guardvibe: Scan AI-Written Code for Security Issues

Overview

GuardVibe adds deterministic security checks to AI-assisted software development. It runs locally as a CLI or MCP server, scanning repositories for issues such as insecure code patterns, exposed secrets, vulnerable dependency versions, and gaps in route authentication.

It is aimed at developers who want checks available while an agent is writing code, rather than relying only on a later review. Its prompt-analysis tool can also identify missing security requirements before code generation. It complements, rather than replaces, tools intended for broad enterprise SAST coverage.

Key Features

• Provides CLI scans and MCP tools for compatible AI coding agents.
• Checks code, dependencies, secrets, configuration, and authentication coverage across a repository.
• Includes framework- and service-aware rules for stacks such as Next.js, Supabase, Clerk, Stripe, Prisma, and Hono.
• Offers secure_prompt to identify implied security requirements before code is generated.
• Supports staged-file and changed-file scans, pre-commit hooks, GitHub Actions, and SARIF output.
• Returns remediation guidance and fix suggestions, with options to verify fixes.
• Runs local code analysis without an account or API key; dependency checks can query OSV when explicitly invoked.

Use Cases

• A solo developer using Claude Code, Cursor, or another MCP-compatible agent wants security feedback during implementation.
• A small team wants a local scan and pre-commit gate for AI-generated changes without setting up a hosted security dashboard.
• A developer wants to check dependency versions and repository configuration before release, alongside code-level findings.
• An agent workflow needs structured findings or SARIF output for CI and security review.

Getting Started

Run the CLI without a global install:

npx guardvibe scan

For MCP setup, use npx guardvibe init claude or the corresponding platform command. See the README for setup options, CLI flags, and configuration.

Alternatives

• opengrep: Opengrep focuses on customizable code-pattern and taint analysis, while GuardVibe also checks dependencies, configuration, and prompts for AI-agent workflows.
• osv-scanner: OSV-Scanner checks dependencies and packages for known vulnerabilities, while GuardVibe covers code, configuration, and prompts as well.

Considerations

• Requires Node.js 18 or later.
• Most scanning is local, but dependency vulnerability checks use the OSV API and therefore need network access when run.
• The deep-scan feature requires an Anthropic or OpenAI API key; it is separate from the offline deterministic checks.
• The README positions GuardVibe for AI-assisted web development, not as a replacement for enterprise SAST, organization-wide policy systems, or professional compliance audits.
• Repository metadata shows 5 stars and 9 open issues, so assess current maintenance and fit before adopting it in a critical workflow.