[ // AI AGENT & CLI BRIEF — curl -fsSL https://studio2201.com/install.sh | sh -s snip ]

Snip vibe-code security gate (`v0.2.11`). Audits staged diffs (`git diff --staged | snip audit`) and runs as a stdio MCP server (`snip serve --mcp`) in <5ms · Agent & MCP Guide · Canary Testbed.

studio2201 / product 02 v0.2.11 Apache-2.0 Vibe-Safe SHIP

Snip

Vibe-code security gate. Real-time pre-deploy audit for AI-generated code diffs, catching leaked credentials, broken RLS, and missing security headers at the moment of generation.

View on GitHub → Framework Doctrine →

What it does & Delivery Channels

Secret & Key Pattern Detection

Flags hardcoded API keys and token shapes for Stripe, OpenAI, Anthropic, AWS, and GitHub before commits are staged.

Supabase & DB RLS Audit

Detects missing or flawed Row Level Security (RLS) policies that inadvertently expose database tables to anonymous callers.

Web Security Headers & CORS

Verifies Content Security Policy (CSP), CORS configurations, and unauthenticated public API routes in seconds.

MCP Server, CLI & PR Gate

Runs via snip serve --mcp inside Cursor/Claude/Windsurf, local pre-commit hook (git diff | snip), and GitHub Action.

GitHub Actions & CI Enforcement

Block leaked API keys, missing RLS, and permissive CORS in pull request diffs before code merges.

# .github/workflows/snip.yml (Prompt your AI Agent or copy directly)
name: snip
on:
  push: { branches: [ master, main ] }
  pull_request: { branches: [ master, main ] }
  workflow_dispatch:
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
permissions: { contents: read }
jobs:
  snip:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - uses: studio2201/studio2201@v1
        with: { tools: 'snip', fail-on: 'block' }
      - uses: actions/upload-artifact@v4
        if: always()
        with: { name: snip-report, path: snip_report.md, if-no-files-found: ignore }

# Workstation CLI & MCP installation (installs to ~/.local/bin):
curl -fsSL https://studio2201.com/install.sh | sh -s snip
git diff --staged | snip audit && snip serve --mcp

Why This Matters & Authoritative Mandates

Automated compliance with Executive Order 14028 §4 (Credential Defense). AI code generation leaks credentials at twice the human baseline; Snip inspects diff additions in <5 ms.

EO 14028 §4 Credential Defense ↗

White House executive order mandating automated controls and continuous scanning to eliminate hardcoded credentials across source code.

OWASP Top 10 for LLMs ↗

Directly mitigates LLM02 (Sensitive Information Disclosure) and LLM06 (Excessive Agency / Unchecked Code Output).

Supabase RLS Guide ↗

PostgreSQL tables without RLS are exposed to public anon callers. Snip flags newly created tables missing security policies.

Model Context Protocol ↗

Anthropic's open standard for agent tooling, allowing Snip to run natively inside Cursor, Windsurf, and Claude Desktop.

How It Works Under the Hood

Diff Addition Lexer

Evaluates only lines beginning with + to eliminate false positives in unchanged code and removed lines.

High-Confidence Heuristics

Detects high-entropy token shapes (e.g. sk-ant-*, sk_live_*, AKIA*) and SQL ENABLE ROW LEVEL SECURITY.

Sub-Millisecond Execution

Zero external crates. Scans large 10,000-line diffs in <5 ms locally on developer laptops before commits stage.

Native stdio MCP Transport

Implements JSON-RPC 2.0 framing over standard I/O for instant integration into AI developer editors.