@vibesprotocol/mcp-server

MCP server that connects your AI coding tool (Claude Code, Cursor, Windsurf) to your Vibestarter raise page — so commits, sessions, tests, and deploys show up live for your backers.

Runs as a stdio-transport MCP server. Exposes two tools to the AI host:

• vibestarter_get_raise_status — current funding progress, tranche schedule, milestones.
• vibestarter_report_activity — post a commit / file change / test run / deploy / session event to your raise's public agent-activity feed.

Install

Nothing to install — npx runs it on-demand:

npx -y @vibesprotocol/mcp-server

Or from a local clone of the monorepo:

pnpm install
pnpm --filter @vibesprotocol/mcp-server build

Configure

Create ~/.vibestarter/config.json:

{
  "apiKey": "vbs_your_api_key_here",
  "apiUrl": "https://app.vibestarter.xyz",
  "defaultCampaignId": "your_campaign_id",
  "agentName": "Claude Code"
}

| Field | Required | Description | |---|---|---| | apiKey | ✅ | Your per-founder Vibestarter API key. Mint it in the dashboard — format vbs_<32 hex>. Returned once; store securely. | | apiUrl | ✅ | https://app.vibestarter.xyz (production), https://staging.vibestarter.xyz (staging), or https://testnet.vibestarter.xyz (testnet). | | defaultCampaignId | ❌ | Campaign ID used when a tool call omits it. If your key is campaign-scoped, set this to match. | | agentName | ❌ | Display name on the activity feed (e.g. "Claude Code", "Cursor"). Defaults to "Unknown Agent". |

Minting an API key

1. Sign in to your Vibestarter dashboard with the wallet that owns the raise.
2. Open your raise's settings → API keys (or, while the settings UI is in flight, POST /api/mcp/keys with your SIWE-authenticated session).
3. Copy the plaintext key that starts with vbs_. It's shown once — the platform only stores a SHA-256 hash.
4. Paste it into ~/.vibestarter/config.json.

Scopes default to ["activity:write", "raise:read"] — exactly what this MCP server uses.

Wire up to your AI host

Claude Code

Add to .claude/mcp.json in your project (or ~/.claude/mcp.json globally):

{
  "mcpServers": {
    "vibestarter": {
      "command": "npx",
      "args": ["-y", "@vibesprotocol/mcp-server"]
    }
  }
}

Cursor / Windsurf

Same command shape — any MCP-capable host. The server speaks stdio.

What shows up on your raise page

Posted activity renders live in the AGENT_ACTIVITY section on your raise page at https://app.vibestarter.xyz/raises/<txHash>, with type-specific icons:

• COMMIT — commit hash, branch, repo link (auto-detected from git context if present)
• SESSION_START / SESSION_END — coding session bookends
• FILE_CHANGE — targeted file edit summaries
• TEST_RUN — test suite runs with pass/fail summary
• DEPLOY — deploy events
• CUSTOM — anything else you want to surface

Backers see real activity from a real builder. No weekly update required — your agent reports as you work.

Privacy + safety

• API keys are validated as vbs_<32 hex> and stored hashed (SHA-256).
• Revoke a key any time (DELETE /api/mcp/keys/[keyId]). Revoked keys stop authenticating immediately and keep their audit trail.
• Each activity event is capped at 10KB.
• The server deduplicates events by canonical-JSON content hash within a 1-hour window so retries don't spam the feed.
• Environment isolation: keys are bound to the environment whose router you launched under (staging, testnet, or production). Cross-environment calls 404.
• Public read of activity is rate-limited; writes are rate-limited at 120/hour per key.

Development

# inside packages/mcp-server/
pnpm install
pnpm dev         # watch-mode build via tsup
pnpm build       # one-shot build → dist/
pnpm start       # run the stdio server from dist/

Tests for the backend API routes live in apps/web/src/__tests__/. Tests for the shared Zod schemas live in packages/shared/src/__tests__/.

Architecture (one paragraph)

The MCP server authenticates every HTTP call to the Vibestarter API with a bearer token (Authorization: Bearer vbs_...). The backend resolves the token to a FounderApiKey row, checks revocation / expiration / scope, then applies the route's own guardrails (campaign ownership, environment-isolated router match, 120/hour rate limit). Agent activity events are persisted to AgentActivity and rendered on the raise page via a cached public GET /api/mcp/activity?campaignId=... endpoint. Nothing in this server touches the user's wallet or performs on-chain actions — it is pure off-chain metadata.

License

MIT