A security scanner that runs inside your IDE — Cursor, Claude Code, Windsurf — and intercepts vulnerable AI-generated code before it ever touches your files.
Free to start. No credit card. Works in 5 min.
You're in. We'll be in touch.
When you're building with AI, you move fast. You describe a feature, the agent writes the code, you ship. But AI models don't think about security the way you'd want them to. They hard-code API keys. They build SQL queries with string concatenation. They hash passwords with MD5. And none of it gets flagged — it just lands silently in your codebase.
AI agents generate code that works — but "works" and "secure" are two different things. A single exposed API key or unparameterized query can take down your entire project. And you won't catch it in a code review you never do.
VibeLint runs as an MCP server inside your IDE. Every time your AI agent generates code, VibeLint intercepts it before it touches your files — scans it, flags violations, and auto-fixes what it can. You keep shipping fast. The code stays clean.
OpenAI, Stripe, AWS, Anthropic keys pasted directly into source. One git push and they're public.
AI loves f-strings in queries: f"SELECT * WHERE id = {id}". Anyone can dump your database.
MD5 and SHA1 for passwords — cracked in seconds. AI generates them constantly because they're short and simple.
os.system() and subprocess with shell=True let attackers execute arbitrary commands on your server.
innerHTML, document.write(), and dangerouslySetInnerHTML without sanitization. One injected script owns your users.
verify=False or algorithm set to none. Anyone can forge auth tokens and access any account.
open(user_input) without validation. Attackers read any file on your server — configs, keys, /etc/passwd.
Hard-coded admin passwords, JWT secrets in source, tokens stored in localStorage. All trivial to exploit.
You describe a feature. Your AI generates it.
Before anything hits your files, VibeLint scans it.
Clean, secure code lands in your project.
api_key = "sk-live-abc123..."
api_key = os.environ.get("API_KEY")
hashed = hashlib.md5(password.encode())
hashed = bcrypt.hashpw(
password.encode(), bcrypt.gensalt()
)
cursor.execute(
f"SELECT * FROM users WHERE id = {id}"
)
cursor.execute(
"SELECT * FROM users WHERE id = %s", (id,)
)
Works with Python, JavaScript, TypeScript — and 7 more languages via Semgrep.
Python 3.8+ required. That's the only dependency.
Copy the prompt below and paste it into Cursor, Claude Code, Windsurf, or any MCP-compatible AI agent. It will handle everything.
Pull the repo and install the Python dependencies.
This detects your Python path, resolves the server location, and writes the correct config for your IDE — no manual JSON editing needed.
Supports Cursor, Windsurf, and Claude Desktop. To target a specific IDE:
Reload the window so it picks up the new MCP server. That's it — VibeLint is now scanning every AI-generated file automatically.
Open your IDE's MCP config and add this. Use full absolute paths for both the Python executable and server.py — do not use cwd.
Config file location depends on your IDE:
~/.cursor/mcp.json
Windsurf — ~/.codeium/windsurf/mcp_config.json
Claude Desktop — claude_desktop_config.json
VS Code — .vscode/mcp.json
Most security tools send your code to their servers to scan it. VibeLint runs entirely on your hardware.
Everything else you might want to know before getting started.
python server.py directly. The security rules apply to all code regardless of who wrote it.
First 50 developers get direct input on the roadmap.
You're in. We'll be in touch.