MCP Observatory
6m ago Tracked 53,340 Last 6m ago 24h 2,739
npm TypeScript analyzed 3.29.0

goklab/guardvibe

v3.29.0
npm

Security infrastructure your AI can't be — deterministic, daily CVE intel past your model's training cutoff, whole-repo-aware, author-independent, and shift-left: secure_prompt secures the prompt before code generation. The security MCP for vibe coding: 450 rules, 39 tools, CLI + doctor for Next.js, Supabase, Clerk, Stripe, Prisma, Hono & MCP.

maintainer
goklab
license
Apache-2.0
first seen
2026-06-06
last seen
2026-08-14
releases · 30d
0
short id

Drift inferred · capture-to-capture

No drift recorded — single capability capture; advisories appear once its surface changes.

capabilities 39 tools
transport stdio · streamable-http · http · sse verified reported listed in the official MCP registry counts 39 tools · 0 res · 0 prompts permission surface via code analysis

tools

  • analyze_cross_file_dataflow
  • analyze_dataflow
  • audit_config
  • audit_mcp_config
  • auth_coverage
  • check_code
  • check_command
  • check_dependencies
  • check_package_health
  • check_project
  • compliance_report
  • deep_scan
  • explain_remediation
  • export_sarif
  • fix_code
  • full_audit
  • generate_policy
  • get_security_docs
  • guardvibe_doctor
  • policy_check
  • remediation_plan
  • repo_security_posture
  • review_pr
  • scan_changed_files
  • scan_config_change
  • scan_dependencies
  • scan_directory
  • scan_file
  • scan_hallucinated_packages
  • scan_host_config
  • scan_secrets
  • scan_secrets_history
  • scan_staged
  • secure_prompt
  • secure_this
  • security_stats
  • security_workflow
  • verify_fix
  • verify_remediation
skills & danger signals github-tarball
prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v3.29.0 · analyzer v33 · 3w ago

skills & prompt files 1

danger signals2

code evidence v3.29.0 · github-tarball
evidence-backed findings quoted directly from the published source artifact — not inferred

code files: 238

filesystem 92

  • fs (weak) goklab-guardvibe-4eae3b7/scripts/intel-check.mjs :23 import { readdirSync, readFileSync } from "node:fs";
  • fs goklab-guardvibe-4eae3b7/src/cli/audit.ts :6 import { writeFileSync, existsSync, mkdirSync } from "fs";
  • fs goklab-guardvibe-4eae3b7/src/cli/auth-coverage.ts :6 import { readdirSync, readFileSync, statSync, writeFileSync, existsSync, mkdirSync } from "fs";
  • fs goklab-guardvibe-4eae3b7/src/cli/ci.ts :7 import { readFileSync, writeFileSync, mkdirSync, existsSync } from "fs";
  • fs goklab-guardvibe-4eae3b7/src/cli/compliance.ts :6 import { writeFileSync, existsSync, mkdirSync } from "fs";
  • fs goklab-guardvibe-4eae3b7/src/cli/deep-scan.ts :5 import { readFileSync, statSync } from "node:fs";
  • fs goklab-guardvibe-4eae3b7/src/cli/doctor.ts :6 import { writeFileSync, existsSync, mkdirSync } from "fs";
  • fs goklab-guardvibe-4eae3b7/src/cli/fix.ts :5 import { readFileSync } from "fs";
  • fs goklab-guardvibe-4eae3b7/src/cli/hook.ts :7 import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, unlinkSync } from "fs";
  • fs goklab-guardvibe-4eae3b7/src/cli/init.ts :7 import { readFileSync, writeFileSync, mkdirSync, existsSync } from "fs";
  • fs goklab-guardvibe-4eae3b7/src/cli/scan.ts :6 import { readFileSync, writeFileSync, existsSync, mkdirSync, statSync } from "fs";
  • fs goklab-guardvibe-4eae3b7/src/cli/secure-this.ts :11 import { readFileSync, writeFileSync, existsSync } from "fs";
  • fs goklab-guardvibe-4eae3b7/src/cli/slopscan.ts :6 import { statSync } from "node:fs";
  • fs goklab-guardvibe-4eae3b7/src/data/rules/ai-security.ts :110 'import path from "path";\nconst ALLOWED_BASE = "/data/workspace";\nconst resolved = path.resolve(ALLOWED_BASE, args.filePath);\nif (!resolved.startsWith(ALLOWED_BASE)) throw new Error("Path traversal
  • fs goklab-guardvibe-4eae3b7/src/data/rules/cve-versions.ts :570 '// package.json\n"@anthropic-ai/sdk": "^0.91.1" // or latest\n\n// Harden Memory Tool root (server bootstrap)\nimport { chmodSync, mkdirSync } from "node:fs";\nmkdirSync(memoryRoot, { recursive: tru
  • fs goklab-guardvibe-4eae3b7/src/data/rules/modern-stack.ts :586 'import { randomUUID } from "crypto";\nimport path from "path";\n\n// Generate safe filename\nconst ext = path.extname(file.name).toLowerCase();\nconst ALLOWED_EXT = [".jpg", ".jpeg", ".png", ".webp",
  • fs goklab-guardvibe-4eae3b7/src/lib/stats.ts :1 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
  • fs goklab-guardvibe-4eae3b7/src/plugins/loader.ts :1 import { readdirSync } from "fs";
  • fs goklab-guardvibe-4eae3b7/src/tools/audit-config.ts :1 import { readFileSync, existsSync, readdirSync } from "fs";
  • fs goklab-guardvibe-4eae3b7/src/tools/audit-mcp-config.ts :1 import { readFileSync, existsSync } from "fs";
  • fs goklab-guardvibe-4eae3b7/src/tools/check-command.ts :3 import { existsSync } from "fs";
  • fs goklab-guardvibe-4eae3b7/src/tools/compliance-report.ts :1 import { readFileSync, statSync } from "fs";
  • fs goklab-guardvibe-4eae3b7/src/tools/doctor.ts :1 import { readFileSync, existsSync } from "fs";
  • fs goklab-guardvibe-4eae3b7/src/tools/export-sarif.ts :2 import { readFileSync, statSync } from "fs";
  • fs goklab-guardvibe-4eae3b7/src/tools/fix-code.ts :298 return "import path from \"path\";\nconst BASE = path.resolve(\"/data/safe\");\nconst resolved = path.resolve(BASE, userPath);\nif (!resolved.startsWith(BASE + path.sep)) throw new Error(\"Path traver
  • fs goklab-guardvibe-4eae3b7/src/tools/full-audit.ts :13 import { readdirSync, readFileSync, statSync, existsSync } from "node:fs";
  • fs goklab-guardvibe-4eae3b7/src/tools/generate-policy.ts :1 import { readFileSync, existsSync, readdirSync } from "fs";
  • fs goklab-guardvibe-4eae3b7/src/tools/policy-check.ts :1 import { readFileSync, statSync } from "fs";
  • fs goklab-guardvibe-4eae3b7/src/tools/reachability.ts :19 import { readdirSync, statSync, readFileSync } from "fs";
  • fs goklab-guardvibe-4eae3b7/src/tools/repo-posture.ts :1 import { readdirSync, readFileSync, existsSync } from "fs";
  • fs goklab-guardvibe-4eae3b7/src/tools/scan-dependencies.ts :1 import { readFileSync } from "fs";
  • fs goklab-guardvibe-4eae3b7/src/tools/scan-directory.ts :2 import { readFileSync, statSync } from "fs";
  • fs goklab-guardvibe-4eae3b7/src/tools/scan-hallucinated.ts :26 import { readdirSync, statSync, readFileSync } from "fs";
  • fs goklab-guardvibe-4eae3b7/src/tools/scan-host-config.ts :1 import { readFileSync, existsSync } from "fs";
  • fs goklab-guardvibe-4eae3b7/src/tools/scan-secrets.ts :1 import { existsSync, readdirSync, readFileSync, statSync } from "fs";
  • fs goklab-guardvibe-4eae3b7/src/utils/config.ts :1 import { readFileSync } from "fs";
  • fs goklab-guardvibe-4eae3b7/src/utils/ignore.ts :11 import { readFileSync } from "fs";
  • fs goklab-guardvibe-4eae3b7/src/utils/update-check.ts :15 import { readFileSync, writeFileSync, mkdirSync } from "node:fs";
  • fs goklab-guardvibe-4eae3b7/src/utils/walk-directory.ts :6 import { readdirSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/benchmarks/performance-1000.test.ts :9 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/cli/audit.test.ts :3 import { mkdirSync, rmSync, writeFileSync, existsSync, readFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/cli/auth-coverage-cli-coverage.test.ts :3 import { mkdtempSync, mkdirSync, rmSync, writeFileSync, readFileSync, existsSync } from "node:fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/cli/ci.test.ts :3 import { mkdirSync, rmSync, existsSync, readFileSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/cli/cli-coverage.test.ts :3 import { mkdirSync, rmSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/cli/cli.test.ts :3 import { mkdirSync, readFileSync, existsSync, rmSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/cli/compliance-coverage.test.ts :3 import { mkdtempSync, rmSync, writeFileSync, existsSync, readFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/cli/deep-scan-cli-coverage.test.ts :3 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/cli/doctor-coverage.test.ts :3 import { mkdtempSync, rmSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/cli/doctor.test.ts :3 import { mkdirSync, rmSync, writeFileSync, existsSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/cli/fix-coverage.test.ts :3 import { mkdtempSync, rmSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/cli/format-matrix.test.ts :7 import { mkdirSync, rmSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/cli/hook.test.ts :3 import { mkdirSync, rmSync, existsSync, readFileSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/cli/init.test.ts :3 import { mkdirSync, rmSync, existsSync, readFileSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/cli/scan.test.ts :3 import { mkdirSync, rmSync, writeFileSync, existsSync, readFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/cli/slopscan.test.ts :3 import { mkdirSync, rmSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/cli/stabilization.test.ts :6 import { mkdirSync, rmSync, writeFileSync, existsSync, readFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/cli/staged-gate.test.ts :7 import { mkdirSync, rmSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/meta/consistency.test.ts :12 import { readFileSync } from "node:fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/plugins/integration.test.ts :3 import { mkdtempSync, writeFileSync, mkdirSync, rmSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/rules/modern-stack.test.ts :566 `const name = req.file.originalname;\nawait fs.writeFile(\`/uploads/\${name}\`, buffer);`,
  • fs (weak) goklab-guardvibe-4eae3b7/tests/smoke.test.ts :7 import { mkdirSync, rmSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/tools/audit-config.test.ts :3 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/tools/audit-mcp-config.test.ts :3 import { mkdirSync, rmSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/tools/auditability.test.ts :3 import { mkdirSync, mkdtempSync, rmSync, writeFileSync, readFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/tools/check-code.test.ts :728 const code = `import * as fs from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/tools/compliance-report.test.ts :3 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/tools/config.test.ts :3 import { mkdtempSync, rmSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/tools/export-sarif.test.ts :3 import { mkdirSync, rmSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/tools/full-audit-coverage.test.ts :3 import { mkdtempSync, writeFileSync, mkdirSync, rmSync } from "node:fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/tools/generate-policy.test.ts :3 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/tools/policy-check.test.ts :3 import { mkdtempSync, rmSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/tools/reachability.test.ts :29 'import fs from "node:fs";', // ignored (builtin)
  • fs (weak) goklab-guardvibe-4eae3b7/tests/tools/repo-posture-coverage.test.ts :3 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/tools/repo-posture.test.ts :3 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/tools/review-pr.test.ts :4 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/tools/scan-dependencies-coverage.test.ts :3 import { mkdtempSync, rmSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/tools/scan-dependencies.test.ts :3 import { mkdtempSync, rmSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/tools/scan-directory.test.ts :3 import { mkdirSync, rmSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/tools/scan-hallucinated-fp.test.ts :9 import { mkdtempSync, writeFileSync, mkdirSync, rmSync } from "node:fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/tools/scan-hallucinated.test.ts :80 const code = `import fs from "fs";\nimport x from "node:crypto";\nimport y from "@/lib/util";\nimport z from "~/config";\nimport real from "lodash";`;
  • fs (weak) goklab-guardvibe-4eae3b7/tests/tools/scan-host-config-coverage.test.ts :3 import { mkdtempSync, mkdirSync, rmSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/tools/scan-host-config.test.ts :3 import { mkdirSync, rmSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/tools/scan-secrets-coverage.test.ts :4 import { mkdtempSync, rmSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/tools/scan-secrets-history-coverage.test.ts :4 import { mkdtempSync, rmSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/tools/scan-secrets-history.test.ts :4 import { mkdtempSync, rmSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/tools/scan-secrets.test.ts :3 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/tools/scan-staged.test.ts :4 import { mkdtempSync, rmSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/tools/security-stats-coverage.test.ts :3 import { mkdirSync, mkdtempSync, rmSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/utils/ignore.test.ts :3 import { mkdirSync, rmSync, writeFileSync } from "fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/utils/stats-coverage.test.ts :3 import { mkdtempSync, rmSync, writeFileSync, mkdirSync, readFileSync, existsSync } from "node:fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/utils/update-check-coverage.test.ts :3 import { mkdtempSync, rmSync, writeFileSync, mkdirSync, readFileSync, existsSync } from "node:fs";
  • fs (weak) goklab-guardvibe-4eae3b7/tests/utils/walk-directory.test.ts :3 import { mkdirSync, rmSync, writeFileSync } from "fs";

shell / exec 36

  • shell (weak) goklab-guardvibe-4eae3b7/scripts/release-gate.mjs :14 import { execSync } from "node:child_process";
  • shell goklab-guardvibe-4eae3b7/src/cli/init.ts :133 const hookCommand = `node -e "const fs=require('fs');let s='';try{s=fs.readFileSync(0,'utf8')}catch(e){}try{const p=(JSON.parse(s).tool_input||{}).file_path;if(p)require('child_process').execFileSync(
  • shell goklab-guardvibe-4eae3b7/src/cli/scan.ts :99 const { execFileSync } = await import("child_process");
  • shell goklab-guardvibe-4eae3b7/src/data/rules/ai-security.ts :125 '// Use spawn with argument array (no shell interpretation)\nimport { spawn } from "child_process";\nconst allowed = /^[a-zA-Z0-9._-]+$/;\nif (!allowed.test(args.filename)) throw new Error("Invalid fi
  • shell goklab-guardvibe-4eae3b7/src/data/rules/core.ts :84 fix: "Avoid shell commands with user input. Use allowlists and input validation. Prefer spawn() with array arguments. Python: use subprocess.run([...]) with list arguments, never shell=True with user
  • shell goklab-guardvibe-4eae3b7/src/index.ts :730 const { execFileSync } = await import("child_process");
  • shell goklab-guardvibe-4eae3b7/src/tools/cross-file-taint.ts :368 // Bare child_process exec()/execSync() (shell-invoking). Lookbehind excludes method
  • shell goklab-guardvibe-4eae3b7/src/tools/diff-aware.ts :12 import { execFileSync } from "child_process";
  • shell goklab-guardvibe-4eae3b7/src/tools/review-pr.ts :1 import { execFileSync } from "child_process";
  • shell goklab-guardvibe-4eae3b7/src/tools/scan-secrets-history.ts :1 import { execFileSync } from "child_process";
  • shell goklab-guardvibe-4eae3b7/src/tools/scan-secrets.ts :3 import { execFileSync } from "child_process";
  • shell goklab-guardvibe-4eae3b7/src/tools/scan-staged.ts :1 import { execFileSync } from "child_process";
  • shell goklab-guardvibe-4eae3b7/src/tools/secure-this.ts :94 `import { execFileSync } from "node:child_process";`,
  • shell goklab-guardvibe-4eae3b7/src/tools/taint-analysis.ts :56 // Command injection: bare child_process exec()/execSync() (the shell-invoking forms).
  • shell (weak) goklab-guardvibe-4eae3b7/tests/cli/audit.test.ts :5 import { spawnSync } from "child_process";
  • shell (weak) goklab-guardvibe-4eae3b7/tests/cli/ci.test.ts :5 import { execFileSync } from "child_process";
  • shell (weak) goklab-guardvibe-4eae3b7/tests/cli/cli-coverage.test.ts :5 import { execFileSync, spawnSync } from "child_process";
  • shell (weak) goklab-guardvibe-4eae3b7/tests/cli/cli.test.ts :5 import { execFileSync } from "child_process";
  • shell (weak) goklab-guardvibe-4eae3b7/tests/cli/doctor.test.ts :5 import { execFileSync } from "child_process";
  • shell (weak) goklab-guardvibe-4eae3b7/tests/cli/format-matrix.test.ts :9 import { execFileSync } from "child_process";
  • shell (weak) goklab-guardvibe-4eae3b7/tests/cli/hook.test.ts :5 import { execFileSync } from "child_process";
  • shell (weak) goklab-guardvibe-4eae3b7/tests/cli/init.test.ts :5 import { execFileSync } from "child_process";
  • shell (weak) goklab-guardvibe-4eae3b7/tests/cli/scan.test.ts :5 import { execFileSync } from "child_process";
  • shell (weak) goklab-guardvibe-4eae3b7/tests/cli/slopscan.test.ts :5 import { spawnSync } from "child_process";
  • shell (weak) goklab-guardvibe-4eae3b7/tests/cli/stabilization.test.ts :8 import { execFileSync } from "child_process";
  • shell (weak) goklab-guardvibe-4eae3b7/tests/cli/staged-gate.test.ts :9 import { execFileSync } from "child_process";
  • shell (weak) goklab-guardvibe-4eae3b7/tests/rules/ai-security.test.ts :59 const code = 'execute: async ({ command }) => {\n return require("child_process").exec(command);\n}';
  • shell (weak) goklab-guardvibe-4eae3b7/tests/smoke.test.ts :9 import { execFileSync } from "child_process";
  • shell (weak) goklab-guardvibe-4eae3b7/tests/tools/file-security.test.ts :16 "execSync(cmd);",
  • shell (weak) goklab-guardvibe-4eae3b7/tests/tools/full-audit.test.ts :279 sectionFindings: [{ ruleId: "VG011", severity: "critical", file: "index.js", line: 18, name: "Command injection", description: "exec with user input", fix: "Use spawn() with array args" }] },
  • shell (weak) goklab-guardvibe-4eae3b7/tests/tools/review-pr.test.ts :3 import { execFileSync } from "child_process";
  • shell (weak) goklab-guardvibe-4eae3b7/tests/tools/scan-secrets-coverage.test.ts :3 import { execFileSync } from "child_process";
  • shell (weak) goklab-guardvibe-4eae3b7/tests/tools/scan-secrets-history-coverage.test.ts :3 import { execFileSync } from "child_process";
  • shell (weak) goklab-guardvibe-4eae3b7/tests/tools/scan-secrets-history.test.ts :3 import { execFileSync } from "child_process";
  • shell (weak) goklab-guardvibe-4eae3b7/tests/tools/scan-staged.test.ts :3 import { execFileSync } from "child_process";
  • shell (weak) goklab-guardvibe-4eae3b7/tests/tools/taint-analysis.test.ts :45 "execSync(cmd);",

network 27

  • net (weak) goklab-guardvibe-4eae3b7/scripts/intel-check.mjs :39 const res = await fetch("https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json", {
  • net goklab-guardvibe-4eae3b7/src/cli/init.ts :75 - Never pass user-controlled URLs to fetch() without allowlist validation
  • net goklab-guardvibe-4eae3b7/src/data/framework-guides.ts :140 const res = await fetch(url, {
  • net goklab-guardvibe-4eae3b7/src/data/rules/ai-security.ts :95 '// Validate URL before fetch in MCP tool\nconst allowedHosts = ["api.example.com", "cdn.example.com"];\nconst parsed = new URL(args.url);\nif (!allowedHosts.includes(parsed.hostname)) throw new Error
  • net goklab-guardvibe-4eae3b7/src/data/rules/ai-tool-runtime.ts :19 '// Sanitize external content in MCP tool response\nfunction sanitizeToolOutput(text: string): string {\n return text\n .replace(/<[^>]*>/g, "")\n .replace(/[\\x00-\\x08\\x0B-\\x1F]/g, "")\n
  • net goklab-guardvibe-4eae3b7/src/data/rules/core.ts :448 "User-controlled input is passed directly to fetch(), axios, or http.request() as the URL. Attackers can make the server request internal services (169.254.169.254 for cloud metadata, localhost admin
  • net goklab-guardvibe-4eae3b7/src/data/rules/cve-versions.ts :127 fix: "Upgrade node-fetch to 2.6.7+ or 3.1.1+. Consider using native fetch (Node.js 18+).",
  • net goklab-guardvibe-4eae3b7/src/data/rules/firebase.ts :86 fixCode: '// Server-side: generate custom token\nimport { getAuth } from "firebase-admin/auth";\nconst customToken = await getAuth().createCustomToken(uid);\n\n// Client-side: only use tokens from you
  • net goklab-guardvibe-4eae3b7/src/data/rules/react-native.ts :25 fixCode: '// Validate token from deep link server-side\nconst { token } = parseURL(url);\nconst res = await fetch("/api/verify-token", { method: "POST", body: JSON.stringify({ token }) });\nif (!res.o
  • net goklab-guardvibe-4eae3b7/src/tools/check-code.ts :743 // Skip SSRF for fetch() calls that only use relative URLs or known-safe patterns
  • net goklab-guardvibe-4eae3b7/src/tools/check-package-health.ts :120 fetch(`https://registry.npmjs.org/${encodeURIComponent(name)}`, { signal: AbortSignal.timeout(5000) }),
  • net goklab-guardvibe-4eae3b7/src/tools/deep-scan.ts :227 const res = await fetch("https://api.anthropic.com/v1/messages", {
  • net goklab-guardvibe-4eae3b7/src/tools/fix-code.ts :244 if (rule.id === "VG705") return 'import { fetch } from "react-native-ssl-pinning";\nawait fetch(url, { sslPinning: { certs: ["cert"] } });';
  • net goklab-guardvibe-4eae3b7/src/tools/taint-analysis.ts :270 // (`fetch(`${WEBAPP_URL}/api?${q}`)`) is not flagged — only an attacker-controlled host
  • net goklab-guardvibe-4eae3b7/src/utils/osv-client.ts :26 const response = await fetch("https://api.osv.dev/v1/query", {
  • net goklab-guardvibe-4eae3b7/src/utils/update-check.ts :74 const res = await fetch(NPM_URL, { signal: ctrl.signal });
  • net (weak) goklab-guardvibe-4eae3b7/tests/cli/deep-scan-cli-coverage.test.ts :100 const f = tmpFile("route.ts", "export async function GET(req){ return fetch(req.url) }");
  • net (weak) goklab-guardvibe-4eae3b7/tests/rules/ai-differentiation.test.ts :93 const r = await fetch(url);
  • net (weak) goklab-guardvibe-4eae3b7/tests/rules/ai-security.test.ts :87 const code = 'server.tool("fetchUrl", async (args) => {\n const res = await fetch(args.url);\n return res.text();\n});';
  • net (weak) goklab-guardvibe-4eae3b7/tests/rules/auth.test.ts :83 testRule("VG426", '/admin/users\nexport async function GET(req) {\n const data = await fetch("/api");\n return Response.json(data);\n}', true);
  • net (weak) goklab-guardvibe-4eae3b7/tests/rules/core.test.ts :294 testRule("VG090", "fetch(req.body.url)", "javascript", true);
  • net (weak) goklab-guardvibe-4eae3b7/tests/rules/supply-chain.test.ts :197 testRule("VG1075", "fetch('https://getsession.org/relay');", true);
  • net (weak) goklab-guardvibe-4eae3b7/tests/tools/check-code.test.ts :209 it("does NOT flag client-component fetch (no server SSRF surface)", () => {
  • net (weak) goklab-guardvibe-4eae3b7/tests/tools/reachability.test.ts :21 'import axios from "axios";',
  • net (weak) goklab-guardvibe-4eae3b7/tests/tools/taint-analysis.test.ts :151 const code = ["const target = req.query.url;", "await fetch(target);"].join("\n");
  • net (weak) goklab-guardvibe-4eae3b7/tests/tools/vg120-narrowing.test.ts :10 const code = 'const apiUrl = "https://api.example.com/v1";\nawait fetch(apiUrl, { method: "POST" });\n';
  • net (weak) goklab-guardvibe-4eae3b7/tests/utils/update-check-coverage.test.ts :46 // Allow the fire-and-forget fetch().then() chain to settle.

secrets 43

  • secrets (weak) goklab-guardvibe-4eae3b7/scripts/intel-check.mjs :79 if (process.env.GITHUB_TOKEN) headers.Authorization = `Bearer ${process.env.GITHUB_TOKEN}`;
  • secrets goklab-guardvibe-4eae3b7/src/cli/deep-scan.ts :58 if (!process.env.ANTHROPIC_API_KEY && !process.env.OPENAI_API_KEY) {
  • secrets goklab-guardvibe-4eae3b7/src/data/framework-guides.ts :105 secret: process.env.SESSION_SECRET,
  • secrets goklab-guardvibe-4eae3b7/src/data/rules/advanced-security.ts :501 '// BAD: timing leak\nif (secret !== process.env.CRON_SECRET) return false;\n\n// GOOD: constant-time comparison\nimport { timingSafeEqual } from "crypto";\nfunction safeCompare(a: string, b: string):
  • secrets goklab-guardvibe-4eae3b7/src/data/rules/ai-security.ts :342 '// app/api/gemini/route.ts (server-only):\nimport { GoogleGenerativeAI } from "@google/generative-ai";\nconst genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY!);\nexport async function POST(
  • secrets goklab-guardvibe-4eae3b7/src/data/rules/ai-tool-runtime.ts :217 '// SAFE — explicit origin allowlist + bearer auth:\napp.use(cors({ origin: ["http://127.0.0.1:6274", "https://app.example.com"], credentials: true }));\napp.use((req, res, next) => {\n if (req.heade
  • secrets goklab-guardvibe-4eae3b7/src/data/rules/auth.ts :210 '// Server-side only (API route or Server Action)\nconst supabaseAdmin = createClient(url, process.env.SUPABASE_SERVICE_ROLE_KEY!);\nawait supabaseAdmin.auth.admin.deleteUser(userId);',
  • secrets goklab-guardvibe-4eae3b7/src/data/rules/core.ts :15 fix: "Use environment variables (process.env.SECRET) or a secrets manager. Never commit credentials to source code.",
  • secrets goklab-guardvibe-4eae3b7/src/data/rules/database.ts :16 '// Option 1: Service role key (admin access)\nconst supabase = createClient(\n process.env.SUPABASE_URL!,\n process.env.SUPABASE_SERVICE_ROLE_KEY!\n);\n\n// Option 2: SSR client with cookies (RLS-a
  • secrets goklab-guardvibe-4eae3b7/src/data/rules/deployment.ts :47 '// app/api/cron/route.ts\nexport async function GET(request: Request) {\n const authHeader = request.headers.get("authorization");\n if (authHeader !== `Bearer ${process.env.CRON_SECRET}`) {\n r
  • secrets goklab-guardvibe-4eae3b7/src/data/rules/firebase.ts :25 fixCode: '// Server-side only (API route or Server Action)\nimport { initializeApp, cert } from "firebase-admin/app";\ninitializeApp({ credential: cert(JSON.parse(process.env.FIREBASE_SERVICE_ACCOUNT_
  • secrets goklab-guardvibe-4eae3b7/src/data/rules/modern-stack.ts :85 '// Add at the very top of server-only modules\nimport "server-only";\n\n// Now this file cannot be imported by Client Components\nexport async function getSecretData() {\n const key = process.env.SE
  • secrets goklab-guardvibe-4eae3b7/src/data/rules/nextjs.ts :16 '// Move to a Server Component (no \'use client\')\nexport default async function Page() {\n const secret = process.env.SECRET_KEY;\n return <ClientComponent data={safeData} />;\n}',
  • secrets goklab-guardvibe-4eae3b7/src/data/rules/other-services.ts :25 fixCode: '// Server-side only\nimport twilio from "twilio";\nconst client = twilio(process.env.TWILIO_ACCOUNT_SID, process.env.TWILIO_AUTH_TOKEN);\n\n// Validate phone number before sending\nconst pho
  • secrets goklab-guardvibe-4eae3b7/src/data/rules/payments.ts :16 "// Server-side only (API route or Server Action)\nimport Stripe from 'stripe';\nconst stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);",
  • secrets goklab-guardvibe-4eae3b7/src/data/rules/react-native.ts :111 fixCode: '// app.config.ts — only public values in extra\nexport default {\n extra: {\n apiUrl: process.env.EXPO_PUBLIC_API_URL, // OK: public\n // NEVER: apiSecret: process.env.API_SECRET\n }
  • secrets goklab-guardvibe-4eae3b7/src/data/rules/services.ts :14 fixCode: '"use server";\nimport { Resend } from "resend";\nconst resend = new Resend(process.env.RESEND_API_KEY);',
  • secrets goklab-guardvibe-4eae3b7/src/data/rules/web-security.ts :14 fixCode: "// Verify webhook signature\nimport crypto from 'crypto';\nconst sig = request.headers.get('x-webhook-signature');\nconst expected = crypto.createHmac('sha256', process.env.WEBHOOK_SECRET!)\
  • secrets goklab-guardvibe-4eae3b7/src/tools/audit-config.ts :287 fix: "Verify the authorization header against process.env.CRON_SECRET in the route handler.",
  • secrets goklab-guardvibe-4eae3b7/src/tools/deep-scan.ts :216 const anthropicKey = process.env.ANTHROPIC_API_KEY;
  • secrets goklab-guardvibe-4eae3b7/src/tools/fix-code.ts :165 return "import crypto from 'crypto';\nconst sig = request.headers.get('x-signature');\nconst expected = crypto.createHmac('sha256', process.env.WEBHOOK_SECRET!)\n .update(body).digest('hex');\nif (si
  • secrets (weak) goklab-guardvibe-4eae3b7/tests/benchmarks/realistic-projects.test.ts :157 const stripe = new Stripe(process.env.STRIPE_SECRET_KEY!);
  • secrets (weak) goklab-guardvibe-4eae3b7/tests/cli/cli.test.ts :130 writeFileSync(safePath, 'const x = process.env.API_KEY;\nconsole.log("hello");', "utf-8");
  • secrets (weak) goklab-guardvibe-4eae3b7/tests/cli/deep-scan-cli-coverage.test.ts :23 const realAnthropic = process.env.ANTHROPIC_API_KEY;
  • secrets (weak) goklab-guardvibe-4eae3b7/tests/cli/stabilization.test.ts :64 writeFileSync(join(TEST_DIR, "test.ts"), 'const x = process.env.API_KEY;\n', "utf-8");
  • secrets (weak) goklab-guardvibe-4eae3b7/tests/fp-detection/realistic-nextjs-supabase.ts :155 const secret = process.env.RESET_SECRET;
  • secrets (weak) goklab-guardvibe-4eae3b7/tests/rules/ai-benchmark-semantic.test.ts :147 `function verifyCron(req: Request) {\n const secret = req.headers.get("x-cron-secret");\n if (secret !== process.env.CRON_SECRET) return false;\n return true;\n}`,
  • secrets (weak) goklab-guardvibe-4eae3b7/tests/rules/ai-benchmark.test.ts :90 `import { createClient } from "@supabase/supabase-js";\nconst supabase = createClient(url, process.env.SUPABASE_SERVICE_ROLE_KEY!);`,
  • secrets (weak) goklab-guardvibe-4eae3b7/tests/rules/ai-differentiation.test.ts :213 it("detects with process.env.GEMINI_API_KEY", () => {
  • secrets (weak) goklab-guardvibe-4eae3b7/tests/rules/auth.test.ts :30 testRule("VG422", '"use client";\nconst key = process.env.CLERK_SECRET_KEY;', true);
  • secrets (weak) goklab-guardvibe-4eae3b7/tests/rules/core.test.ts :29 testRule("VG001", "const password = process.env.PASSWORD", "javascript", false);
  • secrets (weak) goklab-guardvibe-4eae3b7/tests/rules/database.test.ts :47 testRule("VG437", '"use client";\nconst key = process.env.SUPABASE_SERVICE_ROLE_KEY;', true);
  • secrets (weak) goklab-guardvibe-4eae3b7/tests/rules/modern-stack.test.ts :62 `import { NextResponse } from 'next/server';\nconst key = process.env.SECRET_KEY;\nconst users = await prisma.user.findMany();`,
  • secrets (weak) goklab-guardvibe-4eae3b7/tests/rules/nextjs.test.ts :19 testRule("VG400", '"use client";\nconst key = process.env.SECRET_KEY;', true);
  • secrets (weak) goklab-guardvibe-4eae3b7/tests/rules/other-services.test.ts :25 testRule("VG801", '"use client";\nconst sid = process.env.TWILIO_AUTH_TOKEN;', true);
  • secrets (weak) goklab-guardvibe-4eae3b7/tests/rules/payments.test.ts :23 testRule("VG600", "const stripe = new Stripe(process.env.STRIPE_SECRET_KEY);", false);
  • secrets (weak) goklab-guardvibe-4eae3b7/tests/rules/services.test.ts :18 testRule("VG620", '"use client";\nconst key = process.env.RESEND_API_KEY;', true);
  • secrets (weak) goklab-guardvibe-4eae3b7/tests/rules/web-security.test.ts :33 testRule("VG651", "const webhookSecret = process.env.WEBHOOK_SECRET", false);
  • secrets (weak) goklab-guardvibe-4eae3b7/tests/tools/audit-config.test.ts :159 if (auth !== \`Bearer \${process.env.CRON_SECRET}\`) {
  • secrets (weak) goklab-guardvibe-4eae3b7/tests/tools/check-code.test.ts :119 `process.env.DAILY_API_KEY = "MOCK_DAILY_API_KEY";`,
  • secrets (weak) goklab-guardvibe-4eae3b7/tests/tools/deep-scan-coverage.test.ts :33 savedAnthropic = process.env.ANTHROPIC_API_KEY;
  • secrets (weak) goklab-guardvibe-4eae3b7/tests/tools/deep-scan.test.ts :166 const savedAnthropic = process.env.ANTHROPIC_API_KEY;
  • secrets (weak) goklab-guardvibe-4eae3b7/tests/tools/vg964-narrowing.test.ts :8 "const token = process.env.API_SECRET;",

database 2

  • db goklab-guardvibe-4eae3b7/src/data/rules/other-services.ts :61 fixCode: 'import { MongoClient } from "mongodb";\nconst client = new MongoClient(process.env.MONGODB_URI!);',
  • db (weak) goklab-guardvibe-4eae3b7/tests/rules/modern-stack.test.ts :86 `const prisma = require('@prisma/client');\nconst key = process.env.SECRET_KEY;\nawait prisma.user.findMany();`,

tool registrations 39

  • check_code goklab-guardvibe-4eae3b7/src/index.ts :76
  • check_project goklab-guardvibe-4eae3b7/src/index.ts :104
  • get_security_docs goklab-guardvibe-4eae3b7/src/index.ts :143
  • check_dependencies goklab-guardvibe-4eae3b7/src/index.ts :171
  • scan_directory goklab-guardvibe-4eae3b7/src/index.ts :202
  • scan_dependencies goklab-guardvibe-4eae3b7/src/index.ts :237
  • scan_hallucinated_packages goklab-guardvibe-4eae3b7/src/index.ts :262
  • scan_secrets goklab-guardvibe-4eae3b7/src/index.ts :287
  • scan_staged goklab-guardvibe-4eae3b7/src/index.ts :314
  • compliance_report goklab-guardvibe-4eae3b7/src/index.ts :341
  • export_sarif goklab-guardvibe-4eae3b7/src/index.ts :358
  • check_package_health goklab-guardvibe-4eae3b7/src/index.ts :372
  • fix_code goklab-guardvibe-4eae3b7/src/index.ts :391
  • secure_this goklab-guardvibe-4eae3b7/src/index.ts :421
  • audit_config goklab-guardvibe-4eae3b7/src/index.ts :443
  • generate_policy goklab-guardvibe-4eae3b7/src/index.ts :457
  • review_pr goklab-guardvibe-4eae3b7/src/index.ts :471
  • scan_secrets_history goklab-guardvibe-4eae3b7/src/index.ts :489
  • policy_check goklab-guardvibe-4eae3b7/src/index.ts :504
  • analyze_dataflow goklab-guardvibe-4eae3b7/src/index.ts :519
  • analyze_cross_file_dataflow goklab-guardvibe-4eae3b7/src/index.ts :539
  • check_command goklab-guardvibe-4eae3b7/src/index.ts :598
  • scan_config_change goklab-guardvibe-4eae3b7/src/index.ts :614
  • repo_security_posture goklab-guardvibe-4eae3b7/src/index.ts :630
  • explain_remediation goklab-guardvibe-4eae3b7/src/index.ts :644
  • scan_file goklab-guardvibe-4eae3b7/src/index.ts :661
  • scan_changed_files goklab-guardvibe-4eae3b7/src/index.ts :720
  • security_stats goklab-guardvibe-4eae3b7/src/index.ts :822
  • audit_mcp_config goklab-guardvibe-4eae3b7/src/index.ts :839
  • scan_host_config goklab-guardvibe-4eae3b7/src/index.ts :856
  • guardvibe_doctor goklab-guardvibe-4eae3b7/src/index.ts :874
  • verify_fix goklab-guardvibe-4eae3b7/src/index.ts :889
  • security_workflow goklab-guardvibe-4eae3b7/src/index.ts :906
  • auth_coverage goklab-guardvibe-4eae3b7/src/index.ts :1048
  • deep_scan goklab-guardvibe-4eae3b7/src/index.ts :1106
  • full_audit goklab-guardvibe-4eae3b7/src/index.ts :1140
  • remediation_plan goklab-guardvibe-4eae3b7/src/index.ts :1157
  • verify_remediation goklab-guardvibe-4eae3b7/src/index.ts :1173
  • secure_prompt goklab-guardvibe-4eae3b7/src/index.ts :1275

install hooks 1

  • prepare goklab-guardvibe-4eae3b7/package.json :33 npm run build

declared dependencies 8

  • @modelcontextprotocol/sdk@^1.26.0
  • typescript@^5.7.0
  • zod@^3.25.0
  • @types/node@^25.5.2
  • c8@^11.0.0
  • eslint@^10.2.0
  • tsx@^4.22.4
  • typescript-eslint@^8.58.0

perm:untrusted 3

  • untrusted goklab-guardvibe-4eae3b7/src/data/rules/ai-security.ts :206 '// Sanitize external content before LLM context\nconst raw = await fetch(url).then(r => r.text());\nconst sanitized = raw.replace(/<[^>]*>/g, "").slice(0, 2000);\nconst result = await generateText({\
  • untrusted goklab-guardvibe-4eae3b7/src/data/rules/ai-tool-runtime.ts :19 '// Sanitize external content in MCP tool response\nfunction sanitizeToolOutput(text: string): string {\n return text\n .replace(/<[^>]*>/g, "")\n .replace(/[\\x00-\\x08\\x0B-\\x1F]/g, "")\n
  • untrusted (weak) goklab-guardvibe-4eae3b7/tests/rules/ai-security.test.ts :185 const code = 'const html = await fetch(url).then(r => r.text());\nconst result = await generateText({ model, prompt: `Summarize: ${html}` });';