The padlock on the code
One slash command and the security review runs where the code is written.
Code-to-cloud insurance.
Flagship
VibeDefend
Learns your project's rules, watches every prompt, lets the agent ship secure code from the start.
AI Agents
Scanners
- AI SASTStatic analysis with reachability
- SCADependencies + license risk
- Secret DetectionCatch leaked tokens before commit
- License ComplianceOpen-source license risk, classified
- AI IaCTerraform · Cloudformation · Ansible · K8s
- Container SecurityImage scanning + runtime context
- AI CI/CDGitHub Actions · GitLab CI · Jenkinsfile · Tekton
- AI-BOMAI Bill of Materials · EU AI Act + NIST AI RMF
Tour · CybeDefend Platform
The whole platform, one screen at a time.
The dashboard behind the agent: findings, fixes, policies and reports, on every repo.
Seen on our socials.
The four spots, in full. Sound on, one click.
The robot that writes the code
Your AI agent wrote it. The security recipe: a fast install, one line of code.
A key in the door
A secret left in the code is a key left in the door. Protect yourself.
The sweep
Errors and warnings flagged on the line, before the pull request, then the recipe.
What the tour covers
Nine stops, nine pages to dig in.
Each stop is a page of its own. Open the one you need.
Cybe AutoFixVerified AI-generated fixes the agent stages before the PR. One-click rollback, regression test included, signed by your bot.Learn moreCybe AnalysisThe autonomous triage engine. Reads your code knowledge graph and ranks every finding by exploitability + business impact.Learn moreBLSA, Business Logic Security AnalysisOur research arm: refund bypass, tenant cross-talk, PII leak, idempotency.Learn moreSecurity policies, codifiedYour business rules become MCP-context the agent reads on every diff. Zero YAML, rules are mined from your repo, not hand-written.Learn moreAudit-ready reportsSARIF export everywhere, executive PDF on demand, per-team dashboards in the EU and US data regions.Learn moreIDE integrationsNative plugins for VS Code, Cursor, Windsurf, JetBrains, Antigravity. MCP server for Claude Code, Gemini CLI, Cline, Continue, Zed.Learn moreCybe Security ChampionChat with an AI security expert that takes action.Learn morePriority ScoreEvery finding gets a 0 to 100 score from CVSS 4.0, EPSS, exploitability and business context, so your team fixes what truly matters first.Learn moreVibeDefendThe security layer inside your AI coding agent. It learns your rules, watches every prompt, and rewrites unsafe code before the PR is even opened.Learn more
How it works,
in detail.
The documentation walks you through setup, configuration and every option.
Read the docsCybeDefend
Introduction
What CybeDefend does, what happens to your code during a scan, and BLSA, the business logic scanner.
Before you sign up.
Is the platform separate from VibeDefend?
Same data, two surfaces. The platform is the dashboard layer where the scanners (SAST, SCA, IaC, container, secrets, CI/CD), the findings graph, the policies and the compliance reports live. VibeDefend is the agent-time layer that injects the same rules into Claude Code, Cursor, Windsurf and any MCP-compatible client. You can use either independently or both together.
How do I install CybeDefend on my repo?
Sign in at eu.cybedefend.com or us.cybedefend.com, OAuth your GitHub / GitLab / Bitbucket / Azure DevOps org, pick a repo, and the first scan starts inside five minutes. No CI step to add, no agent to deploy. The MCP server ships in two regional endpoints (mcp-eu.cybedefend.com/mcp and mcp-us.cybedefend.com/mcp), you only register the one matching your tenant with your AI coding agent.
Where is my code stored when CybeDefend scans it?
Source is fetched, analysed and the results are stored in the region you pick at signup (EU = Paris, US = Iowa). EU and US tenants are isolated; nothing is replicated across regions. Source itself is deleted immediately after analysis, only findings, summaries and graph metadata are persisted.
Can I run CybeDefend self-hosted or air-gapped?
Yes, on the Enterprise plan. We ship a single OCI image, a Helm chart and an air-gapped tarball. Same feature parity as the SaaS, including Cybe AutoFix and the MCP server, you just point your agent at your in-cluster MCP URL instead of the regional mcp-eu.cybedefend.com / mcp-us.cybedefend.com hosts.
What languages, frameworks and IaC platforms are supported?
SAST: TypeScript / JavaScript, Python, Go, Java / Kotlin, C# / .NET, Ruby, Rust, PHP, plus framework-aware rules for Next.js, NestJS, Django, FastAPI, Spring, Rails, Laravel. IaC: Terraform / OpenTofu, Kubernetes, Helm, CloudFormation, Pulumi, Ansible, CDKTF. Container: any OCI image (Alpine, Debian, Ubuntu, RHEL/UBI base layers, npm, PyPI, Maven, Go, Cargo, NuGet, Composer dependencies). CI/CD: GitHub Actions, GitLab CI, Jenkinsfile.
Install VibeDefend in 5 seconds.
One command wires every coding agent on your machine to CybeDefend: your business rules, your compliance frameworks, and guards that block destructive calls before they fire.
Install in 5 secondsNode 18.17+
npx -y @cybedefend/vibedefend@latest installAuto-detects
Claude Code
Cursor
OpenAI Codex
Windsurf
VS Code Copilot