Guardvibe
未申請Security infrastructure your AI can't be — deterministic, daily CVE intel past your model's training cutoff, whole-repo-aware, author-independent, and shift-left: secure_prompt secures the prompt before code generation. The security MCP for vibe coding: 450 rules, 39 tools, CLI + doctor for Next.js, Supabase, Clerk, Stripe, Prisma, Hono & MCP.
インストール
npx guardvibe init claude未申請リスティング
このMCPサーバーはあなたのものですか？
このリスティングは公開情報から自動的にインデックスされました。申請することで、ページの編集、互換性の設定、成長ツールのアンロックができます。2分以内に完了します。
このサーバーを申請するツール（39個）
analyze_cross_file_dataflow
Cross-file taint analysis — track tainted data across module boundaries
analyze_dataflow
Track tainted data flows from user input to dangerous sinks
audit_config
Audit project configuration files for cross-file security misconfigurations
audit_mcp_config
Audit MCP server configurations for hook injection, file:// abuse, sensitive paths
auth_coverage
Auth coverage map — enumerate routes, parse middleware matchers, detect auth guards, report coverage %
check_code
Analyze a code snippet for security issues
check_command
Analyze shell commands for security risks before execution
check_dependencies
Check individual packages against OSV
check_package_health
Typosquat detection, maintenance status, adoption metrics
check_project
Scan multiple files with security scoring (A-F)
compliance_report
Map security findings to compliance controls (SOC2, PCI-DSS, HIPAA, GDPR, ISO27001, EU AI Act)
deep_scan
LLM-powered deep analysis — IDOR, business logic, race conditions, auth bypass. Defaults to Claude Haiku 4.5 (~cents/scan). Pass model: 'sonnet' for deeper analysis. CLI: npx guardvibe deep-scan <file> --focus idor
explain_remediation
Get detailed remediation guidance with exploit scenarios and fix strategies
export_sarif
SARIF v2.1.0 export for CI/CD integration
fix_code
Auto-fix suggestions with concrete patches for AI agents
full_audit
Single source of truth — runs ALL checks in one call, returns PASS/FAIL/WARN verdict + score + coverage % + deterministic result hash
generate_policy
Detect project stack and generate tailored security policies (CSP, CORS, RLS)
get_security_docs
Security best practices and guides
guardvibe_doctor
Host security audit — CVE-2025-59536, CVE-2026-21852, MCP config, env scanner
policy_check
Check project against compliance policies defined in .guardviberc
remediation_plan
Remediation plan — generates section-by-section fix checklist after audit
repo_security_posture
Assess overall repository security posture and map sensitive areas
review_pr
Review PR diff for security issues with severity gating
scan_changed_files
Scan only git-changed files — for PRs and incremental CI; diff-aware (only newly-added lines; diffaware:false for whole files)
scan_config_change
Compare config file versions to detect security downgrades
scan_dependencies
Check all dependencies for known CVEs (OSV) — annotates each vulnerable package with reachability (is it actually imported in your source?)
scan_directory
Scan a project directory from disk
scan_file
Real-time single-file scan — designed for post-edit hooks
scan_hallucinated_packages
Slopsquat / AI-hallucination detector — flags phantom imports (imported but in no manifest) and typosquats fully offline + deterministic; opt-in online tier adds npm-registry truth (404 = nonexistent, brand-new low-download = slopsquat pattern). CLI: npx guardvibe slopscan [path] --offline
scan_host_config
Scan shell profiles, .env files for base URL hijack and credential sniffing
scan_secrets
Detect leaked secrets, API keys, tokens
scan_secrets_history
Scan git history for leaked secrets (active and removed)
scan_staged
Pre-commit scan of git-staged files — diff-aware (blocks only newly-staged lines; diffaware:false for whole files)
secure_prompt
Prompt-level security (shift left) — analyze a coding prompt BEFORE code is written; deterministic triage (NOMOD/LIGHTMOD/HEAVYMOD), stack + attack-surface detection, severity-ranked GuardVibe requirements embedded via a rewrite directive
secure_this
Close the loop — scan, apply only the fixes that verifiably land (each re-scanned, rolled back on regression), return the verified code + a definition-of-done gate
security_stats
Cumulative security dashboard — scans, fixes, grade trend over time
security_workflow
Get recommended tool workflow for your current task (writing, pre-commit, PR review, etc.)
verify_fix
Verify a security fix was applied correctly — returns fixed/stillvulnerable/newissues
verify_remediation
Remediation verification — compares before/after audit, flags skipped sections