@grovetech/vibe-mcp

Model Context Protocol server for Grovetech Vibe Check — scan any URL for security, performance, GDPR, SEO and AI-readiness issues straight from your AI editor (Cursor, Claude Code, Windsurf, Codex, VS Code, Replit AI…).

This package is a thin stdio → HTTPS proxy. It forwards MCP calls to the hosted endpoint https://grovetechai.com/mcp and streams results back. The tool list is fetched from the server at startup, so you always get the current tools without upgrading the package.

Quickstart

1. Get an API key

Sign up at grovetechai.com (free tier included) and copy your key from Dashboard → Connect IDE → Show key. Keys start with vct_.

2. Connect

Two ways — pick one.

A) Direct HTTP (recommended, nothing to install)

Most modern clients speak remote MCP over HTTP. Claude Code:

claude mcp add --transport http grovetech-vibe-scanner https://grovetechai.com/mcp \
  --header "Authorization: Bearer vct_YOUR_KEY"

Cursor — ~/.cursor/mcp.json:

{
  "mcpServers": {
    "grovetech-vibe-scanner": {
      "url": "https://grovetechai.com/mcp",
      "headers": { "Authorization": "Bearer vct_YOUR_KEY" }
    }
  }
}

Windsurf — ~/.codeium/windsurf/mcp_config.json uses serverUrl instead of url.

B) This package (for clients that only speak stdio)

{
  "mcpServers": {
    "grovetech-vibe-scanner": {
      "command": "npx",
      "args": ["-y", "@grovetech/vibe-mcp"],
      "env": { "GROVETECH_API_KEY": "vct_YOUR_KEY" }
    }
  }
}

Codex CLI — ~/.codex/config.toml:

[mcp_servers.grovetech-vibe-scanner]
command = "npx"
args = ["-y", "@grovetech/vibe-mcp"]
env = { GROVETECH_API_KEY = "vct_YOUR_KEY" }

3. Restart your editor and prompt

"Scan https://my-project.com and show the critical findings."

Tools

| Tool | Description | |------|-------------| | scan_url | Full Vibe Check scan: security, performance, GDPR, SEO, accessibility, AI-readiness. Returns score, risk level, top findings and a report link. | | get_findings | Findings from a previous scan, filterable by severity and category. | | explain_finding | Full explanation and fix for a single finding (CZ + EN). | | list_recent_scans | Your recent scans (max 50). | | compare_scans | Diff two scans of the same URL: fixed / introduced / persisting findings and the score delta. Use it to close the find → fix → rescan loop. | | scan_mcp_config | Audits other MCP servers you have installed — prompt injection in tool descriptions, tool poisoning, shadowing, plaintext secrets, rug pulls. Read-only; never executes anything. |

Full reference: grovetechai.com/docs/mcp.

Environment variables

| Variable | Required | Description | |----------|----------|-------------| | GROVETECH_API_KEY | yes | Your vct_ key from the dashboard. | | GROVETECH_MCP_URL | no | Override the endpoint (self-hosted / staging). Defaults to https://grovetechai.com/mcp. |

Quotas

| Plan | MCP calls / day | |------|-----------------| | Free | 5 | | Solo | 30 | | Pro | 200 | | Partner | 1000 |

scan_url additionally consumes your daily scan quota. The other tools consume only the MCP quota. Limits reset at midnight UTC.

Privacy

This package is a stateless proxy — it forwards JSON-RPC calls over HTTPS and collects no telemetry of its own. The hosted backend logs only metadata (user id, tool name, status, transport, duration) — never scanned URLs, finding payloads, or your API key. See grovetechai.com/privacy.

Troubleshooting

• "Invalid API key" — regenerate it in Dashboard → Connect IDE. Make sure the header is Authorization: Bearer vct_… (the word Bearer included).
• Nothing appears in the editor — restart it after editing the config, then check the MCP panel (/mcp in Claude Code).
• Rate limited — you hit the daily quota; it resets at midnight UTC.

License

MIT — © Grovetech AI s.r.o.