Vibeshift
[MCP Server] The Security Agent for AI assisted coding
What is Vibeshift?
Vibeshift is a Model Context Protocol (MCP) server that allows AI assistants like Claude, Cursor, and VS Code to [mcp server] the security agent for ai assisted coding
[MCP Server] The Security Agent for AI assisted coding
This server falls under the Security and Developer Tools categories on MCPgee, the world's largest MCP server directory with 33,000+ servers.
Features
- MCP protocol support
Use Cases
Maintainer
Works with
Installation
Manual Installation
npx vibeshiftConfiguration
Configuration Details
claude_desktop_config.json
Performance
Response Metrics
Resource Usage
How to Set Up and Use Vibeshift
VibeShift is a security-focused MCP server that brings automated security analysis and AI-assisted web testing to your coding environment. It integrates SAST scanning via Semgrep, dynamic vulnerability detection using Nuclei, and Playwright-based test recording and execution — all accessible through natural language prompts. Developers using AI-assisted coding can use VibeShift to catch XSS, SQL injection, and configuration vulnerabilities before they ship, and to record self-healing regression test suites without writing Playwright code by hand.
Prerequisites
- Python 3.10+ with pip and virtualenv support
- Node.js and npm (for Playwright/Patchright browser automation)
- An LLM API key (e.g., OpenAI or Anthropic) for AI-assisted test generation
- An MCP-compatible client such as Claude Desktop or VS Code with MCP support
- Git to clone the repository (no PyPI package available)
Clone the repository and set up the Python environment
Clone VibeShift from GitHub and create an isolated virtual environment to avoid dependency conflicts.
git clone https://github.com/GroundNG/VibeShift
cd VibeShift
python -m venv venv
source venv/bin/activate # On Windows: venv\Scripts\activateInstall Python dependencies and Patchright browsers
Install all Python dependencies from requirements.txt, then install the Patchright browser binaries which VibeShift uses for Playwright-based test automation.
pip install -r requirements.txt
patchright install --with-depsConfigure your LLM API key
Copy the example environment file and add your LLM API key. This key is used by VibeShift's AI components for test step suggestion and vulnerability analysis.
cp .env.example .env
# Edit .env and set:
# LLM_API_KEY="your-api-key-here"Add the MCP server to your client configuration
Register VibeShift in your MCP client's config file. The server runs via 'uv run mcp_server.py' from the repository directory.
{
"mcpServers": {
"VibeShift": {
"command": "uv",
"args": ["--directory", "/path/to/VibeShift", "run", "mcp_server.py"]
}
}
}Restart your MCP client and verify
Restart Claude Desktop or your MCP client. VibeShift should appear in the available tools list. Try asking it to list available recorded tests to confirm the connection.
Vibeshift Examples
Client configuration
Claude Desktop config that launches VibeShift using uv from a local repository clone.
{
"mcpServers": {
"VibeShift": {
"command": "uv",
"args": ["--directory", "/Users/yourname/VibeShift", "run", "mcp_server.py"]
}
}
}Prompts to try
Example prompts for security scanning, test recording, test execution, and site discovery.
- "Analyze this Python function for SQL injection vulnerabilities"
- "Record a test: go to https://example.com/login, type 'admin' into the username field, type 'Password1' into password, click submit, verify 'Welcome' appears on the page"
- "Run the regression test output/test_login_20240101_120000.json"
- "Discover potential test steps starting from https://example.com/app/"
- "List all available recorded web tests"Troubleshooting Vibeshift
Patchright browser installation fails or browsers are not found at runtime
Run 'patchright install --with-deps' again inside the activated virtual environment. On Linux, ensure system dependencies like libnss3 and libgbm are installed. The --with-deps flag installs these automatically on supported distros.
LLM API errors during test discovery or AI-assisted analysis
Confirm the LLM_API_KEY in your .env file is valid and has sufficient quota. Check that the .env file is in the root of the VibeShift repository directory, not in a subdirectory.
MCP server fails to start with 'uv not found'
Install uv by running 'pip install uv' or 'curl -LsSf https://astral.sh/uv/install.sh | sh'. Alternatively, replace the command with 'python' and set args to the full path of mcp_server.py.
Frequently Asked Questions about Vibeshift
What is Vibeshift?
Vibeshift is a Model Context Protocol (MCP) server that [mcp server] the security agent for ai assisted coding It connects AI assistants to external tools and data sources through a standardized interface.
How do I install Vibeshift?
Follow the installation instructions on the Vibeshift GitHub repository. Clone the repo, install dependencies, and add the server config to your AI client.
Which AI clients work with Vibeshift?
Vibeshift works with all major MCP-compatible AI clients including Claude Desktop, Claude Code, Cursor, VS Code (GitHub Copilot), Windsurf, and Cline.
Is Vibeshift free to use?
Yes, Vibeshift is open source and available under the Apache-2.0 license. You can use it freely in both personal and commercial projects.
Vibeshift Alternatives — Similar Security Servers
Looking for alternatives to Vibeshift? Here are other popular security servers you can use with Claude, Cursor, and VS Code.
Casdoor
★ 13.6kAn open-source Agent-first Identity and Access Management (IAM) /LLM MCP & agent gateway and auth server with web UI supporting OpenClaw, MCP, OAuth, OIDC, SAML, CAS, LDAP, SCIM, WebAuthn, TOTP, MFA, Face ID, Google Workspace, Azure AD
ghidraMCP
★ 9.0kAn Model Context Protocol server that enables LLMs to autonomously reverse engineer applications by exposing Ghidra's decompilation and analysis tools. It allows AI agents to list code structures, rename methods, and analyze binaries directly through
HexStrike AI
★ 8.9kHexStrike AI MCP Agents is an advanced MCP server that lets AI agents (Claude, GPT, Copilot, etc.) autonomously run 150+ cybersecurity tools for automated pentesting, vulnerability discovery, bug bounty automation, and security research. Seamlessly b
IDA Pro MCP
★ 8.7kEnables AI-assisted reverse engineering in IDA Pro by providing tools to analyze binaries, decompile functions, manage comments, search patterns, and interact with the IDA database through natural language.
Anthropic Cybersecurity Skills
★ 6.6k754 structured cybersecurity skills for AI agents · Mapped to 5 frameworks: MITRE ATT&CK, NIST CSF 2.0, MITRE ATLAS, D3FEND & NIST AI RMF · agentskills.io standard · Works with Claude Code, GitHub Copilot, Codex CLI, Cursor, Gemini CLI & 20+ platform
Hooker
★ 5.1k🔥🔥 hooker is a Frida-based reverse engineering toolkit for Android. It offers a user-friendly CLI, universal scripts, auto hook generation, memory roaming to detect activities/services, one-click SOCKS5 proxy setup, Frida JustTrustMe, and BoringSSL u
Browse More Security MCP Servers
Explore all security servers available in the MCPgee directory. Each server includes setup guides for Claude, Cursor, and VS Code.
Set Up Vibeshift in Your Editor
Choose your AI client for step-by-step setup instructions.
Quick Config Preview
Add this to your claude_desktop_config.json or .cursor/mcp.json
Ready to use Vibeshift?
Browse our complete directory of 33,000+ MCP servers, read setup guides for your editor, and start building with the Model Context Protocol.