vibecheck

34 rules for catching AI-generated code smells. ESLint for AI slop.

npx @yuvrajangadsingh/vibecheck .

  src/api/routes.ts
    12:5    error  no-hardcoded-secrets   Hardcoded secret detected. Use environment variables instead.
    45:3    error  no-empty-catch         Empty catch block swallows errors silently.
    89:1    warn   no-console-pollution   console.log left in production code.

  src/utils/db.ts
    34:5    error  no-sql-concat          SQL query built with string concatenation.

  4 problems (3 errors, 1 warning)
  2 files with issues out of 47 scanned (0.8s)

Why

AI coding tools generate code that works but cuts corners. Empty catch blocks, hardcoded secrets, as any everywhere, comments that restate the obvious. CodeRabbit found AI-generated PRs have 1.7x more issues than human PRs. Veracode reports 45% of AI code samples contain security vulnerabilities.

vibecheck catches these patterns with zero config, zero API keys, zero cost. Runs locally, stays fast.

Install

# Run directly (no install)
npx @yuvrajangadsingh/vibecheck .

# Install globally
npm install -g @yuvrajangadsingh/vibecheck

# Standalone binary (no Node required)
curl -fsSL https://github.com/yuvrajangadsingh/vibecheck/releases/latest/download/vibecheck-darwin-arm64 -o vibecheck
chmod +x vibecheck
./vibecheck .

Standalone binaries (built with Bun) available for macOS (arm64, x64) and Linux (x64, arm64) on the releases page. No Node.js or npm required. Python developers can use these to scan their codebases without installing Node.

What it catches

Security

| Rule | Severity | What it detects | |------|----------|----------------| | no-hardcoded-secrets | error | API keys, tokens, passwords in source code | | no-eval | error | eval() and new Function() calls | | no-sql-concat | error | SQL queries built with string concatenation | | no-innerhtml | warn | innerHTML and dangerouslySetInnerHTML usage |

Error Handling

| Rule | Severity | What it detects | |------|----------|----------------| | no-empty-catch | error | Empty catch blocks that silently swallow errors | | no-console-error-only | warn | Catch blocks that only console.error without rethrowing | | no-swallowed-promise | warn | .then() chains without .catch() |

Code Quality

| Rule | Severity | What it detects | |------|----------|----------------| | no-console-pollution | warn | console.log/debug/info left in production code | | no-ai-todo | info | AI-generated placeholder TODOs (TODO: implement, FIXME: add) | | no-god-function | warn | Functions over 80 lines |

AI-Specific Tells

| Rule | Severity | What it detects | |------|----------|----------------| | no-obvious-comments | info | Comments that restate code (// initialize the counter) | | no-ts-any | warn | TypeScript any types and as any casts |

Framework

| Rule | Severity | What it detects | |------|----------|----------------| | no-express-unhandled | warn | Async Express routes without error handling | | no-error-info-leak | error | Error internals (err.message, err.stack) leaked to HTTP responses | | no-flask-debug | warn | Flask app.run(debug=True) in production |

Python

| Rule | Severity | What it detects | |------|----------|----------------| | no-py-eval | error | eval(), exec(), os.system(), subprocess(shell=True) | | no-py-sql-concat | error | SQL queries built with f-strings or .format() | | no-bare-except | error | except: without specifying exception type | | no-pass-except | error | except: pass silently swallowing errors | | no-star-import | warn | from module import * namespace pollution | | no-mutable-default | warn | Mutable default arguments (def foo(bar=[])) | | no-py-print | warn | print() left in production code | | no-py-obvious-comments | info | Comments restating code (# initialize the counter) | | no-type-ignore-blanket | warn | Blanket # type: ignore without specific error code |

Options

vibecheck [path] [options]

Options:
  -c, --config <file>     Path to config file
  -d, --diff              Only scan lines changed in git diff (unstaged)
  --staged                Only scan lines changed in git diff --cached (staged)
  --json                  Output as JSON (for CI pipelines)
  --ignore <patterns...>  Additional ignore patterns
  --severity <level>      Minimum severity: error, warn, info (default: warn)
  -q, --quiet             Only show summary
  --mcp                   Start MCP server (stdio transport)
  -v, --version           Show version
  -h, --help              Show help

Diff mode

Scan only the lines you changed, not the entire codebase. Useful for pre-commit hooks and incremental CI.

# Scan unstaged changes
vibecheck --diff .

# Scan staged changes (pre-commit hook)
vibecheck --staged .

# CI-friendly output
vibecheck --staged --json .

Pre-commit hook

Add to .git/hooks/pre-commit or use with husky:

#!/bin/sh
npx @yuvrajangadsingh/vibecheck --staged .

Config

Create .vibecheckrc in your project root:

{
  "rules": {
    "no-console-pollution": "off",
    "no-obvious-comments": "warn",
    "no-ts-any": "error"
  },
  "ignore": [
    "node_modules",
    "dist",
    "*.test.ts"
  ]
}

All rules are on by default at their recommended severity. Set any rule to "off" to disable it.

VS Code Extension

Get inline diagnostics (squigglies) right in your editor:

ext install yuvrajangadsingh.vibecheck-linter

Available on the VS Code Marketplace. Works in VS Code, Cursor, and Windsurf.

Features: inline error/warning/info markers, Problems panel integration, status bar count, runs on save.

GitHub Action

Add vibecheck to your CI with inline PR annotations:

- uses: yuvrajangadsingh/[email protected]
  with:
    severity: warn       # minimum severity to report (default: warn)
    fail-on: error       # fail the check at this severity (default: error)
    ignore: "tests/**"   # comma-separated ignore patterns

The action automatically scans only files changed in the PR. On push events, it scans the full repo.

Available on the GitHub Marketplace. See it in action on the demo repo.

Manual CI

npx @yuvrajangadsingh/vibecheck . --json > vibecheck.json

Pre-commit Hook

Add vibecheck to your pre-commit config:

# .pre-commit-config.yaml
repos:
  - repo: https://github.com/yuvrajangadsingh/vibecheck
    rev: v1.2.0
    hooks:
      - id: vibecheck

MCP Server

vibecheck ships with a built-in MCP server so AI coding agents can scan code for slop automatically.

# Start the MCP server
vibecheck --mcp

# Or use the dedicated binary
vibecheck-mcp

Add to your Claude Code, Cursor, or Windsurf config:

{
  "mcpServers": {
    "vibecheck": {
      "command": "npx",
      "args": ["-y", "@yuvrajangadsingh/vibecheck", "--mcp"]
    }
  }
}

3 tools available: scan-files (scan files/directories), scan-diff (scan a git diff), get-rules (list all rules).

How is this different from ESLint?

ESLint catches syntax and style issues. vibecheck catches patterns that are specifically common in AI-generated code.

| | vibecheck | ESLint | sloppylint | |---|---|---|---| | AI-specific rules | 34 | 0 | ~20 | | Hedging comments | yes | no | yes | | Stub detection | yes | no | yes | | Section dividers | yes | no | no | | Step comments | yes | no | no | | Deep nesting | yes | plugin | no | | GitHub Action | yes | community | no | | Pre-commit | yes | yes | no | | Zero config | yes | no | no | | Languages | JS/TS/Python | JS/TS | Python |

How it works

vibecheck uses regex pattern matching to scan your JS/TS/Python files. No AST parsing, no external APIs, no AI. Each rule has a detection pattern and an anti-pattern to reduce false positives.

It skips node_modules, dist, build, __pycache__, .venv, lockfiles, and minified code by default.

License

FSL-1.1-Apache-2.0