Guardvibe vs Agentstamp
A side-by-side look at the Guardvibe and Agentstamp MCP servers: transport, auth, tools, quality signals, and the config to install either one in Claude, Cursor, Windsurf or VS Code.
Verdict: choose Guardvibe for security work as a local process; choose Agentstamp for security over a hosted endpoint. You can also run both side by side in one mcpServers block.
Which MCP server should you choose?
Choose Guardvibe when
- You need dedicated capabilities in the Security domain.
- You prefer a local stdio subprocess transport.
- You want tools like
check_code, check_project, get_security_docs.
Choose Agentstamp when
- You need dedicated capabilities in the Security domain.
- You prefer a remote HTTP/SSE transport.
- Its auth model fits you: other.
- You have the keys it needs:
WALLET_ADDRESS. - You want tools like
search_agents, get_agent, verify_stamp.
Feature & specification comparison
Rows where the two servers differ are marked.
| Spec | ||
|---|---|---|
| Category | Security | Security |
| Quality signal | 65/100 · Great | 56/100 · Good |
| Install command | Confirmed | Confirmed |
| Transport | Local subprocess (stdio) | Remote HTTP/SSE |
| Auth | Not declared | other |
| Pricing | Not declared | Free |
| Required env vars | None listed | WALLET_ADDRESS |
| Verified owner | Community listing | Community listing |
| GitHub stars | 6 | 2 |
| Directory activity | 2 views 0 installs 0 upvotes | 2 views 0 installs 0 upvotes |
| Tools | 39 | 19 |
| Full listing | View Guardvibe | View Agentstamp |
Tools & capabilities
Guardvibe tools 39
check_codeAnalyze inline code for security vulnerabilities (OWASP Top 10, XSS, SQL injection, insecure patterns). Pass code as a string parameter. For scanning files on disk, use scan_file instead. Example: check_code({code: 'app.get(...)', language: 'javascript'})check_projectScan multiple files for security vulnerabilities and generate a project-wide security report with a security score. Use this for comprehensive security audits.get_security_docsGet security best practices and remediation guidance for a specific topic, framework, or vulnerability type. Covers OWASP Top 10, framework-specific hardening (Next.js, Supabase, Stripe), and secure coding patterns. Returns actionable guidance with code examples.check_dependenciesCheck npm, PyPI, or Go packages for known security vulnerabilities (CVEs) using the OSV database. Use this before adding new dependencies or to audit existing ones.scan_directoryScan all files in a directory on disk for security vulnerabilities. Pass a directory path — reads files from filesystem. Returns security score (A-F) and findings. Results may be truncated for large projects — check fileRanking in JSON output for top files. Example: scan_directory({path: './src'})scan_dependenciesParse a lockfile or manifest (package.json, package-lock.json, requirements.txt, go.mod) and check all dependencies for known CVEs via the OSV database. Reads the file directly. Use this after installing dependencies, during CI, or when auditing existing projects for vulnerable packages.scan_hallucinated_packagesDetect AI-hallucinated and slopsquatted packages in a repo — the supply-chain seam commodity SCA misses. OFFLINE (deterministic): flags phantom imports (a package imported in source but absent from every package.json — a classic LLM hallucination tell) and typosquats of popular packages. ONLINE (opt-in, default on; gracefully degrades offline): adds npm-registry truth — packages that return 404 (definitive hallucination) and brand-new low-download packages (slopsquat-registration pattern). Run on AI-generated code at PR time, before `npm install`. Pass online:false for a fully deterministic, air-gapped scan.scan_secretsScan files and directories for leaked secrets, API keys, tokens, and credentials. Detects high-entropy strings, known API key patterns (AWS, Stripe, OpenAI, GitHub, Supabase), exposed .env files, and missing .gitignore coverage. Returns findings with exact line numbers and remediation steps.scan_stagedScan git-staged files for security vulnerabilities before committing. Run this before every commit to catch issues early. No input needed — automatically reads staged files. Diff-aware by default: reports only issues on newly-staged lines (set diff_aware:false for whole staged files).compliance_reportMap security findings to compliance controls (SOC2, PCI-DSS, HIPAA, GDPR, ISO27001, EUAIACT). Scans a directory and groups issues by control. Output includes a summary section at the top; for large projects, findings are truncated to top 50. Use mode=executive for C-level summary. Example: compliance_report({path: '.', framework: 'SOC2'})export_sarifScan a directory and export results in SARIF v2.1.0 format for CI/CD integration (GitHub, GitLab, Azure DevOps). Returns JSON string.check_package_healthCheck npm packages for typosquat risk, maintenance status, adoption metrics, and deprecation. Use this before adding new dependencies to catch suspicious or risky packages.- +27 more on the listing page
Agentstamp tools 19
search_agentsSearch the AgentStamp agent directory by query and/or category. Returns agents with reputation scores.get_agentGet full agent profile by ID, including endorsements and reputation score.verify_stampVerify an AgentStamp identity certificate by its stamp ID.browse_agentsBrowse registered agents with optional category filter and sorting.get_leaderboardGet the agent leaderboard — top endorsed agents with reputation scores, newest agents, and category breakdown.browse_wishesBrowse wishes from the Wishing Well. Discover what capabilities AI agents want.get_trendingGet trending wish categories and velocity from the Wishing Well.get_agent_reputationGet an agent's reputation score (0-100) with full breakdown by tier, endorsements, uptime, age, and wishes granted.get_passportGet a signed cross-protocol agent passport. Contains identity, stamp, reputation, A2A card, and MCP metadata — all Ed25519-signed.trust_checkSingle-call trust verdict for any wallet address. Returns whether the agent is trusted, their score, tier, and profile info. Unregistered agents get trusted: false with a registration CTA.trust_compareCompare trust scores of up to 5 wallets side-by-side. See who leads, the score gap, and which agents are unregistered.trust_networkNetwork-wide trust statistics: total agents, stamps, endorsements, wishes, average reputation, top categories. Social proof for the AgentStamp network.- +7 more on the listing page
Ready-to-paste client configs
Paste either block (or both) into your client config, e.g. claude_desktop_config.json or ~/.cursor/mcp.json. We only show a config when the install command is confirmed.
Guardvibe
{
"mcpServers": {
"goklab-guardvibe": {
"command": "npx",
"args": [
"-y",
"guardvibe"
]
}
}
}
Agentstamp
{
"mcpServers": {
"vinaybhosle-agentstamp": {
"url": "https://agentstamp.org/mcp"
}
}
}
Frequently asked questions
Guardvibe is categorized under Security and uses a local stdio subprocess. Agentstamp belongs to Security and uses a remote HTTP/SSE transport. Pick Guardvibe for security work and Agentstamp for security.
Copy the mcpServers block from the config section on this page into your client's config (for example claude_desktop_config.json or ~/.cursor/mcp.json), then fully restart the client.
Guardvibe has no declared pricing — check the project's own site. Agentstamp is listed as free. Auth: other. If a server needs environment variables such as API keys, define them under the env key in your client's MCP config.
Yes. MCP clients support multiple servers: add goklab-guardvibe and vinaybhosle-agentstamp as separate keys in the same mcpServers object, and your assistant will call tools from either one.
On AllMCPs, Guardvibe has a quality signal of 65/100 (Great) with 2 views, 0 installs and 6 GitHub stars. Agentstamp has 56/100 (Good) with 2 views, 0 installs and 2 GitHub stars.