security MCP Server
Security infrastructure your AI can't be — deterministic, daily CVE intel past your model's training cutoff, whole-repo-aware, author-independent, and shift-left: secure_prompt secures the prompt before code generation. The security MCP for vibe coding: 442 rules, 38 tools, CLI + doctor for Next.js, Supabase, Clerk, Stripe, Prisma, Hono & MCP.
Discovered via unknown and last synced 3mo ago.
1. Install the package
npx -y guardvibe
2. Add to claude_desktop_config.json
{
"mcpServers": {
"guardvibe": {
"command": "npx",
"args": [
"guardvibe"
]
}
}
}Config file location: ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) / %APPDATA%\Claude\claude_desktop_config.json (Windows)
Not supported
Detect project stack and generate tailored security policies (CSP, CORS, RLS)
Get detailed remediation guidance with exploit scenarios and fix strategies
**Auth coverage map** — enumerate routes, parse middleware matchers, detect auth guards, report coverage %
Raw queries, client exposure, service role leaks, NoSQL injection, Drizzle identifier injection (CVE-2026-39356)
string
`"high"`
What it does
Track tainted data flows from user input to dangerous sinks
**Host security audit** — CVE-2025-59536, CVE-2026-21852, MCP config, env scanner
**Remediation verification** — compares before/after audit, flags skipped sections
Webhook signatures, key exposure, price manipulation
Type
string
GuardVibe
Pre-commit scan of git-staged files — **diff-aware** (blocks only newly-staged lines; `diff_aware:false` for whole files)
Audit project configuration files for cross-file security misconfigurations
Assess overall repository security posture and map sensitive areas
Get recommended tool workflow for your current task (writing, pre-commit, PR review, etc.)
Malicious install scripts, lockfile integrity, dependency confusion, typosquat detection
7
6
string
`string[]`
Extensive
Detect leaked secrets, API keys, tokens
Real-time single-file scan — designed for post-edit hooks
AsyncStorage secrets, deep links, ATS, hardcoded URLs
Known vulnerable versions in package.json — incl. Axios supply-chain backdoor, Clerk middleware bypass (GHSA-vqx2), Next.js RSC DoS (CVE-2026-23869), Hono CRLF (CVE-2026-29086)
RegExp
Yes
Check project against compliance policies defined in .guardviberc
Cumulative security dashboard — scans, fixes, grade trend over time
**Remediation plan** — generates section-by-section fix checklist after audit
ReDoS, CRLF injection, race conditions, XXE, brute force, audit logging
4
medium
string
Paid tier
Check individual packages against OSV
Scan only git-changed files — for PRs and incremental CI; **diff-aware** (only newly-added lines; `diff_aware:false` for whole files)
**Single source of truth** — runs ALL checks in one call, returns PASS/FAIL/WARN verdict + score + coverage % + deterministic result hash
Zod, tRPC, Hono, GraphQL, Uploadthing, Turso, Convex, OAuth, CSP, webhooks, AI SDK, React Server Action validation (React2Shell)
AWS, GCP, MongoDB, Convex, Sentry, Twilio
sarif
string[]
Scan a project directory from disk
**Auto-fix suggestions** with concrete patches for AI agents
Compare config file versions to detect security downgrades
Verify a security fix was applied correctly — returns fixed/still_vulnerable/new_issues
Server Actions, secret exposure, auth bypass, CSP, redirects
Secrets interpolation, unpinned actions, write-all permissions
string
`512000`
Analyze a code snippet for security issues
SARIF v2.1.0 export for CI/CD integration
**Cross-file taint analysis** — track tainted data across module boundaries
Audit MCP server configurations for hook injection, file:// abuse, sensitive paths
Rules
API key leaks, PII tracking, email injection
6
string
string[]
Scan multiple files with security scoring (A-F)
Security best practices and guides
Analyze shell commands for security risks before execution
Scan shell profiles, .env files for base URL hijack and credential sniffing
SQL injection, XSS, CSRF, command injection, CORS, SSRF, hardcoded secrets
Webhooks, CSP, .env safety, AI key exposure, cookie handling
7
string
Typosquat detection, maintenance status, adoption metrics
Scan git history for leaked secrets (active and removed)
Known vulnerable versions in package.json — incl. Vite dev-server cmd injection (CVE-2024-52011), React Router 7 cluster (CVE-2026-33245/42211/42342), DOMPurify XSS (CVE-2026-47423), Better Auth bypass (CVE-2026-45337), Axios supply-chain backdoor
Check all dependencies for known CVEs (OSV) — annotates each vulnerable package with **reachability** (is it actually imported in your source?)
Map security findings to compliance controls (SOC2, PCI-DSS, HIPAA, GDPR, ISO27001, EU AI Act)
**Close the loop** — scan, apply only the fixes that verifiably land (each re-scanned, rolled back on regression), return the verified code + a definition-of-done gate
Review PR diff for security issues with severity gating
**LLM-powered deep analysis** — IDOR, business logic, race conditions, auth bypass. Defaults to Claude Haiku 4.5 (~cents/scan). Pass `model: 'sonnet'` for deeper analysis. CLI: `npx guardvibe deep-scan <file> --focus idor`
**Prompt-level security (shift left)** — analyze a coding prompt BEFORE code is written; deterministic triage (NO_MOD/LIGHT_MOD/HEAVY_MOD), stack + attack-surface detection, severity-ranked GuardVibe requirements embedded via a rewrite directive
真实性验证技能。分析用户提供的信息、消息、图片或内容，判断其真实性和可信度，识别虚假信息、AI生成内容或伪造内容。
Container escape is a critical attack technique where an adversary breaks out of container isolation to access the host system or other containers. Detection involves monitoring for escape indicators
Pod Security Standards (PSS) define three levels of security policies -- Privileged, Baseline, and Restricted -- enforced by the Pod Security Admission (PSA) controller built into Kubernetes 1.25+. PS
Implements eBPF-based security monitoring using Cilium Tetragon for real-time process execution tracking, network connection observability, file access auditing, and runtime enforcement. Covers TracingPolicy CRD authoring with kprobe/tracepoint hooks, in-kernel filtering via matchArgs/matchBinaries selectors, JSON event export, and integration with SIEM pipelines. Use when building kernel-level runtime security observability for Linux hosts or Kubernetes clusters.
AI Agent Governance Toolkit — Policy enforcement, zero-trust identity, execution sandboxing, and reliability engineering for autonomous AI agents. Covers 10/10 OWASP Agentic Top 10.
Open-source sandboxed agent harness for teams. Giving every employee a secured personal agent.
AI agent security scanner. Detect vulnerabilities in agent configurations, MCP servers, and tool permissions. Available as CLI, GitHub Action, ECC plugin, and GitHub App integration. 🛡️
A secure* runtime for autonomous AI agents. Policy from plain-English constitutions. (*https://ironcurtain.dev)
Learn how to use the absolute-audit Claude skill. Complete guide with installation instructions and examples.
Learn how to use the token-scam-analysis Claude skill. Complete guide with installation instructions and examples.
Learn how to use the absolute-upgrade Claude skill. Complete guide with installation instructions and examples.