GuardVibe

Security infrastructure your AI can't be. No matter how good your coding agent gets, it can't know the CVE published after its training cutoff, it can't deterministically guarantee the same check every run, it can't hold your whole repo in context, and it can't objectively review its own code. GuardVibe does all four — the deterministic, post-cutoff-current, whole-repo, author-independent verification layer for AI-written code.

• 🗓️ Knows what your AI doesn't. CVE rules refreshed daily from GHSA / OSV.dev / CISA KEV — GuardVibe flags vulnerable dependencies published after your model's training cutoff. (93 CVE rules, npm run intel daily triage.)
• 🎯 Deterministic, not probabilistic. Same code = same result, every run (content-hashed). Your AI guesses; GuardVibe doesn't.
• 🗺️ Sees the whole repo. Cross-file taint + auth-coverage across every route — catches the unprotected endpoint your agent's narrow context missed.
• 🔍 An independent second pair of eyes. The thing that wrote the code can't review itself. GuardVibe is the outside checker on AI-written code — in the loop while your AI codes (real-time edit hook), not after.
• ⬅️ NEW: Starts before the first line of code. Every scanner on earth — including your agent reviewing itself — acts after the code exists. secure_prompt acts before: it analyzes the coding prompt itself, detects the stack and attack surfaces it implies, and embeds severity-ranked GuardVibe requirements into the prompt your AI executes. The vulnerability is prevented, not caught. Deterministic, zero LLM calls — and if the prompt is already secure, it passes through untouched.

The security MCP built for vibe coding. 468 security rules, 39 tools covering the entire AI-generated code journey — from the prompt itself to production deployment.

Works with Claude Code, Cursor, Gemini CLI, Codex, VS Code (Copilot), Windsurf, and any MCP-compatible coding agent.

Why a tool, when your AI is so good?

"More rules" was never the moat — a strong model already knows most security rules by heart. What it can't do is be deterministic, know the CVE published after its training cutoff, hold your whole repo in context, or objectively review the code it just wrote. Those four gaps are structural; they don't close as models improve. GuardVibe is the layer that fills them — running while your AI codes, not in a separate audit later. And since v3.19, it runs before your AI codes too: secure_prompt rewrites the task itself so the security requirements are in the prompt, not in the post-mortem.

Why GuardVibe

Most security tools are built for enterprise security teams. GuardVibe is built for you — the developer using AI to build and ship web apps fast.

• 468 security rules, 39 tools purpose-built for the stacks AI agents generate
• Zero setup friction — npx guardvibe and you're scanning
• No account required — runs 100% locally, no API keys, no cloud
• Understands your stack — not generic SAST, but rules that know Next.js, Supabase, Stripe, Clerk, and the tools you actually use
• CVE version intelligence — detects 93 known vulnerable package versions in package.json, refreshed every day from GHSA / OSV.dev / CISA KEV
• AI agent & MCP security — detects MCP server vulnerabilities, tool-description prompt injection (OWASP MCP Top 10), model-controlled sandbox-disable flags, excessive AI permissions, indirect prompt injection
• Auto-fix suggestions — fix_code tool returns concrete patches and structured edits the AI agent can apply mechanically. Coverage: hardcoded credentials → env-var migration; public-prefix LLM keys (NEXT_PUBLIC_/VITE_/EXPO_PUBLIC_/REACT_APP_) → prefix removal; CORS wildcards → env allowlist; dangerouslyAllowBrowser flags → drop; sandbox bypass flags (unsafe/noSandbox/allowEval) → drop; agent loops → add maxSteps; raw-HTML React props → <ReactMarkdown>; missing auth checks → insert auth guard; SQL injection → parameterized queries; missing rate limiters / CSRF / security headers → snippet templates.
• Pre-commit hook — block insecure code before it reaches your repo
• CI/CD ready — GitHub Actions workflow with SARIF upload to Security tab
• Agent-friendly output — JSON format for AI agents, Markdown for humans, SARIF for CI/CD
• Plugin system — extend with community or premium rule packs

New in v3.1.x

• Daily threat-intel pipeline — rule set tracks GHSA / OSV.dev / CISA KEV every day. Latest shipments (v3.1.24 → v3.1.26) added VG1069 node-ipc protestware detection, VG1070 CI npm provenance / --ignore-scripts hardening, VG1071 axios proxy-auth redirect credential leak, VG1072 hono setCookie attribute injection, VG1073 drizzle sql.raw interpolation, VG1074 Miasma @redhat-cloud-services namespace compromise IOC (RHSB-2026-006), and VG1075 Session messenger exfil endpoint IOC (filev2.getsession.org). The hono override floor is pinned to ^4.12.21. Earlier in the v3.1.2x line: Next.js May 2026 13-advisory cluster, Drizzle ORM SQL identifier injection (CVE-2026-39356), Clerk clerkFrontendApiProxy SSRF (CVE-2026-34076), tRPC experimental_nextAppDirCaller prototype pollution (CVE-2025-68130), MikroORM SQL injection, angular-expressions filter RCE, @tanstack/* Mini Shai-Hulud supply-chain attack, Kysely JSON-path traversal, @nyariv/sandboxjs sandbox escape, OpenClaude dangerouslyDisableSandbox model-controlled flag, Strapi content-type builder SQL injection, LangSmith untrusted prompt-manifest deserialization, and more
• OWASP MCP Top 10 alignment — VG1068 flags MCP / AI tool definitions whose description, instructions, or systemPrompt fields carry prompt-injection markers (ignore previous instructions, you are now, jailbreak mode, system prompt:, override safety, …); pair with VG1063 which catches dangerouslyDisableSandbox: true in agent runtimes
• Inline suppress — // guardvibe-ignore VG001 silences individual findings per-line
• CLI-first approach — npx guardvibe audit, npx guardvibe scan, npx guardvibe doctor all work standalone without MCP
• Embedded remediation plan — remediation_plan generates a section-by-section fix checklist after every audit
• Score reflects all sections — security score now factors code, dependencies, config, secrets, auth coverage, and taint analysis
• Gitignored secrets excluded — files matched by .gitignore are automatically skipped during secret scanning
• Taint sanitizer recognition — dataflow analysis recognizes common sanitizers (DOMPurify, escape functions, parameterized queries) and stops propagation

How GuardVibe Compares

GuardVibe is purpose-built for the AI coding workflow. Traditional tools are excellent for enterprise CI/CD pipelines — GuardVibe fills a different gap.

Capability	GuardVibe	Traditional SAST	Dependency Scanners
Runs inside AI agents (MCP)	Native	Not supported	Not supported
Zero config setup	npx guardvibe	Account + config required	Built-in (limited)
Vibecoding stack rules (Next.js, Supabase, Clerk, tRPC, Hono)	100+ dedicated	Generic patterns	Not applicable
AI/LLM security (prompt injection, MCP, tool abuse)	68 rules	Experimental/None	None
AI host security (CVE-2025-59536, CVE-2026-21852)	guardvibe doctor	Not supported	Not supported
Auto-fix suggestions for AI agents	fix_code tool	CLI autofix	Not supported
CVE version detection	93 packages, refreshed daily	Extensive	Extensive
Compliance mapping (SOC2, PCI-DSS, HIPAA)	Built-in	Paid tier	None
SARIF CI/CD export	Yes	Yes	Limited
Rule count	468 (focused, 68 AI-native)	5000+ (broad)	N/A

When to use GuardVibe: You're building with AI agents and want security scanning integrated into your coding workflow — no dashboard, no account, no CI setup.

When to use traditional tools: You need deep AST analysis, enterprise dashboards, org-wide policy enforcement, or coverage across hundreds of languages.

Quick Start

Claude Code

npx guardvibe init claude

Creates .mcp.json MCP config (pinned to current version), .claude/settings.json auto-scan hooks, and CLAUDE.md security rules. Restart Claude Code after setup.

Cursor

npx guardvibe init cursor

Creates .cursor/mcp.json and .cursorrules with security rules. Restart Cursor after setup.

Gemini CLI

npx guardvibe init gemini

Creates ~/.gemini/settings.json MCP config and GEMINI.md security rules.

Codex (OpenAI)

codex mcp add guardvibe -- npx -y guardvibe

VS Code (GitHub Copilot)

Create .vscode/mcp.json in your project:

{
  "servers": {
    "guardvibe": {
      "command": "npx",
      "args": ["-y", "guardvibe"]
    }
  }
}

Note: VS Code uses "servers", not "mcpServers".

Windsurf

Add to ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "guardvibe": {
      "command": "npx",
      "args": ["-y", "guardvibe"]
    }
  }
}

All platforms at once

npx guardvibe init all       # Claude + Cursor + Gemini

Pre-commit hook

npx guardvibe hook install   # Blocks commits with critical/high findings
npx guardvibe hook uninstall # Remove hook

CI/CD (GitHub Actions)

npx guardvibe ci github          # Generates .github/workflows/guardvibe.yml (SARIF scan)
npx guardvibe ci github --pr     # + a diff-aware PR review workflow that posts inline comments

What GuardVibe Scans

Application Code

Next.js App Router, Server Actions, Server Components, React, Express, Hono, tRPC, GraphQL, FastAPI, Go

Authentication & Authorization

Clerk, Auth.js (NextAuth), Supabase Auth, OAuth/OIDC (state parameter, PKCE) — middleware checks, secret exposure, session handling, SSR cookie auth, admin method protection

Database & ORM

Supabase (RLS, anon vs service role), Prisma (raw query injection, CVEs), Drizzle (SQL injection — including CVE-2026-39356 identifier-injection), MikroORM (CVE-2026-44680 runtime-identifier injection), Kysely (CVE-2026-44635 JSON-path traversal), Turso/LibSQL (client exposure, SQL injection), Convex (auth bypass, internal function exposure)

Payments

Stripe (webhook signatures, replay protection, secret keys), Polar.sh, LemonSqueezy

Third-Party Services

Resend (email HTML injection), Upstash Redis, Pinecone, PostHog, Google Analytics (PII tracking), Uploadthing (auth, file type/size)

AI / LLM Security

Prompt injection detection, LLM output sinks, system prompt leaks, MCP server SSRF/path traversal/command injection, MCP tool description prompt-injection markers (OWASP MCP Top 10 alignment, VG1068), model-controlled sandbox-disable flags (dangerouslyDisableSandbox, VG1063), AI agent unrestricted shell/database access, dangerouslyAllowBrowser, missing maxTokens, agent loop without maxSteps, AI API key client exposure, indirect prompt injection via external data, RAG/vector poisoning, public-prefix LLM key leaks (NEXT_PUBLIC_*, VITE_*, EXPO_PUBLIC_*)

AI Host Security

guardvibe doctor — unified host hardening scanner detecting CVE-2025-59536 (hook injection via .claude/settings.json), CVE-2026-21852 (API key exfiltration via ANTHROPIC_BASE_URL override), MCP config audit, environment scanner, permission analysis. Supports Claude, Cursor, VS Code, Gemini, Windsurf. Host-specific remediation with platform-tailored fix steps.

OWASP API Security

BOLA/IDOR (Broken Object Level Authorization), mass assignment (spread request body, Object.assign), missing pagination, rate limiting, admin endpoint authorization, verbose error leaks

Modern Stack

Zod .passthrough() mass assignment, z.any() bypass, file upload validation, server-only import guard, webhook replay protection, CSP headers, unsafe-inline/unsafe-eval detection, cron endpoint auth

Mobile

React Native, Expo — AsyncStorage secrets, deep link token exposure, hardcoded API URLs, ATS configuration

Firebase

Firestore security rules, Firebase Admin SDK exposure, storage rules, custom token validation

CVE Version Intelligence (93 CVEs, refreshed daily)

Frameworks: Next.js (CVE-2024-34351, CVE-2024-46982, CVE-2025-29927, CVE-2026-23869, CVE-2026-44573 / 44574 / 44575 / 44578 / 44579 / 45109 May 2026 cluster), React + react-server-dom-* (CVE-2025-55182, CVE-2026-23870), Express, Hono pre-4.12.18 cluster, @vitejs/plugin-rsc, Strapi content-type-builder (CVE-2026-22599) Auth: Clerk middleware bypass (GHSA-vqx2), Clerk has() org/billing/reverification bypass (GHSA-w24r), Clerk clerkFrontendApiProxy SSRF (CVE-2026-34076), NextAuth.js (2 CVEs), jsonwebtoken ORMs / SQL: Drizzle SQL identifier injection (CVE-2026-39356) + Drizzle sql.raw interpolation (VG1073), MikroORM SQL injection (CVE-2026-44680), Prisma raw-query call-form, Kysely JSON-path traversal (CVE-2026-44635) AI ecosystem: @anthropic-ai/sdk (CVE-2026-34451 + memory tool path escape), Vercel AI SDK file-type bypass (CVE-2025-48985), LangSmith untrusted prompt manifest (CVE-2026-45134), OpenClaude sandbox bypass (CVE-2026-42074), @nyariv/sandboxjs Function.caller escape (CVE-2026-43898) HTTP / parsing: Axios pre-1.15.2 cluster (SSRF + prototype-pollution + DoS + CRLF) + axios proxy-auth redirect leak (VG1071), Hono setCookie attribute injection (VG1072, override pinned ^4.12.21), fast-uri path traversal + host confusion (CVE-2026-6321 / 6322), fast-xml-parser CDATA injection, xmldom CDATA, protobuf.js multi-CVE cluster, undici (2 CVEs), ws Tools / supply chain: node-ipc protestware (VG1069), Miasma @redhat-cloud-services namespace compromise IOC (VG1074), Session messenger exfil endpoint IOC (VG1075), @tanstack/* Mini Shai-Hulud (84 malicious versions, May 2026), @wdio/browserstack-service command injection (CVE-2026-25244), @babel/plugin-transform-modules-systemjs arbitrary code (CVE-2026-44728), @opentelemetry exporter-prometheus DoS (CVE-2026-44902), systeminformation Linux cmd injection (CVE-2026-44724), velocityjs prototype pollution, defu, sharp, lodash, node-fetch, tar, xml2js, crypto-js, angular-expressions RCE, i18next-http-backend, vm2 sandbox breakouts

Deployment & Config

Vercel (vercel.json, cron secrets, headers), Next.js config, Docker, Docker Compose, Fly.io, Render, Netlify, Cloudflare

Infrastructure

Dockerfile security, GitHub Actions CI/CD, Terraform (S3, IAM, RDS, security groups)

Secrets & Environment

API keys (AWS, GitHub, Stripe, OpenAI, Resend, Turso), .env management, .gitignore coverage, high-entropy detection, NEXT_PUBLIC exposure

Compliance Control Mapping

Maps security findings to SOC2, PCI-DSS, HIPAA, GDPR, ISO27001, and EU AI Act (EUAIACT) controls. Identifies which code-level vulnerabilities are relevant to specific compliance requirements. Not a substitute for professional compliance audits.

Supply Chain

Malicious postinstall scripts, unpinned GitHub Actions, CI npm provenance / --ignore-scripts hardening (VG1070), typosquat detection, node-ipc protestware versions (VG1069), Miasma @redhat-cloud-services namespace compromise IOC (VG1074, RHSB-2026-006), Session messenger exfil endpoint IOC (VG1075, filev2.getsession.org), @tanstack/* Mini Shai-Hulud mass-malware versions (May 2026), @wdio/browserstack-service command injection via git branch names (CVE-2026-25244), lockfile poisoning patterns

Prompt-Level Security (Shift Left)

Most vulnerabilities in AI-generated code are born in the prompt: "add login to my app" says nothing about password hashing, session handling, or rate limiting — so the model picks defaults, and the defaults are where the CVEs live. secure_prompt moves the security gate to before code generation: it analyzes the raw prompt, detects the stack and attack surfaces it implies, matches them against GuardVibe's rule set, and returns a directive the host LLM uses to rewrite the prompt with security requirements embedded.

This is not a prompt beautifier. It is deterministic (no LLM, no network), it never restructures intent, and its first job is do no harm: a prompt that is already specific and security-aware gets verdict NO_MOD and passes through untouched.

• NO_MOD — prompt is already specific and security-aware → proceed with the original prompt unchanged
• LIGHT_MOD — intent is clear but security constraints are missing → inject requirements only
• HEAVY_MOD — prompt is vague and security-relevant → inject requirements + surface clarifying questions (never invent the answers)

Before (what the user typed):

add login to my app

After (what the host LLM executes, having applied the secure_prompt directive):

Add login to my app, with these security requirements:
- [VG001] Use environment variables or a secrets manager — never hardcode credentials.
- [VG1008] Always verify the caller has admin privileges before allowing role elevation.
- [VG105] Always specify allowed algorithms explicitly in jwt.verify().

Before implementing, confirm: which framework/stack is this for, and which auth
provider should be used (e.g. Clerk, Auth.js/NextAuth, Supabase Auth, custom JWT)?

Same user intent — but the model now generates auth code with the guardrails stated up front, instead of GuardVibe catching the missing pieces after the fact.

Tools (39 MCP tools)

Tool	What it does
check_code	Analyze a code snippet for security issues
check_project	Scan multiple files with security scoring (A-F)
scan_directory	Scan a project directory from disk
scan_staged	Pre-commit scan of git-staged files — diff-aware (blocks only newly-staged lines; diff_aware:false for whole files)
scan_dependencies	Check all dependencies for known CVEs (OSV) — annotates each vulnerable package with reachability (is it actually imported in your source?)
scan_secrets	Detect leaked secrets, API keys, tokens
check_dependencies	Check individual packages against OSV
check_package_health	Typosquat detection, maintenance status, adoption metrics
compliance_report	Map security findings to compliance controls (SOC2, PCI-DSS, HIPAA, GDPR, ISO27001, EU AI Act)
export_sarif	SARIF v2.1.0 export for CI/CD integration
get_security_docs	Security best practices and guides
fix_code	Auto-fix suggestions with concrete patches for AI agents
secure_this	Close the loop — scan, apply only the fixes that verifiably land (each re-scanned, rolled back on regression), return the verified code + a definition-of-done gate
audit_config	Audit project configuration files for cross-file security misconfigurations
generate_policy	Detect project stack and generate tailored security policies (CSP, CORS, RLS)
review_pr	Review PR diff for security issues with severity gating
scan_secrets_history	Scan git history for leaked secrets (active and removed)
policy_check	Check project against compliance policies defined in .guardviberc
analyze_dataflow	Track tainted data flows from user input to dangerous sinks
analyze_cross_file_dataflow	Cross-file taint analysis — track tainted data across module boundaries
check_command	Analyze shell commands for security risks before execution
scan_config_change	Compare config file versions to detect security downgrades
repo_security_posture	Assess overall repository security posture and map sensitive areas
explain_remediation	Get detailed remediation guidance with exploit scenarios and fix strategies
scan_file	Real-time single-file scan — designed for post-edit hooks
scan_changed_files	Scan only git-changed files — for PRs and incremental CI; diff-aware (only newly-added lines; diff_aware:false for whole files)
security_stats	Cumulative security dashboard — scans, fixes, grade trend over time
guardvibe_doctor	Host security audit — CVE-2025-59536, CVE-2026-21852, MCP config, env scanner
audit_mcp_config	Audit MCP server configurations for hook injection, file:// abuse, sensitive paths
scan_host_config	Scan shell profiles, .env files for base URL hijack and credential sniffing
verify_fix	Verify a security fix was applied correctly — returns fixed/still_vulnerable/new_issues
security_workflow	Get recommended tool workflow for your current task (writing, pre-commit, PR review, etc.)
auth_coverage	Auth coverage map — enumerate routes, parse middleware matchers, detect auth guards, report coverage %
deep_scan	LLM-powered deep analysis — IDOR, business logic, race conditions, auth bypass. Defaults to Claude Haiku 4.5 (~cents/scan). Pass model: 'sonnet' for deeper analysis. CLI: npx guardvibe deep-scan <file> --focus idor
full_audit	Single source of truth — runs ALL checks in one call, returns PASS/FAIL/WARN verdict + score + coverage % + deterministic result hash
remediation_plan	Remediation plan — generates section-by-section fix checklist after audit
verify_remediation	Remediation verification — compares before/after audit, flags skipped sections
secure_prompt	Prompt-level security (shift left) — analyze a coding prompt BEFORE code is written; deterministic triage (NO_MOD/LIGHT_MOD/HEAVY_MOD), stack + attack-surface detection, severity-ranked GuardVibe requirements embedded via a rewrite directive
scan_hallucinated_packages	Slopsquat / AI-hallucination detector — flags phantom imports (imported but in no manifest) and typosquats fully offline + deterministic; opt-in online tier adds npm-registry truth (404 = nonexistent, brand-new low-download = slopsquat pattern). CLI: npx guardvibe slopscan [path] --offline

All scanning tools support format: "json" for machine-readable output.

Slopsquat / hallucinated-package detection

AI assistants invent package names — ~20% of AI-generated code references packages that don't exist, and attackers register those hallucinated names ("slopsquatting"). Commodity SCA scans known, published packages against vuln databases; it can't see a name that doesn't exist yet, was never installed, or was published yesterday. scan_hallucinated_packages / slopscan targets exactly that seam, at code-gen/PR time:

• Offline (deterministic, air-gapped): phantom_import (a package imported in source but absent from every package.json — a classic LLM tell) and typosquats of popular packages. Statement-anchored + comment/template-aware, so example imports in docs/strings are never miscounted.
• Online (opt-in, graceful degrade): npm-registry truth — nonexistent (404), brand-new + low-download (slopsquat-registration pattern), deprecated/unmaintained.

The offline tier is also a full_audit section (online never runs inside the audit, keeping the result hash deterministic). Allowlist intentional unpublished/workspace names via .guardviberc: