VibeCheck — AI Code Safety Layer

Stop shipping AI slop. Catch hallucinated code before it hits production.

16 detection engines. 6 work modes. One keystroke.

VibeCheck scans every commit for the failures AI code editors quietly introduce — phantom imports, ghost routes, swallowed errors, hard-coded mock data, missing env vars, fake auth, drifting contracts — and gives you the proof you need to ship safely.

The problem AI editors don't talk about

AI-generated code compiles, typechecks, and looks correct. It still ships bugs that pass review and break in production. We've audited thousands of agent diffs and these are the patterns that keep landing:

// 1. Phantom routes — handler never exists on the server
await fetch('/api/payments/confirm');

// 2. Swallowed errors — failures vanish silently
try {
  await chargeCustomer(amount);
} catch (error) {
  /* …nothing. ever. */
}

// 3. Hard-coded mock data shipped to prod
const revenue = 99_999;
const subscribers = 1_337;

// 4. Hallucinated dependencies
import { encrypt } from 'crypto-utils-pro'; // package doesn't exist on npm

// 5. Env-var ghosts
const key = process.env.STRIPE_PROD_KEY; // never declared, never set, always undefined

// 6. Drifted contracts — frontend payload doesn't match backend schema
await api.post('/users', { full_name: name });   // server expects { fullName }

Type-checkers, ESLint, Prettier, and the language server all sign off on every single one of those. VibeCheck doesn't.

How VibeCheck works

VibeCheck is a scan engine + verification layer that audits your repository the way a senior engineer would — by reading the code against itself, not against generic style rules.

┌─────────────────────────────────────────────────────────────────┐
│                        Your editor                              │
│      VS Code / Cursor / Windsurf  ◀──▶  VibeCheck Sidebar       │
└─────────────────────────────────────────────────────────────────┘
                              │
                              │  triggers
                              ▼
┌─────────────────────────────────────────────────────────────────┐
│  16 engines  →  routes · deps · envs · auth · secrets · halluc  │
│                  contracts · types · tests · perf · …           │
└─────────────────────────────────────────────────────────────────┘
                              │
                              ▼
┌─────────────────────────────────────────────────────────────────┐
│  Findings  →  trust score · evidence · fix plan · ship verdict  │
└─────────────────────────────────────────────────────────────────┘
                              │
            ┌─────────────────┼──────────────────┐
            ▼                 ▼                  ▼
       Auto-fix          Ship Check           Agent Firewall
   (one-click patch)  (release decision)   (block bad AI edits)

The 6 work modes

The sidebar groups everything into six modes so you can move from finding to ship without context-switching:

Web companion: The same modes are available at vibecheckai.dev if you'd rather drive scans from a browser tab.

The 16 engines (one-line each)

Each engine emits findings with severity, file/line, evidence, and (where possible) a suggested fix.

Quickstart (90 seconds)

1. Install

Install VibeCheck — AI Code Safety Layer from the VS Code / Cursor / Windsurf Marketplace.

2. Scan

Open a project and press:

Cmd/Ctrl + Shift + V

You'll see live findings in the sidebar within a few seconds.

3. Triage

Click a finding. The right inspector shows:

• The code, with the exact lines highlighted
• The evidence trail (why we think it's broken)
• A proposed fix, runnable with one click

4. Ship

When you're ready to merge, run Ship Check (Cmd/Ctrl + Shift + P → VibeCheck: Ship). You get a single 0–100 score, a verdict (SHIP / BLOCK / WATCH), and a JSON proof bundle you can attach to the PR.

Keyboard shortcuts

All bindings are rebindable via VS Code keyboard preferences.

Most-used commands

Open the command palette (Cmd/Ctrl + Shift + P) and type VibeCheck:.

There are 60+ commands in total. The palette filters them as you type.

Configuration

Open VS Code settings (Cmd/Ctrl + ,) and search vibecheck to see all options. The ones that matter most day-to-day:

Sign in (Device Flow)

When you trigger a feature that needs your account (Ship, cloud history, MCP), the extension opens a browser to:

https://vibecheckai.dev/approve?user_code=ABCD-1234

You log in once, approve the device, and the token lands in VS Code SecretStorage — never written to disk in plaintext, never exposed to other extensions.

CLI

Same engines. Same findings. Different surface.

# scan + render to terminal
npx @vibecheck-ai/cli scan .

# ship verdict for CI
npx @vibecheck-ai/cli ship --ci --format sarif > vibecheck.sarif

# guard mode — exit non-zero on critical findings
npx @vibecheck-ai/cli guard . --max-critical=0

CI integration

Drop this into .github/workflows/vibecheck.yml:

name: VibeCheck
on: [pull_request]
jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npx @vibecheck-ai/cli ship --ci --format sarif > vibecheck.sarif
      - uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: vibecheck.sarif

SARIF output renders inline in the PR Files Changed tab — every finding appears next to the line that triggered it.

MCP server

VibeCheck exposes its tools to any MCP-capable agent (Claude Desktop, Cursor's agent panel, custom orchestrators).

npx @vibecheck-ai/mcp

Add to .mcp.json:

{
  "mcpServers": {
    "vibecheck": {
      "command": "npx",
      "args": ["@vibecheck-ai/mcp"]
    }
  }
}

Available tools: vibecheck_scan, vibecheck_protect, vibecheck_findings, vibecheck_fix, vibecheck_roast.

Plans

See vibecheckai.dev/pricing for current pricing.

Privacy & security

Compatibility

• VS Code ≥ 1.93
• Cursor (latest)
• Windsurf (latest)
• Node.js ≥ 20.11 (only needed if you use the bundled CLI from a custom path)

Works on macOS, Linux, and Windows. Apple Silicon and Intel both supported natively.

Troubleshooting

If you hit something not in this table, open an issue at mailto:founder@vibecheckai.dev with the output of VibeCheck: Open Report.

Roadmap (next 90 days)

• Real-time Agent Firewall for Cursor's agent mode
• Inline AI explanations for every finding (opt-in, local model first)
• Custom engine SDK (@vibecheck/engine-sdk)
• Team policy packs (org-wide rule bundles)
• Notion + Linear integration for missions