VibeDoctor
Scans AI-generated code and live sites for leaked secrets, bad imports and slow pages
VibeDoctor scans both your repo and your deployed site with 149+ automated checks — committed API keys, hallucinated package imports, open CORS, missing rate limits, unoptimized images — and returns a ranked report in under two minutes. It connects as an MCP server to Claude Code, Cursor, Codex, Windsurf or Cline, so the same agent that wrote the code can act on the file-and-line findings. Across 1,099 repos scanned by July 2026, 35% had committed secrets and 4% imported a package that doesn't exist.
What holds up
- +Scans both the repo and the live deployed site, not just static code
- +Findings come with exact file and line numbers the agent can act on directly
- +Free scan finishes in under 2 minutes, public or private repo
Mind the limits
- −Findings are only as good as its 149 checks — it can't catch issues outside that list
- −Scan results appear in a public live feed by default unless you choose to scan anonymously
Picked here? Add the badge
Put it on your site. It links back to this page. Free for every listed product.
<a href="https://stillworks.dev/products/p/vibedoctor/"><img src="https://stillworks.dev/badge/vibedoctor.svg" alt="Picked by StillWorks" width="230" height="54"></a>