investigates new cases and documents findings for L2 review

Installing Agents

With the lc-essentials plugin (recommended): Ask Claude Code to "install the l1-bot agent in my org" — the lc-deployer skill handles everything automatically.

Manually: See each agent's README for step-by-step instructions.

Repository Structure