audit_mcp_config
Audit MCP server configurations for hook injection, file:// abuse, sensitive paths
How to use it
Project documentation lists audit_mcp_config for the Guardvibe MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), then check which tools your installed version makes available. Tool availability can depend on configuration and credentials. A server handshake does not verify this tool’s behavior. See the full listing for setup details.
Install Guardvibe
npx guardvibe init claudeOther tools in Guardvibe (38)
Cross-file taint analysis — track tainted data across module boundaries
Track tainted data flows from user input to dangerous sinks
Audit project configuration files for cross-file security misconfigurations
Auth coverage map — enumerate routes, parse middleware matchers, detect auth guards, report coverage %
Analyze a code snippet for security issues
Analyze shell commands for security risks before execution
Check individual packages against OSV
Typosquat detection, maintenance status, adoption metrics
Scan multiple files with security scoring (A-F)
Map security findings to compliance controls (SOC2, PCI-DSS, HIPAA, GDPR, ISO27001, EU AI Act)
LLM-powered deep analysis — IDOR, business logic, race conditions, auth bypass. Defaults to Claude Haiku 4.5 (~cents/scan). Pass model: 'sonnet' for deeper analysis. CLI: npx guardvibe deep-scan <file> --focus idor
Get detailed remediation guidance with exploit scenarios and fix strategies
SARIF v2.1.0 export for CI/CD integration
Auto-fix suggestions with concrete patches for AI agents
Single source of truth — runs ALL checks in one call, returns PASS/FAIL/WARN verdict + score + coverage % + deterministic result hash
Detect project stack and generate tailored security policies (CSP, CORS, RLS)
Security best practices and guides
Host security audit — CVE-2025-59536, CVE-2026-21852, MCP config, env scanner
Check project against compliance policies defined in .guardviberc
Remediation plan — generates section-by-section fix checklist after audit
Assess overall repository security posture and map sensitive areas
Review PR diff for security issues with severity gating
Scan only git-changed files — for PRs and incremental CI; diff-aware (only newly-added lines; diffaware:false for whole files)
Compare config file versions to detect security downgrades
Check all dependencies for known CVEs (OSV) — annotates each vulnerable package with reachability (is it actually imported in your source?)
Scan a project directory from disk
Real-time single-file scan — designed for post-edit hooks
Slopsquat / AI-hallucination detector — flags phantom imports (imported but in no manifest) and typosquats fully offline + deterministic; opt-in online tier adds npm-registry truth (404 = nonexistent, brand-new low-download = slopsquat pattern). CLI: npx guardvibe slopscan [path] --offline
Scan shell profiles, .env files for base URL hijack and credential sniffing
Detect leaked secrets, API keys, tokens
Scan git history for leaked secrets (active and removed)
Pre-commit scan of git-staged files — diff-aware (blocks only newly-staged lines; diffaware:false for whole files)
Prompt-level security (shift left) — analyze a coding prompt BEFORE code is written; deterministic triage (NOMOD/LIGHTMOD/HEAVYMOD), stack + attack-surface detection, severity-ranked GuardVibe requirements embedded via a rewrite directive
Close the loop — scan, apply only the fixes that verifiably land (each re-scanned, rolled back on regression), return the verified code + a definition-of-done gate
Cumulative security dashboard — scans, fixes, grade trend over time
Get recommended tool workflow for your current task (writing, pre-commit, PR review, etc.)
Verify a security fix was applied correctly — returns fixed/stillvulnerable/newissues
Remediation verification — compares before/after audit, flags skipped sections