New: CheckVibe MCP server — scan from Claude Code and Cursor nativelyRead the docs
Paste any URL — production app, staging build, vibe-coded prototype. The scanner runs every check we know in parallel and hands back ranked findings with reproducible evidence.
No installs, no config files, no agents to run. Just the URL of the thing you shipped.
SPA shells, sitemap entries, login flows, dashboard pages — wherever the surface area lives.
Headers, JS bundles, APIs, DNS, TLS, BaaS configs — every check fires concurrently against every discovered route.
Severity is calibrated to exploitability, not noise. Every finding ships with the request, response, and an AI fix prompt.
We render JavaScript and follow redirects the same way Chrome does — not a single naive `curl -I`.
Source-map-aware extraction finds Stripe, OpenAI, Supabase, and Firebase keys leaked into client bundles.
Detects Next.js, Vite, Remix, and SvelteKit routes that never appear in a sitemap.
A leaked dev anon key is not the same as a production service-role key. The scanner knows the difference.
Every CheckVibe finding ships with a copy-paste prompt engineered for Claude, Cursor, and Windsurf — context, file paths, the exact diff.
Watch the traffic hitting your live app, classify suspicious patterns, and surface real threats — credential stuffing, scraping, prompt-injection probes — without flooding your inbox with noise.
Set a project up once.
Branded, executive-style PDFs and shareable dashboards for stakeholders, clients, and security reviewers — without writing a single sentence yourself.
Plug CheckVibe into Claude Desktop, Cursor, or any MCP-compatible client.
