# Grove Tech AI

> Grove Tech AI is an AI studio and security platform for vibe coding. Flagship products: Vibe Check (a scanner for AI-built apps — URL in, a 0–100 score and copy-paste fixes out in ~8 seconds, 186 deterministic checks) and AI Defender (runtime protection deployed with one line, app.use(d.web())). Tagline: "We find the holes. We seal them. Done."

Grove Tech AI (grovetechai.com) is a Czech company based in Prague. It helps people who build applications with AI tools (Cursor, Replit, Lovable, Bolt, v0, Windsurf, Claude Code) find and seal the security holes in their vibe-coded apps and protect them in production. NIS2 / GDPR-aware.

The site is available in Czech (root URLs) and English (`/en/` prefix, e.g. https://grovetechai.com/en/scanner). Both languages are server-rendered and indexable.

## Contact

- Web: https://grovetechai.com
- Email: info@grovetechai.com
- LinkedIn: https://www.linkedin.com/company/grovetech-ai
- Company: Grove Tech AI s.r.o., company ID 21707146, VAT CZ21707146
- Address: Varšavská 715/36, 120 00 Prague 2, Czech Republic

## Vibe Check — the scanner for AI-built apps

Vibe Check is a security and AI-readiness scanner for applications built by vibe coding.

- Input: the URL of a running application
- Output: a 0–100 score plus a list of problems with copy-paste fixes
- Speed: roughly 8 seconds
- 186 deterministic checks across 8 categories — 0 hallucinations, 100% reproducible
- Finds: leaked API keys, exposed .env files, source maps, unprotected AI endpoints
- Categories: security, performance, SEO, GDPR, accessibility, AI readiness, tech stack, data exposure
- NIS2 compliance overview and PDF report
- The report is shareable; the first scan needs no signup
- URL: https://grovetechai.com/scanner (English: https://grovetechai.com/en/scanner)

## MCP server — scan from inside your AI editor

Vibe Check runs as a Model Context Protocol (MCP) server, so an AI coding agent can scan a site, explain a finding and write the fix directly into the code.

- Install: `npx -y @grovetech/vibe-mcp` (published npm package, stdio transport)
- Authentication: `GROVETECH_API_KEY` environment variable; the hosted endpoint uses `Authorization: Bearer <key>`
- Supported clients: Claude Code, Claude Desktop, Cursor, Windsurf, VS Code
- Claude Code slash command: `/vibecheck <url>` drives the whole loop — scan, explain, fix, re-scan, compare
- Tools:
  - `scan_url` — run a full scan of a URL, returns a 0–100 score and top findings
  - `get_findings` — list findings from a scan, filterable by severity and category
  - `explain_finding` — detailed explanation of a finding: impact and concrete fix
  - `list_recent_scans` — the user's most recent completed scans
  - `compare_scans` — diff two scans (before/after a fix): fixed, introduced, persisting, score change
  - `scan_mcp_config` — security scan of third-party MCP servers in your own client config
- Docs: https://grovetechai.com/docs/mcp — Overview: https://grovetechai.com/integrations/mcp

## CLI tool

`@grovetech/defender` ships a CLI for local and CI use.

- `defender init` — detect your framework and wire the protection middleware into your app
- `defender check` — scan a build directory (./dist) for leaked secrets and personal data; exits non-zero on a hit, so CI fails before a key ships
- `defender proxy` — a stack-agnostic reverse proxy, no code changes required
- `defender replay` — replay a captured attack against your target to verify protection holds
- Docs: https://grovetechai.com/docs/defender

## IDE and CI integrations

- Cursor, Claude Code, Windsurf and VS Code — via the MCP server (see above)
- GitHub — connect your account for per-repo scanning; results arrive as pull request comments and status checks. A leaked key or exposed .env fails the check before merge. https://grovetechai.com/github
- CI pipelines — `npx @grovetech/defender check` as a build step

## Malware detection

Vibe Check checks scanned pages for injected malware.

- Injected third-party scripts and unexpected external resources
- Cryptominers and payment-card skimmers
- Redirects to known malicious domains
- Verification against Google Safe Browsing

## Dark web leak monitoring

We monitor whether credentials tied to your domain have appeared in breached databases and alert you.

- Email addresses, passwords and API keys associated with your domain
- Alerts when new leaks appear
- Combined with runtime protection: rotate the key, then let AI Defender block abuse of the old one

## AI exposure and web supply-chain checks

Vibe Check understands the AI layer of a vibe-coded app, not just generic web hygiene.

- Leaked AI/service key in the page — an API key (OpenAI, Anthropic, Google, payment or cloud provider) hardcoded in HTML or JS where any visitor can read it. Critical: the key is abusable immediately, billed to your account.
- Exposed system prompt — a chatbot or AI-assistant system instruction visible in the page source (data attributes or inline). Flagged because it eases jailbreaks and reveals internal logic.
- Web supply chain / Subresource Integrity (SRI) — a third-party script loaded without an integrity hash. If the source content changes (compromised CDN or storage account), foreign code runs on the page with full privileges — the polyfill.io class of attack (2024, 100,000+ sites). Severity is calibrated by source: user-content storage (blob storage, S3, raw GitHub) as high, large reputable CDNs as a best-practice recommendation.

## AI Defender — runtime protection

AI Defender protects AI applications while they run.

- Blocks prompt injection, API key leaks, data theft and cost attacks in runtime
- One-line deployment: `app.use(d.web())`, or run it as a proxy with no code changes
- Detects secrets for 25+ providers in outbound responses
- Blocks access to sensitive paths (.env, .git, .ssh, .aws)
- NIS2 audit logging of incidents
- Complements Vibe Check: what the scanner finds, Defender guards in production
- URL: https://grovetechai.com/defender — Docs: https://grovetechai.com/docs/defender

## AI Agent Scanner

Tests how resistant an AI agent or chatbot is to attack, over public HTTP, on domains you have verified.

- 31 simulated attacks drawn from the OWASP LLM Top 10
- Categories: prompt injection, jailbreak, system prompt extraction, data exfiltration, excessive agency, PII leakage
- Output: a 0–100 resistance score, transcripts and a recommendation per successful attack
- Model-agnostic (GPT, Claude, Llama or your own)
- URL: https://grovetechai.com/ai-agent-scanner

## MCP Security Scanner

Scans third-party MCP servers you have installed, or are considering installing, for malicious behavior. Deterministic, rule-based, no LLM judge.

- Prompt injection in tool descriptions — hidden imperatives, invisible Unicode, hidden HTML comments, base64 blobs
- Tool poisoning — descriptions steering the model to read ~/.ssh, .env or browser profiles, or to send data to external URLs
- Tool shadowing — descriptions that modify how other tools and servers behave
- Secrets in MCP config — plaintext API keys and tokens in env vars
- Rug pull protection — tool definitions are hashed and pinned; changes since approval are flagged with a diff
- Verdict per server (Safe / Caution / Dangerous) plus an environment-level verdict
- Available in the web UI, from the CLI, and via the `scan_mcp_config` MCP tool
- stdio servers are never executed without explicit per-server consent

## Pricing

- Free — 2 scans / 30 days on 1 domain
- Solo — 490 CZK / month
- Pro — 1,290 CZK / month
- Partner — custom agreement
- The first scan is free, no signup
- URL: https://grovetechai.com/pricing

## Partner program

Agencies, consultants and vibe coders can offer Vibe Check to their clients under their own brand.

- Recurring commission on payments from referred customers
- White-label scans and PDF reports
- Partner dashboard: referral kit, QR codes, commission overview, payouts, client domain management
- Self-serve application: https://grovetechai.com/partner-signup

## Case studies

Real customer stories: what Vibe Check found, what the customer fixed and what came of it.

- Case studies: https://grovetechai.com/case-studies
- Live references and telemetry: https://grovetechai.com/proof

## Who it's for

Developers, founders and teams who build apps with AI tools such as Cursor, Replit, Lovable, Bolt, v0, Windsurf or Claude Code, and need to ship them to production quickly and securely.

## Key facts

- Languages: the UI ships in 9 languages (cs, en, de, sk, hi, no, fr, pl, da). Crawlable, server-rendered content exists in Czech (root) and English (`/en/`).
- Focus: security of vibe-coded applications, AI readiness, NIS2 / GDPR compliance
- Determinism: checks are deterministic — no hallucinations, fully reproducible

## FAQ

**Q: What does Grove Tech AI do?**
A: An AI studio and security platform. Vibe Check scans AI-built apps (0–100 score + fixes in ~8s, 186 checks); AI Defender protects them at runtime with one line.

**Q: What is Vibe Check?**
A: A scanner for vibe-coded apps. Give it a URL and within ~8 seconds you get a 0–100 score and concrete fixes. 186 deterministic checks across 8 categories.

**Q: Can I scan from my editor?**
A: Yes. Vibe Check is an MCP server — install `npx -y @grovetech/vibe-mcp` and scan from Claude Code, Cursor, Windsurf or VS Code. There is also a CLI (`npx @grovetech/defender check`).

**Q: What is AI Defender?**
A: Runtime protection deployed with one line, `app.use(d.web())`. It blocks attacks and leaks while the app runs.

**Q: Does it detect malware and leaked credentials?**
A: Yes. Scans check pages for injected malware (scripts, cryptominers, skimmers, malicious redirects, Google Safe Browsing), and dark web monitoring alerts you when your domain's credentials appear in breached databases.

**Q: How much does it cost?**
A: Solo 490 CZK, Pro 1,290 CZK per month, Partner by agreement. The first scan is free, no signup.

**Q: What tools does Vibe Check work with?**
A: Apps built with Cursor, Replit, Lovable, Bolt, v0, Windsurf, Claude Code and others — it scans the running site from its URL, so the generator doesn't matter.

## Pages

Czech at the root, English under `/en/` (e.g. https://grovetechai.com/en/pricing).

- Home: https://grovetechai.com/
- Vibe Check scanner: https://grovetechai.com/scanner
- AI Defender: https://grovetechai.com/defender
- MCP server integration: https://grovetechai.com/integrations/mcp
- MCP server docs: https://grovetechai.com/docs/mcp
- AI Defender docs and CLI: https://grovetechai.com/docs/defender
- AI Agent Scanner: https://grovetechai.com/ai-agent-scanner
- GitHub integration: https://grovetechai.com/github
- Features: https://grovetechai.com/funkce
- Pricing: https://grovetechai.com/pricing
- Methodology: https://grovetechai.com/methodology
- Proof: https://grovetechai.com/proof
- Case studies: https://grovetechai.com/case-studies
- Partner program (apply): https://grovetechai.com/partner-signup
- Blog: https://grovetechai.com/blog
- About: https://grovetechai.com/o-nas
- Security: https://grovetechai.com/security