export_sarif
SARIF v2.1.0 export for CI/CD integration
How to use it
export_sarif is exposed by the Guardvibe MCP server. Add the server to your MCP client (Claude Desktop, Cursor, Windsurf and others), and the export_sarif tool becomes available to the model automatically. See the full listing for setup details and every tool this server provides.
Install Guardvibe
npx guardvibe init claudeOther tools in Guardvibe (38)
Cross-file taint analysis — track tainted data across module boundaries
Track tainted data flows from user input to dangerous sinks
Audit project configuration files for cross-file security misconfigurations
Audit MCP server configurations for hook injection, file:// abuse, sensitive paths
Auth coverage map — enumerate routes, parse middleware matchers, detect auth guards, report coverage %
Analyze a code snippet for security issues
Analyze shell commands for security risks before execution
Check individual packages against OSV
Typosquat detection, maintenance status, adoption metrics
Scan multiple files with security scoring (A-F)
Map security findings to compliance controls (SOC2, PCI-DSS, HIPAA, GDPR, ISO27001, EU AI Act)
LLM-powered deep analysis — IDOR, business logic, race conditions, auth bypass. Defaults to Claude Haiku 4.5 (~cents/scan). Pass model: 'sonnet' for deeper analysis. CLI: npx guardvibe deep-scan <file> --focus idor
Get detailed remediation guidance with exploit scenarios and fix strategies
Auto-fix suggestions with concrete patches for AI agents
Single source of truth — runs ALL checks in one call, returns PASS/FAIL/WARN verdict + score + coverage % + deterministic result hash
Detect project stack and generate tailored security policies (CSP, CORS, RLS)
Security best practices and guides
Host security audit — CVE-2025-59536, CVE-2026-21852, MCP config, env scanner
Check project against compliance policies defined in .guardviberc
Remediation plan — generates section-by-section fix checklist after audit
Assess overall repository security posture and map sensitive areas
Review PR diff for security issues with severity gating
Scan only git-changed files — for PRs and incremental CI; diff-aware (only newly-added lines; diffaware:false for whole files)
Compare config file versions to detect security downgrades
Check all dependencies for known CVEs (OSV) — annotates each vulnerable package with reachability (is it actually imported in your source?)
Scan a project directory from disk
Real-time single-file scan — designed for post-edit hooks
Slopsquat / AI-hallucination detector — flags phantom imports (imported but in no manifest) and typosquats fully offline + deterministic; opt-in online tier adds npm-registry truth (404 = nonexistent, brand-new low-download = slopsquat pattern). CLI: npx guardvibe slopscan [path] --offline
Scan shell profiles, .env files for base URL hijack and credential sniffing
Detect leaked secrets, API keys, tokens
Scan git history for leaked secrets (active and removed)
Pre-commit scan of git-staged files — diff-aware (blocks only newly-staged lines; diffaware:false for whole files)
Prompt-level security (shift left) — analyze a coding prompt BEFORE code is written; deterministic triage (NOMOD/LIGHTMOD/HEAVYMOD), stack + attack-surface detection, severity-ranked GuardVibe requirements embedded via a rewrite directive
Close the loop — scan, apply only the fixes that verifiably land (each re-scanned, rolled back on regression), return the verified code + a definition-of-done gate
Cumulative security dashboard — scans, fixes, grade trend over time
Get recommended tool workflow for your current task (writing, pre-commit, PR review, etc.)
Verify a security fix was applied correctly — returns fixed/stillvulnerable/newissues
Remediation verification — compares before/after audit, flags skipped sections