guardvibe 3.1.1 → 3.1.2

package/README.md

@@ -64,7 +64,7 @@ GuardVibe is purpose-built for the AI coding workflow. Traditional tools are exc
 npx guardvibe init claude
 ```
 
-Creates `.claude.json` MCP config, `.claude/settings.json` auto-scan hooks, and `CLAUDE.md` security rules. Restart Claude Code after setup.
+Creates `.mcp.json` MCP config (pinned to current version), `.claude/settings.json` auto-scan hooks, and `CLAUDE.md` security rules. Restart Claude Code after setup.
 
 ### Cursor
 
@@ -286,6 +286,13 @@ npx guardvibe doctor --scope host    # + shell profiles, global MCP configs
 npx guardvibe doctor --scope full    # + home dir configs
 npx guardvibe doctor --format json   # JSON output
 
+# LLM-powered deep scan (IDOR, business logic, race conditions, auth bypass)
+npx guardvibe deep-scan <file>                  # Default: Haiku 4.5, all focus areas
+npx guardvibe deep-scan <file> --focus idor     # Narrow to IDOR
+npx guardvibe deep-scan <file> --model sonnet   # Deeper analysis (more expensive)
+npx guardvibe deep-scan <file> --max-bytes 5000 # Truncate input for cost control
+# Requires ANTHROPIC_API_KEY or OPENAI_API_KEY env var
+
 # Setup
 npx guardvibe init <platform>       # Setup MCP server (claude, cursor, gemini, all)
 npx guardvibe hook install           # Install pre-commit hook

package/build/cli/init.js

@@ -14,6 +14,18 @@ const GUARDVIBE_MCP_CONFIG = {
     command: "npx",
     args: ["-y", `guardvibe@${pkg.version}`],
 };
+/** Extract a pinned version from an existing MCP server config (`{ args: ["-y", "guardvibe@X.Y.Z"] }`). */
+function extractPinnedVersion(config) {
+    const args = config?.args;
+    if (!Array.isArray(args))
+        return null;
+    for (const arg of args) {
+        if (typeof arg === "string" && arg.startsWith("guardvibe@")) {
+            return arg.slice("guardvibe@".length);
+        }
+    }
+    return null;
+}
 const platforms = {
     claude: {
         path: join(process.cwd(), ".mcp.json"),
@@ -177,12 +189,27 @@ function setupPlatform(name) {
         if (!existing.mcpServers) {
             existing.mcpServers = {};
         }
-        if (existing.mcpServers["guardvibe"]) {
-            console.log(`  [OK] GuardVibe already configured in ${platform.description}`);
+        const servers = existing.mcpServers;
+        if (servers["guardvibe"]) {
+            const existingPin = extractPinnedVersion(servers["guardvibe"]);
+            if (existingPin && existingPin !== pkg.version) {
+                servers["guardvibe"] = GUARDVIBE_MCP_CONFIG;
+                writeJsonFile(platform.path, existing);
+                console.log(`  [OK] Upgraded GuardVibe pin in ${platform.description} (${existingPin} → ${pkg.version})`);
+            }
+            else if (!existingPin) {
+                // Existing config has no pin (legacy unpinned form) — overwrite to pin.
+                servers["guardvibe"] = GUARDVIBE_MCP_CONFIG;
+                writeJsonFile(platform.path, existing);
+                console.log(`  [OK] Pinned GuardVibe in ${platform.description} (was unpinned → ${pkg.version})`);
+            }
+            else {
+                console.log(`  [OK] GuardVibe already up-to-date in ${platform.description} (v${pkg.version})`);
+            }
             setupSecurityGuide(name);
             return true;
         }
-        existing.mcpServers["guardvibe"] = GUARDVIBE_MCP_CONFIG;
+        servers["guardvibe"] = GUARDVIBE_MCP_CONFIG;
         writeJsonFile(platform.path, existing);
     }
     else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "guardvibe",
-  "version": "3.1.1",
+  "version": "3.1.2",
   "mcpName": "io.github.goklab/guardvibe",
   "description": "Security MCP for vibe coding. 390 rules, 36 tools, CLI + doctor. Host security, auth coverage mapping, LLM-powered deep scan (IDOR/business logic), taint analysis, +25 AI-native rules (MCP supply-chain, RAG/vector poisoning, agent loop DoS, public-prefix LLM keys, sandbox bypass). Plus Next.js, Supabase, Clerk, Stripe, Prisma, tRPC, Hono, GraphQL, Convex, Turso, Uploadthing, AI SDK, and the full AI-generated stack.",
   "type": "module",