Guardvibe MCP Server

🗓️ Knows what your AI doesn't. CVE rules refreshed daily from GHSA / OSV.dev / CISA KEV - GuardVibe flags vulnerable dependencies published after your model's training cutoff. (93 CVE rules, npm run intel daily triage.) 🎯 Deterministic, not probabilistic. Same code = same result, every run (content-hashed). Your AI guesses; GuardVibe doesn't. Its 39 documented tools cover scan, check, security, config.

People connecting finance tools to Claude, Cursor, VS Code, or another MCP client. The project is written in TypeScript.

VERIFIED ACTIVE

LAST COMMIT 2026-08-14 · ★ 5 · #44 OF 283 MAINTAINED FINANCE · VERIFIED 2026-08-25

Apache-2.0 · TypeScript servers · how we verify → /methodology

01 · Install Guardvibe

before you install - you'll need

The README does not document required environment variables for a basic install.

Claude Code

claude mcp add goklab-guardvibe -- npx -y guardvibe

Claude Desktop / Cursor / VS Code - add to config

{
  "mcpServers": {
    "goklab-guardvibe": {
      "command": "npx",
      "args": [
        "-y",
        "guardvibe"
      ]
    }
  }
}

Same JSON for Cursor. For VS Code, rename the top-level key from `mcpServers` to `servers`.

Using another client? Same JSON, different key

Claude Desktop · mcpServers

Cursor · mcpServers

VS Code · servers

Windsurf · mcpServers

Zed · context_servers

Cline · mcpServers

Roo Code · mcpServers

Continue · mcpServers

LibreChat · mcpServers

Gemini CLI · mcpServers

Codex CLI · mcp_servers

Full setup guides: every client.

02 · Evidence

Security posture

What to check before giving this server access to your agent - from the registry, GitHub, and our own probes. We don't score safety; we show what's verifiable.

runs as local process (stdio) - runs on your machine with your user's permissions

license Apache-2.0 - declared in the repository

npm package guardvibe - unscoped; check the name against the project README before installing

registry namespace io.github.goklab is GitHub-verified and matches the repo owner

03 · What Guardvibe can do

Prose above is summarized from the project's README and registry record - no invented capabilities.

What you can build

With this server connected, an agent can analyze a code snippet for security issues, scan multiple files with security scoring (A-F), scan a project directory from disk, and check all dependencies for known CVEs (OSV) - annotates each vulnerable package with reachability (is it actually imported in your source?).

Capability map

Tools grouped from the project's README - what Guardvibe lets an agent do.

Scan

11 tools - e.g. Scan a project directory from disk; Pre-commit scan of git-staged files - diff-aware (blocks only newly-staged lines; diff_aware:false for whole files); Check all dependencies for known CVEs (OSV)…

scan_directory · scan_staged · scan_dependencies · scan_secrets · scan_secrets_history · scan_config_change…

Check

6 tools - e.g. Analyze a code snippet for security issues; Scan multiple files with security scoring (A-F); Check individual packages against OSV

check_code · check_project · check_dependencies · check_package_health · policy_check · check_command

Security

4 tools - e.g. Security best practices and guides; Assess overall repository security posture and map sensitive areas; Cumulative security dashboard - scans, fixes, grade trend over time

get_security_docs · repo_security_posture · security_stats · security_workflow

Audit

3 tools - e.g. Audit project configuration files for cross-file security misconfigurations; Audit MCP server configurations for hook injection, file:// abuse, sensitive paths; Single source of truth - runs ALL checks in…

audit_config · audit_mcp_config · full_audit

Secure

2 tools - e.g. Close the loop - scan, apply only the fixes that verifiably land (each re-scanned, rolled back on regression), return the verified code + a definition-of-done g; Prompt-level security (shift left)…

secure_this · secure_prompt

Analyze

2 tools - e.g. Track tainted data flows from user input to dangerous sinks; Cross-file taint analysis - track tainted data across module boundaries

analyze_dataflow · analyze_cross_file_dataflow

Verify

2 tools - e.g. Verify a security fix was applied correctly - returns fixed/still_vulnerable/new_issues; Remediation verification - compares before/after audit, flags skipped sections

verify_fix · verify_remediation

Compliance

1 tool - e.g. Map security findings to compliance controls (SOC2, PCI-DSS, HIPAA, GDPR, ISO27001, EU AI Act)

compliance_report

Latest releases

v3.31.0 · 2026-07-23

Critical Auth.js pair: v5-beta fail-open authorization bypass and homoglyph '@' email normalization bypass (GHSA-8fpg-xm3f-6cx3 / GHSA-7rqj-j65f-68wh), plus the @clerk/nextjs 5.x middleware bypass window no rule…

v3.30.0 · 2026-07-14

New IOC rules for two active npm supply-chain compromises: jscrambler malicious releases (8.14.0/8.16.0/8.17.0/8.18.0/8.20.0) and @injectivelabs/sdk-ts 1.20.21 wallet-key backdoor · New version-pin rule for n8n-mcp…

v3.29.0 · 2026-06-27

VG1098 - @deepstream/server <10.0.5 prototype pollution (CVE-2026-49252, critical CVSS 9.9) · VG1099 - pnpm lockfile/manifest path-traversal & RCE cluster, flags Corepack packageManager pin <10.34.2 / 11.0–11.5.2…

04 · Who maintains Guardvibe

guardvibe is maintained by goklab. It's the only MCP server we track from this author; the repo dates to Mar 2026.

05 · Facts

repository: github.com/goklab/guardvibe
category: finance - ranked #44 of 283 actively-maintained finance servers as of 2026-08-25.
release cadence: 10+ releases in the last 90 days (latest 2026-07-23)
registry: io.github.goklab/guardvibe (active, first published 2026-04-04 · 136 versions)
packages: npm:guardvibe

06 · Guardvibe FAQ

Is Guardvibe still maintained?

Yes - as of 2026-08-25, its last commit was 2026-08-14 and it shipped 10+ releases in the last 90 days. We re-verify nightly.

What can Guardvibe do?

How do I install Guardvibe?

Run `npx -y guardvibe`. The README does not document required environment variables for a basic install. You can also paste the ready-made client config above.

Does Guardvibe run locally?

Yes - it's a stdio server: it runs on your machine (via npx) with your user's permissions. Your data stays local unless the server itself calls external APIs.

07 · Alternatives to Guardvibe

Alternatives to Guardvibe

Maintained finance servers if Guardvibe isn't the fit.

Pairs well with

Servers that cover what Guardvibe doesn't - only shown when the pairing reason fits the companion.

More finance MCP servers · Halal Terminal · Chart Library - Pattern Intelligence · Haiku DeFi MCP · Pexels MCP Server · Bde Score

More TypeScript MCP servers · Test Coverage MCP · Server Taiwan Weather · Code Review Server · Platform AI · SODAX Builders MCP · see all