cd /news/ai-tools/3-open-source-checks-before-pushing-… · home › topics › ai-tools › article
[ARTICLE · art-167726] src=dev.to ↗ pub= topic=ai-tools verified=true sentiment=↑ positive

3 open-source checks before pushing AI-generated apps to production (Security, Browser QA & UI DNA)

Developer Aviv Gerz released three MIT-licensed open-source tools for vetting AI-generated apps before production: vibe-shield, a 92-rule static security scanner and MCP guard that flags leaked Supabase service_role keys, unauthenticated Next.js API routes, IDOR bugs and prompt-injection sinks in about a second; ghost-qa, a headless Playwright browser QA agent that checks live apps across eight failure categories including console errors, failed network calls, mobile layout collisions and WCAG accessibility; and unslop, a 72-rule UI design linter and token exporter that enforces ten design archetypes and exports Tailwind, CSS and W3C tokens. All three are listed on the Official MCP Registry and work with Claude Code, Cursor, Windsurf, OpenCode and VS Code.

by read1 min views1 publishedNov 11, 2026

Stop pushing AI-generated apps to production without running these 3 open-source checks first:

🛡️ vibe-shield — 92-rule static security scanner & MCP guard (catches leaked Supabase service_role keys in client code, unauthenticated Next.js API routes, IDOR bugs, prompt injection sinks & SKILL.md poisoning in ~1s):

https://github.com/avivgerz-hue/vibe-shield 👻 ghost-qa — Autonomous headless Playwright browser QA (tests your live app across 8 traps: console errors, failed network calls, mobile layout collisions, <44px touch targets, WCAG accessibility & dark/light mode parity):

https://github.com/avivgerz-hue/ghost-qa 🎨 unslop — 72-rule UI Design DNA linter & token exporter (strips generic AI purple gradients & bad typography, enforces 10 studio design archetypes, and exports Tailwind v4/v3, CSS & W3C tokens):

https://github.com/avivgerz-hue/unslop All 3 are 100% free, MIT-licensed, live on the Official MCP Registry (io.github.avivgerz-hue/*), and work with Claude Code, Cursor, Windsurf, OpenCode & VS Code.

⭐ Star the repos on GitHub to save them for your next build!

source & further reading
dev.to — original article 2026-Humanoid-IKEA-Assembly-Challenge: 35 Motors, Seven Cameras, in FiftyOne How to Give Your AI Agent a Browser Using Cloud Chromium and Playwright How to Rescue a Broken Lovable App: Triage Order and Fix or Rebuild
── more in #ai-tools 4 stories · sorted by recency
── more on @vibe-shield 3 stories trending now
sponsored brought to you by zahid.host 4,200+ EU-deployed projects
reading about agents? ship yours in a single git push.

Run your AI side-project on zahid.host

EU-based hosting, git-push deploys, automatic HTTPS, no cold starts. Free tier with a custom domain — perfect for shipping the agent you just read about.

$git push zahid main
→ Live at https://your-agent.zahid.host ✓
Get free account → Pricing
from €0/mo · no card required
LIVE [news/3-open-source-checks…] indexed:0 read:1min 2026-11-11 · —