How do I install Vibescan?

Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Vibescan need an API key?

No required environment variable is listed on this record.

What transport does Vibescan use?

Vibescan runs locally over stdio.

Vibescan

Q: When was Vibescan last checked?

Last checked 2026-10-16. MCP server for VibeScan — scan projects for leaked secrets and security issues

by io.github.Aguantar

MCP server for VibeScan — scan projects for leaked secrets and security issues

Power your agent

Add this server

The publisher's own command. Not a PlugMCP endpoint.

Local command

uvx vibescan-mcp-server==0.1.0

Provider

Claude Code

claude mcp add io.github.aguantar-vibescan-mcp-server -- uvx vibescan-mcp-server==0.1.0

Run in a terminal.

Claude Desktop

{
  "mcpServers": {
    "io.github.aguantar-vibescan-mcp-server": {
      "command": "uvx",
      "args": [
        "vibescan-mcp-server==0.1.0"
      ]
    }
  }
}

claude_desktop_config.json

Step-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Related MCP

Related skills

View all

vibescan-mcp-server

mcp-name: io.github.Aguantar/vibescan-mcp-server

MCP server for VibeScan — scan projects for leaked secrets and security issues directly from Claude Code.

Features

vibescan_scan — Scan a project for secrets, dangerous patterns, and git hygiene issues
vibescan_rules — List all 17 detection rules

What VibeScan detects

14 secret categories: env files, config hardcodes, cloud credentials, Docker/infra, CI/CD pipelines, IDE settings, SSH keys, hardcoded patterns, frontend env vars, data files, doc secrets, mobile files, system configs, editor remnants
Dangerous code patterns: eval(), exec(), shell injection, SQL injection, pickle, innerHTML
Git hygiene: missing .gitignore, unignored .env/.pem/.key files

All scanning runs locally — your code never leaves your machine.

Installation

pip install vibescan-mcp-server

Usage with Claude Code

Add to your .mcp.json:

{
  "mcpServers": {
    "vibescan": {
      "command": "vibescan-mcp-server"
    }
  }
}

Then ask Claude: "scan this project for security issues" or "check for leaked secrets".

License

MIT