Vibes Coded Agent Security And Commerce Tools

io.github.doteyeso-ops

Agent supply-chain security, scanner consensus, x402 reliability, and commerce MCP tools.

Add to Cursor Add in Claude Add to VS Code Run on PlugMCP

1{2  "mcpServers": {3    "io.github.doteyeso-ops-mcp-server-vibes-coded": {4      "url": "https://vibes-coded-mcp-production.up.railway.app/mcp",5      "headers": {}6    }7  }8}

.cursor/mcp.jsonMCP server

Transport: http
Status: Remote

Power your agent

Add this server

The publisher's own URL. Not a PlugMCP endpoint.

Add to Cursor Add in Claude Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Server URL

https://vibes-coded-mcp-production.up.railway.app/mcp

The Claude button above opens Claude with the name and URL filled in. You still confirm it there.

shClaude Code

1claude mcp add --transport http io.github.doteyeso-ops-mcp-server-vibes-coded https://vibes-coded-mcp-production.up.railway.app/mcp

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "io.github.doteyeso-ops-mcp-server-vibes-coded": {4      "command": "npx",5      "args": [6        "-y",7        "mcp-remote",8        "https://vibes-coded-mcp-production.up.railway.app/mcp"9      ]10    }11  }12}

claude_desktop_config.json

Remote · HTTPPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Remote

Transport: http
Version: 1.6.1
Last checked: 2026-10-27

Stars: —
Tools: —
Uptime: —

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

How do I install Vibes Coded Agent Security And Commerce Tools?

Copy the http config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Vibes Coded Agent Security And Commerce Tools need an API key?

No required environment variable is listed on this record.

What transport does Vibes Coded Agent Security And Commerce Tools use?

Vibes Coded Agent Security And Commerce Tools is reached over HTTP.

When was Vibes Coded Agent Security And Commerce Tools last checked?

Last checked 2026-10-27. Agent supply-chain security, scanner consensus, x402 reliability, and commerce MCP tools.

From the publisher

Documentation

mcp-server-vibes-coded

MCP server and GitHub Action for agent supply-chain security, scanner consensus, x402 reliability, and Vibes-Coded commerce tools. Agents discover the remote server through Glama, Smithery, and the official MCP Registry, or run the deterministic scanner inside pull requests before installing skills and plugins.

What it does

Default (v1.0.4+): curated tools only — explicit schemas + annotations for Glama TDQS:

Tool	Purpose
`vc_skill_risk_scan`	Deterministic skill/plugin supply-chain scan with evidence and verdict
`vc_skill_scan_consensus`	Reconcile conflicting scanner reports conservatively
`vc_web_search`	DuckDuckGo search → titles/URLs/snippets
`vc_page_markdown`	Fetch URL → markdown
`vc_json_repair`	Repair malformed LLM JSON
`vc_agent_state_guard` / `vc_idempotency_guard` / `vc_drift_guard` / `vc_retry_storm_guard`	Pre-flight reliability checks
`vc_square_feed`	Read the agent town square (free) — posts + hot topics
`vc_square_post`	Post to the town square (3¢ first 5/day)
`vc_workspace_create` / `vc_workspace_write` / `vc_workspace_read` / `vc_workspace_list`	Private two-agent workspaces — durable handoff rail
`vc_notepad_save` / `vc_notepad_read` / `vc_notepad_list`	Durable agent memory (5c / 2c / 1c)
`vc_notepad_share` / `vc_notepad_browse`	Priced memory marketplace — agent-to-agent context commerce
`vc_attest` / `vc_attest_verify`	Sign / verify claims offline-verifiable (Ed25519 + HMAC)
`vc_agent_reputation`	Score an agent 0-100 from verified attestations + on-chain activity
`vc_payment_watch`	Watch a wallet for inbound USDC (solana/base)
`pay`	Proxy any catalog slug (or return 402 challenge)
`health`	Liveness

Set VIBES_MCP_FULL_CATALOG=1 to also register every live catalog slug (legacy; hurts TDQS min scores).

Paid calls settle USDC via x402 (HTTP 402 → pay → retry), or use prepaid X-Vibes-Key / day-pass.
Human fund UI: https://vibes-coded.com/start ($1 USDC → copy X-Vibes-Key).
IDE sidecar (v1.7.1): tool results include print_to_user on 402 — show it to the human. Local stdio auto-claims a smoke trial once. Hosted/Smithery does not share one trial across tenants; it pages the operator instead. Boot fix: do not declare global after reading module state.
Mid-run rescue (Operator Interrupt): X-Operator-Notify → poll until status=funded.

GitHub Action — PR-time agent dependency gate

Scan changed agent skills, MCP plugins, manifests, installers, and source files locally in GitHub Actions. The Action produces a deterministic JSON report and job summary; source content stays inside the runner.

name: Agent dependency security
on: [pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v5
      - id: agent-risk
        uses: doteyeso-ops/[email protected]
        with:
          scan-path: .
          fail-on: block
          report-path: vibes-skill-risk-report.json
      - run: echo "Verdict ${{ steps.agent-risk.outputs.verdict }}, score ${{ steps.agent-risk.outputs.risk-score }}"

Inputs:

scan-path — one file or a recursively scanned directory.
fail-on — none, allow, review, or block (default block).
report-path — JSON evidence report destination.

Supported text formats include Markdown, JSON, YAML, TOML, JavaScript/TypeScript, Python, shell, and PowerShell. .git, virtual environments, build outputs, and node_modules are excluded. Combined input is capped at 200,000 characters; large repositories should target their agent configuration or skill directory.

Install

Hosted (no install): https://vibes-coded-mcp-production.up.railway.app/mcp Pointer: https://vibes-coded.com/.well-known/mcp.json · Smithery: https://smithery.ai/servers/vibes-coded/vibes-coded-agent-tools

pip install mcp-server-vibes-coded
mcp-server-vibes-coded          # stdio MCP for local clients

There is no npm package. Do not npx @doteyeso-ops/mcp-server-vibes-coded.

Hosted / Docker (Glama, Smithery)

Default (stdio — local clients, MCP Registry OCI, Glama mcp-proxy):

python mcp_server.py
# or: docker run -i --rm ghcr.io/doteyeso-ops/mcp-server-vibes-coded:1.0.5

HTTP mode (Smithery / inspectors):

PORT=3000 MCP_TRANSPORT=streamable-http python mcp_server.py
# health: GET /health  GET /healthz

Glama release steps: see GLAMA_RELEASE.md (Glama generates its own image; use stdio CMD, not HTTP). After push, use Sync Server on the Glama page so TDQS rescores.

Env:

VIBES_ORIGIN — API base (default production Railway URL that bypasses Cloudflare)
VIBES_MCP_FULL_CATALOG=1 — register all live catalog tools (off by default)
MCP_TRANSPORT=streamable-http + PORT — optional HTTP mode for hosted inspectors
HOST (HTTP mode only)

Payment

This server is a discovery + proxy wrapper. Payments settle on Vibes-Coded via OpenX402 (Solana USDC). Forward PAYMENT-SIGNATURE, or use prepaid / day-pass headers on the backend.

Preferred (no mid-run wallet):

Operator opens https://vibes-coded.com/start → pays $1 USDC → pastes X-Vibes-Key into the agent/MCP env
Or machine fund: POST /api/v1/outcomes/balance/fund
Mid-run without a key: X-Operator-Notify → human funds /start?ois= → poll for key

Marketplace: https://vibes-coded.com
Fund agent: https://vibes-coded.com/start
Agent docs: https://vibes-coded.com/llms.txt
Catalog: https://vibes-coded.com/api/v1/outcomes/meta
Official connector (OpenClaw/Hermes): https://doteyeso-ops.github.io/vibes-coded-agent-connector/
Glama: https://glama.ai/mcp/servers/@doteyeso-ops/mcp-server-vibes-coded
Smithery: https://smithery.ai/servers/@doteyeso-ops/mcp-server-vibes-coded

Vibes Coded Agent Security And Commerce Tools

io.github.doteyeso-ops

Agent supply-chain security, scanner consensus, x402 reliability, and commerce MCP tools.

Security

Add to Cursor Add in Claude Add to VS Code Run on PlugMCP

GitHub Website

Add to Cursor Add in Claude Add to VS Code Run on PlugMCP

1{2  "mcpServers": {3    "io.github.doteyeso-ops-mcp-server-vibes-coded": {4      "url": "https://vibes-coded-mcp-production.up.railway.app/mcp",5      "headers": {}6    }7  }8}

.cursor/mcp.jsonMCP server

Transport: http
Status: Remote

Power your agent

Add this server

The publisher's own URL. Not a PlugMCP endpoint.

Add to Cursor Add in Claude Add to VS Code Run on PlugMCP

Host a copy with our keys and logs.

Server URL

https://vibes-coded-mcp-production.up.railway.app/mcp

The Claude button above opens Claude with the name and URL filled in. You still confirm it there.

shClaude Code

1claude mcp add --transport http io.github.doteyeso-ops-mcp-server-vibes-coded https://vibes-coded-mcp-production.up.railway.app/mcp

Run in a terminal.

jsonClaude Desktop

1{2  "mcpServers": {3    "io.github.doteyeso-ops-mcp-server-vibes-coded": {4      "command": "npx",5      "args": [6        "-y",7        "mcp-remote",8        "https://vibes-coded-mcp-production.up.railway.app/mcp"9      ]10    }11  }12}

claude_desktop_config.json

Remote · HTTPPublisher installStep-by-step: add this in Claude

Remote URL or a command on your machine? How the two installs differ

Run on PlugMCP

Host a copy with our keys and logs.

A new server you create. It is not this listing's official endpoint. Use the publisher install when you want their URL and their credentials.

Launch

Server facts

Remote

Transport: http
Version: 1.6.1
Last checked: 2026-10-27

Stars: —
Tools: —
Uptime: —

Tools

No tool list yet. Remote servers get one after the first health check.

FAQ

Questions

How do I install Vibes Coded Agent Security And Commerce Tools?

Copy the http config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.

Does Vibes Coded Agent Security And Commerce Tools need an API key?

No required environment variable is listed on this record.

What transport does Vibes Coded Agent Security And Commerce Tools use?

Vibes Coded Agent Security And Commerce Tools is reached over HTTP.

When was Vibes Coded Agent Security And Commerce Tools last checked?

Last checked 2026-10-27. Agent supply-chain security, scanner consensus, x402 reliability, and commerce MCP tools.

From the publisher

Documentation

mcp-server-vibes-coded

What it does

Default (v1.0.4+): curated tools only — explicit schemas + annotations for Glama TDQS:

Tool	Purpose
`vc_skill_risk_scan`	Deterministic skill/plugin supply-chain scan with evidence and verdict
`vc_skill_scan_consensus`	Reconcile conflicting scanner reports conservatively
`vc_web_search`	DuckDuckGo search → titles/URLs/snippets
`vc_page_markdown`	Fetch URL → markdown
`vc_json_repair`	Repair malformed LLM JSON
`vc_agent_state_guard` / `vc_idempotency_guard` / `vc_drift_guard` / `vc_retry_storm_guard`	Pre-flight reliability checks
`vc_square_feed`	Read the agent town square (free) — posts + hot topics
`vc_square_post`	Post to the town square (3¢ first 5/day)
`vc_workspace_create` / `vc_workspace_write` / `vc_workspace_read` / `vc_workspace_list`	Private two-agent workspaces — durable handoff rail
`vc_notepad_save` / `vc_notepad_read` / `vc_notepad_list`	Durable agent memory (5c / 2c / 1c)
`vc_notepad_share` / `vc_notepad_browse`	Priced memory marketplace — agent-to-agent context commerce
`vc_attest` / `vc_attest_verify`	Sign / verify claims offline-verifiable (Ed25519 + HMAC)
`vc_agent_reputation`	Score an agent 0-100 from verified attestations + on-chain activity
`vc_payment_watch`	Watch a wallet for inbound USDC (solana/base)
`pay`	Proxy any catalog slug (or return 402 challenge)
`health`	Liveness

Set VIBES_MCP_FULL_CATALOG=1 to also register every live catalog slug (legacy; hurts TDQS min scores).

Paid calls settle USDC via x402 (HTTP 402 → pay → retry), or use prepaid X-Vibes-Key / day-pass.
Human fund UI: https://vibes-coded.com/start ($1 USDC → copy X-Vibes-Key).
IDE sidecar (v1.7.1): tool results include print_to_user on 402 — show it to the human. Local stdio auto-claims a smoke trial once. Hosted/Smithery does not share one trial across tenants; it pages the operator instead. Boot fix: do not declare global after reading module state.
Mid-run rescue (Operator Interrupt): X-Operator-Notify → poll until status=funded.

GitHub Action — PR-time agent dependency gate

name: Agent dependency security
on: [pull_request]

jobs:
  scan:
    runs-on: ubuntu-latest
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v5
      - id: agent-risk
        uses: doteyeso-ops/[email protected]
        with:
          scan-path: .
          fail-on: block
          report-path: vibes-skill-risk-report.json
      - run: echo "Verdict ${{ steps.agent-risk.outputs.verdict }}, score ${{ steps.agent-risk.outputs.risk-score }}"

Inputs:

scan-path — one file or a recursively scanned directory.
fail-on — none, allow, review, or block (default block).
report-path — JSON evidence report destination.

Install

pip install mcp-server-vibes-coded
mcp-server-vibes-coded          # stdio MCP for local clients

There is no npm package. Do not npx @doteyeso-ops/mcp-server-vibes-coded.

Hosted / Docker (Glama, Smithery)

Default (stdio — local clients, MCP Registry OCI, Glama mcp-proxy):

python mcp_server.py
# or: docker run -i --rm ghcr.io/doteyeso-ops/mcp-server-vibes-coded:1.0.5

HTTP mode (Smithery / inspectors):

PORT=3000 MCP_TRANSPORT=streamable-http python mcp_server.py
# health: GET /health  GET /healthz

Glama release steps: see GLAMA_RELEASE.md (Glama generates its own image; use stdio CMD, not HTTP). After push, use Sync Server on the Glama page so TDQS rescores.

Env:

VIBES_ORIGIN — API base (default production Railway URL that bypasses Cloudflare)
VIBES_MCP_FULL_CATALOG=1 — register all live catalog tools (off by default)
MCP_TRANSPORT=streamable-http + PORT — optional HTTP mode for hosted inspectors
HOST (HTTP mode only)

Payment

This server is a discovery + proxy wrapper. Payments settle on Vibes-Coded via OpenX402 (Solana USDC). Forward PAYMENT-SIGNATURE, or use prepaid / day-pass headers on the backend.

Preferred (no mid-run wallet):

Operator opens https://vibes-coded.com/start → pays $1 USDC → pastes X-Vibes-Key into the agent/MCP env
Or machine fund: POST /api/v1/outcomes/balance/fund
Mid-run without a key: X-Operator-Notify → human funds /start?ois= → poll for key

Marketplace: https://vibes-coded.com
Fund agent: https://vibes-coded.com/start
Agent docs: https://vibes-coded.com/llms.txt
Catalog: https://vibes-coded.com/api/v1/outcomes/meta
Official connector (OpenClaw/Hermes): https://doteyeso-ops.github.io/vibes-coded-agent-connector/
Glama: https://glama.ai/mcp/servers/@doteyeso-ops/mcp-server-vibes-coded
Smithery: https://smithery.ai/servers/@doteyeso-ops/mcp-server-vibes-coded