Skip to content
verify mcp Beta VerifyMCP is currently in beta. If you notice any issues, email [email protected] and we’ll put it right.

io.github.marcosnovo/lexvibe

REMOTE · GOLEXVIBE.COM · 2 COMPONENTS · SCANNED AUG 3

One-step legal compliance for vibe-coded apps: privacy, terms, cookie banner and EU AI Act check.

+7 this week 73 Trust /100
Trust breakdown (6 categories)

How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score →

Endpoint Security80
Transport & Reachability100
Schema Quality & AI Usability61
  • AI-judged instruction clarity (excellent).Pass
  • Context-footprint check failed: tool/resource definitions use about 3245 tokens (~324/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
  • Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
  • Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
  • 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
  • 100% of tool parameters carry a description.Pass
Capabilities100
  • Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Install

Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.

remote · golexvibe.com

# add to Claude Code
claude mcp add --transport http marcosnovo-lexvibe https://golexvibe.com/api/mcp
# ~/.codex/config.toml
[mcp_servers.marcosnovo-lexvibe]
url = "https://golexvibe.com/api/mcp"
// opencode.json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "marcosnovo-lexvibe": {
      "type": "remote",
      "url": "https://golexvibe.com/api/mcp",
      "enabled": true
    }
  }
}
# add to OpenClaw
openclaw mcp add marcosnovo-lexvibe --url https://golexvibe.com/api/mcp --transport streamable-http
# ~/.hermes/config.yaml
mcp_servers:
  marcosnovo-lexvibe:
    url: "https://golexvibe.com/api/mcp"
// mcp.json
{
  "mcpServers": {
    "marcosnovo-lexvibe": {
      "type": "http",
      "url": "https://golexvibe.com/api/mcp"
    }
  }
}

The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.

Changelog

Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.

  • 3 Aug 26 0
    • “claim_app” added an optional parameter “aiAct” cosmetic

    1 cosmetic change on this day. Switch on “Show cosmetic changes” to see it.

  • 2 Aug 26 +1

    No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

  • 1 Aug 26 +3
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 31 Jul 26 +1
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 30 Jul 26 +1
    • The server rewrote its instructions, which are the text every model session reads security
    • Schema quality: 282 → 319 functional
    • Schema quality: 282 → 316 functional
    • Schema quality: 282 → 347 functional
    • Server version: 0.1.8 → 0.1.9 functional
    • New tool “applicable_frameworks” functional
    • New tool “list_frameworks” functional
    • New tool “lookup_framework” functional
    • “claim_app” reworded the description of “url” cosmetic
    • “claim_app” reworded the description of “markets” cosmetic
  • 29 Jul 26 +1
    • Server version: 0.1.7 → 0.1.8 functional
  • 27 Jul 26 +1
    • We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
  • 26 Jul 26 65

    First indexed and scored.

Diagnostics

Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.

Captured 3 Aug 2026 · Probed https://golexvibe.com/api/mcp

TLS valid

Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .

Subject Issuer Valid from Valid until Key Signature Serial
CN=golexvibe.com CN=YR2,O=Let's Encrypt,C=US 2 Jul 2026 30 Sept 2026 RSA 2048 SHA256-RSA 534b80e255889d6f78f91e621ce3a53b4ae
SANs: golexvibe.com
CN=YR2,O=Let's Encrypt,C=US (CA) CN=Root YR,O=ISRG,C=US 3 Sept 2025 2 Sept 2028 RSA 2048 SHA256-RSA 4ebd24947e24d394802d84a52fd5b319
CN=Root YR,O=ISRG,C=US (CA) CN=ISRG Root X1,O=Internet Security Research Group,C=US 13 May 2026 2 Sept 2032 RSA 4096 SHA256-RSA f24b6d17f9d9ad7cb1c9fea78782699f
DNSSEC insecure

Validation of golexvibe.com. Not signed

Zone DS Keys Algorithms Outcome
. trust_anchor 20326, 38696 8, 8 Verified
com. present 19718 13 Verified
golexvibe.com. absent Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation
Authentication No authorisation required

The endpoint answered without asking for a token. Anyone who knows the URL can reach it.

Result No authorisation required
HTTP status 200
Header Value
strict-transport-security max-age=63072000; includeSubDomains
x-content-type-options nosniff
x-frame-options DENY
referrer-policy strict-origin-when-cross-origin
Transports 2 probes
Transport URL Outcome Status Location
streamable-http https://golexvibe.com/api/mcp Verified 200
http (plaintext) http://golexvibe.com/api/mcp HTTPS enforced 308 https://golexvibe.com/api/mcp
MCP tools — 10 exposed · ~2,886 tokens

The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.

Tool Tokens
applicable_frameworks ~128

Given the markets a product serves, return every framework that applies, the documents it must publish, the strictest cookie-consent regime across those markets, and whether a universal opt-out signal (Global Privacy Control) has to be honoured. This is the read-only version of what generate_policies uses internally, so the answer matches the documents LexVibe would actually produce. Use it to answer 'I sell to the EU and Texas — what do I need?'. Read-only, instant.

NameTypeReqDescription
marketsarrayyesMarkets the product serves, e.g. ["eu", "us"].

No output schema declared.

No examples provided.

check_ai_act ~954

Classify a product's risk level under the EU AI Act — minimal, limited, high or prohibited — and return the applicable obligations, each with its compliance deadline (limited-risk transparency duties apply from Aug 2, 2026; Annex III high risk from Dec 2, 2027). The boolean parameters fall into three groups, all optional and defaulting to the safest 'not applicable' value: (1) transparency triggers — usesAI, interactsWithPeople, generatesContent, automatedDecisions; (2) the eight prohibited practices of art. 5 — socialScoring, realtimeBiometricPublic + realtimeBiometricLawEnforcement, emotionRecognitionWorkEducation, biometricCategorisationSensitive, untargetedFaceScraping, manipulativeOrExploitative, individualPredictivePolicing; (3) high-risk triggers — embeddedInRegulatedProduct, annexIII domains. Answer the boolean questions about what the system does; leave unknowns at their defaults, which never over-report risk. Read-only and instant.

NameTypeReqDescription
annexIIIarrayAnnex III high-risk domains that apply. Only these exact values count; anything else is not Annex III and must be left out.
automatedDecisionsbooleanDoes it make automated decisions with legal or similarly significant effects on people (credit, hiring, admissions…)? Adds GDPR art. 22 duties; high risk only if an Annex III domain applies.
biometricCategorisationSensitivebooleanDoes it use biometric data (face, voice, gait…) to infer sensitive attributes — race, political opinion, religion, trade-union membership, sexual orientation (art. 5.1.g)? Prohibited. Ordinary face-u…
embeddedInRegulatedProductbooleanIs the AI a safety component embedded in an Annex I regulated product (toys, machinery, medical devices…)? High risk via art. 6.1, deadline Aug 2, 2028.
emotionRecognitionWorkEducationbooleanDoes it infer emotions (frustration, attention, mood…) from employees at work or students in education, e.g. to flag disengaged staff or bored students (art. 5.1.f)? Prohibited. Emotion inference on…
generatesContentbooleanDoes it generate text, images, audio or video shown to users? Triggers the art. 50 duty to label AI-generated content.
individualPredictivePolicingbooleanPredicting an individual's criminal risk based solely on profiling or personality traits (art. 5.1.d)? Prohibited.
interactsWithPeoplebooleanDo people interact directly with the AI (chatbot, voice assistant…)? Triggers the art. 50 duty to disclose they are talking to an AI.
manipulativeOrExploitativebooleanDoes it use subliminal techniques beyond a person's consciousness, or exploit a known vulnerability (age, disability, specific social or economic situation) to materially distort behavior and cause h…
realtimeBiometricLawEnforcementbooleanOnly if realtimeBiometricPublic: is it used FOR LAW ENFORCEMENT purposes? That combination is prohibited under art. 5.1.h and already in force; any other use of public real-time biometric ID is high…
realtimeBiometricPublicbooleanReal-time remote biometric identification in publicly accessible spaces (e.g. live face recognition)? High risk (Annex III biometrics) — prohibited only when combined with realtimeBiometricLawEnforce…
socialScoringbooleanDoes it score people's social behavior or traits causing detrimental treatment in unrelated contexts, or disproportionate to the behavior (art. 5.1.c)? Prohibited. A seller rating or fitness points a…
untargetedFaceScrapingbooleanDoes it untargetedly scrape facial images from the internet or CCTV footage to build or expand a face-recognition database (art. 5.1.e)? Prohibited. Matching a user's own consented selfie against the…
usesAIbooleanDoes the product use AI at all (LLM calls, recommendations, computer vision…)? false ⇒ minimal risk, the AI Act does not apply.

No output schema declared.

No examples provided.

check_store ~131

Free legal-compliance check of a mobile app from its PUBLIC App Store (apps.apple.com) or Google Play (play.google.com) listing URL — no repo or developer-account access needed. Follows the privacy-policy link the developer declared on the listing, analyzes that page, and returns detected data processing, compliance recommendations, whether the EU AI Act applies, and suggestedAnswers for generate_policies. Read-only.

NameTypeReqDescription
urlstringyesApp Store or Google Play listing URL, e.g. https://apps.apple.com/app/id123456789 or https://play.google.com/store/apps/details?id=com.example.app.

No output schema declared.

No examples provided.

check_website ~358

Free legal-compliance check of a public website (no signup). Fetches the URL server-side and detects data processing relevant to compliance — analytics, marketing pixels, payments, generative AI, email collection, third-party sharing — then returns the legal documents and cookie-consent setup the site needs, whether the EU AI Act applies, and suggestedAnswers you can pass straight to generate_policies. Result contract: `fetched` is true only when the page HTML was actually read; when false, `fetchError` says why ("unreachable": the URL could not be resolved or connected; "blocked": the server answered with an error status) and the detected signals are NOT meaningful — report the check as inconclusive, not as clean. Run it again after adding any SDK, analytics, payment, auth or AI integration: when an appId is passed (or read from the installed LexVibe snippet) the result ALWAYS includes a `drift` key — status "in_sync", "outdated" (listing processing the hosted legal documents don't cover yet) or "unavailable" with a bounded `reason` (no-database, app-not-found, no-baseline, domain-mismatch, page-not-fetched) when the comparison could not be made; treat "unavailable" as unknown, never as in sync. Read-only.

NameTypeReqDescription
appIdstringOptional LexVibe app id of a claimed app. When provided (or when the page already carries the installed LexVibe snippet), the result includes a drift report comparing the current site against the bas…
urlstringyesWebsite URL or bare domain, e.g. https://myapp.com or myapp.com.

No output schema declared.

No examples provided.

claim_app ~422

Create a REAL LexVibe app in the user's account (replaces any YOUR_APP_ID placeholder). Returns a claim link: show it to the user so they can sign in and confirm — the link expires in 30 minutes. On confirmation LexVibe creates the app, scans the URL (if given), generates and hosts the legal documents. After the user confirms, call get_claim_status with the returned code to retrieve the real app id and install snippet. Provide at least `url` or `appName`.

NameTypeReqDescription
aiActobjectIf you already ran check_ai_act for this product, pass the SAME answers object here. The EU AI Act classification is then saved against the app on confirmation and shown in the user's dashboard, inst…
answersobjectCompliance flags you already know (pass check_website's suggestedAnswers): usesAnalytics, processesPayments, usesGenerativeAI, collectsEmails, sharesWithThirdParties, platformType, companyEntity, con…
appNamestringApp / business name (required if no url is provided).
marketsarrayRegions where the app has users; each market pack cites its own frameworks: eu → GDPR/ePrivacy, uk → UK GDPR/PECR, us → CCPA/CPRA, ca → PIPEDA, latam → LGPD…; 'global' is NOT a union of the others —…
platformstringTarget platform when there is no url to infer it from.
urlstringPublic URL of the app: a website URL, or an App Store / Google Play listing URL for a mobile-only product. LexVibe scans whichever kind is provided on confirmation. If you don't have a listing URL ye…

No output schema declared.

No examples provided.

generate_policies ~250

Generate the legal documents (privacy policy, terms of service and, if applicable, an AI disclosure) localized and tailored to the target markets (GDPR, UK GDPR, CCPA…). Returns Markdown drafts. Pass check_website's or check_store's suggestedAnswers as `answers` so the documents disclose the right processing. Anonymous remote generation is template-based and capped at 3 locales; AI-tailored, hosted and auto-updated documents require a LexVibe account (https://golexvibe.com).

NameTypeReqDescription
answersobjectCompliance flags; pass check_website's suggestedAnswers. Recognized keys: usesAnalytics, processesPayments, usesGenerativeAI, collectsEmails, sharesWithThirdParties, platformType.
appNamestringyesPublic / commercial name of the product.
contactEmailstringContact email for privacy requests and data-subject rights.
entitystringData controller / legal entity responsible for the app.
localesarrayDocument languages (max 3 for anonymous callers). Defaults to the languages suggested by the chosen markets.
marketsarrayyesRegions where the app has users; determines the legal frameworks covered.

No output schema declared.

No examples provided.

get_claim_status ~100

Check whether the user has confirmed a claim created with claim_app. While the user hasn't confirmed yet it returns {status: 'pending'} — wait a few seconds and call again (the link expires in 30 minutes). Once claimed it returns the REAL app id, the install snippet and the hosted privacy-policy URL: replace any placeholder (YOUR_APP_ID) snippet with the real one.

NameTypeReqDescription
codestringyesThe claim code returned by claim_app.

No output schema declared.

No examples provided.

get_install_snippet ~158

Return what to install for a LexVibe app id. For web: the one-line <script> snippet (cookie banner with real script blocking + hosted policy links) to paste before </head>, plus a JSX variant for React/Next.js layouts. For iOS/Android: the hosted privacy-policy URL and the exact App Store Connect / Google Play Console fields to paste it into. No app id yet? Call claim_app to create one in the user's account.

NameTypeReqDescription
accentstringOptional brand color for the banner, as a hex value like #4f46e5.
appIdstringyesLexVibe app id from the dashboard.
platformstringTarget platform. Defaults to web.

No output schema declared.

No examples provided.

list_frameworks ~202

List every privacy and AI framework LexVibe generates documents against — 60 laws across 60+ jurisdictions, including GDPR, ePrivacy, the EU AI Act, UK GDPR and PECR, Swiss nFADP, CCPA/CPRA and 18 US state privacy laws modelled individually, PIPEDA and Quebec Law 25, LGPD and other LatAm regimes, APPI, PIPA, PDPA, Australia's Privacy Act, India's DPDP, China's PIPL, Saudi and UAE PDPL, POPIA and more. Each entry carries its id, jurisdiction, effective date and official-text URL. Optionally filter by market pack or by jurisdiction. Read-only, instant.

NameTypeReqDescription
jurisdictionstringOptional jurisdiction id to filter by, e.g. "us-tx", "br", "eu".
marketstringOptional market pack to filter by (eu, uk, us, latam, apac…).

No output schema declared.

No examples provided.

lookup_framework ~183

Look up a privacy or AI law by id and get structured, primary-sourced facts: full name, jurisdiction, effective date, applicability threshold, the documents it requires, the rights it grants, its cookie-consent regime, whether it requires honouring Global Privacy Control, key articles, and a link to the OFFICIAL text (plus the supervisory authority). Use it to answer 'what does the TDPSA require?' or 'when does the EU AI Act apply?' with citations instead of guesses. Call list_frameworks first if you don't know the id. Read-only, instant, no signup.

NameTypeReqDescription
idstringyesFramework id, e.g. "gdpr", "eu-ai-act", "ccpa", "tdpsa", "lgpd", "pipl", "dpdp", "popia". Get the full list from list_frameworks.

No output schema declared.

No examples provided.