Your AI coding agent writes the code. VibeGuard checks the security.

VibeGuard AI is an open-source security scanner designed for modern applications built with AI coding tools, no-code/low-code platforms, and vibe-coding workflows.

It scans your project source code for potential security issues and provides clear findings, confidence levels, and recommendations.

• 🔍 Security vulnerability scanning
• 🚨 Severity-based findings
• 🎯 Confidence score for findings
• 🛡️ Potential XSS detection
• 🔐 Authentication & authorization checks
• 🔑 Secret and credential detection
• 🌐 API security checks
• 📦 Dependency security analysis
• ⚙️ Security configuration checks
• 🤖 AI-assisted security analysis
• 📄 Multiple report formats (JSON, Markdown, HTML, SARIF)
• 🔄 Git diff scanning (--diff)
• 💻 CLI-based workflow
• 🔌 VS Code / Cursor integration
• 🧑‍💻 Designed for vibe-coded applications

Before installing VibeGuard, make sure you have:

• Git
• Node.js
• npm

Check your installation:

git --version
node --version
npm --version

Clone VibeGuard from GitHub:

git clone https://github.com/speakcoreofficial-stack/VibeGuard-AI-Pluging.git

Enter the project:

cd VibeGuard-AI-Pluging

Check the project files:

dir

On macOS/Linux:

ls

Inside the VibeGuard-AI-Pluging directory, run:

npm install

Wait until the installation completes successfully.

Build the CLI:

npm run build

After the build completes, verify that the CLI exists.

Windows PowerShell:

Test-Path .\packages\cli\dist\index.js

The expected result is:

True

If the result is True, the VibeGuard CLI has been successfully built.

You can test VibeGuard directly without installing the global command.

From the VibeGuard repository:

node ./packages/cli/dist/index.js version

If a version number is displayed, the CLI is working correctly.

Example:

VibeGuard 0.1.0

VibeGuard is designed to scan your own project or a project you are authorized to test.

For example, suppose your project is located at:

D:\aditya\my-project

Move into your project:

cd D:\aditya\my-project

Then run VibeGuard:

node D:\aditya\VibeGuard-AI-Pluging\packages\cli\dist\index.js scan

VibeGuard will analyze the project and report potential security findings.

VibeGuard may report findings like:

[HIGH] Potential XSS: Unsafe HTML rendering

File: src/components/Example.tsx
Confidence: 70%

Recommendation:
Use safe rendering methods or sanitize untrusted HTML
before rendering.

Each finding can include:

• Severity
• Vulnerability type
• File location
• Confidence score
• Recommendation
• Evidence

vibeguard scan

vibeguard scan --file src/auth.ts

vibeguard scan --diff

vibeguard scan --ai

vibeguard scan --ci

vibeguard scan --format json
vibeguard scan --format markdown
vibeguard scan --format html
vibeguard scan --format sarif
vibeguard scan --format json -o report.json

vibeguard init

Note: The vibeguard command requires the CLI to be installed globally. If it is not available on your system, use the direct Node.js command shown in the installation section.

If you want to use:

vibeguard scan

instead of:

node ./packages/cli/dist/index.js scan

install VibeGuard globally from the cloned repository (run from the packages/cli directory):

cd packages/cli
npm install -g .

Then verify:

vibeguard version

Expected output:

VibeGuard 0.1.0

If the command is recognized, you can scan your project with:

cd path/to/your-project
vibeguard scan

Replace path/to/your-project with the actual path of your project.

VibeGuard is designed to work with VS Code and Cursor.

Build the extension:

cd packages/vscode
npm install

Install the VS Code extension packaging tool:

npm install -g @vscode/vsce

Create the VSIX package:

vsce package

This will generate a .vsix file.

In VS Code or Cursor:

Extensions
    ↓
...
    ↓
Install from VSIX
    ↓
Select the generated .vsix file

After installation, VibeGuard can be used directly from the editor.

VibeGuard includes plugins so your AI coding agent scans automatically.

npm run build -w @vibeguard/integrations
cp packages/integrations/dist/opencode/opencode.js .opencode/plugin/opencode.js

Or reference it from opencode.json:

{
  "$schema": "https://opencode.ai/config.json",
  "plugin": ["/absolute/path/VibeGuard-AI-Pluging/packages/integrations/dist/opencode/opencode.js"]
}

What you get:

• A vibeguard_scan tool the agent can call
• A /vibeguard-scan command for a readable summary + fix discussion
• An auto security hint after every edit/write that introduces findings

Restart opencode after adding the plugin.

mkdir -p .claude-plugin
cp -r packages/integrations/claude/. .claude-plugin/

What you get:

• /vibeguard command — runs npx vibeguard scan and explains findings
• vibeguard-scan skill — automatically triggers when generating code or when asked "is this code secure?"
• post_tool_use.sh hook — post-edit security hint for source files

VibeGuard includes example applications for testing the scanner.

Navigate to the example:

cd examples/vulnerable-app

Then run:

node ../../packages/cli/dist/index.js scan

This allows developers to test VibeGuard locally without scanning an external application.

Expected result (intentionally vulnerable example):

Critical: 1   High: 4
Security Score: 40/100
[CRITICAL] Possible exposed API credential
[HIGH] Vulnerable dependency detected: express
[HIGH] Vulnerable dependency detected: axios
[HIGH] Potential XSS: Unsafe HTML rendering
[HIGH] Potential Missing Authorization

VibeGuard-AI-Pluging/
│
├── packages/
│   ├── core/                 # @vibeguard/core — scanners, findings, reporter
│   ├── cli/                  # vibeguard — the CLI
│   ├── vscode/               # VS Code / Cursor extension
│   ├── ai/                   # @vibeguard/ai — AI reviewer
│   └── integrations/         # opencode + Claude Code plugins
│
├── examples/
│   └── vulnerable-app/
│
├── README.md
├── LICENSE
└── package.json

VibeGuard is designed as a defensive security tool.

It focuses on helping developers identify and fix security problems in applications they own or are authorized to test.

VibeGuard should not be used to access, attack, or test systems without permission.

VibeGuard is local-first: your source code is scanned on your machine by default and never uploaded unless you explicitly enable an AI provider.

Modern AI coding tools can generate applications extremely quickly.

However, AI-generated code can also introduce:

• insecure authentication
• missing authorization
• exposed secrets
• unsafe input handling
• insecure APIs
• vulnerable dependencies
• unsafe configuration
• XSS risks

VibeGuard acts as a security layer between AI-generated code and production.

AI Coding Agent
       ↓
   Generated Code
       ↓
   🛡️ VibeGuard
       ↓
Security Analysis
       ↓
Findings + Recommendations
       ↓
   Safer Application

• CLI foundation
• Source-code scanning
• Security findings
• Severity levels
• Confidence scores
• Basic XSS detection
• Secret detection
• Dependency scanning
• Single-file scanning (--file)
• Git diff scanning (--diff)
• AI explanations (--ai)
• CI mode (--ci)
• JSON / Markdown / HTML / SARIF reports
• VS Code + Cursor extension
• opencode + Claude Code plugins
• Improved false-positive filtering
• Finding deduplication
• Authentication analysis

• GitHub Actions
• Pull Request security comments
• Python support
• Go support
• Java support
• PHP support
• Advanced data-flow analysis

• AI security agent
• Architecture analysis
• Runtime verification
• Automated security verification
• Continuous security monitoring

Contributions are welcome!

git clone https://github.com/speakcoreofficial-stack/VibeGuard-AI-Pluging.git

git checkout -b feature/my-feature