vibecheck: Instructions file for Codex

AGENTS.md — instructions for AI coding agents

vibecheck is an offline, deterministic, no-AI security/ship-readiness gate for the code you write. Run it as your definition-of-done check before telling the user a task is complete.

When to run

• After implementing or modifying any backend route, auth, database query, cookie/session, CORS, env, or config code.
• Before you say "done", "ready to deploy", or open a PR.

How to run

vibecheck . --ci          # exit code 1 if anything >= high severity, else 0
vibecheck . --json        # structured findings to parse and fix programmatically
vibecheck explain VC-RCE-EVAL   # what a rule means and how to fix it

Or over MCP (stdio): start vibecheck mcp and call the scan tool with { "dir": "." }.

How to act on results

1. Parse --json output: { findings: [{ ruleId, severity, file, line, message, remediation }], counts }.
2. Fix every critical/high finding using the remediation text (or vibecheck explain <ruleId>).
3. Re-run until vibecheck . --ci exits 0.
4. review-severity findings (e.g. VC-ROUTE-NO-AUTH) are possible issues — confirm the route is meant to be public, or add an auth check.

Honesty

vibecheck parses a real AST and runs taint analysis (intra-file inter-procedural for JS/TS); findings are confidence-ranked (high = a user-input source provably reaches the sink). It is a strong, low-false-positive gate for the AI-vibe-coding failure classes — not a proof of security and not a replacement for Semgrep/CodeQL (run those too for breadth). Fix every high-confidence finding; treat review as a prompt to check, not a guaranteed bug. Use .vibecheck.json ignoreRules/allowPaths only for genuine false positives, never to hide an unfixed issue.