Your AI writes code that compiles.
VibeCheck proves it actually works.

14 detection engines find the hallucinations, phantom APIs, ghost routes, credential leaks, and silent failures that ESLint, TypeScript, and code review miss — then fix them in one click.

  

The problem

Every AI coding tool — Cursor, Copilot, Claude, Windsurf, ChatGPT — produces code that compiles, passes lint, and looks correct. Then it breaks in production.

These aren't edge cases. They're the default:

  fetch('/api/payments/confirm')          →  Endpoint never implemented. 404 in prod.
  catch (err) { }                         →  Error silently swallowed. Data lost.
  { revenue: 99999 }                      →  Hardcoded mock. Dashboard lies to users.
  STRIPE_SECRET_KEY in client bundle      →  Credential leaked to every browser.
  <button onClick={handleSubmit}>         →  Handler is empty. Feature doesn't work.

Your linter says it's fine. TypeScript says it's fine. PR review says it's fine.

Your users find the bugs.

The fix: one keystroke

⌘ ⇧ V   /   Ctrl Shift V

That's it. 14 engines run in parallel. Every finding gets a severity, a file location, and a fix.

Scanning workspace...

  ✗  GRD-001  Ghost endpoint /api/payments/confirm       — never implemented
  ✗  SEC-003  STRIPE_SECRET_KEY in client bundle          — credential leak
  ✗  HAL-007  Silent catch in processPayment()            — error swallowed
  ✗  HAL-012  Hardcoded mock { revenue: 99999 }           — fake data in prod path

  Ship Score: 34/100 → NO SHIP

  Applying 4 fixes...

  Ship Score: 100/100 → SHIP ✓

No config files. No setup wizard. No onboarding flow. Install → scan → fix → ship.

Staying compatible with the API

Signed-in Free plan daily scan checks call VibeCheck’s API. Use this extension at 24.x or newer so scan quota and usage recording keep working. Older marketplace builds may receive SCAN_CLIENT_UPGRADE_REQUIRED from the API until you update the extension.

14 detection engines

Every engine is purpose-built for a specific failure mode that traditional tools miss. These map to the engines registered by the CLI FileRunner (workspace engines + baseline registry).

Agent Firewall

VibeCheck intercepts AI edits as they happen — before they reach your files.

Works with Cursor, Copilot, Claude, Windsurf, Cline, Continue, Codeium, Supermaven, Amazon Q, and every other tool that writes to disk.

Toggle from the sidebar. One click.

Fix everything in one click

Every finding includes a fix. Choose your speed:

Inline fix — hover any underlined finding → click the lightbulb → done.

AI Auto-Fix — for complex multi-file issues, an LLM generates a context-aware repair that understands your codebase, not just the error message. Runs locally via Ollama (free) or via Anthropic/OpenAI APIs.

Bulk heal — fix every finding in the entire project in one pass. Watch the score go from red to green.

Beyond scanning: a full intelligence platform

Ship with cryptographic proof

Ship Check scores your project 0–100 and produces a signed proof bundle.

The proof bundle at .vibecheck/proof.json is a tamper-evident record of every check that ran, every finding, and the final verdict. Use it in CI to gate deployments automatically.

Install in 10 seconds

VS Code / Windsurf / Cursor:

1. Open Extensions → Search "VibeCheck AI" → Click Install
2. Open any project
3. Press ⌘⇧V

CLI:

npx @vibecheck-ai/cli scan .

CI/CD:

# .github/workflows/vibecheck.yml
name: VibeCheck
on: [pull_request]
jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npx vibecheck-ai ship --ci

MCP Server (for AI agents):

npx @vibecheck-ai/mcp

Free vs Paid

Core detection is free forever. No account. No time limits. No feature walls on scanning.

Works with every AI coding tool

Cursor  ·  GitHub Copilot  ·  Claude  ·  ChatGPT  ·  Windsurf  ·  Bolt  ·  Cline  ·  Aider  ·  Continue  ·  Codeium  ·  Supermaven  ·  Amazon Q

Language support

TypeScript  ·  JavaScript  ·  React  ·  Vue  ·  Svelte  ·  Next.js  ·  Python  ·  Go  ·  Rust

Privacy & Security

• All scanning runs locally on your machine
• Zero code is transmitted — ever
• Cloud features are opt-in and require explicit setup
• Works fully offline and in air-gapped environments
• Auth credentials use VS Code's encrypted SecretStorage API
• Open source — read every line