MCP server — security scanning inside your AI editor

Vibe Check runs as a Model Context Protocol (MCP) server, so your AI assistant can scan a site, explain a finding and write the fix directly into your code — without switching to a browser.

Installation

Add a server to your MCP client config (claude_desktop_config.json, .mcp.json or .cursor/mcp.json) that runs npx -y @grovetech/vibe-mcp with a GROVETECH_API_KEY environment variable. Get the key from your dashboard.

Available tools

• scan_url — full URL scan: security, performance, SEO, GDPR, accessibility, AI readiness. Returns a 0–100 score and the top findings.
• get_findings — findings from an earlier scan, filterable by severity and category.
• explain_finding — a detailed explanation of a finding, its impact and a concrete fix.
• compare_scans — compare scans before and after a fix: what disappeared, what appeared, what persists.
• scan_mcp_config — a security scan of your own MCP servers: prompt injection and tool poisoning in tool descriptions, plaintext secrets in config, rug-pull changes to tool definitions.

Supported clients

Claude Code, Claude Desktop, Cursor, Windsurf and VS Code. In Claude Code the /vibecheck <url> slash command additionally drives the full loop: scan → explain → fix → re-scan → compare.