protogrid
Sign inAdd to your agent

Search / io.github.Ranqint/vibescale

VibeScale

R0· no sign-in

Pre-launch checks for AI-built apps: leaked keys, Supabase RLS gaps, browser-exposed env vars.

v1.0.0 · active · website · descriptor JSON · versions

An agent can connect right now, no human step.Remote endpoint, no authentication, reachable on the last probe.
Quality89new
Trust80of 100
Uptime, 30 days100%
Latency p50215 ms

Connect

8 clients · secrets stay placeholders
{
  "mcpServers": {
    "vibescale": {
      "type": "http",
      "url": "https://vibe.elya-studio.com/mcp"
    }
  }
}
claude mcp add --transport http vibescale https://vibe.elya-studio.com/mcp
[mcp_servers.vibescale]
url = "https://vibe.elya-studio.com/mcp"

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "vibescale": {
      "type": "remote",
      "url": "https://vibe.elya-studio.com/mcp",
      "enabled": true
    }
  }
}
{
  "mcpServers": {
    "vibescale": {
      "type": "http",
      "url": "https://vibe.elya-studio.com/mcp"
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=vibescale&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vdmliZS5lbHlhLXN0dWRpby5jb20vbWNwIn0%3D"
}
{
  "servers": {
    "vibescale": {
      "type": "http",
      "url": "https://vibe.elya-studio.com/mcp"
    }
  }
}
{
  "mcpServers": {
    "vibescale": {
      "httpUrl": "https://vibe.elya-studio.com/mcp"
    }
  }
}
extensions:
  "vibescale":
    enabled: true
    name: "vibescale"
    type: streamable_http
    uri: "https://vibe.elya-studio.com/mcp"
    timeout: 300

Quality 89 / 100new

protocol75 · weight 25
  • warn
    protocol.modernnewest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
  • n/a
    protocol.statelessonly applies to 2026-07-28 servers
  • pass
    protocol.transportstreamable HTTP
  • n/a
    protocol.list_ttlonly applies to 2026-07-28 servers
authorizationn/a · weight 15
  • n/a
    auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
  • n/a
    auth.secret_in_urlno templated URL
tool hygiene100 · weight 30
  • pass
    tools.descriptionsevery tool has a description
  • pass
    tools.description_lengthdescriptions are concise
  • pass
    tools.schemasevery tool has an object input schema
  • pass
    tools.annotations3 of 3 tools declare readOnlyHint or destructiveHint
  • pass
    tools.directory_hintsevery tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
  • pass
    tools.token_costabout 723 tokens to load every tool
  • pass
    tools.api_dumptools are not a one-to-one API dump
  • pass
    tools.hidden_textno hidden text in tool names, descriptions, schemas or annotations
stabilityn/a · weight 15
  • n/a
    stability.changes, stability.rug_pull, stability.new_linkstool history recorded for 1 of the 7 days needed
dependenciesn/a · weight 15
  • n/a
    deps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI package

3 tools, about 723 tokens to load them all · tool set e86988d29966 · checked 2026-11-14 07:36 UTC

Tool changes

No tool definition changes recorded. A server's first observation is its baseline; later probes record what changes.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 80 / 100

no-repository
provenance45
liveness100
freshness100
hygiene80

+website +reachable +uptime-100% +updated-2d-ago -no-repository

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Endpoints

remoteauthreachableuptime 30dp50protocollast ok
https://vibe.elya-studio.com/mcp streamable-httpnoneyes100%215 ms2025-11-252026-11-14

Tools (3)

check_env_exposureread-onlyTakes environment variable NAMES (never values) and says, for each one, whether the build tool ships it to every visitor (VITE_, NEXT_PUBLIC_, EXPO_PUBLIC_, REACT_APP_, PUBLIC_, GATSBY_, NUXT_PUBLIC_) and whether its name looks like a server secret that must not be there. Use when someone asks whether their .env or API keys are exposed in a Lovable, Bolt, Vite, Next.js or Expo app. Send names only; if a value is included it is dropped and not stored. Explanations are in Hebrew.
lint_supabase_rlsread-onlyReads Supabase SQL (migrations or a schema dump) as text and lists tables in exposed schemas without row level security, RLS with no policy, policies that allow everything or read user_metadata, policies without a role, write grants to anon, SECURITY DEFINER functions and views, new tables without a grant, and public storage buckets, each with SQL that fixes it. Use when someone asks whether their Supabase database is locked down, or before launching an app that uses Supabase. The SQL is never executed or stored; policy logic (who should see what) is not judged. Findings are in Hebrew.
scan_app_launch_readinessread-onlyReads one public web app the way a browser does (its HTML, the same-site scripts it loads and any source maps they point to) and reports what any visitor can already see: server secret keys shipped to the browser (Supabase service_role, OpenAI, Anthropic, Stripe, AWS, GitHub, SendGrid, Resend; shown masked), a published source map, no HTTPS, and missing Content-Security-Policy, HSTS or frame protection. Use when someone built an app with Lovable, Base44, Bolt, Cursor, Replit or similar and asks whether it is safe to launch or whether a key leaked. It does not sign in, guess paths or query the app's database. Findings are in Hebrew.

Schemas: list_tools.

Similar MCP servers

  • vibescanR0quality 80
    net.bigfloppy.vibescan/vibescan

    Free security scan for AI-written GitHub repos: leaked keys, .env, eval, SQLi, CORS.

  • VibeRavenR0quality 89
    io.github.ohad6k/viberaven-guides

    Check Supabase migrations for RLS and grant gaps; fixes for Supabase, Vercel, Stripe errors.

  • vibe-shield — security scanner for AI-generated codeL0
    io.github.avivgerz-hue/vibe-shield

    Scans AI-written code for leaked secrets, unguarded routes and missing RLS.

  • viberavenL0
    io.github.ohad6k/viberaven

    Checks a Vercel + Supabase repo before deploy: RLS, grants, leaked keys, webhooks. Runs locally.

  • PatchLabsR0quality 75
    dev.patchlabs/patchlabs

    Security checks for AI-built apps (Lovable, Supabase, Bolt): RLS, headers, monitoring, fixes.

  • Vibe SpringsR0quality 80
    net.vibesprings/x402-tools

    Pay-per-use weather, environment, finance, and on-chain intelligence tools for AI agents via x402.

More from io.github.Ranqint

  • Atelier Studio Website ToolsR0quality 89
    io.github.Ranqint/atelier-tools

    Plan and score the website of an architecture or interior design studio.

  • Bamboo ConnectR0quality 89
    io.github.Ranqint/bamboo-connect

    Ways to meet new people and find communities in Israeli cities, from published guides (Hebrew).

  • Elya StudioR0quality 89
    io.github.Ranqint/elya-studio

    Size a first product version (MVP) and check what a development quote should state.

  • FutureSelf Vision Board PlannerR0quality 89
    io.github.Ranqint/futureself

    Plan a vision board: ideas for a goal, a board plan from your goals, affirmations.

  • Hero of YouR0quality 89
    io.github.Ranqint/hero-of-you

    Find a personalized illustrated children's book by age, interests and occasion.

  • SpottedR0quality 89
    io.github.Ranqint/spotted

    Check if AI crawlers can read a site, and the questions customers ask AI about a business.

Official server.json
{
  "name": "io.github.Ranqint/vibescale",
  "title": "VibeScale",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://vibe.elya-studio.com/mcp",
      "type": "streamable-http"
    }
  ],
  "version": "1.0.0",
  "websiteUrl": "https://vibe.elya-studio.com/tools/chatgpt-claude",
  "description": "Pre-launch checks for AI-built apps: leaked keys, Supabase RLS gaps, browser-exposed env vars."
}