Vibelogin Mcp

Add authentication to your app without leaving your IDE. MCP server for Cursor, Claude Code, Windsurf, and Cline.

Just say"add authentication to my app"— the agent creates your project, configures auth methods, wires up Google OAuth, and scaffolds a working sign-in flow into your codebase. All from your editor's chat.

No global install needed. Wire it into your MCP client config once and it runs on demand viabunx.

One snippet works in every client.Paste this into your MCP settings and you're done.

{ "mcpServers": { "vibelogin": { "command": "bunx", "args": ["@vibelogin/mcp"] } } }

The first tool call opens a browser for one-click consent. After that, tokens are cached under~/.vibelogin/credentials.json— you won't be asked to log in again for 30 days.

~/Library/Application Support/Claude/claude_desktop_config.json(macOS):

{ "mcpServers": { "vibelogin": { "command": "bunx", "args": ["@vibelogin/mcp"] } } }

~/.cursor/mcp.json(or per-project.cursor/mcp.json):

{ "mcpServers": { "vibelogin": { "command": "bunx", "args": ["@vibelogin/mcp"] } } }

Same shape — every MCP client accepts acommand+argsblock. The one-liner above works in all of them.

That's it — no environment variables needed. Defaults point to production automatically.

On first use, a browser window opens for one-click consent. After that, you're authenticated for 30 days — no further prompts.

The agent picks the right tools automatically based on your conversation. Just say what you need.

Creates a new VibeLogin project in your org. Returns the project's id, slug, oauthSlug, environment, publishable key, andsecret key (shown once).

Lists every project in your org. Use this when the agent needs to discover what already exists before creating something new.

Look up a single project by id, slug, or oauthSlug.

Toggle auth methods, set redirect URLs, and/or wire up Google OAuth. Field-level updates — anything you don't set is left untouched.

If you call this withoutgoogle, the response includes the exact Google Cloud Console URL + redirect URI you need to set up the credentials.

Scaffold a working sign-in flow into your codebase. Detects the framework frompackage.jsonand writes non-destructive files (existing files are skipped, never clobbered).

Supported frameworks today:Next.js (App Router), Vite + React.Refused with guidance:Remix, Astro, Express, unknown.

middleware.ts # hostedAuthMiddleware app/auth/callback/route.ts # createCallbackHandler app/login/page.tsx # <VibeLogin /> .env.local.example # publishable key + secret placeholder

- pnpm add @vibelogin/nextjs
- Copy.env.local.example→.env.local, fillVIBELOGIN_SECRET_KEY
- pnpm dev→ open/login

src/auth/VibeLoginProvider.tsx # context + useVibeLogin() hook src/auth/Login.tsx # /login redirect to hosted UI src/auth/Callback.tsx # /auth/callback handler .env.example # VITE_-prefixed publishable key

- pnpm add @vibelogin/react react-router-dom
- Wrap<App/>in<VibeLoginProvider/>
- Add routes/loginand/auth/callback
- Copy.env.example→.env.local
- pnpm dev→ open/login

You:"Add VibeLogin to this Next.js app. Email + password and Google sign-in."

Agent:(callscreate_project { name: "myapp", environment: "production" })Createdmyapp(pk_live_…).(callsconfigure_auth { projectId, methods: { emailPassword: true } })Email + password enabled. To turn on Google, I need a Client ID and Secret from Google Cloud Console — here's the redirect URI to authorize:https://api.vibelogin.com/oauth/myapp-xyz/google/callback.(after you paste creds:)(callsconfigure_auth { google: { clientId, clientSecret } })(callsadd_auth_to_project { projectDir: ".", slug: "myapp-xyz", publishableKey: "pk_live_…", appUrl: "https://myapp.com" })Scaffold complete (next). Wrotemiddleware.ts,app/auth/callback/route.ts,app/login/page.tsx,.env.local.example. Runpnpm add @vibelogin/nextjs && pnpm devand open/login.

You:"What projects do I have already?"

Agent:(callslist_projects)You have 3:myapp(production),myapp-staging(staging),internal-tools(development).

- No secrets in the agent— authentication uses loopback OAuth + PKCE (RFC 8252)
- Single-use authorization codeswith 2-minute TTL
- Rotated refresh tokens— every refresh invalidates the previous one
- Credentials stored securely—chmod 600on~/.vibelogin/credentials.json

This is a web browser that enables your coding agent, such as Claude Code, to visit websites on your behalf and assist you in identifying bugs or creating UI test cases.

Boost security in your dev lifecycle via SAST, SCA, Secrets & IaC scanning with Cycode.

Model Context Protocol Servers Repository for OpenZeppelin Products

Enable AI agents to secure code with Semgrep.

Model Context Protocol server for Skycloak managed Keycloak. Manage clusters, realms, applications, SSO and users from any MCP client.

Dependency intelligence for AI agents. CVE scanning, health checks, upgrade planning.

Security scanner for MCP servers and AI agent tooling. Detects prompt injection, command injection, auth bypass, and excessive permissions.

Remote MCP server (Streamable HTTP) at https://mcp.agenticrail.nz/ — deterministic step-order enforcement for AI agents. evaluate_step returns ALLOW or DENY before a step runs; verify_receipt proves a sequence's Ed25519-signed, hash-chained receipt chain is intact. No auth required: omit the bearer token and calls run on the public demo key. That first clause matters — the form has no "remote/hosted" field, and putting the endpoint in the description is the convention on that list ("Fully REMOTE! Just use…"). The rest mirrors your own server card verbatim, so the listing and the card can't drift.

An engineering governance and safety control plane for AI coding agents to enforce strict SDLC discipline, quality gates, and security branch protections.

Deterministic security preflight for AI agents. Check URLs, files and shell commands before acting.

AI-powered code quality analysis to detect best practice violations, security issues, and architectural problems in real-time.