@cybedefend/vibedefend

VibeDefend — one-shot installer that connects your AI coding agent to CybeDefend. Each time the agent edits code, the right business and security rules for the change land in its context. Each time you commit work, a quick gap analysis catches the rules you never wrote down.

Install

npx -y @cybedefend/vibedefend@latest install

Works on macOS, Linux, and Windows (PowerShell, cmd, bash, zsh, fish, Git Bash — pick any). Requires Node 18.17 or later — most users already have it because Claude Code / Cursor / Codex ship with a bundled Node.

The installer is fully interactive, and signs you in first:

1. Pick a region (EU / US).
2. Sign in — your browser opens for a one-time CybeDefend sign-in (skipped if you're already signed in from a previous run).
3. Organization check — if your account doesn't belong to an organization yet, the dashboard on-boarding page opens and the installer waits while you create or join one (Ctrl-C to skip and finish later).
4. Pick which agents to wire (auto-detected), confirm. That's it.

Prefer a global install?

npm  install -g @cybedefend/vibedefend && vibedefend install
# or pnpm / yarn — same package

Supported agents

VibeDefend auto-detects and wires whichever of these you have installed.

| Capability | Claude Code | Cursor | OpenAI Codex | Windsurf | VS Code Copilot | |---|:---:|:---:|:---:|:---:|:---:| | MCP server install | ✅ | ✅ | ✅ | ✅ | ✅ | | Business + Security Rules (injected pre-edit) | ✅ | ✅ | ✅ | ⚠️ writes only | ✅ | | Action Guards (hard block on deny) | ✅ all tools | ✅ all tools | ✅ all tools | ⚠️ writes + MCP fallback¹ | ❌ not yet wired | | Session Start (loads doctrine + proposals inbox) | ✅ | ✅ | ✅ | ⚠️ proxied² | ✅ | | Session Review (end-of-session gap analysis + pre-commit diff scan) | ✅ | ✅ | ✅ | ✅ | ✅ | | PreCompact (long-session gap analysis) | ✅ | ✅ | ❌ no event | ❌ no event | ✅ | | Doctrine backstop (per-prompt reminder) | ✅ | ❌ | ✱ via MCP³ | ❌ | ❌ | | Min version | latest | ≥ 1.7 | latest | latest | ≥ 1.110 |

Legend — ✅ supported · ⚠️ supported with caveats · ❌ not exposed by the agent · ✱ alternate mechanism

¹ Windsurf's pre_write_code hook hard-blocks on file writes only. For non-write tool calls (Read / Bash / WebFetch) the installer drops a snippet into .windsurfrules instructing the agent to call cybe_guards_check via MCP before sensitive actions — soft enforcement that relies on the model following its rules file.

² Windsurf has no native SessionStart event. We wire pre_user_prompt, which fires on every turn. The hook is idempotent and cheap (one GET to the proposals endpoint, returns "0 pending" once the inbox is empty), so the per-turn cost is negligible.

³ Codex follows the doctrine via the MCP server's Server.instructions field on each session, removing the need for a per-prompt reminder hook.

Codex setup gotcha: Codex 0.131+ requires you to approve each hook via the /hooks panel inside Codex before they fire. After running vibedefend install, open Codex, run /hooks, and trust the cybedefend entries — until you do that the panel will show Installed N / Active 0.

Pre-commit diff scan (on by default): when Session Review fires, the agent is also asked to run a quick diff scan (SAST / IaC / secrets) on the files it changed this session, via the cybe_scan_diff MCP tool — a best-effort pre-commit check that complements (never replaces) a full scan. It rides on the Session Review hook, so it follows the same edits threshold. Decline it at install, or set "enableDiffScan": false in ~/.cybedefend/runtime-config.json.

Unchecked agents stay untouched. Re-run vibedefend install later to toggle any on or off.

Commands

vibedefend install            Set up MCP + hooks (interactive, signs you in first)
vibedefend update             Refresh hooks to the latest version
vibedefend update --self      Upgrade the CLI itself
vibedefend status             Read-only install report
vibedefend doctor             Diagnose and repair common issues
vibedefend login              (Re-)authenticate against the CybeDefend API
vibedefend logout             Clear stored credentials (a fresh sign-in next run)
vibedefend link               Link a repo to a CybeDefend project
vibedefend uninstall          Remove every VibeDefend-installed file
vibedefend --help             Full help

Linking a repo to its project

For projects imported from GitHub or GitLab, there is nothing to do: VibeDefend reads the repo's origin remote and resolves the matching CybeDefend project automatically on the first hook call.

For any other repo (no remote, a mirror, a monorepo subfolder, an unimported project…), link it once:

vibedefend link                       # interactive: auto-detect, or pick org → project
vibedefend link --project <uuid>      # non-interactive, if you know the project UUID
# or without a global install:
npx -y @cybedefend/vibedefend@latest link --project <PROJECT_ID>

link writes a .cybedefend/config.json next to your code:

{ "projectId": "<your-cybedefend-project-uuid>" }

That file is now optional for GitHub/GitLab-linked projects, but it remains a supported override everywhere — when present, it always wins over git-origin auto-resolution (as does the CYBEDEFEND_PROJECT_ID env var). You can grab the UUID from the project page on the EU dashboard (eu.cybedefend.com) or the US dashboard (us.cybedefend.com).

Updating

At install you're asked "Enable automatic background updates? (recommended)". Leave it on and you never have to update by hand: the SessionStart hook checks npm at most once a day and, when a newer version is out, upgrades @cybedefend/vibedefend in the background — the next session picks it up via the self-resolving runner shim. Opt out (or pin a version / locked-down env) and you instead get a one-line nudge.

To update manually at any time:

vibedefend update     # upgrades the binary if newer, then refreshes hooks

(vibedefend update --self upgrades only the binary, without touching hooks.)

One-time bootstrap for installs older than 1.2.0: those versions shipped a frozen copy of the hook runner with no update logic, so vibedefend update alone cannot upgrade the binary — do it explicitly first:

npm i -g @cybedefend/vibedefend@latest   # or: vibedefend update --self
vibedefend update                         # render the self-resolving shim

After that, updates are hands-off (or one vibedefend update) as above.

Uninstalling

vibedefend uninstall
# Then drop the global package if you installed it:
npm uninstall -g @cybedefend/vibedefend

Sibling: cybedefend-cli

cybedefend-cli is the platform CLI (scan, list vulnerabilities, manage projects from your terminal or CI). VibeDefend handles the AI-agent integration side; the two are complementary and unaware of each other.

Documentation

Full documentation, configuration reference, and troubleshooting at docs.cybedefend.com.

Support

• Bug reports / feature requests: [email protected]
• Email: [email protected]
• Status: status.cybedefend.com

License

BUSL-1.1 — see LICENSE. Copyright 2026 CybeDefend. Converts to Apache-2.0 on 2030-05-25.