Run a scan — Vibe Code Health Scanner

Paste a URL and within roughly 8 seconds you get a 0–100 score and a concrete list of problems with copy-paste fixes. 200 deterministic checks across 8 categories — no hallucinations, 100% reproducible.

The scan finds leaked API keys in your JS bundle, publicly reachable .env and .git files, production source maps, unprotected AI endpoints, missing security headers, misconfigured CORS and exposed admin panels.

How to run a scan

  • From the web — paste a URL in the field above; the first scan needs no signup.
  • From Claude Code or Cursor (MCP server) — npx -y @grovetech/vibe-mcp, then call the scan_url tool. The /vibecheck slash command drives the whole loop: scan → explain → fix → re-scan → compare.
  • From the CLI — npx @grovetech/defender check scans your build before deploy; in CI it exits non-zero when it finds secrets.
  • From GitHub — results delivered as pull request comments and status checks.

Developer workflow integrations

  • MCP server — Vibe Check as a Model Context Protocol server. Scan straight from Claude Code, Cursor, Windsurf or any MCP client: tools scan_url, get_findings, explain_finding, compare_scans and scan_mcp_config. Install: npx -y @grovetech/vibe-mcp.
  • CLI tool — @grovetech/defender with init, check, proxy and replay commands. Scan your build before deploy (defender check) and run a runtime proxy for any stack. Works in CI, exits 1 on findings.
  • IDE integrations — Cursor, Claude Code, Windsurf and VS Code via MCP; the /vibecheck slash command runs a scan, explains a finding, proposes a fix and re-scans afterwards.
  • GitHub integration — repository and pull request scanning, results delivered as PR comments and status checks.

Malware detection and leak monitoring

  • Malware detection — checks your page for injected scripts, cryptominers, skimmers and redirects to malicious domains; verified against Google Safe Browsing.
  • Dark web leak monitoring — we watch whether emails, passwords or API keys from your domain show up in breached databases, and alert you.
  • MCP security scan — audits third-party MCP servers: prompt injection and tool poisoning in tool descriptions, plaintext secrets in config, and rug-pull changes to tool definitions.

AI-layer and supply-chain security

  • Leaked AI key in the page — we find an API key (OpenAI, Anthropic, Google, payment or cloud provider) baked into the HTML or JS where every visitor can read it. A critical finding — the key can be abused immediately, on your account.
  • Exposed system prompt — if your chatbot's or AI assistant's system instruction is visible in the page source, we flag it. An exposed prompt makes jailbreaks easier and reveals internal logic.
  • Web supply chain (Subresource Integrity) — a third-party script loaded without integrity protection (SRI): if the source content changes, foreign code runs on your site with full privileges. This is exactly how the polyfill.io attack (2024, 100,000+ sites) happened. We calibrate severity by source — user-content storage (blob storage, S3) as high, large CDNs as a recommendation.