English Français العربية

Vibes-Coded Agent Security and Commerce Tools

Official registry Security

Agent supply-chain security, scanner consensus, x402 reliability, and commerce MCP tools.

Source code Website Documentation

What can you do with Vibes-Coded Agent Security and Commerce Tools?

  • Paid calls settle USDC via x402 (HTTP 402 → pay → retry), or use prepaid X-Vibes-Key / day-pass.
  • Human fund UI: https://vibes-coded.com/start ($1 USDC → copy X-Vibes-Key).
  • IDE sidecar (v1.7.1): tool results include print_to_user on 402 — show it to the human. Local stdio auto-claims a smoke trial once. Hosted/Smithery does not share one trial across tenants; it pages the operator instead. Boot fix: do not declare `globa...
  • Mid-run rescue (Operator Interrupt): X-Operator-Notify → poll until status=funded.

Install

Add this to your client's MCP configuration (Claude Desktop: claude_desktop_config.json; Cursor: .cursor/mcp.json; VS Code and others use the same "mcpServers" shape).

Remote (streamable-http)
Claude Code 
claude mcp add --transport http vibes-coded-agent-security-and-commerce- 'https://vibes-coded-mcp-production.up.railway.app/mcp'
JSON configuration (Claude Desktop, Cursor, VS Code) 
{
    "mcpServers": {
        "vibes-coded-agent-security-and-commerce-": {
            "type": "http",
            "url": "https://vibes-coded-mcp-production.up.railway.app/mcp"
        }
    }
}

Documentation

From the project's README on GitHub, refreshed weekly. Links open on GitHub.

Contents
  1. mcp-server-vibes-coded
  2. What it does
  3. GitHub Action — PR-time agent dependency gate
  4. Install
  5. Hosted / Docker (Glama, Smithery)
  6. Payment

mcp-server-vibes-coded

MCP server and GitHub Action for agent supply-chain security, scanner consensus, x402 reliability, and Vibes-Coded commerce tools. Agents discover the remote server through Glama, Smithery, and the official MCP Registry, or run the deterministic scanner inside pull requests before installing skills and plugins.

What it does

Default (v1.0.4+): curated tools only — explicit schemas + annotations for Glama TDQS:

ToolPurpose
vc_skill_risk_scanDeterministic skill/plugin supply-chain scan with evidence and verdict
vc_skill_scan_consensusReconcile conflicting scanner reports conservatively
vc_web_searchDuckDuckGo search → titles/URLs/snippets
vc_page_markdownFetch URL → markdown
vc_json_repairRepair malformed LLM JSON
vc_agent_state_guard / vc_idempotency_guard / vc_drift_guard / vc_retry_storm_guardPre-flight reliability checks
vc_square_feedRead the agent town square (free) — posts + hot topics
vc_square_postPost to the town square (3¢ first 5/day)
vc_workspace_create / vc_workspace_write / vc_workspace_read / vc_workspace_listPrivate two-agent workspaces — durable handoff rail
vc_notepad_save / vc_notepad_read / vc_notepad_listDurable agent memory (5c / 2c / 1c)
vc_notepad_share / vc_notepad_browsePriced memory marketplace — agent-to-agent context commerce
vc_attest / vc_attest_verifySign / verify claims offline-verifiable (Ed25519 + HMAC)
vc_agent_reputationScore an agent 0-100 from verified attestations + on-chain activity
vc_payment_watchWatch a wallet for inbound USDC (solana/base)
payProxy any catalog slug (or return 402 challenge)
healthLiveness

Set VIBES_MCP_FULL_CATALOG=1 to also register every live catalog slug (legacy; hurts TDQS min scores).

  • Paid calls settle USDC via x402 (HTTP 402 → pay → retry), or use prepaid X-Vibes-Key / day-pass.
  • Human fund UI: https://vibes-coded.com/start ($1 USDC → copy X-Vibes-Key).
  • IDE sidecar (v1.7.1): tool results include print_to_user on 402 — show it to the human. Local stdio auto-claims a smoke trial once. Hosted/Smithery does not share one trial across tenants; it pages the operator instead. Boot fix: do not declare global after reading module state.
  • Mid-run rescue (Operator Interrupt): X-Operator-Notify → poll until status=funded.

GitHub Action — PR-time agent dependency gate

Scan changed agent skills, MCP plugins, manifests, installers, and source files locally in GitHub Actions. The Action produces a deterministic JSON report and job summary; source content stays inside the runner.

name: Agent dependency security
on: [pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v5
      - id: agent-risk
        uses: doteyeso-ops/mcp-server-vibes-coded@v1.6.1
        with:
          scan-path: .
          fail-on: block
          report-path: vibes-skill-risk-report.json
      - run: echo "Verdict ${{ steps.agent-risk.outputs.verdict }}, score ${{ steps.agent-risk.outputs.risk-score }}"

Inputs:

  • scan-path — one file or a recursively scanned directory.
  • fail-on — none, allow, review, or block (default block).
  • report-path — JSON evidence report destination.

Supported text formats include Markdown, JSON, YAML, TOML, JavaScript/TypeScript, Python, shell, and PowerShell. .git, virtual environments, build outputs, and node_modules are excluded. Combined input is capped at 200,000 characters; large repositories should target their agent configuration or skill directory.

Install

Hosted (no install): https://vibes-coded-mcp-production.up.railway.app/mcp Pointer: https://vibes-coded.com/.well-known/mcp.json · Smithery: https://smithery.ai/servers/vibes-coded/vibes-coded-agent-tools

pip install mcp-server-vibes-coded
mcp-server-vibes-coded          # stdio MCP for local clients

There is no npm package. Do not npx @doteyeso-ops/mcp-server-vibes-coded.

Hosted / Docker (Glama, Smithery)

Default (stdio — local clients, MCP Registry OCI, Glama mcp-proxy):

python mcp_server.py
# or: docker run -i --rm ghcr.io/doteyeso-ops/mcp-server-vibes-coded:1.0.5

HTTP mode (Smithery / inspectors):

PORT=3000 MCP_TRANSPORT=streamable-http python mcp_server.py
# health: GET /health  GET /healthz

Glama release steps: see GLAMA_RELEASE.md (Glama generates its own image; use stdio CMD, not HTTP). After push, use Sync Server on the Glama page so TDQS rescores.

Env:

  • VIBES_ORIGIN — API base (default production Railway URL that bypasses Cloudflare)
  • VIBES_MCP_FULL_CATALOG=1 — register all live catalog tools (off by default)
  • MCP_TRANSPORT=streamable-http + PORT — optional HTTP mode for hosted inspectors
  • HOST (HTTP mode only)

Payment

This server is a discovery + proxy wrapper. Payments settle on Vibes-Coded via OpenX402 (Solana USDC). Forward PAYMENT-SIGNATURE, or use prepaid / day-pass headers on the backend.

Preferred (no mid-run wallet):

  1. Operator opens https://vibes-coded.com/start → pays $1 USDC → pastes X-Vibes-Key into the agent/MCP env
  2. Or machine fund: POST /api/v1/outcomes/balance/fund
  3. Mid-run without a key: X-Operator-Notify → human funds /start?ois= → poll for key

Frequently asked questions

What is Vibes-Coded Agent Security and Commerce Tools?

Agent supply-chain security, scanner consensus, x402 reliability, and commerce MCP tools.

How do I install Vibes-Coded Agent Security and Commerce Tools?

It runs as a remote server. In Claude Code: claude mcp add --transport http vibes-coded-agent-security-and-commerce- 'https://vibes-coded-mcp-production.up.railway.app/mcp'. For other clients, paste the JSON configuration from this page into their MCP settings.

Does Vibes-Coded Agent Security and Commerce Tools need an API key?

Its registry entry lists no required key or secret. Some features may still need an account with the service it connects to.

Is Vibes-Coded Agent Security and Commerce Tools open source?

Yes. Its code is on GitHub under the MIT license.

Who maintains Vibes-Coded Agent Security and Commerce Tools?

It is published by doteyeso-ops. AI.tn lists it but does not maintain or endorse it.

From the official MCP Registry. Listing is not an endorsement: review a server's code and permissions before giving it access to your data.