# VibeScale

> Pre-launch checks for AI-built apps: leaked keys, Supabase RLS gaps, browser-exposed env vars.

- name: io.github.Ranqint/vibescale
- version: 1.0.0
- connection class: R0 (autonomous)
- trust: 80/100 flags: no-repository
- quality: 89/100 (new)
- owner: not claimed
- descriptor: https://api.protogrid.dev/v1/servers/io.github.Ranqint%2Fvibescale
- tools: https://api.protogrid.dev/v1/servers/io.github.Ranqint%2Fvibescale/tools

**An agent can connect right now, no human step.** Remote endpoint, no authentication, reachable on the last probe.

## Connection (mcpServers)

```json
{
  "mcpServers": {
    "vibescale": {
      "type": "http",
      "url": "https://vibe.elya-studio.com/mcp"
    }
  }
}
```


## Trust

- hygiene: 80
- liveness: 100
- freshness: 100
- provenance: 45
- drivers: +website +reachable +uptime-100% +updated-2d-ago -no-repository
- Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed.

## Quality 89/100 (new)

### protocol: 75 (weight 25)

- warn `protocol.modern`: newest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
- n/a `protocol.stateless`: only applies to 2026-07-28 servers
- pass `protocol.transport`: streamable HTTP
- n/a `protocol.list_ttl`: only applies to 2026-07-28 servers

### authorization: n/a (weight 15)

- n/a `auth.prm`, `auth.as_metadata`, `auth.cimd`: no remote uses OAuth
- n/a `auth.secret_in_url`: no templated URL

### tool hygiene: 100 (weight 30)

- pass `tools.descriptions`: every tool has a description
- pass `tools.description_length`: descriptions are concise
- pass `tools.schemas`: every tool has an object input schema
- pass `tools.annotations`: 3 of 3 tools declare readOnlyHint or destructiveHint
- pass `tools.directory_hints`: every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
- pass `tools.token_cost`: about 723 tokens to load every tool
- pass `tools.api_dump`: tools are not a one-to-one API dump
- pass `tools.hidden_text`: no hidden text in tool names, descriptions, schemas or annotations

### stability: n/a (weight 15)

- n/a `stability.changes`, `stability.rug_pull`, `stability.new_links`: tool history recorded for 1 of the 7 days needed

### dependencies: n/a (weight 15)

- n/a `deps.known_vulns`, `deps.mcp_sdk_version`, `deps.resolvable`: no npm or PyPI package

- tools: 3, about 723 tokens to load them all
- tool set hash: e86988d29966d4ec5f049efa437c6ff5
- badge: [![protogrid quality](https://protogrid.dev/badge/io.github.Ranqint/vibescale.svg)](https://protogrid.dev/servers/io.github.Ranqint/vibescale)
- Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed.

### Tool changes

_No tool definition changes recorded._

## Remotes

- https://vibe.elya-studio.com/mcp (streamable-http, auth none, reachable true, uptime30d 1)

## Packages

_none_

## Tools (3)

- `check_env_exposure`: Takes environment variable NAMES (never values) and says, for each one, whether the build tool ships it to every visitor (VITE_, NEXT_PUBLIC_, EXPO_PUBLIC_, REACT_APP_, PUBLIC_, GATSBY_, NUXT_PUBLIC_) and whether its name looks like a server secret that must not be there. Use when someone asks whether their .env or API keys are exposed in a Lovable, Bolt, Vite, Next.js or Expo app. Send names only; if a value is included it is dropped and not stored. Explanations are in Hebrew.
- `lint_supabase_rls`: Reads Supabase SQL (migrations or a schema dump) as text and lists tables in exposed schemas without row level security, RLS with no policy, policies that allow everything or read user_metadata, policies without a role, write grants to anon, SECURITY DEFINER functions and views, new tables without a grant, and public storage buckets, each with SQL that fixes it. Use when someone asks whether their Supabase database is locked down, or before launching an app that uses Supabase. The SQL is never executed or stored; policy logic (who should see what) is not judged. Findings are in Hebrew.
- `scan_app_launch_readiness`: Reads one public web app the way a browser does (its HTML, the same-site scripts it loads and any source maps they point to) and reports what any visitor can already see: server secret keys shipped to the browser (Supabase service_role, OpenAI, Anthropic, Stripe, AWS, GitHub, SendGrid, Resend; shown masked), a published source map, no HTTPS, and missing Content-Security-Policy, HSTS or frame protection. Use when someone built an app with Lovable, Base44, Bolt, Cursor, Replit or similar and asks whether it is safe to launch or whether a key leaked. It does not sign in, guess paths or query the app's database. Findings are in Hebrew.