@vibecheck-ai/mcp 23.2.0 → 24.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/LICENSE +21 -0
  2. package/README.md +28 -27
  3. package/dist/index.js +2366 -2656
  4. package/package.json +18 -22
package/LICENSE ADDED
@@ -0,0 +1,21 @@
1
+ MIT License
2
+
3
+ Copyright (c) 2026 VibeCheck
4
+
5
+ Permission is hereby granted, free of charge, to any person obtaining a copy
6
+ of this software and associated documentation files (the "Software"), to deal
7
+ in the Software without restriction, including without limitation the rights
8
+ to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
+ copies of the Software, and to permit persons to whom the Software is
10
+ furnished to do so, subject to the following conditions:
11
+
12
+ The above copyright notice and this permission notice shall be included in all
13
+ copies or substantial portions of the Software.
14
+
15
+ THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
+ IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
+ FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
+ AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
+ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
+ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
+ SOFTWARE.
package/README.md CHANGED
@@ -2,7 +2,7 @@
2
2
 
3
3
  <br />
4
4
 
5
- <img src="https://github.com/guardiavault-oss/Vibecheck/raw/HEAD/packages/vscode-extension/images/vibecheck_logo_transparent_2x.png" alt="VibeCheck MCP Server" width="80" />
5
+ <img src="https://github.com/vibecheck-oss/vibecheck/raw/HEAD/packages/vscode-extension/images/vibecheck_logo_transparent_2x.png" alt="VibeCheck MCP Server" width="80" />
6
6
 
7
7
  <br />
8
8
 
@@ -10,7 +10,7 @@
10
10
 
11
11
  ### Give your AI agent a trust layer.
12
12
 
13
- The Model Context Protocol server that lets Cursor, Claude, Windsurf, and any MCP-compatible AI agent scan code for hallucinations, compute trust scores, and gate deployments — using the same 17-engine pipeline as the CLI and VS Code extension.
13
+ The Model Context Protocol server that lets Cursor, Claude, Windsurf, and any MCP-compatible AI agent scan code for hallucinations, compute trust scores, and gate deployments — using the same 14-engine pipeline as the CLI and VS Code extension.
14
14
 
15
15
  <br />
16
16
 
@@ -21,7 +21,7 @@ The Model Context Protocol server that lets Cursor, Claude, Windsurf, and any MC
21
21
  <br />
22
22
 
23
23
  <p align="center">
24
- <img src="https://github.com/guardiavault-oss/Vibecheck/raw/HEAD/docs/assets/cli-scan-demo.gif" alt="VibeCheck MCP Server running inside Cursor" width="820" />
24
+ <img src="https://github.com/vibecheck-oss/vibecheck/raw/HEAD/docs/assets/cli-scan-demo.gif" alt="VibeCheck MCP Server running inside Cursor" width="820" />
25
25
  </p>
26
26
 
27
27
  <br />
@@ -36,6 +36,10 @@ The **Model Context Protocol (MCP)** is the open standard that connects AI codin
36
36
 
37
37
  **Your AI agent writes the code. VibeCheck verifies it didn't hallucinate.**
38
38
 
39
+ ### API compatibility
40
+
41
+ Billable scan tools that sync usage to VibeCheck’s API require **`@vibecheck-ai/mcp` 24.x or newer**. Older MCP builds are rejected at the API with `SCAN_CLIENT_UPGRADE_REQUIRED`. Update your MCP config to `npx -y @vibecheck-ai/mcp@latest` (or the matching published version).
42
+
39
43
  <br />
40
44
 
41
45
  ### How it works
@@ -46,7 +50,7 @@ The **Model Context Protocol (MCP)** is the open standard that connects AI codin
46
50
  │ Windsurf / Cline│ tool calls │ Server │
47
51
  │ Any MCP client │ │ │
48
52
  └──────────────────┘ │ ┌──────────────┐ │
49
- │ │ 17 Detection │ │
53
+ │ │ 14 Detection │ │
50
54
  │ │ Engines │ │
51
55
  │ └──────────────┘ │
52
56
  │ ┌──────────────┐ │
@@ -124,7 +128,7 @@ The server communicates over **stdio** using the MCP protocol. No HTTP. No ports
124
128
  <br />
125
129
 
126
130
  <p align="center">
127
- <img src="https://github.com/guardiavault-oss/Vibecheck/raw/HEAD/docs/assets/mcp-setup.png" alt="MCP server configuration in Cursor" width="720" />
131
+ <img src="https://github.com/vibecheck-oss/vibecheck/raw/HEAD/docs/assets/mcp-setup.png" alt="MCP server configuration in Cursor" width="720" />
128
132
  </p>
129
133
 
130
134
  <br />
@@ -192,7 +196,7 @@ The agent calls `vibecheck_roast` for an opinionated, brutally honest assessment
192
196
  <br />
193
197
 
194
198
  <p align="center">
195
- <img src="https://github.com/guardiavault-oss/Vibecheck/raw/HEAD/docs/assets/mcp-agent-scan.png" alt="AI agent using vibecheck_scan tool" width="720" />
199
+ <img src="https://github.com/vibecheck-oss/vibecheck/raw/HEAD/docs/assets/mcp-agent-scan.png" alt="AI agent using vibecheck_scan tool" width="720" />
196
200
  </p>
197
201
 
198
202
  <br />
@@ -201,29 +205,26 @@ The agent calls `vibecheck_roast` for an opinionated, brutally honest assessment
201
205
 
202
206
  <br />
203
207
 
204
- ## 17 Detection Engines
208
+ ## 14 Detection Engines
205
209
 
206
- The same engines that power the CLI and VS Code extension:
210
+ The same engines that power the CLI and VS Code extension (CLI `FileRunner` registration order):
207
211
 
208
212
  | # | Engine | What it catches |
209
213
  |:---:|:---|:---|
210
- | 1 | **Ghost Routes** | API calls to endpoints that were never implemented |
211
- | 2 | **Dead UI** | Buttons, forms, and links wired to empty handlers |
212
- | 3 | **Phantom Imports** | Packages referenced but never installed |
213
- | 4 | **Silent Failures** | Try/catch blocks that swallow errors |
214
- | 5 | **Hardcoded Mocks** | Test data left in production paths |
215
- | 6 | **Credential Leaks** | API keys, tokens, secrets in source |
216
- | 7 | **Env Drift** | Missing `.env` variable references |
217
- | 8 | **Auth Gaps** | Nonexistent auth providers |
218
- | 9 | **Type Holes** | `@ts-ignore`, `any` casts hiding bugs |
219
- | 10 | **Console Pollution** | Debug logs in production bundles |
220
- | 11 | **Version Hallucinations** | Wrong API for installed version |
221
- | 12 | **Slopsquatting** | Typosquat package names |
222
- | 13 | **Architectural Drift** | Structural pattern violations |
223
- | 14 | **Dependency Vulnerabilities** | Known CVEs |
224
- | 15 | **Performance Anti-patterns** | Sync I/O in async paths |
225
- | 16 | **Accessibility Violations** | Missing ARIA, keyboard traps |
226
- | 17 | **Contract Drift** | Code diverged from spec |
214
+ | 1 | **Undefined env vars** | `process.env` references not backed by your env / truthpack |
215
+ | 2 | **Ghost routes** | Client calls to API paths with no handler |
216
+ | 3 | **Phantom dependencies** | Imports of packages not declared or not resolvable |
217
+ | 4 | **API hallucinations** | SDK or API usage that does not exist for your stack |
218
+ | 5 | **Hardcoded secrets** | Keys, tokens, and passwords committed to source |
219
+ | 6 | **Security vulnerabilities** | Injection, XSS, SSRF, weak crypto, and related OWASP-style issues |
220
+ | 7 | **Fake features** | Placeholder flags, empty handlers, mock data in prod paths |
221
+ | 8 | **Version mismatches** | APIs incompatible with installed package versions |
222
+ | 9 | **Logic gaps** | Contradictory or impossible control flow |
223
+ | 10 | **Error-handling gaps** | Swallowed errors, risky `try`/`catch` shape, unchecked async results |
224
+ | 11 | **Incomplete implementation** | Stubs, empty bodies, unfinished paths |
225
+ | 12 | **Type contracts** | Types asserted vs actual JSON/API shape mismatches |
226
+ | 13 | **Security patterns** | Unprotected routes, CSRF, JWT misuse, redirects, CSP gaps |
227
+ | 14 | **Performance anti-patterns** | N+1 queries, sync I/O in async paths, fetch-in-render, and similar |
227
228
 
228
229
  <br />
229
230
 
@@ -289,7 +290,7 @@ The MCP server includes enterprise-grade reliability features:
289
290
  - **Zero code is transmitted** — ever
290
291
  - The MCP server communicates via **stdio only** — no network ports opened
291
292
  - Works **fully offline** and in air-gapped environments
292
- - [Open source](https://github.com/guardiavault-oss/Vibecheck) — read every line
293
+ - [Open source](https://github.com/vibecheck-oss/vibecheck) — read every line
293
294
 
294
295
  <br />
295
296
 
@@ -303,7 +304,7 @@ The MCP server includes enterprise-grade reliability features:
303
304
 
304
305
  <br />
305
306
 
306
- [Website](https://vibecheckai.dev) &nbsp;&nbsp;·&nbsp;&nbsp; [Documentation](https://docs.vibecheckai.dev) &nbsp;&nbsp;·&nbsp;&nbsp; [Discord](https://discord.gg/vibecheck) &nbsp;&nbsp;·&nbsp;&nbsp; [GitHub](https://github.com/guardiavault-oss/Vibecheck)
307
+ [Website](https://vibecheckai.dev) &nbsp;&nbsp;·&nbsp;&nbsp; [Documentation](https://docs.vibecheckai.dev) &nbsp;&nbsp;·&nbsp;&nbsp; [Discord](https://discord.gg/vibecheck) &nbsp;&nbsp;·&nbsp;&nbsp; [GitHub](https://github.com/vibecheck-oss/vibecheck)
307
308
 
308
309
  <br />
309
310