// the direct install command
One command in. Ten seconds to the first finding.
Security installs are supposed to be the part where you lose an afternoon. This one is four lines of YAML, or a single command at a terminal. No account, no agent, no sidecar — and the code being scanned never leaves the machine it is running on.
$ npx vibeshield scan .
Already have the binary? vibeshield scan --staged does the pre-commit job right now.
Zero-Exfiltration Guarantee
Static analysis runs 100% locally on your machine or CI runner. No source code or secrets are ever transmitted across the network.
0
accounts, API keys, or telemetry
4
lines of YAML if you want the PR gate
1.2s
median diff scan
122
AI-failure-mode rules, offline
Five doors, same scanner
Pick the one that matches how you work. They all run the identical engine — the rules pack lives inside the binary, so there is no “lite” version of any of these.
01 · Zero install
Nothing on PATH yet? Type this
Fetches the binary once, verifies the checksum, runs the scan. No global state, no prompt for anything.
first run ~30 s · every run after it under 2 s
npx vibeshield scan .02 · The direct command
One line, then it is just installed
The installer drops the static binary in ~/.local/bin, checks it against the release sha256sums, and — if it spots one — wires the audit skill into your coding agent. Linux, macOS, and Git Bash on Windows.
no sudo · no PATH edits behind your back · --agent none to skip the skill
curl -fsSL https://raw.githubusercontent.com/rajviyash9136freefr-tech/vibeshield/main/scripts/install.sh | bash03 · The gate
Five lines of YAML, every PR covered
Drop the file, push the branch, forget about it. From the next pull request on, the VibeCheck report posts itself — in warn mode by default, so it informs before it ever blocks.
runs on your runner · code never leaves it
name: VibeShield
on: [pull_request]
jobs:
vibeshield:
runs-on: ubuntu-latest
permissions:
contents: read
pull-requests: write
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- uses: rajviyash9136freefr-tech/vibeshield/action@v3.0.104 · The commit-time habit
Stop it at the commit, not the PR
The same rules engine, on staged files, offline. Under 1.5 seconds on a typical diff. git commit --no-verify always works — it is a seatbelt, not a hostage.
pre-commit run --all-files to backfill
repos:
- repo: https://github.com/rajviyash9136freefr-tech/vibeshield
rev: v3.0.1
hooks:
- id: vibeshield05 · From source
If you read Go, read the source before you run it
One module, no CGO, plain go install. Every rule pack is versioned YAML in the same repo — nothing ships compiled that you cannot diff.
go test ./... passes before every release tag
go install github.com/rajviyash9136freefr-tech/vibeshield/scanner/cmd/vibeshield@v3.0.1The first sixty seconds, honestly
Here is exactly what happens when you run the command above in a repo with AI-written code in it. Nothing is phoned home, nothing is installed that you did not ask for, and the scan finishes before your coffee lands.
- The binary is fetched and its sha256 is checked against the release manifest. A mismatch refuses to run — loudly.
- The rules pack (core 2.0.0, MIT) loads from inside the binary. Zero network, zero config.
- Every tracked file gets pattern-matched against the 122 AI-failure-mode rules — 117 of which the engine can evaluate today.
- Findings print in the VibeCheck format: why it matters for AI code, the pattern, a one-line fix. Secrets are redacted to 4+4 characters before anything is printed.
$ npx vibeshield scan .
vibeshield 3.0.0 · rules core 2.0.0 (offline)
Scanning 42 files (full mode)… done in 0.9s
🔴 CRITICAL VS-PKG-001 hallucinated-package
src/utils/parse.ts:8 — fast-parse-utils-v3@2.1.4
9 days old · 1 maintainer · postinstall curls a host
→ Fix: replace with node:util (12 lines, zero dependencies).
🟠 HIGH VS-SEC-017 hardcoded-secret
src/lib/agent.ts:41 — OPENAI_API_KEY = "sk-proj-••••••••4a2f"
→ Fix: read process.env.OPENAI_API_KEY and rotate the key now.
✓ 40 files clean · 2 findings · 0 leaks merged
Next: vibeshield init (add the PR gate + hook)What can actually go wrong
Four honest answers to the four things that actually stop an install. If yours is not here, open an issue — someone reads them.
I am on Windows. Does the one-liner work?
Use the PowerShell installer (irm … | iex), which downloads vibeshield-windows-x86_64.zip, unpacks vibeshield.exe into ~/.local/bin, adds it to your user PATH, and wires the audit skill into any coding agent it finds. The .sh installer is for POSIX shells — Git Bash works, plain PowerShell does not.
Corporate proxy / air-gapped network?
Download the archive for your platform from GitHub Releases, check it against the matching line in sha256sums.txt from the same release, and put the binary on PATH. Rules are embedded in the binary, so scans work with the network unplugged — the scanner links in no HTTP client at all.
I ran it and nothing printed but findings.
Good. Exit code 0 means the scan completed; in the default warn mode findings never fail the run. In CI, set mode: block-on-critical in vibeshield.yml when you want the check to gate merges — the docs page walks through the four modes.
How do I get rid of it?
rm ~/.local/bin/vibeshield (or delete vibeshield.exe), remove the workflow file, remove the hook entry, and delete vibeshield.yml. There is no daemon, no service, and no state outside your repo to clean up.
I am not sure it is installed correctly.
Run vibeshield doctor. It reports the binary and its rule pack, the config, the git hook, the PR-gate workflow and your agent rule files, and prints the exact command that fixes each gap. It changes nothing, and it exits 1 when something needs fixing.
Want the flags, exit codes, and SARIF output? CLI reference → · GitHub Action → · pre-commit →
Audit Your AI Code Before It Enters Production
Scan local git diffs in under 1 second. 100% offline static binary analysis with zero code or tokens sent to external servers.
MIT Licensed · 100% Free · No account required · Open Source