VibeGuard

Local CLI security scanner for AI-generated code. Your code never leaves your machine.

Installation

npm install -g @indicated/vibeguard

Quick Start

# Scan a directory
vibeguard scan ./src

# Scan specific files
vibeguard scan ./api.js ./auth.ts

# Set up pre-commit hook (blocks commits with critical/high issues)
vibeguard init

# View all security rules
vibeguard rules

Commands

vibeguard scan [targets...]

Scan files or directories for security vulnerabilities.

vibeguard scan ./src            # Scan directory
vibeguard scan --staged         # Scan git staged files only
vibeguard scan --json           # Output as JSON
vibeguard scan --force          # Don't exit with error on issues
vibeguard scan --quiet          # Minimal output

vibeguard init

Set up a pre-commit hook to automatically scan code before commits.

vibeguard init          # Creates hook and config
vibeguard init --force  # Overwrite existing hooks

This creates:

• A git pre-commit hook that runs vibeguard scan --staged
• A .vibeguardrc.json config file

vibeguard rules

List all available security rules.

vibeguard rules                      # List all rules
vibeguard rules --severity critical  # Filter by severity
vibeguard rules --language python    # Filter by language
vibeguard rules --json               # Output as JSON

vibeguard login

Authenticate with your license key (for premium features).

vibeguard login
vibeguard login --key YOUR_KEY --email [email protected]

vibeguard logout

Remove stored license key.

vibeguard mcp

Start VibeGuard as an MCP server for AI assistant integration.

AI Assistant Integration (MCP)

VibeGuard can run as an MCP (Model Context Protocol) server, allowing AI coding assistants like Claude Code to directly scan your code for vulnerabilities.

Setup for Claude Code

1. Install VibeGuard globally:

   npm install -g @indicated/vibeguard

2. Add to your Claude Code MCP settings (~/.claude/settings.json):

   {
     "mcpServers": {
       "vibeguard": {
         "command": "vibeguard",
         "args": ["mcp"]
       }
     }
   }

3. Restart Claude Code. The AI will now have access to these tools:

| Tool | Description | |------|-------------| | scan_code | Scan files/directories for security vulnerabilities | | list_security_rules | List all available security rules | | check_code_snippet | Check a code snippet without writing to disk |

How it works

Once configured, you can ask Claude Code things like:

• "Scan my src folder for security issues"
• "Check this code for vulnerabilities before I save it"
• "What security rules does VibeGuard check for?"

The AI will automatically use VibeGuard to scan your code and report any issues.

Configuration

Create a .vibeguardrc.json in your project root:

{
  "exclude": [
    "node_modules",
    "dist",
    "build",
    "*.test.js"
  ],
  "rules": {
    "disabled": ["missing-rate-limit"]
  }
}

Supported Languages

• JavaScript (.js, .jsx, .mjs, .cjs)
• TypeScript (.ts, .tsx)
• Python (.py)

Security Rules (74 checks)

Critical

• hardcoded-secret: Detects hardcoded API keys, tokens, and passwords
• sql-injection: Detects SQL injection vulnerabilities
• eval-usage: Detects dangerous eval() usage
• command-injection: User input passed to shell commands
• insecure-deserialization: Unsafe deserialization of untrusted data
• insecure-randomness: Math.random()/random module used for security tokens
• weak-cryptography: MD5/SHA1 used for passwords or security hashing
• nosql-injection: User input passed directly to MongoDB/NoSQL queries
• password-plaintext-storage: Passwords stored in database without hashing
• django-debug-true: Django DEBUG=True in production
• django-secret-key-exposed: Django SECRET_KEY hardcoded
• django-raw-sql: Django raw SQL with string formatting
• flask-secret-key-exposed: Flask SECRET_KEY hardcoded

High

• missing-auth-route: API routes without authentication
• xss-innerhtml: XSS via innerHTML/dangerouslySetInnerHTML
• secrets-localstorage: Sensitive data in localStorage/sessionStorage
• supabase-no-rls: Supabase queries without RLS
• firebase-no-rules: Firebase without security rules
• idor-vulnerability: Potential IDOR vulnerabilities
• path-traversal: User input in file paths
• ssrf-vulnerability: Server-side request forgery
• open-redirect: Redirecting to user-supplied URLs
• insecure-cookie: Cookies without security flags
• missing-csrf: Forms without CSRF tokens
• disabled-tls-verification: SSL/TLS certificate verification disabled
• unsafe-regex-construction: User input in RegExp constructor (ReDoS)
• postmessage-no-origin: postMessage listener without origin check
• hardcoded-db-credentials: Database connection strings with embedded passwords
• ssti-vulnerability: Server-side template injection
• unvalidated-file-upload: File uploads without type/size validation
• electron-insecure-config: nodeIntegration/contextIsolation misconfiguration
• prisma-raw-query: Prisma raw queries with user input
• nextjs-exposed-server-action: Next.js server actions without auth
• nextjs-api-route-no-auth: Next.js API routes without auth
• express-session-insecure: Express session without secure flags
• jwt-missing-exp: JWT tokens signed without expiration
• jwt-weak-secret: JWT signed with short hardcoded secret
• cors-credentials-wildcard: CORS wildcard origin with credentials enabled
• password-hash-weak: Passwords hashed with MD5/SHA1/raw SHA256 instead of KDF
• zip-slip: Archive extraction without path validation
• s3-public-read: S3 bucket with public access policy

Medium

• permissive-cors: Overly permissive CORS configuration
• http-not-https: HTTP instead of HTTPS
• weak-password: Weak password requirements
• hardcoded-ip: Hardcoded IP addresses
• xxe-vulnerability: XML External Entity injection
• jwt-none-algorithm: JWT accepting "none" algorithm
• insecure-websocket: ws:// instead of wss://
• timing-attack: Non-constant-time secret comparison
• graphql-introspection-enabled: GraphQL schema exposed in production
• mass-assignment: User input passed directly to ORM create/update
• log-injection: User input in log messages (CRLF injection)
• python-assert-security: Assert used for security checks (stripped with -O)
• unsafe-tempfile: tempfile.mktemp() race condition
• missing-security-headers: Express app without security headers (CSP, HSTS, X-Frame-Options)
• csp-unsafe-inline: CSP policy allows unsafe-inline or unsafe-eval
• http-client-no-timeout: Outbound HTTP requests without timeout

Low

• verbose-errors: Detailed errors exposed to clients
• missing-rate-limit: Missing rate limiting on sensitive endpoints
• console-log-sensitive: Logging passwords/tokens/secrets
• debug-mode-enabled: Debug mode enabled in production
• prototype-pollution: Deep merging user input

Exit Codes

• 0: No critical/high issues found
• 1: Critical or high severity issues found (blocks commit)

Use --force to always exit with 0, or git commit --no-verify to skip the hook.

Privacy

VibeGuard runs entirely on your machine. Your code is never sent to any server. Only license validation requires network access.

License

Commercial SaaS - License key required for full features.