# GuardVibe: AI-Native Security for Your Code, From Prompt to Production

This repository profile is provided by osrepos.com, an open source repository discovery platform.

Source: osrepos.com
Repository profile: https://osrepos.com/repo/goklab-guardvibe
Generated for open source discovery and AI-assisted research.

GuardVibe is a security infrastructure designed specifically for AI-generated code. It provides deterministic, daily CVE intelligence, whole-repo context, and independent verification, addressing gaps that AI coding agents cannot fill. GuardVibe shifts security left by analyzing prompts before code generation, ensuring robust protection throughout the development lifecycle.

GitHub: https://github.com/goklab/guardvibe
OSRepos URL: https://osrepos.com/repo/goklab-guardvibe

## Summary

GuardVibe is a security infrastructure designed specifically for AI-generated code. It provides deterministic, daily CVE intelligence, whole-repo context, and independent verification, addressing gaps that AI coding agents cannot fill. GuardVibe shifts security left by analyzing prompts before code generation, ensuring robust protection throughout the development lifecycle.

## Topics

- ai-security
- typescript
- sast
- prompt-injection
- cve
- nextjs
- devsecops
- code-analysis

## Repository Information

Last analyzed by OSRepos: Tue Sep 08 2026 08:28:31 GMT+0100 (Western European Summer Time)
Detail views: 0
GitHub clicks: 0

## Safety Notice

OSRepos shares public repositories for knowledge and discovery only. Review source code, dependencies, licenses, and security implications before running or installing anything.

## Content

## Introduction

GuardVibe is a robust security infrastructure specifically engineered for projects leveraging AI coding agents. It addresses critical security gaps that AI models inherently cannot cover, such as deterministic checks, up-to-date CVE intelligence beyond training cutoffs, whole-repository context, and objective, author-independent code review. GuardVibe introduces a "shift-left" approach with `secure_prompt`, which analyzes and hardens coding prompts *before* any code is generated, ensuring security from the very first line.

## Why Use GuardVibe & Key Benefits

AI coding agents are powerful, but they have structural limitations regarding security. GuardVibe fills these gaps by providing:

*   **Up-to-Date Threat Intelligence:** GuardVibe knows what your AI doesn't. It features CVE rules refreshed daily from GHSA, OSV.dev, and CISA KEV, flagging vulnerable dependencies published *after* your model's training cutoff.
*   **Deterministic Security:** Unlike probabilistic AI guesses, GuardVibe ensures the same code always yields the same security result, every run.
*   **Whole-Repo Awareness:** It performs cross-file taint analysis and authentication coverage across your entire repository, catching issues that an agent's narrow context might miss.
*   **Independent Verification:** GuardVibe acts as an objective, external checker for AI-written code, integrating into the loop *while* your AI codes, not just after.
*   **Prompt-Level Security (Shift-Left):** The `secure_prompt` feature analyzes coding prompts to detect implied attack surfaces and embeds severity-ranked GuardVibe requirements directly into the prompt, preventing vulnerabilities before code is even written.
*   **Developer-Centric Design:** Built for developers using AI, GuardVibe offers zero setup friction, runs 100% locally with no accounts or API keys, and understands modern stacks like Next.js, Supabase, Clerk, and Stripe.
*   **Comprehensive Rule Set:** With 468 security rules and 39 tools, it covers the entire AI-generated code journey, from prompt to production deployment.
*   **Auto-Fix Suggestions:** The `fix_code` tool provides concrete patches and structured edits that AI agents can apply mechanically, accelerating remediation.
*   **CI/CD and Pre-Commit Integration:** Easily integrate GuardVibe into your development workflow with pre-commit hooks and GitHub Actions for SARIF upload.
*   **Daily Threat Intel Pipeline:** Recent updates include daily CVE rule refreshes, OWASP MCP Top 10 alignment, inline suppression, embedded remediation plans, and enhanced host security audits.

GuardVibe is purpose-built for the AI coding workflow, complementing traditional SAST tools by integrating security directly into the developer's process.

## Installation

Getting started with GuardVibe is straightforward. You can initialize it for various AI coding platforms or integrate it into your Git workflow.

**For AI Coding Platforms:**

bash
npx guardvibe init claude


bash
npx guardvibe init cursor


bash
npx guardvibe init gemini


bash
codex mcp add guardvibe -- npx -y guardvibe


**VS Code (GitHub Copilot):** Create `.vscode/mcp.json` in your project:


{
  "servers": {
    "guardvibe": {
      "command": "npx",
      "args": ["-y", "guardvibe"]
    }
  }
}


**Windsurf:** Add to `~/.codeium/windsurf/mcp_config.json`:


{
  "mcpServers": {
    "guardvibe": {
      "command": "npx",
      "args": ["-y", "guardvibe"]
    }
  }
}


**All platforms at once:**

bash
npx guardvibe init all


**Git Integration:**

bash
npx guardvibe hook install


bash
npx guardvibe ci github


## Examples

GuardVibe offers a comprehensive set of CLI commands for scanning, auditing, and remediation.

**Scanning and Auditing:**

bash
npx guardvibe scan [path]


bash
npx guardvibe audit [path]


bash
npx guardvibe doctor


bash
npx guardvibe deep-scan <file> --focus idor


**Remediation and Workflow:**

bash
npx guardvibe secure-this <file> --write


bash
npx guardvibe-scan


## Links

*   **GitHub Repository:** [https://github.com/goklab/guardvibe](https://github.com/goklab/guardvibe)