The agent harness performance optimization system. Skills, instincts, memory, security, and research-first development for Claude Code, Codex, Opencode, Cursor and beyond.
Copilot Security Instructions
A customizable copilot-instructions.md ruleset & prompts to guide GitHub Copilot toward secure coding defaults in Java, Node.js, C# and Python. Blocks risky patterns, teaches…
Install
$
docker run -d -p 8080:8080 copilot-security-mcpClaude Code
claude mcp add copilot-security-instructions -- docker run -d -p 8080:8080 copilot-security-mcpCursor / Claude Desktop (mcp.json)
{
"mcpServers": {
"copilot-security-instructions": {
"command": "docker",
"args": [
"run",
"-d",
"-p",
"8080:8080",
"copilot-security-mcp"
]
}
}
}Install command taken from the project's README or registry entry. Always review code before running it.
README excerpt
Read full README on GitHub →🛡️ Copilot Security Instructions
A comprehensive toolkit to guide GitHub Copilot toward secure coding practices. This project includes customizable instructions and security-focused prompts to help development teams identify and mitigate security risks effectively.
Designed for security-conscious teams, this configuration ensures Copilot suggests safer code patterns, avoids common vulnerabilities, and reinforces best practices — all without disrupting your workflow.
🔐 What's Inside
This project offers:
- Secure-by-default guidance for all languages (e.g., input validation, secret handling, safe logging).
- Language-specific secure patterns:
- ☕ Java
- 🟩 Node.js
- 🟦 C#
- 🐍 Python
- "Do Not Suggest" lists to block risky Copilot completions (e.g.,
eval, inline SQL, insecure deserialization). - AI hallucination protections to prevent package spoofing, non-existent APIs, and misinformation risks.
- Mentorship-style tips to help newer engineers build secure coding habits.
- Custom agents & Agent Skills under
agents/andskills/for repeatable AppSec workflows inside Copilot. - An installable GitHub Copilot CLI plugin under
plugins/copilot-securityfor reusable AppSec agents and skills across projects. - An MCP server for seamless integration of these prompts into other projects.
🗂️ Prompt Catalogue
Explore the available prompts and their intended use cases:
These prompt files live under prompts/ in this repo and are intended to be copied into a consuming repository’s .github/prompts/.
Recommended workflow: start with the application-security-orchestrator agent (see agents/application-security-orchestrator.agent.md).
It standardizes intake, then hands off to specialist agents (Analyst/Architect/Engineer) depending on whether you want findings, a threat model, or implemented fixes.
Similar plugs
Reverse engineer anything with agents, from app behavior down to native binaries.
Build Agentic workflows, RAG pipelines, with rich AI model and tool support on one collaborative workspace. Deploy on cloud, VPC, or self-hosted, so teams move from prototype…
User-friendly AI Interface (Supports Ollama, OpenAI API, ...)
A cross-platform desktop All-in-One assistant for Claude Code, Codex, OpenCode, OpenClaw, Grok Build & Hermes Agent. Only official website: ccswitch.io
Open-source Python library for AI browser agents, plus Browser Use Cloud: stealth browsers and a hosted agent API.