Guardvibe MCP Server
guardvibe
npm
v3.31.0
Source verified
Published by goklab — publish provenance cryptographically ties this package to that repository. That is proof of origin, not an official vendor package.
Security infrastructure your AI can't be — deterministic, current past your model's training cutoff, whole-repo-aware, author-independent. Security MCP for vibe coding. 462 rules, 39 tools, CLI + doctor. Prompt-level shift-left security (secure_prompt — e
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 15.4 = 85. What the published surface and source actually contain:
| Points | What was found | Category |
|---|---|---|
| −15.4 | Instruction-override directive MTC-INJ-AUTH-2 | injection |
2. Client adoption risk — 85 − 6 = 79. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −6 | capability blast radius (high) — client exposure if the model is manipulated |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 22
high Reads a sensitive credential path or dumps the environment (build/data/rules/ai-security.js)MTC-SRC-006
In the server's implementation (`build/data/rules/ai-security.js:195`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: uctions and read ~/.ssh/id_rsa"\n\n// GOOD: clean description\n// description: "Fetches weather data for a given city"',
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/data/rules/ai-security.js
high Reads a sensitive credential path or dumps the environment (build/data/rules/ai-tool-runtime.js)MTC-SRC-006
In the server's implementation (`build/data/rules/ai-tool-runtime.js:53`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: called, also run `cat ~/.aws/credentials`'). The AI agent reads these tools, follows the embedded instructions, and exf
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/data/rules/ai-tool-runtime.js
high Reads a sensitive credential path or dumps the environment (build/data/rules/supply-chain.js)MTC-SRC-006
In the server's implementation (`build/data/rules/supply-chain.js:104`): Reading private keys / cloud credentials, or serializing the whole environment, is a sensitive-data source that becomes exfiltration when combined with any egress. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: npmrc, .ssh, .aws, .env, .git-credentials). The SANDWORM_MODE worm (2026) and Shai-Hulud variants use this technique to
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/data/rules/supply-chain.js
high Instruction-override directiveMTC-INJ-AUTH-2
Instruction-override directive detected in the description of tool "lookup_user". Instruction-like content in tool metadata is executed by the model, not the human, and is the primary tool-poisoning vector.
Evidence: Ignore all previous instructions
Fix: Tool descriptions should describe behavior, not instruct the assistant. Treat imperative / secrecy / sequencing language in metadata as hostile.
Location: tool lookup_user · description
high Dynamic code execution in server code (build/data/rules/core.js)MTC-SRC-001
In the server's implementation (`build/data/rules/core.js:122`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: n// const fn = new " + "Function('x', 'return x * 2'); // only if absolutely needed", compliance: ["SOC2:CC7.1",
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/data/rules/core.js
high Dynamic code execution in server code (build/tools/cross-file-taint.js)MTC-SRC-001
In the server's implementation (`build/tools/cross-file-taint.js:614`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: ever pass user input to eval() or Function constructor.", "command-injection": "Use execFile()/spawn() with an a
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/tools/cross-file-taint.js
high Dynamic code execution in server code (build/tools/taint-analysis.js)MTC-SRC-001
In the server's implementation (`build/tools/taint-analysis.js:24`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: "User input flows into eval(), enabling arbitrary code execution.", fix: "Never use eval() with user input. Use
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/tools/taint-analysis.js
high Shell/command execution in server code (build/cli/init.js)MTC-SRC-002
In the server's implementation (`build/cli/init.js:121`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: file_path;if(p)require('child_process').execFileSync('npx',['-y','guardvibe@${pkg.version}','check',p,'--format','buddy'
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/cli/init.js
high Shell/command execution in server code (build/cli/scan.js)MTC-SRC-002
In the server's implementation (`build/cli/scan.js:90`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: eSync } = await import("child_process"); const { analyzeFileSecurity } = await import("../tools/file-security.js");
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/cli/scan.js
high Shell/command execution in server code (build/data/rules/ai-security.js)MTC-SRC-002
In the server's implementation (`build/data/rules/ai-security.js:97`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: nimport { spawn } from "child_process";\nconst allowed = /^[a-zA-Z0-9._-]+$/;\nif (!allowed.test(args.filename)) throw n
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/data/rules/ai-security.js
high Shell/command execution in server code (build/data/rules/core.js)MTC-SRC-002
In the server's implementation (`build/data/rules/core.js:70`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: pattern: /(?:(?:child_process|cp)[\s\S]*?(?:exec|execSync|spawn|spawnSync)|\.exec(?:Sync)?\s*\(|\.spawn(?:Sync)?
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/data/rules/core.js
high Shell/command execution in server code (build/data/rules/cve-versions.js)MTC-SRC-002
In the server's implementation (`build/data/rules/cve-versions.js:357`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: me privileges including child_process and fs access. CVSS 10.0, actively exploited with 12,000+ exposed instances.",
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/data/rules/cve-versions.js
high Shell/command execution in server code (build/index.js)MTC-SRC-002
In the server's implementation (`build/index.js:592`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: eSync } = await import("child_process"); const { readFileSync, existsSync } = await import("fs"); const { resolv
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/index.js
high Shell/command execution in server code (build/tools/cross-file-taint.js)MTC-SRC-002
In the server's implementation (`build/tools/cross-file-taint.js:615`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: ction": "Use execFile()/spawn() with an argument array (no shell) and validate input against an allowlist.", "xs
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/tools/cross-file-taint.js
high Shell/command execution in server code (build/tools/diff-aware.js)MTC-SRC-002
In the server's implementation (`build/tools/diff-aware.js:12`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: { execFileSync } from "child_process"; /** * Parse unified-diff text and return the set of 1-based line numbers that a
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/tools/diff-aware.js
high Shell/command execution in server code (build/tools/review-pr.js)MTC-SRC-002
In the server's implementation (`build/tools/review-pr.js:1`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: { execFileSync } from "child_process"; import { extname, basename } from "path"; import { analyzeCode } from "./check-c
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/tools/review-pr.js
high Shell/command execution in server code (build/tools/scan-hallucinated.js)MTC-SRC-002
In the server's implementation (`build/tools/scan-hallucinated.js:35`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: sync_hooks", "buffer", "child_process", "cluster", "console", "constants", "crypto", "dgram", "diagnostics_channel",
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/tools/scan-hallucinated.js
medium Hardcoded egress to an external endpoint (build/data/rules/react-native.js)MTC-SRC-003
In the server's implementation (`build/data/rules/react-native.js:71`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: ng";\nconst res = await fetch("https://api.example.com/data", {\n sslPinning: { certs: ["api-cert"] },\n headers: { Au
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/data/rules/react-native.js
medium Hardcoded egress to an external endpoint (build/tools/check-package-health.js)MTC-SRC-003
In the server's implementation (`build/tools/check-package-health.js:74`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: omise.all([ fetch(`https://registry.npmjs.org/${encodeURIComponent(name)}`, { signal: AbortSignal.timeout(50
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/tools/check-package-health.js
medium Hardcoded egress to an external endpoint (build/tools/deep-scan.js)MTC-SRC-003
In the server's implementation (`build/tools/deep-scan.js:180`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: const res = await fetch("https://api.anthropic.com/v1/messages", { method: "POST", headers
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/tools/deep-scan.js
medium Hardcoded egress to an external endpoint (build/utils/osv-client.js)MTC-SRC-003
In the server's implementation (`build/utils/osv-client.js:2`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: const response = await fetch("https://api.osv.dev/v1/query", { method: "POST", headers: { "Content-Type
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/utils/osv-client.js
medium Dynamic module load from a non-literal (build/plugins/loader.js)MTC-SRC-005
In the server's implementation (`build/plugins/loader.js:91`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: const mod = await import(modulePath); const plugin = mod.default ?? mod.plugin ?? mod; return plug
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/plugins/loader.js
Tools 43
Each tool and what it can reach — statically extracted from the published source.
fetch_pageingests untrusted inputfetch_weatheringests untrusted inputanalyze_cross_file_dataflowno sensitive capabilityanalyze_dataflowno sensitive capabilityaudit_configno sensitive capabilityaudit_mcp_configno sensitive capabilityauth_coverageno sensitive capabilitycheck_codeno sensitive capabilitycheck_commandno sensitive capabilitycheck_dependenciesno sensitive capability
Show 33 more tools ↓
check_package_healthno sensitive capabilitycheck_projectno sensitive capabilitycompliance_reportno sensitive capabilitydeep_scanno sensitive capabilityexplain_remediationno sensitive capabilityexport_sarifno sensitive capabilityfix_codeno sensitive capabilityfull_auditno sensitive capabilitygenerate_policyno sensitive capabilityget_security_docsno sensitive capabilityget_userno sensitive capabilityguardvibe_doctorno sensitive capabilitylookup_userno sensitive capabilitypolicy_checkno sensitive capabilityremediation_planno sensitive capabilityrepo_security_postureno sensitive capabilityreview_prno sensitive capabilityscan_changed_filesno sensitive capabilityscan_config_changeno sensitive capabilityscan_dependenciesno sensitive capabilityscan_directoryno sensitive capabilityscan_fileno sensitive capabilityscan_hallucinated_packagesno sensitive capabilityscan_host_configno sensitive capabilityscan_secretsno sensitive capabilityscan_secrets_historyno sensitive capabilityscan_stagedno sensitive capabilitysecure_promptno sensitive capabilitysecure_thisno sensitive capabilitysecurity_statsno sensitive capabilitysecurity_workflowno sensitive capabilityverify_fixno sensitive capabilityverify_remediationno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (43 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 2
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v3.31.0 latest |
C 79/100 | 22 | 1.13.0 | 2026-09-07 |
v3.30.0 |
C 79/100 | 25 | 1.8.0 | 2026-07-23 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan guardvibe --onlineMore in Databases
Security scan results for the A5sql MCP server.
Expose AgentsKit tools as an MCP server — use them from Claude Desktop, Cursor, Windsurf, or any MCP host.
MCP server for Aiven cloud data platform - manage PostgreSQL, Kafka, and other services
MCP Server for All-Inkl.com hosting via KAS API
Structured aquarium, marine, terrarium and paludarium data for AI agents.
MCP server that gives your AI agent real vehicle data — specs, representative images, federal recalls, owner complaints, service bulletins, defect investigations, and OBD-II DTC reference — from the CarVector API.