Security scanner for AI-generated code - detects vulnerabilities in vibe-coded projects
Security Scanner for AI-Generated Code
Catches vulnerabilities your AI assistant missed. Integrates directly with Claude Code, Cursor, and Cline via MCP (Model Context Protocol).
# 2-minute setup for Claude Code
echo '{"mcpServers":{"vibesec":{"command":"bun","args":["run","/path/to/vibesec-bun-poc/bin/vibesec-mcp"]}}}' > ~/.claude/mcp.json
# Restart Claude Code - that's it!
VibeSec now works inside your AI coding assistant through MCP integration:
Demo:
You: "Claude, can you scan this file for security issues using VibeSec?"
Claude: *uses vibesec_scan tool* "Found 2 critical issues:
1. Hardcoded API key on line 23
2. SQL injection risk in query builder..."
The rise of vibe coding has democratized software development, but 45% of AI-generated code fails security tests (Veracode 2025). VibeSec bridges the gap between rapid AI-assisted development and production-ready security.
# Install via npm
npm install -g vibesec
# Or use with Bun (recommended for POC)
bun install vibesec
# Scan your project
vibesec scan .
# Get plain language help
vibesec scan --explain
# Generate stakeholder report
vibesec scan -f stakeholder -o report.txt
VibeSec speaks your language! No security expertise needed.
# Scan with plain language explanations
vibesec scan . --explain
# What you'll see:
# ✅ Clear "What/Why/How" explanations (no jargon!)
# ✅ Real-world analogies (e.g., "like leaving your door unlocked")
# ✅ Time estimates for each fix (e.g., "15-30 minutes")
# ✅ Who can fix it (e.g., "Any developer")
# ✅ Security score out of 100
First time? Check out the Quick Start Guide for a step-by-step walkthrough.
Note: POC currently focuses on JavaScript/TypeScript. Built with TypeScript + Bun runtime. See TECH_STACK.md for details.
┌─────────────────────────────────────────────────────────┐
│ VibeSec CLI │
└─────────────────────────────────────────────────────────┘
│
┌───────────────────┼───────────────────┐
▼ ▼ ▼
┌───────────────┐ ┌───────────────┐ ┌──────────────────┐
│ Core Scanner │ │ Integrations │ │ Reporters │
│ │ │ │ │ │
│ • AST Parser │ │ • Snyk API │ │ • Plain Text │
│ • Detectors │ │ • Socket.dev │ │ • JSON │
│ • Analyzers │ │ • GitHub │ │ • Plain Language │
│ │ │ │ │ • Stakeholder │
└───────────────┘ └───────────────┘ └──────────────────┘
│
▼
┌─────────────────────────────────────────────────────────┐
│ Detection Rules Database │
│ • Built-in Rules • Community Rules • Custom Rules │
└─────────────────────────────────────────────────────────┘
See ARCHITECTURE.md for detailed design documentation.
Create a .vibesec.yaml file in your project root:
# .vibesec.yaml
version: 1
scan:
paths:
- src/
- lib/
exclude:
- node_modules/
- vendor/
- "*.test.js"
severity:
fail_on: high # fail CI if high/critical issues found
detectors:
secrets: true
injection: true
auth: true
ai-specific: true
integrations:
snyk:
enabled: true
token: ${SNYK_TOKEN}
socket:
enabled: true
token: ${SOCKET_TOKEN}
output:
format: json
file: vibesec-report.json
📚 Complete Documentation Index - Browse all documentation
📋 Active Planning: GitHub Project Board
Track progress on our GitHub Project:
Planning docs migrated to GitHub Projects for better collaboration. See docs/archive/ for historical planning documents.
# Run all tests
npm test
# Run specific test suite
npm test -- scanner/detectors/secrets
# Run with coverage
npm test -- --coverage
# Scan current directory
vibesec scan .
# Scan with plain language (for PMs/designers)
vibesec scan --explain
# Only show critical issues
vibesec scan --severity critical
# Generate stakeholder report for board presentation
vibesec scan -f stakeholder -o security-report.txt
# Get security score (0-100) with benchmark comparison
vibesec scan --explain
# Output shows:
# Security Score:
# 85/100 (B) - Good
# Your score is 5 points above the average for small projects
# Disable colors (for screen readers or terminals without color support)
vibesec scan --no-color
# Or use environment variable
NO_COLOR=1 vibesec scan .
# .github/workflows/vibesec.yml
name: VibeSec Security Scan
on: [push, pull_request]
jobs:
security:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Install Bun
uses: oven-sh/setup-bun@v1
- name: Install VibeSec
run: bun install vibesec
- name: Run Security Scan
run: bun vibesec scan . --severity high -f json
See examples/ for more use cases.
VibeSec is open-source software licensed under the MIT License.
VibeSec is built on research from:
If you discover a security vulnerability within VibeSec itself, please email security@vibesec.dev. All security vulnerabilities will be promptly addressed.
Built with ❤️ for the vibe coding community
FAQs
Security scanner for AI-generated code - detects vulnerabilities in vibe-coded projects
The npm package vibesec receives a total of 0 weekly downloads. As such, vibesec popularity was classified as not popular.
We found that vibesec demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.