Agent Check: your AI agent checks the code it just wrote

How it works

1. Connect VibeDoctor to your coding agent once (see Connect your agent).
2. Your agent writes or edits code as usual.
3. It sends the files it changed to vibedoctor_check.
4. It gets back each issue with its severity, file, line and a suggested fix, then fixes them and checks again.

VibeDoctor asks the agent to run the check after every code change. Agents decide when to call a tool, so if yours skips one, ask it to check the files it changed.

What it checks

• Security patterns: SQL injection, XSS, eval(), unprotected routes, CORS wildcards, insecure cookies and secrets in frontend code.
• Secrets: API keys, passwords, tokens and private keys in the files the agent sends.
• Deep analysis: rules that follow user input into databases, files and the shell.
• Dependencies: when the agent sends package.json or another manifest, packages that do not exist and other dependency problems.

Every answer says what it checked and what it did not. A check looks only at the files the agent sends, so it does not run language linters, look up dependency CVEs or follow auth set up in other files. A full Vibe Check scan of your repository covers those.

Connect your agent

• Claude Code and Codex: run one command and sign in. The connector page has the commands.
• Cursor, VS Code and Windsurf: open MCP Connect in VibeDoctor, copy your project's link and add it to the editor's MCP settings (for Cursor, ~/.cursor/mcp.json).
• Claude and ChatGPT: add VibeDoctor as a connector to ask about your scans and check code in chat.

That is the whole setup. There is no plugin, extension or script to install.

Every push scanned too

Agent Check covers the code your agent writes in a session. On the Watch, Guard and Shield plans, the VibeDoctor GitHub App also runs a full scan on every push to main or master, so a change that skipped the agent's check still gets scanned.

Your code

• VibeDoctor receives only the files your agent sends for a check.
• They are checked in a temporary folder that is deleted when the check ends.
• VibeDoctor never sees your conversation with the agent or files it does not send.

The privacy policy has the details.

Limits

• Free accounts get 50 calls per project per day. vibedoctor_status and vibedoctor_note do not count.
• The count resets at midnight UTC.
• Paid plans have no daily limit.
• During your Free Week, a check returns every issue with its line and fix. After it, a check on the free plan shows how many issues it found, and a paid plan shows each one.

FAQ

Want the long version? Read Claude Code Security Review: What Each Tool Catches (2026).