Which integrations are available for this server?

Analyzes Firebase security rules to identify potential vulnerabilities and configuration issues. Performs security audits on project dependencies using npm audit to detect known vulnerabilities and package-level CVEs. Maps detected security findings to OWASP categories and standards to provide industry-standard vulnerability context. Scans Prisma schemas to identify security vulnerabilities and configuration risks in database rules. Analyzes Supabase security rules to identify potential vulnerabilities and configuration issues.

How do I use VibeCheck MCP Server?

1. Click on "Deploy Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@VibeCheck MCP Server audit this codebase for security vulnerabilities and hardcoded secrets" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

VibeCheck MCP Server

AI-powered security audit tool for codebases. Analyzes code for vulnerabilities using real-time data from MITRE CWE and npm audit.

Features

AI-Powered Analysis: Uses MCP sampling to analyze code with Claude
Real-Time CWE Data: Fetches vulnerability definitions from MITRE's CWE API
Dependency Scanning: Uses npm audit for package vulnerability checks
Zero Configuration: No API keys required to get started

Related MCP server: mcp-web-audit

Installation

Claude Code (Recommended)

/plugin marketplace add BPN-Solutions/vibecheck-mcp
/plugin install vibecheck@vibecheck

Manual Installation

Add to your Claude Desktop config (~/.claude/claude_desktop_config.json):

{
  "mcpServers": {
    "vibecheck": {
      "command": "npx",
      "args": ["-y", "vibecheck-audit-mcp"]
    }
  }
}

From Source

git clone https://github.com/BPN-Solutions/vibecheck-mcp.git
cd vibecheck-mcp
npm install && npm run build

Tools

scan_codebase

Full AI-powered security audit with real-time vulnerability data.

Analyzes:

Authentication and authorization issues
API security vulnerabilities
Database security rules
Exposed secrets and environment variables
Dependency vulnerabilities (via npm audit)
Data flow and injection vulnerabilities

Input:

{
  "path": "/path/to/codebase",
  "categories": ["auth", "api", "secrets-env"],
  "severityThreshold": "medium"
}

Or provide files directly:

{
  "files": [
    { "path": "src/auth.ts", "content": "..." }
  ]
}

Categories:

auth - Authentication, sessions, middleware
api - API routes, endpoints
database-rules - Firebase/Supabase rules, Prisma schemas
secrets-env - Environment variables, config files
dependencies - package.json vulnerabilities
data-flow - User input handling, injection points

check_dependencies

Quick dependency-only scan using npm audit.

Input:

{
  "path": "/path/to/project",
  "includeDevDependencies": false
}

Requirements:

npm installed
package-lock.json in the project

Data Sources

Source	Purpose	Auth Required
MITRE CWE API	Vulnerability definitions	No
npm audit	Package CVEs	No
OWASP	Security categories	No (bundled)

Development

# Build
npm run build

# Watch mode
npm run dev

# Run directly
npm start

How It Works

File Reading: Reads files from the specified path or accepts file contents directly
Hotspot Collection: Categorizes files by security relevance (auth, api, secrets, etc.)
Dependency Audit: Runs npm audit if package-lock.json exists
AI Analysis: Uses MCP sampling to analyze each category with expert prompts
CWE Enrichment: Fetches relevant CWE definitions from MITRE API
Results: Returns structured findings with severity, CWE/OWASP refs, and remediation steps

Output Format

{
  "findings": [
    {
      "id": "uuid",
      "type": "hardcoded-secret",
      "severity": "critical",
      "title": "Hardcoded API Key",
      "description": "...",
      "filePath": "src/config.ts",
      "lineNumber": 42,
      "codeSnippet": "const API_KEY = 'sk-...'",
      "aiReasoning": "...",
      "confidence": 95,
      "cwes": [{ "id": "CWE-798", "name": "..." }],
      "owasp": [{ "id": "A02:2021", "name": "..." }],
      "remediation": {
        "summary": "Use environment variables",
        "steps": ["..."]
      }
    }
  ],
  "dependencyVulnerabilities": [...],
  "summary": {
    "totalFindings": 5,
    "critical": 1,
    "high": 2,
    "medium": 2,
    "low": 0,
    "vulnerableDependencies": 3
  },
  "scanDuration": 12500
}

License

MIT

Available Tools

2 tools

check_dependenciesA

Run npm audit to check dependencies for known vulnerabilities.

Uses the GitHub Advisory Database (same as npm audit). Returns known CVEs, severity levels, and patched versions.

Requirements:

npm must be installed
Directory must contain package-lock.json (or yarn.lock/pnpm-lock.yaml)

Inputs: path (required), includeDevDependencies.

scan_codebaseB

AI-powered security audit with real-time vulnerability database lookups.

Analyzes code for:

Authentication and authorization issues
API security vulnerabilities
Database security rules
Exposed secrets and environment variables
Dependency vulnerabilities (via npm audit)
Data flow and injection vulnerabilities

Returns findings with:

Severity ratings (critical, high, medium, low)
AI reasoning and confidence scores
CWE and OWASP references
Remediation steps

Inputs: path, files, categories, severityThreshold.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A3.7/5.0

Scored 2026-04-18 06:20 across 2 tools

Disambiguation5/5

The two tools have clearly distinct purposes: check_dependencies focuses specifically on npm dependency vulnerabilities using npm audit, while scan_codebase performs a broader AI-powered security audit across multiple code aspects. There is no overlap in scope or functionality.

Naming Consistency5/5

Both tools follow a consistent verb_noun naming pattern (check_dependencies, scan_codebase) with clear action verbs describing their functions. The naming is uniform and predictable throughout the tool set.

Tool Count2/5

With only 2 tools, this server feels severely under-scoped for its apparent purpose of security auditing. A comprehensive security toolset would typically include more operations like fixing vulnerabilities, monitoring, or configuration management. The count is too low for meaningful agent workflows.

Completeness2/5

While the tools cover vulnerability checking and code scanning, there are significant gaps in the security audit lifecycle. Missing are tools for remediation (e.g., fix_vulnerabilities, update_dependencies), reporting, configuration management, or continuous monitoring. This incomplete surface will limit agent effectiveness.

Resources

Related MCP Connectors

SafeWeave
dev.safeweave
Security scanner for AI-written code: SAST, secrets, dependencies, IaC, containers and DAST.
Code Analysis Penetration Testing Security
16
https://mcp.safeweave.dev/mcp
Nekzus-npm-sentinel-mcp
ai.smithery
Provide AI-powered real-time analysis and intelligence on NPM packages, including security, depend…
Developer Tools Monitoring Security
218
https://server.smithery.ai/@Nekzus/npm-sentinel-mcp/mcp
Repo Security Scanner — Malicious Code & Supply Chain
io.github.eltociear
Audit GitHub repos for malicious and supply-chain code before you depend on them.
Security Code Analysis Version Control
1
https://mcp.apify.com/?actors=eltociear/mcp-server-security-scanner
Frogeye Security ScannerA
io.github.frogeye-ai
Zero-config MCP security scanner for AI-generated apps. 25K+ vulnerability patterns.
Security Penetration Testing
2
https://mcp.frogeye.ai/mcp

Related MCP Servers

MCP Security Audit Server
Security Developer Tools Code Execution
qianniuspace
A
license
C
quality
D
maintenance
Audits npm package dependencies for security vulnerabilities, providing detailed reports and fix recommendations with MCP integration.
Updated a year ago (2025-07-18 09:03 UTC)
1
38 npm
58
MIT
mcp-web-audit
Security Developer Tools Testing & QA Tools
Shen-zhihao
A
license
B
quality
D
maintenance
A Node.js-based frontend security audit tool that performs comprehensive dependency security audits for both local projects and remote repositories. Generates detailed Markdown reports with vulnerability detection, risk assessment, and fix recommendations.
Updated a year ago (2025-11-25 08:11 UTC)
1
8 npm
7
ISC
Security Scanner MCP
Code Analysis Security Testing & QA Tools
ongjin
A
license
Not graded
quality
D
maintenance
Automatically detects security vulnerabilities in AI-generated code, scanning for hardcoded secrets, injection flaws, XSS, weak cryptography, authentication issues, path traversal, and vulnerable dependencies across JavaScript, Python, Java, and Go.
Updated 6 months ago (2026-05-20 13:27 UTC)
33 npm
2
MIT
VibeCheck MCP Server
Security Code Analysis Testing & QA Tools
philiphess1
A
license
A
quality
D
maintenance
An AI-powered security audit tool that analyzes codebases for vulnerabilities using real-time data from MITRE CWE and npm audit. It enables deep analysis of authentication, API security, and dependencies to provide structured findings and remediation steps.
Updated 9 months ago (2026-02-03 00:46 UTC)
2
115 npm
1
MIT

VibeCheck MCP Server

Features

Installation

Claude Code (Recommended)

Manual Installation

From Source

Tools

scan_codebase

check_dependencies

Data Sources

Development

How It Works

Output Format

License

Available Tools

Tool Schema Changelog

TDQS

Resources

Related MCP Connectors

Related MCP Servers

MCP Security Audit Server

mcp-web-audit

Security Scanner MCP

VibeCheck MCP Server