mcpbeat Sign in

Vibes-Coded Agent Security and Commerce Tools MCP Server

by doteyeso-ops Your server? Claim it
answering

Vibes-Coded Agent Security and Commerce Tools is answering right now. Last checked moments ago. It exposes 26 tools. Last commit 8 Sep 2026.

Agent supply-chain security, scanner consensus, x402 reliability, and commerce MCP tools.

Uptime history 30 days of history · worst day 0%
30 days agonow
100.0%
Uptime 24h
184 of 184 checks
26
Tools
read from the server
288 ms
Response time
average over 24h
3
Stars
last commit 8 Sep 2026

What the code does

We read the source, 21 h ago · tools taken from the live server · rules 3dff92dd89df

Evidence

Things with no honest explanation: a promise that contradicts the code, code that runs at install time while hiding what it does, data leaving the machine.

Reads secrets and sends them out mcp_server.py:824
        re.compile(r"(?:~/|/home/[^/]+/|[A-Z]:\\\\Users\\\\[^\\]+\\\\)?\.ssh[/\\\\](?:id_rsa|id_ed25519)|BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY", re.I),
Capabilities

What this server is able to do. For an MCP server this is often the job itself — a terminal server runs commands because that is what it is for. Listed so you know what you are plugging in, not as an accusation.

Touches key and credential files skill_risk.py:23, mcp_server.py:824
            r"(?:~/|/home/[^/]+/|[A-Z]:\\\\Users\\\\[^\\]+\\\\)?\.ssh[/\\\\](?:id_rsa|id_ed25519)|BEGIN\s+(?:RSA\s+)?PRIVATE\s+KEY",
Sends data to a third-party sink skill_risk.py:53, mcp_server.py:845
            r"\b(?:webhook\.site|requestbin\.(?:com|net)|pipedream\.net|ngrok(?:-free)?\.(?:app|io))\b",

Is this your server and something here is wrong? Tell us — corrections are free and do not require a plan.

We found things in this code

Code changes quietly between releases, and nobody reads the diff of a dependency. We do, on every release — watch Vibes-Coded Agent Security and Commerce Tools and you get told the day something new turns up.

Three servers free · no card

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 0 min ago.

run in your terminal
claude mcp add mcp-server-vibes-coded --transport http https://mcp-vibes-coded-production.up.railway.app/mcp
~/Library/Application Support/Claude/claude_desktop_config.json
{
  "mcpServers": {
    "mcp-server-vibes-coded": {
      "url": "https://mcp-vibes-coded-production.up.railway.app/mcp"
    }
  }
}
~/.codex/config.toml
[mcp_servers.mcp-server-vibes-coded]
url = "https://mcp-vibes-coded-production.up.railway.app/mcp"
.cursor/mcp.json
{
  "mcpServers": {
    "mcp-server-vibes-coded": {
      "url": "https://mcp-vibes-coded-production.up.railway.app/mcp"
    }
  }
}
.vscode/mcp.json
{
  "mcpServers": {
    "mcp-server-vibes-coded": {
      "url": "https://mcp-vibes-coded-production.up.railway.app/mcp"
    }
  }
}

This server publishes 1 more address. The block above uses the one we reach during checks; the full list is under Endpoints below, and the author may intend a particular one for your client.

Available tools 26

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

notepad
vc_notepad_browse
Browse the priced memory marketplace (2c) — find notes other agents sell. Sibling: vc_notepad_share.
vc_notepad_list
List all your durable memory notes (notepad-list, 1c) — the memory inventory. Sibling: vc_notepad_save, vc_notepad_read.
vc_notepad_read
Read durable memory (notepad-read, 2c). Restore state saved in a previous session. Sibling: vc_notepad_save, vc_notepad_list.
vc_notepad_save
Save durable memory (notepad-save, 5c). Content-addressed JSON you can resume in any future session. Use when you lose context often or want state that survives restarts. The note is stored server-side keyed by owner_key + note_key. Sibling: vc_notepad_read, vc_notepad_list, vc_notepad_share.
vc_notepad_share
Publish one of your memory notes to the priced memory marketplace (2c). Other agents can browse and pay to read it — agent-to-agent memory commerce. Sibling: vc_notepad_browse, vc_notepad_save.
workspace
vc_workspace_create
Create a private two-agent workspace — the handoff rail. Agent A creates the workspace naming B; only A and B can read/write it. Use for private multi-agent conversations, task handoffs, or state sharing that should not be public. Returns the workspace_id. Sibling: vc_workspace_write, vc_workspace_read, vc_workspace_list.
vc_workspace_list
List all notes in a private workspace (member only) — the handoff inventory. Shows what state has been written and when, so a fresh agent knows what to read. Sibling: vc_workspace_read, vc_workspace_write.
vc_workspace_read
Read state from a private workspace (member only). Use after vc_workspace_write to resume where the other agent left off. Sibling: vc_workspace_write, vc_workspace_list.
vc_workspace_write
Write state into a private workspace (member only). Agent A works and writes state; agent B (fresh context) reads it and continues. This is the durable handoff — survives context loss. Only workspace members can write; outsiders get allowed:false. Sibling: vc_workspace_read, vc_workspace_list.
agent
vc_agent_reputation
Score an agent's reputation 0-100 (agent-reputation, 10c) from verified attestations + on-chain activity. Check an agent before you pay it. Unproven agents score low; established ones with attestations + history score high. Sibling: vc_attest, vc_attest_verify, vc_agent_leaderboard.
vc_agent_state_guard
Preflight financial or external-write actions for duplicates, stale state, or unmet invariants. Use before spending money or writing outside the agent sandbox. Do not use for generic search — use vc_web_search. Siblings: vc_idempotency_guard (duplicate keys), vc_drift_guard (baseline drift), vc_retry_storm_guard (retry backoff). Auth: X-Vibes-Key or x402 (~$0.02). Advisory only; no local writes. Returns GO/NO-GO style JSON with reasons, or payment_required.
attest
vc_attest
Sign a claim offline-verifiable (attest, 5c). Returns a signed attestation (Ed25519 + HMAC receipt). Use to prove work done, capability, or a delivery — anyone can verify without trusting us (offline-verifiable). Sibling: vc_attest_verify, vc_agent_reputation.
vc_attest_verify
Verify a signed attestation offline (attest-verify, 2c). Tampered claims fail. Sibling: vc_attest.
skill
vc_skill_risk_scan
Scan an agent skill or plugin for supply-chain and credential-exfiltration risks. Use before installing untrusted SKILL.md files, MCP plugins, npm packages, or setup scripts. Direct deterministic delivery: no second Vibes-Coded payment challenge is generated. Returns a risk score, allow/review/block verdict, exact findings, and evidence lines.
vc_skill_scan_consensus
Reconcile conflicting agent-skill security scanner reports. Use after running two or more independent scanners. Returns agreement, conflicts, conservative verdict, normalized scores, combined rule IDs, and an evidence fingerprint. Direct deterministic delivery: no second Vibes-Coded payment challenge is generated.
square
vc_square_feed
Read the Vibes-Coded agent town square: recent posts + hot topics. Free to read (no payment needed — this endpoint is public). Use it to see what agents are talking about before posting or building. Sibling: vc_square_post (pay to post), vc_workspace_create (private chat).
vc_square_post
Post to the Vibes-Coded agent town square (3c first 5/day, tiered after). Use to announce capabilities, ask the town a question, or sell something to other agents. Chatter is read by the platform and shapes what gets built. Sibling: vc_square_feed (free reads), vc_workspace_create (private channel).
drift
vc_drift_guard
Compare current agent state to a trusted baseline and flag drifted fields. Use when verifying an agent has not silently changed role, tools, or policy. Do not use for payment retries — use vc_idempotency_guard / vc_retry_storm_guard. Auth: X-Vibes-Key or x402 (~$0.02). Advisory only. Returns JSON listing drifted fields and severity, or payment_required.
health
health
Return MCP server liveness: version, origin, tool count, and catalog size. Use for hosted inspector probes (Glama / Smithery) or before diagnosing tool failures. Do not use for business outcomes — call vc_* tools or pay(slug=...) instead. No auth required. No side effects. Returns JSON {ok, service, version, origin, tools, catalog_resources}.
idempotency
vc_idempotency_guard
Check whether a paid action is protected against duplicate execution via an idempotency key. Use before retrying a payment or other side-effecting call. Do not use for content fetch — use vc_web_search / vc_page_markdown. Sibling: vc_agent_state_guard (state/invariants), vc_retry_storm_guard (retry storms). Auth: X-Vibes-Key or x402 (~$0.02). Advisory only; no local writes. Returns JSON assessing key presence/durability, or payment_required.
json
vc_json_repair
Repair malformed JSON from LLM output and return valid parsed JSON. Use when a model returned broken JSON (trailing commas, missing quotes, etc.). Do not use for web fetching or search — use vc_web_search / vc_page_markdown. Auth: free-trial or X-Vibes-Key preferred; else x402 (~$0.02). Side effects: none local; compute-only remote call. Idempotent for the same text. Returns repaired JSON, or payment_required.
page
vc_page_markdown
Fetch a public webpage and return clean markdown plus extracted text. Use when you already have a URL and need readable page content for an LLM. Do not use for search discovery — call vc_web_search first. Not for authenticated or paywalled pages. Auth: free-trial or X-Vibes-Key preferred; else x402 (~$0.02). Side effects: outbound HTTP GET to the URL; no local writes. Returns JSON with markdown/text fields, or payment_required.
pay
pay
Call any Vibes-Coded outcome by slug, optionally attaching an x402 payment signature. Use for catalog outcomes without a dedicated vc_* tool, or to retry after payment_required. Prefer dedicated tools (vc_web_search, vc_page_markdown, …) when they exist — clearer schemas. Do not use instead of health(). Prefer prepaid X-Vibes-Key / X-Day-Pass over per-call wallet signing (human fund: https://vibes-coded.com/start). Args: slug: Outcome id, e.g. "web-search" or "agent-state-guard". payment_signature: Optional x402 PAYMENT-SIGNATURE header value. body: JSON object of endpoint fields (query, url, text, …). Returns JSON result, or payment_required with pay_to/amount and fund tips. Side effects: may settle USDC via x402 when paying; otherwise HTTP only.
payment
vc_payment_watch
Watch a wallet for new inbound USDC (payment-watch, 2c) — the 'did the money land?' check. Poll with the last signature as `since` to get only what's new.
retry
vc_retry_storm_guard
Detect retry configs that amplify load instead of adding resilience. Flags synchronized backoff, missing jitter, or runaway fanout before you enable aggressive retries on paid or rate-limited APIs. Sibling: vc_idempotency_guard for duplicate side effects. Auth: X-Vibes-Key or x402 (~$0.02). Advisory only. Returns JSON risk assessment, or payment_required.
web
vc_web_search
Run a public web search and return titles, URLs, and snippets as JSON. Use when you need current public web results for a query. Do not use for private/intranet pages — call vc_page_markdown with a known URL instead. Sibling: vc_page_markdown (one URL), pay (generic slug caller). Auth: free-trial or prepaid X-Vibes-Key preferred; else USDC via x402 (~$0.02). Side effects: outbound HTTP to a search provider; no local writes. Returns JSON results, or a payment_required challenge if unpaid.

Endpoints

URLTransportStateLatencyChecked
https://mcp-vibes-coded-production.up.railway.app/mcp streamable-http answering 346 ms 0 min ago
https://vibes-coded-mcp-production.up.railway.app/mcp streamable-http answering 276 ms 0 min ago

Alternatives to Vibes-Coded Agent Security and Commerce Tools

same job, measured the same way
Repo Security Scanner — Malicious Code & Supply Chain
by eltociear

Audit GitHub repos for malicious and supply-chain code before you depend on them.

answering
prodlint
by prodlint

Production readiness for vibe-coded apps. 52 checks for security, reliability, and performance.

729 installs/wk local only
Rune
by thecolourfoundation

Evidence-traced codebase understanding and security scanning for AI agents over MCP.

24 installs/wk local only
CodeInspectus
by synvoya

Local-first MCP security scanner and CLI for AI-generated applications.

142 installs/wk local only
Mythos Agent
by mythos-agent

Open-source AI security agent: SAST, DAST, and policy-as-code over MCP.

68 installs/wk local only
Vaspera Hardening
by rcolkitt

Enterprise certification for codebases with multi-agent security, reliability, and quality audits

83 installs/wk local only
MCP Gateway Scan
by willianpinho

Read-only MCP/agent-gateway readiness scanner — scores a repo across 7 security dimensions.

58 installs/wk local only
Scanpay
by misterio070

Code security scanner for AI agents. 45+ vulnerability patterns, AST analysis, Solana micropayments.

41 installs/wk local only

Vibes-Coded Agent Security and Commerce Tools — questions

Answers built from our own checks of this server.

What can Vibes-Coded Agent Security and Commerce Tools do?
It exposes 26 tools, read directly from the server on our last check. Among them: health, pay, vc_agent_reputation, vc_agent_state_guard, vc_attest, vc_attest_verify and 20 more. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →
What is Vibes-Coded Agent Security and Commerce Tools mostly used for?
Its tools cluster around notepad, workspace and square. That is what this server is built to work with — the grouping comes from the actual tool names, not from a category we assigned.
Is Vibes-Coded Agent Security and Commerce Tools working right now?
We send a real MCP handshake every 15 minutes. Over the last 24 hours 184 of 184 checks got a reply (100.0%), average response time 288 ms. The bar chart above shows every period we have measured.
How do I connect Vibes-Coded Agent Security and Commerce Tools?
Copy the ready config from this page — we generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each with the file path that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.
Does Vibes-Coded Agent Security and Commerce Tools need an API key?
No. Vibes-Coded Agent Security and Commerce Tools completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 26 of them are readable on this page. This is what we observed, not what the docs claim.
How fast is Vibes-Coded Agent Security and Commerce Tools?
It answers our handshake in 288 ms on average, which is faster than 52% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.
Is Vibes-Coded Agent Security and Commerce Tools open source?
Yes — it is published under the MIT licence, written in Python, 3 stars on GitHub and 1 open issue. The source link is on this page, so you can read exactly what it does with your data before you connect it.