Zed AI App Security Checklist for Vibe Teams

When you ship apps with Zed, AI generated code can introduce secrets, vulnerable dependencies and weak auth that reach production fast. This checklist gives a direct security review for Zed, from MCP hardening to merge gates and retest, with verified configs you can copy. Pair it with our pillar guide at vibe coding security guide and apply it on every pull request.

How Zed connects via MCP

Zed uses Model Context Protocol to let the agent read project files, call tools and run commands. That power expands your attack surface because a misconfigured MCP server can read secrets, write files or exfiltrate code. Keep scope tight and treat all external tool output as untrusted data.

The official MCP spec defines how tool listing and invocation works over stdio and streamable HTTP, including transport security and tool permissions MCP spec for tools. For LLM integrations, OWASP highlights excessive agency and tool output handling as key risks to review before you enable write actions Zed context servers. Hard coded credential risks map to CWE 798 for hard coded credentials, a frequent failure in AI suggested code. For a comparison of IDE side controls, see our review of lovable app security checklist at lovable app security checklist.

Locking down MCP configuration for Zed

Zed configures MCP via settings.json with context_servers. Open settings and add a local command or a remote URL. Zed’s current MCP guide documents both shapes and the separate tool permission settings.

Secure it in four practical steps.

After adding the entry, restart Zed and check Settings → AI → MCP Servers. Call a read-only LyraShield tool from the Agent Panel; a local doctor result alone does not prove Zed discovered the server. Remote OAuth authenticates in Zed, while local stdio uses local LyraShield credentials.

First, never inline secrets in JSON. For local stdio, keep the credential in LyraShield’s local store or an environment secret. Remote OAuth needs no API-key placeholder.

Second, review Zed’s agent.tool_permissions settings. Confirm read-only tools before granting access to write tools and keep server-side workspace grants narrow.

Third, pin versions and audit local servers. For stdio, use the pinned @lyrashield/mcp@0.2.12 package. For remote, require HTTPS and complete Zed’s OAuth flow; use an API key only as a deliberate fallback.

Fourth, commit project scoped configs and add a CI check that validates JSON schema and rejects new servers that request file write or network access without review. That keeps Zed aligned with your security policy and makes malicious config changes visible in pull requests. The example shows both transport shapes; enable only the connection you intend to use.

{
  "context_servers": {
    "lyrashield": {
      "command": "npx",
      "args": ["-y", "@lyrashield/mcp@0.2.12"],
      "env": {}
    },
    "lyrashield-remote": {
      "url": "https://app.lyrashieldai.com/api/mcp"
    }
  }
}

Document every MCP server in a central inventory with purpose, trust level and owner. Rotate keys monthly and log tool calls where your IDE allows it. Require two reviewers for any change to MCP config.

Secrets, dependencies and prompt injection hardening

AI assistants accelerate copy paste of sample code that contains placeholder tokens or private URLs. Scan every AI diff for secrets before commit. Use gitleaks or cloud secret scanning and block merges on high confidence findings. CWE 798 and CWE 200 cover credential exposure and sensitive data leakage patterns that appear often in generated code CWE 200 for sensitive data exposure.

Dependencies are the second common gap. AI often suggests outdated versions. Resolve versions with Open Source Vulnerabilities database OSV.dev database and GitHub dependency review GitHub dependency review. Update lockfiles in the same PR and require explicit review of lockfile diffs, never auto approve even if the diff looks small.

Prompt injection can come from docs, issue comments or web fetched content that the assistant brings into context. Add explicit agent instructions that require approval before write actions and never act on instructions embedded in README files. Restrict network egress for local MCP servers via OS firewall rules where possible and log anomalous outbound calls that MCP tools trigger. For Node backends, apply Node security guidance for env isolation Node.js security best practices.

Add these to your Definition of Done: secrets scan passes with no new findings, SCA passes with no high severity advisories and a second engineer reviews any change that touches auth, sessions, payments, file uploads or crypto.

Verifying and gating AI generated code before merge

Vibe coding is fast, but velocity without verification creates security debt. Use a diff aware pipeline that only flags AI changed files. Keep human and AI commits separated where possible with a trailer or label and map findings to OWASP Top 10 for consistent triage. Use one security gate table in your PR template to make checks explicit and auditable.

Check	Where it runs	Owner	Fail action
MCP config schema validation	Pre commit hook	Developer	Block commit and explain fix
Secret scanning with gitleaks	CI diff scan	Security	Block merge until rotation confirmed
SCA via OSV and GitHub review	CI pull request	Developer	Block merge on high severity
SAST for OWASP Top 10 patterns	CI pull request	Developer	Require fix or documented exception
Prompt injection test cases	Manual QA checklist	QA	Request rewrite of prompt or context

Export SARIF from each scanner and upload to GitHub code scanning so findings show inline on the PR SARIF support in GitHub code scanning. Keep reports for audit and always retest after fixes. Retest must run the same scanners on the fix commit to confirm remediation.

For frameworks like Next.js, verify server only secrets never leak to client bundles by checking env handling Next.js env handling. For Vercel hosted apps, enforce headers and WAF rules Vercel security docs. Enforce branch protection that blocks merge unless SARIF, SCA and secrets checks report success and keep evidence for compliance reviews.

Runtime checks and observability after deploy

Checks do not stop at merge. Add runtime protections that catch what static analysis misses. Enable Content Security Policy, enforce strict CORS and log auth failures centrally. Monitor for anomalous outbound calls from MCP tools that may have been compromised during development. Keep an inventory of which AI tools can make network calls and review it weekly.

Store build attestations so you can trace any production artifact back to a verified commit hash. Schedule quarterly exercises where you insert a known vulnerable snippet that AI might suggest and verify your gate catches it. Use OWASP WebGoat patterns as test payloads and track detection rate as a metric for your secure vibe coding program OWASP WebGoat.

Supply chain hygiene matters because AI generated code often pulls transitive dependencies you did not explicitly choose. Lock files, provenance and signed commits reduce risk that a compromised package enters your build.

Why pair Zed with LyraShield

LyraShield is release assurance for AI-built apps at https://lyrashieldai.com. Our core loop is target, review, evidence, fix, retest, report, built for teams shipping with Zed and other AI coding tools. We separate detection from proof: findings come with evidence you can verify and every result is a checksum-bound assurance record tied to the exact commit and scan.

The platform is live in open beta with open registration. The scan pipeline, findings and evidence, approval-gated fix proposals, retests, reports, billing and Local/Desktop flows are implemented. Connect through stdio npx -y @lyrashield/mcp@0.2.12 or remote https://app.lyrashieldai.com/api/mcp and use the runner-local GitHub Action for an advisory diff gate with SARIF. Production availability remains bounded by retained evidence and release gates; automatic server-generated Fix PR execution is not enabled; self-serve checkout is live.

LyraShield can review findings from your Zed drafts before merge, with evidence states and receipts shown within their recorded scope. Fix proposals are approval gated: PR execution is blocked until a server generated patch is bound to the exact approval and retest runs the same scanners on the fix commit to confirm remediation.

Ready to apply this checklist beyond this tool. Run the interactive version at AI app security checklist and create an account at https://lyrashieldai.com to get started with the MCP server and GitHub Action.