@vibecodemax/cli

CLI for VibeCodeMax projects. Runs bootstrap provider configuration locally from your project root — credentials never leave your machine.

What it does

During bootstrap, the MCP orchestrates your project setup step by step. When a step requires provider configuration (setting up auth, applying API settings, enabling integrations), this CLI handles the actual provider calls locally using credentials stored in your env files.

You don't run this CLI manually in most cases — the MCP tells your coding agent which command to execute and the agent runs it from your project root.

Requirements

• Node.js 20+
• A VibeCodeMax project with .env.local and/or .env.bootstrap.local configured

Usage

npx @vibecodemax/cli <command> [options]

Package manager variants:

pnpm dlx @vibecodemax/cli <command> [options]
yarn dlx @vibecodemax/cli <command> [options]

Commands

read-setup-state

Reads .vibecodemax/setup-state.json from the current project and prints a JSON setupState object for bootstrap prerequisite hydration.

npx @vibecodemax/cli read-setup-state

admin ensure-admin

Ensures the target user exists in Supabase Auth and has the admin role in the default profiles table.

npx @vibecodemax/cli admin ensure-admin --email [email protected]

This command reads SUPABASE_SERVICE_ROLE_KEY and NEXT_PUBLIC_SUPABASE_URL from local env files, performs lookup/create/promote/verify locally, and prints JSON only.

If a new user is created, the CLI output does not expose a password. The result indicates that password setup still needs a user-facing reset or invite flow.

configure-site-redirects

Configures site URL and redirect allow-list for the project's auth provider.

npx @vibecodemax/cli configure-site-redirects --mode test
npx @vibecodemax/cli configure-site-redirects --mode production --production-domain https://yourdomain.com

configure-email-password

Configures email/password signup behavior.

npx @vibecodemax/cli configure-email-password --email-confirmation yes

enable-google-provider

Enables Google OAuth using credentials from .env.bootstrap.local. The Supabase personal access token must be stored as SUPABASE_ACCESS_TOKEN.

npx @vibecodemax/cli enable-google-provider

Output

All commands print structured JSON to stdout and exit with code 0 on success, non-zero on failure.

{ "ok": true, "command": "configure-site-redirects", "applied": ["site_url", "uri_allow_list"] }

{ "ok": false, "code": "MISSING_ENV", "message": "SUPABASE_ACCESS_TOKEN is missing. Add it to .env.bootstrap.local." }

Security

Credentials are read from local env files and sent only to the relevant provider APIs. No secret values appear in CLI output. Secret-bearing local commands avoid putting credentials on child-process argv, and read-setup-state requires .vibecodemax/setup-state.json to remain secret-free.