$ loading_
Scan AI-generated code for security risks before shipping with ranked findings.
This MCP tool is described as a local code security scanner, with no stated need for credentials or remote endpoints. Its code-execution/scanning behavior carries normal local-tooling risk, but the open-source MIT-licensed nature keeps the overall posture closer to caution than high risk.
The materials explicitly state that no keys or environment variables are required. No API tokens, cloud credentials, or other sensitive authentication secrets are requested, so credential exposure and misuse risk appears low.
The materials list no remote endpoints, and the README does not indicate uploads of code, telemetry, or scan results to external services. Based on the provided facts, there is no explicit data-egress path.
The system flags executes-code, and the tool exposes a scanner over MCP, so it likely runs local parsing/analysis logic and may spawn related processes or inspect target code. This is normal for this class of tool and merits caution, but no specific red flags of excessive execution are shown.
As a code scanner, it would normally need to read project source and related files; the mention of inter-procedural taint analysis implies access may span multiple files. The materials do not show writes to sensitive system locations or permissions unrelated to scanning, so this is a standard data-access caution item.
Positive factors include being open source, auditable, and MIT licensed. However, it comes from a third-party registry, has 0 stars, unknown maintenance status, and limited README detail, so supply-chain maturity and maintenance signals are weak; review the source and dependencies before using it in sensitive environments.
Copy the install command and let the AI configure it · recommended for beginners
No copy-paste install info for "vibecheck" yet — see the docs or source repo.
Use vibecheck to scan this AI-generated Node.js backend code. Focus on SQL injection, SSRF, command injection, path traversal, weak JWT settings, and exposed secrets, then rank findings by confidence.
A confidence-ranked list of security findings with vulnerability type, affected location, and risk explanation.
Before merging, run vibecheck on this Python service code to detect inter-procedural sensitive data flows and check for hardcoded secrets, command execution, and unsafe CORS configuration.
A security report for code review that highlights potential vulnerabilities and their remediation priority.
Use vibecheck to scan this Go microservice code and assess whether it is safe to ship, focusing on request forwarding, file access, auth tokens, and database query risks.
A ship/no-ship recommendation with specific risks, severity assessment, and remediation guidance.
Scan codebases, model threats, review security, and generate reports with AI.
Scan JS/TS files for event-listener leaks and generate validated fixes.
Scan AI agents for tool-calling vulnerabilities and surface key security risks.
Provide mentor-like feedback to AI agents on complex, high-stakes workflows.
Scan Python projects and GitHub repos for vulnerabilities, secrets, and AI risk insights.
Scan AI coding workflows for code, secrets, dependency, and tool security risks.