Vibe Check — a complete audit of your site and vibe-coded app

A detailed overview: the risks of vibe-coded apps, supported stacks (Cursor, Replit, Lovable, Bolt, v0, Windsurf, Claude Code), plans and pricing. A scan from a URL in roughly 8 seconds, 200 deterministic checks across 8 categories.

Covers security, performance, SEO, GDPR, AEO (AI-readiness), NIS2 and the AI Act. Every finding comes with a copy-paste fix.

Developer workflow integrations

  • MCP server — Vibe Check as a Model Context Protocol server. Scan straight from Claude Code, Cursor, Windsurf or any MCP client: tools scan_url, get_findings, explain_finding, compare_scans and scan_mcp_config. Install: npx -y @grovetech/vibe-mcp.
  • CLI tool — @grovetech/defender with init, check, proxy and replay commands. Scan your build before deploy (defender check) and run a runtime proxy for any stack. Works in CI, exits 1 on findings.
  • IDE integrations — Cursor, Claude Code, Windsurf and VS Code via MCP; the /vibecheck slash command runs a scan, explains a finding, proposes a fix and re-scans afterwards.
  • GitHub integration — repository and pull request scanning, results delivered as PR comments and status checks.

Malware detection and leak monitoring

  • Malware detection — checks your page for injected scripts, cryptominers, skimmers and redirects to malicious domains; verified against Google Safe Browsing.
  • Dark web leak monitoring — we watch whether emails, passwords or API keys from your domain show up in breached databases, and alert you.
  • MCP security scan — audits third-party MCP servers: prompt injection and tool poisoning in tool descriptions, plaintext secrets in config, and rug-pull changes to tool definitions.

AI-layer and supply-chain security

  • Leaked AI key in the page — we find an API key (OpenAI, Anthropic, Google, payment or cloud provider) baked into the HTML or JS where every visitor can read it. A critical finding — the key can be abused immediately, on your account.
  • Exposed system prompt — if your chatbot's or AI assistant's system instruction is visible in the page source, we flag it. An exposed prompt makes jailbreaks easier and reveals internal logic.
  • Web supply chain (Subresource Integrity) — a third-party script loaded without integrity protection (SRI): if the source content changes, foreign code runs on your site with full privileges. This is exactly how the polyfill.io attack (2024, 100,000+ sites) happened. We calibrate severity by source — user-content storage (blob storage, S3) as high, large CDNs as a recommendation.