AI coding agents
Secure code writes from Codex, Claude Code, Antigravity, Windsurf, Cursor, and MCP-compatible IDEs.
block secretsgate file writesscan before save
Secure every action your AI agents take.
VibeLint checks code writes, tool calls, and workflow actions before they become risk. Block unsafe generated code, gate sensitive actions, and keep a searchable audit trail across IDEs, MCP tools, and agent builders.
Live protection layer
One control layer for every agent action.
VibeLint checks code, permissions, and policy before execution—then records every decision as searchable evidence.
VIBELINTLIVE POLICY PATH
Policy online
VibeLint decision engineWrite authentication code
Risk 91Action analysis
Unsigned JWT decode detected
- Identity
- Permission
- Policy
- Risk 91
Blocked before writeThe unsafe edit never reaches the project.
AllowedRuns and records
Human reviewPauses for approval
BlockedStops before executionSelected
Audit record writtenAgent, action, reason, risk, and redacted context retained.
evt_code_8a21Blocked before writeWrite authentication code from IDE agent. Blocked before write.
Designed forIDEsMCP toolsworkflow agentsagent frameworks
See VibeLint in action
Check what agents write. Control what they do. Keep proof of what happened.
Before code reaches your projectExplore code security
Catch insecure code while the agent is still writing it.
VibeLint scans AI-generated code locally, points to the exact risk, and returns a safer fix before the change lands.
- Agent proposessrc/auth/session.ts
- VibeLint checksCode + security boundaries
- Safe outcomeBlock risk and return a fix
Local
raw source scanning
11
detector categories
MCP + CLI
developer workflow
Cursor proposed a file edit
src/auth/session.ts
18
export function readSession(token: string) {19
const session = jwt.decode(token)20
return session?.payload21
}Blocked before write
High riskJWT decoded without verifying its signature.
Fix: verify the signature and restrict allowed algorithms.
The shift
AI moved from suggesting to acting.
VibeLint secures that new action layer. It treats generated code, tool calls, and workflow automation as one surface that needs permission checks, blocking, approvals, and logs.
Unsafe file writesOver-broad tool accessSilent workflow actionsSecrets in generated codeUnreviewed production changesNo audit trail
Without a control layer
Agents can touch real systems. They edit files, call APIs, run workflows, send messages, query databases, and operate with whatever credentials you give them.
The risky action looks normal. A generated auth helper can skip verification. A workflow agent can email customers. A framework agent can query more data than intended.
Review happens too late. Traditional scanners and pull request checks see the result after the action already happened. VibeLint adds the check at action time.
ok
With VibeLint
Every action gets a decision. Allow low-risk actions, block dangerous ones, and gate sensitive operations behind approval.
Code writes stay protected. A code write is treated as an agent action, so secrets, injection risks, and broken auth are still blocked before they land.
Teams get evidence. Search action logs, review permission decisions, and understand what each agent attempted before risk spreads.
How it works
After you sign up, set up once—then protect every agent action.
Your dashboard gives a ready-to-copy MCP setup. From there, choose a path: scan generated code, log agent activity, or gate sensitive actions before they run.
Setup · code security
Add VibeLint once. Every AI code write gets checked.
Install VibeLint as an MCP server, keep coding as usual, and block risky generated code before it lands in your project.
- 01
Connect your IDE
Add VibeLint as an MCP server with the ready-to-copy setup in your dashboard.
- 02
Your agent writes code
Keep using Cursor, Claude Code, Codex, Antigravity, or Windsurf as you normally do.
- 03
VibeLint checks first
Code is scanned locally. Safe edits continue; risky ones are flagged or blocked with a clear fix.
Want the full walkthrough for this layer?
Explore code securityUse cases
Secure agents without changing where you build them.
VibeLint is deliberately not the builder. It is the security, permission, and audit layer around the agents your team already runs.
Workflow agents
Add approval and audit trails around agents that send emails, update CRMs, trigger jobs, or call SaaS APIs.
approve sendslog tool callsblock risky automations
Developer frameworks
Wrap LangGraph, CrewAI, OpenAI Agents SDK, LlamaIndex, and custom runtimes with one permission pattern.
SDK-friendlyHTTP-firstredacted payloads
Enterprise platforms
Use VibeLint as the lightweight policy layer beside Copilot Studio, Bedrock Agents, Agentforce, and internal tools.
agent identitiesteam policiesaudit evidence
Privacy by design
Security evidence without exposing your code.
Source code stays local during scans
Only metadata syncs to the hosted dashboard
Agent payloads are redacted before logging
No need to replace your builder or observability stack
Works where your agents already run
VibeLint is the security layer around the tools you already use.
Not another agent builder. VibeLint gives agents built in IDEs, workflow builders, and frameworks a shared permission check, audit log, and approval path.
Popular starting points
Simple HTTP or SDK flow: check permission, run if allowed, log action, require approval when risky.
Pricing
Protection that grows with your agents
Free includes basic code security plus light agent visibility. Pro adds the full detector suite, permissions, approvals, and generous agent security. Max is for high-volume production agents.
Free
Local code protection
For developers who want VibeLint between their AI coding agent and their files.
$0forever
Start freeNo card required
What you get
- Stop secrets before they land in your project
- Catch injection and broken auth while the agent is writing
- Keep raw source scans on your machine
Plan details
- Local MCP scanner
- Unlimited local protected checks
- 500 dashboard-synced protected checks per month
- Pre-write security checks
- Hard-coded secrets
- SQL and NoSQL injection
- Broken auth patterns
- CORS and framework misconfiguration
- Pre-commit hook
- Code remediation hints
Recommended
Pro
Permissions, logs, approvals
For builders and teams running agents across IDEs, workflows, and frameworks.
$19.99/month
Cancel anytime
What you get
- Allow, block, or approve sensitive agent actions
- Search every agent action in one audit trail
- Get full detector coverage with clear fix hints
Everything in Free, plus
- Everything in Free
- 1,000 dashboard-synced protected checks per month
- All 11 detectors
- Prompt injection detection
- LLM output execution detection
- Missing rate-limit detection
- Vulnerable dependency detection
- Agent identities and API keys
- Agent action logs
- Permission policies
- Approval requests
- Permission decision history
Max
Production agent security
For high-volume teams running many agents, logs, rules, and approvals.
$49/month
Cancel anytime
What you get
- Govern many production agents under one policy layer
- Keep longer history when you need to investigate
- Scale logs, rules, and approvals with your team
Everything in Pro, plus
- Everything in Pro
- 50 agents
- 250,000 action logs per month
- 250 permission policies
- 2,500 permission rules
- 2,500 pending approvals
- 90-day action log retention
- 90-day scan history retention
Different layer
Your stack builds and watches. VibeLint decides.
Builders create agents. Auth proves identity. Observability traces behavior. Scanners review code later. VibeLint is the missing action-time control layer — allow, block, approve, and log before impact.
Step 1 — Their job
What the layer already does
Step 2 — Missing control
The gap they leave open
Step 3 — Action-time security
What VibeLint adds
Agent builders
Build time
n8nDifyFlowiseLangGraphCrewAI
Their job
Design, orchestrate, and run the agent workflow.
Gap
They make agents act — they do not decide if that action should run.
VibeLint adds
Sits in front of tool calls and workflow steps as the security decision point.
- Allow / block / approve
- Action audit trail
- Risk-aware gates
Observability tools
After the fact
LangfuseBraintrustPhoenixHelicone
Their job
Trace prompts, model calls, latency, cost, and evals.
Gap
You can see what happened, but nothing stopped the risky step first.
VibeLint adds
Adds permission outcomes, approval state, and security risk scoring to the trail.
- Decision + reason
- Approval status
- Security risk score
Auth infrastructure
Identity layer
Auth0Permit.ioCerbosComposio
Their job
Authenticate users, apps, and API credentials.
Gap
User or app access is not the same as agent policy for files, tools, and money moves.
VibeLint adds
Applies agent-specific policy to each tool call and workflow action.
- Per-agent policies
- Sensitive action gates
- Scoped agent keys
Traditional scanners
After write
SASTSCADependency scanPR checks
Their job
Find code and package risk once the artifact already exists.
Gap
PR and repo scans run after the write — and never see live agent actions.
VibeLint adds
Checks generated code and agent actions before they land or execute.
- Pre-write scanning
- Pre-action checks
- Block before commit
Positioning in one line
VibeLint does not replace your stack. It closes the action-time security gap.
Keep building agents where you already build them. VibeLint is the shared permission, approval, and audit layer around the moment they act.
1
Keep your stack
Builders, auth, observability, and SAST stay. VibeLint fills the gap between them.
2
Control the action moment
Decisions happen before code writes, tool calls, and workflow steps take effect.
3
Leave evidence behind
Every allow, block, and approval becomes searchable security evidence for the team.
FAQ
Questions builders ask before protecting AI agent work.
Privacy, setup, pricing, and how VibeLint fits next to the agents you already run—answered plainly.
PrivacyDoes my source code ever leave my machine?
No. Code scanning runs entirely locally. Only lightweight metadata — issue type, severity, line number, and project history — is synced to the dashboard. Your raw source never leaves your environment.
- Local scanner keeps all source files on your machine
- Dashboard sync: issue type, severity, line number, and history only
- Agent payloads are redacted before any logging
- Permission decisions sync as metadata, not as code
Agent ControlWhat is Agent Control and why do I need it?
Agent Control is VibeLint's permission layer that decides — in real time — whether an agent action should be allowed, blocked, or escalated for human approval. Without it, AI agents can read, write, or delete sensitive resources with no oversight.
- Define per-agent or per-project permission policies
- Gate any tool call: file writes, API calls, database mutations, shell commands
- Three decision outcomes: Allow, Block, or Require Approval
- Policies take effect immediately without restarting your agent
Agent ControlHow granular are the permission policies?
Policies can be scoped to an individual agent identity, a project, a tool category, or a specific action pattern — giving you precise control without writing custom middleware.
- Identity-level: restrict what a specific agent or workflow is allowed to do
- Tool-level: blanket allow/block for shell, filesystem, network, or database tools
- Pattern-level: block writes to /secrets, /prod, or any path pattern you define
- Time-based approvals: auto-expire approvals after a set window
Agent ControlWhat happens when an agent action is blocked or needs approval?
Safe work continues uninterrupted. Risky work is stopped or paused with a structured decision your team can act on immediately.
- Allow: action proceeds normally with a log entry
- Block: action is denied with a clear reason returned to the agent
- Require Approval: action waits in queue until a human reviews it from the dashboard
- All decisions are timestamped and stored in Agent Logs for audit
Agent LogsWhat does VibeLint log about my agents?
Every agent action, permission decision, and code scan result is captured in a structured, searchable audit trail — so you can see exactly what happened, when, and why.
- Action logs: tool call, input summary, outcome, and timestamp per agent
- Decision logs: Allow / Block / Approval result with the matching policy rule
- Code scan logs: file path, issue type, severity, and detector ID
- All logs are correlated by agent identity and session for easy tracing
Agent LogsCan I search or export agent logs for compliance or debugging?
Yes. The dashboard provides full-text search across all log dimensions. Logs can be filtered by agent, project, time range, or decision outcome and exported for compliance reports or incident reviews.
- Full-text search across action, tool, and outcome fields
- Filter by agent identity, project, severity, or date range
- Export logs as JSON or CSV for your SIEM, audit system, or incident review
- Retention policies configurable per plan
Agent LogsHow are agent logs different from standard application logs?
Standard logs capture system events. VibeLint's agent logs are purpose-built for agentic workflows — capturing intent, action, and governance decision in a single correlated record.
- Agent identity attached to every entry (not just process or IP)
- Permission decision correlated with the exact action that triggered it
- Redacted payloads ensure sensitive data is never stored in logs
- Timeline view reconstructs a full agent session at a glance
Code SecurityWhat kinds of security issues does VibeLint catch in AI-generated code?
VibeLint scans code as agents write or edit it, catching the vulnerability classes most common in AI-generated output before they ever reach your codebase.
- Hardcoded secrets, API keys, and credential leaks
- SQL / NoSQL injection and broken authentication patterns
- Unsafe configuration, open CORS policies, and risky execution paths
- Prompt injection and LLM-output abuse patterns (Pro & Team)
Code SecurityWhen does the code scan run — before or after the file is written?
Scans run before risky writes are committed, acting as a gate. If an issue is found, the write is blocked or flagged for review — not just reported after the fact.
- Pre-write interception via MCP tool-call hook
- Blocking mode: unsafe code is stopped before it lands on disk
- Warning mode: code is written but flagged for immediate review
- Results appear in your dashboard and in-IDE within milliseconds
Code SecurityDoes VibeLint integrate with my existing security tools like SonarQube or Snyk?
VibeLint complements your existing SAST and SCA tools by adding a real-time gate at the AI write layer — the gap most scanners miss because they run after code is already committed.
- Closes the pre-commit gap left by post-commit scanners
- Exports findings in SARIF format for SIEM and CI pipeline ingestion
- Works alongside Snyk, SonarQube, Semgrep, and similar tools
- No migration required — add VibeLint as an extra layer, not a replacement
SetupHow long does setup take and which tools are supported?
Most teams are protected in under two minutes. VibeLint is built for the AI coding and agent stack you already use — not something new to migrate into.
- IDEs and coding agents via MCP: Cursor, Claude Code, Codex, Windsurf, and similar
- Workflow agents that call an HTTP permission or logging layer
- Runtimes and SDKs: LangGraph, CrewAI, and custom agent loops
- Copy the setup snippet from your dashboard — no config file to maintain
PricingWhat does the Free plan include, and when should I upgrade?
Free gives you local code protection so you can start securing AI writes right away. Upgrade to Pro when you need the full agent control and logging plane.
- Free: local MCP scanning, unlimited local protected checks, core detectors
- Pro: agent identities, action logs, permission policies, approvals, and full detector coverage
- Upgrade only when you need control and visibility across agents and workflows
Still deciding?
Ready when you are
Secure what your AI agents write, run, and touch.
Create a free account, install VibeLint, and start with local code protection. Upgrade when you want agent identities, action logs, permission policies, and approvals.
Local code protection
Scan AI writes before they land
Agent permissions
Gate sensitive tool actions
Searchable audit logs
Trace what every agent did
- Free local scanning
- About 2 minutes to set up
- Upgrade for full protection
Trusted in production
Used by solo developers and small teams.
10,000+
Scans run
500+
Agents governed
17
Open-source repos with security risks found