What is vibeguard?

VibeGuard is a security scanner built specifically for code generated by AI coding tools, since the README argues that AI assistants tend to write working code quickly while skipping the security hardening a human developer would normally add. Running one command scans a project in about five seconds and reports problems like hardcoded API keys, SQL injection, and cross site scripting, each labeled by severity along with a suggested fix, and the tool can also attempt to fix some issues automatically. The scanner looks for over 50 kinds of leaked secret keys, from OpenAI and AWS to Stripe and Slack, and flags cases where a database like Supabase has been left open to the public with no row level security. It also traces how untrusted input actually flows through code, so it can confirm, rather than just guess, when user input reaches a SQL query or gets injected into an AI system prompt, which is a common way prompt injection attacks happen. Other checks look for AI agent loops with no limit on how many times they can run, and for cases where text generated by a language model gets passed straight into a command execution function, which could let an attacker run arbitrary commands through a crafted response. Beyond scanning code, VibeGuard can also audit the configuration of MCP tool servers that an AI agent connects to, checking for suspicious or unpinned installs and configuration that changed since it was last approved. A separate real time firewall feature can inspect an agent's actions, like network requests or shell commands, before they run, and block ones that would send a secret key or personal information to an outside server. Everything runs entirely on the user's own machine, with no telemetry and no account required, and it is distributed under the MIT license, meaning it can be used, modified, and shared freely as long as the copyright notice stays intact. It works alongside tools like Claude Code, Cursor, and several other AI coding assistants through a shared plugin protocol.