Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, get in touch and we’ll put it right.

io.github.AshMet/vibemap-mcp

NPM · @VIBEMAP.AI/MCP-SERVER · SCANNED SEP 30

Load & create VibeMap product specs from your coding agent; sync build progress.

0 this week 83 Trust /100
Trust breakdown (7 categories)

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →

Supply Chain Security98
  • No malware found by supply-chain analysis.Pass
  • No known CVEs affecting this package version or its production dependencies.Pass
  • No install/post-install scripts declared.Pass
  • 35 of 98 dependencies flagged as unhealthy (1 deprecated). View diagnostics → Partial
Provenance & Transparency45
Schema Quality & AI Usability86
  • 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).Pass
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 3820 tokens (~109/item across 35 items; 35 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management87
  • Stability observed for 26 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage81
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 43% of tool parameters carry a description.Partial
Tool Safety100
  • No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
  • We read all 35 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
  • An AI judge read all 35 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

How do I install the io.github.AshMet/vibemap-mcp server?

io.github.AshMet/vibemap-mcp runs locally as an npm package, launched with npx -y @vibemap.ai/mcp-server. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

npm · @vibemap.ai/mcp-server

# add to Claude Code
claude mcp add ashmet-vibemap-mcp -- npx -y @vibemap.ai/mcp-server
// .cursor/mcp.json
{
  "mcpServers": {
    "ashmet-vibemap-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@vibemap.ai/mcp-server"
      ]
    }
  }
}
// .vscode/mcp.json
{
  "servers": {
    "ashmet-vibemap-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@vibemap.ai/mcp-server"
      ]
    }
  }
}
# add to Codex CLI
codex mcp add ashmet-vibemap-mcp -- npx -y @vibemap.ai/mcp-server
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "ashmet-vibemap-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@vibemap.ai/mcp-server"
      ],
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add ashmet-vibemap-mcp --command npx --arg -y --arg @vibemap.ai/mcp-server
# ~/.hermes/config.yaml
mcp_servers:
  ashmet-vibemap-mcp:
    command: "npx"
    args: ["-y", "@vibemap.ai/mcp-server"]
// ~/.netclaw/config/netclaw.json
{
  "McpServers": {
    "ashmet-vibemap-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "@vibemap.ai/mcp-server"
      ]
    }
  }
}
# add to Vellum
assistant mcp add ashmet-vibemap-mcp -t stdio -c npx -a -y @vibemap.ai/mcp-server
// mcp.json
{
  "mcpServers": {
    "ashmet-vibemap-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@vibemap.ai/mcp-server"
      ]
    }
  }
}
Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 30 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

  • 28 Sept 26 −2
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 27 Sept 26 0
    • Stability: 0.97 → pass security
  • 26 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 93 to 97. That category is still filling its 30-day observation window: 28 days of observed history at the previous scan, 29 at this one. The score rises as the window fills, whether or not the server changes.

  • 25 Sept 26 0
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 23 Sept 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 83 to 87. That category is still filling its 30-day observation window: 25 days of observed history at the previous scan, 26 at this one. The score rises as the window fills, whether or not the server changes.

  • 21 Sept 26 −2
    • Stability: pass → 0.80 functional
  • 20 Sept 26 0
    • Stability: 0.97 → pass security
Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 30 Sept 2026 · Analysed npm/@vibemap.ai/mcp-server@2.8.1

Provenance No attestation

The registry publishes no build provenance for this version, so there is nothing to verify.

Result No attestation
Ecosystem npm

Background: How many MCP packages publish verified provenance →

Dependencies 98 packages
Packages resolved 98
Deprecated 1
Stale 34
Tree resolution Complete

Background: SBOMs and build attestations, explained →

MCP tools · 35 exposed · ~3,820 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →

Tool Tokens
vibemap_analyze_codebase ~146

Scan a local codebase and submit it to VibeMap for AI-powered reverse engineering. The server-side generation persists FEATURES from the code digest. It does NOT persist user stories or acceptance criteria — after the features task completes (poll vibemap_get_generation_status), create those yourself with vibemap_create_user_story and vibemap_create_acceptance_criterion, using your full codebase access for accuracy. Returns a sessionId to poll.

NameTypeReqDescription
depthnumber––
localPathstringyesAbsolute path to the local project directory
projectIdstringyesThe VibeMap project to populate with discovered specs
taskTitlestring––

No output schema declared.

No examples provided.

vibemap_block_criterion ~70

Mark a criterion as blocked. Transitions any-active-status → blocked. Use this when external dependency, ambiguity, or environmental issue prevents progress.

NameTypeReqDescription
categorystringyes–
criterionIdstringyes–
reasonstringyesHuman-readable explanation (1-2000 chars)

No output schema declared.

No examples provided.

vibemap_claim_criterion ~51

Atomically claim an acceptance criterion for implementation. Transitions ready → in_progress. Returns 409 (race) if another agent already claimed it.

NameTypeReqDescription
criterionIdstringyesAcceptance criterion UUID

No output schema declared.

No examples provided.

vibemap_create_acceptance_criterion ~160

Create a new acceptance criterion for a user story in BDD format (Given/When/Then). Use this to flesh out what 'done' means for a story before or during implementation. You can call this multiple times to add multiple scenarios (happy path, error cases, edge cases) to the same story.

NameTypeReqDescription
descriptionstring–Optional plain-text summary
givenConditionstringyesPrecondition / context ('Given …')
scenarioCategorystring––
statusstring––
storyIdstringyesID of the user story this criterion belongs to
thenOutcomestringyesExpected result ('Then …')
whenActionstringyesAction performed ('When …')

No output schema declared.

No examples provided.

vibemap_create_feature ~93

Create a new feature in a VibeMap project. Use this when reverse-engineering a codebase to register discovered capabilities.

NameTypeReqDescription
business_valuestring––
categorystring––
complexitystring––
descriptionstring––
effortstring––
namestringyes–
prioritystring––
projectIdstringyes–

No output schema declared.

No examples provided.

vibemap_create_page ~115

Create a page/screen in a VibeMap project's page inventory. Author pages after features, stories, and criteria to capture the app's screens and routes. Existing pages are visible via vibemap_get_project_context — enrich, don't duplicate.

NameTypeReqDescription
descriptionstring–What this page is for
namestringyesPage name (e.g. 'Dashboard')
pathstring–Route path (e.g. '/dashboard')
projectIdstringyes–
statusstring––

No output schema declared.

No examples provided.

vibemap_create_persona ~261

Create a user persona in a VibeMap project. Personas are the cast of users the spec is written for — author them FIRST, then reference each persona's role (userRole) when writing user stories. Match the depth VibeMap's own generator produces: fill the structured blocks so the persona is rich and semantically searchable, not just a name. Existing personas are visible via vibemap_get_project_context — enrich, don't duplicate. All params are camelCase.

NameTypeReqDescription
avatarDescriptionstring–Brief visual description
communicationPreferencesobject–How to reach them
demographicsobject–Who they are
goalsAndNeedsobject–What they are trying to achieve
namestringyesPersona's first name
narrativeobject–Their voice
painPointsobject–What frustrates or blocks them
productSpecificobject–How they relate to this product
projectIdstringyes–
psychographicsobject–What drives them
taglinestring–Brief one-line descriptor
userRolestring–Canonical role this persona represents (e.g. 'admin', 'diver'). User stories reference this role.

No output schema declared.

No examples provided.

vibemap_create_project ~85

Create a new VibeMap project. Use this when starting from an existing codebase — create the project first, then call vibemap_analyze_codebase with the returned project ID.

NameTypeReqDescription
descriptionstringyesDetailed project description (50+ characters). The more detail, the better the AI analysis.
namestringyesProject name (3-100 characters)

No output schema declared.

No examples provided.

vibemap_create_schema ~240

Persist a VibeMap project's database schema — tables, columns, and relationships — in one call. Author this LAST, after the rest of the spec exists, grounded on the spec (idea-first) or the codebase's models/migrations (code-first). One table per domain entity; give every table an `id` primary key and created_at/updated_at; set real Postgres column types + constraints; express foreign keys via each column's `foreignKey` (relationships auto-derive from these, so `relationships` is optional); add junction tables for many-to-many. All params are camelCase (this IS VibeMap's SchemaJSON). Existing schema is visible via vibemap_get_project_context (dbSchema) — the server keyed-reconciles, so re-running is safe. Table/page access rules are handled by the separate access-rules flow, not here.

NameTypeReqDescription
projectIdstringyes–
relationshipsarray–Optional — foreign keys on columns auto-derive relationships. Provide only for relationships not expressed by a column FK.
tablesarrayyesOne entry per table (snake_case, plural names).

No output schema declared.

No examples provided.

vibemap_create_user_story ~118

Create a new user story inside a VibeMap feature. Provide the user role, action, and expected outcome.

NameTypeReqDescription
descriptionstringyes–
estimatedEffortnumber––
featureIdstringyes–
iWantTostring–What the user wants to do
prioritystring––
soThatstring–The benefit / outcome
titlestringyes–
userRolestring–e.g., 'admin', 'developer', 'guest'

No output schema declared.

No examples provided.

vibemap_get_atomic_blueprint ~95

Retrieve a code-shaped atomic blueprint of a VibeMap project — relationships hydrated, Kanban metadata stripped, with synthesized interactions and entity state machines. Designed for LLM coders building the application end-to-end. Prefer this over vibemap_get_project_context when generating code; the blueprint omits PM narrative and process metadata to maximise signal-per-token.

NameTypeReqDescription
projectIdstringyesThe VibeMap project ID

No output schema declared.

No examples provided.

vibemap_get_code_map ~59

Fetch the project's current code map (status draft|confirmed, nodes/edges, sync anchor incl. any drift report). Use before re-submitting to preserve the user's hidden-node curation where possible.

NameTypeReqDescription
projectIdstringyes–

No output schema declared.

No examples provided.

vibemap_get_generation_status ~62

Poll the status of a VibeMap AI generation task (e.g., reverse engineering or spec generation). Use the sessionId returned by vibemap_analyze_codebase.

NameTypeReqDescription
sessionIdstringyesSession ID from vibemap_analyze_codebase

No output schema declared.

No examples provided.

vibemap_get_kanban_board ~75

Get a real-time kanban board view of a project grouped by status columns. Shows features with their stories nested underneath. Ideal for an IDE agent to understand what's planned, in progress, and done.

NameTypeReqDescription
includeCriteriaboolean–Include acceptance criteria counts per story
projectIdstringyes–

No output schema declared.

No examples provided.

vibemap_get_next_ready_criterion ~55

Get the highest-priority acceptance criterion in `ready` status for the given project. Returns the criterion to work on next, or null if nothing is ready.

NameTypeReqDescription
projectIdstringyesProject UUID

No output schema declared.

No examples provided.

vibemap_get_page_source ~92

Retrieve a VibeMap page's generated source code so you can pull it straight into a repo. Returns the page's own source_code plus the source_code of each of its sections. Use this to export a generated page into your codebase instead of copy-pasting.

NameTypeReqDescription
pageIdstringyesThe page ID to export
projectIdstringyesThe VibeMap project ID

No output schema declared.

No examples provided.

vibemap_get_project_context ~102

Retrieve the full context of a VibeMap project including features, user stories, personas, pages, and database schema. Use this before building a feature to understand all the specs.

NameTypeReqDescription
includeFeaturesboolean––
includePagesboolean––
includePersonasboolean––
includeSchemaboolean––
includeStoriesboolean––
projectIdstringyesThe VibeMap project ID

No output schema declared.

No examples provided.

vibemap_list_acceptance_criteria ~86

List acceptance criteria for a story, feature, or project. Returns BDD-formatted criteria (Given/When/Then) with status.

NameTypeReqDescription
featureIdstring––
limitnumber––
offsetnumber––
projectIdstring––
statusstring––
storyIdstring––

No output schema declared.

No examples provided.

vibemap_list_access_rules ~124

List a VibeMap project's access-control rules: table-level rules (per persona/role, with can_select/insert/update/delete and structured op_conditions predicates like "own rows only") and page-level rules (can_view/create_content/edit/delete with predicates), plus an advisory reconciliation summary flagging page↔table drift. Use this to generate correct RLS policies and route/UI authorization — the atomic blueprint only carries page-level conditions, so call this for table-level (RLS) access control.

NameTypeReqDescription
projectIdstringyesThe VibeMap project ID

No output schema declared.

No examples provided.

vibemap_list_changesets ~151

List a VibeMap project's version-control changesets (most recent first) with a per-changeset op count. Every write you make through this server is wrapped in a changeset, so use this to see the changesets your own edits produced, audit who/what changed the project, or review recent edit history. Pass includeOps=true to inline each changeset's individual operations (entity_type, op, diff).

NameTypeReqDescription
includeOpsboolean–Inline each changeset's individual ops + diffs (default false)
limitnumber–Max changesets to return (1-200, default 50)
projectIdstringyesThe VibeMap project ID

No output schema declared.

No examples provided.

vibemap_list_features ~86

List features for a VibeMap project. Supports filtering by status, priority, category, and search. Returns paginated results.

NameTypeReqDescription
categorystring––
limitnumber––
offsetnumber––
prioritystring––
projectIdstringyes–
searchstring––
statusstring––

No output schema declared.

No examples provided.

vibemap_list_kanban_events ~87

List kanban transition events for a project, newest first. Use `since` to fetch only events after a timestamp (for reconnect-backfill).

NameTypeReqDescription
limitnumber–Max events to return (default 200, max 1000)
projectIdstringyes–
sincestring–ISO timestamp; only events strictly after this are returned

No output schema declared.

No examples provided.

vibemap_list_projects ~32

List all VibeMap projects for the authenticated user. Returns project IDs, names, descriptions, and status.

Input schema present but exposes no named parameters.

No output schema declared.

No examples provided.

vibemap_list_user_stories ~102

List user stories for a project or feature. Filter by status, priority. Returns paginated results with full story detail.

NameTypeReqDescription
featureIdstring–Filter by specific feature
limitnumber––
offsetnumber––
prioritystring––
projectIdstring–Filter by project (use featureId for more specific results)
searchstring––
statusstring––

No output schema declared.

No examples provided.

vibemap_report_progress ~55

Append a progress event to the criterion timeline without changing its status. Used to surface intermediate work for visibility.

NameTypeReqDescription
criterionIdstringyes–
summarystringyesShort progress note (1-2000 chars)

No output schema declared.

No examples provided.

vibemap_resolve_review ~93

Resolve a criterion in review. Transitions in_review → passed | failed. NOTE: agents (env_token:agent) cannot self-resolve their own work — this tool requires a CI-scoped token (env_token:ci) or a session user.

NameTypeReqDescription
criterionIdstringyes–
notesstring––
outcomestringyes–
testRunUrlstring––

No output schema declared.

No examples provided.

vibemap_scan_codebase ~69

Scan a local directory and return a formatted tree view plus file statistics. Use this to explore and understand an existing codebase before syncing to VibeMap.

NameTypeReqDescription
depthnumber–Max directory depth to traverse
localPathstringyesAbsolute path to the local project directory

No output schema declared.

No examples provided.

vibemap_submit_code_map ~234

Submit a structural code map of the user's codebase to VibeMap (rendered on the project's Codebase tab). Build it yourself from your codebase access: one node per meaningful unit (page/route, API endpoint, data model, service, module, config), edges for imports/routes/reads/writes. Node kinds: page|api|model|service|module|config. Layers: ui|api|data|services|shared. Edge kinds: imports|routes|reads|writes. Use repo-relative paths as node ids. Max 500 nodes — aggregate small files into their module. Re-submitting replaces the project's map and resets it to draft for the user to re-confirm.

NameTypeReqDescription
anchorobject–Optional sync anchor: { commitSha?, scannedAt? } (git rev-parse HEAD)
mapobjectyes{ nodes: [{id,label,kind,path,layer,summary?}], edges: [{source,target,kind}], stats?: {totalFiles,scannedAt} }
projectIdstringyesVibeMap project to attach the map to

No output schema declared.

No examples provided.

vibemap_submit_for_review ~95

Submit completed work for review. Transitions in_progress → in_review. Requires a git SHA and a diff URL as evidence.

NameTypeReqDescription
criterionIdstringyes–
diffUrlstringyesURL to view the diff (PR link or compare URL)
gitShastringyes7+ char commit SHA
notesstring–Optional notes for the reviewer (max 2000 chars)

No output schema declared.

No examples provided.

vibemap_sync_changes ~200

Report codebase changes since the last sync so VibeMap can flag spec drift. Workflow: 1) call vibemap_get_code_map and read anchor.commitSha; 2) run `git diff --name-only <commitSha>..HEAD` (plus untracked files from `git status --porcelain`); 3) call this tool with the changed paths and your current HEAD sha. The response lists affected map units and features — update the stale specs with vibemap_update_feature / vibemap_update_user_story / vibemap_update_acceptance_criterion (all changeset-audited), then re-submit the code map with vibemap_submit_code_map to clear the drift.

NameTypeReqDescription
changedFilesarrayyesRepo-relative paths changed since anchor.commitSha (max 2000)
headShastring–Current HEAD commit sha (git rev-parse HEAD)
projectIdstringyesVibeMap project id

No output schema declared.

No examples provided.

vibemap_unblock_criterion ~61

Unblock a criterion. Transitions blocked → prior_status (recorded when block was set; defaults to ready).

NameTypeReqDescription
criterionIdstringyes–
resolutionstringyesHow the blocker was resolved (1-2000 chars)

No output schema declared.

No examples provided.

vibemap_update_acceptance_criterion ~96

Update an acceptance criterion's status or content. Use status 'passed' when your code satisfies the criterion, 'failed' when it does not.

NameTypeReqDescription
criterionIdstringyes–
descriptionstring––
givenConditionstring––
scenarioCategorystring––
statusstring––
thenOutcomestring––
whenActionstring––

No output schema declared.

No examples provided.

vibemap_update_feature ~88

Update an existing feature's fields or status in VibeMap.

NameTypeReqDescription
business_valuestring––
categorystring––
complexitystring––
descriptionstring––
effortstring––
featureIdstringyes–
namestring––
prioritystring––
statusstring––

No output schema declared.

No examples provided.

vibemap_update_kanban_status ~187

[DEPRECATED — use the typed transition tools (claim, report_progress, submit_for_review, resolve_review, block, unblock) instead. This tool will be removed in a future release.] Atomically advance or update the kanban status of a feature, user story, or acceptance criterion. Validates allowed state transitions and prevents invalid moves. Call this when you start or finish implementing something. Feature stages: draft → open → in_progress → completed Story stages: draft → has_criteria → open → in_progress → completed Criterion stages: draft → pending → passed | failed

NameTypeReqDescription
entityIdstringyesID of the feature, story, or criterion
entityTypestringyesType of item to update
newStatusstringyesTarget kanban status
notesstring–Optional context about why this transition was made

No output schema declared.

No examples provided.

vibemap_update_user_story ~95

Update an existing user story's fields or status in VibeMap.

NameTypeReqDescription
descriptionstring––
estimatedEffortnumber––
iWantTostring––
prioritystring––
soThatstring––
statusstring––
storyIdstringyes–
titlestring––
userRolestring––

No output schema declared.

No examples provided.

Common questions

What is the io.github.AshMet/vibemap-mcp server?

io.github.AshMet/vibemap-mcp is listed in the public MCP registry as io.github.AshMet/vibemap-mcp. Load & create VibeMap product specs from your coding agent; sync build progress. This page covers its npm package (@vibemap.ai/mcp-server).

Is the io.github.AshMet/vibemap-mcp server safe to use?

io.github.AshMet/vibemap-mcp scores 83 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 30 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

What tools does the io.github.AshMet/vibemap-mcp server expose?

io.github.AshMet/vibemap-mcp exposes 35 tools: vibemap_list_projects, vibemap_create_project, vibemap_get_project_context, vibemap_get_atomic_blueprint, vibemap_list_access_rules, and 30 more. Their descriptions and schemas cost roughly 3,820 tokens of context every time the server is loaded.

Is the io.github.AshMet/vibemap-mcp server still maintained?

io.github.AshMet/vibemap-mcp is still listed as active in the MCP registry. We last reached this channel on 30 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

What licence is the io.github.AshMet/vibemap-mcp server under?

io.github.AshMet/vibemap-mcp declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.