PHPackages                             timmonaghan/laravel-security-agent - PHPackages - PHPackages  [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register)

1. [Directory](/)
2. /
3. [Security](/categories/security)
4. /
5. timmonaghan/laravel-security-agent

ActiveLibrary[Security](/categories/security)

timmonaghan/laravel-security-agent
==================================

AI-powered security agent for Laravel — monitors logs and responds to threats via Claude.

v1.1.5(2mo ago)00MITPHP ^8.1

Since Apr 30Compare

[ Source](https://github.com/retronoodle/laravel-security-agent)[ Packagist](https://packagist.org/packages/timmonaghan/laravel-security-agent)[ RSS](/packages/timmonaghan-laravel-security-agent/feed)WikiDiscussions Synced 3w ago

READMEChangelogDependencies (7)Versions (7)Used By (0)

Laravel Security Agent
======================

[](#laravel-security-agent)

AI-powered threat detection for Laravel applications. Monitors logs for suspicious activity and uses a Claude AI agent (via tool use) to classify threats, block IPs, and alert administrators.

Requirements
------------

[](#requirements)

- PHP 8.1+
- Laravel 8, 9, 10, 11, or 12
- Guzzle 7+
- An Anthropic API key

Installation
------------

[](#installation)

**1. Require the package**

```
composer require timmonaghan/laravel-security-agent
```

**2. Publish the config**

```
php artisan vendor:publish --tag=security-agent-config
```

**3. Publish and run the migrations**

```
php artisan vendor:publish --tag=security-agent-migrations
php artisan migrate
```

**4. (Optional) Publish the email view**

```
php artisan vendor:publish --tag=security-agent-views
```

**5. Add environment variables to `.env`**

```
LSA_ANTHROPIC_API_KEY=sk-ant-...
LSA_MODEL=claude-sonnet-4-6               # optional, this is the default

SECURITY_ADMIN_EMAILS=admin@example.com,ops@example.com
SECURITY_CONFIDENCE_THRESHOLD=0.85        # 0.0–1.0, default 0.85
SECURITY_BLOCK_TTL_MINUTES=60             # default 60
SECURITY_LOG_PATH=/path/to/storage/logs/laravel.log  # default: storage/logs/laravel.log
SECURITY_SCHEDULE_FREQUENCY=everyMinute  # everyMinute (default), everyFiveMinutes, everyTenMinutes, everyFifteenMinutes, everyThirtyMinutes, hourly

# Admin panel
LSA_ADMIN_ENABLED=true
LSA_ADMIN_PASSWORD=your-secret-password
LSA_ADMIN_PATH=lsa-admin                  # URL path, default: lsa-admin
```

**6. Ensure the Laravel scheduler is running**

```
# In cron (recommended for production)
* * * * * cd /path-to-your-project && php artisan schedule:run >> /dev/null 2>&1
```

The package auto-registers the `security-agent:monitor` command in the Laravel scheduler.

Admin Web Panel
---------------

[](#admin-web-panel)

Laravel Security Agent ships with a built-in web panel for monitoring and configuration.

**Access it at:** `https://your-app.com/lsa-admin` (or your configured `LSA_ADMIN_PATH`)

The panel provides:

- **Dashboard** — live counts of security events and blocked IPs, plus a table of the 10 most recent events with IP, pattern type, confidence score, and outcome.
- **Settings** — change the active Claude model and update the Anthropic API key without touching the server. Changes are written directly to your `.env` file.
- **Password protection** — set `LSA_ADMIN_PASSWORD` in `.env` to secure the panel. The panel is disabled (403) if no password is configured.

To use a custom URL path:

```
LSA_ADMIN_PATH=security-dashboard
```

How It Works
------------

[](#how-it-works)

1. **Log polling** — `security-agent:monitor` runs on the configured schedule and reads new log lines using a byte-offset (stored in cache), so it only processes new entries.
2. **Pattern detection** — Lines are scanned for `sqli`, `auth_brute_force`, and `404_flood` patterns. Matching batches are dispatched as `AnalyzeThreat` jobs.
3. **AI analysis** — `ThreatAgent` sends the suspicious batch to Claude with four tools: `get_ip_history`, `get_recent_events`, `block_ip`, `send_alert`. Claude reasons over the evidence and calls tools as needed (max 10 turns).
4. **Auto-block or alert** — High-confidence threats (≥ threshold) are written to `lsa_ip_blocklist` with an expiry. Lower-confidence threats trigger an admin email.
5. **Audit trail** — Every event and agent decision is stored in `lsa_security_events` with a human-readable summary.
6. **API rate limiting** — Built-in rate limiter prevents runaway Claude API calls under heavy log volume.

Blocklist Middleware (Optional)
-------------------------------

[](#blocklist-middleware-optional)

The package ships a ready-made middleware. To enforce the IP blocklist on incoming requests, register it in `app/Http/Kernel.php`:

```
use Timmonaghan\SecurityAgent\Http\Middleware\BlocklistMiddleware;

// Add to the $middleware array for global enforcement:
protected $middleware = [
    // ...
    BlocklistMiddleware::class,
];

// Or add to $middlewareGroups['web'] to apply only to web routes:
protected $middlewareGroups = [
    'web' => [
        // ...
        BlocklistMiddleware::class,
    ],
];
```

Rollback
--------

[](#rollback)

```
composer remove timmonaghan/laravel-security-agent
php artisan migrate:rollback  # or drop tables manually
```

Notes
-----

[](#notes)

- Queue driver `sync` is supported (MVP default) but an async driver (Redis, database) is recommended for production to avoid blocking the scheduler process during Claude API calls.
- IPv4 only in this release.
- Database tables are prefixed with `lsa_` (`lsa_security_events`, `lsa_ip_blocklist`) to avoid collisions with host app tables.

###  Health Score

35

—

LowBetter than 77% of packages

Maintenance83

Actively maintained with recent releases

Popularity0

Limited adoption so far

Community2

Small or concentrated contributor base

Maturity47

Maturing project, gaining track record

How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window.

**Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores.

**Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement.

**Maturity (30%)** — Project age, version count, PHP version support, and release stability.

###  Release Activity

Cadence

Every ~0 days

Total

6

Last Release

85d ago

### Community

Maintainers

![](https://www.gravatar.com/avatar/ebbcc90e4bacea75bbeb530f9a121a3c42fee2fc1406584bfc19b07892f5dc2f?d=identicon)[retronoodle](/maintainers/retronoodle)

###  Code Quality

TestsPHPUnit

### Embed Badge

![Health badge](/badges/timmonaghan-laravel-security-agent/health.svg)

```
[![Health](https://phpackages.com/badges/timmonaghan-laravel-security-agent/health.svg)](https://phpackages.com/packages/timmonaghan-laravel-security-agent)
```

###  Alternatives

[roots/acorn

Framework for Roots WordPress projects built with Laravel components.

9762.4M133](/packages/roots-acorn)[flarum/core

Delightfully simple forum software.

211.4M2.4k](/packages/flarum-core)[laravel/ai

The official AI SDK for Laravel.

1.0k3.2M246](/packages/laravel-ai)[aedart/athenaeum

Athenaeum is a mono repository; a collection of various PHP packages

255.2k](/packages/aedart-athenaeum)

PHPackages © 2026

[Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)