VibeReview CLI

Local-first security guardrails for AI coding agents.

VibeReview profiles your repository, installs security guidance matched to its technology stack, and gives your coding agent a repeatable workflow for threat modelling, secure-by-default implementation, dependency checks, and per-chat security reports.

It works with Cursor, Codex, Claude Code, and GitHub Copilot. There is no VibeReview server or account, and VibeReview never receives your source code or synchronizes your reports. Optional code-specific generation goes directly through your chosen provider CLI.

Why VibeReview?

AI coding agents can move quickly, but security expectations are often implicit, inconsistent, or introduced too late. VibeReview places project-aware security context directly in the repository so the agent can use it while designing and implementing a feature.

• Local-first: stack detection, catalog matching, workspace configuration, and reports stay on your machine.
• Useful immediately: deterministic baseline guardrails require no model call and consume no provider tokens.
• Project-aware: optional code-specific guardrails are derived from a bounded set of security-relevant files.
• Agent-native: instructions, skills, and session hooks are installed using each supported provider's project conventions.
• Secure dependency changes: added or changed dependency versions are checked directly with OSV.dev.
• Auditable: each IDE chat gets one readable Markdown report that is updated as the feature evolves.
• No catalog clutter: the complete guardrail catalog remains in the npm package instead of being copied into your repository.

How it works

npx @securityreviewai/vibereview-cli init
      │
      ├─ Select your coding agent
      ├─ Detect the technology stack locally
      ├─ Match bundled guardrail packs without an AI call
      ├─ Install baseline guardrails and the local agent workflow
      └─ Optionally generate code-specific guardrails with your provider CLI

Security-relevant prompt
      │
      ├─ Select applicable project guardrails
      ├─ Threat-model the requested change
      ├─ Check changed dependencies with OSV.dev
      ├─ Implement and verify secure-by-default code
      └─ Create or update one Markdown report for that IDE chat

Baseline setup is deterministic and token-free. Code-specific generation is optional, clearly confirmed before it runs, and billed under your existing provider account.

Requirements

• Node.js 20.12 or newer
• npm or another way to run npm packages
• A project directory; a Git repository is recommended but not required
• The CLI for the coding agent you select

VibeReview does not install Cursor, Codex, Claude Code, or GitHub Copilot for you. Install and authenticate the provider CLI using its official documentation first, or let VibeReview start its interactive login flow when code-specific generation requires authentication.

| Coding agent | Provider ID | Executable | Version check | Authentication/login | |---|---|---|---|---| | Cursor | cursor | cursor-agent | cursor-agent --version | cursor-agent login | | OpenAI Codex | codex | codex | codex --version | codex login | | Claude Code | claude | claude | claude --version | claude auth login | | GitHub Copilot CLI | copilot | copilot | copilot version | copilot login --web-flow |

Copilot does not provide a documented non-interactive authentication-status command equivalent to the other providers. VibeReview uses available token or GitHub CLI signals and otherwise lets the first Copilot agent request perform the definitive check.

Claude Code with Requesty

VibeReview supports Claude Code routed through Requesty without requiring first-party Anthropic OAuth. Export the Requesty gateway URL, your Requesty API key, and the model before running VibeReview:

export ANTHROPIC_BASE_URL="https://router.requesty.ai"
export ANTHROPIC_AUTH_TOKEN="<your-requesty-api-key>"
export ANTHROPIC_MODEL="anthropic/claude-sonnet-4-5"

npx @securityreviewai/[email protected] init --provider claude

VibeReview requires both a valid ANTHROPIC_BASE_URL and a non-empty ANTHROPIC_AUTH_TOKEN (or ANTHROPIC_API_KEY) in its inherited environment. It recognizes the configuration without reading or printing the key and skips claude auth status and claude auth login. Claude Code then inherits the same variables for code-specific guardrail generation.

If Requesty is configured only inside ~/.claude/settings.json, export the variables in the terminal that launches VibeReview as shown above so preflight can recognize them. Choose a model or Requesty policy supported by your account; the example model can be replaced through ANTHROPIC_MODEL.

Quick start

From the root of the project you want to protect:

npx @securityreviewai/vibereview-cli init

VibeReview will ask which coding agent you use, analyze the repository, install matched baseline guardrails, and configure that agent's local security workflow. It will then explain code-specific guardrails and ask whether you want to generate them.

After initialization, restart an already-running IDE agent so it reloads the new project instructions, skills, and hooks.

VibeReview's documented interface is the scoped npx command. It requires no global installation and avoids depending on npm's global binary directory being configured on your PATH.

Commands

npx @securityreviewai/vibereview-cli init

Detect the stack, select baseline guardrails, and install the security workflow for a coding agent.

npx @securityreviewai/vibereview-cli init

Common examples:

# Select the provider interactively
npx @securityreviewai/vibereview-cli init

# Non-interactive baseline-only setup
npx @securityreviewai/vibereview-cli init --provider codex --yes

# Non-interactive setup including token-consuming code-specific generation
npx @securityreviewai/vibereview-cli init --provider claude --yes --generate

# Explicitly skip the optional generation prompt
npx @securityreviewai/vibereview-cli init --provider cursor --skip-generation

# Initialize a different project directory
npx @securityreviewai/vibereview-cli init --cwd /path/to/project

# Re-detect the stack and refresh VibeReview-managed files
npx @securityreviewai/vibereview-cli init --provider copilot --force

# Return a machine-readable result
npx @securityreviewai/vibereview-cli init --provider codex --yes --json

| Option | Meaning | |---|---| | --provider <name> | Use cursor, codex, claude, or copilot instead of prompting. | | --yes, -y | Accept non-interactive defaults. Requires --provider; baseline setup remains token-free unless --generate is also present. | | --generate | Generate code-specific guardrails during initialization. This invokes the selected provider and consumes provider tokens. | | --skip-generation | Install only deterministic baseline guardrails and skip the optional generation prompt. | | --force | Refresh managed files while preserving existing custom and code-specific guardrails. | | --cwd <path> | Operate on a project other than the current directory. | | --json | Print machine-readable JSON instead of the normal terminal summary. | | --verbose | Show matched packs, detection warnings, and additional generation details. |

Running init again without --force stops rather than overwriting an initialized workspace.

npx @securityreviewai/vibereview-cli guardrails generate

Generate or regenerate repository-specific guardrails using the provider saved during initialization.

npx @securityreviewai/vibereview-cli guardrails generate

The command explains the token cost and asks for confirmation. A successful run atomically replaces only the code_specific section; baseline and custom guardrails are preserved.

# Confirm non-interactively
npx @securityreviewai/vibereview-cli guardrails generate --yes

# Generate for another initialized project
npx @securityreviewai/vibereview-cli guardrails generate --cwd /path/to/project

# Include evidence-bundle statistics
npx @securityreviewai/vibereview-cli guardrails generate --verbose

# Return a machine-readable result
npx @securityreviewai/vibereview-cli guardrails generate --yes --json

Regenerate after meaningful changes to security boundaries, authentication, authorization, external integrations, data access, secrets, infrastructure, or other sensitive parts of the codebase. You do not need to regenerate for every small edit.

General commands

npx @securityreviewai/vibereview-cli --help
npx @securityreviewai/vibereview-cli --version

What initialization creates

The provider-independent workspace state lives under .vibereview/:

.vibereview/
├── config.json        # Selected provider and project configuration
├── profile.json       # Deterministically detected technology profile
├── guardrails.yml     # Canonical baseline, generated, and custom rules
├── guardrails.md      # Generated human-readable guardrail tables
├── state.json         # Catalog/profile state used for safe refreshes
├── gates/             # Reserved local workflow state
├── hooks/
│   └── context.cjs    # Local session-context hook runtime
└── reports/
    └── <session-id>.md

guardrails.yml is the canonical file read by the agent workflow. guardrails.md is a generated view intended for people; do not edit it directly.

VibeReview also installs provider-native project files:

| Provider | Always-on instructions | Project skills | Hook configuration | |---|---|---|---| | Cursor | .cursor/rules/vibereview-security.mdc | .cursor/skills/vibereview-* | .cursor/hooks.json | | Codex | Managed block in AGENTS.md | .codex/skills/vibereview-* | .codex/hooks.json | | Claude Code | Managed block in .claude/CLAUDE.md | .claude/skills/vibereview-* | .claude/settings.json | | GitHub Copilot | Managed block in .github/copilot-instructions.md | .github/skills/vibereview-* | .github/hooks/vibereview.json |

Existing instruction text and unrelated hook entries are preserved. Files dedicated to VibeReview are refreshed only when they carry VibeReview ownership markers, preventing accidental replacement of user-owned files.

For a team-wide setup, commit the guardrails and provider integration files that should apply to every contributor. Decide separately whether .vibereview/reports/ belongs in version control: reports can contain useful security context, but they may also describe sensitive boundaries and residual risks.

Guardrail types

VibeReview combines three sources into one active guardrail file:

| Source | How it is created | Update behavior | |---|---|---| | baseline | Deterministically selected from bundled technology packs | Refreshed by init --force | | code_specific | Optionally generated from bounded repository evidence | Replaced by guardrails generate | | custom | Written and maintained by your team | Preserved by refresh and regeneration |

Adding custom guardrails

Add project policies to the custom list in .vibereview/guardrails.yml:

custom:
  - id: custom-admin-authorization
    source: custom
    type: must
    category: authorization
    title: Enforce server-side authorization for admin actions
    instruction: Every admin action must verify the authenticated user's admin role on the server.
    rationale: Client-side route protection is not an authorization boundary.
    cwe_ids:
      - CWE-862
    owasp_top10:
      - A01:2021

Use a stable, unique id; set source to custom; and use must or must_not for type. Custom edits are active immediately because the agent reads guardrails.yml. The human-readable guardrails.md view is rebuilt the next time you run init --force or successfully regenerate code-specific guardrails.

Code-specific guardrails and privacy

Code-specific generation is opt-in. Before it runs, VibeReview tells you that it will invoke the selected provider CLI and consume tokens from your configured provider account.

VibeReview selects at most 30 security-relevant files, capped at 80 KB in total and 24 KB per file. It excludes common dependency and build directories, provider configuration directories, .env files, credential-like paths, private keys, lockfiles, binary files, and symbolic links.

The bounded evidence is sent directly through your selected provider CLI under that provider's billing, retention, and privacy terms. When an LLM gateway such as Requesty is configured, its routing, billing, retention, and privacy terms also apply. VibeReview has no intermediary server.

The provider job runs from a temporary empty directory with provider-appropriate restrictions:

• Cursor uses sandboxed, read-only ask mode.
• Codex uses an ephemeral, read-only execution and ignores user configuration.
• Claude Code runs in plan mode with tools disabled, an empty MCP configuration, and no session persistence.
• GitHub Copilot runs non-interactively with only its read capability exposed to the empty working directory.

Generated output must pass VibeReview's schema and cite exact evidence paths. Generic rules, duplicates, unsupported fields, and invalid evidence references are rejected. VibeReview makes one repair attempt when a provider responds successfully with invalid structured output.

If generation fails, the deterministic baseline guardrails remain installed and active.

Security workflow during coding

For a security-relevant request, the installed instructions guide the coding agent through this sequence:

1. Read the project profile and shortlist applicable baseline, code-specific, and custom guardrails.
2. Perform a focused PWNISMS threat model for the requested feature or change.
3. Query OSV.dev when a dependency is added or its version changes, and re-check any proposed remediation version.
4. Implement secure-by-default code using the applicable guardrails and identified threats.
5. Run checks proportionate to the change.
6. Create or update the current IDE chat's Markdown security report.

PWNISMS covers product, workload, network, identity and access management, secrets, monitoring, and supply-chain risks. The analysis is scoped to the requested work; it is not a claim that every risk in the repository has been audited.

For OSV.dev checks, only the package ecosystem, canonical package name, and exact version are sent directly to https://api.osv.dev/v1/query. Source code, prompts, repository names, secrets, and lockfiles are not sent to OSV.dev.

Session reports

Reports are written locally to:

.vibereview/reports/<chat-session-id>.md

VibeReview uses one report per IDE chat, not one report per prompt:

• the first security-relevant request in a new chat creates a report;
• follow-up work in the same chat updates that same file;
• the agent may add, revise, reorder, or remove entries so the report reflects the feature's latest state; and
• a new IDE chat receives a new report file.

Reports use YAML frontmatter plus readable Markdown tables. Depending on the work performed, they cover scope and assumptions, threats and mitigations, security practices, OSV.dev results, secure code changes, applied guardrails, OWASP mappings, verification, and residual risks.

Treat reports as security-sensitive project documentation. They intentionally avoid full prompts, secrets, hidden reasoning, and raw tool output, but may still describe trust boundaries or remaining exposure.

Deterministic technology detection

The initial profile does not invoke a model. VibeReview derives technologies from recognized manifests, dependency names, source extensions, infrastructure files, and a small number of bounded content signals.

Detection ignores dependency, build, virtual-environment, and version-control directories and does not read .env files or credentials. Recognized signals include major JavaScript/TypeScript and Python frameworks, Go, Rust, Java, databases, authentication libraries, Docker, Kubernetes, Terraform providers, GitHub Actions, OpenAPI, MCP, and popular agent frameworks.

Run initialization with --verbose to see matched packs, warnings, and technologies without a bundled pack.

Troubleshooting

vibereview: command not found

The standalone vibereview command is not the documented installation path. Use the scoped package through npx:

npx @securityreviewai/vibereview-cli init

Provider CLI not found

VibeReview does not install provider CLIs. Install the selected provider's executable, verify its version using the command in the Requirements table, and retry.

You can still install token-free baseline guardrails without running code-specific generation. The provider CLI must be available when that provider actually handles prompts.

Authentication does not open or complete

Run the provider's login command directly in an interactive terminal, complete the browser flow, verify authentication, and retry generation:

cursor-agent login
codex login
claude auth login
copilot login --web-flow

VibeReview can only launch interactive authentication when both stdin and stdout are attached to a terminal. Headless and CI environments must be authenticated separately using provider-supported credentials.

Code-specific generation fails

Baseline guardrails remain active. Retry with additional diagnostics:

npx @securityreviewai/vibereview-cli guardrails generate --verbose

Common causes are missing authentication, provider quota or rate limits, a provider timeout, or invalid structured output. The default timeout is five minutes. It can be changed to a value of at least 10,000 milliseconds:

VIBEREVIEW_AGENT_TIMEOUT_MS=600000 npx @securityreviewai/vibereview-cli guardrails generate

Workspace is already initialized

Refresh VibeReview-managed files without discarding custom or generated rules:

npx @securityreviewai/vibereview-cli init --provider <cursor|codex|claude|copilot> --force

The coding agent does not use the workflow

Restart the IDE agent after initialization. Then confirm that the provider-specific instructions, project skills, and hook file listed above exist and are enabled by that provider. The workflow improves consistency but cannot guarantee compliance by an underlying model or provider runtime.

Reports are not appearing

Reports are created by the coding agent for security-relevant work, not by the deterministic initialization command. Restart the agent, begin a new chat, and make a request that changes a security boundary, sensitive data flow, dependency, authentication, authorization, external integration, or infrastructure configuration.

Updating VibeReview

With npx, select the latest published release explicitly when you want to avoid a cached version:

npx @securityreviewai/vibereview-cli@latest --version
npx @securityreviewai/vibereview-cli@latest init --provider codex --force

Review release notes before refreshing managed workflow files in important repositories.

Removing VibeReview

There is currently no automated uninstall command. Removal is intentionally manual because VibeReview merges managed blocks and hook entries into files that may also contain your own configuration.

To remove it safely, review and delete the VibeReview-owned instruction blocks, skills, and hook entries listed under What initialization creates, then remove .vibereview/ if you no longer need its guardrails or reports. Back up or retain reports required for audit or project history.

Security considerations

VibeReview is a security workflow aid, not a replacement for code review, security testing, architecture review, or professional assessment. Provider output can be incomplete or incorrect. Review security-critical changes and verify important controls independently.

See SECURITY.md for the security model, data-handling boundaries, and vulnerability-reporting process. Do not disclose suspected vulnerabilities in a public issue.

Contributing

Contributions are welcome. See CONTRIBUTING.md for the complete workflow and security-sensitive review expectations. A typical local development workflow is:

npm install
npm run typecheck
npm test

To run the local build against a test repository:

npm run build
node bin/vibereview.js init --cwd /path/to/test-project

Tests do not invoke paid provider requests. They cover catalog and skill assets, stack detection, evidence limits and exclusions, structured-output validation, runner restrictions, rule normalization, safe workspace updates, all four provider integrations, hook session identity, report contracts, and non-interactive setup.

The checked-in guardrail catalog is a compact runtime projection. Maintainers can import source packs and rebuild the compressed asset with:

npm run catalog:import -- /path/to/guardrail-packs
npm run build:catalog

Please keep changes focused, include tests for behavior changes, and avoid fixtures containing real credentials or proprietary source code.

License

Licensed under the Apache License 2.0.