# io.github.marcosnovo/lexvibe (npm · @lexvibe/mcp)

One-step legal compliance for vibe-coded apps: privacy, terms, cookie banner and EU AI Act check.

- Trust score: 65/100 (medium)
- Change this week: +59
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- remote · `golexvibe.com`: 73/100, [markdown](https://verifymcp.io/servers/marcosnovo-lexvibe/api-mcp.md), [page](https://verifymcp.io/servers/marcosnovo-lexvibe/api-mcp)
- npm · `@lexvibe/mcp`: 65/100 (this document), [markdown](https://verifymcp.io/servers/marcosnovo-lexvibe/lexvibe-mcp.md), [page](https://verifymcp.io/servers/marcosnovo-lexvibe/lexvibe-mcp)

## Channel facts

- Registry: `npm`
- Package: `@lexvibe/mcp`
- Version: `1.0.3`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 3 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 56/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 4170 tokens (~417/item across 10 items; 10 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 23/100
  - Stability observed for 7 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add marcosnovo-lexvibe -- npx -y @lexvibe/mcp
```

### Codex

```bash
codex mcp add marcosnovo-lexvibe -- npx -y @lexvibe/mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "marcosnovo-lexvibe": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@lexvibe/mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add marcosnovo-lexvibe --command npx --arg -y --arg @lexvibe/mcp
```

### Hermes

```yaml
mcp_servers:
  marcosnovo-lexvibe:
    command: "npx"
    args: ["-y", "@lexvibe/mcp"]
```

### Other

```json
{
  "mcpServers": {
    "marcosnovo-lexvibe": {
      "command": "npx",
      "args": [
        "-y",
        "@lexvibe/mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-03 (score 65, +1)

No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-02 (score 64, +22)

- [security regression] Provenance: fail → unverified
- [security regression] Install scripts: pass → unverified
- [security regression] Stability: 0.17 → unverified
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [functional regression] Maintenance: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] License: pass → unverified
- [functional regression] Capabilities: pass → unverified
- [functional improvement] Dependency health: unverified → partial
- [functional] Licence: MIT

### 2026-08-01 (score 42, +1)

No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-07-31 (score 41, +35)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-30 (score 6, 0)

- [functional regression] Security disclosure: fail → unverified
- [functional improvement] Tool coverage: unverified → 100
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: fail
- [functional] First check of Tool coverage: 66
- [functional] First check of Schema quality: unverified
- [functional] Package version: 0.1.8 → 1.0.3
- [functional] Package version: 0.1.8 → 1.0.2

### 2026-07-27 (score 6)

First indexed and scored.

## MCP tools (10)

### `scan_project` (~220 tokens)

Read-only scan of a local project (dependencies + source code + mobile manifests). Detects data processing relevant to legal compliance — analytics, payments, generative AI (distinguishing user-facing AI from server-side-only AI), email collection, third-party sharing — and returns {signals, suggestedAnswers, facts, locales, platforms}: per-vendor `signals`, compliance flags in `suggestedAnswers`, structured `facts` (auth methods, payments channel, AI flags, tracking/IDFA, device permissions), the `locales` the app supports and the product platforms (web / iOS / Android). Run it first: pass suggestedAnswers to generate_policies, and `facts`, `locales` and `signals` to claim_app so the generated documents are anchored in evidence. Never modifies files; errors if `dir` does not exist or is not a project root. For a deployed site whose code you don't have, use check_website instead.

Input parameters:

- `dir` (string, required): Path of the project root to analyze (absolute paths are safest).

### `check_compliance` (~295 tokens)

Read-only compliance readiness check. Run this after adding any SDK, analytics, payment, auth or AI integration — it detects processing activities your legal documents don't cover yet. It scans the project, detects platforms and data processing, auto-derives what it can (app name, legal entity, contact email) and reports which human facts are still missing (including target markets). Returns {platforms, detected, derived, provided, missing, ready, agentPrompt}: `ready` is true only when no human fact is missing, and `agentPrompt` is a prompt you (the dev agent) can answer from the repo, so document generation needs no forms. Never modifies files; errors if `dir` does not exist or is not a project root. Call it before make_compliant when you want to confirm facts first; re-run it with the answers as arguments until `ready` is true.

Input parameters:

- `appName` (string): Override the auto-derived app name.
- `contactEmail` (string): Privacy contact email, if already known (overrides the derived one).
- `dir` (string, required): Path of the project root to analyze (absolute paths are safest).
- `entity` (string): Data controller / legal entity, if already known (overrides the derived one).
- `markets` (array): Regions where the app has users. Without them `ready` can never be true (markets are a required human fact).

### `generate_policies` (~456 tokens)

Generate the legal documents (privacy policy, terms of service and, if applicable, an AI disclosure) localized and tailored to the target markets' frameworks (GDPR, UK GDPR, CCPA/CPRA, PIPEDA, LGPD…). Returns {documents: [{docType, locale, content, source}]} where content is Markdown and source is 'ai' or 'template' (template ⇒ not yet personalized — tell the user). Documents are returned only, never written to disk (make_compliant writes them to /legal) and nothing is persisted server-side. Run scan_project first and pass its suggestedAnswers as `answers` so the documents disclose the right processing; requires network access to the LexVibe API.

Input parameters:

- `answers` (object): Compliance flags; pass scan_project's suggestedAnswers. Recognized keys: usesAnalytics, processesPayments, usesGenerativeAI, collectsEmails, sharesWithThirdParties, platformType.
- `appName` (string, required): App / business name shown in the documents, e.g. 'Acme Notes'.
- `contactEmail` (string): Privacy contact email published in the documents. If omitted, a [to complete] placeholder is left.
- `entity` (string): Data controller / legal entity (person or company legally responsible), e.g. 'Acme Labs S.L.'. If omitted, the documents keep a [to complete] placeholder.
- `locales` (array): Languages to generate the documents in (ISO 639-1). Defaults to the markets' main languages; anonymous calls are capped at 3 locales. Pass scan_project's `locales` to match the languages the app actu…
- `markets` (array, required): Regions where the app has users (at least one). Each market pack cites its own frameworks: eu → GDPR/ePrivacy, uk → UK GDPR/PECR, us → CCPA/CPRA, ca → PIPEDA, latam → LGPD…; 'global' is NOT a union o…

### `install_snippet` (~370 tokens)

Insert the LexVibe cookie-banner + hosted-policies snippet into an HTML file, right before </head>. By default the banner is themed to match the app's own colors, fonts and radius (detected from its stylesheets). Idempotent: if the snippet is already in the file, nothing changes. If the file has no literal </head> (e.g. a Next.js App Router layout.tsx), it does NOT modify the file: it returns the snippet plus exact instructions for you (the dev agent) to add it as JSX — it never corrupts user files. After deploying, confirm with verify_snippet that the snippet is live.

Input parameters:

- `accent` (string): Banner accent color as a CSS hex value, e.g. #4f46e5. Defaults to the color detected from the app's own styles (see `theme`).
- `appId` (string): LexVibe app id, e.g. from claim_app/get_claim_status (defaults to the LEXVIBE_APP_ID env var; without either, the YOUR_APP_ID placeholder is used and flagged).
- `file` (string, required): Path of the file to install into (index.html, app/layout.tsx…).
- `lang` (string): Force the banner's language as an ISO 639-1 code, e.g. 'en' or 'es' (one of the 12 LexVibe locales). Defaults to the page's own language.
- `position` (string): Where the banner sits on screen: bottom (full-width bar), bottom-left or bottom-right (floating card in that corner). Defaults to bottom.
- `theme` (string): auto (default): match the banner to this app's colors, fonts and radius. off: LexVibe default look.

### `check_ai_act` (~1042 tokens)

Classify a product's risk level under the EU AI Act — minimal, limited, high or prohibited — and return the applicable obligations, each with its compliance deadline (limited-risk transparency duties apply from Aug 2, 2026; Annex III high risk from Dec 2, 2027). The boolean parameters fall into three groups, all optional and defaulting to the safest 'not applicable' value: (1) transparency triggers — usesAI, interactsWithPeople, generatesContent, automatedDecisions; (2) the eight prohibited practices of art. 5 — socialScoring, realtimeBiometricPublic + realtimeBiometricLawEnforcement, emotionRecognitionWorkEducation, biometricCategorisationSensitive, untargetedFaceScraping, manipulativeOrExploitative, individualPredictivePolicing; (3) high-risk triggers — embeddedInRegulatedProduct, annexIII domains. Answer from what you know about the product (scan_project's suggestedAnswers.usesGenerativeAI maps to usesAI + generatesContent); leave unknowns at their defaults, which never over-report risk. Returns {level, headline, explanation, obligations: [{title, description, deadline}]}. Read-only, no signup; requires network access to the LexVibe API (errors return {error} with isError). Use it when the user asks whether the EU AI Act applies to them or after adding an AI feature; make_compliant already includes a basic version of this check.

Input parameters:

- `annexIII` (array): Annex III high-risk domains the system operates in: biometrics, critical (infrastructure), education, employment (HR/hiring), essential (credit, insurance, benefits), law (enforcement), migration, ju…
- `automatedDecisions` (boolean): Does it make automated decisions with legal or similarly significant effects on people (credit, hiring, admissions…)? Adds GDPR art. 22 duties; high risk only if an Annex III domain applies.
- `biometricCategorisationSensitive` (boolean): Does it use biometric data (face, voice, gait…) to infer sensitive attributes — race, political opinion, religion, trade-union membership, sexual orientation (art. 5.1.g)? Prohibited. Ordinary face-u…
- `embeddedInRegulatedProduct` (boolean): Is the AI a safety component embedded in an Annex I regulated product (toys, machinery, medical devices…)? High risk via art. 6.1, deadline Aug 2, 2028.
- `emotionRecognitionWorkEducation` (boolean): Does it infer emotions (frustration, attention, mood…) from employees at work or students in education, e.g. to flag disengaged staff or bored students (art. 5.1.f)? Prohibited. Emotion inference on…
- `generatesContent` (boolean): Does it generate text, images, audio or video shown to users? Triggers the art. 50 duty to label AI-generated content.
- `individualPredictivePolicing` (boolean): Predicting an individual's criminal risk based solely on profiling or personality traits (art. 5.1.d)? Prohibited.
- `interactsWithPeople` (boolean): Do people interact directly with the AI (chatbot, voice assistant…)? Triggers the art. 50 duty to disclose they are talking to an AI.
- `manipulativeOrExploitative` (boolean): Does it use subliminal techniques beyond a person's consciousness, or exploit a known vulnerability (age, disability, specific social or economic situation) to materially distort behavior and cause h…
- `realtimeBiometricLawEnforcement` (boolean): Only if realtimeBiometricPublic: is it used for LAW ENFORCEMENT purposes? That combination is prohibited (art. 5.1.h) and already in force.
- `realtimeBiometricPublic` (boolean): Real-time remote biometric identification in publicly accessible spaces (e.g. live face recognition)? High risk (Annex III biometrics) — prohibited only when combined with realtimeBiometricLawEnforce…
- `socialScoring` (boolean): Does it score people's social behavior or traits causing detrimental treatment in unrelated contexts, or disproportionate to the behavior (art. 5.1.c)? Prohibited. A seller rating or fitness points a…
- `untargetedFaceScraping` (boolean): Does it untargetedly scrape facial images from the internet or CCTV footage to build or expand a face-recognition database (art. 5.1.e)? Prohibited. Matching a user's own consented selfie against the…
- `usesAI` (boolean): Does the product use AI at all (LLM calls, recommendations, computer vision…)? false ⇒ minimal risk, the AI Act does not apply.

### `check_website` (~195 tokens)

Free, no-signup compliance check of a DEPLOYED website by URL (the same public checker as the LexVibe /check page). Fetches the live page server-side and detects tracking/processing that actually ships to visitors — analytics, marketing pixels, payments, generative AI, email capture, third parties. Returns {url, signals: [{signal, vendors}], recommendations: [{id, title, reason}], aiAct} — which documents/banner the site needs and whether the EU AI Act applies. Read-only and rate-limited (a burst of calls returns an error asking to wait a minute). Complements scan_project (which reads the local source): use check_website after deploying, or for a site whose code you don't have.

Input parameters:

- `url` (string, required): Public URL (or bare domain) of the deployed site, e.g. https://myapp.com or myapp.com. Must be publicly reachable.

### `verify_snippet` (~162 tokens)

Verify that the LexVibe cookie-banner snippet is actually LIVE on a deployed site: fetches the public URL and looks for the widget marker in the served HTML. Run it after deploying (install_snippet edits local files — this confirms the change reached production). Only public http(s) hosts are allowed — localhost, private-network and reserved addresses are rejected. Returns {status: 'ok' | 'missing' | 'unknown'}. If 'missing', the snippet was not found: check that the deploy included the change, or re-run install_snippet and deploy again.

Input parameters:

- `url` (string, required): Public URL (or bare domain) of the deployed site to verify, e.g. https://myapp.com or myapp.com. Must be publicly reachable.

### `make_compliant` (~494 tokens)

One-step legal compliance: scan the project, generate privacy policy / terms / cookie & AI disclosures (written as Markdown to <dir>/legal), install the cookie-banner snippet before </head> (web only; skipped for native apps, and JSX layouts get manual instructions instead of being modified), and classify EU AI Act risk. Use this first when the user asks to make their app legally compliant, GDPR-ready, or to add a privacy policy or cookie banner; use check_compliance instead for a read-only report. Returns {done, filesWritten, documents, source, snippet, aiAct, missingFacts, agentPrompt, nextSteps} — if source is 'template' or missingFacts is non-empty, answer the agentPrompt and re-run with appName/entity/contactEmail/markets for complete documents. Aborts without writing anything if `dir` does not exist or is not a project root.

Input parameters:

- `accent` (string): Banner accent color as a CSS hex value, e.g. #4f46e5. Defaults to the LexVibe accent.
- `appId` (string): LexVibe app id (defaults to the LEXVIBE_APP_ID env var). Without a real id the snippet uses the YOUR_APP_ID placeholder and the result tells you to call claim_app.
- `appName` (string): App / business name. If omitted, it's derived from the repo (package.json / LICENSE).
- `contactEmail` (string): Privacy contact email, if already known (overrides the derived one).
- `dir` (string, required): Path of the project root to analyze (absolute paths are safest).
- `entity` (string): Data controller / legal entity, if already known (overrides the derived one).
- `lang` (string): Force the banner's language as an ISO 639-1 code, e.g. 'en' or 'es' (one of the 12 LexVibe locales). Defaults to the page's own language.
- `markets` (array): Regions where the app has users; they decide which frameworks the documents cover (eu → GDPR, uk → UK GDPR, us → CCPA/CPRA…). Defaults to ["eu"] — confirm with the user before accepting that default.
- `position` (string): Where the banner sits on screen: bottom (full-width bar), bottom-left or bottom-right (floating card in that corner). Defaults to bottom.

### `claim_app` (~513 tokens)

Create a REAL LexVibe app in the user's account (replaces the YOUR_APP_ID placeholder). Returns {claimUrl, code, expiresAt}: show claimUrl to the user so they can sign in and confirm — the link expires in 30 minutes. After they confirm, call get_claim_status with `code` to retrieve the real app id and install snippet. Requires `url` or `appName` (errors otherwise). Use this whenever no real LEXVIBE_APP_ID is configured, so hosted policies, consent proof and auto-updates get linked to the user's account; creates nothing until the user confirms the link.

Input parameters:

- `answers` (object): Compliance flags you already know (pass scan_project's suggestedAnswers): usesAnalytics, processesPayments, usesGenerativeAI, collectsEmails, sharesWithThirdParties, platformType, companyEntity, cont…
- `appName` (string): App / business name (required if no url is provided).
- `facts` (object): scan_project's `facts` object as-is: { authMethods: (apple/google/email/other)[], payments: apple_iap/google_play/stripe/other/none, ai: { userFacing, serverSide, processesPersonalData, providers },…
- `locales` (array): scan_project's `locales` — ISO 639-1 language codes the app actually supports, e.g. ['en', 'es'].
- `markets` (array): Regions where the app has users; each market pack cites its own frameworks: eu → GDPR/ePrivacy, uk → UK GDPR/PECR, us → CCPA/CPRA, ca → PIPEDA, latam → LGPD…; 'global' is NOT a union of the others —…
- `signals` (array): scan_project's `signals` — detected processing with vendor names.
- `url` (string): Public URL of the app: a website URL when answers.platformType includes 'web', or the App Store / Google Play listing URL when it's mobile-only (ios/android without web). LexVibe scans whichever kind…

### `get_claim_status` (~190 tokens)

Check whether the user has confirmed a claim created with claim_app. Returns {status: 'pending' | 'expired' | 'claimed', …}. While 'pending', wait a few seconds and call again (the link expires in 30 minutes; 'expired' ⇒ create a new claim). Once 'claimed' it adds the REAL appId, the install snippet, the hosted policyUrl, `published` (if false, do NOT install the snippet yet — the policy page would be a dead link until the user publishes from their dashboard) and a `pending` list of details the code can't know (e.g. the controller's legal name): replace any YOUR_APP_ID placeholder snippet with the real one and ask the user for the pending items. Errors on an unknown code.

Input parameters:

- `code` (string, required): The claim code returned by claim_app (not the URL — the `code` field).

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/marcosnovo-lexvibe/lexvibe-mcp#diagnostics

## Score history

- 2026-08-03: 65
- 2026-08-02: 64
- 2026-08-01: 42
- 2026-07-31: 41
- 2026-07-30: 6
- 2026-07-28: 6
- 2026-07-27: 6

## Links

- npm package: https://www.npmjs.com/package/@lexvibe/mcp
- Socket report: https://socket.dev/npm/package/@lexvibe/mcp
- Repository: https://github.com/marcosnovo/lexvibe-mcp
- Website: https://golexvibe.com/
- Changelog RSS feed: https://verifymcp.io/servers/marcosnovo-lexvibe/lexvibe-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/marcosnovo-lexvibe/lexvibe-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/marcosnovo-lexvibe/lexvibe-mcp