guardvibe vs osv-scanner
Local AI-code security checks compared with dependency vulnerability scanning
guardvibe scans repositories for security issues in code, dependencies, secrets, configuration, and prompts, with tools for AI coding workflows. osv-scanner focuses on known vulnerabilities in dependencies, container images, and Linux packages using OSV data; it also offers offline scans and dependency license reporting.
guardvibe: Scan AI-Written Code for Security Issues
GuardVibe is a local security scanner and MCP server for developers building with AI coding agents. It checks code, dependencies, configuration, and prompts, with rules tailored to modern web stacks.
osv-scanner: Find Vulnerabilities in Project Dependencies
OSV-Scanner checks project dependencies, container images, and vendored code against the OSV vulnerability database. It suits developers and security teams who want a Go-based CLI for finding known issues across multiple ecosystems.
| guardvibe | osv-scanner | |
|---|---|---|
| Language | TypeScript | Go |
| License | Apache-2.0 | Apache-2.0 |
| Stars | 5 | 11.2k |
| Forks | 0 | 812 |
| Last analyzed | Oct 4, 2026 | Oct 14, 2026 |
Key differences
- guardvibe targets AI-assisted web development with CLI and MCP tools, while osv-scanner is a Go CLI for dependency and container vulnerability checks.
- guardvibe checks code patterns, secrets, configuration, authentication coverage, and prompts; osv-scanner matches dependency and package data against vulnerability advisories.
- guardvibe is written in TypeScript and requires Node.js 18 or later; osv-scanner is written in Go.
- guardvibe’s local deterministic checks do not require an account or API key, though OSV dependency checks need network access when run; osv-scanner supports offline scans after a local database is set up.
- osv-scanner reports dependency licenses and offers experimental guided fixes for selected npm and Maven files; guardvibe offers remediation guidance and fix verification options.
- Both use the Apache-2.0 license and are not archived; the provided metadata lists 5 stars for guardvibe and 11.1k for osv-scanner.
Choose guardvibe if you…
- want security feedback during AI-assisted implementation through CLI or MCP tools.
- need checks for code, secrets, configuration, authentication coverage, or security requirements in prompts.
- want local scans, changed-file checks, or pre-commit integration for an AI-focused web project.
Choose osv-scanner if you…
- need to check dependencies, container images, or supported Linux packages against OSV vulnerability data.
- work in a disconnected environment and can set up a local OSV database for offline scans.
- want dependency license reporting or experimental guided remediation for supported npm or Maven files.
Compare the numbers side by side, or add more projects
This comparison is generated with AI from the OSRepos analyses of both projects. Always check each project's repository and documentation before choosing.