Grove Tech AI — Vibe Check scanner and AI Defender for vibe-coded apps

We find the holes. We seal them. Done. Grove Tech AI is an AI studio and security platform for people who build apps in Cursor, Replit, Lovable, Bolt, v0, Windsurf or Claude Code. Vibe Check scans your app from its URL in roughly 8 seconds, returns a 0–100 score and concrete fixes. AI Defender then protects it at runtime with a single line of code.

Vibe Check — a scanner for AI-built apps

URL → a 0–100 score and a list of problems with copy-paste fixes in about 8 seconds. 201 deterministic checks across 8 categories — no hallucinations, 100% reproducible. Finds leaked API keys, exposed .env files, source maps and unprotected AI endpoints.

What Vibe Check checks

  • Security — HTTPS, HSTS, CSP, cookies, headers, exposed secrets and keys
  • Performance — server response time, compression, caching, inline assets
  • SEO — meta tags, structure, sitemap, robots, canonical
  • GDPR — cookie consent, analytics, privacy
  • AEO (AI-readiness) — semantic structure, llms.txt, schema.org, availability to AI agents
  • NIS2 — compliance overview for Czech and EU legislation

AI Defender — runtime protection

AI Defender blocks attacks while your app is running: prompt injection and multi-turn jailbreak, poisoned RAG documents, unauthorized tool calls, API key leaks, automatic PII redaction, data exfiltration and token-cost attacks. Every block is written to an audit log with NIS2 and AI Act evidence.

One-line deployment

Add app.use(d.web()) and your app is protected at runtime — no further configuration.

Developer workflow integrations

  • MCP server — Vibe Check as a Model Context Protocol server. Scan straight from Claude Code, Cursor, Windsurf or any MCP client: tools scan_url, get_findings, explain_finding, compare_scans and scan_mcp_config. Install: npx -y @grovetech/vibe-mcp.
  • CLI tool — @grovetech/defender with init, check, proxy and replay commands. Scan your build before deploy (defender check) and run a runtime proxy for any stack. Works in CI, exits 1 on findings.
  • IDE integrations — Cursor, Claude Code, Windsurf and VS Code via MCP; the /vibecheck slash command runs a scan, explains a finding, proposes a fix and re-scans afterwards.
  • GitHub integration — repository and pull request scanning, results delivered as PR comments and status checks.

Malware detection and leak monitoring

  • Malware detection — checks your page for injected scripts, cryptominers, skimmers and redirects to malicious domains; verified against Google Safe Browsing.
  • Dark web leak monitoring — we watch whether emails, passwords or API keys from your domain show up in breached databases, and alert you.
  • MCP security scan — audits third-party MCP servers: prompt injection and tool poisoning in tool descriptions, plaintext secrets in config, and rug-pull changes to tool definitions.

AI-layer and supply-chain security

  • Leaked AI key in the page — we find an API key (OpenAI, Anthropic, Google, payment or cloud provider) baked into the HTML or JS where every visitor can read it. A critical finding — the key can be abused immediately, on your account.
  • Exposed system prompt — if your chatbot's or AI assistant's system instruction is visible in the page source, we flag it. An exposed prompt makes jailbreaks easier and reveals internal logic.
  • Web supply chain (Subresource Integrity) — a third-party script loaded without integrity protection (SRI): if the source content changes, foreign code runs on your site with full privileges. This is exactly how the polyfill.io attack (2024, 100,000+ sites) happened. We calibrate severity by source — user-content storage (blob storage, S3) as high, large CDNs as a recommendation.