Workflows

Claude Code plugin

The LaraBeacon plugin gives Claude Code a local MCP server, skills, and a short session hint for Laravel projects. Claude can run scans, fix confirmed findings within the scope of a change, create baselines, and read Cloud report history without parsing terminal output.

Install

Inside Claude Code, add the marketplace and install the plugin:

/plugin marketplace add Baer-Software/larabeacon-claude-plugin
/plugin install larabeacon@larabeacon

The MCP server needs PHP 8.2 or newer on the PATH and starts in the project Claude Code was opened in. When LaraBeacon is not installed yet, run /larabeacon:setup; the free Core package is installed with:

composer require --dev baer-software/larabeacon

The Cloud tools need LaraBeacon Core 3.3 or newer.

Skills

/larabeacon:scan runs a scan, separates findings related to the current change from pre-existing and environment-specific ones, applies fixes within the reported scope, and reruns the affected checks.
/larabeacon:setup installs Core and explains the Pro and Cloud setup without asking for secrets in chat.
/larabeacon:cloud uploads a scan on request and summarizes new and resolved findings between Cloud reports.

MCP tools

Tool	What it does	Network
`larabeacon_status`	Installed Laravel, Core and Pro versions, Cloud configuration and next steps	No
`larabeacon_scan`	Runs `php artisan larabeacon` with a profile, selected checks, baseline and fix previews	No
`larabeacon_preflight`	Describes the environment and the checks a profile would run	No
`larabeacon_checks`	Searches the Core and Pro check catalogue	No
`larabeacon_baseline`	Writes a JSON acceptance baseline with a required reason	No
`larabeacon_cloud_upload`	Runs a scan with `--report`	Cloud
`larabeacon_cloud_reports`	Lists recent Cloud reports of the project	Cloud
`larabeacon_cloud_report`	Reads one report with open, new and resolved findings	Cloud

Data boundary

The MCP server runs on your machine and delegates every scan and Cloud request to the project’s own Artisan commands. It never reads .env or Cloud tokens; credentials stay in the application configuration. Scans upload no code or results, and the plugin collects no telemetry. The vulnerable-dependency checks run composer audit and npm, pnpm or yarn audit, which send package names and versions to Packagist and the npm or Yarn registry. larabeacon_status asks Packagist for the newest public LaraBeacon release at most once a day (no project data; disable with LARABEACON_UPDATE_CHECK=0). Only larabeacon_cloud_upload sends a report, with the same payload and opt-ins as --report, and the skills call it only when you ask for an upload.

Finding text comes from your project. The plugin marks it as data, so Claude does not treat it as instructions.

Cloud from Claude Code

With Cloud credentials configured, Claude can list the project’s reports and read the latest one. History requests use the existing project token, which also uploads reports and installs Pro. It sees only reports of its own project that are still within retention, so protect it like any other deployment secret. Cloud is included with every Pro project licence.

php artisan larabeacon:cloud status
php artisan larabeacon:cloud reports --limit=5
php artisan larabeacon:cloud report latest