Make AI suggestions opt-in via --ai-suggestions flag.

Markdown reports are deterministic by default; OpenAI is only called when explicitly requested.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: slowcoder360

README.md

@@ -40,7 +40,7 @@ VibeSafe helps developers quickly check their projects for common security issue
   Console, JSON (`--output`), or Markdown reports (`--report`).
 
 - 🧠 **AI-Powered Fix Suggestions (Optional)**  
-  Add an OpenAI API key for smart recommendations in Markdown reports.
+  Pass `--ai-suggestions` with `--report` and an OpenAI API key for smart recommendations in Markdown reports.
 
 - 🎯 **Focus on Critical Issues**  
   Use `--high-only` to trim noise.
@@ -79,7 +79,7 @@ vibesafe scan -o scan-results.json
 
 **Generate Markdown Report:**
 
-To generate a Markdown report, use the `-r` or `--report` flag. You can optionally provide a filename. If no filename is given, it defaults to `VIBESAFE-REPORT.md` in the scanned directory.
+To generate a deterministic Markdown report (no LLM calls), use the `-r` or `--report` flag. You can optionally provide a filename. If no filename is given, it defaults to `VIBESAFE-REPORT.md` in the scanned directory.
 
 *With a specific filename:*
 ```bash
@@ -93,28 +93,28 @@ vibesafe scan -r
 vibesafe scan --report 
 ```
 
-*Using a local llm host for report (the llm host must support OpenAI API)
-```bash
- # example with ollama at local host with default ollama port
- vibesafe scan --url http://127.0.0.1:11434 --model gemma3:27b-it-q8_0
-```
-
-if --url flag is not specified the report will be done by OpenAI (you will need an OpenAI API Key, see below)
-
-**Generate AI Report from OpenAI (Requires API Key):**
+**Generate AI Suggestions in Report (Opt-in, Requires API Key):**
 
-To generate fix suggestions in the Markdown report, you need an OpenAI API key.
+AI fix suggestions are **not** included by default. Pass `--ai-suggestions` along with `--report` to enable them.
 
 1.  Create a `.env` file in the root of the directory where you run `vibesafe` (or in the project root if running locally during development).
 2.  Add your key to the `.env` file:
     ```
     OPENAI_API_KEY=sk-YourActualOpenAIKeyHere
     ```
-3.  Run the scan with the report flag:
+3.  Run the scan with both flags:
 ```bash
-vibesafe scan -r ai-report.md
+vibesafe scan -r ai-report.md --ai-suggestions
 ```
 
+*Using a local LLM host (must support OpenAI API):*
+```bash
+# example with ollama at local host with default ollama port
+vibesafe scan -r report.md --ai-suggestions --url http://127.0.0.1:11434 --model gemma3:27b-it-q8_0
+```
+
+If `--url` is not specified, AI suggestions use the OpenAI API.
+
 **Show Only High/Critical Issues:**
 
 ```bash

src/index.ts

@@ -53,6 +53,7 @@ program.command('scan')
   .option('-o, --output <file>', 'Specify JSON output file path (e.g., report.json)')
   .option('-r, --report [file]', 'Specify Markdown report file path (defaults to VIBESAFE-REPORT.md)')
   .option('--high-only', 'Only report high severity issues')
+  .option('--ai-suggestions', 'Include AI-powered fix suggestions in the Markdown report (requires OpenAI API key or compatible LLM host)')
   .option('-m, --model <model>', 'Specify OpenAI model to use for suggestions. If not specified the program will use gpt-4.1-nano', 'gpt-4.1-nano')
   .option('-u, --url <url>', 'Use the specified url (e.g. http://localhost:11434 for ollama or https://api.openai.com for ChatGPT) for ai suggestions. If not specified the program will call OpenAI API', 'https://api.openai.com')
   .action(async (directory, options) => {
@@ -312,7 +313,7 @@ program.command('scan')
             infoSecretFindings: infoSecretFindings
         };
         try {
-            const markdownContent = await generateMarkdownReport(reportData, options.url, options.model);
+            const markdownContent = await generateMarkdownReport(reportData, options.url, options.model, !!options.aiSuggestions);
             fs.writeFileSync(reportPath, markdownContent);
             console.log(chalk.green(`\nMarkdown report generated successfully at ${reportPath}`));
         } catch (error: any) {

src/reporting/markdown.ts

@@ -7,7 +7,6 @@ import { RateLimitFinding } from '../scanners/rateLimiting';
 import { LoggingFinding } from '../scanners/logging';
 import { HttpClientFinding } from '../scanners/httpClient';
 import { GitignoreWarning } from '../utils/fileTraversal';
-import { generateAISuggestions } from './aiSuggestions';
 import path from 'path';
 import ora from 'ora';
 import chalk from 'chalk';
@@ -53,7 +52,7 @@ function getSeverityInfo(severity: FindingSeverity | SecretFinding['severity'] |
  * @param reportData The aggregated findings.
  * @returns A Markdown formatted string.
  */
-export async function generateMarkdownReport(reportData: ReportData, url: string, model: string  = 'gpt-4.1-nano'): Promise<string> {
+export async function generateMarkdownReport(reportData: ReportData, url: string, model: string  = 'gpt-4.1-nano', aiSuggestions: boolean = false): Promise<string> {
     let markdown = `# VibeSafe Security Scan Report ✨🛡️\n\n`;
     markdown += `Generated: ${new Date().toISOString()}\n\n`;
 
@@ -198,19 +197,22 @@ export async function generateMarkdownReport(reportData: ReportData, url: string
         }
     }
 
-    // --- AI Suggestions ---
-    let apiKey = process.env.OPENAI_API_KEY;
-    if (! apiKey){ // ollama dont need an API key but this field can't be none
-        apiKey = 'YOUR_API_KEY_PLACEHOLDER';
-    }
-    const spinner = ora(`Generating AI suggestions (using API from ${url}/v1 with model: ${model})... `).start();
-    try {
-        const aiSuggestions = await generateAISuggestions(reportData, {baseURL: url + '/v1', apiKey: apiKey}, model);
-        spinner.succeed('AI suggestions generated.');
-        markdown += aiSuggestions; // Append the suggestions section
-    } catch (error: any) {
-        spinner.fail('AI suggestion generation failed.');
-        markdown += `\n## AI Suggestions\n\n*Error generating suggestions: ${error.message}*\n`; // Append error message
+    // --- AI Suggestions (opt-in via --ai-suggestions) ---
+    if (aiSuggestions) {
+        const { generateAISuggestions } = await import('./aiSuggestions');
+        let apiKey = process.env.OPENAI_API_KEY;
+        if (!apiKey) { // ollama dont need an API key but this field can't be none
+            apiKey = 'YOUR_API_KEY_PLACEHOLDER';
+        }
+        const spinner = ora(`Generating AI suggestions (using API from ${url}/v1 with model: ${model})... `).start();
+        try {
+            const suggestions = await generateAISuggestions(reportData, { baseURL: url + '/v1', apiKey }, model);
+            spinner.succeed('AI suggestions generated.');
+            markdown += suggestions;
+        } catch (error: any) {
+            spinner.fail('AI suggestion generation failed.');
+            markdown += `\n## AI Suggestions\n\n*Error generating suggestions: ${error.message}*\n`;
+        }
     }
 
     return markdown;