# Use the Lightning Web Security (LWS) MCP Tools (Beta)

The `guide_lws_security` tool analyzes components based on product security and Lightning Web Security Guidelines, helping you identify vulnerabilities and recommend fixes. This MCP tool is superseded by [the `experience-lwc-security-validate` skill](/docs/platform/lwc/guide/afv-lwc-skills.md).

:::note
MCP Tools for LWC is a pilot or beta service that is subject to the Beta Services Terms at [Agreements - Salesforce.com](https://www.salesforce.com/company/legal/agreements/) or a written Unified Pilot Agreement if executed by Customer, and applicable terms in the Product Terms Directory. Use of this pilot or beta service is at the Customer's sole discretion.
:::

To use this tool, pass the `--toolsets` flag as part of the `args` property of your MCP configuration file and specify `lwc-experts`. See [Use DX MCP Tools for LWC](/docs/platform/lwc/guide/mcp-intro.md) for configuration details.

Here are some possible prompts that invoke the security tool.

## LWS Security Guide (`guide_lws_security`)

Ask about how to align your code with LWC security best practices.

- Analyze this component to flag XSS/DOM injection risks for lwc:dom="manual" and innerHTML. Suggest fixes for this component.
- Generate a secure LWC and Apex checklist for create, read, update, delete operations. Consider field-level security, WITH SHARING, SOQL injection prevention, and input validation.
- Audit the third‑party libraries under Lightning Web Security and CSP, and recommend safe integration patterns.

The tool identifies anti-patterns in the LWC code based on Lightning Web Security best practices, returning an assessment with recommendations for next steps.

:::important
When working with these tools using Agentforce Vibes Extension, you must enable the `a4d-general-rules-no-edit.md` and `a4d-lwc-rules-no-edit.md` global rules. The `a4d-general-rules-no-edit.md` rule is enabled by default. For more information on configuring rules in Agentforce Vibes, see [Agentforce Rules](https://developer.salesforce.com/docs/platform/einstein-for-devs/guide/devagent-rules.md) in the *Agentforce Vibes Extension Developer Guide*.
:::

**See Also**

- [Salesforce DX MCP Server](https://developer.salesforce.com/docs/atlas.en-us.sfdx_dev.meta/sfdx_dev/sfdx_dev_mcp.htm)
- [LWC MCP Tools Reference](/docs/platform/lwc/guide/mcp-reference.md)
- [*Security for Lightning Components Developer Guide*: Lightning Web Security](https://developer.salesforce.com/docs/platform/lightning-components-security/guide/lws-intro.md)