{
  "markdown": "# @lexvibe/mcp\n\n[![lexvibe-mcp MCP server](https://glama.ai/mcp/servers/marcosnovo/lexvibe-mcp/badges/card.svg)](https://glama.ai/mcp/servers/marcosnovo/lexvibe-mcp)\n[![lexvibe-mcp MCP server](https://glama.ai/mcp/servers/marcosnovo/lexvibe-mcp/badges/score.svg)](https://glama.ai/mcp/servers/marcosnovo/lexvibe-mcp)\n\nLexVibe **MCP** server — one-step legal compliance for vibe-coded apps\n(Lovable, Bolt, v0, Next.js, plain HTML). Wire it into your AI assistant\n(Claude Code, Claude Desktop, Cursor…) and it makes your app \"legally ready\"\nwithout you knowing the law: privacy policy, terms of service, cookie consent\nbanner with real script blocking, and an EU AI Act risk check.\n\n## Tools\n\n| Tool                | What it does                                                                                                                                                           |\n| ------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------- |\n| `make_compliant`    | One step: scan → generate docs into `/legal` → install the banner snippet → classify EU AI Act risk.                                                                   |\n| `check_compliance`  | Read-only readiness report: what was detected, what could be auto-derived, and which human facts are still missing. Run it again after adding any SDK to catch drift.  |\n| `scan_project`      | Detect analytics, payments, generative AI, email collection, third parties and platforms (web / iOS / Android).                                                        |\n| `check_website`     | Free, no-signup compliance check of a **deployed** site by URL: per-vendor signals, recommendations and EU AI Act applicability (the same public checker as `/check`). |\n| `verify_snippet`    | Fetch a deployed URL and confirm the cookie-banner snippet is actually live in the served HTML (`ok` / `missing` / `unknown`).                                         |\n| `generate_policies` | Generate privacy policy / terms / AI disclosure, localized and tailored per market.                                                                                    |\n| `install_snippet`   | Insert the cookie-banner snippet before `</head>`; for JSX layouts it returns exact instructions instead.                                                              |\n| `check_ai_act`      | Classify EU AI Act risk and list the applicable obligations with deadlines.                                                                                            |\n| `claim_app`         | Create a REAL app in the user's LexVibe account: returns a link the user opens to sign in and confirm (30 min).                                                        |\n| `get_claim_status`  | Poll a claim created with `claim_app`; once confirmed it returns the real app id, install snippet and policy URL.                                                      |\n\n## Typical use (natural language)\n\n> \"Make my app legally compliant for the EU and the US.\"\n\nOne `make_compliant` call: the agent scans the project, writes the localized\npolicies to `/legal`, installs the cookie-banner snippet in your HTML head and\nreturns the EU AI Act classification plus next steps. You just review and\napprove.\n\nDraft-first flow: start with `check_compliance` — it reports what the scan\ncould figure out on its own and returns an `agentPrompt` your coding agent can\nanswer by reading the repo (company entity, contact email, target markets), so\nthere are no forms to fill.\n\nNo app id yet? The agent calls `claim_app` and hands you a link: open it, sign\nin and confirm — that creates the real app in **your** LexVibe account (hosted,\nauto-updated policies and consent proof linked to you). The agent then picks up\nthe real app id via `get_claim_status` and replaces any `YOUR_APP_ID`\nplaceholder automatically.\n\n## Keep your policies in sync with your code\n\nLegal documents describe your app as it was when they were generated. Every\nSDK you add afterwards — payments, analytics, auth, AI — is a processing\nactivity your documents don't cover yet. LexVibe calls this **drift**, and the\nMCP server is the sensor that lives inside your AI dev loop: the same\nassistant that adds the SDK can catch the compliance gap before you deploy.\n\nPaste this standing rule into your assistant's project rules — `AGENTS.md`\n(Codex, Gemini CLI and most agents), `CLAUDE.md`, `.cursorrules`,\n`.windsurfrules`…:\n\n> After adding any SDK, analytics, payments, auth or AI integration to this\n> project, run LexVibe's `check_compliance` tool and follow its\n> recommendation.\n\nWhen `check_compliance` reports processing activities that were added after\nyour documents were generated, re-run `generate_policies` (or\n`make_compliant`) so the documents disclose the new processing. The same\napplies to the deployed site: `check_website` detects the trackers that\nactually ship to visitors, so you can catch drift the local scan can't see\n(scripts injected by a CMS, a tag manager, a no-code platform…). Claimed apps\nare also watched by LexVibe's other drift sensors (periodic site rechecks and\nthe GitHub integration), and the remote `check_website` tool additionally\nreturns a `drift` section for claimed apps comparing the live site against\nthe baseline the documents were generated from.\n\n## Quickstart\n\n```bash\nnpx -y @lexvibe/mcp   # or build from source: npm run build -w packages/mcp\n```\n\n### Claude Code (`.mcp.json` in your project, or `claude mcp add`)\n\n```json\n{\n  \"mcpServers\": {\n    \"lexvibe\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@lexvibe/mcp\"],\n      \"env\": {\n        \"LEXVIBE_APP_ID\": \"your-app-id\"\n      }\n    }\n  }\n}\n```\n\n### Cursor (`~/.cursor/mcp.json`)\n\n```json\n{\n  \"mcpServers\": {\n    \"lexvibe\": {\n      \"command\": \"npx\",\n      \"args\": [\"-y\", \"@lexvibe/mcp\"],\n      \"env\": {\n        \"LEXVIBE_APP_ID\": \"your-app-id\"\n      }\n    }\n  }\n}\n```\n\nClaude Desktop uses the same `mcpServers` structure in\n`claude_desktop_config.json`.\n\n### Codex CLI (`~/.codex/config.toml`)\n\nCodex is the one client that does **not** use the `mcpServers` JSON above — its\nconfig is TOML:\n\n```bash\ncodex mcp add lexvibe -- npx -y @lexvibe/mcp\n```\n\nOr by hand:\n\n```toml\n[mcp_servers.lexvibe]\ncommand = \"npx\"\nargs = [\"-y\", \"@lexvibe/mcp\"]\nenv = { LEXVIBE_APP_ID = \"YOUR_APP_ID\" }\n```\n\nProject-scoped config lives in `.codex/config.toml` (trusted projects only).\n\n### Gemini CLI (`~/.gemini/settings.json`)\n\nSame `mcpServers` shape as Cursor. For the **remote** server use `httpUrl`, not\n`url`: in Gemini CLI `url` means SSE, and this endpoint speaks Streamable HTTP\nonly, so `url` fails without saying why.\n\n```json\n{\n  \"mcpServers\": {\n    \"lexvibe\": { \"httpUrl\": \"https://golexvibe.com/api/mcp\" }\n  }\n}\n```\n\n## Remote MCP (no install)\n\nBrowser-based agents that cannot run local processes — claude.ai / Claude\nDesktop connectors, ChatGPT connectors — can use the hosted remote server\ninstead (Streamable HTTP, no auth):\n\n```\nhttps://golexvibe.com/api/mcp\n```\n\nThe remote server has no filesystem access, so it exposes the remote-safe\nsubset: `check_website`, `check_store`, `generate_policies` (template-based\ndrafts, capped for anonymous callers), `check_ai_act`, `get_install_snippet`,\nplus `claim_app` / `get_claim_status` to create a real app in the user's\naccount. Stdio-only clients can bridge to it with\n`npx -y mcp-remote https://golexvibe.com/api/mcp`.\n\n### Which integration to use, per platform\n\n| Platform                              | Integration       | How                                                     |\n| ------------------------------------- | ----------------- | ------------------------------------------------------- |\n| Claude Code                           | stdio (or remote) | `claude mcp add lexvibe -- npx -y @lexvibe/mcp`         |\n| Cursor / Windsurf / Cline / VS Code   | stdio             | `mcpServers` config with `npx -y @lexvibe/mcp`          |\n| Codex CLI                             | stdio (or remote) | `codex mcp add lexvibe -- npx -y @lexvibe/mcp`          |\n| Gemini CLI                            | stdio (or remote) | `mcpServers` in `~/.gemini/settings.json`               |\n| Zed                                   | stdio (or remote) | `context_servers` in `settings.json`                    |\n| Claude Desktop / claude.ai            | remote            | Settings → Connectors → `https://golexvibe.com/api/mcp` |\n| ChatGPT                               | remote            | Settings → Connectors → `https://golexvibe.com/api/mcp` |\n| Lovable / Bolt / v0 / Base44 / Replit | prompt (no MCP)   | Paste the one-liner from <https://golexvibe.com/prompt> |\n\nFull per-platform setup guide: <https://golexvibe.com/docs/integrations>\n\n## Configuration\n\n| Variable             | Default                 | Purpose                                                            |\n| -------------------- | ----------------------- | ------------------------------------------------------------------ |\n| `LEXVIBE_APP_ID`     | `YOUR_APP_ID`           | Your LexVibe app id (links the snippet to your hosted policies)    |\n| `LEXVIBE_API_URL`    | `https://golexvibe.com` | LexVibe instance that generates documents and classifies AI risk   |\n| `LEXVIBE_CDN_URL`    | `https://golexvibe.com` | Host the widget script is served from (self-hosting only)          |\n| `LEXVIBE_EVENTS_URL` | LexVibe events endpoint | Override where anonymous tool-usage events are sent (self-hosting) |\n| `LEXVIBE_TELEMETRY`  | `1`                     | Set to `0` / `false` / `off` to disable usage telemetry            |\n\n## Usage analytics\n\nEach tool call sends one anonymous `mcp_tool_call` event to LexVibe so your MCP\nusage shows up alongside your website in the Platform analytics dashboard\n(same event the hosted remote server already records, tagged\n`source: \"mcp_stdio\"` so the two channels are distinguishable).\n\n- **Anonymous.** The event carries only the tool name, the package version and —\n  only when `LEXVIBE_APP_ID` is a real app id (a valid UUID) — that app id, so\n  the events map to your app. Placeholders like `your-app-id` are ignored. Never\n  your file paths, file contents, app name, emails or generated documents.\n- **Non-blocking.** It's fire-and-forget with a 3s timeout: it never delays,\n  breaks or fails a tool call, even offline.\n- **Opt-out.** Set `LEXVIBE_TELEMETRY=0` (or the de-facto `DO_NOT_TRACK=1`) to\n  turn it off completely.\n\n> Side effects: `scan_project`, `check_compliance`, `check_website`,\n> `verify_snippet`, `check_ai_act` and `get_claim_status` are read-only\n> (`check_website`, the AI Act check and the claim poll call the LexVibe API;\n> `verify_snippet` fetches the URL you pass it — public http(s) hosts only,\n> with the same anti-SSRF validation the platform uses). `generate_policies` calls the API and returns Markdown.\n> `install_snippet` edits one file on your local filesystem (only when it\n> contains `</head>`). `make_compliant` does both: it calls the API **and**\n> writes files (`/legal/*.md` plus the snippet in your HTML head).\n> `claim_app` creates a pending claim in LexVibe; the app itself is only\n> created when the user confirms the link while signed in.\n",
  "bytes": 11248,
  "sha": "ce2e5de29b285ec726f199d785ac186abf1deb720eb64300fffd2906bdad6f66",
  "repo_slug": "marcosnovo/lexvibe-mcp",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_marcosnovo_lexvibe_f2576ddf/readme"
}