🛡️ VibeDefender

Security Knowledge MCP Server for AI Coding Agents

Guide your AI agents through professional security assessments with methodology, documentation, and step-by-step workflows covering OWASP Top 10 and beyond.

Installation • Features • Quick Start • Configuration • Documentation

🌟 Why VibeDefender?

Your AI coding agent (Claude Code, Cursor, etc.) already knows how to run commands. VibeDefender teaches it WHEN, WHY, and HOW to run security tools like a professional pentester.

Instead of guessing which security tools to run, your AI gets:

• 📚 Step-by-step security methodology - Professional assessment workflows

• 🎯 Plain English guidance - No security expertise required

• 🔧 Tool installation guides - Automated setup assistance

• 📖 Always-current documentation - Live tool documentation proxy

• ✅ OWASP Top 10 coverage - Industry-standard vulnerability detection

⭐ If you find VibeDefender useful, please star this repo! It helps others discover professional security testing for AI agents.

📦 Installation

Direct from GitHub (Recommended)

This automatically clones, installs dependencies, builds, and runs the MCP server.

Global Installation

✨ Features

🎯 What Makes VibeDefender Different

✅ Knowledge-First Approach - Guides AI agents instead of executing tools directly ✅ 5 Pre-Built Security Workflows - Setup, full scan, pre-push check, live testing, URL scanning ✅ OWASP Top 10 Coverage - Comprehensive vulnerability detection (injection, XSS, auth, etc.) ✅ Mandatory Runtime Analysis - Not just static analysis - tests your running application ✅ Artifact Generation - Saves all scan results as JSON + markdown reports ✅ Zero Security Knowledge Required - Plain English explanations for non-security developers ✅ Tool Agnostic - Works with any MCP-compatible AI editor (Claude Code, Cursor, etc.)

🔧 Integrated Security Tools

• Trivy - CVE and dependency vulnerability scanning

• Semgrep - Static code analysis with 2000+ security rules

• Nuclei - Runtime security testing with template-based scanning

• Metasploit - Optional integration for discovery and exploitation

🤖 Supported AI Editors

🧠 Philosophy

The MCP GUIDES, not executes.

Your AI agent (Claude Code, Cursor, etc.) already has the ability to run CLI commands. This MCP provides:

• 📋 Step-by-step methodology for security assessments

• 🔧 Installation guides for required tools

• 💬 Plain English explanations for non-technical users

• 📚 Documentation proxy for always-current tool docs

⚡ Quick Start

1. Install and configure (one-time setup):

2. Talk to your AI agent in plain English:

3. Get professional security reports with actionable fixes:

⚙️ Configuration

Claude Code

Add to your Claude Code MCP settings:

Claude Desktop

Add to ~/Library/Application Support/Claude/claude_desktop_config.json:

Cursor

Add to Cursor's MCP settings (Settings → Features → MCP):

Google Antigravity

Same configuration as Claude Desktop.

🧪 Testing with MCP Inspector

Test the server before configuring in your editor:

Expected: Web UI shows "Connected", lists all security:// resources and 5 workflow prompts.

🎯 Available Workflows

🛠️ Required Tools

The MCP guides you through installing these (just say "help me set up"):

🎖️ Metasploit Integration

Metasploit Framework is integrated for both discovery (reconnaissance) and exploitation phases.

Setup

1. Install external Metasploit MCP server:

2. Set environment variable (add to ~/.bashrc or ~/.zshrc):

3. Verify installation:

Usage

Discovery Phase (Automatic):

• Runs safe auxiliary modules for service detection

• Port scanning and version detection

• Correlates findings with CVE database

• No exploitation attempts

Exploitation Phase (Requires Approval):

• Executes exploits against validated vulnerabilities

• Requires explicit human approval

• Full session management and post-exploitation

• Evidence gathering only (read-only)

Safety

⚠️ CRITICAL: Authorization Required

• Only use on systems you own OR have written permission to test

• Unauthorized access to computer systems is illegal

• Discovery phase: Basic authorization sufficient

• Exploitation phase: Explicit approval required

📖 Documentation

• See security://methodology/exploitation for complete exploitation workflow

• See security://docs/metasploit for detailed tool usage

• Includes safety guidelines, workflow examples, and troubleshooting

📚 Available Resources

📋 Methodology Guides

📖 Reference Documentation

🔧 Tool Documentation

💡 Example Workflows

First Time Setup

Before Pushing Code

Full Security Scan

📁 Project Structure

🎨 Design Decisions

1. 🚫 No execution tools - AI agents already have CLI access. We provide knowledge.

2. 💬 Plain English - Everything explained for non-technical users.

3. 📋 Step-by-step - Prompts tell the AI exactly what to do at each step.

4. 📖 Documentation proxy - Search patterns for always-current tool docs.

5. 📦 Minimal files - 4 files total, easy to understand and maintain.

6. 🌐 GitHub-based distribution - No npm publish, direct from source via npx.

🌐 Browser Automation Options

For live testing that needs a browser:

🔧 Troubleshooting

Build Errors

If you see TypeScript compilation errors when installing from GitHub:

MCP Server Not Connecting

1. Test with MCP Inspector first (see "Testing" section above)

2. Check Node.js version: node --version (requires >= 22.0.0)

3. Verify the server runs standalone:

   npx github:yunusj/VibeDefender-MCP # Should output: "Security Knowledge MCP server running on stdio"

4. Check editor configuration file syntax (valid JSON)

5. Restart your AI editor after configuration changes

Permission Errors

If you get EACCES errors:

Update to Latest Version

⚠️ Security Notice

• ✅ Only scan systems you are authorized to test

• 🔒 Live validation (scan-url, scan-live) requires explicit authorization

• 🤝 The AI will ask for confirmation before testing URLs

• 📄 Always get written permission before security testing

• 🛡️ Follow responsible disclosure practices

🤝 Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

📄 License

MIT License - see LICENSE for details

⭐ Show Your Support

If VibeDefender helps secure your code, please star this repository!

Made with 🛡️ by security professionals, for developers