VibeShift: The Security Engineer for Vibe Coders

VibeShift is an intelligent security agent designed to integrate seamlessly with AI coding assistants (like Cursor, GitHub Copilot, Claude Code, etc.). It acts as your automated security engineer, analyzing code generated by AI, identifying vulnerabilities, and facilitating AI-driven remediation before insecure code makes it to your codebase. It leverages the MCP (Model Context Protocol) for smooth interaction within your existing AI coding environment.

<a href="https://www.producthunt.com/posts/vibeshift-mcp?embed=true&utm_source=badge-featured&utm_medium=badge&utm_source=badge-vibeshift&#0045;mcp" target="_blank"><img src="https://api.producthunt.com/widgets/embed-image/v1/featured.svg?post_id=966186&theme=light&t=1747654611925" alt="VibeShift&#0032;MCP - Get&#0032;secure&#0044;&#0032;working&#0032;code&#0032;in&#0032;1&#0032;shot | Product Hunt" style="width: 115px; height: 25px;" width="250" height="54" /></a>

The Problem: AI coding assistants accelerate development dramatically, but they can also generate code with subtle or overt security vulnerabilities. Manually reviewing all AI-generated code for security flaws is slow, error-prone, and doesn't scale with the speed of AI development. This "vibe-driven development" can leave applications exposed.

The Solution: GroundNG's VibeShift bridges this critical security gap by enabling your AI coding assistant to:

1. Automatically Analyze AI-Generated Code: As code is generated or modified by an AI assistant, VibeShift can be triggered to perform security analysis using a suite of tools (SAST, DAST components) and AI-driven checks.
2. Identify Security Vulnerabilities: Pinpoints common and complex vulnerabilities (e.g., XSS, SQLi, insecure configurations, logic flaws) within the AI-generated snippets or larger code blocks.
3. Facilitate AI-Driven Remediation: Provides detailed feedback and vulnerability information directly to the AI coding assistant, enabling it to suggest or even automatically apply fixes.
4. Create a Security Feedback Loop: Ensures that developers and their AI assistants are immediately aware of potential security risks, allowing for rapid correction and learning.

This creates a "shift-left" security paradigm for AI-assisted coding, embedding security directly into the development workflow and helping to ship more secure code, faster.

Demo (Click to play these videos)

Features

• MCP Integration: Seamlessly integrates with Cursor/Windsurf/Github Copilot/Roo Code
• Automated Security Scanning: Triggers on AI code generation/modification to perform:
  • Static Code Analysis (SAST): Integrates tools like Semgrep to find vulnerabilities in source code.
  • Dynamic Analysis (DAST Primitives): Can invoke tools like Nuclei or ZAP for checks against running components (where applicable).
• AI-Assisted Test Recording: Generate Playwright-based test scripts from natural language descriptions (in automated mode).
• Deterministic Test Execution: Run recorded JSON test files reliably using Playwright.
• AI-Powered Test Discovery: Crawl websites and leverage any LLM (in openai compliant format) to suggest test steps for discovered pages.
• Regression Testing: Easily run existing test suites to catch regressions.
• Automated Feedback Loop: Execution results (including failures, screenshots, console logs) are returned, providing direct feedback to the AI assistant.
• Self Healing: Existing tests self heal in case of code changes. No need to manually update.
• UI tests: UI tests which aren't supported by playwright directly are also supported. For example, Check if the text is overflowing in the div
• Visual Regression Testing: Using traditional pixelmatch and vision LLM approach.

How it Works

+-------------+       +-----------------+       +---------------------+       +-----------------+       +-------------+
|    User     | ----> | AI Coding Agent | ----> |     MCP Server      | ----> | Scan, test, exec| ----> | Browser     |
| (Developer) |       | (e.g., Copilot) |       | (mcp_server.py)     |       | (SAST, Record)  |       | (Playwright)|
+-------------+       +-----------------+       +---------------------+       +-----------------+       +-------------+
      ^                                                  |                            |                     |
      |--------------------------------------------------+----------------------------+---------------------+
                                      [Test Results / Feedback]

1. User: Prompts their AI coding assistant (e.g., "Test this repository for security vulnerabilities", "Record a test for the login flow", "Run the regression test 'test_login.json'").
2. AI Coding Agent: Recognizes the intent and uses MCP to call the appropriate tool provided by the MCP Server.
3. MCP Server: Routes the request to the corresponding function (get_security_scan, record_test_flow, run_regression_test, discover_test_flows, list_recorded_tests).
4. VibeShift Agent:
   • Traditional Security Scan: Invokes Static Analysis Tools (e.g., Semgrep) on the code.
   • Recording: The WebAgent (in automated mode) interacts with the LLM to plan steps, controls the browser via BrowserController (Playwright), processes HTML/Vision, and saves the resulting…