Which integrations are available for this server?

Analyzes Firebase security rules to identify potential vulnerabilities and configuration issues. Performs security audits on project dependencies using npm audit to detect known vulnerabilities and package-level CVEs. Maps detected security findings to OWASP categories and standards to provide industry-standard vulnerability context. Scans Prisma schemas to identify security vulnerabilities and configuration risks in database rules. Analyzes Supabase security rules to identify potential vulnerabilities and configuration issues.

How do I use VibeCheck MCP Server?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@VibeCheck MCP Server audit this codebase for security vulnerabilities and hardcoded secrets" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

VibeCheck MCP Server

AI-powered security audit tool for codebases. Analyzes code for vulnerabilities using real-time data from MITRE CWE and npm audit.

Features

AI-Powered Analysis: Uses MCP sampling to analyze code with Claude
Real-Time CWE Data: Fetches vulnerability definitions from MITRE's CWE API
Dependency Scanning: Uses npm audit for package vulnerability checks
Zero Configuration: No API keys required to get started

Installation

Claude Code (Recommended)

/plugin marketplace add BPN-Solutions/vibecheck-mcp /plugin install vibecheck@vibecheck

Manual Installation

Add to your Claude Desktop config (~/.claude/claude_desktop_config.json):

{ "mcpServers": { "vibecheck": { "command": "npx", "args": ["-y", "vibecheck-audit-mcp"] } } }

From Source

git clone https://github.com/BPN-Solutions/vibecheck-mcp.git cd vibecheck-mcp npm install && npm run build

Tools

scan_codebase

Full AI-powered security audit with real-time vulnerability data.

Analyzes:

Authentication and authorization issues
API security vulnerabilities
Database security rules
Exposed secrets and environment variables
Dependency vulnerabilities (via npm audit)
Data flow and injection vulnerabilities

Input:

{ "path": "/path/to/codebase", "categories": ["auth", "api", "secrets-env"], "severityThreshold": "medium" }

Or provide files directly:

{ "files": [ { "path": "src/auth.ts", "content": "..." } ] }

Categories:

auth - Authentication, sessions, middleware
api - API routes, endpoints
database-rules - Firebase/Supabase rules, Prisma schemas
secrets-env - Environment variables, config files
dependencies - package.json vulnerabilities
data-flow - User input handling, injection points

check_dependencies

Quick dependency-only scan using npm audit.

Input:

{ "path": "/path/to/project", "includeDevDependencies": false }

Requirements:

npm installed
package-lock.json in the project

Data Sources

Source	Purpose	Auth Required
MITRE CWE API	Vulnerability definitions	No
npm audit	Package CVEs	No
OWASP	Security categories	No (bundled)

Development

# Build npm run build # Watch mode npm run dev # Run directly npm start

How It Works

File Reading: Reads files from the specified path or accepts file contents directly
Hotspot Collection: Categorizes files by security relevance (auth, api, secrets, etc.)
Dependency Audit: Runs npm audit if package-lock.json exists
AI Analysis: Uses MCP sampling to analyze each category with expert prompts
CWE Enrichment: Fetches relevant CWE definitions from MITRE API
Results: Returns structured findings with severity, CWE/OWASP refs, and remediation steps

Output Format

{ "findings": [ { "id": "uuid", "type": "hardcoded-secret", "severity": "critical", "title": "Hardcoded API Key", "description": "...", "filePath": "src/config.ts", "lineNumber": 42, "codeSnippet": "const API_KEY = 'sk-...'", "aiReasoning": "...", "confidence": 95, "cwes": [{ "id": "CWE-798", "name": "..." }], "owasp": [{ "id": "A02:2021", "name": "..." }], "remediation": { "summary": "Use environment variables", "steps": ["..."] } } ], "dependencyVulnerabilities": [...], "summary": { "totalFindings": 5, "critical": 1, "high": 2, "medium": 2, "low": 0, "vulnerableDependencies": 3 }, "scanDuration": 12500 }