# guardvibe

A local security scanner for AI-written code: 618 rules, 39 tools, dependency CVE checks and MCP server vulnerability detection.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 6
- Author: goklab
- License: Apache-2.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/goklab/guardvibe
- Updated: 2026-10-23
- HTML: https://affpapa.org/en/nevibecode/mcp/guardvibe

## What it does

GuardVibe runs as an MCP server and checks code while your agent writes it, not in a separate audit afterwards. It ships 618 security rules and 39 tools: scanning `package.json` for known vulnerable versions, finding MCP server flaws, prompt injection hidden in tool descriptions, and excessive agent permissions. The `secure_prompt` tool inspects the coding prompt itself before any code exists and folds security requirements into it.

CVE rules refresh daily from GHSA, OSV.dev and CISA KEV, so the scanner catches vulnerable package versions published after a model's training cutoff. Results are deterministic: the same code yields the same findings on every run. The `fix_code` tool returns concrete patches — move a hardcoded key into an environment variable, drop a CORS wildcard, swap raw HTML in React for `<ReactMarkdown>`, insert an auth guard or parameterized queries.

Everything runs locally with no account and no API keys. Start it with `npx guardvibe`. Output comes as JSON for agents, Markdown for humans and SARIF for CI/CD, plus a pre-commit hook and a GitHub Actions workflow that uploads SARIF to the Security tab. Without Node.js and `npx` on your `PATH`, the server will not start.

## Requirements
- Needs: Node.js (commands run via npx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add guardvibe -- npx -y guardvibe
```

### Codex

**Platform CLI**
```bash
codex mcp add guardvibe -- npx -y guardvibe
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "guardvibe": {
            "command": "npx",
            "args": [
                "-y",
                "guardvibe"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "guardvibe": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "guardvibe"
            ]
        }
    }
}
```

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add guardvibe npx -y guardvibe
```

## When to use it
- flag vulnerable package versions in dependencies
- find unprotected routes across the whole repo
- catch prompt injection in MCP tool descriptions
- get a patch for a hardcoded key or a CORS wildcard
- block insecure code before it reaches the repo

## Example prompts
- Scan this project with guardvibe and list the vulnerable dependencies
- Run secure_prompt on this task and add the security requirements
- Apply fix_code to the findings and show me the patches

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 386989
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89408
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12109
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7658
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2061
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1802

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md