MCP.Market

Vibescan MCP server

by Aguantar·io.github.Aguantar/vibescan-mcp-server·v0.1.0·1 stars
No reviews yet

MCP server for VibeScan — scan projects for leaked secrets and security issues

C68/100grade C
Write a reviewInstall
What users say
No reviews yet
Be the first
Safety scan
C68/100

full report

Adoption
New

1 stars28 downloads/wk

Reviews

Write one

Nobody has reviewed Vibescan yet.

If you have run it, two minutes of your experience saves the next person an afternoon.

Vibescan tools (2)

write = sends, deletes, buys or posts

Read from the package source without running it. The installed server may list more.

  • vibescan_rules

    List all available VibeScan detection rules.

  • vibescan_scan

    Scan a project directory for leaked secrets and security issues.

Public scan report

scanner v0.1.10 · 2026-09-27 · same rubric, same numbers if you re-run it

1 medium
  • Code scan6 source files scanned20/25
  • –Live reliabilityno gateway calls yet and no remote to proben/a
  • –Tool poisoningtools not inspected (local package is not executed); not countedn/a
  • Auth qualitylocal package, no credentials required12/15
  • Maintenancelast push 193 days ago4/15
  • Maintainer identityregistry namespace matches repository owner; GitHub account older than a year8/10

Findings (1)

  • mediumeval / new Function usedexec.eval
    vibescan_mcp_server-0.1.0/src/vibescan_mcp/server.py: …e/config/docs - Dangerous patterns: eval(), shell injection, SQL injection, pickl…
Overall 68/100. Components that don't apply are left out of the denominator. Any critical finding is an F.RubricAppeal a findingJSON

How Vibescan compares

Against every graded Security MCP server, from our own scans and uptime checks. Updated after each scan run.

Safety score
68/100
higher than 30% of 918 Security servers
Tools
2
the typical Security server has 6
Tools that change things
0%
typical: 0%. Fewer write tools means less an agent can break
GitHub stars
1
more than 60% of 585 Security servers
Downloads a week
28
more than 15% of 240 Security servers with a package

What its tools let an agent do: 2 read

Install Vibescan in Claude Code, Cursor or VS Code

claude mcp add vibescan-mcp-server -- uvx vibescan-mcp-server
Add to Cursor

What the publisher says

From the Vibescan repository's README, as published. We do not edit it. Read it on GitHub

vibescan-mcp-server

mcp-name: io.github.Aguantar/vibescan-mcp-server

MCP server for VibeScan — scan projects for leaked secrets and security issues directly from Claude Code.

Features

  • vibescanscan** — Scan a project for secrets, dangerous patterns, and git hygiene issues
  • vibescanrules** — List all 17 detection rules

What VibeScan detects

  • 14 secret categories: env files, config hardcodes, cloud credentials, Docker/infra, CI/CD pipelines, IDE settings, SSH keys, hardcoded patterns, frontend env vars, data files, doc secrets, mobile files, system configs, editor remnants
  • Dangerous code patterns: eval(), exec(), shell injection, SQL injection, pickle, innerHTML
  • Git hygiene: missing .gitignore, unignored .env/.pem/.key files

All scanning runs locally — your code never leaves your machine.

Installation

pip install vibescan-mcp-server

Usage with Claude Code

Add to your .mcp.json:

{
  "mcpServers": {
    "vibescan": {
      "command": "vibescan-mcp-server"
    }
  }
}

Then ask Claude: "scan this project for security issues" or "check for leaked secrets".

License

MIT

Nothing above is checked by us. What we check is on the safety report.

Vibescan: common questions

Is Vibescan MCP server safe?
With care: it is graded C, so read the findings first (68/100). Read the Vibescan safety report
How do I install Vibescan?
It runs on your machine. Copy the Claude Code, Cursor, VS Code or Claude Desktop config from the install section.
Does Vibescan need an API key?
Not as far as the registry entry and our scan can tell: no credentials are declared or required.
Is Vibescan maintained?
The last commit was 228 days ago (2026-03-19). The latest release is v0.1.0.
What can I use instead of Vibescan?
Servers from other publishers that do the same job: Secret Scanner MCP server, Secret Scanner MCP server and Jikida MCP server.
How does Vibescan compare with other Security MCP servers?
safety score 68/100 (higher than 30% of 918 Security servers); tools 2 (the typical Security server has 6); tools that change things 0% (typical: 0%. Fewer write tools means less an agent can break). Full comparison.

Alternatives to Vibescan

Same job from other publishers: the closest match first, then the best rated.

  • Secret Scanner
    Scans files for leaked secrets and API keys
    More from 4hmetuyar →
    A
  • Secret Scanner
    Scans files for leaked secrets and API keys
    More from GuardBee →
    A
  • Jikida
    Security tools for your AI: scan, pentest, check headers, guard code and scan repos for secrets.
    A
  • Skylos
    Dead code, security, secrets detection and code quality for Python, TypeScript, Go.
    C
  • Snyk
    Easily find and fix security issues in your applications leveraging Snyk platform capabilities.
    B

More from Aguantar →