mcp-server-vibes-coded

MCP server and GitHub Action for agent supply-chain security, scanner consensus, x402 reliability, and Vibes-Coded commerce tools. Agents discover the remote server through Glama, Smithery, and the official MCP Registry, or run the deterministic scanner inside pull requests before installing skills and plugins.

What it does

Default (v1.0.4+): curated tools only — explicit schemas + annotations for Glama TDQS:

Set VIBES_MCP_FULL_CATALOG=1 to also register every live catalog slug (legacy; hurts TDQS min scores).

• Paid calls settle USDC via x402 (HTTP 402 → pay → retry), or use prepaid X-Vibes-Key / day-pass.

• Human fund UI: https://vibes-coded.com/start ($1 USDC → copy X-Vibes-Key).

• Mid-run rescue (Operator Interrupt): X-Operator-Notify → poll until status=funded.

Related MCP server: gatefareio/mcp-server

GitHub Action — PR-time agent dependency gate

Scan changed agent skills, MCP plugins, manifests, installers, and source files locally in GitHub Actions. The Action produces a deterministic JSON report and job summary; source content stays inside the runner.

name: Agent dependency security
on: [pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v5
      - id: agent-risk
        uses: doteyeso-ops/mcp-server-vibes-coded@v1.6.1
        with:
          scan-path: .
          fail-on: block
          report-path: vibes-skill-risk-report.json
      - run: echo "Verdict ${{ steps.agent-risk.outputs.verdict }}, score ${{ steps.agent-risk.outputs.risk-score }}"

Inputs:

• scan-path — one file or a recursively scanned directory.

• fail-on — none, allow, review, or block (default block).

• report-path — JSON evidence report destination.

Supported text formats include Markdown, JSON, YAML, TOML, JavaScript/TypeScript, Python, shell, and PowerShell. .git, virtual environments, build outputs, and node_modules are excluded. Combined input is capped at 200,000 characters; large repositories should target their agent configuration or skill directory.

Install

Hosted (no install): https://vibes-coded-mcp-production.up.railway.app/mcp Pointer: https://vibes-coded.com/.well-known/mcp.json · Smithery: https://smithery.ai/servers/vibes-coded/vibes-coded-agent-tools

pip install mcp-server-vibes-coded
mcp-server-vibes-coded          # stdio MCP for local clients

There is no npm package. Do not npx @doteyeso-ops/mcp-server-vibes-coded.

Hosted / Docker (Glama, Smithery)

Default (stdio — local clients, MCP Registry OCI, Glama mcp-proxy):

python mcp_server.py
# or: docker run -i --rm ghcr.io/doteyeso-ops/mcp-server-vibes-coded:1.0.5

HTTP mode (Smithery / inspectors):

PORT=3000 MCP_TRANSPORT=streamable-http python mcp_server.py
# health: GET /health  GET /healthz

Glama release steps: see GLAMA_RELEASE.md (Glama generates its own image; use stdio CMD, not HTTP). After push, use Sync Server on the Glama page so TDQS rescores.

Env:

• VIBES_ORIGIN — API base (default production Railway URL that bypasses Cloudflare)

• VIBES_MCP_FULL_CATALOG=1 — register all live catalog tools (off by default)

• MCP_TRANSPORT=streamable-http + PORT — optional HTTP mode for hosted inspectors

• HOST (HTTP mode only)

Payment

This server is a discovery + proxy wrapper. Payments settle on Vibes-Coded via OpenX402 (Solana USDC). Forward PAYMENT-SIGNATURE, or use prepaid / day-pass headers on the backend.

Preferred (no mid-run wallet):

1. Operator opens https://vibes-coded.com/start → pays $1 USDC → pastes X-Vibes-Key into the agent/MCP env

2. Or machine fund: POST /api/v1/outcomes/balance/fund

3. Mid-run without a key: X-Operator-Notify → human funds /start?ois= → poll for key

• Marketplace: https://vibes-coded.com

• Fund agent: https://vibes-coded.com/start

• Agent docs: https://vibes-coded.com/llms.txt

• Catalog: https://vibes-coded.com/api/v1/outcomes/meta

• Official connector (OpenClaw/Hermes): https://doteyeso-ops.github.io/vibes-coded-agent-connector/

• Glama: https://glama.ai/mcp/servers/@doteyeso-ops/mcp-server-vibes-coded

• Smithery: https://smithery.ai/servers/@doteyeso-ops/mcp-server-vibes-coded