Log inSubmit server
Guardvibe logo

Guardvibe

by goklab

Locally scans AI-generated code, dependencies, secrets, configs, and MCP hosts for security issues.

InstallRepositoryWebsite
Full README Compare alternatives Embed widget Claim this listing

Install Guardvibe

Pick your client, then add it in one click or paste the config.

STDIONode.js
~/Library/Application Support/Claude/claude_desktop_config.json
claude_desktop_config.json
{
  "mcpServers": {
    "goklab-guardvibe": {
      "command": "npx",
      "args": [
        "-y",
        "guardvibe"
      ]
    }
  }
}

Settings → Developer → Edit Config, merge this into mcpServers, then fully quit and reopen Claude Desktop.

Install not yet sandbox-tested— the server itself is confirmed live (we called its tools/list endpoint). The stdio install command is a separate, ongoing check.

Overview

goklab/guardvibe MCP server provides local security analysis for AI-generated applications and their development environments. It exposes tools for inline code checks, repository and dependency scans, taint analysis, secret detection, configuration audits, remediation, SARIF export, and compliance reporting. Reach for it when an AI coding workflow needs deterministic checks across a project rather than review of a single snippet. It also supports staged-file, changed-file, pull-request, pre-commit, and MCP host security workflows.

Use cases

  • Scan AI-generated application code for vulnerabilities
  • Audit dependencies for known CVEs before installation
  • Block secrets and security issues before commits
  • Review changed files and pull requests in CI
  • Audit MCP and AI host configuration

Key features

  • Cross-file taint and dataflow analysis
  • OSV-based dependency CVE detection
  • Secret and git-history scanning
  • Verified remediation and structured fixes
  • SARIF and compliance report generation
  • MCP host and configuration auditing

Tools39

What Guardvibe lets your agent do. Expand a tool for its parameters.

Verified live~8.3k tokens of context

Security & health

What it can reach and how reliably it runs — from our own checks, not the maintainer’s claims.

ActiveLast checked 2d ago

Recent health check succeeded.

19/19 checks healthy over the last 79d

Supply-chain signal

No high-severity advisories surfaced by our automated scan.

Critical 0High 0Medium 0Low 0

Scanned 11d ago via OSV.dev · guardvibe (npm)

Adoption & maintenance

Factual signals from GitHub, npm, and our automated checks — not a rating.

GitHub stars6Stargazers on the source repository.
npm downloads7kPackage downloads in the last 30 days.
Last commit4d agoMost recent push to the default branch.
Tools exposed39Callable tools this server registers over MCP.
Directory activity3 viewsConfig copies, upvotes, and views on AllMCPs.

How Guardvibe works

What goklab/guardvibe does

goklab/guardvibe adds security checks to an MCP-compatible coding agent. Its rule set targets common application vulnerabilities, OWASP Top 10 issues, dependency CVEs, leaked credentials, insecure configuration, and risks specific to AI-generated code. Framework-aware checks cover stacks such as Next.js, Supabase, Clerk, Stripe, Prisma, Hono, and GraphQL.

The server operates locally and does not require an account, API key, or cloud service. It can inspect code supplied directly to a tool or read files, directories, manifests, lockfiles, git state, and selected host configuration from disk. Results can be returned for agents, rendered for human review, or exported as SARIF for CI systems.

How it works

Use check_code for an inline snippet and scan_file, scan_directory, or check_project for code on disk. Project-wide analysis can produce a security score and findings across multiple files. analyze_dataflow follows user-controlled values into dangerous sinks within a file, while analyze_cross_file_dataflow follows those flows across supplied module contents.

Dependency checks use the OSV database and support npm, PyPI, and Go packages. scan_dependencies reads common manifests and lockfiles, while check_dependencies accepts package information for a targeted lookup. Secret scanning identifies credential patterns, high-entropy values, exposed environment files, and missing .gitignore coverage. Hallucinated-package scanning can run offline or optionally query the npm registry for package existence and download signals.

Security can be applied during development as well as review. scan_staged, scan_changed_files, and review_pr focus on changes, and scan_staged is diff-aware by default. scan_config_change compares configuration revisions for security downgrades. export_sarif produces SARIF 2.1.0 output for CI platforms, while policy_check evaluates project requirements defined in .guardviberc.

Setup and configuration

Run the package locally with npx guardvibe and connect it to an MCP-compatible coding client. The server is designed for zero-configuration use and runs without API keys. A pre-commit hook is available for blocking insecure staged code before a commit. CI workflows can consume SARIF output or use policy and severity checks as release gates.

Some tools accept paths and read the referenced files directly. For example, pass a directory to scan_directory, a file path to scan_file, or a project path and compliance framework to compliance_report. scan_host_config checks project environment files by default and can also inspect shell profiles and global AI configuration with host scope.

Tools and capabilities

  • Scan inline code, files, directories, projects, staged files, changed files, and pull requests.
  • Detect injection risks through single-file and cross-file dataflow analysis.
  • Find package CVEs, suspicious npm packages, typosquats, and likely AI-hallucinated dependencies.
  • Locate leaked secrets and inspect git history for credentials that were later removed.
  • Audit application configuration, MCP configuration, host configuration, and configuration changes.
  • Generate remediation guidance, structured patches, tailored security policies, and verified fixes.
  • Produce compliance mappings for SOC2, PCI-DSS, HIPAA, GDPR, ISO27001, and EUAIACT.
  • Export SARIF and maintain local security statistics in .guardvibe/stats.json.
  • Analyze shell commands with allow, ask, or deny risk verdicts before execution.

Limitations and notes

Large scan results may be truncated; project and compliance output includes mechanisms for prioritizing or limiting findings. Hallucinated-package checks can be fully deterministic with online:false; online registry checks add information when available and degrade gracefully offline. secure_this can return partial results or no_autofix, so remaining findings still require manual work. Its verified output should be written back to disk only after the returned definition-of-done gate passes.

The server supports Claude Code, Cursor, Gemini CLI, Codex, VS Code with Copilot, Windsurf, and other MCP-compatible coding agents. It is licensed under Apache-2.0.

Read the full README View source on GitHub

Reviews

No reviews yet — be the first to share how it worked for you.

Frequently Asked Questions about Guardvibe

goklab/guardvibe is an MCP server that connects AI coding agents to local application-security scanners and project files. Its main tools check code, scan projects and dependencies, detect secrets, analyze dataflow, audit MCP and host configuration, suggest or verify fixes, and export SARIF or compliance reports.

Install or run it with `npx guardvibe`, then connect that local process to an MCP-compatible coding client. It is designed to run without an account or API key and can be used for local scans, pre-commit checks, or CI workflows.

Yes, goklab/guardvibe works with Cursor. The project also names Claude Code, Gemini CLI, Codex, VS Code with Copilot, Windsurf, and other MCP-compatible coding agents as supported clients.

Yes, it checks npm, PyPI, and Go packages against the OSV database. Use `check_dependencies` for targeted package checks or `scan_dependencies` to read manifests and lockfiles such as `package.json`, `package-lock.json`, `requirements.txt`, and `go.mod`.

Yes, `fix_code` returns structured fix suggestions and patches, while `secure_this` applies candidate changes only when rescanning verifies them. `secure_this` can still return partial or no-autofix results, so any remaining findings need manual remediation.

Related MCP servers

All in Security All alternatives
Add a badge to your READMEShow it’s listed — live SVG, Markdown or HTML.

AllMCPs Directory Badge

Full Badge Customizer

Showcase your server listing on GitHub or your project documentation. Embed this dynamic SVG badge to highlight official listing status and live engagement.

Badge Style:
Live Dynamic SVG PreviewGuardvibe AllMCPs Directory Badge
Markdown (GitHub README)
[![AllMCPs](https://allmcps.com/api/badge/goklab-guardvibe?style=directory)](https://allmcps.com/mcp/goklab-guardvibe)
HTML Embed
<a href="https://allmcps.com/mcp/goklab-guardvibe"><img src="https://allmcps.com/api/badge/goklab-guardvibe?style=directory" alt="Guardvibe on AllMCPs" /></a>