01
Receives code locally
Run VibeLint through an MCP-compatible coding tool, the CLI, or a pre-commit workflow. Raw source files stay on the developer machine during scanning.
Local code checks
Stop unsafe AI-generated code before it ships.
VibeLint scans proposed and existing source code for security mistakes that AI coding tools often introduce, then returns clear findings and safer fixes while keeping raw source local by default.
VibeLint decision trace
agentwrite src/auth/session.ts
scaninsecure_authentication
riskJWT accepted without signature verification
fixverify the signature and restrict allowed algorithms
resultchange blocked until corrected
11
detector categories
Local
raw source scanning
MCP + CLI
developer workflow
What it does
How code security works
Code security analyzes the code itself. It gives an AI coding agent or developer a security decision before a risky change becomes part of the repository.
02
Checks security boundaries
Detectors cover secrets, authentication, injection, framework configuration, CORS, static-analysis findings, prompt injection, LLM output execution, dependencies, rate limiting, and missing authentication.
03
Returns actionable findings
Each result identifies the detector, severity, affected file and line, why the pattern is risky, and a fix hint. Plans and workflow configuration determine the available coverage and blocking behavior.
Example: an AI agent edits authentication
Catch a security shortcut before it lands
An agent proposes decoding a session token without verifying its signature. VibeLint flags the unsafe authentication pattern and points the agent toward verified token handling.
VibeLint decision trace
agentwrite src/auth/session.ts
scaninsecure_authentication
riskJWT accepted without signature verification
fixverify the signature and restrict allowed algorithms
resultchange blocked until corrected
Example use cases
Where code security fits
AI coding agents
Review generated code before write
Let Cursor, Claude Code, Codex, Windsurf, or another MCP client scan a proposed file before accepting the change.
Catch secrets, auth mistakes, and injection paths earlier.
Repository safety
Add a pre-commit security check
Scan changed files before a commit so risky generated code does not quietly move into review or deployment.
Keep a repeatable security gate beside human review and tests.
AI applications
Inspect LLM and MCP trust boundaries
Find untrusted content entering privileged prompts or model output reaching commands, tools, file access, or other sensitive execution paths.
Separate model suggestions from authorized application behavior.
What code security does not do automatically
A static code scan does not automatically observe every terminal command or external tool call. The coding agent, MCP workflow, CLI, or hook must invoke the scan at the right point. Keep tests, dependency review, runtime controls, and human review in the workflow too.
One connected security loop
Connect code security to the rest of VibeLint.
Code checks, permission decisions, approvals, and action evidence work best together—before, during, and after an agent action.