What kind of security rules does GuardVibe include?
It covers 300+ rules across 20+ modules including web, authentication, database, API, cloud, AI/LLM, supply chain, mobile, frontend, and secrets detection.
GuardVibe — Security MCP for Vibe Coding
@goklab
基本情報
GuardVibe — Security MCP for Vibe Coding について
Security MCP server with 300+ rules for AI-generated code. Scans Next.js, Supabase, Clerk, Stripe, Prisma, Hono, GraphQL, and 20+ modules. Zero config, runs locally.
GuardVibe — Security MCP for Vibe Coding の設定
以下の設定を使って、このサーバーを MCP 対応クライアントに追加してください。
{
"mcpServers": {
"guardvibe": {
"command": "npx",
"args": [
"-y",
"guardvibe"
]
}
}
}GuardVibe — Security MCP for Vibe Coding のツール
29Analyze code for security vulnerabilities (OWASP Top 10, XSS, SQL injection, insecure patterns). Use this when reviewing or writing code to catch security issues early.
Scan multiple files for security vulnerabilities and generate a project-wide security report with a security score. Use this for comprehensive security audits.
Get security best practices and guidance for a specific topic, framework, or vulnerability type. Use this to learn how to write secure code.
Check npm, PyPI, or Go packages for known security vulnerabilities (CVEs) using the OSV database. Use this before adding new dependencies or to audit existing ones.
Scan an entire project directory for security vulnerabilities. Reads files directly from the filesystem — no need to pass file contents. Returns a security score (A-F) and detailed findings. Includes scan metadata (ID, timestamp, duration, file hashes) for audit trails. Use baseline to compare with a previous scan.
Parse a lockfile or manifest (package.json, package-lock.json, requirements.txt, go.mod) and check all dependencies for known CVEs via the OSV database. Reads the file directly.
Scan files and directories for leaked secrets, API keys, tokens, and credentials. Checks .env files, config files, and source code. Verifies .gitignore coverage.
Scan git-staged files for security vulnerabilities before committing. Run this before every commit to catch issues early. No input needed — automatically reads staged files.
Generate a compliance-focused security report mapped to SOC2, PCI-DSS, HIPAA, GDPR, or ISO27001 controls. Scans a directory and groups findings by compliance control. Includes exploit scenarios and audit evidence for each finding. Use mode=executive for a C-level summary.
Scan a directory and export results in SARIF v2.1.0 format for CI/CD integration (GitHub, GitLab, Azure DevOps). Returns JSON string.
Check npm packages for typosquat risk, maintenance status, adoption metrics, and deprecation. Use this before adding new dependencies to catch suspicious or risky packages.
Analyze code for security vulnerabilities and return fix suggestions with concrete patches. The AI agent can apply these patches to automatically fix issues. Returns structured fix data including before/after code, severity, and line numbers.
Audit project configuration files (next.config, middleware/proxy, .env, vercel.json) together for cross-file security issues. Detects gaps that single-file scanning misses: missing security headers, unprotected routes, exposed secrets, middleware/route mismatches.
Scan a project to detect its stack (Next.js, Supabase, Stripe, etc.) and generate tailored security policies: CSP headers, CORS config, Supabase RLS suggestions, rate limiting config, and security headers.
Review a pull request for security issues. Scans only changed lines (diff-only mode) and produces output for GitHub Check Runs, PR comments, or inline annotations. Supports severity gating to block PRs.
Scan git history for leaked secrets. Finds secrets that were committed in the past — even if they were later removed. Marks each finding as 'active' (still in code) or 'removed' (in git history only, needs rotation).
Check project against compliance policies defined in .guardviberc. Supports custom frameworks, severity thresholds, required controls, and risk exceptions. Returns pass/fail with details.
Track user input (request body, URL params, form data) flowing into dangerous sinks (SQL queries, eval, file operations, redirects). Detects injection vulnerabilities that regex rules miss by following variable assignments through code.
Track user input flowing across module boundaries — detects injection vulnerabilities that span multiple files. Resolves imports/exports, builds a module graph, and follows tainted data from HTTP handlers through helper functions to dangerous sinks (SQL, eval, redirect, file ops). Pass all related files for best results.
Analyze a shell command for security risks before execution. Returns allow/ask/deny verdict with blast radius, safer alternatives, and context-aware risk assessment. Detects: destructive ops, git history rewrites, secret exposure, data exfiltration, deploy triggers, privilege escalation, database drops.
Compare before/after versions of a config file to detect security downgrades: CORS relaxation, CSP weakening, HSTS removal, debug mode, cookie flag changes, TLS disabling, new hardcoded secrets, removed security headers.
Analyze a repository's overall security posture. Maps sensitive areas (auth, payments, PII, admin, API, infrastructure), identifies high-risk workflows, recommends guard mode, and lists priority fixes.
Deep explanation of a security finding: why it's risky, real-world impact, exploit scenario, minimum fix, secure alternative, breaking risk assessment, and test strategy. Helps agents apply fixes correctly.
Scan a single file from disk for security vulnerabilities. Returns only findings (no boilerplate). Designed for real-time use: call this after editing a file to catch security issues immediately. Lightweight and fast — reads the file, detects language, and returns findings in JSON.
Scan only files that have changed since a given git ref (branch, commit, or HEAD~N). Ideal for PR checks, pre-push hooks, and incremental CI. Returns findings only for modified/added files.
Show cumulative security statistics, grade trend, and vulnerability fix progress for this project. Use this to demonstrate the value of GuardVibe security scanning over time. Data is stored locally in .guardvibe/stats.json.
Scan MCP configuration files (.claude/settings.json, .cursor/mcp.json, .vscode/mcp.json) for security issues: malicious hooks (CVE-2025-59536), suspicious MCP servers, overly permissive tool access, and shell injection patterns. Use this to verify MCP configurations are safe before use.
Scan host environment for AI security issues: API base URL hijacking (CVE-2026-21852), credential exposure in shell profiles, .env file leaks, and environment variable sniffing. Checks .env files at project scope; add scope=host to also check shell profiles and global AI configs.
Comprehensive AI host security audit. Scans MCP configurations, hooks, environment variables, shell profiles, and permissions for known attack vectors (CVE-2025-59536 hook injection, CVE-2026-21852 base URL hijack, tool result injection, supply chain attacks). Reports trust state, verdict, and confidence for each finding. Supports allowlists via .guardviberc. Use scope=project (default) for project-only scan, scope=host to include shell profiles and global configs.
概要
What is GuardVibe?
GuardVibe is a security MCP server with 300+ security rules designed to protect AI-generated code from the first line to production deployment. It works with Claude Code, Cursor, Gemini CLI, Codex, VS Code (Copilot), Windsurf, and any MCP-compatible coding agent.
How to use GuardVibe?
Install and configure GuardVibe by adding it as an MCP server in your agent’s configuration using the command npx -y guardvibe. No account or API keys are required; scanning starts immediately with zero setup.
Key features of GuardVibe
- 300+ security rules for Next.js, Supabase, Clerk, Stripe, Prisma, and more
- 20+ tools — scan files, check code, fix vulnerabilities, export SARIF
- Zero setup — run
npx guardvibeand start scanning - 100% local execution — no account or API keys needed
- CVE detection for 20+ known vulnerable package versions
- Pre-commit hook to block insecure code before it reaches your repo
Use cases of GuardVibe
- Scan AI-generated code for security vulnerabilities before committing
- Auto-fix common security issues in web frameworks and authentication modules
- Detect prompt injection and MCP server vulnerabilities in agent workflows
- Block insecure dependencies and known CVEs during development
- Generate security policies and export findings in SARIF format
よくある質問
Do I need an account or API keys to use GuardVibe?
No. GuardVibe runs 100% locally, requires no account, and does not send your code anywhere.
Which coding agents does GuardVibe work with?
It works with Claude Code, Cursor, Gemini CLI, Codex, VS Code (Copilot), Windsurf, and any MCP-compatible coding agent.
How do I enable GuardVibe in my MCP configuration?
Add the following to your MCP server configuration: `{"mcpServers": {"guardvibe": {"command": "npx", "args": ["-y", "guardvibe"]}}}`.
Can GuardVibe automatically fix vulnerabilities?
Yes, GuardVibe provides concrete auto-fix patches that the AI agent can apply directly.
「開発者ツール」の他のコンテンツ
Modelglass
ModelglassModelglass turns "which model should I use?" into a lookup instead of a guess. Seven tools give your agent live pricing across image, language, video, and audio models. Sourced and versioned, not scraped once and forgott
1
Heard
HeardLet your cloud agents talk to you. Grok Bot, Meta Muse, ChatGPT, Claude, Devin and others report progress to Heard, which reads it out loud on your Mac, and they pick up the replies you send back.
UXMachine
UXMachineUXMachine measures a web page in a real browser and returns verifiable observations, each with its evidence and its limits. It opens the address on desktop (1280×800) and mobile (390×844) and follows the site's own links
Foremerge
naw103Catch intent conflicts before code conflicts. The open-source coordination protocol for coding agents, built above Git.
50
Total CMS
Joe WorkmanRead-only Total CMS docs and site content over MCP: exact Twig signatures, field types, schema options, the CLI, release notes and comparisons. No key required.
コメント