The security brain for AI agents

Your agents follow your rules. And you can prove it.

npx -y @cybedefend/vibedefend@latest install

5/5 on Book a demo

Fixed in the same session

The brain knows your company.

A guard knows what is dangerous everywhere.

What a scanner, a guard and the security brain each know
QuestionA scannerA guardThe brain
What it knowsKnown flawsWhat is dangerous anywhereYour system and your rules
When it actsOnce the code is writtenWhen the agent actsBefore every edit and action
What you keepAlerts to sortA log of blocksEvery rule served and action refused

Where do you start?

  1. It knows your system.

    A map of your code, so it knows what an agent is touching before it writes a line.

    Cursorbilling/refund.ts

    1. POST /refunds

      Calls it

    2. approvals.second(order)

      Inside it

    3. payments.refund(order)

      Runs after it

    Known before the agent writes a line

  2. It holds your rules.

    The rules your seniors repeat in review, mined from your code with their evidence and approved by your team.

    Every query is scoped to the tenant.

    rules/data-access.md
    await db.invoices.find({ id, tenant: req.tenant })

    Scoped to the tenant, at the line

  3. It decides at the moment of action.

    Outside the agent's reach, it picks the rules that apply and refuses a DROP TABLE before it runs.

    Cursor wants to run

    DROP TABLE invoices;

    1. Read
    2. Checked against your guards
    3. Refused
    4. Run

    Stopped before it ran.

  4. It learns.

    When the code changes or a rule is missing, it proposes one. A person approves it, every agent follows.

    • billing/refund.ts:41approvals.second(order);refund(
    • billing/credits.ts:88approvals.second(credit);refund(
    • support/goodwill.ts:23approvals.second(ticket);refund(
    • admin/override.ts:57approvals.second(order);refund(
    • jobs/chargebacks.ts:132approvals.second(dispute);refund(

    Refunds above €500 need a second approver.

    Proposed from 5 places in your codeApproved once by Sofia M.
    • Claude Code
    • Cursor
    • OpenAI Codex
    • GitHub Copilot
    • Devin Desktop
    • Google Antigravity

  5. It remembers.

    Every rule served and every action refused, on the record, for whoever has to prove it.

    Cursor

    1. src/billing/cart-checkout.ts

      3 rules served

    2. DROP TABLE invoices;

      Blocked

    3. CWE-89, src/db/users.repo.ts:42

      Finding fixed

    Traced to Sofia M., in the Brain

What it saves, on your numbers.

Three calculators, one per offer. Every assumption on the page is yours to change.

Everything your agents do, on one map.

Day 1: rules, guards and scans, live from the first session.

Day 30: every rule served and every action blocked, ready for your audit.

A demo organisation: its names, people and figures are fictitious.
See the map fill up

They ship with it every day.

  • Vulnerability analysis and remediation have become significantly faster. We save valuable time every day.
    OlivierTech Lead, Koddex
  • It secures our projects by detecting and fixing vulnerabilities in code and dependencies, with seamless integration.
    GeoffreyCTO, Diag n'Grow
  • We tried the same approach with other AIs and never got results this convincing.
    Alexandre LignonCEO, Twenty One Nexus

With the support of

  • Bpifrance
  • French Tech
  • Google for Startups
  • EuraTechnologies
  • CRIStAL
  • CNRS
  • Scaleway

Every agent. One brain.

Developers first, because their agents act the most. Then everyone else who works with one.

npx -y @cybedefend/vibedefend@latest install

  • Claude Code
  • Cursor
  • Devin Desktop
  • GitHub Copilot
  • OpenAI Codex
  • Google Antigravity
Install freeBook a demo

In detail

How it works, step by step

  • Wired.

    One command on each developer's machine wires Claude Code, Cursor, Devin Desktop, GitHub Copilot, OpenAI Codex and Google Antigravity to the same rules and checks, with guards in Claude Code, Cursor, Codex and Antigravity. Nothing to build in your pipeline, nothing to configure agent by agent.

  • Served.

    Your business rules and security rules reach the agent at the line it edits.

  • Guarded.

    Destructive commands and secret reads are refused before they run.

  • Checked.

    Every change is scanned before the commit, with its fix.

  • Proved.

    After the commit, BLSA (Business Logic Security Analysis, built with the CNRS and the CRIStAL laboratory) checks the business logic of the change, and its proof mode shows why each verdict holds or breaks: the rule, the path through the code, the line. BLSA is open to design partners today.

  • Learned.

    New rules are proposed from your code; a person approves them once, every agent follows them.

One developer's day, as the team sees it

Per developer, not per repository: the rules each agent was served, and what it was stopped from doing.

  • Served 3 rules on src/api/refunds.tsServed
  • Tried rm -rf ./migrationsBlocked
  • Tried to read .env, used the managed referenceBlocked
  • Diff checked before the commit, one finding fixedFixed
  • Proposed a rule: refunds above €500 need a second approverWaiting for approval

Demo data. The person and the events are fictitious.

Why a rules file is not enough

A rules file does not fix it. The rule was in the file, word for word, and the agent broke it anyway.

A rules file against VibeDefend

What people ask first.

What is CybeDefend?
CybeDefend is the security brain for AI agents. It knows your system through a map of your code, holds your business and security rules, and decides at the moment each agent acts which rules apply and which actions are refused. It keeps the record of every rule served and every action refused. VibeDefend, its agent layer, works inside Claude Code, Cursor, Devin Desktop, GitHub Copilot, OpenAI Codex and Google Antigravity.
How is it different from a code scanner?
A scanner reads code after it is written and sends alerts to people. CybeDefend works while the agent writes: it hands the agent your rules before the edit, stops what must never run, and gives the agent one finding it can fix in the same session. The scan is still there, on the change, before the commit.
Is it an AI model?
No. The brain sits above your agents, not inside a model. It knows your code, holds your rules and picks the ones that apply to what an agent is doing. Blocking is deterministic: a rule decides, and a model is only a second opinion.
Do I replace my scanner or my guard?
No, keep them. A scanner reads code once it is written, a guard knows what is dangerous for any company. The brain adds what neither of them knows, your system and your own rules, at the moment each agent acts. Every change is still scanned before the commit.
Does it cover people who don't code?
Yes, through the agents they use. Developers come first because their agents act the most. When someone else uses Claude Code, Cursor or Codex to write an email, drive a browser or call an API, each of those actions is a tool call, and the brain checks it like any other.
How do I install it?
Run one command in any terminal, on macOS, Linux or Windows, with Node 18.17 or later. The installer finds the coding agents on your machine and wires each of them; you choose your region, EU or US, and sign in once in your browser.
How do I know it works on my code?
Install it on one repository and read the Brain: every rule served, every action refused and every finding fixed is on record, with the agent and the developer behind it. For a team, we run a pilot on your repositories first, then set a price with you.
My agent already checks its own code. Why add CybeDefend?
Each agent checks its own work, with its own settings. CybeDefend gives all six agents the same rules, your business rules included, served before the edit rather than reviewed after it, and keeps one record of what each agent was served, what was blocked and what was fixed.