The Open-Source Verification Stack for AI Coding Agents: Security (92 Rules), Playwright Browser QA, and UI Design Linting

AI coding agents like Claude Code, Cursor, Windsurf, and Cline can scaffold an entire Next.js + Supabase + Tailwind feature in under a minute.

The bottleneck is no longer writing code—it is verifying what the agent actually generated before deploying to production. Passing tsc and npm run build only proves syntax validity. It does not check whether your API routes verify auth sessions, whether your mobile layout overlaps at 375x812, or whether your dark-mode palette fails perceptual contrast math.

We open-sourced three MIT-licensed CLI tools, Agent Skills (SKILL.md), and Model Context Protocol (MCP) servers—now live on the Official MCP Registry (registry.modelcontextprotocol.io)—that give AI coding agents a deterministic verification loop:

1. VibeShield v2.1 — 92-Rule Static Security Scanner

• GitHub: https://github.com/avivgerz-hue/vibe-shield
• Run instantly: npx -y @vibefoundry/vibe-shield@latest scan .
• What it checks:
  • 80 Application Security Rules across 7 vectors: Client Exposure (NEXT_PUBLIC_ secret leaks), Auth & API Routes (unauthenticated Next.js mutation handlers, IDOR patterns, missing webhook verification), Database & Supabase RLS (tables without Row-Level Security, permissive USING (true) policies), AI Sinks (eval, command injection, unsafe dangerouslySetInnerHTML), Infrastructure/Cookies/CORS, Supply Chain dependencies, and Secrets/Crypto.
  • 12 MCP & Agent Skill Poisoning Rules: Audits .cursorrules, SKILL.md, CLAUDE.md, and mcp.json for hidden zero-width Unicode characters, prompt exfiltration instructions, and dangerous wildcard permissions.
  • Outputs: Attack-Surface Map, OWASP Top 10:2025 + CWE mappings, SARIF 2.1.0 for GitHub Code Scanning, HTML/Markdown executive reports, and an agent-ready SECURITY_PATCH_PROMPT.md.

2. GhostQA v2.1 — Autonomous 8-Trap Headless Playwright QA Engine

• GitHub: https://github.com/avivgerz-hue/ghost-qa
• Run instantly: npx -y ghost-qa test http://localhost:3000
• What it checks: Crawls your live web app in headless Chromium across Desktop (1440x900), Tablet (768x1024), and Mobile (375x812) viewports and inspects 8 browser traps:
  1. Runtime Console & Uncaught Page Exceptions
  2. Network 4xx/5xx API Failures & CORS Blocks
  3. Layout Geometry (horizontal overflow, sibling bounding-box collisions, clipped text, and <44x44px mobile touch targets)
  4. Accessibility & Keyboard Tab-Order Traps
  5. Core Web Vitals & DOM Weight
  6. Internal Link & Asset Integrity
  7. SEO & Social Graph Completeness
  8. Dark / Light Theme Parity & Unstyled Flash Detection

3. Unslop v2.1 — 72-Rule UI Design Craft & Contrast Engine

• GitHub: https://github.com/avivgerz-hue/unslop
• Run instantly: npx -y unslop-mcp audit .
• What it checks: Audits CSS, Tailwind, and JSX/TSX across 7 pillars of UI craft:
  • Color & Atmospheric Polarity (real WCAG 2.1 AA/AAA luminance ratios + APCA Lc perceptual contrast math, dark-mode surface elevation, and generic AI gradient detection)
  • Typography & Scannable Hierarchy (clamp() fluid sizing, tabular-nums, line-width measure)
  • Layout & 8pt Spatial Grid Architecture
  • Surface, Borders & Elevation
  • Microcopy & Anti-Cliche Rules
  • Interaction & Motion (:focus-visible, prefers-reduced-motion)
  • Theme & Token Architecture (exports 10 studio archetypes to Tailwind v4 @theme, Tailwind v3, CSS variables, and W3C Design Tokens JSON)

Native Support for 8 AI Coding Agents

Every tool includes an init command (vibe-shield init, ghost-qa init, unslop init) that automatically scaffolds configuration and rules for Claude Code, Cursor, Windsurf, GitHub Copilot, Cline, Roo Code, OpenCode, and Gemini CLI.

All three repositories are MIT-licensed and open-source:

• 🛡️ VibeShield: https://github.com/avivgerz-hue/vibe-shield
• 👻 GhostQA: https://github.com/avivgerz-hue/ghost-qa
• 🎨 Unslop: https://github.com/avivgerz-hue/unslop