Guardvibe vs Healthclaw Guardrails
A side-by-side look at the Guardvibe and Healthclaw Guardrails MCP servers: transport, auth, tools, quality signals, and the config to install either one in Claude, Cursor, Windsurf or VS Code.
Verdict: choose Guardvibe for security work as a local process; choose Healthclaw Guardrails for security over a hosted endpoint. You can also run both side by side in one mcpServers block.
Which MCP server should you choose?
Choose Guardvibe when
- You need dedicated capabilities in the Security domain.
- You prefer a local stdio subprocess transport.
- You want tools like
check_code, check_project, get_security_docs.
Choose Healthclaw Guardrails when
- You need dedicated capabilities in the Security domain.
- You prefer a remote HTTP/SSE transport.
- You want tools like
context_get, fhir_read, fhir_search.
Feature & specification comparison
Rows where the two servers differ are marked.
| Spec | ||
|---|---|---|
| Category | Security | Security |
| Quality signal | 65/100 · Great | 61/100 · Good |
| Install command | Confirmed | Confirmed |
| Transport | Local subprocess (stdio) | Remote HTTP/SSE |
| Auth | Not declared | Not declared |
| Pricing | Not declared | Not declared |
| Required env vars | None listed | None listed |
| Verified owner | Community listing | Community listing |
| GitHub stars | 6 | 31 |
| Directory activity | 2 views 0 installs 0 upvotes | 1 views 0 installs 0 upvotes |
| Tools | 39 | 27 |
| Full listing | View Guardvibe | View Healthclaw Guardrails |
Tools & capabilities
Guardvibe tools 39
check_codeAnalyze inline code for security vulnerabilities (OWASP Top 10, XSS, SQL injection, insecure patterns). Pass code as a string parameter. For scanning files on disk, use scan_file instead. Example: check_code({code: 'app.get(...)', language: 'javascript'})check_projectScan multiple files for security vulnerabilities and generate a project-wide security report with a security score. Use this for comprehensive security audits.get_security_docsGet security best practices and remediation guidance for a specific topic, framework, or vulnerability type. Covers OWASP Top 10, framework-specific hardening (Next.js, Supabase, Stripe), and secure coding patterns. Returns actionable guidance with code examples.check_dependenciesCheck npm, PyPI, or Go packages for known security vulnerabilities (CVEs) using the OSV database. Use this before adding new dependencies or to audit existing ones.scan_directoryScan all files in a directory on disk for security vulnerabilities. Pass a directory path — reads files from filesystem. Returns security score (A-F) and findings. Results may be truncated for large projects — check fileRanking in JSON output for top files. Example: scan_directory({path: './src'})scan_dependenciesParse a lockfile or manifest (package.json, package-lock.json, requirements.txt, go.mod) and check all dependencies for known CVEs via the OSV database. Reads the file directly. Use this after installing dependencies, during CI, or when auditing existing projects for vulnerable packages.scan_hallucinated_packagesDetect AI-hallucinated and slopsquatted packages in a repo — the supply-chain seam commodity SCA misses. OFFLINE (deterministic): flags phantom imports (a package imported in source but absent from every package.json — a classic LLM hallucination tell) and typosquats of popular packages. ONLINE (opt-in, default on; gracefully degrades offline): adds npm-registry truth — packages that return 404 (definitive hallucination) and brand-new low-download packages (slopsquat-registration pattern). Run on AI-generated code at PR time, before `npm install`. Pass online:false for a fully deterministic, air-gapped scan.scan_secretsScan files and directories for leaked secrets, API keys, tokens, and credentials. Detects high-entropy strings, known API key patterns (AWS, Stripe, OpenAI, GitHub, Supabase), exposed .env files, and missing .gitignore coverage. Returns findings with exact line numbers and remediation steps.scan_stagedScan git-staged files for security vulnerabilities before committing. Run this before every commit to catch issues early. No input needed — automatically reads staged files. Diff-aware by default: reports only issues on newly-staged lines (set diff_aware:false for whole staged files).compliance_reportMap security findings to compliance controls (SOC2, PCI-DSS, HIPAA, GDPR, ISO27001, EUAIACT). Scans a directory and groups issues by control. Output includes a summary section at the top; for large projects, findings are truncated to top 50. Use mode=executive for C-level summary. Example: compliance_report({path: '.', framework: 'SOC2'})export_sarifScan a directory and export results in SARIF v2.1.0 format for CI/CD integration (GitHub, GitLab, Azure DevOps). Returns JSON string.check_package_healthCheck npm packages for typosquat risk, maintenance status, adoption metrics, and deprecation. Use this before adding new dependencies to catch suspicious or risky packages.- +27 more on the listing page
Healthclaw Guardrails tools 27
context_getRetrieve a pre-built context envelope with patient-centric FHIR resources. Returns bounded, policy-stamped, time-limited context.fhir_readRead a specific FHIR resource by type and ID. Supports FHIR R4 US Core v9 stable resources and FHIR R6 ballot3 experimental resources. Returns redacted resource with PHI protection.fhir_searchSearch for FHIR resources. Supports FHIR R4 US Core v9 stable resources and FHIR R6 ballot3 experimental resources. Supports patient, code, status, _lastUpdated, _count, _sort parameters. Returns paginated, redacted Bundle.fhir_validateValidate a proposed FHIR R6 resource against structural rules. Returns OperationOutcome.questionnaire_populateSDC $populate — pre-fill a Questionnaire for a subject. Returns a QuestionnaireResponse. Read tier; mints a tenant token for non-public tenants.questionnaire_extractSDC $extract — extract FHIR resources from a completed QuestionnaireResponse into a transaction Bundle. Write tier; requires step-up authorization, including for dry_run=true previews.fhir_propose_writePropose a write — validates the resource and returns a preview. Does NOT commit. Write tier: step-up authorization is required and is supplied by the deployment as an X-Step-Up-Token header. You cannot obtain or pass it yourself. If it is absent this returns requires_step_up; tell the patient authorization is needed rather than attempting another route.fhir_commit_writeCommit a previously proposed write. Requires step-up authorization token. This is a destructive operation.fhir_statsCompute statistics (count, min, max, mean) over numeric Observation values. Standard FHIR $stats (since R4). Only supports valueQuantity. Filter by patient and/or code.fhir_interpret_labsInterpret lab Observations against reference ranges — flags each value low/normal/high/critical (HL7 v3 ObservationInterpretation) and returns clinician + consumer summaries. Decision support, not diagnosis. Read-tier. Response includes _meta.ui.resourceUri pointing to an embeddable trend timeline.care_gapsCheck which preventive-care screenings/immunizations a patient may be due for (blood pressure, cholesterol, colorectal/cervical/breast cancer screening, flu, diabetes A1c), from their own connected records. Decision support based on USPSTF/ACIP/ADA guidelines — not a diagnosis or directive. Response includes _meta.ui.resourceUri pointing to an embeddable review UI.guardrail_conformanceRun the guardrail conformance self-test on the connected HealthClaw deployment and return the graded scorecard across seven guardrail properties: PHI redaction, immutable audit, step-up auth, human-in-the-loop, tenant isolation, medical disclaimers, and error fidelity. Uses synthetic data only. Set fresh=true to force a new run instead of the cached result.- +15 more on the listing page
Ready-to-paste client configs
Paste either block (or both) into your client config, e.g. claude_desktop_config.json or ~/.cursor/mcp.json. We only show a config when the install command is confirmed.
Guardvibe
{
"mcpServers": {
"goklab-guardvibe": {
"command": "npx",
"args": [
"-y",
"guardvibe"
]
}
}
}
Healthclaw Guardrails
{
"mcpServers": {
"healthclaw-guardrails": {
"url": "https://mcp-demo-production-ee2c.up.railway.app/mcp"
}
}
}
Frequently asked questions
Guardvibe is categorized under Security and uses a local stdio subprocess. Healthclaw Guardrails belongs to Security and uses a remote HTTP/SSE transport. Pick Guardvibe for security work and Healthclaw Guardrails for security.
Copy the mcpServers block from the config section on this page into your client's config (for example claude_desktop_config.json or ~/.cursor/mcp.json), then fully restart the client.
Guardvibe has no declared pricing — check the project's own site. Healthclaw Guardrails has no declared pricing — check the project's own site. If a server needs environment variables such as API keys, define them under the env key in your client's MCP config.
Yes. MCP clients support multiple servers: add goklab-guardvibe and healthclaw-guardrails as separate keys in the same mcpServers object, and your assistant will call tools from either one.
On AllMCPs, Guardvibe has a quality signal of 65/100 (Great) with 2 views, 0 installs and 6 GitHub stars. Healthclaw Guardrails has 61/100 (Good) with 1 views, 0 installs and 31 GitHub stars.