This release adds 3 notable features for engineering teams evaluating rollout.
✓ No known CVEs patched in this version
Topics
+14 more
Affected surfaces
Summary
AI summaryNew MCP tool secure_prompt analyzes coding prompts and returns deterministic enhancement directives.
Changes in this release
| Type | Severity | Summary | CVE |
|---|---|---|---|
| Feature | Low |
Adds new MCP tool `secure_prompt` for pre‑code prompt analysis. Adds new MCP tool `secure_prompt` for pre‑code prompt analysis. Source: llm_adapter@2026-06-11 Confidence: high |
— |
| Feature | Low |
`secure_prompt` returns triage verdict (NO_MOD, LIGHT_MOD, HEAVY_MOD) and security requirements with rule-id tags. `secure_prompt` returns triage verdict (NO_MOD, LIGHT_MOD, HEAVY_MOD) and security requirements with rule-id tags. Source: granite4.1:30b@2026-06-11-audit Confidence: low |
— |
| Feature | Low |
Rule matching pulls only code-level rules, dedupes guidance, caps at top 8 by severity. Rule matching pulls only code-level rules, dedupes guidance, caps at top 8 by severity. Source: granite4.1:30b@2026-06-11-audit Confidence: low |
— |
| Feature | Low |
Optional `context` input enriches stack info but cannot escalate non-security prompts. Optional `context` input enriches stack info but cannot escalate non-security prompts. Source: granite4.1:30b@2026-06-11-audit Confidence: low |
— |
| Refactor | Medium |
Re-synced runtime server description and Gemini extension manifest with actual rule/tool counts. Re-synced runtime server description and Gemini extension manifest with actual rule/tool counts. Source: granite4.1:30b@2026-06-11-audit Confidence: low |
— |
Full changelog
- New MCP tool
secure_prompt(tool 38): analyzes a coding prompt BEFORE code is written and returns a deterministic enhancement directive — triage verdict (NO_MOD passes well-specified secure prompts through untouched / LIGHT_MOD injects missing security constraints / HEAVY_MOD also surfaces clarifying questions), detected stack + attack surfaces, and severity-ranked security requirements with rule-id tags. No LLM calls, no network — same prompt = same directive. - Rule matching pulls code-level rules only (version-pin/manifest advisories excluded by language), dedupes near-identical guidance, caps at the top 8 by severity; the optional
contextinput enriches stack info but can never escalate a non-security prompt. - Runtime server description and the Gemini extension manifest re-synced with the real rule/tool counts and now enforced by the consistency test suite.
Weekly OSS security release digest.
The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.
No spam, unsubscribe anytime.
Share this release
About goklab/guardvibe
Security MCP for vibe coding with 330 rules and 29 tools. Purpose-built for AI-generated code — scans Next.js, Supabase, Clerk, Stripe, Prisma, Hono, GraphQL, and 25+ modules. Cross-file taint analysis, host security audit, auto-fix, SARIF export, pre-commit hook, and CVE version detection. Zero config, runs locally.
Related context
Related tools
Beta — feedback welcome: [email protected]