VibeScale MCP Server

by ranqint Your server? Claim it

answering

VibeScale is answering right now. Last checked 11 min ago. It exposes 3 tools.

Pre-launch checks for AI-built apps: leaked keys, Supabase RLS gaps, browser-exposed env vars.

Uptime history 8 hours of history

8 hours agonow

100.0%

Uptime 24h

29 of 29 checks

Tools

read from the server

315 ms

Response time

average over 24h

open, no key

Access

streamable-http

Nothing serious here today

Today is the operative word: we check VibeScale every 15 minutes and re-read its code on every release. Watch it and you find out the day that stops being true.

Connect this server

Endpoint below is the one we actually reach during checks — not the one copied from a README. Last verified 11 min ago.

Claude Code Claude Desktop Codex Cursor VS Code

run in your terminal

claude mcp add vibescale --transport http https://vibe.elya-studio.com/mcp

Settings → Connectors → Add custom connector, then paste this address

https://vibe.elya-studio.com/mcp

~/.codex/config.toml

[mcp_servers.vibescale]
url = "https://vibe.elya-studio.com/mcp"

.cursor/mcp.json

{
  "mcpServers": {
    "vibescale": {
      "url": "https://vibe.elya-studio.com/mcp"
    }
  }
}

.vscode/mcp.json

{
  "servers": {
    "vibescale": {
      "type": "http",
      "url": "https://vibe.elya-studio.com/mcp"
    }
  }
}

Available tools 3

Read directly from the server with tools/list, grouped by what they act on. If a tool disappears, we record the date.

env

check_env_exposure

Takes environment variable NAMES (never values) and says, for each one, whether the build tool ships it to every visitor (VITE_, NEXT_PUBLIC_, EXPO_PUBLIC_, REACT_APP_, PUBLIC_, GATSBY_, NUXT_PUBLIC_) and whether its name looks like a server secret that must not be there. Use when someone asks whether their .env or API keys are exposed in a Lovable, Bolt, Vite, Next.js or Expo app. Send names only; if a value is included it is dropped and not stored. Explanations are in Hebrew.

lint

lint_supabase_rls

Reads Supabase SQL (migrations or a schema dump) as text and lists tables in exposed schemas without row level security, RLS with no policy, policies that allow everything or read user_metadata, policies without a role, write grants to anon, SECURITY DEFINER functions and views, new tables without a grant, and public storage buckets, each with SQL that fixes it. Use when someone asks whether their Supabase database is locked down, or before launching an app that uses Supabase. The SQL is never executed or stored; policy logic (who should see what) is not judged. Findings are in Hebrew.

scan

scan_app_launch_readiness

Reads one public web app the way a browser does (its HTML, the same-site scripts it loads and any source maps they point to) and reports what any visitor can already see: server secret keys shipped to the browser (Supabase service_role, OpenAI, Anthropic, Stripe, AWS, GitHub, SendGrid, Resend; shown masked), a published source map, no HTTPS, and missing Content-Security-Policy, HSTS or frame protection. Use when someone built an app with Lovable, Base44, Bolt, Cursor, Replit or similar and asks whether it is safe to launch or whether a key leaked. It does not sign in, guess paths or query the app's database. Findings are in Hebrew.

Endpoints

URL	Transport	State	Latency	Checked
https://vibe.elya-studio.com/mcp	streamable-http	answering	316 ms	11 min ago

Alternatives to VibeScale

same job, measured the same way

Val

by nyx-intelligence

QA agent for vibecoded apps. Real browser checks, your AI fixes them. Ship to green.

37 installs/wk local only

YouGame

by yougame

Publish a browser game on YouGame: the build rules, the leaderboard SDK, pre-upload checks.

9 tools answering

ego-webqa

by roy32172310

Deterministic browser delivery checks for AI-generated web pages.

704 installs/wk local only

Burrowbox

by burrowbox

Persistent Linux computers for AI agents: desktop, signed-in browser, vault, apps and shell.

answering

Browserbash

by pramoddutta

Plain-English browser tests for AI agents: real Chrome, deterministic verdicts. Free, no API keys.

83 installs/wk local only

Browser Game

by opengameapp

Local tools for planning and validating focused browser-game prototypes.

59 installs/wk local only

Nullprint

by nullprintai

Create, launch, check and drive Nullprint AI antidetect browser profiles from any MCP agent.

1 094 installs/wk local only

Vibe Test — Browser Testing Agent

by aishwaryshrivastav

Code-aware browser testing agent — 14 Playwright tools for AI code editors via MCP

111 installs/wk local only

VibeScale — questions

Answers built from our own checks of this server.

What can VibeScale do?

It exposes 3 tools, read directly from the server on our last check. Among them: check_env_exposure, lint_supabase_rls, scan_app_launch_readiness. The full list with descriptions is on this page — we take it from the server itself via tools/list, not from a README. How MCP servers expose tools in the first place →

Is VibeScale working right now?

We send a real MCP handshake every 15 minutes. Over the last 24 hours 29 of 29 checks got a reply (100.0%), average response time 315 ms. The bar chart above shows every period we have measured.

How do I connect VibeScale?

Copy the ready config from this page. We generate it for Claude Code, Claude Desktop, Codex, Cursor and VS Code, each in the form that client actually reads. It is a remote server, so there is nothing to install — the client connects to the address.

Does VibeScale need an API key?

No. VibeScale completed a full MCP handshake with us as an anonymous client and listed its tools without asking for anything. All 3 of them are readable on this page. This is what we observed, not what the docs claim.

How fast is VibeScale?

It answers our handshake in 315 ms on average, which is faster than 47% of all working MCP servers we measure. The comparison comes from our own checks across the whole registry, every 15 minutes.