SuperAPI AI Directory
Partner with us中文AI newsFavorites
All toolsAI developer platformsguardvibe

guardvibe

Security scanner for vibe-coded apps (Next.js, Supabase, Stripe, Prisma and more): taint analysis, auto-fix, SARIF export, pre-commit hook and CVE detection.

Open website

About this tool

GuardVibe is positioned as the "security infrastructure layer" that AI coding agents cannot replace, with its core argument being: no matter how powerful a coding agent is, it cannot perform deterministic checks, master CVEs published after its training cutoff, hold an entire repository in context, or objectively review code it generated itself. GuardVibe claims to fill these four structural gaps.

Purpose GuardVibe is used to provide security verification throughout the entire AI-assisted coding (vibe coding) workflow, covering every stage from prompts to production deployment. It is aimed at developers using AI to quickly build and ship web applications, not enterprise security teams.

Main capabilities

  • Deterministic scanning: the same code produces the same result every run (based on content hashing), avoiding model guesswork-style output.
  • Full-repository awareness: cross-file taint analysis and authentication coverage checks for each route can uncover unprotected endpoints missed by an agent's narrow context.
  • CVE version intelligence: refreshed daily from GHSA / OSV.dev / CISA KEV, it detects package versions in package.json that are known to be vulnerable and can flag vulnerabilities published after the model's training cutoff. Officially stated to have 214 CVE version pinning rules as of the latest version.
  • AI agent and MCP security: detects MCP server vulnerabilities, prompt injection in tool descriptions (OWASP MCP Top 10), model-controllable sandbox-disabling flags, excessive AI permissions, and indirect prompt injection.
  • Automatic fix suggestions: the fix_code tool returns concrete patches and structured edits for AI agents to apply mechanically. The officially listed coverage includes migrating hardcoded credentials to environment variables, removing publicly prefixed LLM key prefixes (NEXT_PUBLIC_ / VITE_ / EXPO_PUBLIC_ / REACT_APP_), changing CORS wildcards to environment allowlists, removing the dangerouslyAllowBrowser flag, removing sandbox bypass flags (unsafe / noSandbox / allowEval), adding maxSteps to agent loops, changing raw HTML React attributes to <ReactMarkdown>, inserting authentication guards for missing authentication, changing SQL injection to parameterized queries, and using code snippet templates for missing rate limiting/CSRF/security response headers.
  • secure_prompt: analyzes coding prompts before code generation, identifies theirimplicit tech stack and attack surface, and embeds severity-ordered GuardVibe requirements into the prompt so vulnerabilities are prevented rather than caught after the fact. It is officially stated to be deterministic, make zero LLM calls, and pass through unchanged if the prompt is already secure.
  • Delivery formats and integrations: CLI and doctor; pre-commit hooks can block insecure code before it enters the repository; CI/CD-ready, with a GitHub Actions workflow and SARIF uploaded to the Security tab; output formats include JSON for AI agents, Markdown for humans, and SARIF for CI/CD; a plugin system is provided to extend community or premium rule packs.
  • MCP service: officially stated to include 589 security rules and 39 tools, covering the entire AI-generated code workflow from prompts to production deployment, and can be used with Claude Code, Cursor, Gemini CLI, Codex, VS Code (Copilot), Windsurf, and other MCP-compatible coding agents.

Usage

  • Officially described as having zero configuration friction: run npx guardvibe to start scanning; no account required, 100% local operation, no API keys, no cloud service.
  • npm run intel performs daily CVE intelligence triage (official description).
  • The repository is on GitHub:https://github.com/goklab/guardvibe。

Use cases

  • Individual developers using AI coding agents to quickly build web applications.
  • Teams that need to add security gates in CI/CD and block insecure code before commit.
  • AI coding workflows that need real-time edit hook feedback during coding rather than post-hoc audits.
  • Projects using tech stacks such as Next.js, Supabase, Clerk, Stripe, Prisma, Hono, and MCP.

Limitations and notes

  • The capabilities above, the number of rules (such as 589 rules, 39 tools, and 214 CVE version-pinning rules), and the newly added content in versions all come from official descriptions. Actual availability is subject to the project's current release; this summary does not guarantee its accuracy.
  • The large number of CVE IDs and entries listed in the official version notes only reflect updates to its rule library and do not provide complete details for each entry.
  • Apart from the officially described local operation and no account or API key being required, other pricing, cost, or platform information is not yet provided.
  • Compatibility with various AI coding agents is an official claim; the specific configuration methods and steps are not provided in the materials.
  • It is categorized under the AI development platform category based on its positioning as a security scanning and development platform tool.

Related tools

Browse category