> For the complete documentation index, see [llms.txt](https://docs.ox.security/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.ox.security/admin-settings/vibesec-settings.md).

# VibeSec Settings

VibeSec settings control which VibeSec capabilities are available across your organization. You can enable or disable individual modules based on your organization's requirements.

**To configure VibeSec settings:**

* Go to **Settings** > **VibeSec**, and enable or disable the required settings.

### Modules

<table><thead><tr><th width="246.5">Setting</th><th>Description</th></tr></thead><tbody><tr><td><strong>Agent Guidelines</strong></td><td><p>Enables <a href="/pages/cSCS7jivjNZXoFY7uAxM">Agent Guidelines</a> across the organization.</p><p>When enabled, OX analyzes prompts sent to AI coding agents, predicts potential vulnerabilities that may be introduced, and provides relevant security guidelines to help generate secure code.</p><p>Disabling this setting stops developers from receiving Agent Guidelines.</p><p>Default: Enabled.</p></td></tr><tr><td><strong>Inline Code Annotations</strong></td><td><p>Adds an inline comment in generated code whenever a VibeSec guideline is applied.</p><p>This setting is available only when Agent Guidelines are enabled.</p><p>Default: Disabled.</p></td></tr><tr><td><strong>AI Governance</strong></td><td><p>Enables AI Governance capabilities.</p><p>AI Governance provides visibility into AI usage across your organization and allows you to govern approved and restricted AI tools, services, and models.</p><p>Default: Enabled.</p></td></tr><tr><td><strong>MCP Servers</strong></td><td><p>Tracks <a href="/pages/y4H63MFvMH2KXJPKTMjO">MCP servers</a> used by AI agents, controls blocking, and includes them in the AI inventory and governance views.</p><p>Default: Enabled.</p></td></tr><tr><td><strong>Stdio MCP Servers</strong></td><td><p>Blocks the use of stdio-based MCP servers. These servers run locally and may introduce additional security risks.</p><p>OX Security found multiple CVEs where user input was directly passed to MCP Stdio, allowing direct command execution on the machine.</p><p>Disable this setting to allow developers to use stdio-based MCP servers.</p><p>Default: Enabled.</p></td></tr><tr><td><strong>External SaaS</strong></td><td><p>Tracks <a href="/pages/y71QUfra7wwsclITzPM9">external SaaS</a> services accessed by AI agents and includes them in the AI inventory and governance views.</p><p>Default: Enabled.</p></td></tr><tr><td><strong>AI Models</strong></td><td><p>Tracks the <a href="/pages/XSen2bINuI6Wnod433aR">AI models</a> used by agents for reasoning and code generation and includes them in the AI inventory and governance views.</p><p>Default: Enabled.</p></td></tr></tbody></table>

### General

| Setting                   | Description                                                                                                                                                                                                                      |
| ------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **'Secured by OX' Badge** | Displays a Secured by OX indicator in supported AI coding assistants when VibeSec is active. The badge provides visual confirmation that OX protection is running. Disable this setting to hide the indicator. Default: Enabled. |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.ox.security/admin-settings/vibesec-settings.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.