Vibescan is answering right now. Last checked 7 min ago. It exposes 1 tools. Last commit 30 Oct 2026.
Free security scan for AI-written GitHub repos: leaked keys, .env, eval, SQLi, CORS.
What the code does
We read the source, 1 d ago · tools taken from the live server · rules 995398eba69f
What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.
…nd it flags the mistakes LLM-generated code makes most often: leaked API keys, committed <code>.env</code> files, <code>eval()</code> on user or LLM input, SQL built from strings, wildcard CORS, debug mode left on, TLS verification turned off, and no rate limiting.</p>
Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.
This code can reach further than it looks
We found places where it runs commands, builds paths or queries from values it is given. None of that is a flaw by itself — it becomes one when the code changes, and code changes quietly between releases. We re-read it on every one.
Connect this server
Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 7 min ago.
claude mcp add vibescan --transport http https://vibescan.bigfloppy.net/mcphttps://vibescan.bigfloppy.net/mcp[mcp_servers.vibescan]
url = "https://vibescan.bigfloppy.net/mcp"{
"mcpServers": {
"vibescan": {
"url": "https://vibescan.bigfloppy.net/mcp"
}
}
}{
"servers": {
"vibescan": {
"type": "http",
"url": "https://vibescan.bigfloppy.net/mcp"
}
}
}Available tools 1
Read directly from the server with tools/list, grouped by what they act on.
If a tool disappears, we record the date.
scan_repo
Endpoints
| URL | Transport | State | Latency | Checked |
|---|---|---|---|---|
| https://vibescan.bigfloppy.net/mcp | streamable-http | answering | 201 ms | 7 min ago |
Alternatives to Vibescan
same job, measured the same wayAudit GitHub repos for security, compliance, and EU AI Act exposure from Claude or Cursor.
Security scanner for AI-generated code. 30 free rules; all 223 with a paid-plan API key.
GitHub Secret Scanner - Find Leaked API Keys | Gitleaks
Evaluates any GitHub repository for license risk, maintenance velocity, stars/forks, and security.
MCP server for the GitHub REST API: issues, PRs, repos; read always on, write env-gated.
Free read-only check of a public GitHub repo for eight security signals related to the EU CRA.
Security audit for AI agents — scan code/diffs for leaked secrets, check deps via OSV.
Security tools for your AI: scan, pentest, check headers, guard code and scan repos for secrets.
Vibescan — questions
Answers built from our own checks of this server.