# io.github.goklab/guardvibe (npm · guardvibe)

Deterministic security layer your AI can't be. 462 rules, 39 tools, CLI + doctor + host audit.

- Trust score: 75/100 (medium)
- Change this week: +30
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `guardvibe`: 75/100 (this document), [markdown](https://verifymcp.io/servers/goklab-guardvibe/guardvibe.md), [page](https://verifymcp.io/servers/goklab-guardvibe/guardvibe)

## Channel facts

- Registry: `npm`
- Package: `guardvibe`
- Version: `3.31.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (96 of 100), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (96 of 100), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to goklab/guardvibe).
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 10 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 71/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 4998 tokens (~128/item across 39 items; 39 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add goklab-guardvibe -- npx -y guardvibe
```

### Codex

```bash
codex mcp add goklab-guardvibe -- npx -y guardvibe
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "goklab-guardvibe": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "guardvibe"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add goklab-guardvibe --command npx --arg -y --arg guardvibe
```

### Hermes

```yaml
mcp_servers:
  goklab-guardvibe:
    command: "npx"
    args: ["-y", "guardvibe"]
```

### Other

```json
{
  "mcpServers": {
    "goklab-guardvibe": {
      "command": "npx",
      "args": [
        "-y",
        "guardvibe"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 75, +55)

- [security improvement] Install scripts: unverified → pass
- [security improvement] Provenance: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [security] The attested source repository moved: goklab/guardvibe
- [functional regression] Security disclosure: unverified → fail
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] License: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional] Licence: Apache-2.0

### 2026-08-02 (score 20, +15)

- [security improvement] Malware scan: unverified → pass
- [functional regression] Security disclosure: fail → unverified

### 2026-08-01 (score 5, −15)

- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified

### 2026-07-31 (score 20, −25)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-27 (score 45)

First indexed and scored.

## MCP tools (39)

### `check_code` (~134 tokens)

Analyze inline code for security vulnerabilities (OWASP Top 10, XSS, SQL injection, insecure patterns). Pass code as a string parameter. For scanning files on disk, use scan_file instead. Example: check_code({code: 'app.get(...)', language: 'javascript'})

Input parameters:

- `code` (string, required): The code snippet to analyze
- `format` (string): Output format: markdown (human) or json (machine-readable for agents)
- `framework` (string): Framework context (e.g. express, nextjs, fastapi, react, django)
- `language` (string, required): Programming language of the code

### `check_project` (~71 tokens)

Scan multiple files for security vulnerabilities and generate a project-wide security report with a security score. Use this for comprehensive security audits.

Input parameters:

- `files` (array, required): List of files to scan: [{path, content}]
- `format` (string): Output format: markdown (human) or json (machine-readable for agents)

### `get_security_docs` (~100 tokens)

Get security best practices and remediation guidance for a specific topic, framework, or vulnerability type. Covers OWASP Top 10, framework-specific hardening (Next.js, Supabase, Stripe), and secure coding patterns. Returns actionable guidance with code examples.

Input parameters:

- `topic` (string, required): Security topic to look up (e.g. "express authentication", "sql injection prevention", "nextjs csrf", "react xss", "owasp top 10")

### `check_dependencies` (~83 tokens)

Check npm, PyPI, or Go packages for known security vulnerabilities (CVEs) using the OSV database. Use this before adding new dependencies or to audit existing ones.

Input parameters:

- `format` (string): Output format: markdown (human) or json (machine-readable for agents)
- `packages` (array, required): List of packages to check: [{name, version, ecosystem}]

### `scan_directory` (~155 tokens)

Scan all files in a directory on disk for security vulnerabilities. Pass a directory path — reads files from filesystem. Returns security score (A-F) and findings. Results may be truncated for large projects — check fileRanking in JSON output for top files. Example: scan_directory({path: './src'})

Input parameters:

- `baseline` (string): Path to a previous scan JSON output file for baseline comparison (new/fixed/unchanged findings)
- `exclude` (array): Additional directories to exclude
- `format` (string): Output format: markdown (human) or json (machine-readable for agents)
- `path` (string, required): Directory path to scan (e.g. './src', '.')
- `recursive` (boolean): Scan subdirectories

### `scan_dependencies` (~113 tokens)

Parse a lockfile or manifest (package.json, package-lock.json, requirements.txt, go.mod) and check all dependencies for known CVEs via the OSV database. Reads the file directly. Use this after installing dependencies, during CI, or when auditing existing projects for vulnerable packages.

Input parameters:

- `format` (string): Output format: markdown (human) or json (machine-readable for agents)
- `manifest_path` (string, required): Path to manifest file (e.g. 'package.json', 'requirements.txt', 'go.mod')

### `scan_hallucinated_packages` (~222 tokens)

Detect AI-hallucinated and slopsquatted packages in a repo — the supply-chain seam commodity SCA misses. OFFLINE (deterministic): flags phantom imports (a package imported in source but absent from every package.json — a classic LLM hallucination tell) and typosquats of popular packages. ONLINE (opt-in, default on; gracefully degrades offline): adds npm-registry truth — packages that return 404 (definitive hallucination) and brand-new low-download packages (slopsquat-registration pattern). Run on AI-generated code at PR time, before `npm install`. Pass online:false for a fully deterministic, air-gapped scan.

Input parameters:

- `format` (string): Output format: markdown (human) or json (guardvibe.slopscan.v1 for agents)
- `online` (boolean): Query the npm registry for existence/age/downloads. false = deterministic offline-only (phantom imports + typosquats).
- `path` (string): Repository root to scan (default current directory)

### `scan_secrets` (~116 tokens)

Scan files and directories for leaked secrets, API keys, tokens, and credentials. Detects high-entropy strings, known API key patterns (AWS, Stripe, OpenAI, GitHub, Supabase), exposed .env files, and missing .gitignore coverage. Returns findings with exact line numbers and remediation steps.

Input parameters:

- `format` (string): Output format: markdown (human) or json (machine-readable for agents)
- `path` (string, required): File or directory path to scan
- `recursive` (boolean): Scan subdirectories

### `scan_staged` (~115 tokens)

Scan git-staged files for security vulnerabilities before committing. Run this before every commit to catch issues early. No input needed — automatically reads staged files. Diff-aware by default: reports only issues on newly-staged lines (set diff_aware:false for whole staged files).

Input parameters:

- `diff_aware` (boolean): Report only findings on newly-staged lines (true, default) vs. all lines in staged files (false)
- `format` (string): Output format: markdown (human) or json (machine-readable for agents)

### `compliance_report` (~151 tokens)

Map security findings to compliance controls (SOC2, PCI-DSS, HIPAA, GDPR, ISO27001, EUAIACT). Scans a directory and groups issues by control. Output includes a summary section at the top; for large projects, findings are truncated to top 50. Use mode=executive for C-level summary. Example: compliance_report({path: '.', framework: 'SOC2'})

Input parameters:

- `format` (string): Output format: markdown (human) or json (machine-readable for agents)
- `framework` (string, required): Compliance framework
- `mode` (string): Report mode: full (detailed) or executive (C-level summary)
- `path` (string, required): Directory to scan

### `export_sarif` (~55 tokens)

Scan a directory and export results in SARIF v2.1.0 format for CI/CD integration (GitHub, GitLab, Azure DevOps). Returns JSON string.

Input parameters:

- `path` (string, required): Directory to scan

### `check_package_health` (~91 tokens)

Check npm packages for typosquat risk, maintenance status, adoption metrics, and deprecation. Use this before adding new dependencies to catch suspicious or risky packages.

Input parameters:

- `format` (string): Output format: markdown (human) or json (machine-readable for agents)
- `packages` (array, required): List of package names to check (e.g. ['lodash', 'expres', 'react-qeury'])

### `fix_code` (~135 tokens)

Pass vulnerable code as a string and get fix suggestions with before/after patches. Returns structured edit instructions (line numbers, severity, confidence). Use verify_fix afterwards to confirm the fix resolved the issue. Example: fix_code({code: '...', language: 'typescript'})

Input parameters:

- `code` (string, required): The code snippet to analyze and fix
- `format` (string): Output format: json (for agent auto-fix) or markdown (human review)
- `framework` (string): Framework context (e.g. express, nextjs, fastapi, react, django)
- `language` (string, required): Programming language of the code

### `secure_this` (~262 tokens)

Close the loop on vulnerabilities in code: scan, apply only the fixes that VERIFIABLY land (each candidate edit is re-scanned and rolled back if it fails to resolve the issue or introduces a new one), and return the verified code plus a definition-of-done gate. Prefer this over fix_code+verify_fix when you want a guarantee the fix landed — not just a suggestion. Returns { status: clean|secured|partial|no_autofix, fixedCode, applied[], remaining[], definitionOfDone:{passed,message}, proofTest }. Write fixedCode to disk, then require definitionOfDone.passed before claiming the task complete; anything in remaining[] needs a manual fix. When fixes were applied, proofTest is a runnable regression test (GuardVibe-as-oracle) you can drop into the project to guard against regressions. Example: secure_this({code: '...', language: 'typescript'})

Input parameters:

- `code` (string, required): The code to scan and secure
- `filePath` (string): File path for context-aware analysis (the file is NOT written; apply fixedCode yourself)
- `framework` (string): Framework context (e.g. express, nextjs, react)
- `language` (string, required): Programming language of the code

### `audit_config` (~92 tokens)

Audit application config files (next.config, middleware, .env, vercel.json) for cross-file security gaps: missing headers, unprotected routes, exposed secrets. NOT the same as guardvibe_doctor which checks AI host security (MCP configs, hooks). Example: audit_config({path: '.'})

Input parameters:

- `format` (string): Output format
- `path` (string, required): Project root directory to audit

### `generate_policy` (~84 tokens)

Auto-detect project stack (Next.js, Supabase, Stripe, Clerk, Prisma, etc.) and generate tailored security policies. Outputs ready-to-use CSP headers, CORS configuration, Supabase RLS policies, rate limiting rules, and security headers based on detected frameworks.

Input parameters:

- `format` (string): Output format
- `path` (string, required): Project root directory to scan

### `review_pr` (~139 tokens)

Review a pull request for security issues. Scans only changed lines (diff-only mode) and produces output for GitHub Check Runs, PR comments, or inline annotations. Supports severity gating to block PRs.

Input parameters:

- `base` (string): Base branch to diff against
- `diff_only` (boolean): Only report findings in changed lines (true) or all findings in changed files (false)
- `fail_on` (string): Block PR if findings at this severity or above exist
- `format` (string): Output: markdown (PR comment), json (structured), annotations (GitHub Check Runs)
- `path` (string): Repository root path

### `scan_secrets_history` (~92 tokens)

Scan git history for leaked secrets. Finds secrets that were committed in the past — even if they were later removed. Marks each finding as 'active' (still in code) or 'removed' (in git history only, needs rotation).

Input parameters:

- `format` (string): Output format
- `max_commits` (number): Maximum number of commits to scan
- `path` (string, required): Repository root path

### `policy_check` (~88 tokens)

Check project against compliance policies defined in .guardviberc. Use this in CI/CD pipelines to enforce security gates, or before releases to verify compliance requirements are met. Validates custom framework requirements, severity thresholds, required controls, and risk exceptions. Returns pass/fail status with detailed findings per control.

Input parameters:

- `format` (string): Output format
- `path` (string, required): Project root directory

### `analyze_dataflow` (~89 tokens)

Track user input (request body, URL params, form data) flowing into dangerous sinks (SQL queries, eval, file operations, redirects). Detects injection vulnerabilities that regex rules miss by following variable assignments through code.

Input parameters:

- `code` (string, required): Code to analyze for tainted data flows
- `format` (string): Output format
- `language` (string, required): Language (JS/TS only)

### `analyze_cross_file_dataflow` (~139 tokens)

Track user input flowing across module boundaries — detects injection vulnerabilities spanning multiple files. Pass files array with file contents. For single-file analysis, use analyze_dataflow instead. Example: analyze_cross_file_dataflow({files: [{path: 'src/api.ts', content: '...'}, {path: 'src/db.ts', content: '...'}]})

Input parameters:

- `files` (array): List of files to analyze (ignored when path is provided)
- `format` (string): Output format
- `path` (string): Project directory path. When provided, auto-discovers all JS/TS files — no need to pass file contents manually.

### `check_command` (~111 tokens)

Analyze a shell command for security risks before execution. Returns allow/ask/deny verdict with blast radius, safer alternatives, and context-aware risk assessment. Detects: destructive ops, git history rewrites, secret exposure, data exfiltration, deploy triggers, privilege escalation, database drops.

Input parameters:

- `branch` (string): Current git branch (for branch-specific risk)
- `command` (string, required): Shell command to analyze
- `cwd` (string): Current working directory
- `format` (string): Output format

### `scan_config_change` (~99 tokens)

Compare before/after versions of a config file to detect security downgrades: CORS relaxation, CSP weakening, HSTS removal, debug mode, cookie flag changes, TLS disabling, new hardcoded secrets, removed security headers.

Input parameters:

- `after` (string, required): New config file content
- `before` (string, required): Previous config file content
- `file_path` (string): Config file path for context
- `format` (string): Output format

### `repo_security_posture` (~68 tokens)

Analyze a repository's overall security posture. Maps sensitive areas (auth, payments, PII, admin, API, infrastructure), identifies high-risk workflows, recommends guard mode, and lists priority fixes.

Input parameters:

- `format` (string): Output format
- `path` (string, required): Repository root path

### `explain_remediation` (~114 tokens)

Pass a GuardVibe rule ID (e.g. VG154) to get a detailed explanation: risk assessment, exploit scenario, minimum fix, secure alternative, and test strategy. Optionally pass the affected code snippet for context-aware guidance. Example: explain_remediation({rule_id: 'VG402'})

Input parameters:

- `code` (string): Affected code snippet for context
- `format` (string): Output format
- `rule_id` (string, required): GuardVibe rule ID (e.g. VG001, VG402)

### `scan_file` (~135 tokens)

Scan a single file on disk by path for security vulnerabilities. Pass a file path — the tool reads the file itself. For inline code snippets, use check_code instead. The 'agent' format returns the structured guardvibe.agent.v1 contract (finding + exact edit + confidence + verify step). Example: scan_file({file_path: 'src/api/route.ts', format: 'agent'})

Input parameters:

- `file_path` (string, required): Absolute or relative path to the file to scan
- `format` (string): Output format. 'agent' = machine-actionable guardvibe.agent.v1 (exact edits + confidence + verify)

### `scan_changed_files` (~145 tokens)

Scan only files that have changed since a given git ref (branch, commit, or HEAD~N). Ideal for PR checks, pre-push hooks, and incremental CI. Diff-aware by default: returns only findings on newly-added lines (set diff_aware:false for whole changed files).

Input parameters:

- `base` (string): Git ref to diff against (e.g. 'main', 'HEAD~3', commit SHA)
- `diff_aware` (boolean): Report only newly-introduced findings on added lines (true, default) vs. all findings in changed files (false)
- `format` (string): Output format
- `path` (string): Repository root path

### `security_stats` (~82 tokens)

Show cumulative security statistics, grade trend, and vulnerability fix progress for this project. Use this to demonstrate the value of GuardVibe security scanning over time. Data is stored locally in .guardvibe/stats.json.

Input parameters:

- `format` (string): Output format
- `path` (string): Project root path
- `period` (string): Time period for stats

### `audit_mcp_config` (~96 tokens)

Scan MCP configuration files (.claude/settings.json, .cursor/mcp.json, .vscode/mcp.json) for security issues: malicious hooks (CVE-2025-59536), suspicious MCP servers, overly permissive tool access, and shell injection patterns. Use this to verify MCP configurations are safe before use.

Input parameters:

- `format` (string): Output format
- `path` (string): Project root directory to scan

### `scan_host_config` (~118 tokens)

Scan host environment for AI security issues: API base URL hijacking (CVE-2026-21852), credential exposure in shell profiles, .env file leaks, and environment variable sniffing. Checks .env files at project scope; add scope=host to also check shell profiles and global AI configs.

Input parameters:

- `format` (string): Output format
- `path` (string): Project root directory
- `scope` (string): Scan scope: project (.env files only), host (+ shell profiles, global configs), full (+ home dir)

### `guardvibe_doctor` (~160 tokens)

Check AI host security: MCP configurations, hooks, base URL hijacking, environment variable exposure. NOT the same as audit_config which checks application config files (next.config, .env, headers). Use scope=project (default) for project-only, scope=host to include shell profiles and global AI configs. Example: guardvibe_doctor({scope: 'project'})

Input parameters:

- `format` (string): Output format: markdown (human) or json (machine-readable)
- `path` (string): Project root directory
- `scope` (string): Scan scope: project (default, .claude.json + .cursor/ + .vscode/ + .env), host (+ shell profiles + global MCP configs), full (+ home dir configs)

### `verify_fix` (~112 tokens)

Verify that a specific security fix was applied correctly. Re-scans the updated code and checks if the target vulnerability (by rule ID) is resolved. Returns 'fixed', 'still_vulnerable', or 'new_issues' status with details.

Input parameters:

- `code` (string, required): Updated code after applying the fix
- `filePath` (string): File path for context-aware analysis
- `language` (string, required): Programming language
- `ruleId` (string, required): Rule ID to verify (e.g. VG402)

### `security_workflow` (~175 tokens)

Get the recommended GuardVibe tool sequence for your current task. Returns which tools to call, in what order, and with what parameters. Use this when unsure which tool to use. Example: security_workflow({task: 'pre_commit'})

Input parameters:

- `task` (string, required): Current task: writing_code (after edits), pre_commit (before commit), pr_review (reviewing PR), new_project (initial setup), fix_vulnerabilities (fixing known issues), compliance_mapping (audit again…

### `auth_coverage` (~167 tokens)

Analyze authentication coverage across Next.js App Router routes. Detects auth guards (Clerk, NextAuth, Supabase, custom) and reports protected vs unprotected routes. Pass files array with route file contents and middleware content. Example: auth_coverage({files: [{path: 'app/api/users/route.ts', content: '...'}], middleware: '...'})

Input parameters:

- `files` (array): Route and page files from app/ directory (ignored when path is provided)
- `format` (string): Output format
- `middleware` (string): Content of middleware.ts file (ignored when path is provided)
- `path` (string): Project directory path. When provided, auto-discovers all route, page, layout, and middleware files — no need to pass file contents manually.

### `deep_scan` (~219 tokens)

LLM-powered deep security analysis for vulnerabilities that pattern-matching cannot detect: IDOR, business logic flaws, race conditions, stale auth, mass assignment, privilege escalation. Defaults to Claude Haiku 4.5 (~cents per scan); pass `model: 'sonnet'` for deeper analysis at higher cost. Requires ANTHROPIC_API_KEY or OPENAI_API_KEY env var.

Input parameters:

- `code` (string, required): Code to analyze
- `context` (string): Additional context (e.g., 'This is a payment endpoint')
- `existingFindings` (array): Already-detected findings to avoid duplicating
- `focus` (string): Focus area — narrows the prompt to a specific vulnerability class
- `format` (string): Output format
- `language` (string, required): Programming language
- `maxBytes` (integer): Max prompt size in bytes — caps cost. Code over this limit is truncated.
- `model` (string): LLM model. haiku = fast & cheap (default), sonnet = deeper analysis

### `full_audit` (~147 tokens)

Single command that runs ALL checks: code scan (429 rules), secret detection, dependency CVEs, config audit, taint analysis, and auth coverage. Returns PASS/FAIL/WARN verdict with deterministic hash. IMPORTANT: If verdict is FAIL or WARN, you MUST call remediation_plan next to get a section-by-section fix checklist — do NOT skip any section. After fixing, call verify_remediation to confirm ALL sections are addressed. Example: full_audit({path: '.'})

Input parameters:

- `format` (string): Output format
- `path` (string): Project root directory
- `skipDeps` (boolean): Skip dependency vulnerability check
- `skipSecrets` (boolean): Skip secret scanning

### `remediation_plan` (~119 tokens)

Generate a mandatory section-by-section remediation plan from full_audit results. MUST be called after full_audit when verdict is FAIL or WARN. Returns ordered steps for ALL 6 sections (secrets, code, dependencies, config, taint, auth-coverage) with specific tool calls and actions. AI assistants MUST complete every section — skipping sections is not allowed. Example: remediation_plan({path: '.'})

Input parameters:

- `format` (string): Output format: json for agents (recommended), markdown for humans
- `path` (string): Project root directory

### `verify_remediation` (~127 tokens)

Compare before/after audit results to verify ALL sections were addressed. MUST be called after completing remediation to confirm success. Runs a fresh audit and compares against the before snapshot. Explicitly flags skipped sections and refuses to return 'complete' status unless every section is addressed. Pass the before audit hash or let it re-run. Example: verify_remediation({path: '.', before_hash: 'abc123'})

Input parameters:

- `before_hash` (string): Result hash from the initial full_audit (for tracking)
- `format` (string): Output format
- `path` (string): Project root directory

### `secure_prompt` (~278 tokens)

Shift-left security at the prompt level: analyze a raw coding prompt BEFORE any code is written and return a structured enhancement directive that embeds GuardVibe security requirements (auth checks, input validation, webhook signature verification, SQL injection prevention, secrets handling) into the prompt you are about to execute. Deterministic — no LLM, no network: triage verdict NO_MOD (prompt already specific and security-aware → proceed with the ORIGINAL prompt unchanged), LIGHT_MOD (inject missing security constraints only), or HEAVY_MOD (also surface clarifying questions — never invent answers to them). Detects stack (Next.js, Supabase, Clerk, Stripe, Prisma, Express, Hono...) and attack surfaces (auth, payments, file upload, user input, SQL, secrets, redirects) from the prompt text, matches them against GuardVibe's rule set, and returns verdict + intent summary + numbered [rule-id] requirements + rewrite directive. Call this with the user's prompt before generating code; prevents vulnerabilities before code generation instead of scanning after. Example: secure_prompt({raw_prompt: 'add login to my app'})

Input parameters:

- `context` (string): Known stack/framework context if the client has it (e.g. 'Next.js app router, Supabase, Stripe')
- `raw_prompt` (string, required): The user's original coding prompt, verbatim

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/goklab-guardvibe/guardvibe#diagnostics

## Score history

- 2026-08-03: 75
- 2026-08-02: 20
- 2026-08-01: 5
- 2026-07-31: 20
- 2026-07-30: 45
- 2026-07-28: 45
- 2026-07-27: 45

## Links

- npm package: https://www.npmjs.com/package/guardvibe
- Socket report: https://socket.dev/npm/package/guardvibe
- Repository: https://github.com/goklab/guardvibe
- Changelog RSS feed: https://verifymcp.io/servers/goklab-guardvibe/guardvibe/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/goklab-guardvibe/guardvibe/changelog.json
- HTML version of this page: https://verifymcp.io/servers/goklab-guardvibe/guardvibe