Guardrails for Devin Desktop, built from your own rules.

Your company's rules reach Devin Desktop, formerly Windsurf, before every file write. A write that breaks them never lands.

npx -y @cybedefend/vibedefend@latest install

Create a free accountAny recent version of Devin DesktopRead the docs

Devin Desktop is writingbilling/refund.ts

export async function refund(req: Request) {
  const { id, amount } = await req.json();
  const invoice = await db.invoices.find({
    id, tenant: req.tenant,
  });
  if (amount > 500)
    await approvals.second(invoice);
  return payments.refund(invoice, amount);
}

Every query is scoped to the tenant.

rules/data-access.md

Refunds above €500 need a second approver.

Approved once by Sofia M.

Checked before the commit: clean

Set up in four steps.

  1. Run one commandIn any terminal, on macOS, Linux or Windows. Node 18.17 or later.
  2. Choose your region, sign inEU or US. Your browser opens to sign in, no key to paste.
  3. Tick Devin DesktopThe installer finds the agents on your machine and ticks them for you.
  4. Code as usualOpen Devin Desktop: VibeDefend runs alongside it.

Check it any time: vibedefend status

What VibeDefend adds to Devin Desktop.

Rules served

Writes only

File writes only: pre_write_code is the moment the Windsurf hooks expose.

Devin Desktop is writingsrc/billing/cart-checkout.ts

const total = new Decimal128(cart.sum);
const rows = await db.query(
  "SELECT * FROM carts WHERE id = $1", [id]
);

Monetary amounts use Decimal128, never Number.

Mined from src/billing.ts:14

Parameterise every query that mixes user input.

OWASP Top 10

Served before the edit

Secret guard

Raw secret reads are refused; Devin Desktop gets the managed reference instead.

Devin Desktopwebhooks.ts

  1. cat .env | grep STRIPE

    Blocked: raw secret read

  2. Insteadprocess.env.STRIPE_WEBHOOK_SECRET

  3. npm test -- webhooks

    Tests pass

Logged for the team

Action guard

Destructive commands, schema drops and protected paths are stopped before they run.

Devin Desktop

  1. rm -rf dist/

    Allowed: build output

  2. rm -rf .cache/

    Allowed: cache

  3. rm -rf ./storage/uploads

    Blocked: protected path, user uploads

Logged for the team

Live findings

SAST, SCA, secrets, IaC and CI/CD findings, live in the session.

Devin Desktop

  1. SASTsrc/db/users.repo.ts:42

    SQL injection

  2. SCApackage.json

    lodash 4.17.20, CVE-2021-23337

  3. Secretsconfig/prod.yml

    AWS access key

  4. IaCinfra/main.tf

    S3 bucket public-read

  5. CI/CD.github/workflows/deploy.yml

    pull_request_target

In the agent's context, live

Limits in Devin Desktop

  • MCP tools and web fetchesThe Windsurf hooks have none for them: a .windsurfrules snippet asks the agent to check them first.Through .windsurfrules

Your questions.

Does VibeDefend change my Devin Desktop configuration?
It adds its hooks and registers the cybedefend MCP server, in ~/.codeium/windsurf/hooks.json, ~/.codeium/windsurf/mcp_config.json, .windsurfrules. Your own hooks stay: re-running the installer only replaces VibeDefend's entries.
What leaves my machine?
The analysis runs in the region you chose at install, EU or US. The decision to block an action is made on your machine. Before an edit, the hook sends the part of the file being written, to find the rules that apply. The session review sends the files the session changed. Both are analysed in transit: we keep none of your code, only the trail of the rules served and the actions refused. Your sign-in token stays in your OS keychain.
Which version of Devin Desktop do I need?
A recent version of Devin Desktop, and Node 18.17 or later. The installer runs on macOS, Linux and Windows.
Do I need to link each repository?
Not for projects imported from GitHub or GitLab: VibeDefend reads the repo's origin and finds the project. For any other repo, run vibedefend link once. It writes .cybedefend/config.json with the project ID.
How do I remove it?
Run vibedefend uninstall: it removes every file VibeDefend installed. If you installed the package globally, then run npm uninstall -g @cybedefend/vibedefend.
Where do Action Guards stop in Devin Desktop?
The Windsurf hooks pre_write_code, pre_read_code and pre_run_command let VibeDefend hard-block file writes, file reads and shell commands. These hooks have no event for web fetches and do not gate MCP tool calls: for those, VibeDefend adds a snippet to .windsurfrules that asks the agent to call cybe_guards_check through MCP first. It holds when the model follows its rules file.
Technical details for Devin Desktop
MCP server
Available~/.codeium/windsurf/mcp_config.json
Rules before each edit
Writes onlypre_write_codeFile writes only: pre_write_code is the moment the Windsurf hooks expose.
Dangerous actions blocked
Writes, reads, shellpre_write_codepre_read_codepre_run_commandFile writes, file reads and shell commands are hard-blocked. For MCP tools and web fetches, a .windsurfrules snippet asks the agent to call cybe_guards_check first: it holds when the model follows its rules file.
Rules loaded at start
On each promptpre_user_promptThe Windsurf hooks have no session-start event. VibeDefend uses pre_user_prompt, which fires on every turn; the check is cheap and returns at once when nothing is pending.
End-of-session review
Availablepost_cascade_responseRuns at the end of each response, once the edit threshold is crossed.
Review of long sessions
Not availableNo equivalentThe Windsurf hooks have no event before compaction.
Reminder on every prompt
Not availableNo equivalentNot available in Devin Desktop.

What it writes for Devin Desktop

  • ~/.codeium/windsurf/hooks.json
  • ~/.codeium/windsurf/mcp_config.json
  • .windsurfrules

And the hook runner in ~/.cybedefend/. Your own hooks stay: re-running the installer only replaces VibeDefend's entries.

Run the installer from your repository root: the .windsurfrules snippet is written in the folder you run it from.

The Windsurf hooks expose fewer moments than the other agents. File writes, file reads and shell commands are hard-blocked; MCP tools and web fetches rely on the agent following .windsurfrules.

Something off? vibedefend status gives a read-only report, and vibedefend doctor repairs what it can.