Guardvibe
UnclaimedSecurity infrastructure your AI can't be — deterministic, daily CVE intel past your model's training cutoff, whole-repo-aware, author-independent, and shift-left: secure_prompt secures the prompt before code generation. The security MCP for vibe coding: 450 rules, 39 tools, CLI + doctor for Next.js, Supabase, Clerk, Stripe, Prisma, Hono & MCP.
Install
npx guardvibe init claudeSet up this server
More in Databases
Browse the full directoryUnclaimed listing
Is this your MCP server?
This listing was auto-indexed from the public record. Claim it to edit the page, set compatibility and unlock growth tools. Takes under two minutes.
Claim this serverSecurity profile
Claimed and verified servers get a weekly static scan that shows what the code can reach: external services, environment variables, shell commands, agent configuration folders, plus any dependencies with known advisories. Claim this listing to get one. How the security profile works
39 of 39 tools
Documented tools (39)
From project documentation. A server handshake does not verify each tool’s description or behavior.
analyze_cross_file_dataflow
Cross-file taint analysis — track tainted data across module boundaries
analyze_dataflow
Track tainted data flows from user input to dangerous sinks
audit_config
Audit project configuration files for cross-file security misconfigurations
audit_mcp_config
Audit MCP server configurations for hook injection, file:// abuse, sensitive paths
auth_coverage
Auth coverage map — enumerate routes, parse middleware matchers, detect auth guards, report coverage %
check_code
Analyze a code snippet for security issues
check_command
Analyze shell commands for security risks before execution
check_dependencies
Check individual packages against OSV
check_package_health
Typosquat detection, maintenance status, adoption metrics
check_project
Scan multiple files with security scoring (A-F)
compliance_report
Map security findings to compliance controls (SOC2, PCI-DSS, HIPAA, GDPR, ISO27001, EU AI Act)
deep_scan
LLM-powered deep analysis — IDOR, business logic, race conditions, auth bypass. Defaults to Claude Haiku 4.5 (~cents/scan). Pass model: 'sonnet' for deeper analysis. CLI: npx guardvibe deep-scan <file> --focus idor
explain_remediation
Get detailed remediation guidance with exploit scenarios and fix strategies
export_sarif
SARIF v2.1.0 export for CI/CD integration
fix_code
Auto-fix suggestions with concrete patches for AI agents
full_audit
Single source of truth — runs ALL checks in one call, returns PASS/FAIL/WARN verdict + score + coverage % + deterministic result hash
generate_policy
Detect project stack and generate tailored security policies (CSP, CORS, RLS)
get_security_docs
Security best practices and guides
guardvibe_doctor
Host security audit — CVE-2025-59536, CVE-2026-21852, MCP config, env scanner
policy_check
Check project against compliance policies defined in .guardviberc
remediation_plan
Remediation plan — generates section-by-section fix checklist after audit
repo_security_posture
Assess overall repository security posture and map sensitive areas
review_pr
Review PR diff for security issues with severity gating
scan_changed_files
Scan only git-changed files — for PRs and incremental CI; diff-aware (only newly-added lines; diffaware:false for whole files)
scan_config_change
Compare config file versions to detect security downgrades
scan_dependencies
Check all dependencies for known CVEs (OSV) — annotates each vulnerable package with reachability (is it actually imported in your source?)
scan_directory
Scan a project directory from disk
scan_file
Real-time single-file scan — designed for post-edit hooks
scan_hallucinated_packages
Slopsquat / AI-hallucination detector — flags phantom imports (imported but in no manifest) and typosquats fully offline + deterministic; opt-in online tier adds npm-registry truth (404 = nonexistent, brand-new low-download = slopsquat pattern). CLI: npx guardvibe slopscan [path] --offline
scan_host_config
Scan shell profiles, .env files for base URL hijack and credential sniffing
scan_secrets
Detect leaked secrets, API keys, tokens
scan_secrets_history
Scan git history for leaked secrets (active and removed)
scan_staged
Pre-commit scan of git-staged files — diff-aware (blocks only newly-staged lines; diffaware:false for whole files)
secure_prompt
Prompt-level security (shift left) — analyze a coding prompt BEFORE code is written; deterministic triage (NOMOD/LIGHTMOD/HEAVYMOD), stack + attack-surface detection, severity-ranked GuardVibe requirements embedded via a rewrite directive
secure_this
Close the loop — scan, apply only the fixes that verifiably land (each re-scanned, rolled back on regression), return the verified code + a definition-of-done gate
security_stats
Cumulative security dashboard — scans, fixes, grade trend over time
security_workflow
Get recommended tool workflow for your current task (writing, pre-commit, PR review, etc.)
verify_fix
Verify a security fix was applied correctly — returns fixed/stillvulnerable/newissues
verify_remediation
Remediation verification — compares before/after audit, flags skipped sections
Tool change history
FAQ
Questions about Guardvibe MCP Server
- How do I connect Guardvibe MCP Server to Claude?
- The listing records `npx guardvibe init claude` as its setup step. Run it, then follow the repository's instructions for the client configuration; the listing names Claude Code, Cursor, Windsurf as compatible clients.
- Is Guardvibe MCP Server free?
- The listed licence is Apache-2.0. Check the upstream terms for permitted use and commercial requirements; a public repository does not by itself mean the software is free or open source. Connected APIs and hosted services may have separate charges.
- What can Guardvibe MCP Server do?
- Guardvibe MCP Server documents 39 tools to the agent, including analyze_cross_file_dataflow, analyze_dataflow, audit_config. The descriptions above come from project documentation. A live handshake does not test individual tool behavior.