GuardVibe: AI-Native Security for Your Code, From Prompt to Production

Introduction

GuardVibe is a robust security infrastructure specifically engineered for projects leveraging AI coding agents. It addresses critical security gaps that AI models inherently cannot cover, such as deterministic checks, up-to-date CVE intelligence beyond training cutoffs, whole-repository context, and objective, author-independent code review. GuardVibe introduces a "shift-left" approach with secure_prompt, which analyzes and hardens coding prompts before any code is generated, ensuring security from the very first line.

Why Use GuardVibe & Key Benefits

AI coding agents are powerful, but they have structural limitations regarding security. GuardVibe fills these gaps by providing:

• Up-to-Date Threat Intelligence: GuardVibe knows what your AI doesn't. It features CVE rules refreshed daily from GHSA, OSV.dev, and CISA KEV, flagging vulnerable dependencies published after your model's training cutoff.
• Deterministic Security: Unlike probabilistic AI guesses, GuardVibe ensures the same code always yields the same security result, every run.
• Whole-Repo Awareness: It performs cross-file taint analysis and authentication coverage across your entire repository, catching issues that an agent's narrow context might miss.
• Independent Verification: GuardVibe acts as an objective, external checker for AI-written code, integrating into the loop while your AI codes, not just after.
• Prompt-Level Security (Shift-Left): The secure_prompt feature analyzes coding prompts to detect implied attack surfaces and embeds severity-ranked GuardVibe requirements directly into the prompt, preventing vulnerabilities before code is even written.
• Developer-Centric Design: Built for developers using AI, GuardVibe offers zero setup friction, runs 100% locally with no accounts or API keys, and understands modern stacks like Next.js, Supabase, Clerk, and Stripe.
• Comprehensive Rule Set: With 468 security rules and 39 tools, it covers the entire AI-generated code journey, from prompt to production deployment.
• Auto-Fix Suggestions: The fix_code tool provides concrete patches and structured edits that AI agents can apply mechanically, accelerating remediation.
• CI/CD and Pre-Commit Integration: Easily integrate GuardVibe into your development workflow with pre-commit hooks and GitHub Actions for SARIF upload.
• Daily Threat Intel Pipeline: Recent updates include daily CVE rule refreshes, OWASP MCP Top 10 alignment, inline suppression, embedded remediation plans, and enhanced host security audits.

GuardVibe is purpose-built for the AI coding workflow, complementing traditional SAST tools by integrating security directly into the developer's process.

Installation

Getting started with GuardVibe is straightforward. You can initialize it for various AI coding platforms or integrate it into your Git workflow.

For AI Coding Platforms:

npx guardvibe init claude

npx guardvibe init cursor

npx guardvibe init gemini

codex mcp add guardvibe -- npx -y guardvibe

VS Code (GitHub Copilot): Create .vscode/mcp.json in your project:

{
  "servers": {
    "guardvibe": {
      "command": "npx",
      "args": ["-y", "guardvibe"]
    }
  }
}

Windsurf: Add to ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "guardvibe": {
      "command": "npx",
      "args": ["-y", "guardvibe"]
    }
  }
}

All platforms at once:

npx guardvibe init all

Git Integration:

npx guardvibe hook install

npx guardvibe ci github

Examples

GuardVibe offers a comprehensive set of CLI commands for scanning, auditing, and remediation.

Scanning and Auditing:

npx guardvibe scan [path]

npx guardvibe audit [path]

npx guardvibe doctor

npx guardvibe deep-scan <file> --focus idor

Remediation and Workflow:

npx guardvibe secure-this <file> --write

npx guardvibe-scan

Links

• GitHub Repository: https://github.com/goklab/guardvibe