VibeScale

io.github.Ranqint/vibescaleVersion 1.0.1

For app builders in Israel: pre-launch checks for leaked keys, Supabase RLS, exposed env vars.

Status

Responds225 msNov 14, 2026, 14:41 UTCAnswered our handshake without sign-in.

Registry data may be out of date

We could not refresh it, so this page shows the last copy.

Last checked: Nov 14, 2026, 14:41 UTC
Latency: 225 ms
Remotes responding: 1 of 1
Sign-in: No sign-in
Hosting: Hosted outside the EU (detected)
Registry data as of: Nov 14, 2026, 22:14 UTC

Data from the official MCP Registry, checked by run.zero. How we check

Connect

Streamable HTTP

https://vibe.elya-studio.com/mcpResponds225 msNov 14, 2026, 14:41 UTC

No sign-in

Claude Code

claude mcp add --transport http vibescale https://vibe.elya-studio.com/mcp

Claude Desktop and claude.ai

1
2
3

Settings > Connectors > Add custom connector
Name: vibescale
Remote MCP server URL: https://vibe.elya-studio.com/mcp

Cursor

{
  "mcpServers": {
    "vibescale": {
      "url": "https://vibe.elya-studio.com/mcp"
    }
  }
}

VS Code

code --add-mcp '{"name":"vibescale","type":"http","url":"https://vibe.elya-studio.com/mcp"}'

Built your own server? run.zero hosts MCP servers on European infrastructure.

Host your own MCP server on run.zero

Tools

3 tools

Tools of VibeScale
	Description		Read-only	Idempotent	Open world
`check_env_exposure`Takes environment variable NAMES (never values) and says, for each one, whether the build tool ships it to every visitor (VITE_, NEXT_PUBLIC_, EXPO_PUBLIC_, REACT_APP_, PUBLIC_, GATSBY_, NUXT_PUBLIC_) and whether its name looks like a server secret that must not be there. Use when someone asks whether their .env or API keys are exposed in a Lovable, Bolt, Vite, Next.js or Expo app. Send names only; if a value is included it is dropped and not stored. Explanations are in Hebrew.	Takes environment variable NAMES (never values) and says, for each one, whether the build tool ships it to every visitor (VITE_, NEXT_PUBLIC_, EXPO_PUBLIC_, REACT_APP_, PUBLIC_, GATSBY_, NUXT_PUBLIC_) and whether its name looks like a server secret that must not be there. Use when someone asks whether their .env or API keys are exposed in a Lovable, Bolt, Vite, Next.js or Expo app. Send names only; if a value is included it is dropped and not stored. Explanations are in Hebrew.	No	Yes	Yes	No
`lint_supabase_rls`Reads Supabase SQL (migrations or a schema dump) as text and lists tables in exposed schemas without row level security, RLS with no policy, policies that allow everything or read user_metadata, policies without a role, write grants to anon, SECURITY DEFINER functions and views, new tables without a grant, and public storage buckets, each with SQL that fixes it. Use when someone asks whether their Supabase database is locked down, or before launching an app that uses Supabase. The SQL is never executed or stored; policy logic (who should see what) is not judged. Findings are in Hebrew.	Reads Supabase SQL (migrations or a schema dump) as text and lists tables in exposed schemas without row level security, RLS with no policy, policies that allow everything or read user_metadata, policies without a role, write grants to anon, SECURITY DEFINER functions and views, new tables without a grant, and public storage buckets, each with SQL that fixes it. Use when someone asks whether their Supabase database is locked down, or before launching an app that uses Supabase. The SQL is never executed or stored; policy logic (who should see what) is not judged. Findings are in Hebrew.	No	Yes	Yes	No
`scan_app_launch_readiness`Reads one public web app the way a browser does (its HTML, the same-site scripts it loads and any source maps they point to) and reports what any visitor can already see: server secret keys shipped to the browser (Supabase service_role, OpenAI, Anthropic, Stripe, AWS, GitHub, SendGrid, Resend; shown masked), a published source map, no HTTPS, and missing Content-Security-Policy, HSTS or frame protection. Use when someone built an app with Lovable, Base44, Bolt, Cursor, Replit or similar and asks whether it is safe to launch or whether a key leaked. It does not sign in, guess paths or query the app's database. Findings are in Hebrew.	Reads one public web app the way a browser does (its HTML, the same-site scripts it loads and any source maps they point to) and reports what any visitor can already see: server secret keys shipped to the browser (Supabase service_role, OpenAI, Anthropic, Stripe, AWS, GitHub, SendGrid, Resend; shown masked), a published source map, no HTTPS, and missing Content-Security-Policy, HSTS or frame protection. Use when someone built an app with Lovable, Base44, Bolt, Cursor, Replit or similar and asks whether it is safe to launch or whether a key leaked. It does not sign in, guess paths or query the app's database. Findings are in Hebrew.	No	Yes	Yes	Yes

Details

Registry status: Active
Published: Nov 14, 2026
Updated: Nov 14, 2026
Website: https://vibe.elya-studio.com/tools/chatgpt-claude⁠ (opens in a new tab)
Repository: Not given
Categories (suggested): Developer tools DatabasesSuggested categories are assigned automatically from the registry text and may be wrong. Verified operators can correct them.
GDPR: Not declared

Are you the operator? Claim this listing