guardvibe — Claude Code MCP server: security checks for AI code
A local security scanner for AI-written code: 618 rules, 39 tools, dependency CVE checks and MCP server vulnerability detection.
claude mcp add guardvibe -- npx -y guardvibeWhat guardvibe does
GuardVibe runs as an MCP server and checks code while your agent writes it, not in a separate audit afterwards. It ships 618 security rules and 39 tools: scanning package.json for known vulnerable versions, finding MCP server flaws, prompt injection hidden in tool descriptions, and excessive agent permissions. The secure_prompt tool inspects the coding prompt itself before any code exists and folds security requirements into it.
CVE rules refresh daily from GHSA, OSV.dev and CISA KEV, so the scanner catches vulnerable package versions published after a model's training cutoff. Results are deterministic: the same code yields the same findings on every run. The fix_code tool returns concrete patches — move a hardcoded key into an environment variable, drop a CORS wildcard, swap raw HTML in React for <ReactMarkdown>, insert an auth guard or parameterized queries.
Everything runs locally with no account and no API keys. Start it with npx guardvibe. Output comes as JSON for agents, Markdown for humans and SARIF for CI/CD, plus a pre-commit hook and a GitHub Actions workflow that uploads SARIF to the Security tab. Without Node.js and npx on your PATH, the server will not start.
What it helps with
- flag vulnerable package versions in dependencies
- find unprotected routes across the whole repo
- catch prompt injection in MCP tool descriptions
- get a patch for a hardcoded key or a CORS wildcard
- block insecure code before it reaches the repo
Example prompts for the agent
- Scan this project with guardvibe and list the vulnerable dependencies
- Run secure_prompt on this task and add the security requirements
- Apply fix_code to the findings and show me the patches
How to install guardvibe
Platform CLI
claude mcp add guardvibe -- npx -y guardvibePlatform CLI
codex mcp add guardvibe -- npx -y guardvibeConfig file
{
"mcpServers": {
"guardvibe": {
"command": "npx",
"args": [
"-y",
"guardvibe"
]
}
}
}Config file
{
"servers": {
"guardvibe": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"guardvibe"
]
}
}
}Platform CLI
gemini mcp add guardvibe npx -y guardvibeStep by step, with commands for each platform: How to add an MCP server to Claude Code, Codex, Cursor, VS Code, Gemini CLI and more
Questions about guardvibe
How do I install guardvibe in Claude Code?
Run claude mcp add guardvibe -- npx -y guardvibe.
What does guardvibe do?
It scans code against 618 security rules, checks package versions against fresh CVE data and suggests patches. It runs as an MCP server while you code.
Do I need an account or API keys?
No. It runs entirely locally, with no keys and no cloud.
