{"name":"GuardVibe: AI-Native Security for Your Code, From Prompt to Production","description":"GuardVibe is a security infrastructure designed specifically for AI-generated code. It provides deterministic, daily CVE intelligence, whole-repo context, and independent verification, addressing gaps that AI coding agents cannot fill. GuardVibe shifts security left by analyzing prompts before code generation, ensuring robust protection throughout the development lifecycle.","github":"https://github.com/goklab/guardvibe","url":"https://osrepos.com/repo/goklab-guardvibe","source":"osrepos.com","sourceDescription":"This repository profile is provided by osrepos.com, an open source repository discovery platform.","repositoryProfile":"https://osrepos.com/repo/goklab-guardvibe","generatedFor":"open source discovery and AI-assisted research","markdown":"https://osrepos.com/repo/goklab-guardvibe.md","json":"https://osrepos.com/repo/goklab-guardvibe.json","topics":["ai-security","typescript","sast","prompt-injection","cve","nextjs","devsecops","code-analysis"],"keywords":["ai-security","typescript","sast","prompt-injection","cve","nextjs","devsecops","code-analysis"],"stars":null,"summary":"GuardVibe is a security infrastructure designed specifically for AI-generated code. It provides deterministic, daily CVE intelligence, whole-repo context, and independent verification, addressing gaps that AI coding agents cannot fill. GuardVibe shifts security left by analyzing prompts before code generation, ensuring robust protection throughout the development lifecycle.","content":"## Introduction\n\nGuardVibe is a robust security infrastructure specifically engineered for projects leveraging AI coding agents. It addresses critical security gaps that AI models inherently cannot cover, such as deterministic checks, up-to-date CVE intelligence beyond training cutoffs, whole-repository context, and objective, author-independent code review. GuardVibe introduces a \"shift-left\" approach with `secure_prompt`, which analyzes and hardens coding prompts *before* any code is generated, ensuring security from the very first line.\n\n## Why Use GuardVibe & Key Benefits\n\nAI coding agents are powerful, but they have structural limitations regarding security. GuardVibe fills these gaps by providing:\n\n*   **Up-to-Date Threat Intelligence:** GuardVibe knows what your AI doesn't. It features CVE rules refreshed daily from GHSA, OSV.dev, and CISA KEV, flagging vulnerable dependencies published *after* your model's training cutoff.\n*   **Deterministic Security:** Unlike probabilistic AI guesses, GuardVibe ensures the same code always yields the same security result, every run.\n*   **Whole-Repo Awareness:** It performs cross-file taint analysis and authentication coverage across your entire repository, catching issues that an agent's narrow context might miss.\n*   **Independent Verification:** GuardVibe acts as an objective, external checker for AI-written code, integrating into the loop *while* your AI codes, not just after.\n*   **Prompt-Level Security (Shift-Left):** The `secure_prompt` feature analyzes coding prompts to detect implied attack surfaces and embeds severity-ranked GuardVibe requirements directly into the prompt, preventing vulnerabilities before code is even written.\n*   **Developer-Centric Design:** Built for developers using AI, GuardVibe offers zero setup friction, runs 100% locally with no accounts or API keys, and understands modern stacks like Next.js, Supabase, Clerk, and Stripe.\n*   **Comprehensive Rule Set:** With 468 security rules and 39 tools, it covers the entire AI-generated code journey, from prompt to production deployment.\n*   **Auto-Fix Suggestions:** The `fix_code` tool provides concrete patches and structured edits that AI agents can apply mechanically, accelerating remediation.\n*   **CI/CD and Pre-Commit Integration:** Easily integrate GuardVibe into your development workflow with pre-commit hooks and GitHub Actions for SARIF upload.\n*   **Daily Threat Intel Pipeline:** Recent updates include daily CVE rule refreshes, OWASP MCP Top 10 alignment, inline suppression, embedded remediation plans, and enhanced host security audits.\n\nGuardVibe is purpose-built for the AI coding workflow, complementing traditional SAST tools by integrating security directly into the developer's process.\n\n## Installation\n\nGetting started with GuardVibe is straightforward. You can initialize it for various AI coding platforms or integrate it into your Git workflow.\n\n**For AI Coding Platforms:**\n\nbash\nnpx guardvibe init claude\n\n\nbash\nnpx guardvibe init cursor\n\n\nbash\nnpx guardvibe init gemini\n\n\nbash\ncodex mcp add guardvibe -- npx -y guardvibe\n\n\n**VS Code (GitHub Copilot):** Create `.vscode/mcp.json` in your project:\n\n\n{\n  \"servers\": {\n    \"guardvibe\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"guardvibe\"]\n    }\n  }\n}\n\n\n**Windsurf:** Add to `~/.codeium/windsurf/mcp_config.json`:\n\n\n{\n  \"mcpServers\": {\n    \"guardvibe\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"guardvibe\"]\n    }\n  }\n}\n\n\n**All platforms at once:**\n\nbash\nnpx guardvibe init all\n\n\n**Git Integration:**\n\nbash\nnpx guardvibe hook install\n\n\nbash\nnpx guardvibe ci github\n\n\n## Examples\n\nGuardVibe offers a comprehensive set of CLI commands for scanning, auditing, and remediation.\n\n**Scanning and Auditing:**\n\nbash\nnpx guardvibe scan [path]\n\n\nbash\nnpx guardvibe audit [path]\n\n\nbash\nnpx guardvibe doctor\n\n\nbash\nnpx guardvibe deep-scan <file> --focus idor\n\n\n**Remediation and Workflow:**\n\nbash\nnpx guardvibe secure-this <file> --write\n\n\nbash\nnpx guardvibe-scan\n\n\n## Links\n\n*   **GitHub Repository:** [https://github.com/goklab/guardvibe](https://github.com/goklab/guardvibe)","metrics":{"detailViews":0,"githubClicks":0},"dates":{"published":null,"modified":"2026-09-08T07:28:31.000Z"}}