vibesafex

Stop shipping AI-generated code you haven't reviewed.

vibesafex catches the bugs your AI coding agent won't tell you about: hallucinated imports, hardcoded secrets, security vulnerabilities, and dead code.

Built for the vibe coding era. Works with code from Claude Code, Cursor, Copilot, Windsurf, and any AI coding tool.

Quick Start

pip install vibesafex
vibesafex scan .

What It Catches

Usage

Scan a directory

vibesafex scan src/

Scan specific files

vibesafex scan main.py utils.py

Check code from stdin

echo 'x = eval(input())' | vibesafex check

JSON output (for CI/CD)

vibesafex scan . --format json

Filter by severity

vibesafex scan . --severity error          # Only errors
vibesafex scan . --fail-on warning         # Fail CI on warnings too

Python API

from vibesafex import scan_code, scan_file, scan_directory

# Scan a string
issues = scan_code('x = eval(input())')
for issue in issues:
    print(f"{issue.code}: {issue.message}")

# Scan a file
issues = scan_file("main.py")

# Scan a project
result = scan_directory("src/")
print(f"{result.error_count} errors found in {result.files_scanned} files")

Custom scanner configuration

from vibesafex import Scanner

scanner = Scanner(
    severity_threshold="warning",  # Skip info-level
    exclude_dirs={".venv", "migrations"},
)
result = scanner.scan_directory(".")

Example Output

  ✗ main.py:5:0 [error] VS100: Use of eval() - potential code injection vulnerability
  ✗ main.py:8:0 [error] VS200: Possible OpenAI API key
  ⚠ main.py:12:0 [warning] VS300: Import 'magic_ai_lib' - package 'magic_ai_lib' not found (hallucinated import?)
  ⚠ main.py:15:0 [warning] VS501: Function 'process' has empty body (pass) - placeholder
  ℹ main.py:20:0 [info] VS500: TODO comment - AI may have left incomplete implementation

5 files scanned: 2 errors, 2 warnings, 1 info

Pre-commit Hook

# .pre-commit-config.yaml
repos:
  - repo: local
    hooks:
      - id: vibesafex
        name: vibesafex
        entry: vibesafex scan --fail-on error
        language: python
        types: [python]
        additional_dependencies: [vibesafex]

Why Not Just Use Ruff/Pylint?

vibesafex focuses specifically on AI-generated code patterns that traditional linters miss:

• Hallucinated imports: AI confidently imports packages that don't exist. vibesafex checks against stdlib, installed packages, and 200+ known popular packages.
• Secret leakage: AI copies real-looking API keys into code. vibesafex detects patterns for 12+ providers.
• Placeholder code: AI leaves pass, ..., NotImplementedError stubs that slip through review.
• AI anti-patterns: Mutable defaults, star imports, excessive Any — patterns AI generates more often than humans.

Use vibesafex alongside your existing linter, not instead of it.

See Also

Part of the stef41 LLM toolkit — open-source tools for every stage of the LLM lifecycle:

License

Apache 2.0