Loading…
Deploy and host AI-built websites on EU infrastructure, straight from your AI agent.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 7 days ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The vibedeploy MCP server exposes 39 tools, focused primarily on filesystem, developer, and web capabilities. Its published description reads: "Deploy and host AI-built websites on EU infrastructure, straight from your AI agent". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates vibedeploy F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Hidden instructions in a tool description" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check vibedeploy's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add vibedeploy to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://mcp.vibedeploy.be/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Return the team's plan, its limits, and current usage. Use this BEFORE deploy_site or add_custom_domain to know whether a deploy would trip a plan limit, instead of provoking PLAN_LIMIT_EXCEEDED. Also
Publish a website to a live URL. Deploy a static site or single-page app you built (with AI or by hand) to your platform subdomain (e.g. {name}.vibedeploy.be or {name}.vibedeploy.eu) with automatic SS
Patch or replace files on an existing site. Defaults to patch mode: only the listed files change; everything else stays. Pass mode:'replace' to wipe-and-replace the whole site (the legacy behaviour, s
List sites for the team this connection belongs to.
Return name, url, plan, last deploy time, and recent deploy history.
Soft-delete a site. confirm=true is required. The site moves to status 'deleted' immediately (its hostname is freed and it stops serving), and is fully purged after the team's recovery window by a swe
Return a privacy-safe traffic summary for a site over the last `period` days (default 7): total page views, distinct-visitor count, top pages, daily counts, device/browser breakdowns, and Web Vitals a
Return the bytes of one file currently served by the site. Use this to inspect or edit existing content (call read_file → modify → update_site mode:'patch') so a new chat can iterate on a site without
Batched version of read_file. Pass up to 50 paths; each is fetched independently with the same per-file rules as read_file. The whole batch is capped at 8388608 bytes total — once that's exhausted, re
Return SHA-256 + size for every file currently served. Use BEFORE re-deploying to skip files whose content hasn't changed: hash your local files, diff against this list, and only ship the differences
Return SHA-256 + size for every file in the site's editable source tree (the platform's copy of the pre-build code, not the served dist). Use BEFORE editing so you know which paths exist and which hav
Return the bytes of one source file (the platform's editable copy of the pre-build code), letting an AI in any future chat fetch and edit content without needing the original local files. Use list_sou
Batched read across the editable source tree (up to 50 paths). Each entry is independent: a missing/oversized file fails its own slot but doesn't abort the batch. Cumulative cap 8388608 bytes; remaind
Stage edits to a site's editable source tree (not the live dist). Use list_source_files first to discover what's there. The dist is unchanged until you re-deploy via update_site or run build_and_deplo
Remove one file from the site's editable source tree. The served dist is unchanged.
Run a build inside a hardened one-shot pod against the site's editable source tree (write source first via write_source_files / list_source_files autoPromote), then atomically swap the build output in
Search for a literal string or basic regex across all files in either the served dist or the editable source tree. Use this BEFORE batch-reading files to find candidates — saves the 'read 14 batches j
Publish a website to a live URL from a public archive link. Point this at a tar(.gz) archive on github / gist / S3 and the server fetches and deploys it, no upload from your side. Server-side fetch of
Download the external images a site references (e.g. from the old site it was rebuilt from), store them on this VibeDeploy site under assets/img/, and rewrite the HTML <img> references to local paths
Apply one or more literal find/replace edits to a single file on the site, in one tool call. Designed for tiny edits where uploading the full file would be wasteful (one nav-button reference, one enco
Apply find/replace edits across MANY files in one tool call. Batch sibling of update_file_content. Per-file edit semantics identical (count: 1 default, -1 = all, positive int asserts exact count). Who
Read the form-to-email relay config of a site, plus the resolved delivery mode, the active From address, and (for a custom sender domain) the DNS records to publish and their verification status. Subm
Configure the built-in form-to-email relay, fully self-service. Supports a custom From (via a verified sender domain or your own SMTP relay), an explicit Reply-To, and full email branding (subject tem
Check the DNS records for a site's custom sender domain (DKIM TXT + SPF include). Once the DKIM record is observed, the sender domain is marked verified and the relay sends from the custom From (DKIM-
Start attaching a user-owned domain to an existing site. Returns a TXT record the user must add at their DNS provider. Idempotent: calling twice with the same (siteName, domain) returns the existing r
Check the TXT record the user added at step 1 and, if found, attach the domain to the site's ingress. If verification fails, the most common cause is DNS propagation delay; wait a few minutes and try
Remove a custom domain from a site. The site itself is unaffected; only the custom hostname is detached. The {name}.vibedeploy.be subdomain keeps serving the site.
Return all custom domains attached to a site. Each entry has a recordId you can pass to verify_custom_domain or remove_custom_domain.
Read the DNS records VibeDeploy tracks for a site (the records it created/manages on your behalf), oldest first. Returns each record's host, type, and value. Any team member, including viewers, can re
Check whether a domain can be registered and get an INDICATIVE retail price. IMPORTANT: this is a read-only lookup — it does NOT buy, register, reserve, or pay for any domain, and it changes nothing.
Opens a staging session for a multi-call deploy. Use when the site is too large to fit in a single deploy_site/update_site call. Pair with add_files (one or more times) OR a single tarball upload to t
Append files to an open staging session. Call as many times as needed; commit_deploy applies them all at once. Validates path/extension/encoding on every call so a bad file fails fast. Same 500 MB cap
Stream a single file across multiple calls when its content exceeds the per-MCP-call output budget. LAST RESORT — try these first: (1) add_files with encoding:'gzip+base64' fits ~250 KB of text source
Atomically apply a staging session's files to the live site. Runs preflight + secret/malware scan against the complete staged set; on failure the session stays open and can be re-attempted or aborted.
Discard a staging session and its scratch dir. Live site is untouched. Returns immediately; cleanup is best-effort and the sweeper will retry if it fails.
Return staging sessions for the team this token belongs to. Defaults to currently-active ones (open + committing). Up to 50 rows.
Return the most recent 50 deploy and snapshot history entries for a site, newest first. Includes the source (how it was triggered), an optional label, the associated Longhorn snapshot name (if any), t
List the Longhorn volume snapshots for a site. Snapshots are point-in-time backups of the site's served files. Any team member can list snapshots. Returns NO_VOLUME if the site has no volume yet (it h
Take a point-in-time Longhorn snapshot of a site's served files. This is an additive backup — it does not change anything served. It records a manual-snapshot history entry and runs retention cleanup.
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: check_domain_availability
A tool description contains imperative text aimed at the model (e.g. "ignore previous", "before answering read …").
E retail price. IMPORTANT: this is a read-only lookup — it does NOT buy, rRecommendationRemove model-directed instructions from tool descriptions.
tool: get_account
A tool description tries to alter the model’s use of another tool.
XCEEDED. Also returns the per-token MCP rate-limit ceiling (live remainingRecommendationDescriptions must describe only their own tool.
tool: deploy_site
A tool description tries to alter the model’s use of another tool.
is touched. Use update_site (default mode:'patch') if you want to add or chRecommendationDescriptions must describe only their own tool.
tool: update_site
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
n patch mode to remove specific files without wiping the rest. Use `dryRun: true` toRecommendationAnnotate destructive tools and require human approval.
tool: update_site
A tool description tries to alter the model’s use of another tool.
refer that over begin_deploy + add_file_chunk streaming. Errors if the siteRecommendationDescriptions must describe only their own tool.
tool: read_file
A tool description tries to alter the model’s use of another tool.
file → modify → update_site mode:'patch') so a new chat can iterate on a siRecommendationDescriptions must describe only their own tool.
tool: read_files
A tool description tries to alter the model’s use of another tool.
ched version of read_file. Pass up to 50 paths; each is fetched independeRecommendationDescriptions must describe only their own tool.
tool: list_file_hashes
A tool description tries to alter the model’s use of another tool.
differences via update_site mode:'patch' or begin_deploy → add_files. For SRecommendationDescriptions must describe only their own tool.
tool: read_source_file
A tool description tries to alter the model’s use of another tool.
erved dist, use read_file instead.RecommendationDescriptions must describe only their own tool.
tool: read_source_file
One tool reads private data, ingests untrusted content, AND can send data outbound — the three preconditions for autonomous data theft in a single call. A prompt injection reaching this tool can exfiltrate secrets with no further step.
any future chat fetch and edit content without needing the original local files. Use lRecommendationSplit the capabilities across separate least-privilege tools so no single tool can read secrets, read untrusted input, and reach the network at once.
tool: write_source_files
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
te_source_files Write files into the editable source tree Stage edits to aRecommendationAnnotate destructive tools and require human approval.
tool: write_source_files
A tool description tries to alter the model’s use of another tool.
u re-deploy via update_site or run build_and_deploy. Sites have source storRecommendationDescriptions must describe only their own tool.
tool: delete_source_file
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
ete_source_file Delete a file from the source tree Remove one file from the sRecommendationAnnotate destructive tools and require human approval.
tool: build_and_deploy
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: deploy_from_url
A tool description tries to alter the model’s use of another tool.
. Equivalent to begin_deploy → POST uploadUrl → commit_deploy in one call. HRecommendationDescriptions must describe only their own tool.
tool: update_file_content
A tool description tries to alter the model’s use of another tool.
ll need to call build_and_deploy.RecommendationDescriptions must describe only their own tool.
tool: apply_edits
A tool description tries to alter the model’s use of another tool.
atch sibling of update_file_content. Per-file edit semantics identical (count: 1 deRecommendationDescriptions must describe only their own tool.
tool: get_forms_config
One tool reads private data, ingests untrusted content, AND can send data outbound — the three preconditions for autonomous data theft in a single call. A prompt injection reaching this tool can exfiltrate secrets with no further step.
nfig for a site Read the form-to-email relay config of a site, plus the resolved delivRecommendationSplit the capabilities across separate least-privilege tools so no single tool can read secrets, read untrusted input, and reach the network at once.
tool: set_forms_config
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ype":"string"},"password":{"description":"Set to store/replace (encrypteRecommendationRemove side-channel parameters; constrain tool inputs.
tool: set_forms_config
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: add_custom_domain
A tool description tries to alter the model’s use of another tool.
the TXT is published (typically within minutes; up to 24h), call verify_cuRecommendationDescriptions must describe only their own tool.
tool: list_custom_domains
A tool description tries to alter the model’s use of another tool.
you can pass to verify_custom_domain or remove_custom_domain.RecommendationDescriptions must describe only their own tool.
tool: check_domain_availability
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
es a valid team token but is not tied to a specific site. {"$schema":RecommendationRemove side-channel parameters; constrain tool inputs.
tool: begin_deploy
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
ssion limit per token: 5. Default TTL: 1 hour. {"$schema":"http://jsoRecommendationRemove side-channel parameters; constrain tool inputs.
tool: begin_deploy
A tool description tries to alter the model’s use of another tool.
fit in a single deploy_site/update_site call. Pair with add_files (one or mRecommendationDescriptions must describe only their own tool.
tool: add_files
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
ronment can run shell but can't reach this host, gzip+base64 via add_RecommendationAnnotate destructive tools and require human approval.
tool: add_files
A tool description tries to alter the model’s use of another tool.
each this host, begin_deploy's uploadUrl (tarball POST, 100 MB) beats everytRecommendationDescriptions must describe only their own tool.
tool: add_file_chunk
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
t's tool-output token budget, NOT by VibeDeploy's server. EmpiricallyRecommendationRemove side-channel parameters; constrain tool inputs.
tool: add_file_chunk
A tool description tries to alter the model’s use of another tool.
edeploy.be; (3) deploy_from_url if the files are fetchable from a public URL. ORecommendationDescriptions must describe only their own tool.
tool: commit_deploy
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
via add_files, delete old path here).","type":"array","items":{"type":"string"RecommendationAnnotate destructive tools and require human approval.
tool: list_history
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
deploy/snapshot history for a site Return the most recent 50 deploy andRecommendationRemove side-channel parameters; constrain tool inputs.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: deploy_site
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: update_site
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: update_site
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
accident). Use `delete: [paths]` in patch mode to remove specific files withouRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: delete_site
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: read_file
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
read_file Read a file from a deployed site Return the bytes of one fiRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: read_file
A filesystem tool exposes a path parameter that is a free-form string with no pattern/enum/format constraint, so it accepts absolute paths and "../" traversal. A tool that constrains its path (a rooted `pattern` or an `enum`) does not fire.
unconstrained path parameter "path"RecommendationConstrain the path parameter to a rooted allow-list and reject absolute/traversal paths server-side.
tool: read_files
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
read_files Read multiple files from a deployed site in one call Batched versioRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: read_source_file
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
ead_source_file Read a file from the editable source tree Return the bytesRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: read_source_files
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
ad_source_files Read multiple source files in one call Batched read across the editable soRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: write_source_files
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: write_source_files
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
te_source_files Write files into the editable source tree Stage edits to aRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: delete_source_file
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: delete_source_file
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
ete_source_file Delete a file from the source tree Remove one file from the sRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: delete_source_file
A filesystem tool exposes a path parameter that is a free-form string with no pattern/enum/format constraint, so it accepts absolute paths and "../" traversal. A tool that constrains its path (a rooted `pattern` or an `enum`) does not fire.
unconstrained path parameter "path"RecommendationConstrain the path parameter to a rooted allow-list and reject absolute/traversal paths server-side.
tool: build_and_deploy
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: search_files
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
rep so we don't read non-matching files.","type":"string"},"maxMatches":{"description":RecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: deploy_from_url
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: rehost_images
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: update_file_content
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: update_file_content
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
al find/replace edits to a single file on the site, in one tool call. Designed for tinRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: update_file_content
A filesystem tool exposes a path parameter that is a free-form string with no pattern/enum/format constraint, so it accepts absolute paths and "../" traversal. A tool that constrains its path (a rooted `pattern` or an `enum`) does not fire.
unconstrained path parameter "path"RecommendationConstrain the path parameter to a rooted allow-list and reject absolute/traversal paths server-side.
tool: apply_edits
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: apply_edits
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
ly find/replace edits across MANY files in one tool call. Batch sibling of update_file_RecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: set_forms_config
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: verify_forms_sender_domain
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: add_custom_domain
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: verify_custom_domain
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: remove_custom_domain
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: check_domain_availability
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: begin_deploy
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: add_files
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: add_files
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
staging session Append files to an open staging session. Call as many timesRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: add_file_chunk
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: add_file_chunk
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
add_file_chunk Append one chunk of a single file to a staging session Stream a single file acrosRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: commit_deploy
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: commit_deploy
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
ul for renames (write new path via add_files, delete old path here).","type":"RecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: abort_deploy
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: create_snapshot
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.