guardvibe

# GuardVibe

[![npm version](https://img.shields.io/npm/v/guardvibe)](https://www.npmjs.com/package/guardvibe)
[![License: Apache-2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
[![Node.js CI](https://github.com/goklab/guardvibe/actions/workflows/ci.yml/badge.svg)](https://github.com/goklab/guardvibe/actions/workflows/ci.yml)
[![npm provenance](https://img.shields.io/badge/provenance-verified-brightgreen)](https://www.npmjs.com/package/guardvibe)
[![codecov](https://codecov.io/gh/goklab/guardvibe/graph/badge.svg)](https://codecov.io/gh/goklab/guardvibe)

> **Security infrastructure your AI can't be.**
> No matter how good your coding agent gets, it can't know the CVE published after its training cutoff, it can't deterministically guarantee the same check every run, it can't hold your whole repo in context, and it can't objectively review its own code. GuardVibe does all four — the deterministic, post-cutoff-current, whole-repo, author-independent verification layer for AI-written code.

- **🗓️ Knows what your AI doesn't.** CVE rules refreshed **daily** from GHSA / OSV.dev / CISA KEV — GuardVibe flags vulnerable dependencies published *after* your model's training cutoff. (97 CVE rules, `npm run intel` daily triage.)
- **🎯 Deterministic, not probabilistic.** Same code = same result, every run (content-hashed). Your AI guesses; GuardVibe doesn't.
- **🗺️ Sees the whole repo.** Cross-file taint + auth-coverage across every route — catches the unprotected endpoint your agent's narrow context missed.
- **🔍 An independent second pair of eyes.** The thing that wrote the code can't review itself. GuardVibe is the outside checker on AI-written code — in the loop *while* your AI codes (real-time edit hook), not after.
- **⬅️ NEW: Starts before the first line of code.** Every scanner on earth — including your agent reviewing itself — acts *after* the code exists. [`secure_prompt`](#prompt-level-security-shift-left) acts *before*: it analyzes the coding prompt itself, detects the stack and attack surfaces it implies, and embeds severity-ranked GuardVibe requirements into the prompt your AI executes. The vulnerability is prevented, not caught. Deterministic, zero LLM calls — and if the prompt is already secure, it passes through untouched.

**The security MCP built for vibe coding.** 472 security rules, 39 tools covering the entire AI-generated code journey — from the prompt itself to production deployment.

Works with **Claude Code, Cursor, Gemini CLI, Codex, VS Code (Copilot), Windsurf**, and any MCP-compatible coding agent.

## Why a tool, when your AI is so good?

"More rules" was never the moat — a strong model already knows most security rules by heart. What it *can't* do is be deterministic, know the CVE published after its training cutoff, hold your whole repo in context, or objectively review the code it just wrote. Those four gaps are structural; they don't close as models improve. GuardVibe is the layer that fills them — running *while* your AI codes, not in a separate audit later. And since v3.19, it runs *before* your AI codes too: `secure_prompt` rewrites the task itself so the security requirements are in the prompt, not in the post-mortem.

## Why GuardVibe

Most security tools are built for enterprise security teams. GuardVibe is built for **you** — the developer using AI to build and ship web apps fast.

- **472 security rules, 39 tools** purpose-built for the stacks AI agents generate
- **Zero setup friction** — `npx guardvibe` and you're scanning
- **No account required** — runs 100% locally, no API keys, no cloud
- **Understands your stack** — not generic SAST, but rules that know Next.js, Supabase, Stripe, Clerk, and the tools you actually use
- **CVE version intelligence** — detects 97 known vulnerable package versions in package.json, refreshed every day from GHSA / OSV.dev / CISA KEV
- **AI agent & MCP security** — detects MCP server vulnerabilities, tool-description prompt injection (OWASP MCP Top 10), model-controlled sandbox-disable flags, excessive AI permissions, indirect prompt injection
- **Auto-fix suggestions** — `fix_code` tool returns concrete patches and structured edits the AI agent can apply mechanically. Coverage: hardcoded credentials → env-var migration; public-prefix LLM keys (`NEXT_PUBLIC_/VITE_/EXPO_PUBLIC_/REACT_APP_`) → prefix removal; CORS wildcards → env allowlist; `dangerouslyAllowBrowser` flags → drop; sandbox bypass flags (`unsafe`/`noSandbox`/`allowEval`) → drop; agent loops → add `maxSteps`; raw-HTML React props → `<ReactMarkdown>`; missing auth checks → insert auth guard; SQL injection → parameterized queries; missing rate limiters / CSRF / security headers → snippet templates.
- **Pre-commit hook** — block insecure code before it reaches your repo
- **CI/CD ready** — GitHub Actions workflow with SARIF upload to Security tab
- **Agent-friendly output** — JSON format for AI agents, Markdown for humans, SARIF for CI/CD
- **Plugin system** — extend with community or premium rule packs

## New in v3.34.x

- **Daily threat-intel pipeline** — rule set tracks GHSA / OSV.dev / CISA KEV every day. Latest shipments (v3.34.0) added `VG1115` Next.js AVIF/libheif RCE + Windows-hosted RCE (GHSA-2xp9-vwfh-vxw4 / CVE-2026-75604, CVSS 9.5), `VG1116` `@clerk/clerk-react` 5.x org/billing/reverification authorization bypass (CVE-2026-42349), `VG1117` `@zereight/mcp-gitlab` unauthenticated file read / SSRF / DNS rebinding (CVE-2026-61560/-61559/-61568), and `VG1118` PostCSS `sourceMappingURL` residual window (GHSA-fxqj-rqcc-2cmp / GHSA-r28c-9q8g-f849). v3.32-3.33 added `VG1109`-`VG1114`: crypto-js `WordArray.random()` insufficient entropy, jsii-diff command injection, the keyv/cacheable "ChainDrop" npm supply-chain worm, React2Shell `react-server-dom-*` RCE, `@trigger.dev/core` prototype pollution, and an axios Basic-auth injection window. Earlier: Auth.js v5 beta fail-open, Next.js/PostCSS July residual windows, `@asyncapi/*` supply-chain IOC, Clerk 5.x middleware bypass, jscrambler/`@injectivelabs` IOCs, n8n-mcp cross-tenant isolation, Next.js May 2026 13-advisory cluster, Drizzle ORM SQL identifier injection (CVE-2026-39356), `@tanstack/*` Mini Shai-Hulud supply-chain attack, Kysely JSON-path traversal, and more
- **OWASP MCP Top 10 alignment** — `VG1068` flags MCP / AI tool definitions whose `description`, `instructions`, or `systemPrompt` fields carry prompt-injection markers (`ignore previous instructions`, `you are now`, `jailbreak mode`, `system prompt:`, `override safety`, …); pair with `VG1063` which catches `dangerouslyDisableSandbox: true` in agent runtimes
- **Inline suppress** — `// guardvibe-ignore VG001` silences individual findings per-line
- **CLI-first approach** — `npx guardvibe audit`, `npx guardvibe scan`, `npx guardvibe doctor` all work standalone without MCP
- **Embedded remediation plan** — `remediation_plan` generates a section-by-section fix checklist after every audit
- **Score reflects all sections** — security score now factors code, dependencies, config, secrets, auth coverage, and taint analysis
- **Gitignored secrets excluded** — files matched by `.gitignore` are automatically skipped during secret scanning
- **Taint sanitizer recognition** — dataflow analysis recognizes common sanitizers (DOMPurify, escape functions, parameterized queries) and stops propagation

## How GuardVibe Compares

GuardVibe is purpose-built for the AI coding workflow. Traditional tools are excellent for enterprise CI/CD pipelines — GuardVibe fills a different gap.

| Capability | GuardVibe | Traditional SAST | Dependency Scanners |
|-----------|-----------|-----------------|-------------------|
| Runs inside AI agents (MCP) | Native | Not supported | Not supported |
| Zero config setup | `npx guardvibe` | Account + config required | Built-in (limited) |
| Vibecoding stack rules (Next.js, Supabase, Clerk, tRPC, Hono) | 100+ dedicated | Generic patterns | Not applicable |
| AI/LLM security (prompt injection, MCP, tool abuse) | 68 rules | Experimental/None | None |
| AI host security (CVE-2025-59536, CVE-2026-21852) | `guardvibe doctor` | Not supported | Not supported |
| Auto-fix suggestions for AI agents | `fix_code` tool | CLI autofix | Not supported |
| CVE version detection | 97 packages, refreshed daily | Extensive | Extensive |
| Compliance mapping (SOC2, PCI-DSS, HIPAA) | Built-in | Paid tier | None |
| SARIF CI/CD export | Yes | Yes | Limited |
| Rule count | 472 (focused, 68 AI-native) | 5000+ (broad) | N/A |

**When to use GuardVibe:** You're building with AI agents and want security scanning integrated into your coding workflow — no dashboard, no account, no CI setup.

**When to use traditional tools:** You need deep AST analysis, enterprise dashboards, org-wide policy enforcement, or coverage across hundreds of languages.

## Quick Start

### Claude Code

```bash
npx guardvibe init claude
```

Creates `.mcp.json` MCP config (pinned to current version), `.claude/settings.json` auto-scan hooks, and `CLAUDE.md` security rules. Restart Claude Code after setup.

### Cursor

```bash
npx guardvibe init cursor
```

Creates `.cursor/mcp.json` and `.cursorrules` with security rules. Restart Cursor after setup.

### Gemini CLI

```bash
npx guardvibe init gemini
```

Creates `~/.gemini/settings.json` MCP config and `GEMINI.md` security rules.

### Codex (OpenAI)

```bash
codex mcp add guardvibe -- npx -y guardvibe
```

### VS Code (GitHub Copilot)

Create `.vscode/mcp.json` in your project:

```json
{
  "servers": {
    "guardvibe": {
      "command": "npx",
      "args": ["-y", "guardvibe"]
    }
  }
}
```

> **Note:** VS Code uses `"servers"`, not `"mcpServers"`.

### Windsurf

Add to `~/.codeium/windsurf/mcp_config.json`:

```json
{
  "mcpServers": {
    "guardvibe": {
      "command": "npx",
      "args": ["-y", "guardvibe"]
    }
  }
}
```

### All platforms at once

```bash
npx guardvibe init all       # Claude +