guardvibe 3.0.25 → 3.0.27

package/CHANGELOG.md

@@ -5,6 +5,16 @@ All notable changes to GuardVibe are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [3.0.26] - 2026-04-25
+
+### Fixed
+- `init claude` now writes `.mcp.json` (Claude Code v2.x project-scope filename) instead of `.claude.json` — fixes silent install failure where MCP server was never loaded
+- VG964 (server-only missing) now requires Next.js context (`from 'next/...'` or `require('next/...')`) — no longer fires on plain CommonJS Node files
+- VG138 (plaintext password compare) no longer matches `typeof password !== 'string'` type guards
+- VG148 (login brute-force) now detects rate-limit middleware passed as positional argument before bcrypt.compare
+- VG061 (JWT no expiry) now correctly recognizes `expiresIn` anywhere in the `jwt.sign` argument list
+- VG030 (missing rate limit) no longer fires when route declaration includes a `*Limiter`, `*Throttle`, `*RateLimit`, `*Brute`, or `*SlowDown` middleware
+
 ## [2.7.1] - 2026-04-04
 
 ### Fixed

package/README.md

@@ -6,7 +6,7 @@
 [![npm provenance](https://img.shields.io/badge/provenance-verified-brightgreen)](https://www.npmjs.com/package/guardvibe)
 [![codecov](https://codecov.io/gh/goklab/guardvibe/graph/badge.svg)](https://codecov.io/gh/goklab/guardvibe)
 
-**The security MCP built for vibe coding.** 335 security rules, 36 tools covering the entire AI-generated code journey — from first line to production deployment.
+**The security MCP built for vibe coding.** 365 security rules, 36 tools covering the entire AI-generated code journey — from first line to production deployment.
 
 Works with **Claude Code, Cursor, Gemini CLI, Codex, VS Code (Copilot), Windsurf**, and any MCP-compatible coding agent.
 
@@ -14,7 +14,7 @@ Works with **Claude Code, Cursor, Gemini CLI, Codex, VS Code (Copilot), Windsurf
 
 Most security tools are built for enterprise security teams. GuardVibe is built for **you** — the developer using AI to build and ship web apps fast.
 
-- **335 security rules, 36 tools** purpose-built for the stacks AI agents generate
+- **365 security rules, 36 tools** purpose-built for the stacks AI agents generate
 - **Zero setup friction** — `npx guardvibe` and you're scanning
 - **No account required** — runs 100% locally, no API keys, no cloud
 - **Understands your stack** — not generic SAST, but rules that know Next.js, Supabase, Stripe, Clerk, and the tools you actually use
@@ -50,7 +50,7 @@ GuardVibe is purpose-built for the AI coding workflow. Traditional tools are exc
 | CVE version detection | 23 packages | Extensive | Extensive |
 | Compliance mapping (SOC2, PCI-DSS, HIPAA) | Built-in | Paid tier | None |
 | SARIF CI/CD export | Yes | Yes | Limited |
-| Rule count | 335 (focused) | 5000+ (broad) | N/A |
+| Rule count | 365 (focused) | 5000+ (broad) | N/A |
 
 **When to use GuardVibe:** You're building with AI agents and want security scanning integrated into your coding workflow — no dashboard, no account, no CI setup.
 
@@ -235,7 +235,7 @@ Malicious postinstall scripts, unpinned GitHub Actions, typosquat detection
 
 All scanning tools support `format: "json"` for machine-readable output.
 
-## Security Rules (341 rules across 25 modules)
+## Security Rules (365 rules across 25 modules)
 
 | Category | Rules | Coverage |
 |----------|-------|----------|

package/build/cli/audit.js

@@ -6,6 +6,8 @@ import { writeFileSync, existsSync, mkdirSync } from "fs";
 import { resolve, dirname } from "path";
 import { parseArgs, getStringFlag, getOutputPath, shouldFail, validateFormat } from "./args.js";
 import { runFullAudit, formatAuditResult } from "../tools/full-audit.js";
+import { setRules } from "../utils/rule-registry.js";
+import { builtinRules } from "../data/rules/index.js";
 export async function runAudit(args) {
     const { flags, positional } = parseArgs(args);
     const targetPath = resolve(positional[0] ?? ".");
@@ -14,6 +16,7 @@ export async function runAudit(args) {
     const failOn = getStringFlag(flags, "fail-on") ?? "critical";
     const skipDeps = flags["skip-deps"] === true;
     const skipSecrets = flags["skip-secrets"] === true;
+    setRules(builtinRules);
     // Terminal format by default when outputting to TTY, unless --format is specified
     const isTerminal = !outputFile && process.stdout.isTTY && !flags["format"];
     const format = isTerminal ? "terminal" : rawFormat;

package/build/cli/init.js

@@ -11,8 +11,8 @@ const GUARDVIBE_MCP_CONFIG = {
 };
 const platforms = {
     claude: {
-        path: join(process.cwd(), ".claude.json"),
-        description: "Claude Code (.claude.json)",
+        path: join(process.cwd(), ".mcp.json"),
+        description: "Claude Code (.mcp.json)",
     },
     gemini: {
         path: join(homedir(), ".gemini", "settings.json"),
@@ -154,7 +154,7 @@ function setupSecurityGuide(platformName) {
     else if (platformName === "gemini")
         setupGeminiGuide();
     const gitignoreEntries = {
-        claude: [".claude.json", ".claude/", "CLAUDE.md"],
+        claude: [".mcp.json", ".claude/", "CLAUDE.md"],
         cursor: [".cursor/", ".cursorrules"],
         gemini: ["GEMINI.md"],
     };

package/build/data/rules/advanced-security.js

@@ -110,7 +110,7 @@ export const advancedSecurityRules = [
         severity: "critical",
         owasp: "A02:2025 Cryptographic Failures",
         description: "Password is compared using direct string equality (=== or ==) instead of a hashing function. This means passwords are stored or transmitted in plaintext.",
-        pattern: /(?:password|passwd|pwd)\s*(?:===|!==|==|!=)\s*(?:(?:req|request|body|input|data|form|user)[\.\[]|["'])/gi,
+        pattern: /(?<!typeof\s)(?:password|passwd|pwd)\s*(?:===|!==|==|!=)\s*(?:(?:req|request|body|input|data|form|user)[\.\[]|["'](?!(?:string|number|boolean|undefined|object|function|symbol|bigint)["']))/gi,
         languages: ["javascript", "typescript", "python"],
         fix: "Never compare passwords directly. Use bcrypt.compare() or argon2.verify() to compare against hashed passwords.",
         fixCode: '// BAD: plaintext comparison\nif (user.password === inputPassword) { ... }\n\n// GOOD: hash comparison\nimport bcrypt from "bcrypt";\nconst valid = await bcrypt.compare(inputPassword, user.passwordHash);\nif (!valid) return new Response("Invalid", { status: 401 });',
@@ -240,7 +240,7 @@ export const advancedSecurityRules = [
         severity: "high",
         owasp: "A07:2025 Identification and Authentication Failures",
         description: "Login/authentication endpoint compares passwords without rate limiting or account lockout. Attackers can try unlimited password combinations.",
-        pattern: /(?:signIn|login|authenticate|logIn)\b[\s\S]{0,500}?(?:bcrypt\.compare|argon2\.verify|compare|verify)[\s\S]{0,300}?(?:(?!rateLimit|limiter|throttle|lockout|maxAttempts|failedAttempts|loginAttempts|Ratelimit)[\s\S]){5,}?(?:return|Response|res\.)/gi,
+        pattern: /(?:signIn|login|authenticate|logIn)\b(?:(?!rateLimit|limiter|throttle|lockout|maxAttempts|failedAttempts|loginAttempts|Ratelimit|brute)[\s\S]){0,500}?(?:bcrypt\.compare|argon2\.verify|compare|verify)(?:(?!rateLimit|limiter|throttle|lockout|maxAttempts|failedAttempts|loginAttempts|Ratelimit|brute)[\s\S]){5,300}?(?:return|Response|res\.)/gi,
         languages: ["javascript", "typescript"],
         fix: "Add rate limiting and account lockout to login endpoints.",
         fixCode: '// Add rate limiting to login\nimport { Ratelimit } from "@upstash/ratelimit";\nconst loginLimiter = new Ratelimit({\n  redis: Redis.fromEnv(),\n  limiter: Ratelimit.slidingWindow(5, "15 m"), // 5 attempts per 15 min\n});\n\nconst { success } = await loginLimiter.limit(email);\nif (!success) return new Response("Too many attempts", { status: 429 });',

package/build/data/rules/core.js

@@ -140,7 +140,7 @@ export const coreRules = [
         severity: "medium",
         owasp: "A04:2025 Insecure Design",
         description: "Authentication or API endpoints without rate limiting are vulnerable to brute force attacks.",
-        pattern: /(?:app|router)\.\s*(?:get|post|put|delete|patch|use)\s*\(\s*['"](?:\/login|\/auth|\/signin|\/register|\/signup|\/forgot-password)/gi,
+        pattern: /(?:app|router)\.\s*(?:get|post|put|delete|patch|use)\s*\(\s*['"](?:\/login|\/auth|\/signin|\/register|\/signup|\/forgot-password)['"]\s*,(?!\s*(?:\w*[Ll]imiter|\w*[Tt]hrottle|\w*[Rr]ate[Ll]imit|\w*[Bb]rute|\w*[Ss]low[Dd]own))/gi,
         languages: ["javascript", "typescript", "python", "go"],
         fix: "Add rate limiting middleware. Express: npm install express-rate-limit. FastAPI: use slowapi. Apply stricter limits on auth endpoints (e.g. 5 requests/minute).",
         fixCode: "// Express rate limiting\nimport rateLimit from 'express-rate-limit';\napp.use('/api/', rateLimit({ windowMs: 15 * 60 * 1000, max: 100 }));",
@@ -200,7 +200,7 @@ export const coreRules = [
         severity: "high",
         owasp: "A07:2025 Auth Failures",
         description: "JWT token created without expiration time.",
-        pattern: /jwt\.sign\s*\([^)]*(?!\bexpiresIn\b)[^)]*\)/gi,
+        pattern: /jwt\.sign\s*\((?:(?!\bexpiresIn\b)[^)])*\)/gi,
         languages: ["javascript", "typescript"],
         fix: "Always set token expiration: jwt.sign(payload, secret, { expiresIn: '15m' }).",
         fixCode: "// Always set expiration\nconst token = jwt.sign(payload, secret, { expiresIn: '15m' });",

package/build/data/rules/modern-stack.js

@@ -65,7 +65,7 @@ export const modernStackRules = [
         severity: "high",
         owasp: "A01:2025 Broken Access Control",
         description: 'File contains sensitive server-side logic (database queries, secret access) but does not import "server-only". Without this guard, the module can be accidentally imported by a Client Component, leaking server code to the browser bundle.',
-        pattern: /^(?![\s\S]*?(?:['"]server-only['"]|['"]use server['"]|['"]use client['"])[\s\S]*?)[\s\S]*?(?:process\.env\.(?!NEXT_PUBLIC_)\w+(?:_KEY|_SECRET|_TOKEN)|(?:prisma|db|supabase)\.(?:query|from|\$queryRaw))/g,
+        pattern: /^(?=[\s\S]*?(?:from\s+['"]next(?:\/[^'"]*)?['"]|require\s*\(\s*['"]next(?:\/[^'"]*)?['"]))(?![\s\S]*?(?:['"]server-only['"]|['"]use server['"]|['"]use client['"])[\s\S]*?)[\s\S]*?(?:process\.env\.(?!NEXT_PUBLIC_)\w+(?:_KEY|_SECRET|_TOKEN)|(?:prisma|db|supabase)\.(?:query|from|\$queryRaw))/g,
         languages: ["javascript", "typescript"],
         fix: 'Add import "server-only" at the top of files that contain server-side logic.',
         fixCode: '// Add at the very top of server-only modules\nimport "server-only";\n\n// Now this file cannot be imported by Client Components\nexport async function getSecretData() {\n  const key = process.env.SECRET_KEY;\n  return prisma.user.findMany();\n}',

package/build/index.js

@@ -60,7 +60,7 @@ function mergeStatsIntoOutput(results, summary, format) {
 const server = new McpServer({
     name: "guardvibe",
     version: pkg.version,
-    description: "Security MCP for vibe coding — single source of truth for AI assistants. 335 security rules and 36 tools. Use full_audit for a comprehensive PASS/FAIL/WARN verdict with deterministic result hash, coverage %, and unified report across code, secrets, dependencies, config, taint analysis, and auth coverage. IMPORTANT: When full_audit returns FAIL/WARN, call remediation_plan to get a mandatory section-by-section fix checklist covering ALL 6 sections (not just code). After fixing, call verify_remediation to confirm all sections were addressed. Same code = same hash = same results regardless of which AI assistant runs it. Covers OWASP, Next.js, Supabase, Stripe, Clerk, Prisma, Hono, AI SDK, MCP server security, host hardening. Maps to SOC2, PCI-DSS, HIPAA, GDPR, ISO27001, EU AI Act. Runs 100% locally with zero configuration.",
+    description: "Security MCP for vibe coding — single source of truth for AI assistants. 365 security rules and 36 tools. Use full_audit for a comprehensive PASS/FAIL/WARN verdict with deterministic result hash, coverage %, and unified report across code, secrets, dependencies, config, taint analysis, and auth coverage. IMPORTANT: When full_audit returns FAIL/WARN, call remediation_plan to get a mandatory section-by-section fix checklist covering ALL 6 sections (not just code). After fixing, call verify_remediation to confirm all sections were addressed. Same code = same hash = same results regardless of which AI assistant runs it. Covers OWASP, Next.js, Supabase, Stripe, Clerk, Prisma, Hono, AI SDK, MCP server security, host hardening. Maps to SOC2, PCI-DSS, HIPAA, GDPR, ISO27001, EU AI Act. Runs 100% locally with zero configuration.",
 });
 // Tool 1: Analyze code for security vulnerabilities
 server.tool("check_code", "Analyze inline code for security vulnerabilities (OWASP Top 10, XSS, SQL injection, insecure patterns). Pass code as a string parameter. For scanning files on disk, use scan_file instead. Example: check_code({code: 'app.get(...)', language: 'javascript'})", {
@@ -884,7 +884,7 @@ server.tool("deep_scan", "LLM-powered deep security analysis for vulnerabilities
     return { content: [{ type: "text", text: output }] };
 });
 // Tool 33: Full audit — single source of truth
-server.tool("full_audit", "Single command that runs ALL checks: code scan (341 rules), secret detection, dependency CVEs, config audit, taint analysis, and auth coverage. Returns PASS/FAIL/WARN verdict with deterministic hash. IMPORTANT: If verdict is FAIL or WARN, you MUST call remediation_plan next to get a section-by-section fix checklist — do NOT skip any section. After fixing, call verify_remediation to confirm ALL sections are addressed. Example: full_audit({path: '.'})", {
+server.tool("full_audit", "Single command that runs ALL checks: code scan (365 rules), secret detection, dependency CVEs, config audit, taint analysis, and auth coverage. Returns PASS/FAIL/WARN verdict with deterministic hash. IMPORTANT: If verdict is FAIL or WARN, you MUST call remediation_plan next to get a section-by-section fix checklist — do NOT skip any section. After fixing, call verify_remediation to confirm ALL sections are addressed. Example: full_audit({path: '.'})", {
     path: z.string().default(".").describe("Project root directory"),
     format: z.enum(["markdown", "json"]).default("markdown").describe("Output format"),
     skipDeps: z.boolean().default(false).describe("Skip dependency vulnerability check"),

package/build/tools/check-code.js

@@ -594,9 +594,21 @@ export function analyzeCode(code, language, framework, filePath, configDir, rule
  * Prefers framework-specific rules (VG4xx, VG9xx) over generic core rules (VG0xx).
  */
 function deduplicateFindings(findings) {
+    // First pass: drop exact duplicates — same rule firing on the same line.
+    // Happens when a rule has multiple regex variants that all match the same position,
+    // typical on minified single-line files where many patterns hit line 2 or 3.
+    const seenExact = new Set();
+    const exactDeduped = [];
+    for (const f of findings) {
+        const key = `${f.rule.id}:${f.line}`;
+        if (seenExact.has(key))
+            continue;
+        seenExact.add(key);
+        exactDeduped.push(f);
+    }
     // Group findings by line number
     const byLine = new Map();
-    for (const f of findings) {
+    for (const f of exactDeduped) {
         const group = byLine.get(f.line);
         if (group)
             group.push(f);

package/build/tools/full-audit.js

@@ -210,25 +210,36 @@ export async function runFullAudit(path, options) {
                 const depsJson = await scanDependencies(manifestPath, "json");
                 const parsed = safeJsonParse(depsJson);
                 if (parsed) {
-                    const vuln = parsed.summary?.vulnerable ?? 0;
-                    const counts = { findings: vuln, critical: parsed.summary?.critical ?? 0, high: parsed.summary?.high ?? 0, medium: parsed.summary?.medium ?? 0 };
+                    const vulnPackages = parsed.summary?.vulnerable ?? 0;
                     const depFindings = [];
+                    let depCritical = 0, depHigh = 0, depMedium = 0;
                     for (const pkg of parsed.packages ?? []) {
                         for (const v of pkg.vulnerabilities ?? []) {
                             const vuln2 = v;
+                            const sev = (vuln2.severity ?? "high");
+                            if (sev === "critical")
+                                depCritical++;
+                            else if (sev === "high")
+                                depHigh++;
+                            else
+                                depMedium++;
                             depFindings.push({
                                 ruleId: `DEP:${(vuln2.id ?? "CVE")}`,
-                                severity: (vuln2.severity ?? "high"),
+                                severity: sev,
                                 file: "package.json",
                                 line: 0,
                                 name: `${pkg.name ?? "unknown"}: ${(vuln2.id ?? "CVE")}`,
                                 description: (vuln2.summary ?? vuln2.details ?? ""),
                                 fix: `Run: npm update ${pkg.name ?? ""}`,
                             });
-                            allFindings.push({ ruleId: `DEP:${vuln2.id ?? "CVE"}`, severity: vuln2.severity, file: "package.json", line: 0 });
+                            allFindings.push({ ruleId: `DEP:${vuln2.id ?? "CVE"}`, severity: sev, file: "package.json", line: 0 });
                         }
                     }
-                    sections.push({ name: "dependencies", status: "ok", ...counts, details: vuln === 0 ? "No known CVEs" : `${vuln} vulnerable package(s)`, sectionFindings: depFindings });
+                    const counts = { findings: depFindings.length, critical: depCritical, high: depHigh, medium: depMedium };
+                    const detailText = depFindings.length === 0
+                        ? "No known CVEs"
+                        : `${depFindings.length} CVE(s) across ${vulnPackages} vulnerable package(s)`;
+                    sections.push({ name: "dependencies", status: "ok", ...counts, details: detailText, sectionFindings: depFindings });
                 }
             }
             catch {
@@ -339,7 +350,7 @@ export async function runFullAudit(path, options) {
     const totalHigh = sections.reduce((s, sec) => s + sec.high, 0);
     const totalMedium = sections.reduce((s, sec) => s + sec.medium, 0);
     const totalFindings = sections.reduce((s, sec) => s + sec.findings, 0);
-    const rulesApplied = rules.length > 0 ? rules.length : 335;
+    const rulesApplied = rules.length > 0 ? rules.length : 365;
     // Adjust score to reflect ALL sections, not just code
     // Each critical finding deducts 5 points, high deducts 3, medium deducts 1
     // Score from code scan is the baseline, other sections reduce it further

package/build/tools/scan-secrets.js

@@ -3,6 +3,7 @@ import { basename, dirname, extname, join, relative, resolve } from "path";
 import { execFileSync } from "child_process";
 import { secretPatterns, calculateEntropy } from "../data/secret-patterns.js";
 import { loadConfig } from "../utils/config.js";
+import { isExcludedFilename } from "../utils/constants.js";
 const DEFAULT_SECRET_EXCLUDES = new Set(["node_modules", ".git", "build", "dist"]);
 const SOURCE_FILE_EXTENSIONS = new Set([
     ".js", ".jsx", ".mjs", ".cjs",
@@ -75,6 +76,8 @@ function walkForSecrets(dir, recursive, results, excludes) {
         if (!entry.isFile())
             continue;
         const name = entry.name;
+        if (isExcludedFilename(name))
+            continue;
         const ext = extname(name).toLowerCase();
         if (name.startsWith(".env") || CONFIG_FILE_EXTENSIONS.has(ext) || SOURCE_FILE_EXTENSIONS.has(ext)) {
             results.push(fullPath);

package/build/utils/constants.d.ts

@@ -8,3 +8,6 @@ export declare const EXTENSION_MAP: Record<string, string>;
 export declare const CONFIG_FILE_MAP: Record<string, string>;
 /** Directory names excluded from filesystem scans by default. */
 export declare const DEFAULT_EXCLUDES: Set<string>;
+/** File-name patterns excluded from scans — minified bundles, vendor libs, generated artifacts. */
+export declare const DEFAULT_FILE_PATTERN_EXCLUDES: RegExp[];
+export declare function isExcludedFilename(name: string): boolean;

package/build/utils/constants.js

@@ -32,3 +32,15 @@ export const DEFAULT_EXCLUDES = new Set([
     ".vercel", ".clerk", ".wrangler", ".netlify", ".amplify",
     ".serverless", ".firebase", ".expo", ".output",
 ]);
+/** File-name patterns excluded from scans — minified bundles, vendor libs, generated artifacts. */
+export const DEFAULT_FILE_PATTERN_EXCLUDES = [
+    /\.min\.(js|mjs|cjs|css)$/i,
+    /\.bundle\.(js|mjs|cjs)$/i,
+    /-bundle\.(js|mjs|cjs)$/i,
+    /\.production(\.min)?\.(js|mjs|cjs)$/i,
+    /\.umd(\.min)?\.(js|mjs|cjs)$/i,
+    /\.esm(\.min)?\.(js|mjs|cjs)$/i,
+];
+export function isExcludedFilename(name) {
+    return DEFAULT_FILE_PATTERN_EXCLUDES.some((pattern) => pattern.test(name));
+}

package/build/utils/walk-directory.js

@@ -4,7 +4,7 @@
  */
 import { readdirSync } from "fs";
 import { join, extname } from "path";
-import { EXTENSION_MAP, CONFIG_FILE_MAP } from "./constants.js";
+import { EXTENSION_MAP, CONFIG_FILE_MAP, isExcludedFilename } from "./constants.js";
 /**
  * Recursively walk a directory, collecting file paths that match
  * known source extensions, Dockerfiles, or config file names.
@@ -31,6 +31,8 @@ export function walkDirectory(dir, recursive, excludes, results, unsupportedResu
             walkDirectory(fullPath, recursive, excludes, results, unsupportedResults);
         }
         else if (entry.isFile()) {
+            if (isExcludedFilename(entry.name))
+                continue;
             const ext = extname(entry.name).toLowerCase();
             let matched = false;
             if (EXTENSION_MAP[ext]) {

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "guardvibe",
-  "version": "3.0.25",
+  "version": "3.0.27",
   "mcpName": "io.github.goklab/guardvibe",
-  "description": "Security MCP for vibe coding. 341 rules, 36 tools, CLI + doctor. Host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis. Plus Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
+  "description": "Security MCP for vibe coding. 365 rules, 36 tools, CLI + doctor. Host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis. Plus Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",
   "bin": {
     "guardvibe": "build/cli.js",