Guardvibe

GuardVibe

Security infrastructure your AI can't be. No matter how good your coding agent gets, it can't know the CVE published after its training cutoff, it can't deterministically guarantee the same check every run, it can't hold your whole repo in context, and it can't objectively review its own code. GuardVibe does all four — the deterministic, post-cutoff-current, whole-repo, author-independent verification layer for AI-written code.

• 🗓️ Knows what your AI doesn't. CVE rules refreshed daily from GHSA / OSV.dev / CISA KEV — GuardVibe flags vulnerable dependencies published after your model's training cutoff. (229 CVE rules, npm run intel daily triage.)
• 🎯 Deterministic, not probabilistic. Same code = same result, every run (content-hashed). Your AI guesses; GuardVibe doesn't.
• 🗺️ Sees the whole repo. Cross-file taint + auth-coverage across every route — catches the unprotected endpoint your agent's narrow context missed.
• 🔍 An independent second pair of eyes. The thing that wrote the code can't review itself. GuardVibe is the outside checker on AI-written code — in the loop while your AI codes (real-time edit hook), not after.
• ⬅️ NEW: Starts before the first line of code. Every scanner on earth — including your agent reviewing itself — acts after the code exists. secure_prompt acts before: it analyzes the coding prompt itself, detects the stack and attack surfaces it implies, and embeds severity-ranked GuardVibe requirements into the prompt your AI executes. The vulnerability is prevented, not caught. Deterministic, zero LLM calls — and if the prompt is already secure, it passes through untouched.

The security MCP built for vibe coding. 604 security rules, 39 tools covering the entire AI-generated code journey — from the prompt itself to production deployment.

Works with Claude Code, Cursor, Gemini CLI, Codex, VS Code (Copilot), Windsurf, and any MCP-compatible coding agent.

Why a tool, when your AI is so good?

"More rules" was never the moat — a strong model already knows most security rules by heart. What it can't do is be deterministic, know the CVE published after its training cutoff, hold your whole repo in context, or objectively review the code it just wrote. Those four gaps are structural; they don't close as models improve. GuardVibe is the layer that fills them — running while your AI codes, not in a separate audit later. And since v3.19, it runs before your AI codes too: secure_prompt rewrites the task itself so the security requirements are in the prompt, not in the post-mortem.

Why GuardVibe

Most security tools are built for enterprise security teams. GuardVibe is built for you — the developer using AI to build and ship web apps fast.

• 604 security rules, 39 tools purpose-built for the stacks AI agents generate
• Zero setup friction — npx guardvibe and you're scanning
• No account required — runs 100% locally, no API keys, no cloud
• Understands your stack — not generic SAST, but rules that know Next.js, Supabase, Stripe, Clerk, and the tools you actually use
• CVE version intelligence — detects 229 known vulnerable package versions in package.json, refreshed every day from GHSA / OSV.dev / CISA KEV
• AI agent & MCP security — detects MCP server vulnerabilities, tool-description prompt injection (OWASP MCP Top 10), model-controlled sandbox-disable flags, excessive AI permissions, indirect prompt injection
• Auto-fix suggestions — fix_code tool returns concrete patches and structured edits the AI agent can apply mechanically. Coverage: hardcoded credentials → env-var migration; public-prefix LLM keys (NEXT_PUBLIC_/VITE_/EXPO_PUBLIC_/REACT_APP_) → prefix removal; CORS wildcards → env allowlist; dangerouslyAllowBrowser flags → drop; sandbox bypass flags (unsafe/noSandbox/allowEval) → drop; agent loops → add maxSteps; raw-HTML React props → <ReactMarkdown>; missing auth checks → insert auth guard; SQL injection → parameterized queries; missing rate limiters / CSRF / security headers → snippet templates.
• Pre-commit hook — block insecure code before it reaches your repo
• CI/CD ready — GitHub Actions workflow with SARIF upload to Security tab
• Agent-friendly output — JSON format for AI agents, Markdown for humans, SARIF for CI/CD
• Plugin system — extend with community or premium rule packs

New in v3.61.x

• TinaCMS, JHipster, PraisonAI, Actual and Backstage gaps closed — v3.61.0 adds VG1249 the Backstage Sentry Scaffolder actions SSRF and integration token disclosure (CVE-2026-106459), VG1250 the Actual Sync Server CORS proxy GitHub allowlist prefix bypass that leaks private repositories (CVE-2026-57449), VG1251 the JHipster generated-app reactive sort SQL injection and Blob ContentType stored XSS across generator-jhipster and react-jhipster (CVE-2026-107375, CVE-2026-107303), VG1252 the PraisonAI AgentOS unauthenticated network-exposed default (CVE-2026-61426) and VG1253 the TinaCMS admin preview iframe origin takeover of the content API across tinacms and @tinacms/app (CVE-2026-108261, critical). 229 CVE version-pin rules.

New in v3.60.x

• TanStack Start, OpenNext Cloudflare, Claude Code, Ghost and Backstage gaps closed — v3.60.0 adds VG1244 the TanStack Start unauthenticated reflected XSS through server-function responses across start-server-core, react-start, solid-start and vue-start (CVE-2026-102989), VG1245 the OpenNext Cloudflare cache interception middleware bypass via percent-encoded paths (CVE-2026-100409), VG1246 the Claude Code plugin hash pin bypass for 2.1.64–2.1.178 (CVE-2026-86063), VG1247 the Ghost cluster of eight advisories fixed in 6.67.0 (bookmark card and theme translation RCE, stored XSS, invite token disclosure) and VG1248 the Backstage confluence-to-markdown Scaffolder action path traversal (CVE-2026-106560). 224 CVE version-pin rules.

New in v3.59.x

• Template engine, shell quoting, Backstage and confidential contract gaps closed — v3.59.0 adds VG1239 the Handlebars own-property prototype check bypass on the end-of-life 3.x line (CVE-2026-106445), VG1240 the shell-quote quote() newline-in-operator command injection for 1.1.0–1.8.3 (CVE-2026-9277), VG1241 the Backstage Scaffolder task state validation residual window (CVE-2026-106500), VG1242 the OpenZeppelin Confidential Contracts encrypted handle disclosure (GHSA-29h2-jr22-frmh) and VG1243 the Backstage Bitbucket pull-request action path validation bypass (CVE-2026-106486). 219 CVE version-pin rules.

New in v3.58.x

• CMS, document viewer, wallet and AI workflow gaps closed — v3.58.0 adds VG1234 the TinaCMS self-hosted auth bypass that accepts tokens from any TinaCloud app (CVE-2026-63506), VG1235 the File Viewer legacy DOC renderer DOM XSS (CVE-2026-91127), VG1236 the BSV wallet toolbox unchecked storage-supplied output scripts (CVE-2026-56744), VG1237 the Flowise Python validator bypass and NodeVM puppeteer sandbox escape (CVE-2026-73487, CVE-2026-73483) and VG1238 the Backstage OIDC provider unverified-email sign-in (CVE-2026-106488). 214 CVE version-pin rules.

New in v3.57.x

• JWT, database driver and MessagePack gaps closed — v3.57.0 adds VG1229 the fast-jwt algorithm confusion, unsigned token acceptance and claim-validator bypass cluster (CVE-2026-107722, CVE-2026-107720, CVE-2026-107723, CVE-2026-107724), VG1230 the mariadb connector SQL injection and memory disclosure residual window (CVE-2026-107385, CVE-2026-107384, CVE-2026-107383), VG1231 the msgpack5 streaming decoder stack exhaustion and truncated map32 crash (CVE-2026-107300, CVE-2026-107302), VG1232 the Vendure Admin Dashboard stored XSS (CVE-2026-63459) and VG1233 the libp2p gossipsub StrictSign peer impersonation (CVE-2026-86038). 209 CVE version-pin rules.

New in v3.56.x

• Backstage and Handlebars gaps closed — v3.56.0 adds VG1224 the Backstage Scaffolder task data exposure and action input authorization bypass (CVE-2026-106501, CVE-2026-106503), VG1225 the Backstage TechDocs mkdocs.yml code execution and SSRF cluster (CVE-2026-106558, CVE-2026-106510, CVE-2026-106455 and three more), VG1226 the Backstage backend-defaults service credential restriction bypass (CVE-2026-106492), VG1227 the Backstage catalog placeholder resolution SSRF (CVE-2026-106498) and VG1228 the Handlebars JavaScript injection via AST type confusion and own-property prototype check bypass (CVE-2026-106446, CVE-2026-106445). 204 CVE version-pin rules.

New in v3.55.x

• Payload CMS, Quasar, Next.js and sharp gaps closed — v3.55.0 adds VG1219 the Payload core cluster fixed in 3.90.0 (unauthorized document updates, auth-collection field access bypass, SQL injection, first-register RCE and upload issues — CVE-2026-105859, CVE-2026-105845 and twelve more), VG1220 Payload plugins and database adapters (form builder RCE CVE-2026-105857, import/export prototype pollution CVE-2026-105844, SQLite/Postgres SQL injection CVE-2026-105856, MCP API key, multi-tenant, S3, MongoDB and ecommerce issues), VG1221 the Quasar SSR meta-tag XSS, User-Agent ReDoS, dev error page environment disclosure and Icon Genie path traversal cluster (CVE-2026-106102 to 106107), VG1222 the Next.js Image Optimization SSRF residual window 16.3.6–16.3.7 (CVE-2026-94483) and VG1223 the sharp 0.35.4 bundled librsvg residual window (GHSA-wq5f-xc86-pv6w). 199 CVE version-pin rules.

New in v3.54.x

• vm2, GraphQL Tools, Nx, shell-quote and MCP SDK gaps closed — v3.54.0 adds VG1213 the vm2 3.11.7–3.12.1 sandbox-escape residual window (CVE-2026-93605, CVE-2026-100721 and six more, fixed 3.12.2), VG1214 @graphql-tools/utils mergeDeep prototype-pollution DoS in federated gateways (CVE-2026-104852), VG1215 @graphql-tools/executor-legacy-ws TLS certificate validation disabled (CVE-2026-103921), VG1216 Nx command injection through git revisions and @nx/docker release config plus the world-accessible daemon socket (CVE-2026-104854, CVE-2026-104859), VG1217 shell-quote quote() command injection after a comment token (CVE-2026-102422) and VG1218 MCP TypeScript SDK OAuth client sending credentials to a server-chosen authorization server (CVE-2026-104850). 194 CVE version-pin rules.

New in v3.53.x

• CISA KEV Strapi, Capacitor, compression, ProseMirror and Vue SSR gaps closed — v3.53.0 adds VG1208 Strapi unauthenticated private-field filtering that leaks admin password-reset tokens (CVE-2023-22894, in CISA KEV), VG1209 Capacitor Android/iOS remote content loaded at the app origin through the internal HTTP proxy path (CVE-2026-103922), VG1210 compression memory-leak DoS on premature response close (CVE-2026-87776), VG1211 prosemirror-view XSS through pasted HTML (CVE-2026-104847) and VG1212 @vue/server-renderer SSR XSS through a carriage return in dynamic attribute names (GHSA-g2v6-rqmx-r4w6). 188 CVE version-pin rules.

New in v3.52.x

• Widely installed dependency gaps closed — v3.52.0 adds VG1203 source-map-js indexed source-map offset event-loop DoS (CVE-2026-93749), VG1204 proxy-addr IP spoofing through an IPv4-mapped IPv6 trust subnet that matches every client (CVE-2026-90711), VG1205 simple-git unsafe-operation guard bypasses — trailer command config, config includes, abbreviated long options and the VISUAL editor (CVE-2026-102826/102827/102828/102829), VG1206 Seroval fromJSON thenable assimilation and unbounded TypedArray allocation (CVE-2026-104846/104845) and VG1207 Tinypool prototype-pollution gadgets to RCE (CVE-2026-104848/104849). 183 CVE version-pin rules.

New in v3.51.x

• figlet, Mockoon, libp2p and dev-tool gaps closed — v3.51.0 adds VG1198 figlet whitespaceBreak infinite-loop DoS (CVE-2026-96780), VG1199 @yeger/turbo-graph unauthenticated network-exposed task execution via /api/run (CVE-2026-59160), VG1200 Payload alt-text plugin authorization bypass through an omitted overrideAccess (CVE-2026-59965), VG1201 Mockoon unauthenticated admin API with wildcard CORS (CVE-2026-59148) and VG1202 libp2p PeerStore accepting attacker-signed PeerRecords for a victim peer ID (CVE-2026-86039). 183 CVE version-pin rules.

New in v3.50.x

• Coverage audit of every CVE rule — each version rule is now compared with the advisories it cites on every published npm release. v3.50.0 closes the three windows that audit found uncovered: VG1195 Next.js 10.x–11.x for the AVIF/libheif image-optimizer RCE (GHSA-2xp9-vwfh-vxw4, critical), VG1196 end-of-life @angular/router lines (19.x and older) for the SSR matrix-parameter DoS (CVE-2026-101896), and VG1197 the original mcp-from-openapi / FrontMCP $ref SSRF window (CVE-2026-39885).

New in v3.49.x

• basic-ftp, A2UI, Trigger.dev, @fastify/busboy and probe-image-size gaps closed — v3.49.0 adds VG1190 basic-ftp quadratic directory-listing parser DoS (CVE-2026-102990), VG1191 @a2ui/web_core openUrl javascript: URI execution from agent-supplied buttons (CVE-2026-10032, critical), VG1192 Trigger.dev default secrets / cross-tenant SQL injection / replay IDOR / webhook SSRF cluster (6 advisories, critical), VG1193 @fastify/busboy prototype-named header and oversized boundary DoS (CVE-2026-19481, CVE-2026-19484) and VG1194 probe-image-size quadratic SVG parser DoS (CVE-2026-104861).

New in v3.48.x

• NestJS, Astro, vm2, Piscina and devalue gaps closed — v3.48.0 adds VG1185 @nestjs/platform-fastify absolute-form middleware bypass (GHSA-9c5c-9qcx-q35q), VG1186 @astrojs/node malformed Host port crash (CVE-2026-102984), VG1187 vm2 sandbox escape cluster residual window (12 advisories, critical), VG1188 Piscina ThreadPool options prototype-pollution RCE (CVE-2026-102992, critical) and VG1189 devalue shared-memory / uneval expansion / stringifyAsync rejection cluster (3 advisories).

New in v3.47.x

• Axios, Fastify, gRPC, NestJS and Angular SSR gaps closed — v3.47.0 adds VG1180 NestJS microservices nested message pattern crash (CVE-2026-102281), VG1181 axios prototype-pollution gadget / fetch maxRedirects / HTTP/2 / ReDoS cluster residual window (7 advisories), VG1182 @grpc/grpc-js getAuthContext unauthorized certificate (CVE-2026-101916), VG1183 Fastify not-found auth bypass and validation bypass cluster (4 advisories) and VG1184 Angular router SSR numeric matrix parameter DoS (CVE-2026-101896).

New in v3.46.x

• Next.js og-image RCE and widely installed dependency gaps closed — v3.46.0 adds VG1175 Next.js next/og ImageResponse remote code execution residual window (GHSA-vcvr-r3jv-pc5j, critical), VG1176 Nodemailer addressparser quadratic backtracking DoS past 9.1.0 (2 advisories), VG1177 engine.io protocol revision mismatch crash (CVE-2026-102599), VG1178 webpack-dev-middleware publicPath path traversal (CVE-2026-76844) and VG1179 Electron sandbox inheritance / webview worker / protocol CORS / preload cache cluster (5 advisories).

New in v3.45.x

• Widely installed dependency gaps closed — v3.45.0 adds VG1170 Cline Hub dashboard cross-origin WebSocket hijacking (CVE-2026-59723), VG1171 @xhmikosr/decompress symlink-chain path traversal (CVE-2026-101894, critical), VG1172 brace-expansion stack-exhaustion DoS on nested and comma-chained braces (2 advisories), VG1173 undici WebSocket crash / BalancedPool TLS check drop / cache poisoning (3 advisories) and VG1174 joi isoDate() quadratic regex DoS (GHSA-6h2x-m376-mqjq).

New in v3.44.x

• SSR, package-manager and dev-tool gaps closed — v3.44.0 adds VG1165 Angular SSR infinite-loop DoS on a malformed DOCTYPE (CVE-2026-101895, the releases that fixed last month's SSR advisories), VG1166 pnpm 12 pre-release lockfile symlink escape (GHSA-2rx9-3g3h-c2jv), VG1167 claude-code-templates Studio server unauthenticated command injection (CVE-2026-73222), VG1168 OpenClaw Feishu per-account disablement bypass (2 advisories) and VG1169 DOCX editor font-name CSS injection / print XSS (GHSA-x7m8-jrm8-hpvx).

New in v3.43.x

• Parser, workflow and MCP gaps closed — v3.43.0 adds VG1160 smol-toml six-byte infinite-loop DoS (CVE-2026-85730), VG1161 n8n expression sandbox escape / SSRF / ReDoS / OAuth registration cluster (5 advisories), VG1162 FrontMCP / mcp-from-openapi $ref SSRF fix bypass (CVE-2026-59973), VG1163 node-opcua client socket leak (CVE-2026-68904) and VG1164 Plate DOCX export SSRF (CVE-2026-65842).
• Widest-reach gaps of the month closed — v3.42.0 adds VG1153 nanoid size-overflow that freezes every later ID to one constant string (CVE-2026-73086), VG1154 mysql2 plaintext-password auth downgrade, VG1159 Nodemailer addressparser quadratic DoS, VG1157 toml prototype pollution + recursion crash, VG1158 SVGO removeScripts XSS bypass, and residual windows for the September pnpm path-traversal / proxy-secret cluster (VG1155) and Orval $ref SSRF (VG1156).
• 30-day backlog cleared — every uncovered high/critical advisory of the last month on a package with real reach now has a rule (v3.40.0–v3.41.0): js-yaml, browserslist, multer, engine.io, @xmldom/xmldom, faker, adm-zip, @tiptap/core, @angular/platform-server SSR, @sap/cds-mtxs, mariadb and more. Older hand-written xmldom, RSC and MikroORM rules were regenerated so ranges that resolve past the fix are no longer flagged.
• Backlog worked by reach — the daily run now ranks uncovered advisories by how many projects actually install the package. v3.40.0 closed the widest-reach gaps of the last month: VG1141 js-yaml merge-key CPU exhaustion, VG1136 browserslist custom-stats prototype write, VG1135 engine.io WebTransport crash, VG1137 faker helpers.fake() code execution, VG1134 mariadb password-before-TLS-validation, plus link-preview-js, TOON and LiquidJS.
• Advisory-accurate version rules — every CVE version-pin rule is checked against the GitHub Advisory Database on every published npm release: ranges that resolve past the fix are never flagged (v3.37.2), releases outside a cited advisory are no longer flagged and missed ones are added, and three rules with no advisory behind them were removed (v3.38.0).
• Daily threat-intel pipeline — rule set tracks GHSA / OSV.dev / CISA KEV every day. Latest shipments (v3.39.0) added VG1129 Orval generated-client code-injection RCE cluster (11 advisories, CVE-2026-62681 and more), VG1130 Astro AVIF/libheif image-optimization RCE (GHSA-26w7-cxv4-gfx2, CVSS 9.8), VG1131 Vendure external-auth account takeover (CVE-2026-63472), VG1132 MapLibre GL DOM.sanitize() zero-click XSS (CVE-2026-85061, CVSS 10.0), and VG1133 yayson prototype pollution (CVE-2026-61534). v3.37.0 added VG1128 ws memory-exhaustion DoS + uninitialized memory disclosure (CVE-2026-48779 / CVE-2026-45736) and corrected VG917's caret/tilde matching. v3.36.0 added VG1124 @bytebase/dbhub MCP-server DNS-rebinding SQL execution + read-only bypass (CVE-2026-61742/-61788), VG1125 Unleash missing-await permission bypass + cross-project IDOR (CVE-2026-77426), VG1126 Elysia multipart quadratic-CPU DoS (CVE-2026-56669), and VG1127 request-filtering-agent process crash (CVE-2026-62985). v3.35.0 added VG1119 SunEditor sanitizer-bypass stored XSS (CVE-2026-59167, CVSS 10.0), VG1120 sharp bundled-libheif RCE residual window (GHSA-rgj7-g3m4-5g8c, 0.33.3–0.35.3), VG1121 @roomi-fields/notebooklm-mcp MCP-tool path traversal (CVE-2026-61647), VG1122 9router LLM-router auth-bypass cluster (CVE-2026-56681/-56675/-56676/-56679), and VG1123 deepstream PATCH_MULTI permission-bypass residual (CVE-2026-63116). v3.34.0 added VG1115 Next.js AVIF/libheif RCE + Windows-hosted RCE (GHSA-2xp9-vwfh-vxw4 / CVE-2026-75604, CVSS 9.5), VG1116 @clerk/clerk-react 5.x org/billing/reverification authorization bypass (CVE-2026-42349), VG1117 @zereight/mcp-gitlab unauthenticated file read / SSRF / DNS rebinding (CVE-2026-61560/-61559/-61568), and VG1118 PostCSS sourceMappingURL residual window (GHSA-fxqj-rqcc-2cmp / GHSA-r28c-9q8g-f849). v3.32-3.33 added VG1109-VG1114: crypto-js WordArray.random() insufficient entropy, jsii-diff command injection, the keyv/cacheable "ChainDrop" npm supply-chain worm, React2Shell react-server-dom-* RCE, @trigger.dev/core prototype pollution, and an axios Basic-auth injection window. Earlier: Auth.js v5 beta fail-open, Next.js/PostCSS July residual windows, @asyncapi/* supply-chain IOC, Clerk 5.x middleware bypass, jscrambler/@injectivelabs IOCs, n8n-mcp cross-tenant isolation, Next.js May 2026 13-advisory cluster, Drizzle ORM SQL identifier injection (CVE-2026-39356), @tanstack/* Mini Shai-Hulud supply-chain attack, Kysely JSON-path traversal, and more
• OWASP MCP Top 10 alignment — VG1068 flags MCP / AI tool definitions whose description, instructions, or systemPrompt fields carry prompt-injection markers (ignore previous instructions, you are now, jailbreak mode, system prompt:, override safety, …); pair with VG1063 which catches dangerouslyDisableSandbox: true in agent runtimes
• Inline suppress — // guardvibe-ignore VG001 silences individual findings per-line
• CLI-first approach — npx guardvibe audit, npx guardvibe scan, npx guardvibe doctor all work standalone without MCP
• Embedded remediation plan — remediation_plan generates a section-by-section fix checklist after every audit
• Score reflects all sections — security score now factors code, dependencies, config, secrets, auth coverage, and taint analysis
• Gitignored secrets excluded — files matched by .gitignore are automatically skipped during secret scanning
• Taint sanitizer recognition — dataflow analysis recognizes common sanitizers (DOMPurify, escape functions, parameterized queries) and stops propagation

How GuardVibe Compares

GuardVibe is purpose-built for the AI coding workflow. Traditional tools are excellent for enterprise CI/CD pipelines — GuardVibe fills a different gap.

Capability	GuardVibe	Traditional SAST	Dependency Scanners
Runs inside AI agents (MCP)	Native	Not supported	Not supported
Zero config setup	npx guardvibe	Account + config required	Built-in (limited)
Vibecoding stack rules (Next.js, Supabase, Clerk, tRPC, Hono)	100+ dedicated	Generic patterns	Not applicable
AI/LLM security (prompt injection, MCP, tool abuse)	68 rules	Experimental/None	None
AI host security (CVE-2025-59536, CVE-2026-21852)	guardvibe doctor	Not supported	Not supported
Auto-fix suggestions for AI agents	fix_code tool	CLI autofix	Not supported
CVE version detection	229 packages, refreshed daily	Extensive	Extensive
Compliance mapping (SOC2, PCI-DSS, HIPAA)	Built-in	Paid tier	None
SARIF CI/CD export	Yes	Yes	Limited
Rule count	604 (focused, 68 AI-native)	5000+ (broad)	N/A

When to use GuardVibe: You're building with AI agents and want security scanning integrated into your coding workflow — no dashboard, no account, no CI setup.

When to use traditional tools: You need deep AST analysis, enterprise dashboards, org-wide policy enforcement, or coverage across hundreds of languages.

Quick Start

Claude Code

npx guardvibe init claude

Creates .mcp.json MCP config (pinned to current version), .claude/settings.json auto-scan hooks, and CLAUDE.md security rules. Restart Claude Code after setup.

Cursor

npx guardvibe init cursor

Creates .cursor/mcp.json and .cursorrules with security rules. Restart Cursor after setup.

Gemini CLI

npx guardvibe init gemini

Creates ~/.gemini/settings.json MCP config and GEMINI.md security rules.

Codex (OpenAI)

codex mcp add guardvibe -- npx -y guardvibe

VS Code (GitHub Copilot)

Create .vscode/mcp.json in your project:

{
  "servers": {
    "guardvibe": {
      "command": "npx",
      "args": ["-y", "guardvibe"]
    }
  }
}

Note: VS Code uses "servers", not "mcpServers".

Windsurf

Add to ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "guardvibe": {
      "command": "npx",
      "args": ["-y", "guardvibe"]
    }
  }
}

All platforms at once

npx guardvibe init all       # Claude + Cursor + Gemini

Pre-commit hook

npx guardvibe hook install   # Blocks commits with critical/high findings
npx guardvibe hook uninstall # Remove hook

CI/CD (GitHub Actions)

npx guardvibe ci github          # Generates .github/workflows/guardvibe.yml (SARIF scan)
npx guardvibe ci github --pr     # + a diff-aware PR review workflow that posts inline comments

What GuardVibe Scans

Application Code

Next.js App Router, Server Actions, Server Components, React, Express, Hono, tRPC, GraphQL, FastAPI, Go

Authentication & Authorization

Clerk, Auth.js (NextAuth), Supabase Auth, OAuth/OIDC (state parameter, PKCE) — middleware checks, secret exposure, session handling, SSR cookie auth, admin method protection

Database & ORM

Supabase (RLS, anon vs service role), Prisma (raw query injection, CVEs), Drizzle (SQL injection — including CVE-2026-39356 identifier-injection), MikroORM (CVE-2026-44680 runtime-identifier injection), Kysely (CVE-2026-44635 JSON-path traversal), Turso/LibSQL (client exposure, SQL injection), Convex (auth bypass, internal function exposure)

Payments

Stripe (webhook signatures, replay protection, secret keys), Polar.sh, LemonSqueezy

Third-Party Services

Resend (email HTML injection), Upstash Redis, Pinecone, PostHog, Google Analytics (PII tracking), Uploadthing (auth, file type/size)

AI / LLM Security

Prompt injection detection, LLM output sinks, system prompt leaks, MCP server SSRF/path traversal/command injection, MCP tool description prompt-injection markers (OWASP MCP Top 10 alignment, VG1068), model-controlled sandbox-disable flags (dangerouslyDisableSandbox, VG1063), AI agent unrestricted shell/database access, dangerouslyAllowBrowser, missing maxTokens, agent loop without maxSteps, AI API key client exposure, indirect prompt injection via external data, RAG/vector poisoning, public-prefix LLM key leaks (NEXT_PUBLIC_*, VITE_*, EXPO_PUBLIC_*)

AI Host Security

guardvibe doctor — unified host hardening scanner detecting CVE-2025-59536 (hook injection via .claude/settings.json), CVE-2026-21852 (API key exfiltration via ANTHROPIC_BASE_URL override), MCP config audit, environment scanner, permission analysis. Supports Claude, Cursor, VS Code, Gemini, Windsurf. Host-specific remediation with platform-tailored fix steps.

OWASP API Security

BOLA/IDOR (Broken Object Level Authorization), mass assignment (spread request body, Object.assign), missing pagination, rate limiting, admin endpoint authorization, verbose error leaks

Modern Stack

Zod .passthrough() mass assignment, z.any() bypass, file upload validation, server-only import guard, webhook replay protection, CSP headers, unsafe-inline/unsafe-eval detection, cron endpoint auth

Mobile

React Native, Expo — AsyncStorage secrets, deep link token exposure, hardcoded API URLs, ATS configuration

Firebase

Firestore security rules, Firebase Admin SDK exposure, storage rules, custom token validation

CVE Version Intelligence (229 CVEs, refreshed daily)

Frameworks: Next.js (CVE-2024-34351, CVE-2024-46982, CVE-2025-29927, CVE-2026-23869, CVE-2026-44573 / 44574 / 44575 / 44578 / 44579 / 45109 May 2026 cluster), React + react-server-dom-* (CVE-2025-55182, CVE-2026-23870), Express, Hono pre-4.12.18 cluster, @vitejs/plugin-rsc, Strapi content-type-builder (CVE-2026-22599) Auth: Clerk middleware bypass (GHSA-vqx2), Clerk has() org/billing/reverification bypass (GHSA-w24r), Clerk clerkFrontendApiProxy SSRF (CVE-2026-34076), NextAuth.js (2 CVEs), jsonwebtoken ORMs / SQL: Drizzle SQL identifier injection (CVE-2026-39356) + Drizzle sql.raw interpolation (VG1073), MikroORM SQL injection (CVE-2026-44680), Prisma raw-query call-form, Kysely JSON-path traversal (CVE-2026-44635) AI ecosystem: @anthropic-ai/sdk (CVE-2026-34451 + memory tool path escape), Vercel AI SDK file-type bypass (CVE-2025-48985), LangSmith untrusted prompt manifest (CVE-2026-45134), OpenClaude sandbox bypass (CVE-2026-42074), @nyariv/sandboxjs Function.caller escape (CVE-2026-43898) HTTP / parsing: Axios pre-1.15.2 cluster (SSRF + prototype-pollution + DoS + CRLF) + axios proxy-auth redirect leak (VG1071), Hono setCookie attribute injection (VG1072, override pinned ^4.12.21), fast-uri path traversal + host confusion (CVE-2026-6321 / 6322), fast-xml-parser CDATA injection, xmldom CDATA, protobuf.js multi-CVE cluster, undici (2 CVEs), ws Tools / supply chain: node-ipc protestware (VG1069), Miasma @redhat-cloud-services namespace compromise IOC (VG1074), Session messenger exfil endpoint IOC (VG1075), @tanstack/* Mini Shai-Hulud (84 malicious versions, May 2026), @wdio/browserstack-service command injection (CVE-2026-25244), @babel/plugin-transform-modules-systemjs arbitrary code (CVE-2026-44728), @opentelemetry exporter-prometheus DoS (CVE-2026-44902), systeminformation Linux cmd injection (CVE-2026-44724), velocityjs prototype pollution, defu, sharp, lodash, node-fetch, tar, xml2js, crypto-js, angular-expressions RCE, i18next-http-backend, vm2 sandbox breakouts

Deployment & Config

Vercel (vercel.json, cron secrets, headers), Next.js config, Docker, Docker Compose, Fly.io, Render, Netlify, Cloudflare

Infrastructure

Dockerfile security, GitHub Actions CI/CD, Terraform (S3, IAM, RDS, security groups)

Secrets & Environment

API keys (AWS, GitHub, Stripe, OpenAI, Resend, Turso), .env management, .gitignore coverage, high-entropy detection, NEXT_PUBLIC exposure

Compliance Control Mapping

Maps security findings to SOC2, PCI-DSS, HIPAA, GDPR, ISO27001, and EU AI Act (EUAIACT) controls. Identifies which code-level vulnerabilities are relevant to specific compliance requirements. Not a substitute for professional compliance audits.

Supply Chain

Malicious postinstall scripts, unpinned GitHub Actions, CI npm provenance / --ignore-scripts hardening (VG1070), typosquat detection, node-ipc protestware versions (VG1069), Miasma @redhat-cloud-services namespace compromise IOC (VG1074, RHSB-2026-006), Session messenger exfil endpoint IOC (VG1075, filev2.getsession.org), @tanstack/* Mini Shai-Hulud mass-malware versions (May 2026), @wdio/browserstack-service command injection via git branch names (CVE-2026-25244), lockfile poisoning patterns

Prompt-Level Security (Shift Left)

Most vulnerabilities in AI-generated code are born in the prompt: "add login to my app" says nothing about password hashing, session handling, or rate limiting — so the model picks defaults, and the defaults are where the CVEs live. secure_prompt moves the security gate to before code generation: it analyzes the raw prompt, detects the stack and attack surfaces it implies, matches them against GuardVibe's rule set, and returns a directive the host LLM uses to rewrite the prompt with security requirements embedded.

This is not a prompt beautifier. It is deterministic (no LLM, no network), it never restructures intent, and its first job is do no harm: a prompt that is already specific and security-aware gets verdict NO_MOD and passes through untouched.

• NO_MOD — prompt is already specific and security-aware → proceed with the original prompt unchanged
• LIGHT_MOD — intent is clear but security constraints are missing → inject requirements only
• HEAVY_MOD — prompt is vague and security-relevant → inject requirements + surface clarifying questions (never invent the answers)

Before (what the user typed):

add login to my app

After (what the host LLM executes, having applied the secure_prompt directive):

Add login to my app, with these security requirements:
- [VG001] Use environment variables or a secrets manager — never hardcode credentials.
- [VG1008] Always verify the caller has admin privileges before allowing role elevation.
- [VG105] Always specify allowed algorithms explicitly in jwt.verify().

Before implementing, confirm: which framework/stack is this for, and which auth
provider should be used (e.g. Clerk, Auth.js/NextAuth, Supabase Auth, custom JWT)?

Same user intent — but the model now generates auth code with the guardrails stated up front, instead of GuardVibe catching the missing pieces after the fact.

Tools (39 MCP tools)

Tool	What it does
check_code	Analyze a code snippet for security issues
check_project	Scan multiple files with security scoring (A-F)
scan_directory	Scan a project directory from disk
scan_staged	Pre-commit scan of git-staged files — diff-aware (blocks only newly-staged lines; diff_aware:false for whole files)
scan_dependencies	Check all dependencies for known CVEs (OSV) — annotates each vulnerable package with reachability (is it actually imported in your source?)
scan_secrets	Detect leaked secrets, API keys, tokens
check_dependencies	Check individual packages against OSV
check_package_health	Typosquat detection, maintenance status, adoption metrics
compliance_report	Map security findings to compliance controls (SOC2, PCI-DSS, HIPAA, GDPR, ISO27001, EU AI Act)
export_sarif	SARIF v2.1.0 export for CI/CD integration
get_security_docs	Security best practices and guides
fix_code	Auto-fix suggestions with concrete patches for AI agents
secure_this	Close the loop — scan, apply only the fixes that verifiably land (each re-scanned, rolled back on regression), return the verified code + a definition-of-done gate
audit_config	Audit project configuration files for cross-file security misconfigurations
generate_policy	Detect project stack and generate tailored security policies (CSP, CORS, RLS)
review_pr	Review PR diff for security issues with severity gating
scan_secrets_history	Scan git history for leaked secrets (active and removed)
policy_check	Check project against compliance policies defined in .guardviberc
analyze_dataflow	Track tainted data flows from user input to dangerous sinks
analyze_cross_file_dataflow	Cross-file taint analysis — track tainted data across module boundaries
check_command	Analyze shell commands for security risks before execution
scan_config_change	Compare config file versions to detect security downgrades
repo_security_posture	Assess overall repository security posture and map sensitive areas
explain_remediation	Get detailed remediation guidance with exploit scenarios and fix strategies
scan_file	Real-time single-file scan — designed for post-edit hooks
scan_changed_files	Scan only git-changed files — for PRs and incremental CI; diff-aware (only newly-added lines; diff_aware:false for whole files)
security_stats	Cumulative security dashboard — scans, fixes, grade trend over time
guardvibe_doctor	Host security audit — CVE-2025-59536, CVE-2026-21852, MCP config, env scanner
audit_mcp_config	Audit MCP server configurations for hook injection, file:// abuse, sensitive paths
scan_host_config	Scan shell profiles, .env files for base URL hijack and credential sniffing
verify_fix	Verify a security fix was applied correctly — returns fixed/still_vulnerable/new_issues
security_workflow	Get recommended tool workflow for your current task (writing, pre-commit, PR review, etc.)
auth_coverage	Auth coverage map — enumerate routes, parse middleware matchers, detect auth guards, report coverage %
deep_scan	LLM-powered deep analysis — IDOR, business logic, race conditions, auth bypass. Defaults to Claude Haiku 4.5 (~cents/scan). Pass model: 'sonnet' for deeper analysis. CLI: npx guardvibe deep-scan <file> --focus idor
full_audit	Single source of truth — runs ALL checks in one call, returns PASS/FAIL/WARN verdict + score + coverage % + deterministic result hash
remediation_plan	Remediation plan — generates section-by-section fix checklist after audit
verify_remediation	Remediation verification — compares before/after audit, flags skipped sections
secure_prompt	Prompt-level security (shift left) — analyze a coding prompt BEFORE code is written; deterministic triage (NO_MOD/LIGHT_MOD/HEAVY_MOD), stack + attack-surface detection, severity-ranked GuardVibe requirements embedded via a rewrite directive
scan_hallucinated_packages	Slopsquat / AI-hallucination detector — flags phantom imports (imported but in no manifest) and typosquats fully offline + deterministic; opt-in online tier adds npm-registry truth (404 = nonexistent, brand-new low-download = slopsquat pattern). CLI: npx guardvibe slopscan [path] --offline

All scanning tools support format: "json" for machine-readable output.

Slopsquat / hallucinated-package detection

AI assistants invent package names — ~20% of AI-generated code references packages that don't exist, and attackers register those hallucinated names ("slopsquatting"). Commodity SCA scans known, published packages against vuln databases; it can't see a name that doesn't exist yet, was never installed, or was published yesterday. scan_hallucinated_packages / slopscan targets exactly that seam, at code-gen/PR time:

• Offline (deterministic, air-gapped): phantom_import (a package imported in source but absent from every package.json — a classic LLM tell) and typosquats of popular packages. Statement-anchored + comment/template-aware, so example imports in docs/strings are never miscounted.
• Online (opt-in, graceful degrade): npm-registry truth — nonexistent (404), brand-new + low-download (slopsquat-registration pattern), deprecated/unmaintained.

The offline tier is also a full_audit section (online never runs inside the audit, keeping the result hash deterministic). Allowlist intentional unpublished/workspace names via .guardviberc:

{ "slopscan": { "online": true, "allow": ["@myorg/internal-pkg"] } }

Security Rules (604 rules across 25 modules)

Category	Rules	Coverage
Core OWASP	39	SQL injection, XSS, CSRF, command injection, CORS, SSRF, hardcoded secrets
Next.js App Router	18	Server Actions, secret exposure, auth bypass, CSP, redirects
Auth (Clerk / Auth.js / Supabase Auth)	17	Middleware, secret keys, session storage, role checks, SSR cookies
Database (Supabase / Prisma / Drizzle)	13	Raw queries, client exposure, service role leaks, NoSQL injection, Drizzle identifier injection (CVE-2026-39356)
OWASP API Security	11	BOLA/IDOR, mass assignment, pagination, rate limiting, error leaks
Modern Stack	47	Zod, tRPC, Hono, GraphQL, Uploadthing, Turso, Convex, OAuth, CSP, webhooks, AI SDK, React Server Action validation (React2Shell)
Deployment Config	21	Vercel, Next.js config, Docker Compose, Fly, Render, Netlify, Cloudflare, K8s secrets
Payments (Stripe / Polar / Lemon)	9	Webhook signatures, key exposure, price manipulation
Services (Resend / Upstash / Pinecone / PostHog)	11	API key leaks, PII tracking, email injection
Web Security	20	Webhooks, CSP, .env safety, AI key exposure, cookie handling
React Native / Expo	10	AsyncStorage secrets, deep links, ATS, hardcoded URLs
Firebase	7	Firestore rules, admin SDK, storage, custom tokens
AI / LLM Security	33	Prompt injection, MCP SSRF, excessive agency, indirect injection
AI Host Security	14	CVE-2025-59536 hook injection, CVE-2026-21852 base URL hijack, MCP config audit
AI Tool Runtime	14	MCP tool output sanitization, obfuscated descriptions, safety bypass
CVE Version Intelligence	229	Known vulnerable versions in package.json — incl. Vite dev-server cmd injection (CVE-2024-52011), React Router 7 cluster (CVE-2026-33245/42211/42342), DOMPurify XSS (CVE-2026-47423), Better Auth bypass (CVE-2026-45337), Axios supply-chain backdoor
Shell / Bash	5	Pipe to bash, chmod 777, rm -rf, sudo password
SQL	4	DROP/DELETE without WHERE, stacked queries, GRANT ALL
Supply Chain	19	Malicious install scripts, lockfile integrity, dependency confusion, typosquat detection
Go	6	SQL injection, command injection, template escaping
Dockerfile	7	Root user, secrets in ENV, untagged images, non-root user
CI/CD (GitHub Actions)	8	Secrets interpolation, unpinned actions, write-all permissions
Terraform	6	Public S3, open security groups, IAM wildcards
Advanced Security	31	ReDoS, CRLF injection, race conditions, XXE, brute force, audit logging
Other Services	5	AWS, GCP, MongoDB, Convex, Sentry, Twilio

CLI Commands

# Scanning
npx guardvibe scan [path]            # Scan a directory for security issues
npx guardvibe scan . --format json   # JSON output for automation
npx guardvibe check <file>           # Scan a single file
npx guardvibe diff [base]            # Scan changed files — reports only newly-introduced issues
npx guardvibe diff [base] --all-lines # Include pre-existing findings in changed files too

# Close the loop — scan, apply verified fixes, re-verify
npx guardvibe secure-this <file>          # Dry run: show the fixes that would land + remaining manual work
npx guardvibe secure-this <file> --write  # Apply only the fixes that re-verify clean (rolled back on regression)
npx guardvibe secure-this <file> --format json

# Full security audit
npx guardvibe audit [path]           # Full audit with PASS/FAIL verdict + hash
npx guardvibe audit . --format json  # JSON output for CI pipelines
npx guardvibe audit --skip-deps      # Skip dependency CVE check
npx guardvibe audit --full           # Disable MCP-output truncation (full finding set)

# Host security audit
npx guardvibe doctor                 # Host hardening audit (project scope)
npx guardvibe doctor --scope host    # + shell profiles, global MCP configs
npx guardvibe doctor --scope full    # + home dir configs
npx guardvibe doctor --format json   # JSON output

# LLM-powered deep scan (IDOR, business logic, race conditions, auth bypass)
npx guardvibe deep-scan <file>                  # Default: Haiku 4.5, all focus areas
npx guardvibe deep-scan <file> --focus idor     # Narrow to IDOR
npx guardvibe deep-scan <file> --model sonnet   # Deeper analysis (more expensive)
npx guardvibe deep-scan <file> --max-bytes 5000 # Truncate input for cost control
# Requires ANTHROPIC_API_KEY or OPENAI_API_KEY env var

# Setup
npx guardvibe init <platform>       # Setup MCP server (claude, cursor, gemini, all)
npx guardvibe hook install           # Install pre-commit hook
npx guardvibe hook uninstall         # Remove pre-commit hook
npx guardvibe ci github              # Generate GitHub Actions workflow

# Pre-commit / CI
npx guardvibe-scan                   # Scan staged files (for pre-commit)
npx guardvibe-scan --format sarif --output results.sarif  # CI mode

# Options (scan commands)
#   --format <type>     scan / diff: markdown|json|sarif
#                       check:       markdown|json|sarif|buddy|agent
#       agent = guardvibe.agent.v1 — per finding: { id, severity, confidence, exactEdit, manualFix, verify }
#       so an AI agent can apply the exact edit and run the verify step to prove the fix
#       (an unsupported format errors rather than silently falling back to markdown)
#   --output <file>     Write results to file
#   --fail-on <level>   critical|high|medium|low|none — exit 1 when a finding at/above this level exists
#       check, audit, and the pre-commit gate (guardvibe-scan / scan --staged) gate on
#       critical by DEFAULT; scan and diff are reports (exit 0) unless --fail-on is passed
#   --full              Bypass response-size caps (50 JSON / 30 markdown / 200-file taint)

Plugin System

Extend GuardVibe with custom or community rule packs.

npm install guardvibe-rules-awesome

Plugins matching guardvibe-rules-*, @guardvibe/rules-*, or @guardvibe-pro/rules-* are discovered automatically.

Writing a Plugin

A plugin is an npm package that exports a GuardVibePlugin object:

// index.ts
import type { GuardVibePlugin } from "guardvibe/plugins";

const plugin: GuardVibePlugin = {
  name: "my-rules",
  version: "1.0.0",
  description: "My custom security rules",
  rules: [
    {
      id: "CUSTOM001",
      name: "My Custom Rule",
      severity: "high",       // "critical" | "high" | "medium" | "low" | "info"
      owasp: "A01:2025 Broken Access Control",
      description: "What this rule detects and why it's dangerous",
      pattern: /vulnerable_pattern_here/g,   // RegExp with global flag
      languages: ["javascript", "typescript"], // which file types to scan
      fix: "How to fix the vulnerability",
      fixCode: "// Copy-paste secure code example",
      compliance: ["SOC2:CC6.1"],  // optional compliance mapping
    },
  ],
};

export default plugin;

Plugin Rule Schema

Field	Type	Required	Description
id	string	Yes	Unique rule ID (e.g., "CUSTOM001")
name	string	Yes	Human-readable rule name
severity	string	Yes	critical, high, medium, low, or info
owasp	string	Yes	OWASP category mapping
description	string	Yes	What the rule detects
pattern	RegExp	Yes	Regex pattern to match vulnerable code (use /g flag)
languages	string[]	Yes	File types to scan
fix	string	Yes	How to fix the issue
fixCode	string	No	Copy-paste secure code example
compliance	string[]	No	SOC2/PCI-DSS/HIPAA control IDs

Loading Plugins

Plugins are loaded from three sources:

1. Auto-discovery: Any installed npm package matching guardvibe-rules-* or @guardvibe/rules-*
2. Config-specified: Packages listed in .guardviberc plugins array
3. Local paths: Relative paths in .guardviberc plugins array

// .guardviberc
{
  "plugins": [
    "guardvibe-rules-awesome",
    "./my-local-rules"
  ]
}

Configuration

Create a .guardviberc file in your project root:

{
  "rules": {
    "disable": ["VG030"],
    "severity": {
      "VG002": "medium"
    }
  },
  "scan": {
    "exclude": ["fixtures/", "coverage/"],
    "maxFileSize": 1048576
  },
  "plugins": ["guardvibe-rules-awesome"]
}

Inline Suppression

const key = process.env.API_KEY; // guardvibe-ignore VG001

// guardvibe-ignore-next-line VG002
app.get("/api/health", (req, res) => res.json({ ok: true }));

Supports //, #, and <!-- --> comment styles.

GuardVibe Scans Itself

We run GuardVibe on its own codebase as a pre-commit hook. Every commit is scanned before it reaches the repository — the same workflow GuardVibe enables for your projects.

How It Works

You write code with AI
    |
AI agent calls GuardVibe MCP tools
    |
GuardVibe scans locally (no cloud, no API)
    |
Returns findings with severity, OWASP mapping, and fix suggestions
    |
AI agent fixes issues before they reach production

Performance

Tested on real AI-built projects (837 files, Next.js + Supabase + Clerk):

• Scan time: ~1.2s (837 files)
• False positive rate: near zero — context-aware detection (React Native, Supabase client/server, static innerHTML, git-aware secrets)
• Detection rate: 100% on known vulnerability patterns
• Security score: A (99/100) on production projects

Troubleshooting

MCP connection issues

If your AI agent cannot connect to GuardVibe:

1. Restart your IDE/agent. MCP servers are started by the host application. After running npx guardvibe init, restart Claude Code, Cursor, or Gemini CLI for the config to take effect.
2. Check the config path. Run npx guardvibe init claude again and verify the output shows the correct config file location (.mcp.json in your project root for Claude Code, .cursor/mcp.json for Cursor).
3. Re-run init to upgrade. When upgrading GuardVibe, re-run npx guardvibe init claude — .mcp.json is pinned to a specific version (e.g. guardvibe@3.1.36) at init time for fast deterministic startup. As of v3.1.2 the re-run also rewrites stale pins automatically (Upgraded GuardVibe pin (3.1.27 → 3.1.28)); since v3.1.27 the PostToolUse hook command is pinned to the same version (was @latest) and re-run upgrades a stale hook too. The same applies to npx guardvibe hook install and npx guardvibe ci github (since v3.1.3) — both are version-pinned at install/generate time and re-run to upgrade.
4. Pre-3.1.1 users won't see the auto-update banner. GuardVibe started writing a once-per-day "newer version available" notice to stderr in v3.1.1. If your install predates that, you'll never see it — run npx -y guardvibe@latest init <host> once to bake in the latest pin and start receiving banners on subsequent sessions.
5. Verify Node.js version. GuardVibe requires Node.js >= 18.0.0. Check with node --version.
6. Check npx cache. If you upgraded GuardVibe and the old version is cached, run npx -y guardvibe@latest to force the latest version.

Node.js version requirements

GuardVibe requires Node.js >= 18.0.0. Earlier versions will fail with syntax errors or missing APIs. Node.js 22 LTS is recommended.

False positives

If a rule triggers on safe code:

• Inline suppression: Add // guardvibe-ignore VG001 on the same line, or // guardvibe-ignore-next-line VG001 on the line above. Supports //, #, and <!-- --> comment styles.
• Config exclusion: Add the rule ID to rules.disable in .guardviberc:

  { "rules": { "disable": ["VG030"] } }
  

• Path exclusion: Add directories to scan.exclude in .guardviberc:

  { "scan": { "exclude": ["fixtures/", "test-data/"] } }
  

Pre-commit hook issues

• Hook not running: Verify the hook file exists at .git/hooks/pre-commit and is executable (chmod +x .git/hooks/pre-commit).
• Hook blocking valid commits: Use git commit --no-verify to skip the hook temporarily, then investigate the findings.
• Removing the hook: Run npx guardvibe hook uninstall.

Security Model

GuardVibe is designed for use on sensitive and proprietary codebases:

• 100% local execution. All scanning happens on your machine. No code, findings, or metadata are sent to any server.
• No accounts, no API keys, no telemetry. There is no signup, no cloud dashboard, and no usage tracking of any kind.
• One optional network call. The scan_dependencies and check_dependencies tools query the OSV API to check for known CVEs. This is opt-in -- you only call it when you explicitly use those tools. No other tool makes network requests.
• Safe for air-gapped environments. All code analysis rules run entirely offline. Only dependency vulnerability checks require network access.

Configuration (.guardviberc)

Create a .guardviberc JSON file in your project root to customize GuardVibe behavior.

Full example

{
  "rules": {
    "disable": ["VG030", "VG045"],
    "severity": {
      "VG002": "medium",
      "VG010": "low"
    }
  },
  "scan": {
    "exclude": ["fixtures/", "coverage/", "dist/", "vendor/"],
    "maxFileSize": 1048576
  },
  "plugins": [
    "guardvibe-rules-awesome",
    "./my-local-rules"
  ],
  "compliance": {
    "frameworks": ["SOC2", "HIPAA"],
    "failOn": "high",
    "exceptions": [
      {
        "ruleId": "VG030",
        "reason": "Accepted risk per security review 2026-03",
        "approvedBy": "security-team",
        "expiresAt": "2026-12-31",
        "files": ["src/legacy/**"]
      }
    ],
    "requiredControls": ["SOC2:CC6.1"]
  },
  "scoring": {
    "densityModel": "exponential"
  }
}

Configuration fields

Field	Type	Default	Description
rules.disable	string[]	[]	Rule IDs to skip during scanning
rules.severity	Record<string, string>	{}	Override severity for specific rules
scan.exclude	string[]	[]	Glob patterns for directories/files to skip
scan.maxFileSize	number	512000	Maximum file size in bytes (files larger than this are skipped)
plugins	string[]	[]	npm package names or local paths to load as plugins
compliance.frameworks	string[]	--	Compliance frameworks to map against (SOC2, PCI-DSS, HIPAA, GDPR, ISO27001)
compliance.failOn	string	"high"	Minimum severity that causes compliance failure
compliance.exceptions	PolicyException[]	[]	Approved exceptions with expiration dates
compliance.requiredControls	string[]	--	Controls that must pass regardless of exceptions
scoring.densityModel	"linear" | "exponential"	"linear"	Score decay curve. linear matches pre-v3.0.50 (cliff at density 5). exponential keeps resolution past density 5 — smoother decay for large repos. Severity caps (1+ critical → max C/60, 1+ high → max B/75) apply under both.

Security

GuardVibe takes supply chain security seriously:

• npm provenance — every published version is cryptographically signed via Sigstore, linking the package to this exact GitHub repo and commit. Verify with npm audit signatures
• 2FA enabled — npm account protected with two-factor authentication
• Branch protection — force push disabled on main, admin enforcement enabled
• Tag protection — version tags (v*) cannot be deleted or force-pushed
• Minimal CI permissions — GitHub Actions workflows use permissions: contents: read only
• Minimal, fully-audited runtime dependencies — only three direct dependencies: the MCP SDK, Zod, and the TypeScript compiler (used for AST-based dataflow analysis). Zod and TypeScript are zero-sub-dependency, pure-JS packages. The MCP SDK pulls a small set of widely-used, audited transitive packages (e.g. express, cors, ajv) for its optional HTTP transport — GuardVibe itself runs over stdio. No native bindings anywhere in the tree, and all code analysis runs 100% locally and offline

To report a vulnerability, please email info@goklab.com or open a GitHub issue.

License

Apache 2.0 — open source, patent-safe, enterprise-ready. Built by GokLab.