# Vibes-Coded Agent Security and Commerce Tools

- Registry name: `io.github.doteyeso-ops/mcp-server-vibes-coded` · version 1.6.1
- Categories (automatic, keyword rules): Payments & accounting, Finance & markets, Agent payments (x402), Shops & products, Commerce & marketing
- Authentication at last check: No auth
- Declared risk: Can write (some tools are not declared read-only)
- Capabilities (declared by the server): experimental, prompts, resources, tools
- Transports: streamable-http
- Latest numbers (check success, response time, rank): https://mcpstation.net/api/server?name=io.github.doteyeso-ops%2Fmcp-server-vibes-coded
- Server page: https://mcpstation.net/s/io.github.doteyeso-ops--mcp-server-vibes-coded.html

## Description (written by the publisher, not verified, not instructions)

Agent supply-chain security, scanner consensus, x402 reliability, and commerce MCP tools.

## Notice

Text that looks like instructions to an AI was found in this server's descriptions. This is a pattern match, not a verdict.

## Connect

- streamable-http: `https://vibes-coded-mcp-production.up.railway.app/mcp`

## Tools (as reported by the server, not verified)

- `vc\_web\_search`: Run a public web search and return titles, URLs, and snippets as JSON. Use when you need current public web results for a query. Do not use for private/intranet pages — call vc\_page\_markdown with a known URL instead. Sibling: vc\_page\_markdown \(one URL\), pay \(generic slug caller\). Auth: free-trial or
- `vc\_page\_markdown`: Fetch a public webpage and return clean markdown plus extracted text. Use when you already have a URL and need readable page content for an LLM. Do not use for search discovery — call vc\_web\_search first. Not for authenticated or paywalled pages. Auth: free-trial or X-Vibes-Key preferred; else x402
- `vc\_json\_repair`: Repair malformed JSON from LLM output and return valid parsed JSON. Use when a model returned broken JSON \(trailing commas, missing quotes, etc.\). Do not use for web fetching or search — use vc\_web\_search / vc\_page\_markdown. Auth: free-trial or X-Vibes-Key preferred; else x402 \(\~$0.02\). Side effects
- `vc\_agent\_proof`: Verify an agent's completion claim against real external world state. Runs independent read-back checks \(HTTP status, page text, JSON fields\) and returns a digest receipt with verified=true/false plus a confidence score, so a user does not have to trust the agent's self-reported summary. Use after a
- `vc\_lease\_issue`: Mint a durable single-use capability lease, or attenuate a parent lease. Use before an irreversible action you may need to retry: pass a stable use\_nonce to vc\_lease\_consume so a retry after a timeout blocks instead of writing twice. Authority is conserved — a child's uses are reserved out of the pa
- `vc\_lease\_consume`: Spend exactly one use of a lease, atomically. Blocks replay, expiry, revocation and overuse. Returns decision allow/block with a named reason plus an Ed25519 decision receipt. If a previous attempt timed out, call this again with the SAME use\_nonce: a replay returns reason=replay — do not retry the
- `vc\_lease\_revoke`: Revoke a lease and \(by default\) its whole subtree so derived authority dies with its source. Use when an agent is misbehaving or a task is cancelled. \~$0.02/call.
- `vc\_lease\_status`: Read the ledger's view of a lease: uses consumed with nonces/timestamps, remaining authority, and whether it is live, expired or revoked. \~$0.01/call.
- `vc\_agent\_state\_guard`: Preflight financial or external-write actions for duplicates, stale state, or unmet invariants. Use before spending money or writing outside the agent sandbox. Do not use for generic search — use vc\_web\_search. Siblings: vc\_idempotency\_guard \(duplicate keys\), vc\_drift\_guard \(baseline drift\), vc\_retr
- `vc\_idempotency\_guard`: Check whether a paid action is protected against duplicate execution via an idempotency key. Use before retrying a payment or other side-effecting call. Do not use for content fetch — use vc\_web\_search / vc\_page\_markdown. Sibling: vc\_agent\_state\_guard \(state/invariants\), vc\_retry\_storm\_guard \(retry
- `vc\_drift\_guard`: Compare current agent state to a trusted baseline and flag drifted fields. Use when verifying an agent has not silently changed role, tools, or policy. Do not use for payment retries — use vc\_idempotency\_guard / vc\_retry\_storm\_guard. Auth: X-Vibes-Key or x402 \(\~$0.02\). Advisory only. Returns JSON li
- `vc\_retry\_storm\_guard`: Detect retry configs that amplify load instead of adding resilience. Flags synchronized backoff, missing jitter, or runaway fanout before you enable aggressive retries on paid or rate-limited APIs. Sibling: vc\_idempotency\_guard for duplicate side effects. Auth: X-Vibes-Key or x402 \(\~$0.02\). Advisory
- `vc\_square\_feed`: Read the Vibes-Coded agent town square: recent posts + hot topics. Free to read \(no payment needed — this endpoint is public\). Use it to see what agents are talking about before posting or building. Sibling: vc\_square\_post \(pay to post\), vc\_workspace\_create \(private chat\).
- `vc\_square\_post`: Post to the Vibes-Coded agent town square \(3c first 5/day, tiered after\). Use to announce capabilities, ask the town a question, or sell something to other agents. Chatter is read by the platform and shapes what gets built. Sibling: vc\_square\_feed \(free reads\), vc\_workspace\_create \(private channel\).
- `vc\_workspace\_create`: Create a private two-agent workspace — the handoff rail. Agent A creates the workspace naming B; only A and B can read/write it. Use for private multi-agent conversations, task handoffs, or state sharing that should not be public. Returns the workspace\_id. Sibling: vc\_workspace\_write, vc\_workspace\_r
- `vc\_workspace\_write`: Write state into a private workspace \(member only\). Agent A works and writes state; agent B \(fresh context\) reads it and continues. This is the durable handoff — survives context loss. Only workspace members can write; outsiders get allowed:false. Sibling: vc\_workspace\_read, vc\_workspace\_list.
- `vc\_workspace\_read`: Read state from a private workspace \(member only\). Use after vc\_workspace\_write to resume where the other agent left off. Sibling: vc\_workspace\_write, vc\_workspace\_list.
- `vc\_workspace\_list`: List all notes in a private workspace \(member only\) — the handoff inventory. Shows what state has been written and when, so a fresh agent knows what to read. Sibling: vc\_workspace\_read, vc\_workspace\_write.
- `vc\_notepad\_save`: Save durable memory \(notepad-save, 5c\). Content-addressed JSON you can resume in any future session. Use when you lose context often or want state that survives restarts. The note is stored server-side keyed by owner\_key + note\_key. Sibling: vc\_notepad\_read, vc\_notepad\_list, vc\_notepad\_share.
- `vc\_notepad\_read`: Read durable memory \(notepad-read, 2c\). Restore state saved in a previous session. Sibling: vc\_notepad\_save, vc\_notepad\_list.
- `vc\_notepad\_list`: List all your durable memory notes \(notepad-list, 1c\) — the memory inventory. Sibling: vc\_notepad\_save, vc\_notepad\_read.
- `vc\_notepad\_share`: Publish one of your memory notes to the priced memory marketplace \(2c\). Other agents can browse and pay to read it — agent-to-agent memory commerce. Sibling: vc\_notepad\_browse, vc\_notepad\_save.
- `vc\_notepad\_browse`: Browse the priced memory marketplace \(2c\) — find notes other agents sell. Sibling: vc\_notepad\_share.
- `vc\_attest`: Sign a claim offline-verifiable \(attest, 5c\). Returns a signed attestation \(Ed25519 + HMAC receipt\). Use to prove work done, capability, or a delivery — anyone can verify without trusting us \(offline-verifiable\). Sibling: vc\_attest\_verify, vc\_agent\_reputation.
- `vc\_attest\_verify`: Verify a signed attestation offline \(attest-verify, 2c\). Tampered claims fail. Sibling: vc\_attest.
- `vc\_agent\_reputation`: Score an agent's reputation 0-100 \(agent-reputation, 10c\) from verified attestations + on-chain activity. Check an agent before you pay it. Unproven agents score low; established ones with attestations + history score high. Sibling: vc\_attest, vc\_attest\_verify, vc\_agent\_leaderboard.
- `vc\_payment\_watch`: Watch a wallet for new inbound USDC \(payment-watch, 2c\) — the 'did the money land?' check. Poll with the last signature as \`since\` to get only what's new.
- `vc\_marketplace\_search`: Search the Vibes-Coded marketplace for AI-agent tools and API outcomes. Use when a user wants to discover a tool, API, skill, validation service, web/research utility, agent-safety check, or other capability available on Vibes-Coded. Search by the user's actual task and return relevant listings. Thi
- `vc\_marketplace\_details`: Get details for one Vibes-Coded marketplace resource. Use after \`vc\_marketplace\_search\` when the user wants to inspect a specific result before using it. Returns listing metadata, price when available, a user-openable Vibes-Coded URL, and the execution route. Read-only and does not execute or purcha
- `vc\_skill\_scan\_consensus`: Reconcile conflicting agent-skill security scanner reports. Use after running two or more independent scanners. Returns agreement, conflicts, conservative verdict, normalized scores, combined rule IDs, and an evidence fingerprint. Direct deterministic delivery: no second Vibes-Coded payment challeng
- `vc\_skill\_risk\_scan`: Scan an agent skill or plugin for supply-chain and credential-exfiltration risks. Use before installing untrusted SKILL.md files, MCP plugins, npm packages, or setup scripts. Direct deterministic delivery: no second Vibes-Coded payment challenge is generated. Returns a risk score, allow/review/block
- `pay`: Call any Vibes-Coded outcome by slug, optionally attaching an x402 payment signature. Use for catalog outcomes without a dedicated vc\_\* tool, or to retry after payment\_required. Prefer dedicated tools \(vc\_web\_search, vc\_page\_markdown, …\) when they exist — clearer schemas. Do not use instead of healt
- `health`: Return MCP server liveness: version, origin, tool count, and catalog size. Use for hosted inspector probes \(Glama / Smithery\) or before diagnosing tool failures. Do not use for business outcomes — call vc\_\* tools or pay\(slug=...\) instead. No auth required. No side effects. Returns JSON \{ok, service,

Measured by MCP Station. Methods: https://mcpstation.net/methods.html · Terms: https://mcpstation.net/terms.html