Vibescan

net.bigfloppy.vibescanPublished by vibescan.bigfloppy.netOfficial publisherv1.0.0Updated Nov 6, 2026

Free security scan for AI-written GitHub repos: leaked keys, .env, eval, SQLi, CORS.

VerifiedStreamable HTTPWeb executableDeveloper ToolsSecurity & Monitoring

Overview

AI-generated overview

Remote MCP server that scans a public GitHub repository for leaked secrets and risky code patterns common in AI-written code.

What you can do
  • Scan a public GitHub repository, given as owner/repo or a URL, for security problems.
  • Report leaked secrets and committed .env files.
  • Flag risky code patterns such as eval, SQL injection and CORS misconfiguration.
When to use it
Useful when you want a quick free security check of a public GitHub repo, especially one largely written by AI assistants, before sharing or deploying it.
Requirements
A remote MCP endpoint at vibescan.bigfloppy.net; no package install, API key or environment variable is declared. The repository to scan must be public on GitHub.
Before you install
The scan is sent to a third-party service, so repository names and contents are shared with it. Results are pattern-based and may miss issues or produce false positives; do not treat them as a full audit.

Installation

In SourceWeft

  1. Open Vibescan in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Web executable via Streamable HTTP. Remote servers run from the web runtime once configured in a workspace.

Use with an agent

Paste this prompt into Claude Code, Codex, Cursor or another agent — or into SourceWeft chat. The agent reads this server's install guide, shows you its publisher, endpoint and sign-in, and adds it to your client once you agree. Keys never go into a command.

Read https://sourceweft.com/mcp/net.bigfloppy.vibescan%2Fvibescan/install.md and connect the MCP server it describes to my client. Before changing any config, show me its publisher, endpoint and sign-in method and wait for my OK. Never put an API key in a command or in a file I would commit; ask me where it should come from.

Read the install guide the agent follows

Other MCP clients

Add this to your client's mcpServers config.

{
  "mcpServers": {
    "vibescan": {
      "type": "http",
      "url": "https://vibescan.bigfloppy.net/mcp"
    }
  }
}

README

VibeScan

A security scanner for vibe-coded repos. Stdlib-only Python, nothing to pip install. Run: PORT=8473 python3 server.py · Health: /api/health · Vhost: vibescan.bigfloppy.net → 127.0.0.1:8473

Source: README.md at commit 738ace1

Tools

1

scan_repo

Scan a public GitHub repo (owner/repo or URL) for leaked secrets, .env files, eval, SQLi, CORS and other risky patterns common in AI-written code.

Parametersreporequired

Version history

1
  1. v1.0.0LatestOct 30, 2026

Score

90% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 daysRequired25 pts
  • Auth declaredRequired10 pts
  • Tools listedRequired15 pts
  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.