mcp-server-vibes-coded is an MCP server and GitHub Action positioned as a combination of AI agent supply chain security, scanner consensus, x402 payment reliability, and Vibes-Coded business tools. Agents can discover this remote server through Glama, Smithery, and the official MCP Registry, or run deterministic scanners in pull requests to complete checks before installing skills and plugins.
Main capabilities The repository description states that it provides 26 tools, covering four categories of use: agent security, scanner consensus, x402 reliability, and the Vibes-Coded 344-item resource business directory. Since v1.0.4, only curated selected tools are registered by default, providing explicit schemas and annotations (for Glama TDQS); setting VIBES_MCP_FULL_CATALOG=1 additionally registers all live directory slugs, but this is a legacy mode and will lower the minimum TDQS score.
Payment and settlement methods Paid calls are settled in USDC via x402: the flow is HTTP 402 → payment → retry. A prepaid X-Vibes-Key or day pass can also be used. The manual top-up interface is https://vibes-coded.com/start（支付 after 1 USDC, the X-Vibes-Key can be copied). The server itself is a discovery and proxy wrapper layer, and payment is ultimately settled on Vibes-Coded through OpenX402 (Solana USDC); it forwards the PAYMENT-SIGNATURE, or uses the prepaid / day pass header on the backend.
IDE sidecar (v1.7.1) Tool results will include print_to_user when encountering a 402, which needs to be shown to the human user. Local stdio will automatically claim one smoke trial; hosted / Smithery will not share the same trial across multiple tenants, but instead notifies the operator. The repository also has a startup fix note: after reading module state, do not declare global.
Mid-run rescue (Operator Interrupt) The flow is X-Operator-Notify → poll until status=funded. The keyless machine top-up method is POST /api/v1/outcomes/balance/fund. The operator can also first open https://vibes-coded.com/start pay 1 USDC, then paste the X-Vibes-Key into the agent / MCP environment variable.
GitHub Action: agent dependency gate at the PR stage This Action can locally scan changed agent skills, MCP plugins, manifests, installers, and source files within GitHub Actions, producing a deterministic JSON report and task summary, and the source content does not leave the runner. Configurable parameters include: scan-path (a single file or recursively scan a directory), fail-on (optional none, allow, review, block; default block), report-path (location for the JSON evidence report output). Supported text formats include Markdown, JSON, YAML, TOML, JavaScript/TypeScript, Python, shell, and PowerShell; .git, virtual environments, build artifacts, and node_modules are excluded. The merged input limit is 200,000 characters, and large repositories should be scanned against their agent configuration or skill directories.
Hosting and access methods The no-install hosted address is https://vibes-coded-mcp-production.up.railway.app/mcp，指针为 https://vibes-coded.com/.well-known/mcp.json，Smithery the page is https://smithery.ai/servers/vibes-coded/vibes-coded-agent-tools。仓库明确说明没有 npm package, do not execute npx @doteyeso-ops/mcp-server-vibes-coded. The default mode is stdio, suitable for local clients, MCP Registry OCI, and Glama mcp-proxy; HTTP mode (MCP_TRANSPORT=streamable-http + PORT) is suitable for Smithery / inspector.
Related environment variables VIBES_ORIGIN specifies the API base URL (the default is the production Railway URL that bypasses Cloudflare); VIBES_MCP_FULL_CATALOG=1 registers all live catalog tools (disabled by default); MCP_TRANSPORT=streamable-http + PORT enables the optional HTTP mode; HOST is only used in HTTP mode.
Use cases and limitations It is suitable for development workflows that need to review agent skills and MCP plugins before installation, PR workflows that need deterministic scan reports and gates, and agents that need to call commercial catalog resources via x402 with USDC payment. In terms of limitations: hosted / Smithery environments do not share the same trial; it does not use an npm package, so it cannot be installed via npx; enabling the full catalog lowers the TDQS score; the total character count of scan input has an upper limit of 200,000.
Other links The marketplace is https://vibes-coded.com，为智能体充值页面为 https://vibes-coded.com/start，智能体文档为 https://vibes-coded.com/llms.txt，目录接口为 https://vibes-coded.com/api/v1/outcomes/meta，官方连接器（OpenClaw/Hermes）为 https://doteyeso-ops.github.io/vibes-coded-agent-connector/，Glama The page is https://glama.ai/mcp/servers/@doteyeso-ops/mcp-server-vibes-coded，Smithery The page is https://smithery.ai/servers/@doteyeso-ops/mcp-server-vibes-coded。
