VibeArmor Documentation

1. Scan your first app

Go to vibearmor.ai/scan and paste any live URL. Vercel previews, Netlify deploys, Railway apps, or any public endpoint. The scan takes about 2-3 minutes and runs 100 security checks against your app.

2. What the score means

Every scan produces a score from 0 to 100, mapped to a letter grade. The score reflects real hackability, not security hygiene trivia.

3. Understanding finding tiers

Every finding is classified into one of three tiers. This is the core of how VibeArmor differs from generic scanners: we separate what is actually exploitable from what is noise.

GitHub Actions

Add this step to any workflow. It uses only curl and jq — no action marketplace dependencies, no supply chain risk.

name: Security Scan

on:
  push:
    branches: [main]
  pull_request:

jobs:
  vibearmor:
    runs-on: ubuntu-latest
    steps:
      - name: Wait for deployment
        uses: actions/github-script@v7
        with:
          script: |
            // Wait for your preview deploy to be ready
            // Replace with your deployment check logic

      - name: VibeArmor Security Scan
        run: |
          RESULT=$(curl -s -X POST https://vibearmor.ai/api/scan \
            -H "Content-Type: application/json" \
            -d '{"url": "${{ env.DEPLOY_URL }}"}')

          SCORE=$(echo $RESULT | jq -r '.score')
          GRADE=$(echo $RESULT | jq -r '.grade')
          CRITICAL=$(echo $RESULT | jq -r '.criticalCount')

          echo "## Security Scan Results" >> $GITHUB_STEP_SUMMARY
          echo "Score: **$SCORE** (Grade: **$GRADE**)" >> $GITHUB_STEP_SUMMARY
          echo "Critical findings: **$CRITICAL**" >> $GITHUB_STEP_SUMMARY

          if [ "$SCORE" -lt "70" ]; then
            echo "::error::Security score $SCORE is below threshold (70)"
            exit 1
          fi

          echo "Security scan passed with score $SCORE ($GRADE)"

Vercel Deploy Hook

Tips

• Set the threshold to match your risk tolerance. 70 blocks anything below a C. 90 requires an A or better.
• For pull request checks, scan the preview URL (Vercel generates one per PR).
• Scans take 2-3 minutes. Add a timeout of 5m to your CI step to avoid hanging builds.

Claude Code

Add the VibeArmor MCP server to your .mcp.json file:

{
  "mcpServers": {
    "vibearmor": {
      "command": "npx",
      "args": ["-y", "vibearmor-mcp"],
      "env": {
        "VIBEARMOR_API_URL": "https://vibearmor.ai",
        "VIBEARMOR_API_KEY": "your-api-key"
      }
    }
  }
}

Cursor

Open Settings → MCP → Add Server and enter the same configuration as above.

Available tools

Usage example

Once connected, you can ask your AI assistant naturally:

Point deductions by tier and severity

Every scan starts at 100. Points are deducted based on the tier and severity of each failed check. Tier 3 findings are shown but never deduct points.

Score floors

Floors prevent misleadingly low scores when an app has many minor issues but nothing exploitable. They ensure the grade reflects actual hackability.

Calibration reference

We calibrate our scoring against well-known production apps to ensure grades are meaningful.