Guardvibe
Built for developers shipping AI-generated code fast. Exposes 36 MCP tools including scan_code, fix_code, and audit_codebase across 422 security rules targeting the actual stacks AI agents generate: Next.js Server Actions, Supabase RLS policies, Clerk auth flows, tRPC endpoints, Stripe integrations. The fix_code tool returns structured patches AI agents can apply mechanically, migrating hardcoded credentials to env vars, stripping dangerous CORS wildcards, removing sandbox bypass flags. Runs entirely local with no API keys required. Daily threat intel pipeline tracks GHSA and CISA KEV for CVE version detection across 60 packages. Includes guardvibe doctor to audit your AI host environment and pre-commit hooks to block insecure commits before they land.
- GitHub stars
- 6
- tools
- 39
- transport
- STDIO
- last updated
- Nov 12, 2026
Tools
39 toolsPublic tool metadata for what this MCP can expose to an agent.
check_codeAnalyze a code snippet for security issues
Analyze a code snippet for security issues
No parameter schema in public metadata yet.
check_projectScan multiple files with security scoring (A-F)
Scan multiple files with security scoring (A-F)
No parameter schema in public metadata yet.
scan_directoryScan a project directory from disk
Scan a project directory from disk
No parameter schema in public metadata yet.
scan_stagedPre-commit scan of git-staged files — diff-aware (blocks only newly-staged lines; diff_aware:false for whole files)
Pre-commit scan of git-staged files — diff-aware (blocks only newly-staged lines; diff_aware:false for whole files)
No parameter schema in public metadata yet.
scan_dependenciesCheck all dependencies for known CVEs (OSV) — annotates each vulnerable package with reachability (is it actually imported in your source?)
Check all dependencies for known CVEs (OSV) — annotates each vulnerable package with reachability (is it actually imported in your source?)
No parameter schema in public metadata yet.
scan_secretsDetect leaked secrets, API keys, tokens
Detect leaked secrets, API keys, tokens
No parameter schema in public metadata yet.
check_dependenciesCheck individual packages against OSV
Check individual packages against OSV
No parameter schema in public metadata yet.
check_package_healthTyposquat detection, maintenance status, adoption metrics
Typosquat detection, maintenance status, adoption metrics
No parameter schema in public metadata yet.
compliance_reportMap security findings to compliance controls (SOC2, PCI-DSS, HIPAA, GDPR, ISO27001, EU AI Act)
Map security findings to compliance controls (SOC2, PCI-DSS, HIPAA, GDPR, ISO27001, EU AI Act)
No parameter schema in public metadata yet.
export_sarifSARIF v2.1.0 export for CI/CD integration
SARIF v2.1.0 export for CI/CD integration
No parameter schema in public metadata yet.
get_security_docsSecurity best practices and guides
Security best practices and guides
No parameter schema in public metadata yet.
fix_codeAuto-fix suggestions with concrete patches for AI agents
Auto-fix suggestions with concrete patches for AI agents
No parameter schema in public metadata yet.
secure_thisClose the loop — scan, apply only the fixes that verifiably land (each re-scanned, rolled back on regression), return the verified code + a definition-of-done gate
Close the loop — scan, apply only the fixes that verifiably land (each re-scanned, rolled back on regression), return the verified code + a definition-of-done gate
No parameter schema in public metadata yet.
audit_configAudit project configuration files for cross-file security misconfigurations
Audit project configuration files for cross-file security misconfigurations
No parameter schema in public metadata yet.
generate_policyDetect project stack and generate tailored security policies (CSP, CORS, RLS)
Detect project stack and generate tailored security policies (CSP, CORS, RLS)
No parameter schema in public metadata yet.
review_prReview PR diff for security issues with severity gating
Review PR diff for security issues with severity gating
No parameter schema in public metadata yet.
scan_secrets_historyScan git history for leaked secrets (active and removed)
Scan git history for leaked secrets (active and removed)
No parameter schema in public metadata yet.
policy_checkCheck project against compliance policies defined in .guardviberc
Check project against compliance policies defined in .guardviberc
No parameter schema in public metadata yet.
analyze_dataflowTrack tainted data flows from user input to dangerous sinks
Track tainted data flows from user input to dangerous sinks
No parameter schema in public metadata yet.
analyze_cross_file_dataflowCross-file taint analysis — track tainted data across module boundaries
Cross-file taint analysis — track tainted data across module boundaries
No parameter schema in public metadata yet.
check_commandAnalyze shell commands for security risks before execution
Analyze shell commands for security risks before execution
No parameter schema in public metadata yet.
scan_config_changeCompare config file versions to detect security downgrades
Compare config file versions to detect security downgrades
No parameter schema in public metadata yet.
repo_security_postureAssess overall repository security posture and map sensitive areas
Assess overall repository security posture and map sensitive areas
No parameter schema in public metadata yet.
explain_remediationGet detailed remediation guidance with exploit scenarios and fix strategies
Get detailed remediation guidance with exploit scenarios and fix strategies
No parameter schema in public metadata yet.
scan_fileReal-time single-file scan — designed for post-edit hooks
Real-time single-file scan — designed for post-edit hooks
No parameter schema in public metadata yet.
scan_changed_filesScan only git-changed files — for PRs and incremental CI; diff-aware (only newly-added lines; diff_aware:false for whole files)
Scan only git-changed files — for PRs and incremental CI; diff-aware (only newly-added lines; diff_aware:false for whole files)
No parameter schema in public metadata yet.
security_statsCumulative security dashboard — scans, fixes, grade trend over time
Cumulative security dashboard — scans, fixes, grade trend over time
No parameter schema in public metadata yet.
guardvibe_doctorHost security audit — CVE-2025-59536, CVE-2026-21852, MCP config, env scanner
Host security audit — CVE-2025-59536, CVE-2026-21852, MCP config, env scanner
No parameter schema in public metadata yet.
audit_mcp_configAudit MCP server configurations for hook injection, file:// abuse, sensitive paths
Audit MCP server configurations for hook injection, file:// abuse, sensitive paths
No parameter schema in public metadata yet.
scan_host_configScan shell profiles, .env files for base URL hijack and credential sniffing
Scan shell profiles, .env files for base URL hijack and credential sniffing
No parameter schema in public metadata yet.
verify_fixVerify a security fix was applied correctly — returns fixed/still_vulnerable/new_issues
Verify a security fix was applied correctly — returns fixed/still_vulnerable/new_issues
No parameter schema in public metadata yet.
security_workflowGet recommended tool workflow for your current task (writing, pre-commit, PR review, etc.)
Get recommended tool workflow for your current task (writing, pre-commit, PR review, etc.)
No parameter schema in public metadata yet.
auth_coverageAuth coverage map — enumerate routes, parse middleware matchers, detect auth guards, report coverage %
Auth coverage map — enumerate routes, parse middleware matchers, detect auth guards, report coverage %
No parameter schema in public metadata yet.
deep_scanLLM-powered deep analysis — IDOR, business logic, race conditions, auth bypass. Defaults to Claude Haiku 4.5. Pass model: 'sonnet' for deeper analysis
LLM-powered deep analysis — IDOR, business logic, race conditions, auth bypass. Defaults to Claude Haiku 4.5. Pass model: 'sonnet' for deeper analysis
No parameter schema in public metadata yet.
full_auditSingle source of truth — runs ALL checks in one call, returns PASS/FAIL/WARN verdict + score + coverage % + deterministic result hash
Single source of truth — runs ALL checks in one call, returns PASS/FAIL/WARN verdict + score + coverage % + deterministic result hash
No parameter schema in public metadata yet.
remediation_planRemediation plan — generates section-by-section fix checklist after audit
Remediation plan — generates section-by-section fix checklist after audit
No parameter schema in public metadata yet.
verify_remediationRemediation verification — compares before/after audit, flags skipped sections
Remediation verification — compares before/after audit, flags skipped sections
No parameter schema in public metadata yet.
secure_promptPrompt-level security (shift left) — analyze a coding prompt BEFORE code is written; deterministic triage (NO_MOD/LIGHT_MOD/HEAVY_MOD), stack + attack-surface detection, severity-ranked GuardVibe requirements embedded via a rewrite directive
Prompt-level security (shift left) — analyze a coding prompt BEFORE code is written; deterministic triage (NO_MOD/LIGHT_MOD/HEAVY_MOD), stack + attack-surface detection, severity-ranked GuardVibe requirements embedded via a rewrite directive
No parameter schema in public metadata yet.
scan_hallucinated_packagesSlopsquat / AI-hallucination detector — flags phantom imports and typosquats fully offline + deterministic; opt-in online tier adds npm-registry truth
Slopsquat / AI-hallucination detector — flags phantom imports and typosquats fully offline + deterministic; opt-in online tier adds npm-registry truth
No parameter schema in public metadata yet.
Sponsors
Agent CaffeineSponsoredClose your lid, come back to finished work
SnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthly
WaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthly
knobsSponsoredSee your site on any phone, any day, in any languageReadme
GuardVibe
Security infrastructure your AI can't be. No matter how good your coding agent gets, it can't know the CVE published after its training cutoff, it can't deterministically guarantee the same check every run, it can't hold your whole repo in context, and it can't objectively review its own code. GuardVibe does all four — the deterministic, post-cutoff-current, whole-repo, author-independent verification layer for AI-written code.
Details
- Repository
- github.com/goklab/guardvibe
- Category
- Security & Pentesting
- Package
guardvibe- Transport
- STDIO
- Registry
- MCP registry, active
Related Security & Pentesting MCP servers
View all
Pincervouchlyai/pincer-mcpSecure grip for your agent's secrets - security-hardened MCP gateway with proxy token architecture6stars
Cybersecurity Vulnerability Intelmartc03/gov-mcp-serversCVE lookup via NIST NVD, CISA KEV, EPSS, and MITRE ATT&CK. 7 tools.0stars
FedRAMP 20x Requirementskevinrabun/fedramp20xmcpAn MCP server that provides access to FedRAMP 20x security requirements and controls.5stars
Promptrejectormcprevsmoke/promptrejectormcpSecurity gateway for AI agents: detects prompt injections, jailbreaks, and common vulnerabilities.2stars
MCP Gateway Scanwillianpinho/mcp-gateway-scanRead-only MCP/agent-gateway readiness scanner — scores a repo across 7 security dimensions.2stars
Fetter MCPfetter-io/fetter-mcpReal-time Python package and vulnerability data for AI coding agents.1stars