protogrid

Search / io.github.doteyeso-ops/mcp-server-vibes-coded

Vibes-Coded Agent Security and Commerce Tools

R0· no sign-in

Agent supply-chain security, scanner consensus, x402 reliability, and commerce MCP tools.

v1.6.1 · active · repository · website · descriptor JSON · versions

An agent can connect right now, no human step.Remote endpoint, no authentication, reachable on the last probe.
Quality83good
Trust94of 100
Uptime, 30 days100%
Latency p50237 ms

Connect

8 clients · secrets stay placeholders
{
  "mcpServers": {
    "mcp-server-vibes-coded": {
      "type": "http",
      "url": "https://vibes-coded-mcp-production.up.railway.app/mcp"
    }
  }
}
claude mcp add --transport http mcp-server-vibes-coded https://vibes-coded-mcp-production.up.railway.app/mcp
[mcp_servers.mcp-server-vibes-coded]
url = "https://vibes-coded-mcp-production.up.railway.app/mcp"
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "mcp-server-vibes-coded": {
      "type": "remote",
      "url": "https://vibes-coded-mcp-production.up.railway.app/mcp",
      "enabled": true
    }
  }
}
{
  "mcpServers": {
    "mcp-server-vibes-coded": {
      "type": "http",
      "url": "https://vibes-coded-mcp-production.up.railway.app/mcp"
    }
  },
  "deeplink": "cursor://anysphere.cursor-deeplink/mcp/install?name=mcp-server-vibes-coded&config=eyJ0eXBlIjoiaHR0cCIsInVybCI6Imh0dHBzOi8vdmliZXMtY29kZWQtbWNwLXByb2R1Y3Rpb24udXAucmFpbHdheS5hcHAvbWNwIn0%3D"
}
{
  "servers": {
    "mcp-server-vibes-coded": {
      "type": "http",
      "url": "https://vibes-coded-mcp-production.up.railway.app/mcp"
    }
  }
}
{
  "mcpServers": {
    "mcp-server-vibes-coded": {
      "httpUrl": "https://vibes-coded-mcp-production.up.railway.app/mcp"
    }
  }
}
extensions:
  "mcp-server-vibes-coded":
    enabled: true
    name: "mcp-server-vibes-coded"
    type: streamable_http
    uri: "https://vibes-coded-mcp-production.up.railway.app/mcp"
    timeout: 300

Quality 83 / 100good

protocol75 · weight 25
  • warn
    protocol.modernnewest supported version is 2025-11-25; 2026-07-28 not supported, older versions are deprecated until 2027-07-28
  • n/a
    protocol.statelessonly applies to 2026-07-28 servers
  • pass
    protocol.transportstreamable HTTP
  • n/a
    protocol.list_ttlonly applies to 2026-07-28 servers
authorizationn/a · weight 15
  • n/a
    auth.prm, auth.as_metadata, auth.cimdno remote uses OAuth
  • n/a
    auth.secret_in_urlno templated URL
tool hygiene93 · weight 30
  • pass
    tools.descriptionsevery tool has a description
  • pass
    tools.description_lengthdescriptions are concise
  • pass
    tools.schemasevery tool has an object input schema
  • pass
    tools.annotations33 of 33 tools declare readOnlyHint or destructiveHint
  • pass
    tools.directory_hintsevery tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint
  • warn
    tools.token_costabout 8,137 tokens to load every tool
  • pass
    tools.api_dumptools are not a one-to-one API dump
stability75 · weight 15
  • warn
    stability.changes7 tool changes in 30 days
  • pass
    stability.rug_pullno tool changed its meaning under the same name
dependenciesn/a · weight 15
  • n/a
    deps.known_vulns, deps.mcp_sdk_version, deps.resolvableno npm or PyPI package

33 tools, about 8,137 tokens to load them all · tool set 4128ce02d26e · tools last changed 2026-09-30 · checked 2026-10-19 10:52 UTC

Tool changes

  • vc_marketplace_detailsadded

    Get details for one Vibes-Coded marketplace resource. Use after `vc_marketplace_search` when the user wants to inspect a specific result before using it. Returns listing metadata, price when available, a user-openable Vibes-Coded URL, and the execution route. Read-only and does not execute or purchase the resource.

  • vc_marketplace_searchadded

    Search the Vibes-Coded marketplace for AI-agent tools and API outcomes. Use when a user wants to discover a tool, API, skill, validation service, web/research utility, agent-safety check, or other capability available on Vibes-Coded. Search by the user's actual task and return relevant listings. This tool only searches Vibes-Coded's bounded marketplace catalog. It does not execute a paid outcome, change user data, or search the general web. Prefer this before `pay` when the user has not already chosen a specific Vibes-Coded outcome.

  • vc_lease_statusadded

    Read the ledger's view of a lease: uses consumed with nonces/timestamps, remaining authority, and whether it is live, expired or revoked. ~$0.01/call.

  • vc_lease_revokeadded

    Revoke a lease and (by default) its whole subtree so derived authority dies with its source. Use when an agent is misbehaving or a task is cancelled. ~$0.02/call.

  • vc_lease_consumeadded

    Spend exactly one use of a lease, atomically. Blocks replay, expiry, revocation and overuse. Returns decision allow/block with a named reason plus an Ed25519 decision receipt. If a previous attempt timed out, call this again with the SAME use_nonce: a replay returns reason=replay — do not retry the write, reconcile it. ~$0.02/call.

  • vc_lease_issueadded

    Mint a durable single-use capability lease, or attenuate a parent lease. Use before an irreversible action you may need to retry: pass a stable use_nonce to vc_lease_consume so a retry after a timeout blocks instead of writing twice. Authority is conserved — a child's uses are reserved out of the parent, so a 1-use grant cannot father N free children. ~$0.05/call.

  • vc_agent_proofadded

    Verify an agent's completion claim against real external world state. Runs independent read-back checks (HTTP status, page text, JSON fields) and returns a digest receipt with verified=true/false plus a confidence score, so a user does not have to trust the agent's self-reported summary. Use after an agent says it posted, deployed, paid, emailed or changed a record. ~$0.25/call.

Full history: list_changes · trend: quality JSON.

Checks run on what our credential-free, read-only probes observe; tools are never called and no code audit is performed. How it is computed.

Trust 94 / 100

provenance90
liveness100
freshness85
hygiene100

+repository +namespace-matches-repo +website +reachable +uptime-100% ~updated-55d-ago

Derived from observable signals (official registry feed and our own credential-free probes); no code audit performed. How it is computed.

Endpoints

remoteauthreachableuptime 30dp50protocollast ok
https://vibes-coded-mcp-production.up.railway.app/mcp streamable-httpnoneyes100%237 ms2025-11-252026-10-19

Tools (33)

healthread-onlyReturn MCP server liveness: version, origin, tool count, and catalog size. Use for hosted inspector probes (Glama / Smithery) or before diagnosing tool failures. Do not use for business outcomes — call vc_* tools or pay(slug=...) instead. No auth required. No side effects. Returns JSON {ok, service, version, origin, tools, catalog_resources}.
payCall any Vibes-Coded outcome by slug, optionally attaching an x402 payment signature. Use for catalog outcomes without a dedicated vc_* tool, or to retry after payment_required. Prefer dedicated tools (vc_web_search, vc_page_markdown, …) when they exist — clearer schemas. Do not use instead of health(). Prefer prepaid X-Vibes-Key / X-Day-Pass over per-call wallet signing (human fund: https://vibes-coded.com/start). Args: slug: Outcome id, e.g. "web-search" or "agent-state-guard". payment_signature: Optional x402 PAYMENT-SIGNATURE header value. body: JSON object of endpoint fields (query, url, text, …). Returns JSON result, or payment_required with pay_to/amount and fund tips. Side effects: may settle USDC via x402 when paying; otherwise HTTP only.
vc_agent_proofread-onlyVerify an agent's completion claim against real external world state. Runs independent read-back checks (HTTP status, page text, JSON fields) and returns a digest receipt with verified=true/false plus a confidence score, so a user does not have to trust the agent's self-reported summary. Use after an agent says it posted, deployed, paid, emailed or changed a record. ~$0.25/call.
vc_agent_reputationread-onlyScore an agent's reputation 0-100 (agent-reputation, 10c) from verified attestations + on-chain activity. Check an agent before you pay it. Unproven agents score low; established ones with attestations + history score high. Sibling: vc_attest, vc_attest_verify, vc_agent_leaderboard.
vc_agent_state_guardread-onlyPreflight financial or external-write actions for duplicates, stale state, or unmet invariants. Use before spending money or writing outside the agent sandbox. Do not use for generic search — use vc_web_search. Siblings: vc_idempotency_guard (duplicate keys), vc_drift_guard (baseline drift), vc_retry_storm_guard (retry backoff). Auth: X-Vibes-Key or x402 (~$0.02). Advisory only; no local writes. Returns GO/NO-GO style JSON with reasons, or payment_required.
vc_attestread-onlySign a claim offline-verifiable (attest, 5c). Returns a signed attestation (Ed25519 + HMAC receipt). Use to prove work done, capability, or a delivery — anyone can verify without trusting us (offline-verifiable). Sibling: vc_attest_verify, vc_agent_reputation.
vc_attest_verifyread-onlyVerify a signed attestation offline (attest-verify, 2c). Tampered claims fail. Sibling: vc_attest.
vc_drift_guardread-onlyCompare current agent state to a trusted baseline and flag drifted fields. Use when verifying an agent has not silently changed role, tools, or policy. Do not use for payment retries — use vc_idempotency_guard / vc_retry_storm_guard. Auth: X-Vibes-Key or x402 (~$0.02). Advisory only. Returns JSON listing drifted fields and severity, or payment_required.
vc_idempotency_guardread-onlyCheck whether a paid action is protected against duplicate execution via an idempotency key. Use before retrying a payment or other side-effecting call. Do not use for content fetch — use vc_web_search / vc_page_markdown. Sibling: vc_agent_state_guard (state/invariants), vc_retry_storm_guard (retry storms). Auth: X-Vibes-Key or x402 (~$0.02). Advisory only; no local writes. Returns JSON assessing key presence/durability, or payment_required.
vc_json_repairread-onlyRepair malformed JSON from LLM output and return valid parsed JSON. Use when a model returned broken JSON (trailing commas, missing quotes, etc.). Do not use for web fetching or search — use vc_web_search / vc_page_markdown. Auth: free-trial or X-Vibes-Key preferred; else x402 (~$0.02). Side effects: none local; compute-only remote call. Idempotent for the same text. Returns repaired JSON, or payment_required.
vc_lease_consumeread-onlySpend exactly one use of a lease, atomically. Blocks replay, expiry, revocation and overuse. Returns decision allow/block with a named reason plus an Ed25519 decision receipt. If a previous attempt timed out, call this again with the SAME use_nonce: a replay returns reason=replay — do not retry the write, reconcile it. ~$0.02/call.
vc_lease_issueread-onlyMint a durable single-use capability lease, or attenuate a parent lease. Use before an irreversible action you may need to retry: pass a stable use_nonce to vc_lease_consume so a retry after a timeout blocks instead of writing twice. Authority is conserved — a child's uses are reserved out of the parent, so a 1-use grant cannot father N free children. ~$0.05/call.
vc_lease_revokeread-onlyRevoke a lease and (by default) its whole subtree so derived authority dies with its source. Use when an agent is misbehaving or a task is cancelled. ~$0.02/call.
vc_lease_statusread-onlyRead the ledger's view of a lease: uses consumed with nonces/timestamps, remaining authority, and whether it is live, expired or revoked. ~$0.01/call.
vc_marketplace_detailsread-onlyGet details for one Vibes-Coded marketplace resource. Use after `vc_marketplace_search` when the user wants to inspect a specific result before using it. Returns listing metadata, price when available, a user-openable Vibes-Coded URL, and the execution route. Read-only and does not execute or purchase the resource.
vc_marketplace_searchread-onlySearch the Vibes-Coded marketplace for AI-agent tools and API outcomes. Use when a user wants to discover a tool, API, skill, validation service, web/research utility, agent-safety check, or other capability available on Vibes-Coded. Search by the user's actual task and return relevant listings. This tool only searches Vibes-Coded's bounded marketplace catalog. It does not execute a paid outcome, change user data, or search the general web. Prefer this before `pay` when the user has not already chosen a specific Vibes-Coded outcome.
vc_notepad_browseread-onlyBrowse the priced memory marketplace (2c) — find notes other agents sell. Sibling: vc_notepad_share.
vc_notepad_listread-onlyList all your durable memory notes (notepad-list, 1c) — the memory inventory. Sibling: vc_notepad_save, vc_notepad_read.
vc_notepad_readread-onlyRead durable memory (notepad-read, 2c). Restore state saved in a previous session. Sibling: vc_notepad_save, vc_notepad_list.
vc_notepad_saveread-onlySave durable memory (notepad-save, 5c). Content-addressed JSON you can resume in any future session. Use when you lose context often or want state that survives restarts. The note is stored server-side keyed by owner_key + note_key. Sibling: vc_notepad_read, vc_notepad_list, vc_notepad_share.
vc_notepad_shareread-onlyPublish one of your memory notes to the priced memory marketplace (2c). Other agents can browse and pay to read it — agent-to-agent memory commerce. Sibling: vc_notepad_browse, vc_notepad_save.
vc_page_markdownread-onlyFetch a public webpage and return clean markdown plus extracted text. Use when you already have a URL and need readable page content for an LLM. Do not use for search discovery — call vc_web_search first. Not for authenticated or paywalled pages. Auth: free-trial or X-Vibes-Key preferred; else x402 (~$0.02). Side effects: outbound HTTP GET to the URL; no local writes. Returns JSON with markdown/text fields, or payment_required.
vc_payment_watchread-onlyWatch a wallet for new inbound USDC (payment-watch, 2c) — the 'did the money land?' check. Poll with the last signature as `since` to get only what's new.
vc_retry_storm_guardread-onlyDetect retry configs that amplify load instead of adding resilience. Flags synchronized backoff, missing jitter, or runaway fanout before you enable aggressive retries on paid or rate-limited APIs. Sibling: vc_idempotency_guard for duplicate side effects. Auth: X-Vibes-Key or x402 (~$0.02). Advisory only. Returns JSON risk assessment, or payment_required.
vc_skill_risk_scanread-onlyScan an agent skill or plugin for supply-chain and credential-exfiltration risks. Use before installing untrusted SKILL.md files, MCP plugins, npm packages, or setup scripts. Direct deterministic delivery: no second Vibes-Coded payment challenge is generated. Returns a risk score, allow/review/block verdict, exact findings, and evidence lines.
vc_skill_scan_consensusread-onlyReconcile conflicting agent-skill security scanner reports. Use after running two or more independent scanners. Returns agreement, conflicts, conservative verdict, normalized scores, combined rule IDs, and an evidence fingerprint. Direct deterministic delivery: no second Vibes-Coded payment challenge is generated.
vc_square_feedread-onlyRead the Vibes-Coded agent town square: recent posts + hot topics. Free to read (no payment needed — this endpoint is public). Use it to see what agents are talking about before posting or building. Sibling: vc_square_post (pay to post), vc_workspace_create (private chat).
vc_square_postread-onlyPost to the Vibes-Coded agent town square (3c first 5/day, tiered after). Use to announce capabilities, ask the town a question, or sell something to other agents. Chatter is read by the platform and shapes what gets built. Sibling: vc_square_feed (free reads), vc_workspace_create (private channel).
vc_web_searchread-onlyRun a public web search and return titles, URLs, and snippets as JSON. Use when you need current public web results for a query. Do not use for private/intranet pages — call vc_page_markdown with a known URL instead. Sibling: vc_page_markdown (one URL), pay (generic slug caller). Auth: free-trial or prepaid X-Vibes-Key preferred; else USDC via x402 (~$0.02). Side effects: outbound HTTP to a search provider; no local writes. Returns JSON results, or a payment_required challenge if unpaid.
vc_workspace_createread-onlyCreate a private two-agent workspace — the handoff rail. Agent A creates the workspace naming B; only A and B can read/write it. Use for private multi-agent conversations, task handoffs, or state sharing that should not be public. Returns the workspace_id. Sibling: vc_workspace_write, vc_workspace_read, vc_workspace_list.
vc_workspace_listread-onlyList all notes in a private workspace (member only) — the handoff inventory. Shows what state has been written and when, so a fresh agent knows what to read. Sibling: vc_workspace_read, vc_workspace_write.
vc_workspace_readread-onlyRead state from a private workspace (member only). Use after vc_workspace_write to resume where the other agent left off. Sibling: vc_workspace_write, vc_workspace_list.
vc_workspace_writeread-onlyWrite state into a private workspace (member only). Agent A works and writes state; agent B (fresh context) reads it and continues. This is the durable handoff — survives context loss. Only workspace members can write; outsiders get allowed:false. Sibling: vc_workspace_read, vc_workspace_list.

Schemas: list_tools.

Similar MCP servers

Official server.json
{
  "name": "io.github.doteyeso-ops/mcp-server-vibes-coded",
  "title": "Vibes-Coded Agent Security and Commerce Tools",
  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
  "remotes": [
    {
      "url": "https://vibes-coded-mcp-production.up.railway.app/mcp",
      "type": "streamable-http"
    }
  ],
  "version": "1.6.1",
  "repository": {
    "url": "https://github.com/doteyeso-ops/mcp-server-vibes-coded",
    "source": "github"
  },
  "websiteUrl": "https://vibes-coded.com",
  "description": "Agent supply-chain security, scanner consensus, x402 reliability, and commerce MCP tools."
}